Edit tour

Windows Analysis Report
https://ms-1drive.com/v/794850bf-f104-442e-acb0-475634834dda

Overview

General Information

Sample URL:	https://ms-1drive.com/v/794850bf-f104-442e-acb0-475634834dda
Analysis ID:	1446913
Infos:

Detection

Score:	68
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

AI detected phishing page

Antivirus / Scanner detection for submitted sample

Phishing site detected (based on favicon image match)

AI detected suspicious javascript

Detected non-DNS traffic on DNS port

Detected suspicious crossdomain redirect

Found iframes

HTML body contains low number of good links

HTML title does not match URL

Submit button contains javascript call

Classification

Process Tree

System is w10x64

chrome.exe (PID: 7052 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 5884 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 --field-trial-handle=1992,i,13347417480078568118,3404620895166196032,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 4864 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=6524 --field-trial-handle=1992,i,13347417480078568118,3404620895166196032,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 2192 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6460 --field-trial-handle=1992,i,13347417480078568118,3404620895166196032,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 6480 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://ms-1drive.com/v/794850bf-f104-442e-acb0-475634834dda" MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: https://ms-1drive.com/v/794850bf-f104-442e-acb0-475634834dda	Avira URL Cloud: detection malicious, Label: phishing
Source: https://ms-1drive.com/v/794850bf-f104-442e-acb0-475634834dda	SlashNext: detection malicious, Label: Credential Stealing type: Phishing & Social usering

Phishing

AI detected phishing page

Source: https://ms-1drive.com/v/794850bf-f104-442e-acb0-475634834dda

LLM: Score: 9 brands: OneDrive Reasons: The URL 'https://ms-1drive.com/v/794850bf-f104-442e-acb0-475634834dda' is suspicious because it does not match the legitimate domain for OneDrive, which is 'onedrive.live.com'. The use of 'ms-1drive.com' is a common phishing technique to mimic legitimate services. The page includes a login form, which is a common tactic in phishing to steal credentials. The presence of a medical report PDF is also a social usering technique to entice users to click on the download link. DOM: 0.0.pages.csv

Source: https://ms-1drive.com	Matcher: Template: onedrive matched with high similarity
Source: https://ms-1drive.com/v/794850bf-f104-442e-acb0-475634834dda	Matcher: Template: onedrive matched with high similarity

Source: https://signup.live.com/signup?lic=1&uaid=368a97c0ecf841f8bdc9940f325083c6	LLM: Score: 7 Reasons: The code attempts to break out of an iframe by replacing the top-level window's location with the current location. This behavior is often associated with phishing attempts to prevent detection and ensure the malicious content is displayed in the full browser window. Additionally, the use of 'document.write' to inject HTML can be risky as it may lead to cross-site scripting (XSS) vulnerabilities. DOM: 3.4.pages.csv
Source: https://fpt.live.com/?session_id=368a97c0ecf841f8bdc9940f325083c6&CustomerId=33e01921-4d64-4f8c-a055-5bdaffd5e33d&PageId=SU	LLM: Score: 7 Reasons: The code contains suspicious elements such as hardcoded URLs that appear to be related to phishing attempts, the use of obfuscated or encoded strings, and the collection of potentially sensitive information about plugins and fonts. These characteristics are often associated with malicious activities. DOM: 4.5.pages.csv
Source: https://signup.live.com/signup?lic=1&uaid=368a97c0ecf841f8bdc9940f325083c6	LLM: Score: 7 Reasons: The provided JavaScript code contains long random hexadecimal strings which are typically used for cryptographic purposes. However, the presence of such strings without context or explanation can be suspicious. The variables 'Key', 'randomNum', and 'SKI' might be used for encryption or obfuscation, which is a common technique in malicious scripts to hide their true purpose. Without further context or additional code, it is difficult to determine the exact intent, but the use of such obfuscation techniques raises a moderate to high risk of potential malicious activity. DOM: 3.4.pages.csv
Source: https://fpt2.microsoft.com/Clear.HTML?ctx=Ls1.0&wl=False&session_id=368a97c0ecf841f8bdc9940f325083c6&id=202f4ae7-3b8e-4b75-4b18-6e1e9641e2f2&w=8DC7B7BA93AC1DA&tkt=taBcrIH61PuCVH7eNCyH0K%252fD9DJ44Cptuv0RyrXgXCvIo0u9ttCEbLuRCYXcmaPsbemRxwam7Kqh9GtF9dO	LLM: Score: 7 Reasons: The code interacts with localStorage and sends potentially sensitive information (session_id, CustomerId, authKey) to external URLs. This behavior is typical of tracking but can also be used for malicious purposes such as session hijacking or data exfiltration. The use of obfuscated strings and the lack of clear documentation or context further increase the risk. DOM: 5.6.pages.csv

Source: https://signup.live.com/signup?lic=1&uaid=368a97c0ecf841f8bdc9940f325083c6	HTTP Parser: Number of links: 0
Source: https://login.microsoftonline.com/common/oauth2/authorize?client_id=9ea1ad79-fdb6-4f9a-8bc3-2b70f96e34c7&response_type=id_token+code&nonce=c5d9c3ef-2680-4d1c-8acd-fc7480429940&redirect_uri=https%3a%2f%2fcopilot.microsoft.com%2forgid%2fidtoken%2fconditional&scope=openid%20email%20profile%209ea1ad79-fdb6-4f9a-8bc3-2b70f96e34c7/.default&response_mode=form_post&instance_aware=true&msafed=0&prompt=none&state=%7b%22ig%22%3a%22C6FC439E01C9419EBF3A0CEEDF92AB54%22%7d	HTTP Parser: Number of links: 0

Source: https://login.live.com/login.srf	HTTP Parser: Title: Sign in to your Microsoft account does not match URL
Source: https://signup.live.com/signup?lic=1&uaid=368a97c0ecf841f8bdc9940f325083c6	HTTP Parser: Title: Create account does not match URL
Source: https://login.microsoftonline.com/common/oauth2/authorize?client_id=9ea1ad79-fdb6-4f9a-8bc3-2b70f96e34c7&response_type=id_token+code&nonce=c5d9c3ef-2680-4d1c-8acd-fc7480429940&redirect_uri=https%3a%2f%2fcopilot.microsoft.com%2forgid%2fidtoken%2fconditional&scope=openid%20email%20profile%209ea1ad79-fdb6-4f9a-8bc3-2b70f96e34c7/.default&response_mode=form_post&instance_aware=true&msafed=0&prompt=none&state=%7b%22ig%22%3a%22C6FC439E01C9419EBF3A0CEEDF92AB54%22%7d	HTTP Parser: Title: Redirecting does not match URL

Source: https://signup.live.com/signup?lic=1&uaid=368a97c0ecf841f8bdc9940f325083c6	HTTP Parser: On click: OnBack(); return false;
Source: https://signup.live.com/signup?lic=1&uaid=368a97c0ecf841f8bdc9940f325083c6	HTTP Parser: On click: HOSTUI.evt_inlineBack_onclick();
Source: https://signup.live.com/signup?lic=1&uaid=368a97c0ecf841f8bdc9940f325083c6	HTTP Parser: On click: HOSTUI.evt_inlineBack_onclick();

Source: https://fpt.live.com/?session_id=368a97c0ecf841f8bdc9940f325083c6&CustomerId=33e01921-4d64-4f8c-a055-5bdaffd5e33d&PageId=SU	HTTP Parser: No favicon
Source: about:blank	HTTP Parser: No favicon
Source: https://login.microsoftonline.com/common/oauth2/authorize?client_id=9ea1ad79-fdb6-4f9a-8bc3-2b70f96e34c7&response_type=id_token+code&nonce=c5d9c3ef-2680-4d1c-8acd-fc7480429940&redirect_uri=https%3a%2f%2fcopilot.microsoft.com%2forgid%2fidtoken%2fconditional&scope=openid%20email%20profile%209ea1ad79-fdb6-4f9a-8bc3-2b70f96e34c7/.default&response_mode=form_post&instance_aware=true&msafed=0&prompt=none&state=%7b%22ig%22%3a%22C6FC439E01C9419EBF3A0CEEDF92AB54%22%7d	HTTP Parser: No favicon
Source: https://www.bing.com/secure/Passport.aspx?popup=1&ssl=1	HTTP Parser: No favicon

Source: https://login.live.com/login.srf	HTTP Parser: No <meta name="author".. found
Source: https://login.live.com/login.srf	HTTP Parser: No <meta name="author".. found
Source: https://signup.live.com/signup?lic=1&uaid=368a97c0ecf841f8bdc9940f325083c6	HTTP Parser: No <meta name="author".. found
Source: https://login.microsoftonline.com/common/oauth2/authorize?client_id=9ea1ad79-fdb6-4f9a-8bc3-2b70f96e34c7&response_type=id_token+code&nonce=c5d9c3ef-2680-4d1c-8acd-fc7480429940&redirect_uri=https%3a%2f%2fcopilot.microsoft.com%2forgid%2fidtoken%2fconditional&scope=openid%20email%20profile%209ea1ad79-fdb6-4f9a-8bc3-2b70f96e34c7/.default&response_mode=form_post&instance_aware=true&msafed=0&prompt=none&state=%7b%22ig%22%3a%22C6FC439E01C9419EBF3A0CEEDF92AB54%22%7d	HTTP Parser: No <meta name="author".. found

Source: https://login.live.com/login.srf	HTTP Parser: No <meta name="copyright".. found
Source: https://login.live.com/login.srf	HTTP Parser: No <meta name="copyright".. found
Source: https://signup.live.com/signup?lic=1&uaid=368a97c0ecf841f8bdc9940f325083c6	HTTP Parser: No <meta name="copyright".. found
Source: https://login.microsoftonline.com/common/oauth2/authorize?client_id=9ea1ad79-fdb6-4f9a-8bc3-2b70f96e34c7&response_type=id_token+code&nonce=c5d9c3ef-2680-4d1c-8acd-fc7480429940&redirect_uri=https%3a%2f%2fcopilot.microsoft.com%2forgid%2fidtoken%2fconditional&scope=openid%20email%20profile%209ea1ad79-fdb6-4f9a-8bc3-2b70f96e34c7/.default&response_mode=form_post&instance_aware=true&msafed=0&prompt=none&state=%7b%22ig%22%3a%22C6FC439E01C9419EBF3A0CEEDF92AB54%22%7d	HTTP Parser: No <meta name="copyright".. found

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.6:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.6:49716 version: TLS 1.2

