Edit tour

Windows Analysis Report
bc3c228ad2c13f96cb14375c3860e802.pdf

Overview

General Information

Sample name:	bc3c228ad2c13f96cb14375c3860e802.pdf
Analysis ID:	1541503
MD5:	5448dddeb4ccaa5cf39694f5c28a4b76
SHA1:	a64f68d8253c21beb398272f795aaa62db4de3f4
SHA256:	3d54f8929f551c67e0bec56d1a7c13be514b799da109ab85f3edb06681a32e2a
Infos:

Detection

HTMLPhisher

Score:	72
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

AI detected phishing page

Yara detected HtmlPhish54

AI detected landing page (webpage, office document or email)

Phishing site detected (based on favicon image match)

Phishing site detected (based on image similarity)

Phishing site detected (based on logo match)

Document contains embedded VBA macros

Document misses a certain OLE stream usually present in this Microsoft Office document type

Drops files with a non-matching file extension (content does not match file extension)

HTML body contains low number of good links

HTML page contains hidden javascript code

HTML page contains obfuscated script src

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

Stores files to the Windows start menu directory

Classification

Process Tree

System is w10x64_ra

Acrobat.exe (PID: 6544 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\bc3c228ad2c13f96cb14375c3860e802.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 6780 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 7000 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2264 --field-trial-handle=1548,i,196938426665746239,18177206994314547253,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

chrome.exe (PID: 7876 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://neweranet0-my.sharepoint.com/:f:/g/personal/malahmar_neweranet_com/Etd2wgQOOMlAnCPcJokAti0Br6HyyfMaB6MiwzMZjEF3xw?e=8rf3aZ MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)

chrome.exe (PID: 8072 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2148 --field-trial-handle=2032,i,248921863120407722,16504755158596381138,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)

cleanup

Yara Signatures

HTML

Source	Rule	Description	Author
0.133.id.script.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security
0.138.id.script.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security
5.16.pages.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security
5.10.pages.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security
5.12.pages.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security
4.8.pages.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security
Click to see the 1 entries

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Source: chromecache_918.17.dr

Binary or memory string: const PUBLIC_KEY = `-----BEGIN PUBLIC KEY-----

memstr_ed0e94c3-6

Phishing

AI detected phishing page

Source: https://illmuina.com/?fwrvtcrft=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmY2xpZW50LXJlcXVlc3QtaWQ9N2YxMjVkMGMtMTJjMy1jMjQyLTRmMmQtZWUxOTBkYzM0NWUwJnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODY1Mzk4MzQwNTg3NzYwMS5lMjE1ZTg3MC1lYzAzLTQyMTgtYWZlZC0xZGQxODc5ZGNmNjMmc3RhdGU9RGN0QkVvQWdDRUJScmVrNEpFZ0tIc2NSM0xicy1yRjRmX2R6U3VrTVI4Z1lTZEpaZS1PaF9HQlRrWTUwZTZYbUtnaS1rT0dwcERDM0c1QVpxUXhidTNPTzl5cnZOOHNQ&sso_reload=true	LLM: Score: 9 Reasons: The brand 'Outlook' is well-known and is associated with the domain 'outlook.com'., The provided URL 'illmuina.com' does not match the legitimate domain for Outlook., The URL 'illmuina.com' does not contain any recognizable elements related to Outlook., The presence of input fields for email and account creation is typical for phishing sites attempting to mimic login pages., The domain 'illmuina.com' is suspicious as it does not relate to any known service or brand associated with Outlook. DOM: 5.10.pages.csv
Source: https://illmuina.com/?fwrvtcrft=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmY2xpZW50LXJlcXVlc3QtaWQ9N2YxMjVkMGMtMTJjMy1jMjQyLTRmMmQtZWUxOTBkYzM0NWUwJnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODY1Mzk4MzQwNTg3NzYwMS5lMjE1ZTg3MC1lYzAzLTQyMTgtYWZlZC0xZGQxODc5ZGNmNjMmc3RhdGU9RGN0QkVvQWdDRUJScmVrNEpFZ0tIc2NSM0xicy1yRjRmX2R6U3VrTVI4Z1lTZEpaZS1PaF9HQlRrWTUwZTZYbUtnaS1rT0dwcERDM0c1QVpxUXhidTNPTzl5cnZOOHNQ&sso_reload=true	LLM: Score: 9 Reasons: The brand 'Microsoft' is classified as 'wellknown'., The legitimate domain for Microsoft is 'microsoft.com'., The provided URL 'illmuina.com' does not match the legitimate domain for Microsoft., The URL 'illmuina.com' does not contain any recognizable association with Microsoft., The URL does not contain any subdomains or elements that suggest a legitimate Microsoft service., The presence of input fields for 'Email, phone, or Skype' is typical for Microsoft services, but the domain mismatch is a strong indicator of phishing. DOM: 5.12.pages.csv

Yara detected HtmlPhish54

Source: Yara match	File source: 0.133.id.script.csv, type: HTML
Source: Yara match	File source: 0.138.id.script.csv, type: HTML
Source: Yara match	File source: 5.16.pages.csv, type: HTML
Source: Yara match	File source: 5.10.pages.csv, type: HTML
Source: Yara match	File source: 5.12.pages.csv, type: HTML
Source: Yara match	File source: 4.8.pages.csv, type: HTML

Phishing site detected (based on favicon image match)

Source: https://illmuina.com	Matcher: Template: microsoft matched with high similarity
Source: https://illmuina.com/?fwrvtcrft=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmY2xpZW50LXJlcXVlc3QtaWQ9N2YxMjVkMGMtMTJjMy1jMjQyLTRmMmQtZWUxOTBkYzM0NWUwJnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODY1Mzk4MzQwNTg3NzYwMS5lMjE1ZTg3MC1lYzAzLTQyMTgtYWZlZC0xZGQxODc5ZGNmNjMmc3RhdGU9RGN0QkVvQWdDRUJScmVrNEpFZ0tIc2NSM0xicy1yRjRmX2R6U3VrTVI4Z1lTZEpaZS1PaF9HQlRrWTUwZTZYbUtnaS1rT0dwcERDM0c1QVpxUXhidTNPTzl5cnZOOHNQ&sso_reload=true	Matcher: Template: microsoft matched with high similarity

Phishing site detected (based on image similarity)

Source: https://illmuina.com/?fwrvtcrft=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmY2xpZW50LXJlcXVlc3QtaWQ9N2YxMjVkMGMtMTJjMy1jMjQyLTRmMmQtZWUxOTBkYzM0NWUwJnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODY1Mzk4MzQwNTg3NzYwMS5lMjE1ZTg3MC1lYzAzLTQyMTgtYWZlZC0xZGQxODc5ZGNmNjMmc3RhdGU9RGN0QkVvQWdDRUJScmVrNEpFZ0tIc2NSM0xicy1yRjRmX2R6U3VrTVI4Z1lTZEpaZS1PaF9HQlRrWTUwZTZYbUtnaS1rT0dwcERDM0c1QVpxUXhidTNPTzl5cnZOOHNQ&sso_reload=true

Matcher: Found strong image similarity, brand: MICROSOFT

Phishing site detected (based on logo match)

Source: https://illmuina.com/?fwrvtcrft=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmN	Matcher: Template: microsoft matched
Source: https://illmuina.com/?fwrvtcrft=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmN	Matcher: Template: microsoft matched

HTTP Parser: Number of links: 1

HTTP Parser: Base64 decoded: function c(){if(!document.querySelector(".b") || !document.querySelector(".g")){document.head.appendChild(Object.assign(document.createElement("div"),{classList:["b"]}));document.documentElement.style.filter="hue-rotate(4deg)";document.head.appendChild(Ob...

Source: https://illmuina.com/?fwrvtcrft=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc2	HTTP Parser: Script src: data:text/javascript;base64,ZnVuY3Rpb24gYygpe2lmKCFkb2N1bWVudC5xdWVyeVNlbGVjdG9yKCIuYiIpIHx8ICFkb2N1bWVudC5xdWVyeVNlbGVjdG9yKCIuZyIpKXtkb2N1bWVudC5oZWFkLmFwcGVuZENoaWxkKE9iamVjdC5hc3NpZ24oZG9jdW1lbnQuY3JlYXRlRWxlbWVudCgiZGl2Iikse2NsYXNzTGlzdDpbImIiXX
Source: https://illmuina.com/?fwrvtcrft=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc2	HTTP Parser: Script src: data:text/javascript;base64,ZnVuY3Rpb24gYygpe2lmKCFkb2N1bWVudC5xdWVyeVNlbGVjdG9yKCIuYiIpIHx8ICFkb2N1bWVudC5xdWVyeVNlbGVjdG9yKCIuZyIpKXtkb2N1bWVudC5oZWFkLmFwcGVuZENoaWxkKE9iamVjdC5hc3NpZ24oZG9jdW1lbnQuY3JlYXRlRWxlbWVudCgiZGl2Iikse2NsYXNzTGlzdDpbImIiXX
Source: https://illmuina.com/?fwrvtcrft=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc2	HTTP Parser: Script src: data:text/javascript;base64,ZnVuY3Rpb24gYygpe2lmKCFkb2N1bWVudC5xdWVyeVNlbGVjdG9yKCIuYiIpIHx8ICFkb2N1bWVudC5xdWVyeVNlbGVjdG9yKCIuZyIpKXtkb2N1bWVudC5oZWFkLmFwcGVuZENoaWxkKE9iamVjdC5hc3NpZ24oZG9jdW1lbnQuY3JlYXRlRWxlbWVudCgiZGl2Iikse2NsYXNzTGlzdDpbImIiXX
Source: https://illmuina.com/?fwrvtcrft=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc2	HTTP Parser: Script src: data:text/javascript;base64,ZnVuY3Rpb24gYygpe2lmKCFkb2N1bWVudC5xdWVyeVNlbGVjdG9yKCIuYiIpIHx8ICFkb2N1bWVudC5xdWVyeVNlbGVjdG9yKCIuZyIpKXtkb2N1bWVudC5oZWFkLmFwcGVuZENoaWxkKE9iamVjdC5hc3NpZ24oZG9jdW1lbnQuY3JlYXRlRWxlbWVudCgiZGl2Iikse2NsYXNzTGlzdDpbImIiXX

Source: https://illmuina.com/?fwrvtcrft=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmY2xpZW50LXJlcXVlc3QtaWQ9N2YxMjVkMGMtMTJjMy1jMjQyLTRmMmQtZWUxOTBkYzM0NWUwJnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODY1Mzk4MzQwNTg3NzYwMS5lMjE1ZTg3MC1lYzAzLTQyMTgtYWZlZC0xZGQxODc5ZGNmNjMmc3RhdGU9RGN0QkVvQWdDRUJScmVrNEpFZ0tIc2NSM0xicy1yRjRmX2R6U3VrTVI4Z1lTZEpaZS1PaF9HQlRrWTUwZTZYbUtnaS1rT0dwcERDM0c1QVpxUXhidTNPTzl5cnZOOHNQ&sso_reload=true	HTTP Parser: Iframe src: https://outlook.office365.com/owa/prefetch.aspx
Source: https://illmuina.com/?fwrvtcrft=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmY2xpZW50LXJlcXVlc3QtaWQ9N2YxMjVkMGMtMTJjMy1jMjQyLTRmMmQtZWUxOTBkYzM0NWUwJnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODY1Mzk4MzQwNTg3NzYwMS5lMjE1ZTg3MC1lYzAzLTQyMTgtYWZlZC0xZGQxODc5ZGNmNjMmc3RhdGU9RGN0QkVvQWdDRUJScmVrNEpFZ0tIc2NSM0xicy1yRjRmX2R6U3VrTVI4Z1lTZEpaZS1PaF9HQlRrWTUwZTZYbUtnaS1rT0dwcERDM0c1QVpxUXhidTNPTzl5cnZOOHNQ&sso_reload=true	HTTP Parser: Iframe src: https://outlook.office365.com/owa/prefetch.aspx
Source: https://illmuina.com/?fwrvtcrft=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmY2xpZW50LXJlcXVlc3QtaWQ9N2YxMjVkMGMtMTJjMy1jMjQyLTRmMmQtZWUxOTBkYzM0NWUwJnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODY1Mzk4MzQwNTg3NzYwMS5lMjE1ZTg3MC1lYzAzLTQyMTgtYWZlZC0xZGQxODc5ZGNmNjMmc3RhdGU9RGN0QkVvQWdDRUJScmVrNEpFZ0tIc2NSM0xicy1yRjRmX2R6U3VrTVI4Z1lTZEpaZS1PaF9HQlRrWTUwZTZYbUtnaS1rT0dwcERDM0c1QVpxUXhidTNPTzl5cnZOOHNQ&sso_reload=true	HTTP Parser: Iframe src: https://outlook.office365.com/owa/prefetch.aspx

HTTP Parser: <input type="password" .../> found

Source: https://16b69e33.0cced60565238cd25cf4ed69.workers.dev/	HTTP Parser: No favicon
Source: https://16b69e33.0cced60565238cd25cf4ed69.workers.dev/	HTTP Parser: No favicon
Source: https://illmuina.com/?fwrvtcrft=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmY2xpZW50LXJlcXVlc3QtaWQ9N2YxMjVkMGMtMTJjMy1jMjQyLTRmMmQtZWUxOTBkYzM0NWUwJnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODY1Mzk4MzQwNTg3NzYwMS5lMjE1ZTg3MC1lYzAzLTQyMTgtYWZlZC0xZGQxODc5ZGNmNjMmc3RhdGU9RGN0QkVvQWdDRUJScmVrNEpFZ0tIc2NSM0xicy1yRjRmX2R6U3VrTVI4Z1lTZEpaZS1PaF9HQlRrWTUwZTZYbUtnaS1rT0dwcERDM0c1QVpxUXhidTNPTzl5cnZOOHNQ	HTTP Parser: No favicon
Source: https://illmuina.com/?fwrvtcrft=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmY2xpZW50LXJlcXVlc3QtaWQ9N2YxMjVkMGMtMTJjMy1jMjQyLTRmMmQtZWUxOTBkYzM0NWUwJnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODY1Mzk4MzQwNTg3NzYwMS5lMjE1ZTg3MC1lYzAzLTQyMTgtYWZlZC0xZGQxODc5ZGNmNjMmc3RhdGU9RGN0QkVvQWdDRUJScmVrNEpFZ0tIc2NSM0xicy1yRjRmX2R6U3VrTVI4Z1lTZEpaZS1PaF9HQlRrWTUwZTZYbUtnaS1rT0dwcERDM0c1QVpxUXhidTNPTzl5cnZOOHNQ&sso_reload=true	HTTP Parser: No favicon
Source: https://illmuina.com/?fwrvtcrft=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmY2xpZW50LXJlcXVlc3QtaWQ9N2YxMjVkMGMtMTJjMy1jMjQyLTRmMmQtZWUxOTBkYzM0NWUwJnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODY1Mzk4MzQwNTg3NzYwMS5lMjE1ZTg3MC1lYzAzLTQyMTgtYWZlZC0xZGQxODc5ZGNmNjMmc3RhdGU9RGN0QkVvQWdDRUJScmVrNEpFZ0tIc2NSM0xicy1yRjRmX2R6U3VrTVI4Z1lTZEpaZS1PaF9HQlRrWTUwZTZYbUtnaS1rT0dwcERDM0c1QVpxUXhidTNPTzl5cnZOOHNQ&sso_reload=true	HTTP Parser: No favicon
Source: https://illmuina.com/?fwrvtcrft=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmY2xpZW50LXJlcXVlc3QtaWQ9N2YxMjVkMGMtMTJjMy1jMjQyLTRmMmQtZWUxOTBkYzM0NWUwJnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODY1Mzk4MzQwNTg3NzYwMS5lMjE1ZTg3MC1lYzAzLTQyMTgtYWZlZC0xZGQxODc5ZGNmNjMmc3RhdGU9RGN0QkVvQWdDRUJScmVrNEpFZ0tIc2NSM0xicy1yRjRmX2R6U3VrTVI4Z1lTZEpaZS1PaF9HQlRrWTUwZTZYbUtnaS1rT0dwcERDM0c1QVpxUXhidTNPTzl5cnZOOHNQ&sso_reload=true	HTTP Parser: No favicon
Source: https://illmuina.com/?fwrvtcrft=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmY2xpZW50LXJlcXVlc3QtaWQ9N2YxMjVkMGMtMTJjMy1jMjQyLTRmMmQtZWUxOTBkYzM0NWUwJnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODY1Mzk4MzQwNTg3NzYwMS5lMjE1ZTg3MC1lYzAzLTQyMTgtYWZlZC0xZGQxODc5ZGNmNjMmc3RhdGU9RGN0QkVvQWdDRUJScmVrNEpFZ0tIc2NSM0xicy1yRjRmX2R6U3VrTVI4Z1lTZEpaZS1PaF9HQlRrWTUwZTZYbUtnaS1rT0dwcERDM0c1QVpxUXhidTNPTzl5cnZOOHNQ&sso_reload=true	HTTP Parser: No favicon

Source: https://illmuina.com/?fwrvtcrft=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmY2xpZW50LXJlcXVlc3QtaWQ9N2YxMjVkMGMtMTJjMy1jMjQyLTRmMmQtZWUxOTBkYzM0NWUwJnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODY1Mzk4MzQwNTg3NzYwMS5lMjE1ZTg3MC1lYzAzLTQyMTgtYWZlZC0xZGQxODc5ZGNmNjMmc3RhdGU9RGN0QkVvQWdDRUJScmVrNEpFZ0tIc2NSM0xicy1yRjRmX2R6U3VrTVI4Z1lTZEpaZS1PaF9HQlRrWTUwZTZYbUtnaS1rT0dwcERDM0c1QVpxUXhidTNPTzl5cnZOOHNQ&sso_reload=true	HTTP Parser: No <meta name="author".. found
Source: https://illmuina.com/?fwrvtcrft=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmY2xpZW50LXJlcXVlc3QtaWQ9N2YxMjVkMGMtMTJjMy1jMjQyLTRmMmQtZWUxOTBkYzM0NWUwJnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODY1Mzk4MzQwNTg3NzYwMS5lMjE1ZTg3MC1lYzAzLTQyMTgtYWZlZC0xZGQxODc5ZGNmNjMmc3RhdGU9RGN0QkVvQWdDRUJScmVrNEpFZ0tIc2NSM0xicy1yRjRmX2R6U3VrTVI4Z1lTZEpaZS1PaF9HQlRrWTUwZTZYbUtnaS1rT0dwcERDM0c1QVpxUXhidTNPTzl5cnZOOHNQ&sso_reload=true	HTTP Parser: No <meta name="author".. found
Source: https://illmuina.com/?fwrvtcrft=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmY2xpZW50LXJlcXVlc3QtaWQ9N2YxMjVkMGMtMTJjMy1jMjQyLTRmMmQtZWUxOTBkYzM0NWUwJnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODY1Mzk4MzQwNTg3NzYwMS5lMjE1ZTg3MC1lYzAzLTQyMTgtYWZlZC0xZGQxODc5ZGNmNjMmc3RhdGU9RGN0QkVvQWdDRUJScmVrNEpFZ0tIc2NSM0xicy1yRjRmX2R6U3VrTVI4Z1lTZEpaZS1PaF9HQlRrWTUwZTZYbUtnaS1rT0dwcERDM0c1QVpxUXhidTNPTzl5cnZOOHNQ&sso_reload=true	HTTP Parser: No <meta name="author".. found

Source: https://illmuina.com/?fwrvtcrft=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmY2xpZW50LXJlcXVlc3QtaWQ9N2YxMjVkMGMtMTJjMy1jMjQyLTRmMmQtZWUxOTBkYzM0NWUwJnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODY1Mzk4MzQwNTg3NzYwMS5lMjE1ZTg3MC1lYzAzLTQyMTgtYWZlZC0xZGQxODc5ZGNmNjMmc3RhdGU9RGN0QkVvQWdDRUJScmVrNEpFZ0tIc2NSM0xicy1yRjRmX2R6U3VrTVI4Z1lTZEpaZS1PaF9HQlRrWTUwZTZYbUtnaS1rT0dwcERDM0c1QVpxUXhidTNPTzl5cnZOOHNQ&sso_reload=true	HTTP Parser: No <meta name="copyright".. found
Source: https://illmuina.com/?fwrvtcrft=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmY2xpZW50LXJlcXVlc3QtaWQ9N2YxMjVkMGMtMTJjMy1jMjQyLTRmMmQtZWUxOTBkYzM0NWUwJnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODY1Mzk4MzQwNTg3NzYwMS5lMjE1ZTg3MC1lYzAzLTQyMTgtYWZlZC0xZGQxODc5ZGNmNjMmc3RhdGU9RGN0QkVvQWdDRUJScmVrNEpFZ0tIc2NSM0xicy1yRjRmX2R6U3VrTVI4Z1lTZEpaZS1PaF9HQlRrWTUwZTZYbUtnaS1rT0dwcERDM0c1QVpxUXhidTNPTzl5cnZOOHNQ&sso_reload=true	HTTP Parser: No <meta name="copyright".. found
Source: https://illmuina.com/?fwrvtcrft=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmY2xpZW50LXJlcXVlc3QtaWQ9N2YxMjVkMGMtMTJjMy1jMjQyLTRmMmQtZWUxOTBkYzM0NWUwJnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODY1Mzk4MzQwNTg3NzYwMS5lMjE1ZTg3MC1lYzAzLTQyMTgtYWZlZC0xZGQxODc5ZGNmNjMmc3RhdGU9RGN0QkVvQWdDRUJScmVrNEpFZ0tIc2NSM0xicy1yRjRmX2R6U3VrTVI4Z1lTZEpaZS1PaF9HQlRrWTUwZTZYbUtnaS1rT0dwcERDM0c1QVpxUXhidTNPTzl5cnZOOHNQ&sso_reload=true	HTTP Parser: No <meta name="copyright".. found

Source: unknown	HTTPS traffic detected: 172.202.163.200:443 -> 192.168.2.17:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.17:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.17:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.202.163.200:443 -> 192.168.2.17:49957 version: TLS 1.2

Source: Joe Sandbox View	IP Address: 13.107.136.10 13.107.136.10
Source: Joe Sandbox View	IP Address: 104.18.94.41 104.18.94.41
Source: Joe Sandbox View	IP Address: 13.107.246.60 13.107.246.60

Source: Joe Sandbox View

JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.13
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.13
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27

Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=GaeUzFe9fxuK3Gv&MD=Y3CzMhnY HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /onboarding/smskillreader.txt HTTP/1.1Host: armmf.adobe.comConnection: keep-aliveAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brIf-None-Match: "78-5faa31cce96da"If-Modified-Since: Mon, 01 May 2023 15:02:33 GMT
Source: global traffic	HTTP traffic detected: GET /:f:/g/personal/malahmar_neweranet_com/Etd2wgQOOMlAnCPcJokAti0Br6HyyfMaB6MiwzMZjEF3xw?e=8rf3aZ HTTP/1.1Host: neweranet0-my.sharepoint.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /personal/malahmar_neweranet_com/_layouts/15/onedrive.aspx?id=%2Fpersonal%2Fmalahmar%5Fneweranet%5Fcom%2FDocuments%2FRfq82020%2D382039302%2D42445&ga=1 HTTP/1.1Host: neweranet0-my.sharepoint.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uIzMxYTU4NjIyMGI5ZTA0YWZhN2U3MTU2YTUxODQyNjEwNTViZDA2MjZkZjY3M2I3NTdjMmUwMTkwNTRlNWNkY2EsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jMzFhNTg2MjIwYjllMDRhZmE3ZTcxNTZhNTE4NDI2MTA1NWJkMDYyNmRmNjczYjc1N2MyZTAxOTA1NGU1Y2RjYSwxMzM3NDI3NTM4MjAwMDAwMDAsMCwxMzM3NDM2MTQ4MjUwMjE0ODYsMC4wLjAuMCwyNTgsZDNlZTNmZWQtYjU1ZS00OTMyLWEzNTQtZDkyNWRmNWM1MGRjLCwsMGMyNjVkYTEtYjA4MS02MDAwLWFhMGUtMWFiNTc0MmU5NjI2LDBjMjY1ZGExLWIwODEtNjAwMC1hYTBlLTFhYjU3NDJlOTYyNixMTDZLWmNUTXBrbVhKOEo3akVQVGdBLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTI0MjYsdVhlaFFKUGxlVmpOQ2Jha1VoR0Q2SXlGUVFrLGNPUStvdXpteUIzb2EyZ2Fob3BLWktnend3WlN2eGFvdk1VZFVzUDBqTGlhb2xZcDNSOUk4d0dMYmhOMkw4VFo3c1psREk1TmRjWFlUM0tMd1p2VmdUVE95M2t0emwrRjdJY1lNZHNyck9zWWoxQ0FkMnNQUisvekVqL1d0czRVRUx0UE5vSklEekZqUW1NN1dvTWQ4TnNscE1xMEJWT1A2cGkrUC9hRnBmMkxuMnpiTEkrSzBDb1BxelRSK25rUHRKakIvRUU1V3RrMXJ6WWR2L1ZiQ3dhcGR5OW14Mmw2ZHRvMGprT0RBM0ErSi9VaE45a3JmSkUyV04wck1mRGxFRGtld0dIemZnNjFLUkFvN0UwaTNaeEtPTkltZm9lNlBKRC9wTkg5NEsraUw2d3o0cWZuYXlPR0pURnRDQnVyUjlCTCtScXNTanliTUo1RlNrcUY0QT09PC9TUD4=
Source: global traffic	HTTP traffic detected: GET /_layouts/15/spwebworkerproxy.ashx HTTP/1.1Host: neweranet0-my.sharepoint.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uIzMxYTU4NjIyMGI5ZTA0YWZhN2U3MTU2YTUxODQyNjEwNTViZDA2MjZkZjY3M2I3NTdjMmUwMTkwNTRlNWNkY2EsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jMzFhNTg2MjIwYjllMDRhZmE3ZTcxNTZhNTE4NDI2MTA1NWJkMDYyNmRmNjczYjc1N2MyZTAxOTA1NGU1Y2RjYSwxMzM3NDI3NTM4MjAwMDAwMDAsMCwxMzM3NDM2MTQ4MjUwMjE0ODYsMC4wLjAuMCwyNTgsZDNlZTNmZWQtYjU1ZS00OTMyLWEzNTQtZDkyNWRmNWM1MGRjLCwsMGMyNjVkYTEtYjA4MS02MDAwLWFhMGUtMWFiNTc0MmU5NjI2LDBjMjY1ZGExLWIwODEtNjAwMC1hYTBlLTFhYjU3NDJlOTYyNixMTDZLWmNUTXBrbVhKOEo3akVQVGdBLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTI0MjYsdVhlaFFKUGxlVmpOQ2Jha1VoR0Q2SXlGUVFrLGNPUStvdXpteUIzb2EyZ2Fob3BLWktnend3WlN2eGFvdk1VZFVzUDBqTGlhb2xZcDNSOUk4d0dMYmhOMkw4VFo3c1psREk1TmRjWFlUM0tMd1p2VmdUVE95M2t0emwrRjdJY1lNZHNyck9zWWoxQ0FkMnNQUisvekVqL1d0czRVRUx0UE5vSklEekZqUW1NN1dvTWQ4TnNscE1xMEJWT1A2cGkrUC9hRnBmMkxuMnpiTEkrSzBDb1BxelRSK25rUHRKakIvRUU1V3RrMXJ6WWR2L1ZiQ3dhcGR5OW14Mmw2ZHRvMGprT0RBM0ErSi9VaE45a3JmSkUyV04wck1mRGxFRGtld0dIemZnNjFLUkFvN0UwaTNaeEtPTkltZm9lNlBKRC9wTkg5NEsraUw2d3o0cWZuYXlPR0pURnRDQnVyUjlCTCtScXNTanliTUo1RlNrcUY0QT09PC9TUD4=
Source: global traffic	HTTP traffic detected: GET /_layouts/15/spwebworkerproxy.ashx HTTP/1.1Host: neweranet0-my.sharepoint.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uIzMxYTU4NjIyMGI5ZTA0YWZhN2U3MTU2YTUxODQyNjEwNTViZDA2MjZkZjY3M2I3NTdjMmUwMTkwNTRlNWNkY2EsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jMzFhNTg2MjIwYjllMDRhZmE3ZTcxNTZhNTE4NDI2MTA1NWJkMDYyNmRmNjczYjc1N2MyZTAxOTA1NGU1Y2RjYSwxMzM3NDI3NTM4MjAwMDAwMDAsMCwxMzM3NDM2MTQ4MjUwMjE0ODYsMC4wLjAuMCwyNTgsZDNlZTNmZWQtYjU1ZS00OTMyLWEzNTQtZDkyNWRmNWM1MGRjLCwsMGMyNjVkYTEtYjA4MS02MDAwLWFhMGUtMWFiNTc0MmU5NjI2LDBjMjY1ZGExLWIwODEtNjAwMC1hYTBlLTFhYjU3NDJlOTYyNixMTDZLWmNUTXBrbVhKOEo3akVQVGdBLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTI0MjYsdVhlaFFKUGxlVmpOQ2Jha1VoR0Q2SXlGUVFrLGNPUStvdXpteUIzb2EyZ2Fob3BLWktnend3WlN2eGFvdk1VZFVzUDBqTGlhb2xZcDNSOUk4d0dMYmhOMkw4VFo3c1psREk1TmRjWFlUM0tMd1p2VmdUVE95M2t0emwrRjdJY1lNZHNyck9zWWoxQ0FkMnNQUisvekVqL1d0czRVRUx0UE5vSklEekZqUW1NN1dvTWQ4TnNscE1xMEJWT1A2cGkrUC9hRnBmMkxuMnpiTEkrSzBDb1BxelRSK25rUHRKakIvRUU1V3RrMXJ6WWR2L1ZiQ3dhcGR5OW14Mmw2ZHRvMGprT0RBM0ErSi9VaE45a3JmSkUyV04wck1mRGxFRGtld0dIemZnNjFLUkFvN0UwaTNaeEtPTkltZm9lNlBKRC9wTkg5NEsraUw2d3o0cWZuYXlPR0pURnRDQnVyUjlCTCtScXNTanliTUo1RlNrcUY0QT09PC9TUD4=
Source: global traffic	HTTP traffic detected: GET /personal/malahmar_neweranet_com/_api/v2.1/graphql HTTP/1.1Host: neweranet0-my.sharepoint.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uIzMxYTU4NjIyMGI5ZTA0YWZhN2U3MTU2YTUxODQyNjEwNTViZDA2MjZkZjY3M2I3NTdjMmUwMTkwNTRlNWNkY2EsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jMzFhNTg2MjIwYjllMDRhZmE3ZTcxNTZhNTE4NDI2MTA1NWJkMDYyNmRmNjczYjc1N2MyZTAxOTA1NGU1Y2RjYSwxMzM3NDI3NTM4MjAwMDAwMDAsMCwxMzM3NDM2MTQ4MjUwMjE0ODYsMC4wLjAuMCwyNTgsZDNlZTNmZWQtYjU1ZS00OTMyLWEzNTQtZDkyNWRmNWM1MGRjLCwsMGMyNjVkYTEtYjA4MS02MDAwLWFhMGUtMWFiNTc0MmU5NjI2LDBjMjY1ZGExLWIwODEtNjAwMC1hYTBlLTFhYjU3NDJlOTYyNixMTDZLWmNUTXBrbVhKOEo3akVQVGdBLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTI0MjYsdVhlaFFKUGxlVmpOQ2Jha1VoR0Q2SXlGUVFrLGNPUStvdXpteUIzb2EyZ2Fob3BLWktnend3WlN2eGFvdk1VZFVzUDBqTGlhb2xZcDNSOUk4d0dMYmhOMkw4VFo3c1psREk1TmRjWFlUM0tMd1p2VmdUVE95M2t0emwrRjdJY1lNZHNyck9zWWoxQ0FkMnNQUisvekVqL1d0czRVRUx0UE5vSklEekZqUW1NN1dvTWQ4TnNscE1xMEJWT1A2cGkrUC9hRnBmMkxuMnpiTEkrSzBDb1BxelRSK25rUHRKakIvRUU1V3RrMXJ6WWR2L1ZiQ3dhcGR5OW14Mmw2ZHRvMGprT0RBM0ErSi9VaE45a3JmSkUyV04wck1mRGxFRGtld0dIemZnNjFLUkFvN0UwaTNaeEtPTkltZm9lNlBKRC9wTkg5NEsraUw2d3o0cWZuYXlPR0pURnRDQnVyUjlCTCtScXNTanliTUo1RlNrcUY0QT09PC9TUD4=
Source: global traffic	HTTP traffic detected: GET /_layouts/15/images/odbfavicon.ico?rev=47 HTTP/1.1Host: neweranet0-my.sharepoint.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://neweranet0-my.sharepoint.com/personal/malahmar_neweranet_com/_layouts/15/onedrive.aspx?id=%2Fpersonal%2Fmalahmar%5Fneweranet%5Fcom%2FDocuments%2FRfq82020%2D382039302%2D42445&ga=1Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uIzMxYTU4NjIyMGI5ZTA0YWZhN2U3MTU2YTUxODQyNjEwNTViZDA2MjZkZjY3M2I3NTdjMmUwMTkwNTRlNWNkY2EsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jMzFhNTg2MjIwYjllMDRhZmE3ZTcxNTZhNTE4NDI2MTA1NWJkMDYyNmRmNjczYjc1N2MyZTAxOTA1NGU1Y2RjYSwxMzM3NDI3NTM4MjAwMDAwMDAsMCwxMzM3NDM2MTQ4MjUwMjE0ODYsMC4wLjAuMCwyNTgsZDNlZTNmZWQtYjU1ZS00OTMyLWEzNTQtZDkyNWRmNWM1MGRjLCwsMGMyNjVkYTEtYjA4MS02MDAwLWFhMGUtMWFiNTc0MmU5NjI2LDBjMjY1ZGExLWIwODEtNjAwMC1hYTBlLTFhYjU3NDJlOTYyNixMTDZLWmNUTXBrbVhKOEo3akVQVGdBLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTI0MjYsdVhlaFFKUGxlVmpOQ2Jha1VoR0Q2SXlGUVFrLGNPUStvdXpteUIzb2EyZ2Fob3BLWktnend3WlN2eGFvdk1VZFVzUDBqTGlhb2xZcDNSOUk4d0dMYmhOMkw4VFo3c1psREk1TmRjWFlUM0tMd1p2VmdUVE95M2t0emwrRjdJY1lNZHNyck9zWWoxQ0FkMnNQUisvekVqL1d0czRVRUx0UE5vSklEekZqUW1NN1dvTWQ4TnNscE1xMEJWT1A2cGkrUC9hRnBmMkxuMnpiTEkrSzBDb1BxelRSK25rUHRKakIvRUU1V3RrMXJ6WWR2L1ZiQ3dhcGR5OW14Mmw2ZHRvMGprT0RBM0ErSi9VaE45a3JmSkUyV04wck1mRGxFRGtld0dIemZnNjFLUkFvN0UwaTNaeEtPTkltZm9lNlBKRC9wTkg5NEsraUw2d3o0cWZuYXlPR0pURnRDQnVyUjlCTCtScXNTanliTUo1RlNrcUY0QT09PC9TUD4=; FeatureOverrides_experiments=[]
Source: global traffic	HTTP traffic detected: GET /_layouts/15/images/odbfavicon.ico?rev=47 HTTP/1.1Host: neweranet0-my.sharepoint.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uIzMxYTU4NjIyMGI5ZTA0YWZhN2U3MTU2YTUxODQyNjEwNTViZDA2MjZkZjY3M2I3NTdjMmUwMTkwNTRlNWNkY2EsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jMzFhNTg2MjIwYjllMDRhZmE3ZTcxNTZhNTE4NDI2MTA1NWJkMDYyNmRmNjczYjc1N2MyZTAxOTA1NGU1Y2RjYSwxMzM3NDI3NTM4MjAwMDAwMDAsMCwxMzM3NDM2MTQ4MjUwMjE0ODYsMC4wLjAuMCwyNTgsZDNlZTNmZWQtYjU1ZS00OTMyLWEzNTQtZDkyNWRmNWM1MGRjLCwsMGMyNjVkYTEtYjA4MS02MDAwLWFhMGUtMWFiNTc0MmU5NjI2LDBjMjY1ZGExLWIwODEtNjAwMC1hYTBlLTFhYjU3NDJlOTYyNixMTDZLWmNUTXBrbVhKOEo3akVQVGdBLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTI0MjYsdVhlaFFKUGxlVmpOQ2Jha1VoR0Q2SXlGUVFrLGNPUStvdXpteUIzb2EyZ2Fob3BLWktnend3WlN2eGFvdk1VZFVzUDBqTGlhb2xZcDNSOUk4d0dMYmhOMkw4VFo3c1psREk1TmRjWFlUM0tMd1p2VmdUVE95M2t0emwrRjdJY1lNZHNyck9zWWoxQ0FkMnNQUisvekVqL1d0czRVRUx0UE5vSklEekZqUW1NN1dvTWQ4TnNscE1xMEJWT1A2cGkrUC9hRnBmMkxuMnpiTEkrSzBDb1BxelRSK25rUHRKakIvRUU1V3RrMXJ6WWR2L1ZiQ3dhcGR5OW14Mmw2ZHRvMGprT0RBM0ErSi9VaE45a3JmSkUyV04wck1mRGxFRGtld0dIemZnNjFLUkFvN0UwaTNaeEtPTkltZm9lNlBKRC9wTkg5NEsraUw2d3o0cWZuYXlPR0pURnRDQnVyUjlCTCtScXNTanliTUo1RlNrcUY0QT09PC9TUD4=; FeatureOverrides_experiments=[]
Source: global traffic	HTTP traffic detected: GET /personal/malahmar_neweranet_com/_api/web/GetListUsingPath(DecodedUrl=@a1)/RenderListDataAsStream?@a1=%27%2Fpersonal%2Fmalahmar%5Fneweranet%5Fcom%2FDocuments%27&RootFolder=%2Fpersonal%2Fmalahmar%5Fneweranet%5Fcom%2FDocuments%2FRfq82020%2D382039302%2D42445&TryNewExperienceSingle=TRUE HTTP/1.1Host: neweranet0-my.sharepoint.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uIzMxYTU4NjIyMGI5ZTA0YWZhN2U3MTU2YTUxODQyNjEwNTViZDA2MjZkZjY3M2I3NTdjMmUwMTkwNTRlNWNkY2EsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jMzFhNTg2MjIwYjllMDRhZmE3ZTcxNTZhNTE4NDI2MTA1NWJkMDYyNmRmNjczYjc1N2MyZTAxOTA1NGU1Y2RjYSwxMzM3NDI3NTM4MjAwMDAwMDAsMCwxMzM3NDM2MTQ4MjUwMjE0ODYsMC4wLjAuMCwyNTgsZDNlZTNmZWQtYjU1ZS00OTMyLWEzNTQtZDkyNWRmNWM1MGRjLCwsMGMyNjVkYTEtYjA4MS02MDAwLWFhMGUtMWFiNTc0MmU5NjI2LDBjMjY1ZGExLWIwODEtNjAwMC1hYTBlLTFhYjU3NDJlOTYyNixMTDZLWmNUTXBrbVhKOEo3akVQVGdBLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTI0MjYsdVhlaFFKUGxlVmpOQ2Jha1VoR0Q2SXlGUVFrLGNPUStvdXpteUIzb2EyZ2Fob3BLWktnend3WlN2eGFvdk1VZFVzUDBqTGlhb2xZcDNSOUk4d0dMYmhOMkw4VFo3c1psREk1TmRjWFlUM0tMd1p2VmdUVE95M2t0emwrRjdJY1lNZHNyck9zWWoxQ0FkMnNQUisvekVqL1d0czRVRUx0UE5vSklEekZqUW1NN1dvTWQ4TnNscE1xMEJWT1A2cGkrUC9hRnBmMkxuMnpiTEkrSzBDb1BxelRSK25rUHRKakIvRUU1V3RrMXJ6WWR2L1ZiQ3dhcGR5OW14Mmw2ZHRvMGprT0RBM0ErSi9VaE45a3JmSkUyV04wck1mRGxFRGtld0dIemZnNjFLUkFvN0UwaTNaeEtPTkltZm9lNlBKRC9wTkg5NEsraUw2d3o0cWZuYXlPR0pURnRDQnVyUjlCTCtScXNTanliTUo1RlNrcUY0QT09PC9TUD4=; FeatureOverrides_experiments=[]
Source: global traffic	HTTP traffic detected: GET /personal/malahmar_neweranet_com/_api/web/GetListUsingPath(DecodedUrl=@a1)/RenderListDataAsStream?@a1=%27%2Fpersonal%2Fmalahmar%5Fneweranet%5Fcom%2FDocuments%27&TryNewExperienceSingle=TRUE HTTP/1.1Host: neweranet0-my.sharepoint.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uIzMxYTU4NjIyMGI5ZTA0YWZhN2U3MTU2YTUxODQyNjEwNTViZDA2MjZkZjY3M2I3NTdjMmUwMTkwNTRlNWNkY2EsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jMzFhNTg2MjIwYjllMDRhZmE3ZTcxNTZhNTE4NDI2MTA1NWJkMDYyNmRmNjczYjc1N2MyZTAxOTA1NGU1Y2RjYSwxMzM3NDI3NTM4MjAwMDAwMDAsMCwxMzM3NDM2MTQ4MjUwMjE0ODYsMC4wLjAuMCwyNTgsZDNlZTNmZWQtYjU1ZS00OTMyLWEzNTQtZDkyNWRmNWM1MGRjLCwsMGMyNjVkYTEtYjA4MS02MDAwLWFhMGUtMWFiNTc0MmU5NjI2LDBjMjY1ZGExLWIwODEtNjAwMC1hYTBlLTFhYjU3NDJlOTYyNixMTDZLWmNUTXBrbVhKOEo3akVQVGdBLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTI0MjYsdVhlaFFKUGxlVmpOQ2Jha1VoR0Q2SXlGUVFrLGNPUStvdXpteUIzb2EyZ2Fob3BLWktnend3WlN2eGFvdk1VZFVzUDBqTGlhb2xZcDNSOUk4d0dMYmhOMkw4VFo3c1psREk1TmRjWFlUM0tMd1p2VmdUVE95M2t0emwrRjdJY1lNZHNyck9zWWoxQ0FkMnNQUisvekVqL1d0czRVRUx0UE5vSklEekZqUW1NN1dvTWQ4TnNscE1xMEJWT1A2cGkrUC9hRnBmMkxuMnpiTEkrSzBDb1BxelRSK25rUHRKakIvRUU1V3RrMXJ6WWR2L1ZiQ3dhcGR5OW14Mmw2ZHRvMGprT0RBM0ErSi9VaE45a3JmSkUyV04wck1mRGxFRGtld0dIemZnNjFLUkFvN0UwaTNaeEtPTkltZm9lNlBKRC9wTkg5NEsraUw2d3o0cWZuYXlPR0pURnRDQnVyUjlCTCtScXNTanliTUo1RlNrcUY0QT09PC9TUD4=; FeatureOverrides_experiments=[]
Source: global traffic	HTTP traffic detected: GET /personal/malahmar_neweranet_com/_api/web/GetListUsingPath(DecodedUrl=@a1)/RenderListDataAsStream?@a1=%27%2Fpersonal%2Fmalahmar%5Fneweranet%5Fcom%2FDocuments%27&TryNewExperienceSingle=TRUE HTTP/1.1Host: neweranet0-my.sharepoint.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uIzMxYTU4NjIyMGI5ZTA0YWZhN2U3MTU2YTUxODQyNjEwNTViZDA2MjZkZjY3M2I3NTdjMmUwMTkwNTRlNWNkY2EsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jMzFhNTg2MjIwYjllMDRhZmE3ZTcxNTZhNTE4NDI2MTA1NWJkMDYyNmRmNjczYjc1N2MyZTAxOTA1NGU1Y2RjYSwxMzM3NDI3NTM4MjAwMDAwMDAsMCwxMzM3NDM2MTQ4MjUwMjE0ODYsMC4wLjAuMCwyNTgsZDNlZTNmZWQtYjU1ZS00OTMyLWEzNTQtZDkyNWRmNWM1MGRjLCwsMGMyNjVkYTEtYjA4MS02MDAwLWFhMGUtMWFiNTc0MmU5NjI2LDBjMjY1ZGExLWIwODEtNjAwMC1hYTBlLTFhYjU3NDJlOTYyNixMTDZLWmNUTXBrbVhKOEo3akVQVGdBLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTI0MjYsdVhlaFFKUGxlVmpOQ2Jha1VoR0Q2SXlGUVFrLGNPUStvdXpteUIzb2EyZ2Fob3BLWktnend3WlN2eGFvdk1VZFVzUDBqTGlhb2xZcDNSOUk4d0dMYmhOMkw4VFo3c1psREk1TmRjWFlUM0tMd1p2VmdUVE95M2t0emwrRjdJY1lNZHNyck9zWWoxQ0FkMnNQUisvekVqL1d0czRVRUx0UE5vSklEekZqUW1NN1dvTWQ4TnNscE1xMEJWT1A2cGkrUC9hRnBmMkxuMnpiTEkrSzBDb1BxelRSK25rUHRKakIvRUU1V3RrMXJ6WWR2L1ZiQ3dhcGR5OW14Mmw2ZHRvMGprT0RBM0ErSi9VaE45a3JmSkUyV04wck1mRGxFRGtld0dIemZnNjFLUkFvN0UwaTNaeEtPTkltZm9lNlBKRC9wTkg5NEsraUw2d3o0cWZuYXlPR0pURnRDQnVyUjlCTCtScXNTanliTUo1RlNrcUY0QT09PC9TUD4=; FeatureOverrides_experiments=[]
Source: global traffic	HTTP traffic detected: GET /_layouts/15/odspserviceworkerproxy.aspx?swManifestName=spserviceworker&debug=false&bypass=false&navigationPreloadHeaderValue=%7B%22supportsFeatures%22%3A%5B1855%2C61313%5D%7D&dataHost=Nucleus&applications=%5B%7B%22id%22%3A%22STS%22%2C%22swPrefetchManifestName%22%3A%22stsserviceworkerprefetch%22%7D%2C%7B%22id%22%3A%22SPHome%22%7D%2C%7B%22id%22%3A%22SitePages%22%7D%2C%7B%22id%22%3A%22Embed%22%7D%2C%7B%22id%22%3A%22CreateGroup%22%7D%2C%7B%22id%22%3A%22SingleWebPart%22%7D%2C%7B%22id%22%3A%22VivaHome%22%7D%2C%7B%22id%22%3A%22BrokerLogon%22%7D%2C%7B%22id%22%3A%22Clipchamp%22%7D%2C%7B%22id%22%3A%22MeeBridge%22%7D%2C%7B%22id%22%3A%22SPStart%22%7D%2C%7B%22id%22%3A%22Agreements%22%7D%5D&list=v2&prefetchListData=true&defaultBrotli=true&authenticateFast=true&inlineAuth=v2&wwData=true&enableTheming=true&prefetchFilebrowserPageInTeams=true&FUIV9Flights=[-83099905,3]&spStartApplicationWebBundle=true&enableIntegrities=true&streamViewServerLoad=true&streamInlineScript=true&siteConfigRace=true HTTP/1.1Host: neweranet0-my.sharepoint.comConnection: keep-aliveCache-Control: max-age=0Accept: /Service-Worker: scriptSec-Fetch-Site: same-originSec-Fetch-Mode: same-originSec-Fetch-Dest: serviceworkerReferer: https://neweranet0-my.sharepoint.com/personal/malahmar_neweranet_com/_layouts/15/onedrive.aspx?id=%2Fpersonal%2Fmalahmar%5Fneweranet%5Fcom%2FDocuments%2FRfq82020%2D382039302%2D42445&ga=1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uIzMxYTU4NjIyMGI5ZTA0YWZhN2U3MTU2YTUxODQyNjEwNTViZDA2MjZkZjY3M2I3NTdjMmUwMTkwNTRlNWNkY2EsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jMzFhNTg2MjIwYjllMDRhZmE3ZTcxNTZhNTE4NDI2MTA1NWJkMDYyNmRmNjczYjc1N2MyZTAxOTA1NGU1Y2RjYSwxMzM3NDI3NTM4MjAwMDAwMDAsMCwxMzM3NDM2MTQ4MjUwMjE0ODYsMC4wLjAuMCwyNTgsZDNlZTNmZWQtYjU1ZS00OTMyLWEzNTQtZDkyNWRmNWM1MGRjLCwsMGMyNjVkYTEtYjA4MS02MDAwLWFhMGUtMWFiNTc0MmU5NjI2LDBjMjY1ZGExLWIwODEtNjAwMC1hYTBlLTFhYjU3NDJlOTYyNixMTDZLWmNUTXBrbVhKOEo3akVQVGdBLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTI0MjYsdVhlaFFKUGxlVmpOQ2Jha1VoR0Q2SXlGUVFrLGNPUStvdXpteUIzb2EyZ2Fob3BLWktnend3WlN2eGFvdk1VZFVzUDBqTGlhb2xZcDNSOUk4d0dMYmhOMkw4VFo3c1psREk1TmRjWFlUM0tMd1p2VmdUVE95M2t0emwrRjdJY1lNZHNyck9zWWoxQ0FkMnNQUisvekVqL1d0czRVRUx0UE5vSklEekZqUW1NN1dvTWQ4TnNscE1xMEJWT1A2cGkrUC9hRnBmMkxuMnpiTEkrSzBDb1BxelRSK25rUHRKakIvRUU1V3RrMXJ6WWR2L1ZiQ3dhcGR5OW14Mmw2ZHRvMGprT0RBM0ErSi9VaE45a3JmSkUyV04wck1mRGxFRGtld0dIemZnNjFLUkFvN0UwaTNaeEtPTkltZm9lNlBKRC9wTkg5NEsraUw2d3o0cWZuYXlPR0pURnRDQnVyUjlCTCtScXNTanliTUo1RlNrcUY0QT09PC9TUD4=; FeatureOverrides_experiments=[]
Source: global traffic	HTTP traffic detected: GET /_vti_bin/afdcache.ashx/_userprofile/userphoto.jpg?_oat_=1729821675_978987c137e442151c7b982398c0d77c992fd737080b7f7acbe407a2f02f3ca6&P1=1729805032&P2=-149452251&P3=1&P4=T1YfEV6cUYX0UReS%2FpOQU7%2FnrgOYpy%2BnmiFTxwkUKlElDno3tNew4LsxRdyZhxw06SOPeyz%2Fnkzk4riIqEsOOdEX%2Fy5pjoAwsvkzKNFv88zqMGHa9wuLto%2BmtcyHpJkj0Tgb0ZcBKdKVpyl7mWz9G17S%2BRP7Pjk4JoRIOJsG3aqgRlL1%2Fl82f%2FJfsJ21Z3Uqz59rWvVHijyWtxBO9MPT8xFyiZgLbtTchL0y0vrwrqaZF9g8%2B05UXLGe5WiNKbE2rigAoKyBaAMGZ2DgY5wbozch32cE1DCEGcX3Xh0IVB2pSwwvEasUz99Yj23SGxBRNlaq3Ia6jKNmIKRNBnmvgQ%3D%3D&size=M&accountname=malahmar%40neweranet.com HTTP/1.1Host: neweranet0.sharepoint.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://neweranet0-my.sharepoint.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_vti_bin/afdcache.ashx/_userprofile/userphoto.jpg?_oat_=1729821675_978987c137e442151c7b982398c0d77c992fd737080b7f7acbe407a2f02f3ca6&P1=1729805032&P2=-149452251&P3=1&P4=T1YfEV6cUYX0UReS%2FpOQU7%2FnrgOYpy%2BnmiFTxwkUKlElDno3tNew4LsxRdyZhxw06SOPeyz%2Fnkzk4riIqEsOOdEX%2Fy5pjoAwsvkzKNFv88zqMGHa9wuLto%2BmtcyHpJkj0Tgb0ZcBKdKVpyl7mWz9G17S%2BRP7Pjk4JoRIOJsG3aqgRlL1%2Fl82f%2FJfsJ21Z3Uqz59rWvVHijyWtxBO9MPT8xFyiZgLbtTchL0y0vrwrqaZF9g8%2B05UXLGe5WiNKbE2rigAoKyBaAMGZ2DgY5wbozch32cE1DCEGcX3Xh0IVB2pSwwvEasUz99Yj23SGxBRNlaq3Ia6jKNmIKRNBnmvgQ%3D%3D&size=M&accountname=malahmar%40neweranet.com HTTP/1.1Host: neweranet0.sharepoint.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_layouts/15/SPComponentRegistry.ashx?projects=[%22spfx%22]&languages=%5B%5D HTTP/1.1Host: neweranet0-my.sharepoint.comConnection: keep-aliveAccept: application/jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Type: application/jsonSec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://neweranet0-my.sharepoint.com/_layouts/15/odspserviceworkerproxy.aspx?swManifestName=spserviceworker&debug=false&bypass=false&navigationPreloadHeaderValue=%7B%22supportsFeatures%22%3A%5B1855%2C61313%5D%7D&dataHost=Nucleus&applications=%5B%7B%22id%22%3A%22STS%22%2C%22swPrefetchManifestName%22%3A%22stsserviceworkerprefetch%22%7D%2C%7B%22id%22%3A%22SPHome%22%7D%2C%7B%22id%22%3A%22SitePages%22%7D%2C%7B%22id%22%3A%22Embed%22%7D%2C%7B%22id%22%3A%22CreateGroup%22%7D%2C%7B%22id%22%3A%22SingleWebPart%22%7D%2C%7B%22id%22%3A%22VivaHome%22%7D%2C%7B%22id%22%3A%22BrokerLogon%22%7D%2C%7B%22id%22%3A%22Clipchamp%22%7D%2C%7B%22id%22%3A%22MeeBridge%22%7D%2C%7B%22id%22%3A%22SPStart%22%7D%2C%7B%22id%22%3A%22Agreements%22%7D%5D&list=v2&prefetchListData=true&defaultBrotli=true&authenticateFast=true&inlineAuth=v2&wwData=true&enableTheming=true&prefetchFilebrowserPageInTeams=true&FUIV9Flights=[-83099905,3]&spStartApplicationWebBundle=true&enableIntegrities=true&streamViewServerLoad=true&streamInlineScript=true&siteConfigRace=trueAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uIzMxYTU4NjIyMGI5ZTA0YWZhN2U3MTU2YTUxODQyNjEwNTViZDA2MjZkZjY3M2I3NTdjMmUwMTkwNTRlNWNkY2EsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jMzFhNTg2MjIwYjllMDRhZmE3ZTcxNTZhNTE4NDI2MTA1NWJkMDYyNmRmNjczYjc1N2MyZTAxOTA1NGU1Y2RjYSwxMzM3NDI3NTM4MjAwMDAwMDAsMCwxMzM3NDM2MTQ4MjUwMjE0ODYsMC4wLjAuMCwyNTgsZDNlZTNmZWQtYjU1ZS00OTMyLWEzNTQtZDkyNWRmNWM1MGRjLCwsMGMyNjVkYTEtYjA4MS02MDAwLWFhMGUtMWFiNTc0MmU5NjI2LDBjMjY1ZGExLWIwODEtNjAwMC1hYTBlLTFhYjU3NDJlOTYyNixMTDZLWmNUTXBrbVhKOEo3akVQVGdBLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTI0MjYsdVhlaFFKUGxlVmpOQ2Jha1VoR0Q2SXlGUVFrLGNPUStvdXpteUIzb2EyZ2Fob3BLWktnend3WlN2eGFvdk1VZFVzUDBqTGlhb2xZcDNSOUk4d0dMYmhOMkw4VFo3c1psREk1TmRjWFlUM0tMd1p2VmdUVE95M2t0emwrRjdJY1lNZHNyck9zWWoxQ0FkMnNQUisvekVqL1d0czRVRUx0UE5vSklEekZqUW1NN1dvTWQ4TnNscE1xMEJWT1A2cGkrUC9hRnBmMkxuMnpiTEkrSzBDb1BxelRSK25rUHRKakIvRUU1V3RrMXJ6WWR2L1ZiQ3dhcGR5OW14Mmw2ZHRvMGprT0RBM0ErSi9VaE45a3JmSkUyV04wck1mRGxFRGtld0dIemZnNjFLUkFvN0UwaTNaeEtPTkltZm9lNlBKRC9wTkg5NEsraUw2d3o0cWZuYXlPR0pURnRDQnVyUjlCTCtScXNTanliTUo1RlNrcUY0QT09PC9TUD4=; FeatureOverrides_experiments=[]
Source: global traffic	HTTP traffic detected: GET /_layouts/15/SPComponentRegistry.ashx?projects=[%22STS%22]&languages=%5B%5D HTTP/1.1Host: neweranet0-my.sharepoint.comConnection: keep-aliveAccept: application/jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Type: application/jsonSec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://neweranet0-my.sharepoint.com/_layouts/15/odspserviceworkerproxy.aspx?swManifestName=spserviceworker&debug=false&bypass=false&navigationPreloadHeaderValue=%7B%22supportsFeatures%22%3A%5B1855%2C61313%5D%7D&dataHost=Nucleus&applications=%5B%7B%22id%22%3A%22STS%22%2C%22swPrefetchManifestName%22%3A%22stsserviceworkerprefetch%22%7D%2C%7B%22id%22%3A%22SPHome%22%7D%2C%7B%22id%22%3A%22SitePages%22%7D%2C%7B%22id%22%3A%22Embed%22%7D%2C%7B%22id%22%3A%22CreateGroup%22%7D%2C%7B%22id%22%3A%22SingleWebPart%22%7D%2C%7B%22id%22%3A%22VivaHome%22%7D%2C%7B%22id%22%3A%22BrokerLogon%22%7D%2C%7B%22id%22%3A%22Clipchamp%22%7D%2C%7B%22id%22%3A%22MeeBridge%22%7D%2C%7B%22id%22%3A%22SPStart%22%7D%2C%7B%22id%22%3A%22Agreements%22%7D%5D&list=v2&prefetchListData=true&defaultBrotli=true&authenticateFast=true&inlineAuth=v2&wwData=true&enableTheming=true&prefetchFilebrowserPageInTeams=true&FUIV9Flights=[-83099905,3]&spStartApplicationWebBundle=true&enableIntegrities=true&streamViewServerLoad=true&streamInlineScript=true&siteConfigRace=trueAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uIzMxYTU4NjIyMGI5ZTA0YWZhN2U3MTU2YTUxODQyNjEwNTViZDA2MjZkZjY3M2I3NTdjMmUwMTkwNTRlNWNkY2EsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jMzFhNTg2MjIwYjllMDRhZmE3ZTcxNTZhNTE4NDI2MTA1NWJkMDYyNmRmNjczYjc1N2MyZTAxOTA1NGU1Y2RjYSwxMzM3NDI3NTM4MjAwMDAwMDAsMCwxMzM3NDM2MTQ4MjUwMjE0ODYsMC4wLjAuMCwyNTgsZDNlZTNmZWQtYjU1ZS00OTMyLWEzNTQtZDkyNWRmNWM1MGRjLCwsMGMyNjVkYTEtYjA4MS02MDAwLWFhMGUtMWFiNTc0MmU5NjI2LDBjMjY1ZGExLWIwODEtNjAwMC1hYTBlLTFhYjU3NDJlOTYyNixMTDZLWmNUTXBrbVhKOEo3akVQVGdBLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTI0MjYsdVhlaFFKUGxlVmpOQ2Jha1VoR0Q2SXlGUVFrLGNPUStvdXpteUIzb2EyZ2Fob3BLWktnend3WlN2eGFvdk1VZFVzUDBqTGlhb2xZcDNSOUk4d0dMYmhOMkw4VFo3c1psREk1TmRjWFlUM0tMd1p2VmdUVE95M2t0emwrRjdJY1lNZHNyck9zWWoxQ0FkMnNQUisvekVqL1d0czRVRUx0UE5vSklEekZqUW1NN1dvTWQ4TnNscE1xMEJWT1A2cGkrUC9hRnBmMkxuMnpiTEkrSzBDb1BxelRSK25rUHRKakIvRUU1V3RrMXJ6WWR2L1ZiQ3dhcGR5OW14Mmw2ZHRvMGprT0RBM0ErSi9VaE45a3JmSkUyV04wck1mRGxFRGtld0dIemZnNjFLUkFvN0UwaTNaeEtPTkltZm9lNlBKRC9wTkg5NEsraUw2d3o0cWZuYXlPR0pURnRDQnVyUjlCTCtScXNTanliTUo1RlNrcUY0QT09PC9TUD4=; FeatureOverrides_experiments=[]