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /v/794850bf-f104-442e-acb0-475634834dda HTTP/1.1Host: ms-1drive.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /css/onedrive.css HTTP/1.1Host: ms-1drive.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://ms-1drive.com/v/794850bf-f104-442e-acb0-475634834ddaAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /img/pdf.png HTTP/1.1Host: ms-1drive.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ms-1drive.com/v/794850bf-f104-442e-acb0-475634834ddaAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: ms-1drive.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ms-1drive.com/v/794850bf-f104-442e-acb0-475634834ddaAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /img/pdf.png HTTP/1.1Host: ms-1drive.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: ms-1drive.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: onedrive.live.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/5/js/login_en_31OakWsQhbXgK7L_U0YNNw2.js HTTP/1.1Host: logincdn.msftauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://login.live.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://login.live.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/5/images/microsoft_logo_ee5c8d9fb6248c938fd0.svg HTTP/1.1Host: logincdn.msftauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://login.live.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/5/chunks/oneds-analytics-js_54b1724af1b05e2ba3db_en.js HTTP/1.1Host: logincdn.msftauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://login.live.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://login.live.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/5/images/2_bc3d32a696895f78c19d.svg HTTP/1.1Host: logincdn.msftauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://login.live.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/5/images/signin_options_4e48046ce74f4b89d450.svg HTTP/1.1Host: logincdn.msftauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://login.live.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/5/images/microsoft_logo_ee5c8d9fb6248c938fd0.svg HTTP/1.1Host: logincdn.msftauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/5/images/2_bc3d32a696895f78c19d.svg HTTP/1.1Host: logincdn.msftauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /16.000.30238.3/images/favicon.ico HTTP/1.1Host: logincdn.msftauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://login.live.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/5/images/signin_options_4e48046ce74f4b89d450.svg HTTP/1.1Host: logincdn.msftauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /16.000.30238.3/images/favicon.ico HTTP/1.1Host: logincdn.msftauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /converged_ux_v2_nBE5FSqn9KpH44ZlTc3VqQ2.css?v=1 HTTP/1.1Host: acctcdn.msftauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://signup.live.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: styleReferer: https://signup.live.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /jqueryshim_hlu0tTfjWJFWYNt1WZrVqg2.js?v=1 HTTP/1.1Host: acctcdn.msftauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://signup.live.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://signup.live.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /knockout_3.3.0_X1BYS2jZMbi7hfUj8VuqFA2.js?v=1 HTTP/1.1Host: acctcdn.msftauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://signup.live.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://signup.live.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /lwsignupstringscountrybirthdate_en-us_gdxUIqa3ijrOefuBnwhTKg2.js?v=1 HTTP/1.1Host: acctcdn.msftauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://signup.live.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://signup.live.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /lightweightsignuppackage_xUzYzJceL8JC5cjTFIHHBQ2.js?v=1 HTTP/1.1Host: acctcdn.msftauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://signup.live.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://signup.live.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /images/microsoft_logo_7lyNn7YkjJOP0NwZNw6QvQ2.svg HTTP/1.1Host: acctcdn.msftauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://signup.live.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /images/microsoft_logo_7lyNn7YkjJOP0NwZNw6QvQ2.svg HTTP/1.1Host: acctcdn.msftauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /images/favicon.ico?v=2 HTTP/1.1Host: acctcdn.msftauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://signup.live.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /oneds_MC5gQfpbTUjLu60sQCwU1w2.js?v=1 HTTP/1.1Host: acctcdn.msftauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://signup.live.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /datarequestpackage_h-_7C7UzwdefXJT9njDBTQ2.js HTTP/1.1Host: acctcdn.msftauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://signup.live.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://signup.live.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /images/2_vD0yppaJX3jBnfbHF1hqXQ2.svg HTTP/1.1Host: acctcdn.msftauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://signup.live.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /images/favicon.ico?v=2 HTTP/1.1Host: acctcdn.msftauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /images/2_vD0yppaJX3jBnfbHF1hqXQ2.svg HTTP/1.1Host: acctcdn.msftauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /px?id=1776578&t=2 HTTP/1.1Host: secure.adnxs.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bounce?%2Fpx%3Fid%3D1776578%26t%3D2 HTTP/1.1Host: secure.adnxs.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: XANDR_PANID=5WjnP_WkGZ_O4OjIHi9hXGUqFsqMtYENMVtLZ_4nxmgLX3ApHNCCauxPjFC8eTlriS6kxrza28F8dUlLyz8oh4q66GfJOdWJA_skstrYSno.; receive-cookie-deprecation=1; uuid2=8390600150162661499
Source: global traffic	HTTP traffic detected: GET /bounce?%2Fpx%3Fid%3D1776578%26t%3D2 HTTP/1.1Host: secure.adnxs.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: uuid2=8390600150162661499; anj=dTM7k!M4/8CxrEQF']wIg2E>9v:j>B!]tbP6j2F-XstGt!@E(1%'?oW
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/BssoInterrupt_Core_RY3pVDLvjU_KKLtTKxjDFA2.js HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://login.microsoftonline.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: chromecache_306.2.dr	String found in binary or memory: (function() { var sharingGlobalConfig ={"thumbnailUrlFormat":"https://www.bing.com/th?id={0}","defaultFormCode":"EX0023","facebookShareFormat":"https://www.facebook.com/dialog/feed?app_id={3}\u0026display=popup\u0026link={0}\u0026redirect_uri={1}\u0026ref={2}","facebookMessengerUrlFormat":"http://www.facebook.com/dialog/send?app_id={0}\u0026display=popup\u0026link={1}\u0026redirect_uri={2}","facebookFormCode":"EX0023","fbInitialHeight":576,"fbmInitialWidth":640,"facebookAppId":"3732605936979161","twitterApi":"https://twitter.com/intent/tweet?hashtags={0}\u0026text={1}\u0026url={2}","twitterFormCode":"EX0024","twitterInitialHeight":576,"twitterInitialWidth":720,"defaultInitialHeight":255,"whatsAppSchema":"whatsapp://send?text={0}","whatsAppStoreUrl":"","whatsAppFormCode":"EX0053","mailLauncherUrl":"mailto:?subject={0} \u0026body={1}","mailFormCode":"EX0025","smsProtocol":"","smsFormCode":"EX0052","loadingUrl":"/loading","useBlankLoadingPage":false,"closeRedirectUrl":"/share/fbre","pinterestUrlFormat":"https://pinterest.com/pin/create/button/?url={0}\u0026media={1}\u0026description={2}","pinterestFormCode":"EX0051","mybingFormCode":"shtomb","mybingRedirectUrl":"https://www.bing.com/myprofile?tid=id_chatmessagetab\u0026FORM=shtomb","skypeUrlFormat":"https://web.skype.com/share?url={0}\u0026source=button\u0026text={1}","skypeInitialHeight":665,"skypeInitialWidth":305,"outlookComLauncherUrl":"https://outlook.live.com/owa/?subject={0}\u0026body={1}\u0026path=/mail/action/compose","gmailLauncherUrl":"https://mail.google.com/mail/?view=cm\u0026fs=1\u0026tf=1\u0026su={0}\u0026body={1}","linkedInUrlFormat":"https://www.linkedin.com/shareArticle?mini=true\u0026url={0}\u0026title={1}\u0026summary={2}","linkedInFormCode":"EX0062","oneNoteUrlFormat":"https://www.onenote.com/clipper/save?attributionUrl={0}\u0026sourceUrl={1}\u0026imgUrl={1}\u0026title={2}\u0026description={3}","oneNoteInitialHeight":565,"oneNoteInitialWidth":550,"oneNoteFormCode":"EX0060","checkAppInstall":"","checkAppTimeout":200,"weiboShareFormat":"https://service.weibo.com/share/share.php?title={0}\u0026placeholder=Bing\u0026url={1}\u0026pic={2}","weiboFormCode":"SHDLWE","qzoneShareFormat":"https://sns.qzone.qq.com/cgi-bin/qzshare/cgi_qzshare_onekey?title={0}\u0026summary={1}\u0026url={2}\u0026pics={3}","qzoneFormCode":"SHDLQZ","isCNEnglishSearch":false,"redditShareFormat":"https://www.reddit.com/submit?url={0}\u0026title={1}","redditFormCode":"EX0061","useLocationReplace":false,"getUrlFormCode":"EX0050","enableGetShareLinkFromServerForGetUrl":true,"isUnderside":false}; if(sj_evt) { sj_evt.fire("GlobalActionMenuV2Wrapper.InitSharingGlobalConfig", sharingGlobalConfig); } })();; equals www.facebook.com (Facebook)
Source: chromecache_202.2.dr, chromecache_306.2.dr	String found in binary or memory: (function() { var sharingGlobalConfig ={"thumbnailUrlFormat":"https://www.bing.com/th?id={0}","defaultFormCode":"EX0023","facebookShareFormat":"https://www.facebook.com/dialog/feed?app_id={3}\u0026display=popup\u0026link={0}\u0026redirect_uri={1}\u0026ref={2}","facebookMessengerUrlFormat":"http://www.facebook.com/dialog/send?app_id={0}\u0026display=popup\u0026link={1}\u0026redirect_uri={2}","facebookFormCode":"EX0023","fbInitialHeight":576,"fbmInitialWidth":640,"facebookAppId":"3732605936979161","twitterApi":"https://twitter.com/intent/tweet?hashtags={0}\u0026text={1}\u0026url={2}","twitterFormCode":"EX0024","twitterInitialHeight":576,"twitterInitialWidth":720,"defaultInitialHeight":255,"whatsAppSchema":"whatsapp://send?text={0}","whatsAppStoreUrl":"","whatsAppFormCode":"EX0053","mailLauncherUrl":"mailto:?subject={0} \u0026body={1}","mailFormCode":"EX0025","smsProtocol":"","smsFormCode":"EX0052","loadingUrl":"/loading","useBlankLoadingPage":false,"closeRedirectUrl":"/share/fbre","pinterestUrlFormat":"https://pinterest.com/pin/create/button/?url={0}\u0026media={1}\u0026description={2}","pinterestFormCode":"EX0051","mybingFormCode":"shtomb","mybingRedirectUrl":"https://www.bing.com/myprofile?tid=id_chatmessagetab\u0026FORM=shtomb","skypeUrlFormat":"https://web.skype.com/share?url={0}\u0026source=button\u0026text={1}","skypeInitialHeight":665,"skypeInitialWidth":305,"outlookComLauncherUrl":"https://outlook.live.com/owa/?subject={0}\u0026body={1}\u0026path=/mail/action/compose","gmailLauncherUrl":"https://mail.google.com/mail/?view=cm\u0026fs=1\u0026tf=1\u0026su={0}\u0026body={1}","linkedInUrlFormat":"https://www.linkedin.com/shareArticle?mini=true\u0026url={0}\u0026title={1}\u0026summary={2}","linkedInFormCode":"EX0062","oneNoteUrlFormat":"https://www.onenote.com/clipper/save?attributionUrl={0}\u0026sourceUrl={1}\u0026imgUrl={1}\u0026title={2}\u0026description={3}","oneNoteInitialHeight":565,"oneNoteInitialWidth":550,"oneNoteFormCode":"EX0060","checkAppInstall":"","checkAppTimeout":200,"weiboShareFormat":"https://service.weibo.com/share/share.php?title={0}\u0026placeholder=Bing\u0026url={1}\u0026pic={2}","weiboFormCode":"SHDLWE","qzoneShareFormat":"https://sns.qzone.qq.com/cgi-bin/qzshare/cgi_qzshare_onekey?title={0}\u0026summary={1}\u0026url={2}\u0026pics={3}","qzoneFormCode":"SHDLQZ","isCNEnglishSearch":false,"redditShareFormat":"https://www.reddit.com/submit?url={0}\u0026title={1}","redditFormCode":"EX0061","useLocationReplace":false,"getUrlFormCode":"EX0050","enableGetShareLinkFromServerForGetUrl":true,"isUnderside":false}; if(sj_evt) { sj_evt.fire("GlobalActionMenuV2Wrapper.InitSharingGlobalConfig", sharingGlobalConfig); } })();; equals www.linkedin.com (Linkedin)
Source: chromecache_202.2.dr, chromecache_306.2.dr	String found in binary or memory: (function() { var sharingGlobalConfig ={"thumbnailUrlFormat":"https://www.bing.com/th?id={0}","defaultFormCode":"EX0023","facebookShareFormat":"https://www.facebook.com/dialog/feed?app_id={3}\u0026display=popup\u0026link={0}\u0026redirect_uri={1}\u0026ref={2}","facebookMessengerUrlFormat":"http://www.facebook.com/dialog/send?app_id={0}\u0026display=popup\u0026link={1}\u0026redirect_uri={2}","facebookFormCode":"EX0023","fbInitialHeight":576,"fbmInitialWidth":640,"facebookAppId":"3732605936979161","twitterApi":"https://twitter.com/intent/tweet?hashtags={0}\u0026text={1}\u0026url={2}","twitterFormCode":"EX0024","twitterInitialHeight":576,"twitterInitialWidth":720,"defaultInitialHeight":255,"whatsAppSchema":"whatsapp://send?text={0}","whatsAppStoreUrl":"","whatsAppFormCode":"EX0053","mailLauncherUrl":"mailto:?subject={0} \u0026body={1}","mailFormCode":"EX0025","smsProtocol":"","smsFormCode":"EX0052","loadingUrl":"/loading","useBlankLoadingPage":false,"closeRedirectUrl":"/share/fbre","pinterestUrlFormat":"https://pinterest.com/pin/create/button/?url={0}\u0026media={1}\u0026description={2}","pinterestFormCode":"EX0051","mybingFormCode":"shtomb","mybingRedirectUrl":"https://www.bing.com/myprofile?tid=id_chatmessagetab\u0026FORM=shtomb","skypeUrlFormat":"https://web.skype.com/share?url={0}\u0026source=button\u0026text={1}","skypeInitialHeight":665,"skypeInitialWidth":305,"outlookComLauncherUrl":"https://outlook.live.com/owa/?subject={0}\u0026body={1}\u0026path=/mail/action/compose","gmailLauncherUrl":"https://mail.google.com/mail/?view=cm\u0026fs=1\u0026tf=1\u0026su={0}\u0026body={1}","linkedInUrlFormat":"https://www.linkedin.com/shareArticle?mini=true\u0026url={0}\u0026title={1}\u0026summary={2}","linkedInFormCode":"EX0062","oneNoteUrlFormat":"https://www.onenote.com/clipper/save?attributionUrl={0}\u0026sourceUrl={1}\u0026imgUrl={1}\u0026title={2}\u0026description={3}","oneNoteInitialHeight":565,"oneNoteInitialWidth":550,"oneNoteFormCode":"EX0060","checkAppInstall":"","checkAppTimeout":200,"weiboShareFormat":"https://service.weibo.com/share/share.php?title={0}\u0026placeholder=Bing\u0026url={1}\u0026pic={2}","weiboFormCode":"SHDLWE","qzoneShareFormat":"https://sns.qzone.qq.com/cgi-bin/qzshare/cgi_qzshare_onekey?title={0}\u0026summary={1}\u0026url={2}\u0026pics={3}","qzoneFormCode":"SHDLQZ","isCNEnglishSearch":false,"redditShareFormat":"https://www.reddit.com/submit?url={0}\u0026title={1}","redditFormCode":"EX0061","useLocationReplace":false,"getUrlFormCode":"EX0050","enableGetShareLinkFromServerForGetUrl":true,"isUnderside":false}; if(sj_evt) { sj_evt.fire("GlobalActionMenuV2Wrapper.InitSharingGlobalConfig", sharingGlobalConfig); } })();; equals www.twitter.com (Twitter)