Source: global traffic	HTTP traffic detected: GET /transform/passthrough?provider=spo&inputFormat=pdf&cs=fFNQTw&docid=https%3A%2F%2Fneweranet0-my.sharepoint.com%3A443%2F_api%2Fv2.0%2Fdrives%2Fb!8LVLDi5f_ESbIAFRkBb_wuVRh8JOqJNMty5azIcUhKaoh_V28urHQpwy_nU-LkKj%2Fitems%2F01Z3M5PR5D36TZOXWFAVBIEQGHQ734MSXQ%3Fversion%3DPublished&access_token=v1.eyJzaXRlaWQiOiIwZTRiYjVmMC01ZjJlLTQ0ZmMtOWIyMC0wMTUxOTAxNmZmYzIiLCJhdWQiOiIwMDAwMDAwMy0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAvbmV3ZXJhbmV0MC1teS5zaGFyZXBvaW50LmNvbUBkM2VlM2ZlZC1iNTVlLTQ5MzItYTM1NC1kOTI1ZGY1YzUwZGMiLCJleHAiOiIxNzI5ODE0NDAwIn0.CiMKCXNoYXJpbmdpZBIWTEw2S1pjVE1wa21YSjhKN2pFUFRnQQoICgNzdHASAXQKCgoEc25pZBICMzMSBgjk0zoQARoOMTczLjI1NC4yNTAuNzEiFG1pY3Jvc29mdC5zaGFyZXBvaW50KixBZUtpcUtkQzlVWTZsRUI4NGNqWk0wcENDSUxIYkQ1VWRzU0M2T0JQVlFNPTB4OAFKEGhhc2hlZHByb29mdG9rZW5iBHRydWVyYTBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uIzMxYTU4NjIyMGI5ZTA0YWZhN2U3MTU2YTUxODQyNjEwNTViZDA2MjZkZjY3M2I3NTdjMmUwMTkwNTRlNWNkY2F6ATDCAWEwIy5mfG1lbWJlcnNoaXB8dXJuJTNhc3BvJTNhYW5vbiMzMWE1ODYyMjBiOWUwNGFmYTdlNzE1NmE1MTg0MjYxMDU1YmQwNjI2ZGY2NzNiNzU3YzJlMDE5MDU0ZTVjZGNh.yl5HZkEsm_ow_vppRAjzfi8r6BwAi_Xw31TOI03w2DE&cTag=%22c%3A%7B97A7DFA3-C55E-4205-8240-C787F7C64AF0%7D%2C1%22 HTTP/1.1Host: eastus1-mediap.svc.msConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Origin: https://neweranet0-my.sharepoint.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://neweranet0-my.sharepoint.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=GaeUzFe9fxuK3Gv&MD=Y3CzMhnY HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /transform/passthrough?provider=spo&inputFormat=pdf&cs=fFNQTw&docid=https%3A%2F%2Fneweranet0-my.sharepoint.com%3A443%2F_api%2Fv2.0%2Fdrives%2Fb!8LVLDi5f_ESbIAFRkBb_wuVRh8JOqJNMty5azIcUhKaoh_V28urHQpwy_nU-LkKj%2Fitems%2F01Z3M5PR5D36TZOXWFAVBIEQGHQ734MSXQ%3Fversion%3DPublished&access_token=v1.eyJzaXRlaWQiOiIwZTRiYjVmMC01ZjJlLTQ0ZmMtOWIyMC0wMTUxOTAxNmZmYzIiLCJhdWQiOiIwMDAwMDAwMy0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAvbmV3ZXJhbmV0MC1teS5zaGFyZXBvaW50LmNvbUBkM2VlM2ZlZC1iNTVlLTQ5MzItYTM1NC1kOTI1ZGY1YzUwZGMiLCJleHAiOiIxNzI5ODE0NDAwIn0.CiMKCXNoYXJpbmdpZBIWTEw2S1pjVE1wa21YSjhKN2pFUFRnQQoICgNzdHASAXQKCgoEc25pZBICMzMSBgjk0zoQARoOMTczLjI1NC4yNTAuNzEiFG1pY3Jvc29mdC5zaGFyZXBvaW50KixBZUtpcUtkQzlVWTZsRUI4NGNqWk0wcENDSUxIYkQ1VWRzU0M2T0JQVlFNPTB4OAFKEGhhc2hlZHByb29mdG9rZW5iBHRydWVyYTBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uIzMxYTU4NjIyMGI5ZTA0YWZhN2U3MTU2YTUxODQyNjEwNTViZDA2MjZkZjY3M2I3NTdjMmUwMTkwNTRlNWNkY2F6ATDCAWEwIy5mfG1lbWJlcnNoaXB8dXJuJTNhc3BvJTNhYW5vbiMzMWE1ODYyMjBiOWUwNGFmYTdlNzE1NmE1MTg0MjYxMDU1YmQwNjI2ZGY2NzNiNzU3YzJlMDE5MDU0ZTVjZGNh.yl5HZkEsm_ow_vppRAjzfi8r6BwAi_Xw31TOI03w2DE&cTag=%22c%3A%7B97A7DFA3-C55E-4205-8240-C787F7C64AF0%7D%2C1%22 HTTP/1.1Host: eastus1-mediap.svc.msConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /transform/thumbnail?provider=spo&inputFormat=pdf&cs=fFNQTw&docid=https%3A%2F%2Fneweranet0-my.sharepoint.com%3A443%2F_api%2Fv2.0%2Fdrives%2Fb!8LVLDi5f_ESbIAFRkBb_wuVRh8JOqJNMty5azIcUhKaoh_V28urHQpwy_nU-LkKj%2Fitems%2F01Z3M5PR5D36TZOXWFAVBIEQGHQ734MSXQ%3Fversion%3DPublished&access_token=v1.eyJzaXRlaWQiOiIwZTRiYjVmMC01ZjJlLTQ0ZmMtOWIyMC0wMTUxOTAxNmZmYzIiLCJhdWQiOiIwMDAwMDAwMy0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAvbmV3ZXJhbmV0MC1teS5zaGFyZXBvaW50LmNvbUBkM2VlM2ZlZC1iNTVlLTQ5MzItYTM1NC1kOTI1ZGY1YzUwZGMiLCJleHAiOiIxNzI5ODE0NDAwIn0.CiMKCXNoYXJpbmdpZBIWTEw2S1pjVE1wa21YSjhKN2pFUFRnQQoICgNzdHASAXQKCgoEc25pZBICMzMSBgjk0zoQARoOMTczLjI1NC4yNTAuNzEiFG1pY3Jvc29mdC5zaGFyZXBvaW50KixBZUtpcUtkQzlVWTZsRUI4NGNqWk0wcENDSUxIYkQ1VWRzU0M2T0JQVlFNPTB4OAFKEGhhc2hlZHByb29mdG9rZW5iBHRydWVyYTBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uIzMxYTU4NjIyMGI5ZTA0YWZhN2U3MTU2YTUxODQyNjEwNTViZDA2MjZkZjY3M2I3NTdjMmUwMTkwNTRlNWNkY2F6ATDCAWEwIy5mfG1lbWJlcnNoaXB8dXJuJTNhc3BvJTNhYW5vbiMzMWE1ODYyMjBiOWUwNGFmYTdlNzE1NmE1MTg0MjYxMDU1YmQwNjI2ZGY2NzNiNzU3YzJlMDE5MDU0ZTVjZGNh.yl5HZkEsm_ow_vppRAjzfi8r6BwAi_Xw31TOI03w2DE&cTag=%22c%3A%7B97A7DFA3-C55E-4205-8240-C787F7C64AF0%7D%2C1%22&encodeFailures=1&width=1024&height=1024&srcWidth=&srcHeight= HTTP/1.1Host: eastus1-mediap.svc.msConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Origin: https://neweranet0-my.sharepoint.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://neweranet0-my.sharepoint.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /transform/thumbnail?provider=spo&inputFormat=pdf&cs=fFNQTw&docid=https%3A%2F%2Fneweranet0-my.sharepoint.com%3A443%2F_api%2Fv2.0%2Fdrives%2Fb!8LVLDi5f_ESbIAFRkBb_wuVRh8JOqJNMty5azIcUhKaoh_V28urHQpwy_nU-LkKj%2Fitems%2F01Z3M5PR5D36TZOXWFAVBIEQGHQ734MSXQ%3Fversion%3DPublished&access_token=v1.eyJzaXRlaWQiOiIwZTRiYjVmMC01ZjJlLTQ0ZmMtOWIyMC0wMTUxOTAxNmZmYzIiLCJhdWQiOiIwMDAwMDAwMy0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAvbmV3ZXJhbmV0MC1teS5zaGFyZXBvaW50LmNvbUBkM2VlM2ZlZC1iNTVlLTQ5MzItYTM1NC1kOTI1ZGY1YzUwZGMiLCJleHAiOiIxNzI5ODE0NDAwIn0.CiMKCXNoYXJpbmdpZBIWTEw2S1pjVE1wa21YSjhKN2pFUFRnQQoICgNzdHASAXQKCgoEc25pZBICMzMSBgjk0zoQARoOMTczLjI1NC4yNTAuNzEiFG1pY3Jvc29mdC5zaGFyZXBvaW50KixBZUtpcUtkQzlVWTZsRUI4NGNqWk0wcENDSUxIYkQ1VWRzU0M2T0JQVlFNPTB4OAFKEGhhc2hlZHByb29mdG9rZW5iBHRydWVyYTBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uIzMxYTU4NjIyMGI5ZTA0YWZhN2U3MTU2YTUxODQyNjEwNTViZDA2MjZkZjY3M2I3NTdjMmUwMTkwNTRlNWNkY2F6ATDCAWEwIy5mfG1lbWJlcnNoaXB8dXJuJTNhc3BvJTNhYW5vbiMzMWE1ODYyMjBiOWUwNGFmYTdlNzE1NmE1MTg0MjYxMDU1YmQwNjI2ZGY2NzNiNzU3YzJlMDE5MDU0ZTVjZGNh.yl5HZkEsm_ow_vppRAjzfi8r6BwAi_Xw31TOI03w2DE&cTag=%22c%3A%7B97A7DFA3-C55E-4205-8240-C787F7C64AF0%7D%2C1%22&encodeFailures=1&width=1024&height=1024&srcWidth=&srcHeight= HTTP/1.1Host: eastus1-mediap.svc.msConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 16b69e33.0cced60565238cd25cf4ed69.workers.devConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /turnstile/v0/api.js?onload=onloadTurnstileCallback HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://16b69e33.0cced60565238cd25cf4ed69.workers.dev/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /turnstile/v0/b/e1a56f38220d/api.js HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://16b69e33.0cced60565238cd25cf4ed69.workers.dev/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/5g0na/0x4AAAAAAAyORc_In180R-LS/auto/fbE/normal/auto/ HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://16b69e33.0cced60565238cd25cf4ed69.workers.dev/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /turnstile/v0/b/e1a56f38220d/api.js HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/orchestrate/chl_api/v1?ray=8d7cb2331df86b1f&lang=auto HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/5g0na/0x4AAAAAAAyORc_In180R-LS/auto/fbE/normal/auto/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/cmg/1 HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/5g0na/0x4AAAAAAAyORc_In180R-LS/auto/fbE/normal/auto/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: 16b69e33.0cced60565238cd25cf4ed69.workers.devConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://16b69e33.0cced60565238cd25cf4ed69.workers.dev/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/cmg/1 HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/orchestrate/chl_api/v1?ray=8d7cb2331df86b1f&lang=auto HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: 16b69e33.0cced60565238cd25cf4ed69.workers.devConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/flow/ov1/860153270:1729797391:jSfkloMEoVcXzBqBe6pqzmYIrbImU0SmQd4TN3Y8rOg/8d7cb2331df86b1f/6FTJdsMzzg5YAgkR..N3R7KD85a.rxxZ4pKN17m3kig-1729801526-1.1.1.1-Nbe4ApgCuZmKnISEeTthvu1gKWHODS2KTHtZ2gi8jb0.55WsyEVUZX87SXscGIhn HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/i/8d7cb2331df86b1f/1729801528446/hcPEVoAvcEGg0wO HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/5g0na/0x4AAAAAAAyORc_In180R-LS/auto/fbE/normal/auto/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/i/8d7cb2331df86b1f/1729801528446/hcPEVoAvcEGg0wO HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/pat/8d7cb2331df86b1f/1729801528447/391605ba286f68df98208250e68f4a7c199b65305b6bf46bcc94639ac53eff8a/0QN79Uyf2HmXA8s HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveCache-Control: max-age=0sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/5g0na/0x4AAAAAAAyORc_In180R-LS/auto/fbE/normal/auto/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/flow/ov1/860153270:1729797391:jSfkloMEoVcXzBqBe6pqzmYIrbImU0SmQd4TN3Y8rOg/8d7cb2331df86b1f/6FTJdsMzzg5YAgkR..N3R7KD85a.rxxZ4pKN17m3kig-1729801526-1.1.1.1-Nbe4ApgCuZmKnISEeTthvu1gKWHODS2KTHtZ2gi8jb0.55WsyEVUZX87SXscGIhn HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/flow/ov1/860153270:1729797391:jSfkloMEoVcXzBqBe6pqzmYIrbImU0SmQd4TN3Y8rOg/8d7cb2331df86b1f/6FTJdsMzzg5YAgkR..N3R7KD85a.rxxZ4pKN17m3kig-1729801526-1.1.1.1-Nbe4ApgCuZmKnISEeTthvu1gKWHODS2KTHtZ2gi8jb0.55WsyEVUZX87SXscGIhn HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /apc/trans.gif?e07ac061066ba18fa7b97e0654d9436d HTTP/1.1Host: a599989aa37d0cdcb2026ebacbf01376.fp.measure.office.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Origin: https://neweranet0-my.sharepoint.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://neweranet0-my.sharepoint.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /?cczaakcn HTTP/1.1Host: qiagens.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"accept: application/jsonqrc-auth: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Origin: https://16b69e33.0cced60565238cd25cf4ed69.workers.devSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://16b69e33.0cced60565238cd25cf4ed69.workers.dev/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /apc/trans.gif?a106a24b73a74db3515ad939e5c8514e HTTP/1.1Host: a599989aa37d0cdcb2026ebacbf01376.fp.measure.office.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Origin: https://neweranet0-my.sharepoint.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://neweranet0-my.sharepoint.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /apc/trans.gif?e07ac061066ba18fa7b97e0654d9436d HTTP/1.1Host: a599989aa37d0cdcb2026ebacbf01376.fp.measure.office.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /?dataXX0=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1cmwiOiJodHRwczovL2lsbG11aW5hLmNvbS8iLCJkb21haW4iOiJpbGxtdWluYS5jb20iLCJrZXkiOiJ5b0ZIdUhkYmwwSkQiLCJxcmMiOm51bGwsImlhdCI6MTcyOTgwMTUzNywiZXhwIjoxNzI5ODAxNjU3fQ.PK95BSyiMKiF5a86WrEL7drHWXsczyR6u2cQfqHIqzY HTTP/1.1Host: illmuina.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentReferer: https://16b69e33.0cced60565238cd25cf4ed69.workers.dev/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /?cczaakcn HTTP/1.1Host: qiagens.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /apc/trans.gif?a106a24b73a74db3515ad939e5c8514e HTTP/1.1Host: a599989aa37d0cdcb2026ebacbf01376.fp.measure.office.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: illmuina.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Referer: https://16b69e33.0cced60565238cd25cf4ed69.workers.dev/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: qPdM=yoFHuHdbl0JD; qPdM.sig=ftxlg5-8Y92RYEos_rkJ06rZZVk
Source: global traffic	HTTP traffic detected: GET /apc/trans.gif?d122ac44a142fefe436766869baa8b3a HTTP/1.1Host: outlook.office.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Origin: https://neweranet0-my.sharepoint.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://neweranet0-my.sharepoint.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /?cczaakcn=43dbe3be4ea967c921c47015dd2c2e1f2a0e66058ac6ba426a316aefef278ea9ee62cacb932202fa4171e55cbd45642a89b017c550b4e8050061aca0f37d9a8c HTTP/1.1Host: qiagens.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: qPdM=szxDkrNuQv0A; qPdM.sig=1YyWiNBeal69nqLvlxv-GzQWd1A
Source: global traffic	HTTP traffic detected: GET /owa/ HTTP/1.1Host: illmuina.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Referer: https://16b69e33.0cced60565238cd25cf4ed69.workers.dev/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: qPdM=yoFHuHdbl0JD; qPdM.sig=ftxlg5-8Y92RYEos_rkJ06rZZVk
Source: global traffic	HTTP traffic detected: GET /?fwrvtcrft=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmY2xpZW50LXJlcXVlc3QtaWQ9N2YxMjVkMGMtMTJjMy1jMjQyLTRmMmQtZWUxOTBkYzM0NWUwJnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODY1Mzk4MzQwNTg3NzYwMS5lMjE1ZTg3MC1lYzAzLTQyMTgtYWZlZC0xZGQxODc5ZGNmNjMmc3RhdGU9RGN0QkVvQWdDRUJScmVrNEpFZ0tIc2NSM0xicy1yRjRmX2R6U3VrTVI4Z1lTZEpaZS1PaF9HQlRrWTUwZTZYbUtnaS1rT0dwcERDM0c1QVpxUXhidTNPTzl5cnZOOHNQ HTTP/1.1Host: illmuina.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Referer: https://16b69e33.0cced60565238cd25cf4ed69.workers.dev/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: qPdM=yoFHuHdbl0JD; qPdM.sig=ftxlg5-8Y92RYEos_rkJ06rZZVk; ClientId=82BAD7D4CAEA497B9374A35DC465C261; OIDC=1; OpenIdConnect.nonce.v3.sup9B6ZEUsfA82mDnA5liMJB_XpZiMb_G1Brp3kZB_Y=638653983405877601.e215e870-ec03-4218-afed-1dd1879dcf63; X-OWA-RedirectHistory=ArLym14BYalLB2r03Ag
Source: global traffic	HTTP traffic detected: GET /apc/trans.gif?e32f41ff628254f2ac48073f90e481c2 HTTP/1.1Host: outlook.office.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Origin: https://neweranet0-my.sharepoint.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://neweranet0-my.sharepoint.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /apc/trans.gif?d122ac44a142fefe436766869baa8b3a HTTP/1.1Host: outlook.office.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /apc/trans.gif?bad6a97330817a280d386a4cd95a0ef9 HTTP/1.1Host: teams.cloud.microsoftConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Origin: https://neweranet0-my.sharepoint.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://neweranet0-my.sharepoint.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /aadcdn.msftauth.net/~/shared/1.0/content/js/BssoInterrupt_Core_zKox_QMcTIVut7mG_Z9Eew2.js HTTP/1.1Host: illmuina.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://illmuina.com/?fwrvtcrft=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmY2xpZW50LXJlcXVlc3QtaWQ9N2YxMjVkMGMtMTJjMy1jMjQyLTRmMmQtZWUxOTBkYzM0NWUwJnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODY1Mzk4MzQwNTg3NzYwMS5lMjE1ZTg3MC1lYzAzLTQyMTgtYWZlZC0xZGQxODc5ZGNmNjMmc3RhdGU9RGN0QkVvQWdDRUJScmVrNEpFZ0tIc2NSM0xicy1yRjRmX2R6U3VrTVI4Z1lTZEpaZS1PaF9HQlRrWTUwZTZYbUtnaS1rT0dwcERDM0c1QVpxUXhidTNPTzl5cnZOOHNQAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: qPdM=yoFHuHdbl0JD; qPdM.sig=ftxlg5-8Y92RYEos_rkJ06rZZVk; ClientId=82BAD7D4CAEA497B9374A35DC465C261; OIDC=1; OpenIdConnect.nonce.v3.sup9B6ZEUsfA82mDnA5liMJB_XpZiMb_G1Brp3kZB_Y=638653983405877601.e215e870-ec03-4218-afed-1dd1879dcf63; X-OWA-RedirectHistory=ArLym14BYalLB2r03Ag; esctx-8MIMiSwtbyw=AQABCQEAAADW6jl31mB3T7ugrWTT8pFe2gwjjiRCVT1LWwjmzTT1QgTbM-Bzqbsg5T4ZLuMQW0vllIo9WkeGjt5iA3GGYPV8hsSgcsiZXxsBdzaJSe0Sr-TXSUofnsQumjHkNzCBJcf_enS_g1F9-GbPNih-taoscS4M79fe0UqvD6jz-ldajyAA; fpc=AgCPfKbr1T5Hu-oyrvKseDI; esctx=PAQABBwEAAADW6jl31mB3T7ugrWTT8pFeT_4n64Z3iEimSIqQf3UUK3HiHIYF4YLtNpbIg5lv_iHQ3isocj0tvAybCwTM_xLrRyfdF9rmh5jbx9GIUlZAe8yaB3FBautUBtm5D4QHQ-q98xtjwE84-PucrBR_af_WsuovGdIGcUUfdrFcO2jMtaULIb68AJ8nZmZP09T5P_ogAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd
Source: global traffic	HTTP traffic detected: GET /apc/trans.gif?e32f41ff628254f2ac48073f90e481c2 HTTP/1.1Host: outlook.office.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /apc/trans.gif?ed125d994abdc805a9f496f9e5fb5601 HTTP/1.1Host: teams.cloud.microsoftConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Origin: https://neweranet0-my.sharepoint.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://neweranet0-my.sharepoint.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /apc/trans.gif?bad6a97330817a280d386a4cd95a0ef9 HTTP/1.1Host: teams.cloud.microsoftConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /apc/trans.gif?ed125d994abdc805a9f496f9e5fb5601 HTTP/1.1Host: teams.cloud.microsoftConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /aadcdn.msftauth.net/~/shared/1.0/content/js/BssoInterrupt_Core_zKox_QMcTIVut7mG_Z9Eew2.js HTTP/1.1Host: illmuina.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: qPdM=yoFHuHdbl0JD; qPdM.sig=ftxlg5-8Y92RYEos_rkJ06rZZVk; ClientId=82BAD7D4CAEA497B9374A35DC465C261; OIDC=1; OpenIdConnect.nonce.v3.sup9B6ZEUsfA82mDnA5liMJB_XpZiMb_G1Brp3kZB_Y=638653983405877601.e215e870-ec03-4218-afed-1dd1879dcf63; X-OWA-RedirectHistory=ArLym14BYalLB2r03Ag; esctx-8MIMiSwtbyw=AQABCQEAAADW6jl31mB3T7ugrWTT8pFe2gwjjiRCVT1LWwjmzTT1QgTbM-Bzqbsg5T4ZLuMQW0vllIo9WkeGjt5iA3GGYPV8hsSgcsiZXxsBdzaJSe0Sr-TXSUofnsQumjHkNzCBJcf_enS_g1F9-GbPNih-taoscS4M79fe0UqvD6jz-ldajyAA; fpc=AgCPfKbr1T5Hu-oyrvKseDI; esctx=PAQABBwEAAADW6jl31mB3T7ugrWTT8pFeT_4n64Z3iEimSIqQf3UUK3HiHIYF4YLtNpbIg5lv_iHQ3isocj0tvAybCwTM_xLrRyfdF9rmh5jbx9GIUlZAe8yaB3FBautUBtm5D4QHQ-q98xtjwE84-PucrBR_af_WsuovGdIGcUUfdrFcO2jMtaULIb68AJ8nZmZP09T5P_ogAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd
Source: global traffic	HTTP traffic detected: GET /?fwrvtcrft=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmY2xpZW50LXJlcXVlc3QtaWQ9N2YxMjVkMGMtMTJjMy1jMjQyLTRmMmQtZWUxOTBkYzM0NWUwJnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODY1Mzk4MzQwNTg3NzYwMS5lMjE1ZTg3MC1lYzAzLTQyMTgtYWZlZC0xZGQxODc5ZGNmNjMmc3RhdGU9RGN0QkVvQWdDRUJScmVrNEpFZ0tIc2NSM0xicy1yRjRmX2R6U3VrTVI4Z1lTZEpaZS1PaF9HQlRrWTUwZTZYbUtnaS1rT0dwcERDM0c1QVpxUXhidTNPTzl5cnZOOHNQ&sso_reload=true HTTP/1.1Host: illmuina.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-Dest: documentReferer: https://illmuina.com/?fwrvtcrft=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmY2xpZW50LXJlcXVlc3QtaWQ9N2YxMjVkMGMtMTJjMy1jMjQyLTRmMmQtZWUxOTBkYzM0NWUwJnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODY1Mzk4MzQwNTg3NzYwMS5lMjE1ZTg3MC1lYzAzLTQyMTgtYWZlZC0xZGQxODc5ZGNmNjMmc3RhdGU9RGN0QkVvQWdDRUJScmVrNEpFZ0tIc2NSM0xicy1yRjRmX2R6U3VrTVI4Z1lTZEpaZS1PaF9HQlRrWTUwZTZYbUtnaS1rT0dwcERDM0c1QVpxUXhidTNPTzl5cnZOOHNQAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: qPdM=yoFHuHdbl0JD; qPdM.sig=ftxlg5-8Y92RYEos_rkJ06rZZVk; ClientId=82BAD7D4CAEA497B9374A35DC465C261; OIDC=1; OpenIdConnect.nonce.v3.sup9B6ZEUsfA82mDnA5liMJB_XpZiMb_G1Brp3kZB_Y=638653983405877601.e215e870-ec03-4218-afed-1dd1879dcf63; X-OWA-RedirectHistory=ArLym14BYalLB2r03Ag; esctx-8MIMiSwtbyw=AQABCQEAAADW6jl31mB3T7ugrWTT8pFe2gwjjiRCVT1LWwjmzTT1QgTbM-Bzqbsg5T4ZLuMQW0vllIo9WkeGjt5iA3GGYPV8hsSgcsiZXxsBdzaJSe0Sr-TXSUofnsQumjHkNzCBJcf_enS_g1F9-GbPNih-taoscS4M79fe0UqvD6jz-ldajyAA; fpc=AgCPfKbr1T5Hu-oyrvKseDI; esctx=PAQABBwEAAADW6jl31mB3T7ugrWTT8pFeT_4n64Z3iEimSIqQf3UUK3HiHIYF4YLtNpbIg5lv_iHQ3isocj0tvAybCwTM_xLrRyfdF9rmh5jbx9GIUlZAe8y
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: illmuina.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://illmuina.com/?fwrvtcrft=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmY2xpZW50LXJlcXVlc3QtaWQ9N2YxMjVkMGMtMTJjMy1jMjQyLTRmMmQtZWUxOTBkYzM0NWUwJnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODY1Mzk4MzQwNTg3NzYwMS5lMjE1ZTg3MC1lYzAzLTQyMTgtYWZlZC0xZGQxODc5ZGNmNjMmc3RhdGU9RGN0QkVvQWdDRUJScmVrNEpFZ0tIc2NSM0xicy1yRjRmX2R6U3VrTVI4Z1lTZEpaZS1PaF9HQlRrWTUwZTZYbUtnaS1rT0dwcERDM0c1QVpxUXhidTNPTzl5cnZOOHNQAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: qPdM=yoFHuHdbl0JD; qPdM.sig=ftxlg5-8Y92RYEos_rkJ06rZZVk; ClientId=82BAD7D4CAEA497B9374A35DC465C261; OIDC=1; OpenIdConnect.nonce.v3.sup9B6ZEUsfA82mDnA5liMJB_XpZiMb_G1Brp3kZB_Y=638653983405877601.e215e870-ec03-4218-afed-1dd1879dcf63; X-OWA-RedirectHistory=ArLym14BYalLB2r03Ag; esctx-8MIMiSwtbyw=AQABCQEAAADW6jl31mB3T7ugrWTT8pFe2gwjjiRCVT1LWwjmzTT1QgTbM-Bzqbsg5T4ZLuMQW0vllIo9WkeGjt5iA3GGYPV8hsSgcsiZXxsBdzaJSe0Sr-TXSUofnsQumjHkNzCBJcf_enS_g1F9-GbPNih-taoscS4M79fe0UqvD6jz-ldajyAA; fpc=AgCPfKbr1T5Hu-oyrvKseDI; esctx=PAQABBwEAAADW6jl31mB3T7ugrWTT8pFeT_4n64Z3iEimSIqQf3UUK3HiHIYF4YLtNpbIg5lv_iHQ3isocj0tvAybCwTM_xLrRyfdF9rmh5jbx9GIUlZAe8yaB3FBautUBtm5D4QHQ-q98xtjwE84-PucrBR_af_WsuovGdIGcUUfdrFcO2jMtaULIb68AJ8nZmZP09T5P_ogAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1
Source: global traffic	HTTP traffic detected: GET /aadcdn.msftauth.net/~/ests/2.1/content/cdnbundles/converged.v2.login.min_nin8k2ycrbzww8zl5vxkaq2.css HTTP/1.1Host: illmuina.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://illmuina.com/?fwrvtcrft=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmY2xpZW50LXJlcXVlc3QtaWQ9N2YxMjVkMGMtMTJjMy1jMjQyLTRmMmQtZWUxOTBkYzM0NWUwJnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODY1Mzk4MzQwNTg3NzYwMS5lMjE1ZTg3MC1lYzAzLTQyMTgtYWZlZC0xZGQxODc5ZGNmNjMmc3RhdGU9RGN0QkVvQWdDRUJScmVrNEpFZ0tIc2NSM0xicy1yRjRmX2R6U3VrTVI4Z1lTZEpaZS1PaF9HQlRrWTUwZTZYbUtnaS1rT0dwcERDM0c1QVpxUXhidTNPTzl5cnZOOHNQ&sso_reload=trueAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: qPdM=yoFHuHdbl0JD; qPdM.sig=ftxlg5-8Y92RYEos_rkJ06rZZVk; ClientId=82BAD7D4CAEA497B9374A35DC465C261; OIDC=1; OpenIdConnect.nonce.v3.sup9B6ZEUsfA82mDnA5liMJB_XpZiMb_G1Brp3kZB_Y=638653983405877601.e215e870-ec03-4218-afed-1dd1879dcf63; X-OWA-RedirectHistory=ArLym14BYalLB2r03Ag; esctx-8MIMiSwtbyw=AQABCQEAAADW6jl31mB3T7ugrWTT8pFe2gwjjiRCVT1LWwjmzTT1QgTbM-Bzqbsg5T4ZLuMQW0vllIo9WkeGjt5iA3GGYPV8hsSgcsiZXxsBdzaJSe0Sr-TXSUofnsQumjHkNzCBJcf_enS_g1F9-GbPNih-taoscS4M79fe0UqvD6jz-ldajyAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=0.AXEBMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAA.AQABGgEAAADW6jl31mB3T7ugrWTT8pFe_d_ZamHgqmQPbzChEFdnRul5z2P4xuxJPLPEKM9yDKTsFGLTBulxNX1meyflWuA1eFsUlfMHbGqLzIy0u5PUAt487n8uPghai5EoxbR15BYgAA; esctx=PAQABBwEAAADW6jl31mB3T7ugrWTT8pFeXaU5A4OdmLO3MFXqa3nxAx6eKNVzpX4R62ESrsrTIAb8HIjIQjDtpi-7AhU0iFRmn2DIwQQ_Wn981piUa5b-gBZFMIbf5igaZGcEv5AZH_WxCTTEZU3ejIKAU74IeDyQ9fQfCWjlGLIKFiYAPD2RYtz_Ek-n7leL8F9aSK8WHbQgAA; esctx-AlSDhilpH1M=AQABCQEAAADW6jl31mB3T7ugrWTT8pFexv6Dqi8kY4OzDpa4X_SIO-df5u3FX4_16MfOUZP8Rh_Rg_DVoyjgx8D5YM4WYc0qck88FLBQfHxk6wvksxXQKzBk-hxThjxamkIEkJri4SiPE7uM-nr2Asic_FYAG004qwXydI8tG8MXpkn4K12zdSAA; fpc=AgCPfKbr1T5Hu-oyrvKseDKerOTJAQAAAEmkrN4OAAAA
Source: global traffic	HTTP traffic detected: GET /aadcdn.msftauth.net/~/shared/1.0/content/js/ConvergedLogin_PCore_DQTmGfOEMmPUR-Vehc8U6Q2.js HTTP/1.1Host: illmuina.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://illmuina.com/?fwrvtcrft=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmY2xpZW50LXJlcXVlc3QtaWQ9N2YxMjVkMGMtMTJjMy1jMjQyLTRmMmQtZWUxOTBkYzM0NWUwJnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODY1Mzk4MzQwNTg3NzYwMS5lMjE1ZTg3MC1lYzAzLTQyMTgtYWZlZC0xZGQxODc5ZGNmNjMmc3RhdGU9RGN0QkVvQWdDRUJScmVrNEpFZ0tIc2NSM0xicy1yRjRmX2R6U3VrTVI4Z1lTZEpaZS1PaF9HQlRrWTUwZTZYbUtnaS1rT0dwcERDM0c1QVpxUXhidTNPTzl5cnZOOHNQ&sso_reload=trueAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: qPdM=yoFHuHdbl0JD; qPdM.sig=ftxlg5-8Y92RYEos_rkJ06rZZVk; ClientId=82BAD7D4CAEA497B9374A35DC465C261; OIDC=1; OpenIdConnect.nonce.v3.sup9B6ZEUsfA82mDnA5liMJB_XpZiMb_G1Brp3kZB_Y=638653983405877601.e215e870-ec03-4218-afed-1dd1879dcf63; X-OWA-RedirectHistory=ArLym14BYalLB2r03Ag; esctx-8MIMiSwtbyw=AQABCQEAAADW6jl31mB3T7ugrWTT8pFe2gwjjiRCVT1LWwjmzTT1QgTbM-Bzqbsg5T4ZLuMQW0vllIo9WkeGjt5iA3GGYPV8hsSgcsiZXxsBdzaJSe0Sr-TXSUofnsQumjHkNzCBJcf_enS_g1F9-GbPNih-taoscS4M79fe0UqvD6jz-ldajyAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=0.AXEBMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAA.AQABGgEAAADW6jl31mB3T7ugrWTT8pFe_d_ZamHgqmQPbzChEFdnRul5z2P4xuxJPLPEKM9yDKTsFGLTBulxNX1meyflWuA1eFsUlfMHbGqLzIy0u5PUAt487n8uPghai5EoxbR15BYgAA; esctx=PAQABBwEAAADW6jl31mB3T7ugrWTT8pFeXaU5A4OdmLO3MFXqa3nxAx6eKNVzpX4R62ESrsrTIAb8HIjIQjDtpi-7AhU0iFRmn2DIwQQ_Wn981piUa5b-gBZFMIbf5igaZGcEv5AZH_WxCTTEZU3ejIKAU74IeDyQ9fQfCWjlGLIKFiYAPD2RYtz_Ek-n7leL8F9aSK8WHbQgAA; esctx-AlSDhilpH1M=AQABCQEAAADW6jl31mB3T7ugrWTT8pFexv6Dqi8kY4OzDpa4X_SIO-df5u3FX4_16MfOUZP8Rh_Rg_DVoyjgx8D5YM4WYc0qck88FLBQfHxk6wvksxXQKzBk-hxThjxamkIEkJri4SiPE7uM-nr2Asic_FYAG004qwXydI8tG8MXpkn4K12zdSAA; fpc=AgCPfKbr1T5Hu-oyrvKseDKerOTJAQAAAEmkrN4OAAAA
Source: global traffic	HTTP traffic detected: GET /aadcdn.msftauth.net/~/ests/2.1/content/cdnbundles/ux.converged.login.strings-en.min_1yb3e7oii5t28dgo4xrtow2.js HTTP/1.1Host: illmuina.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://illmuina.com/?fwrvtcrft=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmY2xpZW50LXJlcXVlc3QtaWQ9N2YxMjVkMGMtMTJjMy1jMjQyLTRmMmQtZWUxOTBkYzM0NWUwJnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODY1Mzk4MzQwNTg3NzYwMS5lMjE1ZTg3MC1lYzAzLTQyMTgtYWZlZC0xZGQxODc5ZGNmNjMmc3RhdGU9RGN0QkVvQWdDRUJScmVrNEpFZ0tIc2NSM0xicy1yRjRmX2R6U3VrTVI4Z1lTZEpaZS1PaF9HQlRrWTUwZTZYbUtnaS1rT0dwcERDM0c1QVpxUXhidTNPTzl5cnZOOHNQ&sso_reload=trueAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: qPdM=yoFHuHdbl0JD; qPdM.sig=ftxlg5-8Y92RYEos_rkJ06rZZVk; ClientId=82BAD7D4CAEA497B9374A35DC465C261; OIDC=1; OpenIdConnect.nonce.v3.sup9B6ZEUsfA82mDnA5liMJB_XpZiMb_G1Brp3kZB_Y=638653983405877601.e215e870-ec03-4218-afed-1dd1879dcf63; X-OWA-RedirectHistory=ArLym14BYalLB2r03Ag; esctx-8MIMiSwtbyw=AQABCQEAAADW6jl31mB3T7ugrWTT8pFe2gwjjiRCVT1LWwjmzTT1QgTbM-Bzqbsg5T4ZLuMQW0vllIo9WkeGjt5iA3GGYPV8hsSgcsiZXxsBdzaJSe0Sr-TXSUofnsQumjHkNzCBJcf_enS_g1F9-GbPNih-taoscS4M79fe0UqvD6jz-ldajyAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=0.AXEBMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAA.AQABGgEAAADW6jl31mB3T7ugrWTT8pFe_d_ZamHgqmQPbzChEFdnRul5z2P4xuxJPLPEKM9yDKTsFGLTBulxNX1meyflWuA1eFsUlfMHbGqLzIy0u5PUAt487n8uPghai5EoxbR15BYgAA; esctx=PAQABBwEAAADW6jl31mB3T7ugrWTT8pFeXaU5A4OdmLO3MFXqa3nxAx6eKNVzpX4R62ESrsrTIAb8HIjIQjDtpi-7AhU0iFRmn2DIwQQ_Wn981piUa5b-gBZFMIbf5igaZGcEv5AZH_WxCTTEZU3ejIKAU74IeDyQ9fQfCWjlGLIKFiYAPD2RYtz_Ek-n7leL8F9aSK8WHbQgAA; esctx-AlSDhilpH1M=AQABCQEAAADW6jl31mB3T7ugrWTT8pFexv6Dqi8kY4OzDpa4X_SIO-df5u3FX4_16MfOUZP8Rh_Rg_DVoyjgx8D5YM4WYc0qck88FLBQfHxk6wvksxXQKzBk-hxThjxamkIEkJri4SiPE7uM-nr2Asic_FYAG004qwXydI8tG8MXpkn4K12zdSAA; fpc=AgCPfKbr1T5Hu-oyrvKseDKerOTJAQAAAEmkrN4OAAAA
Source: global traffic	HTTP traffic detected: GET /aadcdn.msftauth.net/~/ests/2.1/content/cdnbundles/ux.converged.login.strings-en.min_1yb3e7oii5t28dgo4xrtow2.js HTTP/1.1Host: illmuina.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: qPdM=yoFHuHdbl0JD; qPdM.sig=ftxlg5-8Y92RYEos_rkJ06rZZVk; ClientId=82BAD7D4CAEA497B9374A35DC465C261; OIDC=1; OpenIdConnect.nonce.v3.sup9B6ZEUsfA82mDnA5liMJB_XpZiMb_G1Brp3kZB_Y=638653983405877601.e215e870-ec03-4218-afed-1dd1879dcf63; X-OWA-RedirectHistory=ArLym14BYalLB2r03Ag; esctx-8MIMiSwtbyw=AQABCQEAAADW6jl31mB3T7ugrWTT8pFe2gwjjiRCVT1LWwjmzTT1QgTbM-Bzqbsg5T4ZLuMQW0vllIo9WkeGjt5iA3GGYPV8hsSgcsiZXxsBdzaJSe0Sr-TXSUofnsQumjHkNzCBJcf_enS_g1F9-GbPNih-taoscS4M79fe0UqvD6jz-ldajyAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=0.AXEBMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAA.AQABGgEAAADW6jl31mB3T7ugrWTT8pFe_d_ZamHgqmQPbzChEFdnRul5z2P4xuxJPLPEKM9yDKTsFGLTBulxNX1meyflWuA1eFsUlfMHbGqLzIy0u5PUAt487n8uPghai5EoxbR15BYgAA; esctx=PAQABBwEAAADW6jl31mB3T7ugrWTT8pFeXaU5A4OdmLO3MFXqa3nxAx6eKNVzpX4R62ESrsrTIAb8HIjIQjDtpi-7AhU0iFRmn2DIwQQ_Wn981piUa5b-gBZFMIbf5igaZGcEv5AZH_WxCTTEZU3ejIKAU74IeDyQ9fQfCWjlGLIKFiYAPD2RYtz_Ek-n7leL8F9aSK8WHbQgAA; esctx-AlSDhilpH1M=AQABCQEAAADW6jl31mB3T7ugrWTT8pFexv6Dqi8kY4OzDpa4X_SIO-df5u3FX4_16MfOUZP8Rh_Rg_DVoyjgx8D5YM4WYc0qck88FLBQfHxk6wvksxXQKzBk-hxThjxamkIEkJri4SiPE7uM-nr2Asic_FYAG004qwXydI8tG8MXpkn4K12zdSAA; fpc=AgCPfKbr1T5Hu-oyrvKseDKerOTJAQAAAEmkrN4OAAAA
Source: global traffic	HTTP traffic detected: GET /aadcdn.msftauth.net/~/shared/1.0/content/js/ConvergedLogin_PCore_DQTmGfOEMmPUR-Vehc8U6Q2.js HTTP/1.1Host: illmuina.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: qPdM=yoFHuHdbl0JD; qPdM.sig=ftxlg5-8Y92RYEos_rkJ06rZZVk; ClientId=82BAD7D4CAEA497B9374A35DC465C261; OIDC=1; OpenIdConnect.nonce.v3.sup9B6ZEUsfA82mDnA5liMJB_XpZiMb_G1Brp3kZB_Y=638653983405877601.e215e870-ec03-4218-afed-1dd1879dcf63; X-OWA-RedirectHistory=ArLym14BYalLB2r03Ag; esctx-8MIMiSwtbyw=AQABCQEAAADW6jl31mB3T7ugrWTT8pFe2gwjjiRCVT1LWwjmzTT1QgTbM-Bzqbsg5T4ZLuMQW0vllIo9WkeGjt5iA3GGYPV8hsSgcsiZXxsBdzaJSe0Sr-TXSUofnsQumjHkNzCBJcf_enS_g1F9-GbPNih-taoscS4M79fe0UqvD6jz-ldajyAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=0.AXEBMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAA.AQABGgEAAADW6jl31mB3T7ugrWTT8pFe_d_ZamHgqmQPbzChEFdnRul5z2P4xuxJPLPEKM9yDKTsFGLTBulxNX1meyflWuA1eFsUlfMHbGqLzIy0u5PUAt487n8uPghai5EoxbR15BYgAA; esctx=PAQABBwEAAADW6jl31mB3T7ugrWTT8pFeXaU5A4OdmLO3MFXqa3nxAx6eKNVzpX4R62ESrsrTIAb8HIjIQjDtpi-7AhU0iFRmn2DIwQQ_Wn981piUa5b-gBZFMIbf5igaZGcEv5AZH_WxCTTEZU3ejIKAU74IeDyQ9fQfCWjlGLIKFiYAPD2RYtz_Ek-n7leL8F9aSK8WHbQgAA; esctx-AlSDhilpH1M=AQABCQEAAADW6jl31mB3T7ugrWTT8pFexv6Dqi8kY4OzDpa4X_SIO-df5u3FX4_16MfOUZP8Rh_Rg_DVoyjgx8D5YM4WYc0qck88FLBQfHxk6wvksxXQKzBk-hxThjxamkIEkJri4SiPE7uM-nr2Asic_FYAG004qwXydI8tG8MXpkn4K12zdSAA; fpc=AgCPfKbr1T5Hu-oyrvKseDKerOTJAQAAAEmkrN4OAAAA
Source: global traffic	HTTP traffic detected: GET /aadcdn.msftauth.net/~/shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico HTTP/1.1Host: illmuina.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://illmuina.com/?fwrvtcrft=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmY2xpZW50LXJlcXVlc3QtaWQ9N2YxMjVkMGMtMTJjMy1jMjQyLTRmMmQtZWUxOTBkYzM0NWUwJnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODY1Mzk4MzQwNTg3NzYwMS5lMjE1ZTg3MC1lYzAzLTQyMTgtYWZlZC0xZGQxODc5ZGNmNjMmc3RhdGU9RGN0QkVvQWdDRUJScmVrNEpFZ0tIc2NSM0xicy1yRjRmX2R6U3VrTVI4Z1lTZEpaZS1PaF9HQlRrWTUwZTZYbUtnaS1rT0dwcERDM0c1QVpxUXhidTNPTzl5cnZOOHNQ&sso_reload=trueAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: qPdM=yoFHuHdbl0JD; qPdM.sig=ftxlg5-8Y92RYEos_rkJ06rZZVk; ClientId=82BAD7D4CAEA497B9374A35DC465C261; OIDC=1; OpenIdConnect.nonce.v3.sup9B6ZEUsfA82mDnA5liMJB_XpZiMb_G1Brp3kZB_Y=638653983405877601.e215e870-ec03-4218-afed-1dd1879dcf63; X-OWA-RedirectHistory=ArLym14BYalLB2r03Ag; esctx-8MIMiSwtbyw=AQABCQEAAADW6jl31mB3T7ugrWTT8pFe2gwjjiRCVT1LWwjmzTT1QgTbM-Bzqbsg5T4ZLuMQW0vllIo9WkeGjt5iA3GGYPV8hsSgcsiZXxsBdzaJSe0Sr-TXSUofnsQumjHkNzCBJcf_enS_g1F9-GbPNih-taoscS4M79fe0UqvD6jz-ldajyAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=0.AXEBMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAA.AQABGgEAAADW6jl31mB3T7ugrWTT8pFe_d_ZamHgqmQPbzChEFdnRul5z2P4xuxJPLPEKM9yDKTsFGLTBulxNX1meyflWuA1eFsUlfMHbGqLzIy0u5PUAt487n8uPghai5EoxbR15BYgAA; esctx=PAQABBwEAAADW6jl31mB3T7ugrWTT8pFeXaU5A4OdmLO3MFXqa3nxAx6eKNVzpX4R62ESrsrTIAb8HIjIQjDtpi-7AhU0iFRmn2DIwQQ_Wn981piUa5b-gBZFMIbf5igaZGcEv5AZH_WxCTTEZU3ejIKAU74IeDyQ9fQfCWjlGLIKFiYAPD2RYtz_Ek-n7leL8F9aSK8WHbQgAA; esctx-AlSDhilpH1M=AQABCQEAAADW6jl31mB3T7ugrWTT8pFexv6Dqi8kY4OzDpa4X_SIO-df5u3FX4_16MfOUZP8Rh_Rg_DVoyjgx8D5YM4WYc0qck88FLBQfHxk6wvksxXQKzBk-hxThjxamkIEkJri4SiPE7uM-nr2Asic_FYAG004qwXydI8tG8MXpkn4K12zdSAA; fpc=AgCPfKbr1T5Hu-oyrvKseDKerOTJAQAAAEmkrN4OAAAA; brcap=0
Source: global traffic	HTTP traffic detected: GET /aadcdn.msftauth.net/~/shared/1.0/content/images/signin-options_4e48046ce74f4b89d45037c90576bfac.svg HTTP/1.1Host: illmuina.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://illmuina.com/?fwrvtcrft=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmY2xpZW50LXJlcXVlc3QtaWQ9N2YxMjVkMGMtMTJjMy1jMjQyLTRmMmQtZWUxOTBkYzM0NWUwJnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODY1Mzk4MzQwNTg3NzYwMS5lMjE1ZTg3MC1lYzAzLTQyMTgtYWZlZC0xZGQxODc5ZGNmNjMmc3RhdGU9RGN0QkVvQWdDRUJScmVrNEpFZ0tIc2NSM0xicy1yRjRmX2R6U3VrTVI4Z1lTZEpaZS1PaF9HQlRrWTUwZTZYbUtnaS1rT0dwcERDM0c1QVpxUXhidTNPTzl5cnZOOHNQ&sso_reload=trueAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: qPdM=yoFHuHdbl0JD; qPdM.sig=ftxlg5-8Y92RYEos_rkJ06rZZVk; ClientId=82BAD7D4CAEA497B9374A35DC465C261; OIDC=1; OpenIdConnect.nonce.v3.sup9B6ZEUsfA82mDnA5liMJB_XpZiMb_G1Brp3kZB_Y=638653983405877601.e215e870-ec03-4218-afed-1dd1879dcf63; X-OWA-RedirectHistory=ArLym14BYalLB2r03Ag; esctx-8MIMiSwtbyw=AQABCQEAAADW6jl31mB3T7ugrWTT8pFe2gwjjiRCVT1LWwjmzTT1QgTbM-Bzqbsg5T4ZLuMQW0vllIo9WkeGjt5iA3GGYPV8hsSgcsiZXxsBdzaJSe0Sr-TXSUofnsQumjHkNzCBJcf_enS_g1F9-GbPNih-taoscS4M79fe0UqvD6jz-ldajyAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=0.AXEBMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAA.AQABGgEAAADW6jl31mB3T7ugrWTT8pFe_d_ZamHgqmQPbzChEFdnRul5z2P4xuxJPLPEKM9yDKTsFGLTBulxNX1meyflWuA1eFsUlfMHbGqLzIy0u5PUAt487n8uPghai5EoxbR15BYgAA; esctx=PAQABBwEAAADW6jl31mB3T7ugrWTT8pFeXaU5A4OdmLO3MFXqa3nxAx6eKNVzpX4R62ESrsrTIAb8HIjIQjDtpi-7AhU0iFRmn2DIwQQ_Wn981piUa5b-gBZFMIbf5igaZGcEv5AZH_WxCTTEZU3ejIKAU74IeDyQ9fQfCWjlGLIKFiYAPD2RYtz_Ek-n7leL8F9aSK8WHbQgAA; esctx-AlSDhilpH1M=AQABCQEAAADW6jl31mB3T7ugrWTT8pFexv6Dqi8kY4OzDpa4X_SIO-df5u3FX4_16MfOUZP8Rh_Rg_DVoyjgx8D5YM4WYc0qck88FLBQfHxk6wvksxXQKzBk-hxThjxamkIEkJri4SiPE7uM-nr2Asic_FYAG004qwXydI8tG8MXpkn4K12zdSAA; fpc=AgCPfKbr1T5Hu-oyrvKseDKerOTJAQAAAEmkrN4OAAAA; brcap=0
Source: global traffic	HTTP traffic detected: GET /aadcdn.msftauth.net/~/shared/1.0/content/js/asyncchunk/convergedlogin_pcustomizationloader_80e93b9a4cb13643afca.js HTTP/1.1Host: illmuina.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://illmuina.com/?fwrvtcrft=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmY2xpZW50LXJlcXVlc3QtaWQ9N2YxMjVkMGMtMTJjMy1jMjQyLTRmMmQtZWUxOTBkYzM0NWUwJnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODY1Mzk4MzQwNTg3NzYwMS5lMjE1ZTg3MC1lYzAzLTQyMTgtYWZlZC0xZGQxODc5ZGNmNjMmc3RhdGU9RGN0QkVvQWdDRUJScmVrNEpFZ0tIc2NSM0xicy1yRjRmX2R6U3VrTVI4Z1lTZEpaZS1PaF9HQlRrWTUwZTZYbUtnaS1rT0dwcERDM0c1QVpxUXhidTNPTzl5cnZOOHNQ&sso_reload=trueAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: qPdM=yoFHuHdbl0JD; qPdM.sig=ftxlg5-8Y92RYEos_rkJ06rZZVk; ClientId=82BAD7D4CAEA497B9374A35DC465C261; OIDC=1; OpenIdConnect.nonce.v3.sup9B6ZEUsfA82mDnA5liMJB_XpZiMb_G1Brp3kZB_Y=638653983405877601.e215e870-ec03-4218-afed-1dd1879dcf63; X-OWA-RedirectHistory=ArLym14BYalLB2r03Ag; esctx-8MIMiSwtbyw=AQABCQEAAADW6jl31mB3T7ugrWTT8pFe2gwjjiRCVT1LWwjmzTT1QgTbM-Bzqbsg5T4ZLuMQW0vllIo9WkeGjt5iA3GGYPV8hsSgcsiZXxsBdzaJSe0Sr-TXSUofnsQumjHkNzCBJcf_enS_g1F9-GbPNih-taoscS4M79fe0UqvD6jz-ldajyAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=0.AXEBMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAA.AQABGgEAAADW6jl31mB3T7ugrWTT8pFe_d_ZamHgqmQPbzChEFdnRul5z2P4xuxJPLPEKM9yDKTsFGLTBulxNX1meyflWuA1eFsUlfMHbGqLzIy0u5PUAt487n8uPghai5EoxbR15BYgAA; esctx=PAQABBwEAAADW6jl31mB3T7ugrWTT8pFeXaU5A4OdmLO3MFXqa3nxAx6eKNVzpX4R62ESrsrTIAb8HIjIQjDtpi-7AhU0iFRmn2DIwQQ_Wn981piUa5b-gBZFMIbf5igaZGcEv5AZH_WxCTTEZU3ejIKAU74IeDyQ9fQfCWjlGLIKFiYAPD2RYtz_Ek-n7leL8F9aSK8WHbQgAA; esctx-AlSDhilpH1M=AQABCQEAAADW6jl31mB3T7ugrWTT8pFexv6Dqi8kY4OzDpa4X_SIO-df5u3FX4_16MfOUZP8Rh_Rg_DVoyjgx8D5YM4WYc0qck88FLBQfHxk6wvksxXQKzBk-hxThjxamkIEkJri4SiPE7uM-nr2Asic_FYAG004qwXydI8tG8MXpkn4K12zdSAA; fpc=AgCPfKbr1T5Hu-oyrvKseDKerOTJAQAAAEmkrN4OAAAA; brcap=0
Source: global traffic	HTTP traffic detected: GET /aadcdn.msftauth.net/~/shared/1.0/content/images/appbackgrounds/49-small_e58aafc980614a9cd7796bea7b5ea8f0.jpg HTTP/1.1Host: illmuina.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://illmuina.com/?fwrvtcrft=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmY2xpZW50LXJlcXVlc3QtaWQ9N2YxMjVkMGMtMTJjMy1jMjQyLTRmMmQtZWUxOTBkYzM0NWUwJnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODY1Mzk4MzQwNTg3NzYwMS5lMjE1ZTg3MC1lYzAzLTQyMTgtYWZlZC0xZGQxODc5ZGNmNjMmc3RhdGU9RGN0QkVvQWdDRUJScmVrNEpFZ0tIc2NSM0xicy1yRjRmX2R6U3VrTVI4Z1lTZEpaZS1PaF9HQlRrWTUwZTZYbUtnaS1rT0dwcERDM0c1QVpxUXhidTNPTzl5cnZOOHNQ&sso_reload=trueAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: qPdM=yoFHuHdbl0JD; qPdM.sig=ftxlg5-8Y92RYEos_rkJ06rZZVk; ClientId=82BAD7D4CAEA497B9374A35DC465C261; OIDC=1; OpenIdConnect.nonce.v3.sup9B6ZEUsfA82mDnA5liMJB_XpZiMb_G1Brp3kZB_Y=638653983405877601.e215e870-ec03-4218-afed-1dd1879dcf63; X-OWA-RedirectHistory=ArLym14BYalLB2r03Ag; esctx-8MIMiSwtbyw=AQABCQEAAADW6jl31mB3T7ugrWTT8pFe2gwjjiRCVT1LWwjmzTT1QgTbM-Bzqbsg5T4ZLuMQW0vllIo9WkeGjt5iA3GGYPV8hsSgcsiZXxsBdzaJSe0Sr-TXSUofnsQumjHkNzCBJcf_enS_g1F9-GbPNih-taoscS4M79fe0UqvD6jz-ldajyAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=0.AXEBMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAA.AQABGgEAAADW6jl31mB3T7ugrWTT8pFe_d_ZamHgqmQPbzChEFdnRul5z2P4xuxJPLPEKM9yDKTsFGLTBulxNX1meyflWuA1eFsUlfMHbGqLzIy0u5PUAt487n8uPghai5EoxbR15BYgAA; esctx=PAQABBwEAAADW6jl31mB3T7ugrWTT8pFeXaU5A4OdmLO3MFXqa3nxAx6eKNVzpX4R62ESrsrTIAb8HIjIQjDtpi-7AhU0iFRmn2DIwQQ_Wn981piUa5b-gBZFMIbf5igaZGcEv5AZH_WxCTTEZU3ejIKAU74IeDyQ9fQfCWjlGLIKFiYAPD2RYtz_Ek-n7leL8F9aSK8WHbQgAA; esctx-AlSDhilpH1M=AQABCQEAAADW6jl31mB3T7ugrWTT8pFexv6Dqi8kY4OzDpa4X_SIO-df5u3FX4_16MfOUZP8Rh_Rg_DVoyjgx8D5YM4WYc0qck88FLBQfHxk6wvksxXQKzBk-hxThjxamkIEkJri4SiPE7uM-nr2Asic_FYAG004qwXydI8tG8MXpkn4K12zdSAA; fpc=AgCPfKbr1T5Hu-oyrvKseDKerOTJAQAAAEmkrN4OAAAA; brcap=0
Source: global traffic	HTTP traffic detected: GET /aadcdn.msftauth.net/~/shared/1.0/content/images/appbackgrounds/49_7916a894ebde7d29c2cc29b267f1299f.jpg HTTP/1.1Host: illmuina.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://illmuina.com/?fwrvtcrft=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmY2xpZW50LXJlcXVlc3QtaWQ9N2YxMjVkMGMtMTJjMy1jMjQyLTRmMmQtZWUxOTBkYzM0NWUwJnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODY1Mzk4MzQwNTg3NzYwMS5lMjE1ZTg3MC1lYzAzLTQyMTgtYWZlZC0xZGQxODc5ZGNmNjMmc3RhdGU9RGN0QkVvQWdDRUJScmVrNEpFZ0tIc2NSM0xicy1yRjRmX2R6U3VrTVI4Z1lTZEpaZS1PaF9HQlRrWTUwZTZYbUtnaS1rT0dwcERDM0c1QVpxUXhidTNPTzl5cnZOOHNQ&sso_reload=trueAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: qPdM=yoFHuHdbl0JD; qPdM.sig=ftxlg5-8Y92RYEos_rkJ06rZZVk; ClientId=82BAD7D4CAEA497B9374A35DC465C261; OIDC=1; OpenIdConnect.nonce.v3.sup9B6ZEUsfA82mDnA5liMJB_XpZiMb_G1Brp3kZB_Y=638653983405877601.e215e870-ec03-4218-afed-1dd1879dcf63; X-OWA-RedirectHistory=ArLym14BYalLB2r03Ag; esctx-8MIMiSwtbyw=AQABCQEAAADW6jl31mB3T7ugrWTT8pFe2gwjjiRCVT1LWwjmzTT1QgTbM-Bzqbsg5T4ZLuMQW0vllIo9WkeGjt5iA3GGYPV8hsSgcsiZXxsBdzaJSe0Sr-TXSUofnsQumjHkNzCBJcf_enS_g1F9-GbPNih-taoscS4M79fe0UqvD6jz-ldajyAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=0.AXEBMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAA.AQABGgEAAADW6jl31mB3T7ugrWTT8pFe_d_ZamHgqmQPbzChEFdnRul5z2P4xuxJPLPEKM9yDKTsFGLTBulxNX1meyflWuA1eFsUlfMHbGqLzIy0u5PUAt487n8uPghai5EoxbR15BYgAA; esctx=PAQABBwEAAADW6jl31mB3T7ugrWTT8pFeXaU5A4OdmLO3MFXqa3nxAx6eKNVzpX4R62ESrsrTIAb8HIjIQjDtpi-7AhU0iFRmn2DIwQQ_Wn981piUa5b-gBZFMIbf5igaZGcEv5AZH_WxCTTEZU3ejIKAU74IeDyQ9fQfCWjlGLIKFiYAPD2RYtz_Ek-n7leL8F9aSK8WHbQgAA; esctx-AlSDhilpH1M=AQABCQEAAADW6jl31mB3T7ugrWTT8pFexv6Dqi8kY4OzDpa4X_SIO-df5u3FX4_16MfOUZP8Rh_Rg_DVoyjgx8D5YM4WYc0qck88FLBQfHxk6wvksxXQKzBk-hxThjxamkIEkJri4SiPE7uM-nr2Asic_FYAG004qwXydI8tG8MXpkn4K12zdSAA; fpc=AgCPfKbr1T5Hu-oyrvKseDKerOTJAQAAAEmkrN4OAAAA; brcap=0
Source: global traffic	HTTP traffic detected: GET /aadcdn.msftauth.net/~/shared/1.0/content/images/applogos/53_8b36337037cff88c3df203bb73d58e41.png HTTP/1.1Host: illmuina.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://illmuina.com/?fwrvtcrft=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmY2xpZW50LXJlcXVlc3QtaWQ9N2YxMjVkMGMtMTJjMy1jMjQyLTRmMmQtZWUxOTBkYzM0NWUwJnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODY1Mzk4MzQwNTg3NzYwMS5lMjE1ZTg3MC1lYzAzLTQyMTgtYWZlZC0xZGQxODc5ZGNmNjMmc3RhdGU9RGN0QkVvQWdDRUJScmVrNEpFZ0tIc2NSM0xicy1yRjRmX2R6U3VrTVI4Z1lTZEpaZS1PaF9HQlRrWTUwZTZYbUtnaS1rT0dwcERDM0c1QVpxUXhidTNPTzl5cnZOOHNQ&sso_reload=trueAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: qPdM=yoFHuHdbl0JD; qPdM.sig=ftxlg5-8Y92RYEos_rkJ06rZZVk; ClientId=82BAD7D4CAEA497B9374A35DC465C261; OIDC=1; OpenIdConnect.nonce.v3.sup9B6ZEUsfA82mDnA5liMJB_XpZiMb_G1Brp3kZB_Y=638653983405877601.e215e870-ec03-4218-afed-1dd1879dcf63; X-OWA-RedirectHistory=ArLym14BYalLB2r03Ag; esctx-8MIMiSwtbyw=AQABCQEAAADW6jl31mB3T7ugrWTT8pFe2gwjjiRCVT1LWwjmzTT1QgTbM-Bzqbsg5T4ZLuMQW0vllIo9WkeGjt5iA3GGYPV8hsSgcsiZXxsBdzaJSe0Sr-TXSUofnsQumjHkNzCBJcf_enS_g1F9-GbPNih-taoscS4M79fe0UqvD6jz-ldajyAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=0.AXEBMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAA.AQABGgEAAADW6jl31mB3T7ugrWTT8pFe_d_ZamHgqmQPbzChEFdnRul5z2P4xuxJPLPEKM9yDKTsFGLTBulxNX1meyflWuA1eFsUlfMHbGqLzIy0u5PUAt487n8uPghai5EoxbR15BYgAA; esctx=PAQABBwEAAADW6jl31mB3T7ugrWTT8pFeXaU5A4OdmLO3MFXqa3nxAx6eKNVzpX4R62ESrsrTIAb8HIjIQjDtpi-7AhU0iFRmn2DIwQQ_Wn981piUa5b-gBZFMIbf5igaZGcEv5AZH_WxCTTEZU3ejIKAU74IeDyQ9fQfCWjlGLIKFiYAPD2RYtz_Ek-n7leL8F9aSK8WHbQgAA; esctx-AlSDhilpH1M=AQABCQEAAADW6jl31mB3T7ugrWTT8pFexv6Dqi8kY4OzDpa4X_SIO-df5u3FX4_16MfOUZP8Rh_Rg_DVoyjgx8D5YM4WYc0qck88FLBQfHxk6wvksxXQKzBk-hxThjxamkIEkJri4SiPE7uM-nr2Asic_FYAG004qwXydI8tG8MXpkn4K12zdSAA; fpc=AgCPfKbr1T5Hu-oyrvKseDKerOTJAQAAAEmkrN4OAAAA; brcap=0