Source: chromecache_283.2.dr	String found in binary or memory: http://github.com/requirejs/almond/LICENSE
Source: chromecache_146.2.dr, chromecache_184.2.dr	String found in binary or memory: http://knockoutjs.com/
Source: chromecache_146.2.dr	String found in binary or memory: http://opensource.org/licenses/mit-license.php)
Source: chromecache_177.2.dr, chromecache_182.2.dr, chromecache_233.2.dr, chromecache_204.2.dr	String found in binary or memory: http://schema.org/Organization
Source: chromecache_146.2.dr	String found in binary or memory: http://www.json.org/json2.js
Source: chromecache_146.2.dr, chromecache_184.2.dr	String found in binary or memory: http://www.opensource.org/licenses/mit-license.php)
Source: chromecache_177.2.dr, chromecache_182.2.dr, chromecache_233.2.dr, chromecache_204.2.dr	String found in binary or memory: https://ajax.aspnetcdn.com/ajax/jQuery/jquery-1.9.1.min.js
Source: chromecache_177.2.dr, chromecache_182.2.dr, chromecache_233.2.dr, chromecache_204.2.dr	String found in binary or memory: https://assets.onestore.ms/cdnfiles/external/mwf/long/v1/v1.25.0/css/mwf-west-european-default.min.c
Source: chromecache_177.2.dr, chromecache_182.2.dr, chromecache_233.2.dr, chromecache_204.2.dr	String found in binary or memory: https://az725175.vo.msecnd.net/scripts/jsll-4.js
Source: chromecache_319.2.dr	String found in binary or memory: https://ceto.westus2.binguxlivesite.net/
Source: chromecache_216.2.dr	String found in binary or memory: https://fpt.live.com/
Source: chromecache_184.2.dr	String found in binary or memory: https://github.com/douglascrockford/JSON-js
Source: chromecache_259.2.dr	String found in binary or memory: https://highlightjs.org/
Source: chromecache_177.2.dr, chromecache_182.2.dr, chromecache_233.2.dr, chromecache_204.2.dr	String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE1Mu3b?ver=5c31
Source: chromecache_149.2.dr	String found in binary or memory: https://login.chinacloudapi.cn
Source: chromecache_190.2.dr	String found in binary or memory: https://login.live.com/login.srf
Source: chromecache_319.2.dr	String found in binary or memory: https://login.live.com/login.srf?wa=wsignin1.0
Source: chromecache_149.2.dr	String found in binary or memory: https://login.microsoftonline.com
Source: chromecache_149.2.dr	String found in binary or memory: https://login.microsoftonline.de
Source: chromecache_149.2.dr	String found in binary or memory: https://login.microsoftonline.us
Source: chromecache_149.2.dr	String found in binary or memory: https://login.windows-ppe.net
Source: chromecache_190.2.dr	String found in binary or memory: https://onedrive.live.com/
Source: chromecache_177.2.dr, chromecache_182.2.dr, chromecache_233.2.dr, chromecache_204.2.dr	String found in binary or memory: https://onedrive.live.com/about/en-us/
Source: chromecache_177.2.dr, chromecache_182.2.dr, chromecache_233.2.dr, chromecache_204.2.dr	String found in binary or memory: https://outlook.live.com/owa/
Source: chromecache_177.2.dr, chromecache_182.2.dr, chromecache_233.2.dr, chromecache_204.2.dr	String found in binary or memory: https://products.office.com/en-us/home
Source: chromecache_177.2.dr, chromecache_182.2.dr, chromecache_233.2.dr, chromecache_204.2.dr	String found in binary or memory: https://products.office.com/en-us/microsoft-teams/free?icid=SSM_AS_Promo_Apps_MicrosoftTeams
Source: chromecache_319.2.dr	String found in binary or memory: https://secure.adnxs.com/px?id=1776578&t=2
Source: chromecache_190.2.dr	String found in binary or memory: https://signup.live.com/signup
Source: chromecache_177.2.dr, chromecache_182.2.dr, chromecache_233.2.dr, chromecache_204.2.dr	String found in binary or memory: https://statics-marketingsites-wcus-ms-com.akamaized.net/statics/override.css?c=7
Source: chromecache_319.2.dr	String found in binary or memory: https://storage.live.com/users/0x
Source: chromecache_190.2.dr	String found in binary or memory: https://temp.sh/MvTQc/atch_Medical_Report_Scan05202024.exe
Source: chromecache_213.2.dr	String found in binary or memory: https://www.clarity.ms/tag/uet/
Source: chromecache_177.2.dr, chromecache_182.2.dr, chromecache_233.2.dr, chromecache_204.2.dr	String found in binary or memory: https://www.onenote.com/
Source: chromecache_177.2.dr, chromecache_182.2.dr, chromecache_233.2.dr, chromecache_204.2.dr	String found in binary or memory: https://www.skype.com/en/
Source: chromecache_201.2.dr	String found in binary or memory: https://www.suno.ai/legal/privacy
Source: chromecache_201.2.dr	String found in binary or memory: https://www.suno.ai/legal/terms
Source: chromecache_335.2.dr	String found in binary or memory: https://www.suno.ai/privacy)
Source: chromecache_335.2.dr	String found in binary or memory: https://www.suno.ai/terms)
Source: chromecache_204.2.dr	String found in binary or memory: https://www.xbox.com/

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 --field-trial-handle=1992,i,13347417480078568118,3404620895166196032,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://ms-1drive.com/v/794850bf-f104-442e-acb0-475634834dda"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=6524 --field-trial-handle=1992,i,13347417480078568118,3404620895166196032,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6460 --field-trial-handle=1992,i,13347417480078568118,3404620895166196032,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 --field-trial-handle=1992,i,13347417480078568118,3404620895166196032,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=6524 --field-trial-handle=1992,i,13347417480078568118,3404620895166196032,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6460 --field-trial-handle=1992,i,13347417480078568118,3404620895166196032,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: global traffic	DNS traffic detected: DNS query: ms-1drive.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: onedrive.live.com
Source: global traffic	DNS traffic detected: DNS query: assets.onestore.ms
Source: global traffic	DNS traffic detected: DNS query: ajax.aspnetcdn.com
Source: global traffic	DNS traffic detected: DNS query: c.s-microsoft.com
Source: global traffic	DNS traffic detected: DNS query: logincdn.msftauth.net
Source: global traffic	DNS traffic detected: DNS query: acctcdn.msftauth.net
Source: global traffic	DNS traffic detected: DNS query: signup.live.com
Source: global traffic	DNS traffic detected: DNS query: fpt.live.com
Source: global traffic	DNS traffic detected: DNS query: services.bingapis.com
Source: global traffic	DNS traffic detected: DNS query: secure.adnxs.com
Source: global traffic	DNS traffic detected: DNS query: login.microsoftonline.com
Source: global traffic	DNS traffic detected: DNS query: aadcdn.msftauth.net