Source: global traffic	HTTP traffic detected: GET /owa/prefetch.aspx HTTP/1.1Host: outlook.office365.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://illmuina.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /aadcdn.msftauth.net/~/shared/1.0/content/images/microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg HTTP/1.1Host: illmuina.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://illmuina.com/?fwrvtcrft=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmY2xpZW50LXJlcXVlc3QtaWQ9N2YxMjVkMGMtMTJjMy1jMjQyLTRmMmQtZWUxOTBkYzM0NWUwJnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODY1Mzk4MzQwNTg3NzYwMS5lMjE1ZTg3MC1lYzAzLTQyMTgtYWZlZC0xZGQxODc5ZGNmNjMmc3RhdGU9RGN0QkVvQWdDRUJScmVrNEpFZ0tIc2NSM0xicy1yRjRmX2R6U3VrTVI4Z1lTZEpaZS1PaF9HQlRrWTUwZTZYbUtnaS1rT0dwcERDM0c1QVpxUXhidTNPTzl5cnZOOHNQ&sso_reload=trueAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: qPdM=yoFHuHdbl0JD; qPdM.sig=ftxlg5-8Y92RYEos_rkJ06rZZVk; ClientId=82BAD7D4CAEA497B9374A35DC465C261; OIDC=1; OpenIdConnect.nonce.v3.sup9B6ZEUsfA82mDnA5liMJB_XpZiMb_G1Brp3kZB_Y=638653983405877601.e215e870-ec03-4218-afed-1dd1879dcf63; X-OWA-RedirectHistory=ArLym14BYalLB2r03Ag; esctx-8MIMiSwtbyw=AQABCQEAAADW6jl31mB3T7ugrWTT8pFe2gwjjiRCVT1LWwjmzTT1QgTbM-Bzqbsg5T4ZLuMQW0vllIo9WkeGjt5iA3GGYPV8hsSgcsiZXxsBdzaJSe0Sr-TXSUofnsQumjHkNzCBJcf_enS_g1F9-GbPNih-taoscS4M79fe0UqvD6jz-ldajyAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=0.AXEBMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAA.AQABGgEAAADW6jl31mB3T7ugrWTT8pFe_d_ZamHgqmQPbzChEFdnRul5z2P4xuxJPLPEKM9yDKTsFGLTBulxNX1meyflWuA1eFsUlfMHbGqLzIy0u5PUAt487n8uPghai5EoxbR15BYgAA; esctx=PAQABBwEAAADW6jl31mB3T7ugrWTT8pFeXaU5A4OdmLO3MFXqa3nxAx6eKNVzpX4R62ESrsrTIAb8HIjIQjDtpi-7AhU0iFRmn2DIwQQ_Wn981piUa5b-gBZFMIbf5igaZGcEv5AZH_WxCTTEZU3ejIKAU74IeDyQ9fQfCWjlGLIKFiYAPD2RYtz_Ek-n7leL8F9aSK8WHbQgAA; esctx-AlSDhilpH1M=AQABCQEAAADW6jl31mB3T7ugrWTT8pFexv6Dqi8kY4OzDpa4X_SIO-df5u3FX4_16MfOUZP8Rh_Rg_DVoyjgx8D5YM4WYc0qck88FLBQfHxk6wvksxXQKzBk-hxThjxamkIEkJri4SiPE7uM-nr2Asic_FYAG004qwXydI8tG8MXpkn4K12zdSAA; fpc=AgCPfKbr1T5Hu-oyrvKseDKerOTJAQAAAEmkrN4OAAAA; brcap=0
Source: global traffic	HTTP traffic detected: GET /aadcdn.msftauth.net/~/shared/1.0/content/images/signin-options_4e48046ce74f4b89d45037c90576bfac.svg HTTP/1.1Host: illmuina.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: qPdM=yoFHuHdbl0JD; qPdM.sig=ftxlg5-8Y92RYEos_rkJ06rZZVk; ClientId=82BAD7D4CAEA497B9374A35DC465C261; OIDC=1; OpenIdConnect.nonce.v3.sup9B6ZEUsfA82mDnA5liMJB_XpZiMb_G1Brp3kZB_Y=638653983405877601.e215e870-ec03-4218-afed-1dd1879dcf63; X-OWA-RedirectHistory=ArLym14BYalLB2r03Ag; esctx-8MIMiSwtbyw=AQABCQEAAADW6jl31mB3T7ugrWTT8pFe2gwjjiRCVT1LWwjmzTT1QgTbM-Bzqbsg5T4ZLuMQW0vllIo9WkeGjt5iA3GGYPV8hsSgcsiZXxsBdzaJSe0Sr-TXSUofnsQumjHkNzCBJcf_enS_g1F9-GbPNih-taoscS4M79fe0UqvD6jz-ldajyAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=0.AXEBMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAA.AQABGgEAAADW6jl31mB3T7ugrWTT8pFe_d_ZamHgqmQPbzChEFdnRul5z2P4xuxJPLPEKM9yDKTsFGLTBulxNX1meyflWuA1eFsUlfMHbGqLzIy0u5PUAt487n8uPghai5EoxbR15BYgAA; esctx=PAQABBwEAAADW6jl31mB3T7ugrWTT8pFeXaU5A4OdmLO3MFXqa3nxAx6eKNVzpX4R62ESrsrTIAb8HIjIQjDtpi-7AhU0iFRmn2DIwQQ_Wn981piUa5b-gBZFMIbf5igaZGcEv5AZH_WxCTTEZU3ejIKAU74IeDyQ9fQfCWjlGLIKFiYAPD2RYtz_Ek-n7leL8F9aSK8WHbQgAA; esctx-AlSDhilpH1M=AQABCQEAAADW6jl31mB3T7ugrWTT8pFexv6Dqi8kY4OzDpa4X_SIO-df5u3FX4_16MfOUZP8Rh_Rg_DVoyjgx8D5YM4WYc0qck88FLBQfHxk6wvksxXQKzBk-hxThjxamkIEkJri4SiPE7uM-nr2Asic_FYAG004qwXydI8tG8MXpkn4K12zdSAA; fpc=AgCPfKbr1T5Hu-oyrvKseDKerOTJAQAAAEmkrN4OAAAA; brcap=0
Source: global traffic	HTTP traffic detected: GET /aadcdn.msftauth.net/~/shared/1.0/content/images/appbackgrounds/49-small_e58aafc980614a9cd7796bea7b5ea8f0.jpg HTTP/1.1Host: illmuina.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: qPdM=yoFHuHdbl0JD; qPdM.sig=ftxlg5-8Y92RYEos_rkJ06rZZVk; ClientId=82BAD7D4CAEA497B9374A35DC465C261; OIDC=1; OpenIdConnect.nonce.v3.sup9B6ZEUsfA82mDnA5liMJB_XpZiMb_G1Brp3kZB_Y=638653983405877601.e215e870-ec03-4218-afed-1dd1879dcf63; X-OWA-RedirectHistory=ArLym14BYalLB2r03Ag; esctx-8MIMiSwtbyw=AQABCQEAAADW6jl31mB3T7ugrWTT8pFe2gwjjiRCVT1LWwjmzTT1QgTbM-Bzqbsg5T4ZLuMQW0vllIo9WkeGjt5iA3GGYPV8hsSgcsiZXxsBdzaJSe0Sr-TXSUofnsQumjHkNzCBJcf_enS_g1F9-GbPNih-taoscS4M79fe0UqvD6jz-ldajyAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=0.AXEBMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAA.AQABGgEAAADW6jl31mB3T7ugrWTT8pFe_d_ZamHgqmQPbzChEFdnRul5z2P4xuxJPLPEKM9yDKTsFGLTBulxNX1meyflWuA1eFsUlfMHbGqLzIy0u5PUAt487n8uPghai5EoxbR15BYgAA; esctx=PAQABBwEAAADW6jl31mB3T7ugrWTT8pFeXaU5A4OdmLO3MFXqa3nxAx6eKNVzpX4R62ESrsrTIAb8HIjIQjDtpi-7AhU0iFRmn2DIwQQ_Wn981piUa5b-gBZFMIbf5igaZGcEv5AZH_WxCTTEZU3ejIKAU74IeDyQ9fQfCWjlGLIKFiYAPD2RYtz_Ek-n7leL8F9aSK8WHbQgAA; esctx-AlSDhilpH1M=AQABCQEAAADW6jl31mB3T7ugrWTT8pFexv6Dqi8kY4OzDpa4X_SIO-df5u3FX4_16MfOUZP8Rh_Rg_DVoyjgx8D5YM4WYc0qck88FLBQfHxk6wvksxXQKzBk-hxThjxamkIEkJri4SiPE7uM-nr2Asic_FYAG004qwXydI8tG8MXpkn4K12zdSAA; fpc=AgCPfKbr1T5Hu-oyrvKseDKerOTJAQAAAEmkrN4OAAAA; brcap=0
Source: global traffic	HTTP traffic detected: GET /aadcdn.msftauth.net/~/shared/1.0/content/images/applogos/53_8b36337037cff88c3df203bb73d58e41.png HTTP/1.1Host: illmuina.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: qPdM=yoFHuHdbl0JD; qPdM.sig=ftxlg5-8Y92RYEos_rkJ06rZZVk; ClientId=82BAD7D4CAEA497B9374A35DC465C261; OIDC=1; OpenIdConnect.nonce.v3.sup9B6ZEUsfA82mDnA5liMJB_XpZiMb_G1Brp3kZB_Y=638653983405877601.e215e870-ec03-4218-afed-1dd1879dcf63; X-OWA-RedirectHistory=ArLym14BYalLB2r03Ag; esctx-8MIMiSwtbyw=AQABCQEAAADW6jl31mB3T7ugrWTT8pFe2gwjjiRCVT1LWwjmzTT1QgTbM-Bzqbsg5T4ZLuMQW0vllIo9WkeGjt5iA3GGYPV8hsSgcsiZXxsBdzaJSe0Sr-TXSUofnsQumjHkNzCBJcf_enS_g1F9-GbPNih-taoscS4M79fe0UqvD6jz-ldajyAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=0.AXEBMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAA.AQABGgEAAADW6jl31mB3T7ugrWTT8pFe_d_ZamHgqmQPbzChEFdnRul5z2P4xuxJPLPEKM9yDKTsFGLTBulxNX1meyflWuA1eFsUlfMHbGqLzIy0u5PUAt487n8uPghai5EoxbR15BYgAA; esctx=PAQABBwEAAADW6jl31mB3T7ugrWTT8pFeXaU5A4OdmLO3MFXqa3nxAx6eKNVzpX4R62ESrsrTIAb8HIjIQjDtpi-7AhU0iFRmn2DIwQQ_Wn981piUa5b-gBZFMIbf5igaZGcEv5AZH_WxCTTEZU3ejIKAU74IeDyQ9fQfCWjlGLIKFiYAPD2RYtz_Ek-n7leL8F9aSK8WHbQgAA; esctx-AlSDhilpH1M=AQABCQEAAADW6jl31mB3T7ugrWTT8pFexv6Dqi8kY4OzDpa4X_SIO-df5u3FX4_16MfOUZP8Rh_Rg_DVoyjgx8D5YM4WYc0qck88FLBQfHxk6wvksxXQKzBk-hxThjxamkIEkJri4SiPE7uM-nr2Asic_FYAG004qwXydI8tG8MXpkn4K12zdSAA; fpc=AgCPfKbr1T5Hu-oyrvKseDKerOTJAQAAAEmkrN4OAAAA; brcap=0
Source: global traffic	HTTP traffic detected: GET /aadcdn.msftauth.net/~/shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico HTTP/1.1Host: illmuina.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: qPdM=yoFHuHdbl0JD; qPdM.sig=ftxlg5-8Y92RYEos_rkJ06rZZVk; ClientId=82BAD7D4CAEA497B9374A35DC465C261; OIDC=1; OpenIdConnect.nonce.v3.sup9B6ZEUsfA82mDnA5liMJB_XpZiMb_G1Brp3kZB_Y=638653983405877601.e215e870-ec03-4218-afed-1dd1879dcf63; X-OWA-RedirectHistory=ArLym14BYalLB2r03Ag; esctx-8MIMiSwtbyw=AQABCQEAAADW6jl31mB3T7ugrWTT8pFe2gwjjiRCVT1LWwjmzTT1QgTbM-Bzqbsg5T4ZLuMQW0vllIo9WkeGjt5iA3GGYPV8hsSgcsiZXxsBdzaJSe0Sr-TXSUofnsQumjHkNzCBJcf_enS_g1F9-GbPNih-taoscS4M79fe0UqvD6jz-ldajyAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=0.AXEBMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAA.AQABGgEAAADW6jl31mB3T7ugrWTT8pFe_d_ZamHgqmQPbzChEFdnRul5z2P4xuxJPLPEKM9yDKTsFGLTBulxNX1meyflWuA1eFsUlfMHbGqLzIy0u5PUAt487n8uPghai5EoxbR15BYgAA; esctx=PAQABBwEAAADW6jl31mB3T7ugrWTT8pFeXaU5A4OdmLO3MFXqa3nxAx6eKNVzpX4R62ESrsrTIAb8HIjIQjDtpi-7AhU0iFRmn2DIwQQ_Wn981piUa5b-gBZFMIbf5igaZGcEv5AZH_WxCTTEZU3ejIKAU74IeDyQ9fQfCWjlGLIKFiYAPD2RYtz_Ek-n7leL8F9aSK8WHbQgAA; esctx-AlSDhilpH1M=AQABCQEAAADW6jl31mB3T7ugrWTT8pFexv6Dqi8kY4OzDpa4X_SIO-df5u3FX4_16MfOUZP8Rh_Rg_DVoyjgx8D5YM4WYc0qck88FLBQfHxk6wvksxXQKzBk-hxThjxamkIEkJri4SiPE7uM-nr2Asic_FYAG004qwXydI8tG8MXpkn4K12zdSAA; fpc=AgCPfKbr1T5Hu-oyrvKseDKerOTJAQAAAEmkrN4OAAAA; brcap=0
Source: global traffic	HTTP traffic detected: GET /aadcdn.msftauth.net/~/shared/1.0/content/images/appbackgrounds/49_7916a894ebde7d29c2cc29b267f1299f.jpg HTTP/1.1Host: illmuina.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: qPdM=yoFHuHdbl0JD; qPdM.sig=ftxlg5-8Y92RYEos_rkJ06rZZVk; ClientId=82BAD7D4CAEA497B9374A35DC465C261; OIDC=1; OpenIdConnect.nonce.v3.sup9B6ZEUsfA82mDnA5liMJB_XpZiMb_G1Brp3kZB_Y=638653983405877601.e215e870-ec03-4218-afed-1dd1879dcf63; X-OWA-RedirectHistory=ArLym14BYalLB2r03Ag; esctx-8MIMiSwtbyw=AQABCQEAAADW6jl31mB3T7ugrWTT8pFe2gwjjiRCVT1LWwjmzTT1QgTbM-Bzqbsg5T4ZLuMQW0vllIo9WkeGjt5iA3GGYPV8hsSgcsiZXxsBdzaJSe0Sr-TXSUofnsQumjHkNzCBJcf_enS_g1F9-GbPNih-taoscS4M79fe0UqvD6jz-ldajyAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=0.AXEBMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAA.AQABGgEAAADW6jl31mB3T7ugrWTT8pFe_d_ZamHgqmQPbzChEFdnRul5z2P4xuxJPLPEKM9yDKTsFGLTBulxNX1meyflWuA1eFsUlfMHbGqLzIy0u5PUAt487n8uPghai5EoxbR15BYgAA; esctx=PAQABBwEAAADW6jl31mB3T7ugrWTT8pFeXaU5A4OdmLO3MFXqa3nxAx6eKNVzpX4R62ESrsrTIAb8HIjIQjDtpi-7AhU0iFRmn2DIwQQ_Wn981piUa5b-gBZFMIbf5igaZGcEv5AZH_WxCTTEZU3ejIKAU74IeDyQ9fQfCWjlGLIKFiYAPD2RYtz_Ek-n7leL8F9aSK8WHbQgAA; esctx-AlSDhilpH1M=AQABCQEAAADW6jl31mB3T7ugrWTT8pFexv6Dqi8kY4OzDpa4X_SIO-df5u3FX4_16MfOUZP8Rh_Rg_DVoyjgx8D5YM4WYc0qck88FLBQfHxk6wvksxXQKzBk-hxThjxamkIEkJri4SiPE7uM-nr2Asic_FYAG004qwXydI8tG8MXpkn4K12zdSAA; fpc=AgCPfKbr1T5Hu-oyrvKseDKerOTJAQAAAEmkrN4OAAAA; brcap=0
Source: global traffic	HTTP traffic detected: GET /aadcdn.msftauth.net/~/shared/1.0/content/js/asyncchunk/convergedlogin_pcustomizationloader_80e93b9a4cb13643afca.js HTTP/1.1Host: illmuina.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: qPdM=yoFHuHdbl0JD; qPdM.sig=ftxlg5-8Y92RYEos_rkJ06rZZVk; ClientId=82BAD7D4CAEA497B9374A35DC465C261; OIDC=1; OpenIdConnect.nonce.v3.sup9B6ZEUsfA82mDnA5liMJB_XpZiMb_G1Brp3kZB_Y=638653983405877601.e215e870-ec03-4218-afed-1dd1879dcf63; X-OWA-RedirectHistory=ArLym14BYalLB2r03Ag; esctx-8MIMiSwtbyw=AQABCQEAAADW6jl31mB3T7ugrWTT8pFe2gwjjiRCVT1LWwjmzTT1QgTbM-Bzqbsg5T4ZLuMQW0vllIo9WkeGjt5iA3GGYPV8hsSgcsiZXxsBdzaJSe0Sr-TXSUofnsQumjHkNzCBJcf_enS_g1F9-GbPNih-taoscS4M79fe0UqvD6jz-ldajyAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=0.AXEBMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAA.AQABGgEAAADW6jl31mB3T7ugrWTT8pFe_d_ZamHgqmQPbzChEFdnRul5z2P4xuxJPLPEKM9yDKTsFGLTBulxNX1meyflWuA1eFsUlfMHbGqLzIy0u5PUAt487n8uPghai5EoxbR15BYgAA; esctx=PAQABBwEAAADW6jl31mB3T7ugrWTT8pFeXaU5A4OdmLO3MFXqa3nxAx6eKNVzpX4R62ESrsrTIAb8HIjIQjDtpi-7AhU0iFRmn2DIwQQ_Wn981piUa5b-gBZFMIbf5igaZGcEv5AZH_WxCTTEZU3ejIKAU74IeDyQ9fQfCWjlGLIKFiYAPD2RYtz_Ek-n7leL8F9aSK8WHbQgAA; esctx-AlSDhilpH1M=AQABCQEAAADW6jl31mB3T7ugrWTT8pFexv6Dqi8kY4OzDpa4X_SIO-df5u3FX4_16MfOUZP8Rh_Rg_DVoyjgx8D5YM4WYc0qck88FLBQfHxk6wvksxXQKzBk-hxThjxamkIEkJri4SiPE7uM-nr2Asic_FYAG004qwXydI8tG8MXpkn4K12zdSAA; fpc=AgCPfKbr1T5Hu-oyrvKseDKerOTJAQAAAEmkrN4OAAAA; brcap=0
Source: global traffic	HTTP traffic detected: GET /aadcdn.msftauth.net/~/shared/1.0/content/images/microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg HTTP/1.1Host: illmuina.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: qPdM=yoFHuHdbl0JD; qPdM.sig=ftxlg5-8Y92RYEos_rkJ06rZZVk; ClientId=82BAD7D4CAEA497B9374A35DC465C261; OIDC=1; OpenIdConnect.nonce.v3.sup9B6ZEUsfA82mDnA5liMJB_XpZiMb_G1Brp3kZB_Y=638653983405877601.e215e870-ec03-4218-afed-1dd1879dcf63; X-OWA-RedirectHistory=ArLym14BYalLB2r03Ag; esctx-8MIMiSwtbyw=AQABCQEAAADW6jl31mB3T7ugrWTT8pFe2gwjjiRCVT1LWwjmzTT1QgTbM-Bzqbsg5T4ZLuMQW0vllIo9WkeGjt5iA3GGYPV8hsSgcsiZXxsBdzaJSe0Sr-TXSUofnsQumjHkNzCBJcf_enS_g1F9-GbPNih-taoscS4M79fe0UqvD6jz-ldajyAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=0.AXEBMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAA.AQABGgEAAADW6jl31mB3T7ugrWTT8pFe_d_ZamHgqmQPbzChEFdnRul5z2P4xuxJPLPEKM9yDKTsFGLTBulxNX1meyflWuA1eFsUlfMHbGqLzIy0u5PUAt487n8uPghai5EoxbR15BYgAA; esctx=PAQABBwEAAADW6jl31mB3T7ugrWTT8pFeXaU5A4OdmLO3MFXqa3nxAx6eKNVzpX4R62ESrsrTIAb8HIjIQjDtpi-7AhU0iFRmn2DIwQQ_Wn981piUa5b-gBZFMIbf5igaZGcEv5AZH_WxCTTEZU3ejIKAU74IeDyQ9fQfCWjlGLIKFiYAPD2RYtz_Ek-n7leL8F9aSK8WHbQgAA; esctx-AlSDhilpH1M=AQABCQEAAADW6jl31mB3T7ugrWTT8pFexv6Dqi8kY4OzDpa4X_SIO-df5u3FX4_16MfOUZP8Rh_Rg_DVoyjgx8D5YM4WYc0qck88FLBQfHxk6wvksxXQKzBk-hxThjxamkIEkJri4SiPE7uM-nr2Asic_FYAG004qwXydI8tG8MXpkn4K12zdSAA; fpc=AgCPfKbr1T5Hu-oyrvKseDKerOTJAQAAAEmkrN4OAAAA; brcap=0
Source: global traffic	HTTP traffic detected: GET /personal/malahmar_neweranet_com/_layouts/15/AccessDenied.aspx?correlation=1e265da1%2D7085%2D6000%2Daa0e%2D1d0352a4af7e HTTP/1.1Host: neweranet0-my.sharepoint.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uIzMxYTU4NjIyMGI5ZTA0YWZhN2U3MTU2YTUxODQyNjEwNTViZDA2MjZkZjY3M2I3NTdjMmUwMTkwNTRlNWNkY2EsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jMzFhNTg2MjIwYjllMDRhZmE3ZTcxNTZhNTE4NDI2MTA1NWJkMDYyNmRmNjczYjc1N2MyZTAxOTA1NGU1Y2RjYSwxMzM3NDI3NTM4MjAwMDAwMDAsMCwxMzM3NDM2MTQ4MjUwMjE0ODYsMC4wLjAuMCwyNTgsZDNlZTNmZWQtYjU1ZS00OTMyLWEzNTQtZDkyNWRmNWM1MGRjLCwsMGMyNjVkYTEtYjA4MS02MDAwLWFhMGUtMWFiNTc0MmU5NjI2LDBjMjY1ZGExLWIwODEtNjAwMC1hYTBlLTFhYjU3NDJlOTYyNixMTDZLWmNUTXBrbVhKOEo3akVQVGdBLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTI0MjYsdVhlaFFKUGxlVmpOQ2Jha1VoR0Q2SXlGUVFrLGNPUStvdXpteUIzb2EyZ2Fob3BLWktnend3WlN2eGFvdk1VZFVzUDBqTGlhb2xZcDNSOUk4d0dMYmhOMkw4VFo3c1psREk1TmRjWFlUM0tMd1p2VmdUVE95M2t0emwrRjdJY1lNZHNyck9zWWoxQ0FkMnNQUisvekVqL1d0czRVRUx0UE5vSklEekZqUW1NN1dvTWQ4TnNscE1xMEJWT1A2cGkrUC9hRnBmMkxuMnpiTEkrSzBDb1BxelRSK25rUHRKakIvRUU1V3RrMXJ6WWR2L1ZiQ3dhcGR5OW14Mmw2ZHRvMGprT0RBM0ErSi9VaE45a3JmSkUyV04wck1mRGxFRGtld0dIemZnNjFLUkFvN0UwaTNaeEtPTkltZm9lNlBKRC9wTkg5NEsraUw2d3o0cWZuYXlPR0pURnRDQnVyUjlCTCtScXNTanliTUo1RlNrcUY0QT09PC9TUD4=; FeatureOverrides_experiments=[]; ai_session=aLJsOtZty6NoJa4JKf5lA0\|1729801509900\|1729801509900; MSFPC=GUID=f09e73372e0b4b43b7740e7c80cbfe4c&HASH=f09e&LV=202410&V=4&LU=1729801514528
Source: global traffic	HTTP traffic detected: GET /aadcdn.msftauth.net/~/shared/1.0/content/images/marching_ants_white_166de53471265253ab3a456defe6da23.gif HTTP/1.1Host: illmuina.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://illmuina.com/?fwrvtcrft=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmY2xpZW50LXJlcXVlc3QtaWQ9N2YxMjVkMGMtMTJjMy1jMjQyLTRmMmQtZWUxOTBkYzM0NWUwJnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODY1Mzk4MzQwNTg3NzYwMS5lMjE1ZTg3MC1lYzAzLTQyMTgtYWZlZC0xZGQxODc5ZGNmNjMmc3RhdGU9RGN0QkVvQWdDRUJScmVrNEpFZ0tIc2NSM0xicy1yRjRmX2R6U3VrTVI4Z1lTZEpaZS1PaF9HQlRrWTUwZTZYbUtnaS1rT0dwcERDM0c1QVpxUXhidTNPTzl5cnZOOHNQ&sso_reload=trueAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: qPdM=yoFHuHdbl0JD; qPdM.sig=ftxlg5-8Y92RYEos_rkJ06rZZVk; ClientId=82BAD7D4CAEA497B9374A35DC465C261; OIDC=1; OpenIdConnect.nonce.v3.sup9B6ZEUsfA82mDnA5liMJB_XpZiMb_G1Brp3kZB_Y=638653983405877601.e215e870-ec03-4218-afed-1dd1879dcf63; X-OWA-RedirectHistory=ArLym14BYalLB2r03Ag; esctx-8MIMiSwtbyw=AQABCQEAAADW6jl31mB3T7ugrWTT8pFe2gwjjiRCVT1LWwjmzTT1QgTbM-Bzqbsg5T4ZLuMQW0vllIo9WkeGjt5iA3GGYPV8hsSgcsiZXxsBdzaJSe0Sr-TXSUofnsQumjHkNzCBJcf_enS_g1F9-GbPNih-taoscS4M79fe0UqvD6jz-ldajyAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=0.AXEBMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAA.AQABGgEAAADW6jl31mB3T7ugrWTT8pFe_d_ZamHgqmQPbzChEFdnRul5z2P4xuxJPLPEKM9yDKTsFGLTBulxNX1meyflWuA1eFsUlfMHbGqLzIy0u5PUAt487n8uPghai5EoxbR15BYgAA; esctx=PAQABBwEAAADW6jl31mB3T7ugrWTT8pFeXaU5A4OdmLO3MFXqa3nxAx6eKNVzpX4R62ESrsrTIAb8HIjIQjDtpi-7AhU0iFRmn2DIwQQ_Wn981piUa5b-gBZFMIbf5igaZGcEv5AZH_WxCTTEZU3ejIKAU74IeDyQ9fQfCWjlGLIKFiYAPD2RYtz_Ek-n7leL8F9aSK8WHbQgAA; esctx-AlSDhilpH1M=AQABCQEAAADW6jl31mB3T7ugrWTT8pFexv6Dqi8kY4OzDpa4X_SIO-df5u3FX4_16MfOUZP8Rh_Rg_DVoyjgx8D5YM4WYc0qck88FLBQfHxk6wvksxXQKzBk-hxThjxamkIEkJri4SiPE7uM-nr2Asic_FYAG004qwXydI8tG8MXpkn4K12zdSAA; fpc=AgCPfKbr1T5Hu-oyrvKseDKerOTJAQAAAEmkrN4OAAAA; brcap=0
Source: global traffic	HTTP traffic detected: GET /aadcdn.msftauth.net/~/shared/1.0/content/images/marching_ants_b540a8e518037192e32c4fe58bf2dbab.gif HTTP/1.1Host: illmuina.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://illmuina.com/?fwrvtcrft=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmY2xpZW50LXJlcXVlc3QtaWQ9N2YxMjVkMGMtMTJjMy1jMjQyLTRmMmQtZWUxOTBkYzM0NWUwJnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODY1Mzk4MzQwNTg3NzYwMS5lMjE1ZTg3MC1lYzAzLTQyMTgtYWZlZC0xZGQxODc5ZGNmNjMmc3RhdGU9RGN0QkVvQWdDRUJScmVrNEpFZ0tIc2NSM0xicy1yRjRmX2R6U3VrTVI4Z1lTZEpaZS1PaF9HQlRrWTUwZTZYbUtnaS1rT0dwcERDM0c1QVpxUXhidTNPTzl5cnZOOHNQ&sso_reload=trueAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: qPdM=yoFHuHdbl0JD; qPdM.sig=ftxlg5-8Y92RYEos_rkJ06rZZVk; ClientId=82BAD7D4CAEA497B9374A35DC465C261; OIDC=1; OpenIdConnect.nonce.v3.sup9B6ZEUsfA82mDnA5liMJB_XpZiMb_G1Brp3kZB_Y=638653983405877601.e215e870-ec03-4218-afed-1dd1879dcf63; X-OWA-RedirectHistory=ArLym14BYalLB2r03Ag; esctx-8MIMiSwtbyw=AQABCQEAAADW6jl31mB3T7ugrWTT8pFe2gwjjiRCVT1LWwjmzTT1QgTbM-Bzqbsg5T4ZLuMQW0vllIo9WkeGjt5iA3GGYPV8hsSgcsiZXxsBdzaJSe0Sr-TXSUofnsQumjHkNzCBJcf_enS_g1F9-GbPNih-taoscS4M79fe0UqvD6jz-ldajyAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=0.AXEBMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAA.AQABGgEAAADW6jl31mB3T7ugrWTT8pFe_d_ZamHgqmQPbzChEFdnRul5z2P4xuxJPLPEKM9yDKTsFGLTBulxNX1meyflWuA1eFsUlfMHbGqLzIy0u5PUAt487n8uPghai5EoxbR15BYgAA; esctx=PAQABBwEAAADW6jl31mB3T7ugrWTT8pFeXaU5A4OdmLO3MFXqa3nxAx6eKNVzpX4R62ESrsrTIAb8HIjIQjDtpi-7AhU0iFRmn2DIwQQ_Wn981piUa5b-gBZFMIbf5igaZGcEv5AZH_WxCTTEZU3ejIKAU74IeDyQ9fQfCWjlGLIKFiYAPD2RYtz_Ek-n7leL8F9aSK8WHbQgAA; esctx-AlSDhilpH1M=AQABCQEAAADW6jl31mB3T7ugrWTT8pFexv6Dqi8kY4OzDpa4X_SIO-df5u3FX4_16MfOUZP8Rh_Rg_DVoyjgx8D5YM4WYc0qck88FLBQfHxk6wvksxXQKzBk-hxThjxamkIEkJri4SiPE7uM-nr2Asic_FYAG004qwXydI8tG8MXpkn4K12zdSAA; fpc=AgCPfKbr1T5Hu-oyrvKseDKerOTJAQAAAEmkrN4OAAAA; brcap=0
Source: global traffic	HTTP traffic detected: GET /aadcdn.msftauth.net/~/shared/1.0/content/images/marching_ants_white_166de53471265253ab3a456defe6da23.gif HTTP/1.1Host: illmuina.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: qPdM=yoFHuHdbl0JD; qPdM.sig=ftxlg5-8Y92RYEos_rkJ06rZZVk; ClientId=82BAD7D4CAEA497B9374A35DC465C261; OIDC=1; OpenIdConnect.nonce.v3.sup9B6ZEUsfA82mDnA5liMJB_XpZiMb_G1Brp3kZB_Y=638653983405877601.e215e870-ec03-4218-afed-1dd1879dcf63; X-OWA-RedirectHistory=ArLym14BYalLB2r03Ag; esctx-8MIMiSwtbyw=AQABCQEAAADW6jl31mB3T7ugrWTT8pFe2gwjjiRCVT1LWwjmzTT1QgTbM-Bzqbsg5T4ZLuMQW0vllIo9WkeGjt5iA3GGYPV8hsSgcsiZXxsBdzaJSe0Sr-TXSUofnsQumjHkNzCBJcf_enS_g1F9-GbPNih-taoscS4M79fe0UqvD6jz-ldajyAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=0.AXEBMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAA.AQABGgEAAADW6jl31mB3T7ugrWTT8pFe_d_ZamHgqmQPbzChEFdnRul5z2P4xuxJPLPEKM9yDKTsFGLTBulxNX1meyflWuA1eFsUlfMHbGqLzIy0u5PUAt487n8uPghai5EoxbR15BYgAA; esctx=PAQABBwEAAADW6jl31mB3T7ugrWTT8pFeXaU5A4OdmLO3MFXqa3nxAx6eKNVzpX4R62ESrsrTIAb8HIjIQjDtpi-7AhU0iFRmn2DIwQQ_Wn981piUa5b-gBZFMIbf5igaZGcEv5AZH_WxCTTEZU3ejIKAU74IeDyQ9fQfCWjlGLIKFiYAPD2RYtz_Ek-n7leL8F9aSK8WHbQgAA; esctx-AlSDhilpH1M=AQABCQEAAADW6jl31mB3T7ugrWTT8pFexv6Dqi8kY4OzDpa4X_SIO-df5u3FX4_16MfOUZP8Rh_Rg_DVoyjgx8D5YM4WYc0qck88FLBQfHxk6wvksxXQKzBk-hxThjxamkIEkJri4SiPE7uM-nr2Asic_FYAG004qwXydI8tG8MXpkn4K12zdSAA; fpc=AgCPfKbr1T5Hu-oyrvKseDKerOTJAQAAAEmkrN4OAAAA; brcap=0
Source: global traffic	HTTP traffic detected: GET /aadcdn.msftauth.net/~/shared/1.0/content/images/marching_ants_b540a8e518037192e32c4fe58bf2dbab.gif HTTP/1.1Host: illmuina.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: qPdM=yoFHuHdbl0JD; qPdM.sig=ftxlg5-8Y92RYEos_rkJ06rZZVk; ClientId=82BAD7D4CAEA497B9374A35DC465C261; OIDC=1; OpenIdConnect.nonce.v3.sup9B6ZEUsfA82mDnA5liMJB_XpZiMb_G1Brp3kZB_Y=638653983405877601.e215e870-ec03-4218-afed-1dd1879dcf63; X-OWA-RedirectHistory=ArLym14BYalLB2r03Ag; esctx-8MIMiSwtbyw=AQABCQEAAADW6jl31mB3T7ugrWTT8pFe2gwjjiRCVT1LWwjmzTT1QgTbM-Bzqbsg5T4ZLuMQW0vllIo9WkeGjt5iA3GGYPV8hsSgcsiZXxsBdzaJSe0Sr-TXSUofnsQumjHkNzCBJcf_enS_g1F9-GbPNih-taoscS4M79fe0UqvD6jz-ldajyAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=0.AXEBMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAA.AQABGgEAAADW6jl31mB3T7ugrWTT8pFe_d_ZamHgqmQPbzChEFdnRul5z2P4xuxJPLPEKM9yDKTsFGLTBulxNX1meyflWuA1eFsUlfMHbGqLzIy0u5PUAt487n8uPghai5EoxbR15BYgAA; esctx=PAQABBwEAAADW6jl31mB3T7ugrWTT8pFeXaU5A4OdmLO3MFXqa3nxAx6eKNVzpX4R62ESrsrTIAb8HIjIQjDtpi-7AhU0iFRmn2DIwQQ_Wn981piUa5b-gBZFMIbf5igaZGcEv5AZH_WxCTTEZU3ejIKAU74IeDyQ9fQfCWjlGLIKFiYAPD2RYtz_Ek-n7leL8F9aSK8WHbQgAA; esctx-AlSDhilpH1M=AQABCQEAAADW6jl31mB3T7ugrWTT8pFexv6Dqi8kY4OzDpa4X_SIO-df5u3FX4_16MfOUZP8Rh_Rg_DVoyjgx8D5YM4WYc0qck88FLBQfHxk6wvksxXQKzBk-hxThjxamkIEkJri4SiPE7uM-nr2Asic_FYAG004qwXydI8tG8MXpkn4K12zdSAA; fpc=AgCPfKbr1T5Hu-oyrvKseDKerOTJAQAAAEmkrN4OAAAA; brcap=0
Source: global traffic	HTTP traffic detected: GET /common/GetCredentialType?mkt=en-US HTTP/1.1Host: illmuina.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: qPdM=yoFHuHdbl0JD; qPdM.sig=ftxlg5-8Y92RYEos_rkJ06rZZVk; ClientId=82BAD7D4CAEA497B9374A35DC465C261; OIDC=1; OpenIdConnect.nonce.v3.sup9B6ZEUsfA82mDnA5liMJB_XpZiMb_G1Brp3kZB_Y=638653983405877601.e215e870-ec03-4218-afed-1dd1879dcf63; X-OWA-RedirectHistory=ArLym14BYalLB2r03Ag; esctx-8MIMiSwtbyw=AQABCQEAAADW6jl31mB3T7ugrWTT8pFe2gwjjiRCVT1LWwjmzTT1QgTbM-Bzqbsg5T4ZLuMQW0vllIo9WkeGjt5iA3GGYPV8hsSgcsiZXxsBdzaJSe0Sr-TXSUofnsQumjHkNzCBJcf_enS_g1F9-GbPNih-taoscS4M79fe0UqvD6jz-ldajyAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=0.AXEBMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAA.AQABGgEAAADW6jl31mB3T7ugrWTT8pFe_d_ZamHgqmQPbzChEFdnRul5z2P4xuxJPLPEKM9yDKTsFGLTBulxNX1meyflWuA1eFsUlfMHbGqLzIy0u5PUAt487n8uPghai5EoxbR15BYgAA; esctx=PAQABBwEAAADW6jl31mB3T7ugrWTT8pFeXaU5A4OdmLO3MFXqa3nxAx6eKNVzpX4R62ESrsrTIAb8HIjIQjDtpi-7AhU0iFRmn2DIwQQ_Wn981piUa5b-gBZFMIbf5igaZGcEv5AZH_WxCTTEZU3ejIKAU74IeDyQ9fQfCWjlGLIKFiYAPD2RYtz_Ek-n7leL8F9aSK8WHbQgAA; esctx-AlSDhilpH1M=AQABCQEAAADW6jl31mB3T7ugrWTT8pFexv6Dqi8kY4OzDpa4X_SIO-df5u3FX4_16MfOUZP8Rh_Rg_DVoyjgx8D5YM4WYc0qck88FLBQfHxk6wvksxXQKzBk-hxThjxamkIEkJri4SiPE7uM-nr2Asic_FYAG004qwXydI8tG8MXpkn4K12zdSAA; fpc=AgCPfKbr1T5Hu-oyrvKseDKerOTJAQAAAEmkrN4OAAAA; brcap=0

Source: global traffic	DNS traffic detected: DNS query: x1.i.lencr.org
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: m365cdn.nel.measure.office.net
Source: global traffic	DNS traffic detected: DNS query: neweranet0.sharepoint.com
Source: global traffic	DNS traffic detected: DNS query: eastus1-mediap.svc.ms
Source: global traffic	DNS traffic detected: DNS query: 16b69e33.0cced60565238cd25cf4ed69.workers.dev
Source: global traffic	DNS traffic detected: DNS query: r4.res.office365.com
Source: global traffic	DNS traffic detected: DNS query: challenges.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: config.fp.measure.office.com
Source: global traffic	DNS traffic detected: DNS query: a599989aa37d0cdcb2026ebacbf01376.fp.measure.office.com
Source: global traffic	DNS traffic detected: DNS query: qiagens.com
Source: global traffic	DNS traffic detected: DNS query: illmuina.com
Source: global traffic	DNS traffic detected: DNS query: outlook.office.com
Source: global traffic	DNS traffic detected: DNS query: teams.cloud.microsoft
Source: global traffic	DNS traffic detected: DNS query: upload.fp.measure.office.com
Source: global traffic	DNS traffic detected: DNS query: aadcdn.msftauth.net
Source: global traffic	DNS traffic detected: DNS query: outlook.office365.com
Source: global traffic	DNS traffic detected: DNS query: spo.nel.measure.office.net