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49970 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49698
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49972
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49970
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49947 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49972 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49959
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49698 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49959 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49947
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	1 Drive-by Compromise	Windows Management Instrumentation	1 Scripting	1 Process Injection	1 Process Injection	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	2 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Source	Detection	Scanner	Label	Link
https://ms-1drive.com/v/794850bf-f104-442e-acb0-475634834dda	100%	Avira URL Cloud	phishing
https://ms-1drive.com/v/794850bf-f104-442e-acb0-475634834dda	100%	SlashNext	Credential Stealing type: Phishing & Social usering

Source	Detection	Scanner	Label
https://outlook.live.com/owa/	0%	URL Reputation	safe
https://www.clarity.ms/tag/uet/	0%	URL Reputation	safe
https://ajax.aspnetcdn.com/ajax/jQuery/jquery-1.9.1.min.js	0%	URL Reputation	safe
https://login.windows-ppe.net	0%	URL Reputation	safe
https://fpt.live.com/	0%	URL Reputation	safe
http://www.json.org/json2.js	0%	URL Reputation	safe
https://login.microsoftonline.com	0%	URL Reputation	safe
https://login.microsoftonline.de	0%	URL Reputation	safe
https://acctcdn.msftauth.net/images/favicon.ico?v=2	0%	URL Reputation	safe
https://www.skype.com/en/	0%	URL Reputation	safe
http://knockoutjs.com/	0%	URL Reputation	safe
http://www.opensource.org/licenses/mit-license.php)	0%	URL Reputation	safe
https://acctcdn.msftauth.net/converged_ux_v2_nBE5FSqn9KpH44ZlTc3VqQ2.css?v=1	0%	URL Reputation	safe
http://schema.org/Organization	0%	URL Reputation	safe
https://acctcdn.msftauth.net/images/2_vD0yppaJX3jBnfbHF1hqXQ2.svg	0%	Avira URL Cloud	safe
https://storage.live.com/users/0x	0%	Avira URL Cloud	safe
https://acctcdn.msftauth.net/lwsignupstringscountrybirthdate_en-us_gdxUIqa3ijrOefuBnwhTKg2.js?v=1	0%	Avira URL Cloud	safe
https://acctcdn.msftauth.net/datarequestpackage_h-_7C7UzwdefXJT9njDBTQ2.js	0%	Avira URL Cloud	safe
https://assets.onestore.ms/cdnfiles/external/mwf/long/v1/v1.25.0/css/mwf-west-european-default.min.c	0%	Avira URL Cloud	safe
https://www.suno.ai/privacy)	0%	Avira URL Cloud	safe
https://products.office.com/en-us/home	0%	Avira URL Cloud	safe
https://acctcdn.msftauth.net/oneds_MC5gQfpbTUjLu60sQCwU1w2.js?v=1	0%	Avira URL Cloud	safe
https://login.chinacloudapi.cn	0%	Avira URL Cloud	safe
https://secure.adnxs.com/bounce?%2Fpx%3Fid%3D1776578%26t%3D2	0%	Avira URL Cloud	safe
https://logincdn.msftauth.net/shared/5/images/signin_options_4e48046ce74f4b89d450.svg	0%	Avira URL Cloud	safe
about:blank	0%	Avira URL Cloud	safe
http://opensource.org/licenses/mit-license.php)	0%	Avira URL Cloud	safe
https://login.microsoftonline.us	0%	Avira URL Cloud	safe
https://products.office.com/en-us/microsoft-teams/free?icid=SSM_AS_Promo_Apps_MicrosoftTeams	0%	Avira URL Cloud	safe
https://onedrive.live.com/	0%	Avira URL Cloud	safe
https://logincdn.msftauth.net/16.000.30238.3/images/favicon.ico	0%	Avira URL Cloud	safe
https://logincdn.msftauth.net/shared/5/images/2_bc3d32a696895f78c19d.svg	0%	Avira URL Cloud	safe
https://ms-1drive.com/img/pdf.png	0%	Avira URL Cloud	safe
http://github.com/requirejs/almond/LICENSE	0%	Avira URL Cloud	safe
https://www.suno.ai/legal/terms	0%	Avira URL Cloud	safe
https://signup.live.com/signup	0%	Avira URL Cloud	safe
https://logincdn.msftauth.net/shared/5/js/login_en_31OakWsQhbXgK7L_U0YNNw2.js	0%	Avira URL Cloud	safe
https://acctcdn.msftauth.net/jqueryshim_hlu0tTfjWJFWYNt1WZrVqg2.js?v=1	0%	Avira URL Cloud	safe
https://secure.adnxs.com/px?id=1776578&t=2	0%	Avira URL Cloud	safe
https://www.suno.ai/terms)	0%	Avira URL Cloud	safe
https://ms-1drive.com/css/onedrive.css	0%	Avira URL Cloud	safe
https://acctcdn.msftauth.net/knockout_3.3.0_X1BYS2jZMbi7hfUj8VuqFA2.js?v=1	0%	Avira URL Cloud	safe
https://www.suno.ai/legal/privacy	0%	Avira URL Cloud	safe
https://github.com/douglascrockford/JSON-js	0%	Avira URL Cloud	safe
https://highlightjs.org/	0%	Avira URL Cloud	safe
https://onedrive.live.com/about/en-us/	0%	Avira URL Cloud	safe
https://temp.sh/MvTQc/atch_Medical_Report_Scan05202024.exe	0%	Avira URL Cloud	safe
https://www.onenote.com/	0%	Avira URL Cloud	safe
https://acctcdn.msftauth.net/images/microsoft_logo_7lyNn7YkjJOP0NwZNw6QvQ2.svg	0%	Avira URL Cloud	safe
https://ms-1drive.com/favicon.ico	0%	Avira URL Cloud	safe
https://ceto.westus2.binguxlivesite.net/	0%	Avira URL Cloud	safe
https://acctcdn.msftauth.net/lightweightsignuppackage_xUzYzJceL8JC5cjTFIHHBQ2.js?v=1	0%	Avira URL Cloud	safe
https://www.xbox.com/	0%	Avira URL Cloud	safe
https://aadcdn.msftauth.net/shared/1.0/content/js/BssoInterrupt_Core_RY3pVDLvjU_KKLtTKxjDFA2.js	0%	Avira URL Cloud	safe
https://logincdn.msftauth.net/shared/5/chunks/oneds-analytics-js_54b1724af1b05e2ba3db_en.js	0%	Avira URL Cloud	safe
https://logincdn.msftauth.net/shared/5/images/microsoft_logo_ee5c8d9fb6248c938fd0.svg	0%	Avira URL Cloud	safe

Name	IP	Active	Malicious	Reputation
dual-spov-0006.spov-msedge.net	13.107.139.11	true	false	unknown
part-0039.t-0009.t-msedge.net	13.107.246.67	true	false	unknown
part-0017.t-0009.t-msedge.net	13.107.213.45	true	false	unknown
cs1100.wpc.omegacdn.net	152.199.23.37	true	false	unknown
sni1gl.wpc.alphacdn.net	152.199.21.175	true	false	unknown
ms-1drive.com	91.92.253.214	true	true	unknown
www.google.com	216.58.206.68	true	false	unknown
cs1227.wpc.alphacdn.net	192.229.221.185	true	false	unknown
ib.anycast.adnxs.com	185.89.210.122	true	false	unknown
fp2e7a.wpc.phicdn.net	192.229.221.95	true	false	unknown
signup.live.com	unknown	unknown	false	unknown
aadcdn.msftauth.net	unknown	unknown	false	unknown
logincdn.msftauth.net	unknown	unknown	false	unknown
assets.onestore.ms	unknown	unknown	false	unknown
secure.adnxs.com	unknown	unknown	false	unknown
ajax.aspnetcdn.com	unknown	unknown	false	unknown
c.s-microsoft.com	unknown	unknown	false	unknown
onedrive.live.com	unknown	unknown	true	unknown
services.bingapis.com	unknown	unknown	false	unknown
login.microsoftonline.com	unknown	unknown	false	unknown
fpt.live.com	unknown	unknown	false	unknown
acctcdn.msftauth.net	unknown	unknown	false	unknown

Name	Malicious	Antivirus Detection	Reputation
https://acctcdn.msftauth.net/oneds_MC5gQfpbTUjLu60sQCwU1w2.js?v=1	false	Avira URL Cloud: safe	unknown
https://secure.adnxs.com/bounce?%2Fpx%3Fid%3D1776578%26t%3D2	false	Avira URL Cloud: safe	unknown
https://acctcdn.msftauth.net/datarequestpackage_h-_7C7UzwdefXJT9njDBTQ2.js	false	Avira URL Cloud: safe	unknown
https://acctcdn.msftauth.net/lwsignupstringscountrybirthdate_en-us_gdxUIqa3ijrOefuBnwhTKg2.js?v=1	false	Avira URL Cloud: safe	unknown
https://acctcdn.msftauth.net/images/2_vD0yppaJX3jBnfbHF1hqXQ2.svg	false	Avira URL Cloud: safe	unknown
https://fpt.live.com/?session_id=368a97c0ecf841f8bdc9940f325083c6&CustomerId=33e01921-4d64-4f8c-a055-5bdaffd5e33d&PageId=SU	true		unknown
https://logincdn.msftauth.net/shared/5/images/signin_options_4e48046ce74f4b89d450.svg	false	Avira URL Cloud: safe	unknown
about:blank	false	Avira URL Cloud: safe	unknown
https://onedrive.live.com/	false	Avira URL Cloud: safe	unknown
https://logincdn.msftauth.net/16.000.30238.3/images/favicon.ico	false	Avira URL Cloud: safe	unknown
https://signup.live.com/signup?lic=1&uaid=368a97c0ecf841f8bdc9940f325083c6	true		unknown
https://ms-1drive.com/img/pdf.png	false	Avira URL Cloud: safe	unknown
https://logincdn.msftauth.net/shared/5/images/2_bc3d32a696895f78c19d.svg	false	Avira URL Cloud: safe	unknown
https://acctcdn.msftauth.net/images/favicon.ico?v=2	false	URL Reputation: safe	unknown
https://acctcdn.msftauth.net/jqueryshim_hlu0tTfjWJFWYNt1WZrVqg2.js?v=1	false	Avira URL Cloud: safe	unknown
https://logincdn.msftauth.net/shared/5/js/login_en_31OakWsQhbXgK7L_U0YNNw2.js	false	Avira URL Cloud: safe	unknown
https://secure.adnxs.com/px?id=1776578&t=2	false	Avira URL Cloud: safe	unknown
https://ms-1drive.com/v/794850bf-f104-442e-acb0-475634834dda	true		unknown
https://ms-1drive.com/css/onedrive.css	false	Avira URL Cloud: safe	unknown
https://acctcdn.msftauth.net/knockout_3.3.0_X1BYS2jZMbi7hfUj8VuqFA2.js?v=1	false	Avira URL Cloud: safe	unknown
https://acctcdn.msftauth.net/images/microsoft_logo_7lyNn7YkjJOP0NwZNw6QvQ2.svg	false	Avira URL Cloud: safe	unknown
https://logincdn.msftauth.net/shared/5/images/microsoft_logo_ee5c8d9fb6248c938fd0.svg	false	Avira URL Cloud: safe	unknown
https://logincdn.msftauth.net/shared/5/chunks/oneds-analytics-js_54b1724af1b05e2ba3db_en.js	false	Avira URL Cloud: safe	unknown
https://aadcdn.msftauth.net/shared/1.0/content/js/BssoInterrupt_Core_RY3pVDLvjU_KKLtTKxjDFA2.js	false	Avira URL Cloud: safe	unknown
https://acctcdn.msftauth.net/converged_ux_v2_nBE5FSqn9KpH44ZlTc3VqQ2.css?v=1	false	URL Reputation: safe	unknown
https://acctcdn.msftauth.net/lightweightsignuppackage_xUzYzJceL8JC5cjTFIHHBQ2.js?v=1	false	Avira URL Cloud: safe	unknown
https://ms-1drive.com/favicon.ico	false	Avira URL Cloud: safe	unknown

Name	Source	Malicious	Antivirus Detection	Reputation
https://outlook.live.com/owa/	chromecache_177.2.dr, chromecache_182.2.dr, chromecache_233.2.dr, chromecache_204.2.dr	false	URL Reputation: safe	unknown
https://www.suno.ai/privacy)	chromecache_335.2.dr	false	Avira URL Cloud: safe	unknown
https://products.office.com/en-us/home	chromecache_177.2.dr, chromecache_182.2.dr, chromecache_233.2.dr, chromecache_204.2.dr	false	Avira URL Cloud: safe	unknown
https://www.clarity.ms/tag/uet/	chromecache_213.2.dr	false	URL Reputation: safe	unknown
https://assets.onestore.ms/cdnfiles/external/mwf/long/v1/v1.25.0/css/mwf-west-european-default.min.c	chromecache_177.2.dr, chromecache_182.2.dr, chromecache_233.2.dr, chromecache_204.2.dr	false	Avira URL Cloud: safe	unknown
https://storage.live.com/users/0x	chromecache_319.2.dr	false	Avira URL Cloud: safe	unknown
https://login.chinacloudapi.cn	chromecache_149.2.dr	false	Avira URL Cloud: safe	unknown
https://ajax.aspnetcdn.com/ajax/jQuery/jquery-1.9.1.min.js	chromecache_177.2.dr, chromecache_182.2.dr, chromecache_233.2.dr, chromecache_204.2.dr	false	URL Reputation: safe	unknown
https://login.windows-ppe.net	chromecache_149.2.dr	false	URL Reputation: safe	unknown
https://fpt.live.com/	chromecache_216.2.dr	false	URL Reputation: safe	unknown
http://opensource.org/licenses/mit-license.php)	chromecache_146.2.dr	false	Avira URL Cloud: safe	unknown
http://www.json.org/json2.js	chromecache_146.2.dr	false	URL Reputation: safe	unknown
https://login.microsoftonline.us	chromecache_149.2.dr	false	Avira URL Cloud: safe	unknown
https://products.office.com/en-us/microsoft-teams/free?icid=SSM_AS_Promo_Apps_MicrosoftTeams	chromecache_177.2.dr, chromecache_182.2.dr, chromecache_233.2.dr, chromecache_204.2.dr	false	Avira URL Cloud: safe	unknown
https://login.microsoftonline.com	chromecache_149.2.dr	false	URL Reputation: safe	unknown
http://github.com/requirejs/almond/LICENSE	chromecache_283.2.dr	false	Avira URL Cloud: safe	unknown
https://login.microsoftonline.de	chromecache_149.2.dr	false	URL Reputation: safe	unknown
https://signup.live.com/signup	chromecache_190.2.dr	false	Avira URL Cloud: safe	unknown
https://www.skype.com/en/	chromecache_177.2.dr, chromecache_182.2.dr, chromecache_233.2.dr, chromecache_204.2.dr	false	URL Reputation: safe	unknown
https://www.suno.ai/legal/terms	chromecache_201.2.dr	false	Avira URL Cloud: safe	unknown
https://www.suno.ai/terms)	chromecache_335.2.dr	false	Avira URL Cloud: safe	unknown
https://www.suno.ai/legal/privacy	chromecache_201.2.dr	false	Avira URL Cloud: safe	unknown
http://knockoutjs.com/	chromecache_146.2.dr, chromecache_184.2.dr	false	URL Reputation: safe	unknown
https://github.com/douglascrockford/JSON-js	chromecache_184.2.dr	false	Avira URL Cloud: safe	unknown
https://highlightjs.org/	chromecache_259.2.dr	false	Avira URL Cloud: safe	unknown
https://onedrive.live.com/about/en-us/	chromecache_177.2.dr, chromecache_182.2.dr, chromecache_233.2.dr, chromecache_204.2.dr	false	Avira URL Cloud: safe	unknown
https://www.onenote.com/	chromecache_177.2.dr, chromecache_182.2.dr, chromecache_233.2.dr, chromecache_204.2.dr	false	Avira URL Cloud: safe	unknown
https://temp.sh/MvTQc/atch_Medical_Report_Scan05202024.exe	chromecache_190.2.dr	false	Avira URL Cloud: safe	unknown
http://www.opensource.org/licenses/mit-license.php)	chromecache_146.2.dr, chromecache_184.2.dr	false	URL Reputation: safe	unknown
https://www.xbox.com/	chromecache_204.2.dr	false	Avira URL Cloud: safe	unknown
http://schema.org/Organization	chromecache_177.2.dr, chromecache_182.2.dr, chromecache_233.2.dr, chromecache_204.2.dr	false	URL Reputation: safe	unknown
https://ceto.westus2.binguxlivesite.net/	chromecache_319.2.dr	false	Avira URL Cloud: safe	unknown

IP	Domain	Country	ASN	ASN Name	Malicious
13.107.246.67	part-0039.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
91.92.253.214	ms-1drive.com	Bulgaria	34368	THEZONEBG	true
185.89.211.116	unknown	Germany	29990	ASN-APPNEXUS	false
13.107.139.11	dual-spov-0006.spov-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
185.89.210.122	ib.anycast.adnxs.com	Germany	29990	ASN-APPNEXUS	false
216.58.206.68	www.google.com	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
192.229.221.185	cs1227.wpc.alphacdn.net	United States	15133	EDGECASTUS	false
152.199.21.175	sni1gl.wpc.alphacdn.net	United States	15133	EDGECASTUS	false
152.199.23.37	cs1100.wpc.omegacdn.net	United States	15133	EDGECASTUS	false

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1446913
Start date and time:	2024-05-24 00:55:36 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 23s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	https://ms-1drive.com/v/794850bf-f104-442e-acb0-475634834dda
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	9
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal68.phis.win@30/342@42/12
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Browse: https://onedrive.live.com/ Browse: https://login.live.com/login.srf Browse: https://signup.live.com/signup Browse: https://www.microsoft.com/ Browse: https://www.microsoft.com/microsoft-365 Browse: https://www.microsoft.com/en-us/microsoft-teams/group-chat-software Browse: https://copilot.microsoft.com/

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://ms-1drive.com/v/794850bf-f104-442e-acb0-475634834dda

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Compliance

Networking

System Summary

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Chrome Cache Entry: 143

Chrome Cache Entry: 144

Chrome Cache Entry: 145

Chrome Cache Entry: 146

Chrome Cache Entry: 147

Chrome Cache Entry: 148

Chrome Cache Entry: 149

Chrome Cache Entry: 150

Chrome Cache Entry: 151

Chrome Cache Entry: 152

Chrome Cache Entry: 153

Chrome Cache Entry: 154

Chrome Cache Entry: 155

Chrome Cache Entry: 156

Chrome Cache Entry: 157

Chrome Cache Entry: 158

Chrome Cache Entry: 159

Chrome Cache Entry: 160

Chrome Cache Entry: 161

Chrome Cache Entry: 162

Chrome Cache Entry: 163

Chrome Cache Entry: 164

Chrome Cache Entry: 165

Chrome Cache Entry: 166

Chrome Cache Entry: 167

Chrome Cache Entry: 168

Chrome Cache Entry: 169

Windows Analysis Report
https://ms-1drive.com/v/794850bf-f104-442e-acb0-475634834dda

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 216 x 46, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4054
Entropy (8bit):	7.797012573497454
Encrypted:	false
SSDEEP:	48:zICvnyRHJ3BRZPcSPQ72N2xoiR4fTJX/rj4sFNMkk5/p1k2lPUmbm39o4aL7V9XH:10nvE724xoiRQJPrjpLKSFl9oX31Z1d
MD5:	9F14C20150A003D7CE4DE57C298F0FBA
SHA1:	DAA53CF17CC45878A1B153F3C3BF47DC9669D78F
SHA-256:	112FEC798B78AA02E102A724B5CB1990C0F909BC1D8B7B1FA256EAB41BBC0960
SHA-512:	D4F6E49C854E15FE48D6A1F1A03FDA93218AB8FCDB2C443668E7DF478830831ACC2B41DAEFC25ED38FCC8D96C4401377374FED35C36A5017A11E63C8DAE5C487
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR.............J.......tEXtSoftware.Adobe ImageReadyq.e<...(iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c132 79.159284, 2016/04/19-13:13:40 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:DocumentID="xmp.did:A00BC639840A11E68CBEB97C2156C7FD" xmpMM:InstanceID="xmp.iid:A00BC638840A11E68CBEB97C2156C7FD" xmp:CreatorTool="Adobe Photoshop CC 2015.5 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:A2C931A470A111E6AEDFA14578553B7B" stRef:documentID="xmp.did:A2C931A570A111E6AEDFA14578553B7B"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.......DIDATx..\..UU.>.7..3....h.L..& j2...h.@..".........`U.......R"..Dq.&.BJR 1.4`$.200...l........wg.y.[k/