Source: unknown

HTTP traffic detected: POST /personal/malahmar_neweranet_com/_api/v2.1/graphql HTTP/1.1Host: neweranet0-my.sharepoint.comConnection: keep-aliveContent-Length: 507sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"accept: application/json;odata=verboseContent-Type: application/json;odata=verboseX-ServiceWorker-Strategy: CacheFirstsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Origin: https://neweranet0-my.sharepoint.comSec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://neweranet0-my.sharepoint.com/personal/malahmar_neweranet_com/_layouts/15/onedrive.aspx?id=%2Fpersonal%2Fmalahmar%5Fneweranet%5Fcom%2FDocuments%2FRfq82020%2D382039302%2D42445&ga=1Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uIzMxYTU4NjIyMGI5ZTA0YWZhN2U3MTU2YTUxODQyNjEwNTViZDA2MjZkZjY3M2I3NTdjMmUwMTkwNTRlNWNkY2EsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jMzFhNTg2MjIwYjllMDRhZmE3ZTcxNTZhNTE4NDI2MTA1NWJkMDYyNmRmNjczYjc1N2MyZTAxOTA1NGU1Y2RjYSwxMzM3NDI3NTM4MjAwMDAwMDAsMCwxMzM3NDM2MTQ4MjUwMjE0ODYsMC4wLjAuMCwyNTgsZDNlZTNmZWQtYjU1ZS00OTMyLWEzNTQtZDkyNWRmNWM1MGRjLCwsMGMyNjVkYTEtYjA4MS02MDAwLWFhMGUtMWFiNTc0MmU5NjI2LDBjMjY1ZGExLWIwODEtNjAwMC1hYTBlLTFhYjU3NDJlOTYyNixMTDZLWmNUTXBrbVhKOEo3akVQVGdBLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTI0MjYsdVhlaFFKUGxlVmpOQ2Jha1VoR0Q2SXlGUVFrLGNPUStvdXpteUIzb2EyZ2Fob3BLWktnend3WlN2eGFvdk1VZFVzUDBqTGlhb2xZcDNSOUk4d0dMYmhOMkw4VFo3c1psREk1TmRjWFlUM0tMd1p2VmdUVE95M2t0emwrRjdJY1lNZHNyck9zWWoxQ0FkMnNQUisvekVqL1d0czRVRUx0UE5vSklEekZqUW1NN1dvTWQ4TnNscE1xMEJWT1A2cGkrUC9hRnBmMkxuMnpiTEkrSzBDb1BxelRSK25rUHRKakIvRUU1V3RrMXJ6WWR2L1ZiQ3dhcGR5OW14Mmw2ZHRvMGprT0RBM0ErSi9VaE45a3JmSkUyV04wck1mRGxFRGtld0dIemZnNjFLUkFvN0UwaTNaeEtPTkltZm9lNlBKRC9wTkg5NEsraUw2d3o0cWZuYXlPR0pURnRDQnVyUjlCTCtScXNTanliTUo1RlNrcUY0QT09PC9TUD4=

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 24 Oct 2024 20:25:29 GMTContent-Type: application/jsonContent-Length: 7Connection: closecf-chl-out: +3fDKCR9uk28LFlKHqxlWFlFyNqvYwZiPg8=$iDHoguPNI6zuZ0U1cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0Server: cloudflareCF-RAY: 8d7cb2490b52eaac-DFWalt-svc: h3=":443"; ma=86400
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 24 Oct 2024 20:25:33 GMTContent-Type: application/jsonContent-Length: 7Connection: closecache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0cf-chl-out: WyzUGH+epEIVUvClRAVTXWfiGQM4fEMgQcE=$CHfD16/al+PaVcGlServer: cloudflareCF-RAY: 8d7cb25facb8e7eb-DFWalt-svc: h3=":443"; ma=86400
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 24 Oct 2024 20:25:36 GMTContent-Type: application/jsonContent-Length: 7Connection: closecf-chl-out: VyZTowY/P30o1GTUde4v/RuJV0x9pgSO7xc=$OAGLmXLVafmvW7Lrcache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0Server: cloudflareCF-RAY: 8d7cb2754b39e98f-DFWalt-svc: h3=":443"; ma=86400
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundCache-Control: privateSet-Cookie: x-ms-gateway-slice=estsfd; path=/; secure; samesite=none; httponlyStrict-Transport-Security: max-age=31536000; includeSubDomainsP3P: CP="DSP CUR OTPi IND OTRi ONL FIN"x-ms-request-id: 7637b141-23cc-4a1e-9f53-bcf61ef18100x-ms-ests-server: 2.1.19184.6 - NCUS ProdSlicesnel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0}x-ms-srs: 1.PReferrer-Policy: strict-origin-when-cross-originDate: Thu, 24 Oct 2024 20:25:44 GMTConnection: closeContent-Length: 0Content-Security-Policy: default-src * data: blob: filesystem: about: ws: wss: 'unsafe-inline' 'unsafe-eval'; form-action * data: blob: 'unsafe-inline' 'unsafe-eval'; script-src * data: blob: 'unsafe-inline' 'unsafe-eval'; connect-src * data: blob: 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src * data: blob: filesystem: ; frame-ancestors 'self' * http://* https://* file://* about: javascript: data: blob: filesystem: ; object-src * data: blob: filesystem: 'unsafe-inline' 'unsafe-eval'; style-src * data: blob: 'unsafe-inline'; font-src * data: blob: 'unsafe-inline';

Source: chromecache_1250.17.dr, chromecache_816.17.dr, chromecache_839.17.dr, chromecache_1231.17.dr, chromecache_1176.17.dr, chromecache_1235.17.dr	String found in binary or memory: http://fb.me/use-check-prop-types
Source: chromecache_883.17.dr	String found in binary or memory: http://feross.org
Source: chromecache_1255.17.dr	String found in binary or memory: http://github.com/jquery/globalize
Source: chromecache_1133.17.dr, chromecache_874.17.dr	String found in binary or memory: http://knockoutjs.com/
Source: chromecache_1198.17.dr	String found in binary or memory: http://www.contoso.com
Source: chromecache_1133.17.dr, chromecache_874.17.dr	String found in binary or memory: http://www.json.org/json2.js
Source: chromecache_1041.17.dr	String found in binary or memory: http://www.opensource.org/licenses/mit-license.php
Source: chromecache_1133.17.dr, chromecache_874.17.dr	String found in binary or memory: http://www.opensource.org/licenses/mit-license.php)
Source: chromecache_901.17.dr	String found in binary or memory: http://www.unicode.org/copyright.html
Source: chromecache_1130.17.dr, chromecache_1253.17.dr	String found in binary or memory: https://16b69e33.0cced60565238cd25cf4ed69.workers.dev/)
Source: chromecache_1206.17.dr	String found in binary or memory: https://1drv.com/
Source: chromecache_1206.17.dr	String found in binary or memory: https://centralus1-mediad.svc.ms
Source: chromecache_918.17.dr, chromecache_1223.17.dr	String found in binary or memory: https://challenges.cloudflare.com/turnstile/v0/api.js?onload=onloadTurnstileCallback
Source: chromecache_1010.17.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/web/policies
Source: chromecache_809.17.dr	String found in binary or memory: https://facebook.github.io/react/docs/more-about-refs.html#the-ref-callback-attribute
Source: chromecache_883.17.dr	String found in binary or memory: https://github.com/douglascrockford/JSON-js
Source: chromecache_867.17.dr, chromecache_1254.17.dr	String found in binary or memory: https://github.com/uuidjs/uuid#getrandomvalues-not-supported
Source: chromecache_1146.17.dr	String found in binary or memory: https://illmuina.com/?dataXX0=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1cmwiOiJodHRwczovL2lsbG11aW5hL
Source: chromecache_1133.17.dr, chromecache_874.17.dr	String found in binary or memory: https://js.monitor.azure.com/scripts/c/ms.analytics-web-2.min.js
Source: chromecache_978.17.dr	String found in binary or memory: https://lists.live.com/
Source: chromecache_1206.17.dr	String found in binary or memory: https://livefilestore.com/
Source: chromecache_1028.17.dr, chromecache_877.17.dr, chromecache_1060.17.dr	String found in binary or memory: https://login.microsoftonline.com
Source: chromecache_1028.17.dr	String found in binary or memory: https://login.windows-ppe.net
Source: chromecache_1206.17.dr, chromecache_1031.17.dr, chromecache_977.17.dr, chromecache_852.17.dr	String found in binary or memory: https://media.cloudapp.net
Source: chromecache_877.17.dr, chromecache_1060.17.dr	String found in binary or memory: https://microsoft.spfx3rdparty.com
Source: chromecache_1196.17.dr, chromecache_1031.17.dr, chromecache_977.17.dr, chromecache_914.17.dr	String found in binary or memory: https://my.microsoftpersonalcontent.com
Source: bc3c228ad2c13f96cb14375c3860e802.pdf	String found in binary or memory: https://neweranet0-my.sharepoint.com/:f:/g/personal/malahmar_neweranet_com/Etd2wgQOOMlAnCPcJokAti0Br
Source: chromecache_1206.17.dr, chromecache_1031.17.dr, chromecache_977.17.dr, chromecache_852.17.dr	String found in binary or memory: https://northcentralus1-medias.svc.ms
Source: chromecache_1206.17.dr, chromecache_1121.17.dr, chromecache_1241.17.dr	String found in binary or memory: https://onedrive.cloud.microsoft
Source: chromecache_1206.17.dr, chromecache_1121.17.dr, chromecache_1241.17.dr	String found in binary or memory: https://onedrive.dev.cloud.microsoft
Source: chromecache_1228.17.dr	String found in binary or memory: https://onedrive.live.com/?gologin=1
Source: chromecache_877.17.dr, chromecache_1060.17.dr	String found in binary or memory: https://onedrive.live.com/sa
Source: chromecache_1156.17.dr, chromecache_903.17.dr, chromecache_1007.17.dr, chromecache_817.17.dr	String found in binary or memory: https://outlook.office.com/search
Source: chromecache_1206.17.dr	String found in binary or memory: https://portal.office.com/
Source: chromecache_918.17.dr	String found in binary or memory: https://qiagens.com/?cczaakcn
Source: chromecache_1188.17.dr	String found in binary or memory: https://reactjs.org/link/react-polyfills
Source: chromecache_1228.17.dr	String found in binary or memory: https://res-1.cdn.office.net
Source: chromecache_838.17.dr, chromecache_1085.17.dr, chromecache_1209.17.dr	String found in binary or memory: https://res-1.cdn.office.net/files/fabric-cdn-prod_20230815.002/assets
Source: chromecache_1228.17.dr	String found in binary or memory: https://res-1.cdn.office.net/files/odsp-web-prod_2024-10-11.005/
Source: chromecache_798.17.dr	String found in binary or memory: https://res-1.cdn.office.net/files/odsp-web-prod_2024-10-11.008/
Source: chromecache_798.17.dr	String found in binary or memory: https://res-1.cdn.office.net/files/odsp-web-prod_2024-10-11.008/spwebworker.js
Source: chromecache_1228.17.dr	String found in binary or memory: https://res-1.cdn.office.net/files/sp-client/odsp-media-3b870ca1
Source: chromecache_1228.17.dr	String found in binary or memory: https://res-1.cdn.office.net/files/sp-client/odsp.1ds/odsp.1ds.lib-b7da68fc
Source: chromecache_1228.17.dr	String found in binary or memory: https://res-1.cdn.office.net/files/sp-client/odsp.aria/odsp.aria.lib-ab227069
Source: chromecache_1228.17.dr	String found in binary or memory: https://res-1.cdn.office.net/files/sp-client/odsp.fluentui.core/fui.core-97518b2a
Source: chromecache_1228.17.dr	String found in binary or memory: https://res-1.cdn.office.net/files/sp-client/odsp.fluentui.utilities/fui.util-93de749b
Source: chromecache_1228.17.dr	String found in binary or memory: https://res-1.cdn.office.net/files/sp-client/odsp.knockout/odsp.knockout.lib-447adea9
Source: chromecache_1228.17.dr	String found in binary or memory: https://res-1.cdn.office.net/files/sp-client/odsp.react/odsp.react.lib-9ea4d016
Source: chromecache_1228.17.dr	String found in binary or memory: https://res-1.cdn.office.net/files/sp-client/odsp.tslib/tslib-6a7224b3
Source: chromecache_1228.17.dr	String found in binary or memory: https://res-1.cdn.office.net/files/sp-client/odsp.utilities/odsp.util-644642c2
Source: chromecache_1228.17.dr	String found in binary or memory: https://res-2.cdn.office.net/files/odsp-web-prod_2024-10-11.005/
Source: chromecache_1228.17.dr	String found in binary or memory: https://shell.cdn.office.net
Source: chromecache_1228.17.dr	String found in binary or memory: https://shell.cdn.office.net/api/ShellBootstrapper/business/OneShell
Source: chromecache_1228.17.dr	String found in binary or memory: https://spoprod-a.akamaihd.net/files/odsp-common-library-prod_2019-02-15_20190219.002/require.js
Source: chromecache_1206.17.dr	String found in binary or memory: https://substrate.office.com
Source: chromecache_900.17.dr, chromecache_1237.17.dr, chromecache_1213.17.dr, chromecache_1020.17.dr	String found in binary or memory: https://support.office.com/en-us/article/Manage-lists-and-libraries-with-many-items-b8588dae-9387-48
Source: chromecache_1228.17.dr	String found in binary or memory: https://www.office.com/login?prompt=select_account&ru=%2Flaunch%2Fonedrive
Source: chromecache_1228.17.dr	String found in binary or memory: https://www.office.com/login?ru=%2Flaunch%2Fonedrive