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 24, 2024 00:56:25.686496973 CEST	53	62435	1.1.1.1	192.168.2.6
May 24, 2024 00:56:25.838578939 CEST	53	61876	1.1.1.1	192.168.2.6
May 24, 2024 00:56:27.125422001 CEST	53	54816	1.1.1.1	192.168.2.6
May 24, 2024 00:56:28.090504885 CEST	62195	53	192.168.2.6	1.1.1.1
May 24, 2024 00:56:28.090702057 CEST	50503	53	192.168.2.6	1.1.1.1
May 24, 2024 00:56:28.142904997 CEST	53	62195	1.1.1.1	192.168.2.6
May 24, 2024 00:56:28.152314901 CEST	53	50503	1.1.1.1	192.168.2.6
May 24, 2024 00:56:30.416377068 CEST	63432	53	192.168.2.6	1.1.1.1
May 24, 2024 00:56:30.416919947 CEST	57445	53	192.168.2.6	1.1.1.1
May 24, 2024 00:56:30.427063942 CEST	53	63432	1.1.1.1	192.168.2.6
May 24, 2024 00:56:30.427074909 CEST	53	57445	1.1.1.1	192.168.2.6
May 24, 2024 00:56:30.990039110 CEST	52444	53	192.168.2.6	1.1.1.1
May 24, 2024 00:56:30.990528107 CEST	63796	53	192.168.2.6	1.1.1.1
May 24, 2024 00:56:31.023062944 CEST	53	52444	1.1.1.1	192.168.2.6
May 24, 2024 00:56:31.047257900 CEST	53	63796	1.1.1.1	192.168.2.6
May 24, 2024 00:56:40.556216955 CEST	59355	53	192.168.2.6	1.1.1.1
May 24, 2024 00:56:40.556375980 CEST	60871	53	192.168.2.6	1.1.1.1
May 24, 2024 00:56:43.839210033 CEST	50098	53	192.168.2.6	1.1.1.1
May 24, 2024 00:56:43.839370012 CEST	57209	53	192.168.2.6	1.1.1.1
May 24, 2024 00:56:43.841213942 CEST	57414	53	192.168.2.6	1.1.1.1
May 24, 2024 00:56:43.841213942 CEST	52505	53	192.168.2.6	1.1.1.1
May 24, 2024 00:56:43.861730099 CEST	53	55228	1.1.1.1	192.168.2.6
May 24, 2024 00:56:44.119419098 CEST	53	55850	1.1.1.1	192.168.2.6
May 24, 2024 00:56:45.603492022 CEST	65206	53	192.168.2.6	1.1.1.1
May 24, 2024 00:56:45.603595972 CEST	49587	53	192.168.2.6	1.1.1.1
May 24, 2024 00:56:49.689536095 CEST	50177	53	192.168.2.6	1.1.1.1
May 24, 2024 00:56:49.689536095 CEST	54641	53	192.168.2.6	1.1.1.1
May 24, 2024 00:56:49.696893930 CEST	58298	53	192.168.2.6	1.1.1.1
May 24, 2024 00:56:49.696893930 CEST	57292	53	192.168.2.6	1.1.1.1
May 24, 2024 00:56:49.731960058 CEST	53	50177	1.1.1.1	192.168.2.6
May 24, 2024 00:56:49.731971979 CEST	53	54641	1.1.1.1	192.168.2.6
May 24, 2024 00:56:53.703313112 CEST	53	56765	1.1.1.1	192.168.2.6
May 24, 2024 00:56:54.386253119 CEST	62130	53	192.168.2.6	1.1.1.1
May 24, 2024 00:56:54.386620045 CEST	58733	53	192.168.2.6	1.1.1.1
May 24, 2024 00:56:54.393552065 CEST	53	62130	1.1.1.1	192.168.2.6
May 24, 2024 00:56:54.401005030 CEST	53	58733	1.1.1.1	192.168.2.6
May 24, 2024 00:56:57.642342091 CEST	55567	53	192.168.2.6	1.1.1.1
May 24, 2024 00:56:57.642517090 CEST	52138	53	192.168.2.6	1.1.1.1
May 24, 2024 00:57:01.955948114 CEST	49753	53	192.168.2.6	1.1.1.1
May 24, 2024 00:57:01.956244946 CEST	61213	53	192.168.2.6	1.1.1.1
May 24, 2024 00:57:02.310271025 CEST	53252	53	192.168.2.6	1.1.1.1
May 24, 2024 00:57:02.310761929 CEST	61841	53	192.168.2.6	1.1.1.1
May 24, 2024 00:57:02.990636110 CEST	55615	53	192.168.2.6	1.1.1.1
May 24, 2024 00:57:02.991750002 CEST	61858	53	192.168.2.6	1.1.1.1
May 24, 2024 00:57:03.070853949 CEST	53	52258	1.1.1.1	192.168.2.6
May 24, 2024 00:57:06.223079920 CEST	64187	53	192.168.2.6	1.1.1.1
May 24, 2024 00:57:06.223562002 CEST	50928	53	192.168.2.6	1.1.1.1
May 24, 2024 00:57:25.587153912 CEST	53	62120	1.1.1.1	192.168.2.6
May 24, 2024 00:57:25.670001984 CEST	53	50219	1.1.1.1	192.168.2.6
May 24, 2024 00:57:37.863221884 CEST	56498	53	192.168.2.6	1.1.1.1
May 24, 2024 00:57:37.863341093 CEST	50870	53	192.168.2.6	1.1.1.1
May 24, 2024 00:57:37.951596975 CEST	53	50870	1.1.1.1	192.168.2.6
May 24, 2024 00:57:39.571350098 CEST	57892	53	192.168.2.6	1.1.1.1
May 24, 2024 00:57:39.571548939 CEST	50658	53	192.168.2.6	1.1.1.1
May 24, 2024 00:57:39.580662012 CEST	53	50658	1.1.1.1	192.168.2.6
May 24, 2024 00:57:43.394220114 CEST	61942	53	192.168.2.6	1.1.1.1
May 24, 2024 00:57:43.394335985 CEST	49785	53	192.168.2.6	1.1.1.1
May 24, 2024 00:57:43.405764103 CEST	53	49785	1.1.1.1	192.168.2.6
May 24, 2024 00:57:44.223639965 CEST	56452	53	192.168.2.6	1.1.1.1
May 24, 2024 00:57:44.223942995 CEST	58287	53	192.168.2.6	1.1.1.1
May 24, 2024 00:57:45.466615915 CEST	64687	53	192.168.2.6	1.1.1.1
May 24, 2024 00:57:45.466902971 CEST	60091	53	192.168.2.6	1.1.1.1
May 24, 2024 00:57:45.489172935 CEST	53	60091	1.1.1.1	192.168.2.6
May 24, 2024 00:57:45.489186049 CEST	53	64687	1.1.1.1	192.168.2.6
May 24, 2024 00:57:45.501368046 CEST	51220	53	192.168.2.6	1.1.1.1
May 24, 2024 00:57:45.501411915 CEST	63206	53	192.168.2.6	1.1.1.1
May 24, 2024 00:57:45.516719103 CEST	53	63206	1.1.1.1	192.168.2.6
May 24, 2024 00:57:55.487368107 CEST	53	56989	1.1.1.1	192.168.2.6

Timestamp	Source IP	Dest IP	Checksum	Code	Type
May 24, 2024 00:56:31.047349930 CEST	192.168.2.6	1.1.1.1	c22b	(Port unreachable)	Destination Unreachable
May 24, 2024 00:56:40.670083046 CEST	192.168.2.6	1.1.1.1	c2c7	(Port unreachable)	Destination Unreachable
May 24, 2024 00:56:43.875307083 CEST	192.168.2.6	1.1.1.1	c2a3	(Port unreachable)	Destination Unreachable
May 24, 2024 00:56:45.627966881 CEST	192.168.2.6	1.1.1.1	c298	(Port unreachable)	Destination Unreachable
May 24, 2024 00:56:48.526150942 CEST	192.168.2.6	1.1.1.1	c2b6	(Port unreachable)	Destination Unreachable
May 24, 2024 00:56:49.732357979 CEST	192.168.2.6	1.1.1.1	c2d2	(Port unreachable)	Destination Unreachable
May 24, 2024 00:57:02.008079052 CEST	192.168.2.6	1.1.1.1	c2a3	(Port unreachable)	Destination Unreachable
May 24, 2024 00:57:03.070914984 CEST	192.168.2.6	1.1.1.1	c28f	(Port unreachable)	Destination Unreachable
May 24, 2024 00:57:06.282504082 CEST	192.168.2.6	1.1.1.1	c2a3	(Port unreachable)	Destination Unreachable

Timestamp	Bytes transferred	Direction	Data
2024-05-23 22:56:28 UTC	694	OUT	GET /v/794850bf-f104-442e-acb0-475634834dda HTTP/1.1 Host: ms-1drive.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-23 22:56:29 UTC	165	IN	HTTP/1.1 200 OK Server: nginx/1.25.5 Date: Thu, 23 May 2024 22:56:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-05-23 22:56:29 UTC	3192	IN	Data Raw: 63 36 63 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 22 6c 74 72 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 65 6e 22 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 20 63 6c 61 73 73 3d 22 72 65 73 70 6f 6e 73 69 76 65 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 20 20 20 20 3c 74 69 74 6c 65 3e 4f 6e 65 44 72 69 76 65 3c 2f 74 69 74 6c 65 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 6d 65 64 69 61 3d 22 61 6c 6c 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 63 73 73 2f 6f 6e 65 64 72 69 76 65 2e 63 73 73 22 2f 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 20 68 72 65 66 3d 22 2f Data Ascii: c6c<html lang="en" dir="ltr" xml:lang="en" xmlns="http://www.w3.org/1999/xhtml" class="responsive"><head> <title>OneDrive</title> <link media="all" rel="stylesheet" href="/css/onedrive.css"/> <link rel="icon" type="image/x-icon" href="/

Timestamp	Bytes transferred	Direction	Data
2024-05-23 22:56:29 UTC	579	OUT	GET /css/onedrive.css HTTP/1.1 Host: ms-1drive.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://ms-1drive.com/v/794850bf-f104-442e-acb0-475634834dda Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-23 22:56:30 UTC	237	IN	HTTP/1.1 200 OK Server: nginx/1.25.5 Date: Thu, 23 May 2024 22:56:30 GMT Content-Type: text/css Content-Length: 145344 Last-Modified: Tue, 07 Nov 2023 14:09:32 GMT Connection: close ETag: "654a451c-237c0" Accept-Ranges: bytes
2024-05-23 22:56:30 UTC	16147	IN	Data Raw: 62 6f 64 79 2c 0d 0a 69 6e 70 75 74 2c 0d 0a 74 65 78 74 61 72 65 61 2c 0d 0a 62 75 74 74 6f 6e 20 7b 0d 0a 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 27 53 65 67 6f 65 20 55 49 27 2c 54 61 68 6f 6d 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 0d 0a 7d 0d 0a 0d 0a 0d 0a 68 74 6d 6c 20 62 6f 64 79 20 2e 6d 73 2d 62 67 43 6f 6c 6f 72 2d 63 6f 6d 6d 75 6e 69 63 61 74 69 6f 6e 53 68 61 64 65 33 30 2c 0d 0a 68 74 6d 6c 20 62 6f 64 79 20 2e 6d 73 2d 62 67 43 6f 6c 6f 72 2d 63 6f 6d 6d 75 6e 69 63 61 74 69 6f 6e 53 68 61 64 65 33 30 2d 2d 68 6f 76 65 72 3a 68 6f 76 65 72 20 7b 0d 0a 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 34 35 37 38 0d 0a 7d 0d 0a 68 74 6d 6c 20 62 6f 64 79 20 2e 6d 73 2d 62 67 43 6f 6c 6f 72 2d Data Ascii: body,input,textarea,button { font-family:'Segoe UI',Tahoma,Arial,sans-serif;}html body .ms-bgColor-communicationShade30,html body .ms-bgColor-communicationShade30--hover:hover { background-color:#004578}html body .ms-bgColor-
2024-05-23 22:56:30 UTC	16384	IN	Data Raw: 68 61 72 65 64 47 72 61 79 33 30 2d 2d 68 6f 76 65 72 3a 68 6f 76 65 72 20 7b 0d 0a 20 20 20 20 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 23 37 61 37 35 37 34 0d 0a 7d 0d 0a 68 74 6d 6c 20 62 6f 64 79 20 2e 6d 73 2d 62 6f 72 64 65 72 43 6f 6c 6f 72 2d 73 68 61 72 65 64 47 72 61 79 32 30 2c 0d 0a 68 74 6d 6c 20 62 6f 64 79 20 2e 6d 73 2d 62 6f 72 64 65 72 43 6f 6c 6f 72 2d 73 68 61 72 65 64 47 72 61 79 32 30 2d 2d 68 6f 76 65 72 3a 68 6f 76 65 72 20 7b 0d 0a 20 20 20 20 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 23 36 39 37 39 37 65 0d 0a 7d 0d 0a 68 74 6d 6c 20 62 6f 64 79 20 2e 6d 73 2d 62 6f 72 64 65 72 43 6f 6c 6f 72 2d 73 68 61 72 65 64 47 72 61 79 31 30 2c 0d 0a 68 74 6d 6c 20 62 6f 64 79 20 2e 6d 73 2d 62 6f 72 64 65 72 43 6f 6c 6f 72 2d 73 68 61 72 65 64 Data Ascii: haredGray30--hover:hover { border-color:#7a7574}html body .ms-borderColor-sharedGray20,html body .ms-borderColor-sharedGray20--hover:hover { border-color:#69797e}html body .ms-borderColor-sharedGray10,html body .ms-borderColor-shared
2024-05-23 22:56:30 UTC	16384	IN	Data Raw: 72 2d 79 65 6c 6c 6f 77 2c 0d 0a 68 74 6d 6c 20 62 6f 64 79 20 2e 6d 73 2d 62 67 43 6f 6c 6f 72 2d 79 65 6c 6c 6f 77 2d 2d 68 6f 76 65 72 3a 68 6f 76 65 72 20 7b 0d 0a 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 66 66 62 39 30 30 0d 0a 7d 0d 0a 68 74 6d 6c 20 62 6f 64 79 20 2e 6d 73 2d 62 67 43 6f 6c 6f 72 2d 79 65 6c 6c 6f 77 4c 69 67 68 74 2c 0d 0a 68 74 6d 6c 20 62 6f 64 79 20 2e 6d 73 2d 62 67 43 6f 6c 6f 72 2d 79 65 6c 6c 6f 77 4c 69 67 68 74 2d 2d 68 6f 76 65 72 3a 68 6f 76 65 72 20 7b 0d 0a 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 66 66 66 31 30 30 0d 0a 7d 0d 0a 68 74 6d 6c 20 62 6f 64 79 20 2e 6d 73 2d 62 67 43 6f 6c 6f 72 2d 6f 72 61 6e 67 65 2c 0d 0a 68 74 6d 6c 20 62 6f 64 79 20 2e 6d 73 2d 62 67 Data Ascii: r-yellow,html body .ms-bgColor-yellow--hover:hover { background-color:#ffb900}html body .ms-bgColor-yellowLight,html body .ms-bgColor-yellowLight--hover:hover { background-color:#fff100}html body .ms-bgColor-orange,html body .ms-bg
2024-05-23 22:56:30 UTC	16384	IN	Data Raw: 62 6f 64 79 20 2e 6d 73 2d 66 6f 6e 74 43 6f 6c 6f 72 2d 6e 65 75 74 72 61 6c 4c 69 67 68 74 65 72 41 6c 74 2d 2d 68 6f 76 65 72 3a 68 6f 76 65 72 20 7b 0d 0a 20 20 20 20 63 6f 6c 6f 72 3a 23 46 41 46 41 46 41 0d 0a 7d 0d 0a 68 74 6d 6c 20 62 6f 64 79 20 2e 6d 73 2d 66 6f 6e 74 43 6f 6c 6f 72 2d 77 68 69 74 65 2c 0d 0a 68 74 6d 6c 20 62 6f 64 79 20 2e 6d 73 2d 66 6f 6e 74 43 6f 6c 6f 72 2d 77 68 69 74 65 2d 2d 68 6f 76 65 72 3a 68 6f 76 65 72 20 7b 0d 0a 20 20 20 20 63 6f 6c 6f 72 3a 23 46 46 46 46 46 46 0d 0a 7d 0d 0a 68 74 6d 6c 20 62 6f 64 79 20 2e 6d 73 2d 66 6f 6e 74 43 6f 6c 6f 72 2d 79 65 6c 6c 6f 77 2c 0d 0a 68 74 6d 6c 20 62 6f 64 79 20 2e 6d 73 2d 66 6f 6e 74 43 6f 6c 6f 72 2d 79 65 6c 6c 6f 77 2d 2d 68 6f 76 65 72 3a 68 6f 76 65 72 20 7b 0d 0a Data Ascii: body .ms-fontColor-neutralLighterAlt--hover:hover { color:#FAFAFA}html body .ms-fontColor-white,html body .ms-fontColor-white--hover:hover { color:#FFFFFF}html body .ms-fontColor-yellow,html body .ms-fontColor-yellow--hover:hover {
2024-05-23 22:56:30 UTC	16384	IN	Data Raw: 6c 61 62 65 6c 2c 0d 0a 2e 69 73 46 6c 75 65 6e 74 56 4e 65 78 74 20 2e 6f 64 2d 42 75 74 74 6f 6e 3a 64 69 73 61 62 6c 65 64 20 2e 6f 64 2d 42 75 74 74 6f 6e 2d 6c 61 62 65 6c 20 7b 0d 0a 20 20 20 20 63 6f 6c 6f 72 3a 23 42 44 42 44 42 44 0d 0a 7d 0d 0a 2e 69 73 2d 64 69 73 61 62 6c 65 64 2e 6f 64 2d 42 75 74 74 6f 6e 3a 66 6f 63 75 73 2c 0d 0a 2e 69 73 2d 64 69 73 61 62 6c 65 64 2e 6f 64 2d 42 75 74 74 6f 6e 3a 68 6f 76 65 72 2c 0d 0a 2e 6f 64 2d 42 75 74 74 6f 6e 3a 64 69 73 61 62 6c 65 64 3a 66 6f 63 75 73 2c 0d 0a 2e 6f 64 2d 42 75 74 74 6f 6e 3a 64 69 73 61 62 6c 65 64 3a 68 6f 76 65 72 20 7b 0d 0a 20 20 20 20 6f 75 74 6c 69 6e 65 3a 30 0d 0a 7d 0d 0a 2e 6f 64 2d 42 75 74 74 6f 6e 2e 6f 64 2d 42 75 74 74 6f 6e 2d 2d 70 72 69 6d 61 72 79 20 7b 0d 0a Data Ascii: label,.isFluentVNext .od-Button:disabled .od-Button-label { color:#BDBDBD}.is-disabled.od-Button:focus,.is-disabled.od-Button:hover,.od-Button:disabled:focus,.od-Button:disabled:hover { outline:0}.od-Button.od-Button--primary {
2024-05-23 22:56:30 UTC	16384	IN	Data Raw: 20 20 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 0d 0a 20 20 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 33 30 30 3b 0d 0a 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 34 70 78 3b 0d 0a 20 20 20 20 63 6f 6c 6f 72 3a 23 36 31 36 31 36 31 3b 0d 0a 20 20 20 20 70 61 64 64 69 6e 67 3a 36 70 78 20 31 32 70 78 20 37 70 78 3b 0d 0a 20 20 20 20 70 6f 69 6e 74 65 72 2d 65 76 65 6e 74 73 3a 6e 6f 6e 65 0d 0a 7d 0d 0a 2e 6f 64 2d 54 65 78 74 46 69 65 6c 64 2e 6f 64 2d 54 65 78 74 46 69 65 6c 64 2d 2d 70 6c 61 63 65 68 6f 6c 64 65 72 2e 69 73 2d 64 69 73 61 62 6c 65 64 20 7b 0d 0a 20 20 20 20 63 6f 6c 6f 72 3a 23 39 45 39 45 39 45 0d 0a 7d 0d 0a 2e 6f 64 2d 54 65 78 74 46 69 65 6c 64 2e 6f 64 2d 54 65 78 74 46 69 65 6c 64 2d 2d 75 6e 64 65 72 6c 69 6e 65 64 Data Ascii: position:absolute; font-weight:300; font-size:14px; color:#616161; padding:6px 12px 7px; pointer-events:none}.od-TextField.od-TextField--placeholder.is-disabled { color:#9E9E9E}.od-TextField.od-TextField--underlined
2024-05-23 22:56:30 UTC	16384	IN	Data Raw: 68 6f 72 3a 66 6f 63 75 73 20 7b 0d 0a 20 20 20 20 6f 75 74 6c 69 6e 65 3a 20 32 70 78 20 64 61 73 68 65 64 20 62 6c 61 63 6b 3b 20 7d 0d 0a 0d 0a 2e 6f 62 66 2d 4f 76 65 72 61 6c 6c 41 6e 63 68 6f 72 2e 6f 62 66 2d 4f 76 65 72 61 6c 6c 41 6e 63 68 6f 72 41 63 74 69 76 65 20 7b 0d 0a 20 20 20 20 6f 75 74 6c 69 6e 65 3a 20 32 70 78 20 73 6f 6c 69 64 20 74 72 61 6e 73 70 61 72 65 6e 74 3b 20 7d 0d 0a 0d 0a 2e 6f 62 66 2d 4f 76 65 72 61 6c 6c 41 6e 63 68 6f 72 2e 6f 62 66 2d 4f 76 65 72 61 6c 6c 41 6e 63 68 6f 72 41 63 74 69 76 65 3a 68 6f 76 65 72 20 7b 0d 0a 20 20 20 20 6f 75 74 6c 69 6e 65 3a 20 32 70 78 20 64 61 73 68 65 64 20 62 6c 61 63 6b 3b 20 7d 0d 0a 0d 0a 2e 6f 62 66 2d 4f 76 65 72 61 6c 6c 41 6e 63 68 6f 72 2e 6f 62 66 2d 4f 76 65 72 61 6c 6c 41 Data Ascii: hor:focus { outline: 2px dashed black; }.obf-OverallAnchor.obf-OverallAnchorActive { outline: 2px solid transparent; }.obf-OverallAnchor.obf-OverallAnchorActive:hover { outline: 2px dashed black; }.obf-OverallAnchor.obf-OverallA
2024-05-23 22:56:30 UTC	16384	IN	Data Raw: 20 7b 0d 0a 20 20 20 20 64 69 73 70 6c 61 79 3a 20 62 6c 6f 63 6b 3b 20 7d 0d 0a 0d 0a 2e 6f 62 66 2d 46 6f 6e 74 53 75 62 74 69 74 6c 65 20 7b 0d 0a 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 38 70 78 3b 0d 0a 20 20 20 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 20 32 34 70 78 3b 0d 0a 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 27 77 66 5f 53 65 67 6f 65 55 49 52 65 67 75 6c 61 72 27 2c 20 27 77 66 5f 53 65 67 6f 65 55 49 27 2c 20 27 53 65 67 6f 65 20 55 49 20 52 65 67 75 6c 61 72 27 2c 20 27 53 65 67 6f 65 20 55 49 27 2c 20 27 53 65 67 6f 65 27 2c 20 27 53 65 67 6f 65 20 57 50 27 2c 20 27 54 61 68 6f 6d 61 27 2c 20 27 56 65 72 64 61 6e 61 27 2c 20 27 41 72 69 61 6c 27 2c 20 27 73 61 6e 73 2d 73 65 72 69 66 27 3b 20 7d 0d 0a 0d 0a 2e 6f 62 66 2d Data Ascii: { display: block; }.obf-FontSubtitle { font-size: 18px; line-height: 24px; font-family: 'wf_SegoeUIRegular', 'wf_SegoeUI', 'Segoe UI Regular', 'Segoe UI', 'Segoe', 'Segoe WP', 'Tahoma', 'Verdana', 'Arial', 'sans-serif'; }.obf-
2024-05-23 22:56:30 UTC	14509	IN	Data Raw: 70 2d 63 6f 6d 6d 61 6e 64 42 61 72 20 2e 6d 73 2d 43 6f 6d 6d 61 6e 64 42 61 72 20 2e 6d 73 2d 42 75 74 74 6f 6e 2d 2d 63 6f 6d 6d 61 6e 64 42 61 72 2e 69 73 2d 64 69 73 61 62 6c 65 64 20 69 5b 64 61 74 61 2d 69 63 6f 6e 2d 6e 61 6d 65 3d 4e 65 78 74 5d 2c 0d 0a 2e 4f 6e 65 55 70 2d 2d 68 61 73 43 6f 6d 6d 61 6e 64 42 61 72 2e 4f 6e 65 55 70 2d 2d 6e 65 77 44 65 73 69 67 6e 65 64 43 6f 6d 6d 61 6e 64 42 61 72 20 2e 4f 6e 65 55 70 2d 63 6f 6d 6d 61 6e 64 42 61 72 20 2e 6d 73 2d 43 6f 6d 6d 61 6e 64 42 61 72 20 2e 6d 73 2d 42 75 74 74 6f 6e 2d 2d 63 6f 6d 6d 61 6e 64 42 61 72 2e 69 73 2d 64 69 73 61 62 6c 65 64 20 69 5b 64 61 74 61 2d 69 63 6f 6e 2d 6e 61 6d 65 3d 50 72 65 76 69 6f 75 73 5d 20 7b 0d 0a 20 20 20 20 63 6f 6c 6f 72 3a 23 30 30 37 38 44 34 3b Data Ascii: p-commandBar .ms-CommandBar .ms-Button--commandBar.is-disabled i[data-icon-name=Next],.OneUp--hasCommandBar.OneUp--newDesignedCommandBar .OneUp-commandBar .ms-CommandBar .ms-Button--commandBar.is-disabled i[data-icon-name=Previous] { color:#0078D4;

Timestamp	Bytes transferred	Direction	Data
2024-05-23 22:56:30 UTC	620	OUT	GET /img/pdf.png HTTP/1.1 Host: ms-1drive.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ms-1drive.com/v/794850bf-f104-442e-acb0-475634834dda Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-23 22:56:30 UTC	234	IN	HTTP/1.1 200 OK Server: nginx/1.25.5 Date: Thu, 23 May 2024 22:56:30 GMT Content-Type: image/png Content-Length: 1071 Last-Modified: Fri, 22 Sep 2023 08:45:04 GMT Connection: close ETag: "650d5410-42f" Accept-Ranges: bytes
2024-05-23 22:56:30 UTC	1071	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 60 00 00 00 60 08 06 00 00 00 e2 98 77 38 00 00 00 09 70 48 59 73 00 00 0b 13 00 00 0b 13 01 00 9a 9c 18 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 03 c4 49 44 41 54 78 01 ed dd 4d 48 14 61 1c c7 f1 df cc aa 1b 6e b2 15 15 e4 a1 35 88 8a 84 8a ea 5c 5e 82 5e 08 8a 28 b0 4c ad 43 87 a2 a0 83 74 e8 90 1d ba 15 05 bd 10 11 a5 6d b4 74 e8 05 a2 d7 53 d0 b5 22 cc 88 82 48 3b f4 4e 8a e2 e2 db ee d3 3c 92 a6 a2 9b cd 33 b3 ff 59 e6 f7 01 99 9d cb e2 3e df 7d d8 87 79 74 16 20 22 22 22 0a 23 0b 1e d8 5b bb 6b 6b 46 59 eb 9d 67 2b 45 d0 59 78 d6 df 9f b9 9d 4a a5 7e 22 00 22 30 b4 b7 ae 66 57 06 d6 66 e7 85 15 a3 30 24 22 76 64 f5 d2 ca ca 17 ad ad ad 69 08 Data Ascii: PNGIHDR``w8pHYssRGBgAMAaIDATxMHan5\^^(LCtmtS"H;N<3Y>}yt """#[kkFYg+EYxJ~""0fWf0$"vdi

Timestamp	Bytes transferred	Direction	Data
2024-05-23 22:56:31 UTC	620	OUT	GET /favicon.ico HTTP/1.1 Host: ms-1drive.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ms-1drive.com/v/794850bf-f104-442e-acb0-475634834dda Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-23 22:56:31 UTC	238	IN	HTTP/1.1 200 OK Server: nginx/1.25.5 Date: Thu, 23 May 2024 22:56:31 GMT Content-Type: image/x-icon Content-Length: 7886 Last-Modified: Fri, 22 Sep 2023 12:51:00 GMT Connection: close ETag: "650d8db4-1ece" Accept-Ranges: bytes
2024-05-23 22:56:31 UTC	7886	IN	Data Raw: 00 00 01 00 03 00 20 20 00 00 01 00 20 00 a8 10 00 00 36 00 00 00 18 18 00 00 01 00 20 00 88 09 00 00 de 10 00 00 10 10 00 00 01 00 20 00 68 04 00 00 66 1a 00 00 28 00 00 00 20 00 00 00 40 00 00 00 01 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: 6 hf( @

Timestamp	Bytes transferred	Direction	Data
2024-05-23 22:56:31 UTC	348	OUT	GET /img/pdf.png HTTP/1.1 Host: ms-1drive.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-23 22:56:32 UTC	234	IN	HTTP/1.1 200 OK Server: nginx/1.25.5 Date: Thu, 23 May 2024 22:56:31 GMT Content-Type: image/png Content-Length: 1071 Last-Modified: Fri, 22 Sep 2023 08:45:04 GMT Connection: close ETag: "650d5410-42f" Accept-Ranges: bytes
2024-05-23 22:56:32 UTC	1071	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 60 00 00 00 60 08 06 00 00 00 e2 98 77 38 00 00 00 09 70 48 59 73 00 00 0b 13 00 00 0b 13 01 00 9a 9c 18 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 03 c4 49 44 41 54 78 01 ed dd 4d 48 14 61 1c c7 f1 df cc aa 1b 6e b2 15 15 e4 a1 35 88 8a 84 8a ea 5c 5e 82 5e 08 8a 28 b0 4c ad 43 87 a2 a0 83 74 e8 90 1d ba 15 05 bd 10 11 a5 6d b4 74 e8 05 a2 d7 53 d0 b5 22 cc 88 82 48 3b f4 4e 8a e2 e2 db ee d3 3c 92 a6 a2 9b cd 33 b3 ff 59 e6 f7 01 99 9d cb e2 3e df 7d d8 87 79 74 16 20 22 22 22 0a 23 0b 1e d8 5b bb 6b 6b 46 59 eb 9d 67 2b 45 d0 59 78 d6 df 9f b9 9d 4a a5 7e 22 00 22 30 b4 b7 ae 66 57 06 d6 66 e7 85 15 a3 30 24 22 76 64 f5 d2 ca ca 17 ad ad ad 69 08 Data Ascii: PNGIHDR``w8pHYssRGBgAMAaIDATxMHan5\^^(LCtmtS"H;N<3Y>}yt """#[kkFYg+EYxJ~""0fWf0$"vdi

Timestamp	Bytes transferred	Direction	Data
2024-05-23 22:56:32 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-05-23 22:56:32 UTC	467	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (chd/079C) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-eus2-z1 Cache-Control: public, max-age=29243 Date: Thu, 23 May 2024 22:56:32 GMT Connection: close X-CID: 2

Timestamp	Bytes transferred	Direction	Data
2024-05-23 22:56:32 UTC	348	OUT	GET /favicon.ico HTTP/1.1 Host: ms-1drive.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-23 22:56:33 UTC	238	IN	HTTP/1.1 200 OK Server: nginx/1.25.5 Date: Thu, 23 May 2024 22:56:32 GMT Content-Type: image/x-icon Content-Length: 7886 Last-Modified: Fri, 22 Sep 2023 12:51:00 GMT Connection: close ETag: "650d8db4-1ece" Accept-Ranges: bytes
2024-05-23 22:56:33 UTC	7886	IN	Data Raw: 00 00 01 00 03 00 20 20 00 00 01 00 20 00 a8 10 00 00 36 00 00 00 18 18 00 00 01 00 20 00 88 09 00 00 de 10 00 00 10 10 00 00 01 00 20 00 68 04 00 00 66 1a 00 00 28 00 00 00 20 00 00 00 40 00 00 00 01 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: 6 hf( @