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50053
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50174
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50177
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50057
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50178
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50059
Source: unknown	Network traffic detected: HTTP traffic on port 50263 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50061
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50060
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 50125 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50177 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49950 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 50148 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50165 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49967 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50064
Source: unknown	Network traffic detected: HTTP traffic on port 50091 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50067
Source: unknown	Network traffic detected: HTTP traffic on port 50074 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50070
Source: unknown	Network traffic detected: HTTP traffic on port 50107 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50268 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50159 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50074
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50195
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50073
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49967
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 50120 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50195 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50009 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50172 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50057 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50077
Source: unknown	Network traffic detected: HTTP traffic on port 50130 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50081
Source: unknown	Network traffic detected: HTTP traffic on port 50073 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50269 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49680 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49957
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 50119 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49950
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50089
Source: unknown	Network traffic detected: HTTP traffic on port 50051 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50092
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50091
Source: unknown	Network traffic detected: HTTP traffic on port 50136 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50178 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50093
Source: unknown	Network traffic detected: HTTP traffic on port 50023 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50018
Source: unknown	Network traffic detected: HTTP traffic on port 50170 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50061 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50019
Source: unknown	Network traffic detected: HTTP traffic on port 49676 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50130
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50132
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50135
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50134
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50136
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50161 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50144 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49895
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50263
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50023
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50144
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50265
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50143
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50264
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50146
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50267
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50024
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50145
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50148
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50269
Source: unknown	Network traffic detected: HTTP traffic on port 49879 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50268
Source: unknown	Network traffic detected: HTTP traffic on port 50264 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49957 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50067 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50103 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 50143 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50031
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50152
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50159
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50037
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50158
Source: unknown	Network traffic detected: HTTP traffic on port 50265 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50110 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50160
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50162
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50161
Source: unknown	Network traffic detected: HTTP traffic on port 50104 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50089 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49998
Source: unknown	Network traffic detected: HTTP traffic on port 50203 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50171 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50043
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50164
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50163
Source: unknown	Network traffic detected: HTTP traffic on port 50115 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50165
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50046
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50169
Source: unknown	Network traffic detected: HTTP traffic on port 50109 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50132 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50171
Source: unknown	Network traffic detected: HTTP traffic on port 50160 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50170
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50173
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50051
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50172
Source: unknown	Network traffic detected: HTTP traffic on port 50126 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49867
Source: unknown	Network traffic detected: HTTP traffic on port 50145 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50122 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50174 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50059 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50106
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50105
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50107
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50060 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50109
Source: unknown	Network traffic detected: HTTP traffic on port 50018 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49691
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50100
Source: unknown	Network traffic detected: HTTP traffic on port 50077 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50104
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50103
Source: unknown	Network traffic detected: HTTP traffic on port 50134 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50053 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50162 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50119
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50111
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50110
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50112
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50115
Source: unknown	Network traffic detected: HTTP traffic on port 50099 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50031 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50043 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50127 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50100 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50037 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50127
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50009
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50129
Source: unknown	Network traffic detected: HTTP traffic on port 49677 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50120
Source: unknown	Network traffic detected: HTTP traffic on port 50093 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50122
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50124
Source: unknown	Network traffic detected: HTTP traffic on port 50111 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50123
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50126
Source: unknown	Network traffic detected: HTTP traffic on port 49895 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50125
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50105 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49867 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49820
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50164 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50098
Source: unknown	Network traffic detected: HTTP traffic on port 49691 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50099
Source: unknown	Network traffic detected: HTTP traffic on port 50112 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50158 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50106 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50129 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50135 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50267 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49819
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 50081 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50169 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50064 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50123 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50173 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50152 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50070 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50098 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50046 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50124 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50092 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50019 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50024 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50163 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49998 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49843 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50146 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50203
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49903
Source: unknown	Network traffic detected: HTTP traffic on port 49903 -> 443

Source: chromecache_1232.17.dr	OLE indicator, VBA macros: true
Source: chromecache_885.17.dr	OLE indicator, VBA macros: true

Source: chromecache_1232.17.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: chromecache_885.17.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false

Source: bc3c228ad2c13f96cb14375c3860e802.pdf	Initial sample: https://neweranet0-my.sharepoint.com/:f:/g/personal/malahmar_neweranet_com/Etd2wgQOOMlAnCPcJokAti0Br6HyyfMaB6MiwzMZjEF3xw?e=8rf3aZ
Source: bc3c228ad2c13f96cb14375c3860e802.pdf	Initial sample: https://neweranet0-my.sharepoint.com/:f:/g/personal/malahmar_neweranet_com/etd2wgqoomlancpcjokati0br6hyyfmab6miwzmzjef3xw?e=8rf3az
Source: chromecache_1130.17.dr	Initial sample: https://16b69e33.0cced60565238cd25cf4ed69.workers.dev/

Source: unknown	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\bc3c228ad2c13f96cb14375c3860e802.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2264 --field-trial-handle=1548,i,196938426665746239,18177206994314547253,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://neweranet0-my.sharepoint.com/:f:/g/personal/malahmar_neweranet_com/Etd2wgQOOMlAnCPcJokAti0Br6HyyfMaB6MiwzMZjEF3xw?e=8rf3aZ
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2148 --field-trial-handle=2032,i,248921863120407722,16504755158596381138,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://neweranet0-my.sharepoint.com/:f:/g/personal/malahmar_neweranet_com/Etd2wgQOOMlAnCPcJokAti0Br6HyyfMaB6MiwzMZjEF3xw?e=8rf3aZ	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2264 --field-trial-handle=1548,i,196938426665746239,18177206994314547253,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2148 --field-trial-handle=2032,i,248921863120407722,16504755158596381138,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Google Drive.lnk.16.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.16.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.16.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.16.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.16.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.16.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: bc3c228ad2c13f96cb14375c3860e802.pdf	Initial sample: PDF keyword /JS count = 0
Source: bc3c228ad2c13f96cb14375c3860e802.pdf	Initial sample: PDF keyword /JavaScript count = 0
Source: chromecache_1253.17.dr	Initial sample: PDF keyword /JS count = 0
Source: chromecache_1253.17.dr	Initial sample: PDF keyword /JavaScript count = 0
Source: chromecache_1130.17.dr	Initial sample: PDF keyword /JS count = 0
Source: chromecache_1130.17.dr	Initial sample: PDF keyword /JavaScript count = 0

Source: PDF document	LLM: Page contains button: 'View or Download Document' Source: 'PDF document'
Source: PDF document	LLM: PDF document contains prominent button: 'view or download document'
Source: https://neweranet0-my.sharepoint.com/personal/malahmar_neweranet_com/_layouts/15/onedrive.aspx?ga=1&id=%2Fpersonal%2Fmalahmar%5Fneweranet%5Fcom%2FDocuments%2FRfq82020%2D382039302%2D42445%2FView%20docs%2Epdf&parent=%2Fpersonal%2Fmalahmar%5Fneweranet%5Fcom%2FDocuments%2FRfq82020%2D382039302%2D42445	LLM: Page contains button: 'View docs.pdf' Source: '2.2.pages.csv'

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: Chrome Cache Entry: 1253
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: Chrome Cache Entry: 1130	Jump to dropped file
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: Chrome Cache Entry: 1253	Jump to dropped file

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: chromecache_794.17.dr, chromecache_954.17.dr, chromecache_969.17.dr	Binary or memory string: ",ConnectVirtualMachine:"
Source: chromecache_794.17.dr, chromecache_954.17.dr, chromecache_969.17.dr	Binary or memory string: ",DisconnectVirtualMachine:"

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	1 Drive-by Compromise	Windows Management Instrumentation	1 Browser Extensions	1 Process Injection	11 Masquerading	OS Credential Dumping	1 Security Software Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	1 Spearphishing Link	Scheduled Task/Job	1 Scripting	1 Registry Run Keys / Startup Folder	1 Process Injection	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	Data from Removable Media	3 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 Registry Run Keys / Startup Folder	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	1 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	4 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	5 Application Layer Protocol	Traffic Duplication	Data Destruction

Source	Detection	Scanner	Label
http://www.unicode.org/copyright.html	0%	URL Reputation	safe
https://reactjs.org/link/react-polyfills	0%	URL Reputation	safe
http://www.opensource.org/licenses/mit-license.php	0%	URL Reputation	safe
https://login.microsoftonline.com	0%	URL Reputation	safe
http://knockoutjs.com/	0%	URL Reputation	safe
http://fb.me/use-check-prop-types	0%	URL Reputation	safe
https://substrate.office.com	0%	URL Reputation	safe
http://www.opensource.org/licenses/mit-license.php)	0%	URL Reputation	safe
http://feross.org	0%	URL Reputation	safe

Name	IP	Active	Malicious	Reputation
dual-spo-0005.spo-msedge.net	13.107.136.10	true	false	unknown
s-part-0017.t-0009.t-msedge.net	13.107.246.45	true	false	unknown
HHN-efz.ms-acdc.office.com	40.99.150.50	true	false	unknown
default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	217.20.57.18	true	false	unknown
illmuina.com	89.185.80.154	true	true	unknown
bg.microsoft.map.fastly.net	199.232.210.172	true	false	unknown
qiagens.com	89.185.80.154	true	false	unknown
ooc-g2.tm-4.office.com	52.98.179.34	true	false	unknown
challenges.cloudflare.com	104.18.95.41	true	false	unknown
dns.office.com	150.171.0.2	true	false	unknown
sni1gl.wpc.omegacdn.net	152.199.21.175	true	false	unknown
www.google.com	142.250.186.68	true	false	unknown
s-0005.dual-s-msedge.net	52.123.128.14	true	false	unknown
s-part-0032.t-0009.t-msedge.net	13.107.246.60	true	false	unknown
16b69e33.0cced60565238cd25cf4ed69.workers.dev	104.21.52.38	true	false	unknown
x1.i.lencr.org	unknown	unknown	false	unknown
neweranet0.sharepoint.com	unknown	unknown	false	unknown
r4.res.office365.com	unknown	unknown	false	unknown
outlook.office.com	unknown	unknown	false	unknown
aadcdn.msftauth.net	unknown	unknown	false	unknown
m365cdn.nel.measure.office.net	unknown	unknown	false	unknown
outlook.office365.com	unknown	unknown	false	unknown
spo.nel.measure.office.net	unknown	unknown	false	unknown
teams.cloud.microsoft	unknown	unknown	false	unknown
a599989aa37d0cdcb2026ebacbf01376.fp.measure.office.com	unknown	unknown	false	unknown
upload.fp.measure.office.com	unknown	unknown	false	unknown
config.fp.measure.office.com	unknown	unknown	false	unknown
eastus1-mediap.svc.ms	unknown	unknown	false	unknown

Name	Malicious	Reputation
https://qiagens.com/?cczaakcn=43dbe3be4ea967c921c47015dd2c2e1f2a0e66058ac6ba426a316aefef278ea9ee62cacb932202fa4171e55cbd45642a89b017c550b4e8050061aca0f37d9a8c	false	unknown
https://neweranet0-my.sharepoint.com/_layouts/15/spwebworkerproxy.ashx	false	unknown
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/i/8d7cb2331df86b1f/1729801528446/hcPEVoAvcEGg0wO	false	unknown
https://neweranet0-my.sharepoint.com/_layouts/15/images/odbfavicon.ico?rev=47	false	unknown
https://illmuina.com/aadcdn.msftauth.net/~/shared/1.0/content/images/appbackgrounds/49-small_e58aafc980614a9cd7796bea7b5ea8f0.jpg	true	unknown
https://outlook.office365.com/owa/prefetch.aspx	false	unknown
https://neweranet0-my.sharepoint.com/personal/malahmar_neweranet_com/_api/SP.OAuth.Token/Acquire()	false	unknown
https://neweranet0-my.sharepoint.com/personal/malahmar_neweranet_com/_layouts/15/onedrive.aspx?id=%2Fpersonal%2Fmalahmar%5Fneweranet%5Fcom%2FDocuments%2FRfq82020%2D382039302%2D42445&ga=1	false	unknown
https://illmuina.com/aadcdn.msftauth.net/~/shared/1.0/content/js/asyncchunk/convergedlogin_pcustomizationloader_80e93b9a4cb13643afca.js	true	unknown
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/pat/8d7cb2331df86b1f/1729801528447/391605ba286f68df98208250e68f4a7c199b65305b6bf46bcc94639ac53eff8a/0QN79Uyf2HmXA8s	false	unknown
https://teams.cloud.microsoft/apc/trans.gif?bad6a97330817a280d386a4cd95a0ef9	false	unknown
https://illmuina.com/aadcdn.msftauth.net/~/shared/1.0/content/images/appbackgrounds/49_7916a894ebde7d29c2cc29b267f1299f.jpg	true	unknown
https://neweranet0-my.sharepoint.com/personal/malahmar_neweranet_com/_layouts/15/onedrive.aspx?ga=1&id=%2Fpersonal%2Fmalahmar%5Fneweranet%5Fcom%2FDocuments%2FRfq82020%2D382039302%2D42445%2FView%20docs%2Epdf&parent=%2Fpersonal%2Fmalahmar%5Fneweranet%5Fcom%2FDocuments%2FRfq82020%2D382039302%2D42445	true	unknown
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/cmg/1	false	unknown
https://eastus1-mediap.svc.ms/transform/passthrough?provider=spo&inputFormat=pdf&cs=fFNQTw&docid=https%3A%2F%2Fneweranet0-my.sharepoint.com%3A443%2F_api%2Fv2.0%2Fdrives%2Fb!8LVLDi5f_ESbIAFRkBb_wuVRh8JOqJNMty5azIcUhKaoh_V28urHQpwy_nU-LkKj%2Fitems%2F01Z3M5PR5D36TZOXWFAVBIEQGHQ734MSXQ%3Fversion%3DPublished&access_token=v1.eyJzaXRlaWQiOiIwZTRiYjVmMC01ZjJlLTQ0ZmMtOWIyMC0wMTUxOTAxNmZmYzIiLCJhdWQiOiIwMDAwMDAwMy0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAvbmV3ZXJhbmV0MC1teS5zaGFyZXBvaW50LmNvbUBkM2VlM2ZlZC1iNTVlLTQ5MzItYTM1NC1kOTI1ZGY1YzUwZGMiLCJleHAiOiIxNzI5ODE0NDAwIn0.CiMKCXNoYXJpbmdpZBIWTEw2S1pjVE1wa21YSjhKN2pFUFRnQQoICgNzdHASAXQKCgoEc25pZBICMzMSBgjk0zoQARoOMTczLjI1NC4yNTAuNzEiFG1pY3Jvc29mdC5zaGFyZXBvaW50KixBZUtpcUtkQzlVWTZsRUI4NGNqWk0wcENDSUxIYkQ1VWRzU0M2T0JQVlFNPTB4OAFKEGhhc2hlZHByb29mdG9rZW5iBHRydWVyYTBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uIzMxYTU4NjIyMGI5ZTA0YWZhN2U3MTU2YTUxODQyNjEwNTViZDA2MjZkZjY3M2I3NTdjMmUwMTkwNTRlNWNkY2F6ATDCAWEwIy5mfG1lbWJlcnNoaXB8dXJuJTNhc3BvJTNhYW5vbiMzMWE1ODYyMjBiOWUwNGFmYTdlNzE1NmE1MTg0MjYxMDU1YmQwNjI2ZGY2NzNiNzU3YzJlMDE5MDU0ZTVjZGNh.yl5HZkEsm_ow_vppRAjzfi8r6BwAi_Xw31TOI03w2DE&cTag=%22c%3A%7B97A7DFA3-C55E-4205-8240-C787F7C64AF0%7D%2C1%22	false	unknown
https://outlook.office.com/apc/trans.gif?d122ac44a142fefe436766869baa8b3a	false	unknown
https://16b69e33.0cced60565238cd25cf4ed69.workers.dev/	false	unknown
https://neweranet0-my.sharepoint.com/personal/malahmar_neweranet_com/_api/v2.1/graphql	false	unknown
https://teams.cloud.microsoft/apc/trans.gif?ed125d994abdc805a9f496f9e5fb5601	false	unknown
https://illmuina.com/aadcdn.msftauth.net/~/shared/1.0/content/images/marching_ants_white_166de53471265253ab3a456defe6da23.gif	true	unknown
https://challenges.cloudflare.com/turnstile/v0/b/e1a56f38220d/api.js	false	unknown
https://neweranet0-my.sharepoint.com/_layouts/15/odspserviceworkerproxy.aspx?swManifestName=spserviceworker&debug=false&bypass=false&navigationPreloadHeaderValue=%7B%22supportsFeatures%22%3A%5B1855%2C61313%5D%7D&dataHost=Nucleus&applications=%5B%7B%22id%22%3A%22STS%22%2C%22swPrefetchManifestName%22%3A%22stsserviceworkerprefetch%22%7D%2C%7B%22id%22%3A%22SPHome%22%7D%2C%7B%22id%22%3A%22SitePages%22%7D%2C%7B%22id%22%3A%22Embed%22%7D%2C%7B%22id%22%3A%22CreateGroup%22%7D%2C%7B%22id%22%3A%22SingleWebPart%22%7D%2C%7B%22id%22%3A%22VivaHome%22%7D%2C%7B%22id%22%3A%22BrokerLogon%22%7D%2C%7B%22id%22%3A%22Clipchamp%22%7D%2C%7B%22id%22%3A%22MeeBridge%22%7D%2C%7B%22id%22%3A%22SPStart%22%7D%2C%7B%22id%22%3A%22Agreements%22%7D%5D&list=v2&prefetchListData=true&defaultBrotli=true&authenticateFast=true&inlineAuth=v2&wwData=true&enableTheming=true&prefetchFilebrowserPageInTeams=true&FUIV9Flights=[-83099905,3]&spStartApplicationWebBundle=true&enableIntegrities=true&streamViewServerLoad=true&streamInlineScript=true&siteConfigRace=true	false	unknown
https://illmuina.com/aadcdn.msftauth.net/~/shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico	true	unknown
https://illmuina.com/aadcdn.msftauth.net/~/shared/1.0/content/images/applogos/53_8b36337037cff88c3df203bb73d58e41.png	true	unknown
https://neweranet0-my.sharepoint.com/_layouts/15/SPComponentRegistry.ashx?projects=[%22STS%22]&languages=%5B%5D	false	unknown
https://a599989aa37d0cdcb2026ebacbf01376.fp.measure.office.com/apc/trans.gif?a106a24b73a74db3515ad939e5c8514e	false	unknown
https://neweranet0-my.sharepoint.com/_layouts/15/SPComponentRegistry.ashx?projects=[%22spfx%22]&languages=%5B%5D	false	unknown
https://neweranet0-my.sharepoint.com/personal/malahmar_neweranet_com/_layouts/15/CSPReporting.aspx	false	unknown
https://neweranet0-my.sharepoint.com/personal/malahmar_neweranet_com/_layouts/15/AccessDenied.aspx?correlation=1e265da1%2D7085%2D6000%2Daa0e%2D1d0352a4af7e	false	unknown
https://eastus1-mediap.svc.ms/transform/thumbnail?provider=spo&inputFormat=pdf&cs=fFNQTw&docid=https%3A%2F%2Fneweranet0-my.sharepoint.com%3A443%2F_api%2Fv2.0%2Fdrives%2Fb!8LVLDi5f_ESbIAFRkBb_wuVRh8JOqJNMty5azIcUhKaoh_V28urHQpwy_nU-LkKj%2Fitems%2F01Z3M5PR5D36TZOXWFAVBIEQGHQ734MSXQ%3Fversion%3DPublished&access_token=v1.eyJzaXRlaWQiOiIwZTRiYjVmMC01ZjJlLTQ0ZmMtOWIyMC0wMTUxOTAxNmZmYzIiLCJhdWQiOiIwMDAwMDAwMy0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAvbmV3ZXJhbmV0MC1teS5zaGFyZXBvaW50LmNvbUBkM2VlM2ZlZC1iNTVlLTQ5MzItYTM1NC1kOTI1ZGY1YzUwZGMiLCJleHAiOiIxNzI5ODE0NDAwIn0.CiMKCXNoYXJpbmdpZBIWTEw2S1pjVE1wa21YSjhKN2pFUFRnQQoICgNzdHASAXQKCgoEc25pZBICMzMSBgjk0zoQARoOMTczLjI1NC4yNTAuNzEiFG1pY3Jvc29mdC5zaGFyZXBvaW50KixBZUtpcUtkQzlVWTZsRUI4NGNqWk0wcENDSUxIYkQ1VWRzU0M2T0JQVlFNPTB4OAFKEGhhc2hlZHByb29mdG9rZW5iBHRydWVyYTBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uIzMxYTU4NjIyMGI5ZTA0YWZhN2U3MTU2YTUxODQyNjEwNTViZDA2MjZkZjY3M2I3NTdjMmUwMTkwNTRlNWNkY2F6ATDCAWEwIy5mfG1lbWJlcnNoaXB8dXJuJTNhc3BvJTNhYW5vbiMzMWE1ODYyMjBiOWUwNGFmYTdlNzE1NmE1MTg0MjYxMDU1YmQwNjI2ZGY2NzNiNzU3YzJlMDE5MDU0ZTVjZGNh.yl5HZkEsm_ow_vppRAjzfi8r6BwAi_Xw31TOI03w2DE&cTag=%22c%3A%7B97A7DFA3-C55E-4205-8240-C787F7C64AF0%7D%2C1%22&encodeFailures=1&width=1024&height=1024&srcWidth=&srcHeight=	false	unknown
https://illmuina.com/owa/	true	unknown
https://outlook.office.com/apc/trans.gif?e32f41ff628254f2ac48073f90e481c2	false	unknown
https://challenges.cloudflare.com/turnstile/v0/api.js?onload=onloadTurnstileCallback	false	unknown
https://illmuina.com/	true	unknown
https://illmuina.com/aadcdn.msftauth.net/~/shared/1.0/content/js/ConvergedLogin_PCore_DQTmGfOEMmPUR-Vehc8U6Q2.js	true	unknown
https://illmuina.com/favicon.ico	true	unknown
https://illmuina.com/aadcdn.msftauth.net/~/shared/1.0/content/images/signin-options_4e48046ce74f4b89d45037c90576bfac.svg	true	unknown
https://illmuina.com/aadcdn.msftauth.net/~/shared/1.0/content/js/BssoInterrupt_Core_zKox_QMcTIVut7mG_Z9Eew2.js	true	unknown
https://illmuina.com/?dataXX0=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1cmwiOiJodHRwczovL2lsbG11aW5hLmNvbS8iLCJkb21haW4iOiJpbGxtdWluYS5jb20iLCJrZXkiOiJ5b0ZIdUhkYmwwSkQiLCJxcmMiOm51bGwsImlhdCI6MTcyOTgwMTUzNywiZXhwIjoxNzI5ODAxNjU3fQ.PK95BSyiMKiF5a86WrEL7drHWXsczyR6u2cQfqHIqzY	true	unknown
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/5g0na/0x4AAAAAAAyORc_In180R-LS/auto/fbE/normal/auto/	false	unknown
https://neweranet0-my.sharepoint.com/:f:/g/personal/malahmar_neweranet_com/Etd2wgQOOMlAnCPcJokAti0Br6HyyfMaB6MiwzMZjEF3xw?e=8rf3aZ	false	unknown
https://illmuina.com/aadcdn.msftauth.net/~/shared/1.0/content/images/marching_ants_b540a8e518037192e32c4fe58bf2dbab.gif	true	unknown
https://neweranet0.sharepoint.com/_vti_bin/afdcache.ashx/_userprofile/userphoto.jpg?_oat_=1729821675_978987c137e442151c7b982398c0d77c992fd737080b7f7acbe407a2f02f3ca6&P1=1729805032&P2=-149452251&P3=1&P4=T1YfEV6cUYX0UReS%2FpOQU7%2FnrgOYpy%2BnmiFTxwkUKlElDno3tNew4LsxRdyZhxw06SOPeyz%2Fnkzk4riIqEsOOdEX%2Fy5pjoAwsvkzKNFv88zqMGHa9wuLto%2BmtcyHpJkj0Tgb0ZcBKdKVpyl7mWz9G17S%2BRP7Pjk4JoRIOJsG3aqgRlL1%2Fl82f%2FJfsJ21Z3Uqz59rWvVHijyWtxBO9MPT8xFyiZgLbtTchL0y0vrwrqaZF9g8%2B05UXLGe5WiNKbE2rigAoKyBaAMGZ2DgY5wbozch32cE1DCEGcX3Xh0IVB2pSwwvEasUz99Yj23SGxBRNlaq3Ia6jKNmIKRNBnmvgQ%3D%3D&size=M&accountname=malahmar%40neweranet.com	false	unknown
https://a599989aa37d0cdcb2026ebacbf01376.fp.measure.office.com/apc/trans.gif?e07ac061066ba18fa7b97e0654d9436d	false	unknown
https://illmuina.com/common/GetCredentialType?mkt=en-US	true	unknown
https://illmuina.com/aadcdn.msftauth.net/~/shared/1.0/content/images/microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg	true	unknown
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/flow/ov1/860153270:1729797391:jSfkloMEoVcXzBqBe6pqzmYIrbImU0SmQd4TN3Y8rOg/8d7cb2331df86b1f/6FTJdsMzzg5YAgkR..N3R7KD85a.rxxZ4pKN17m3kig-1729801526-1.1.1.1-Nbe4ApgCuZmKnISEeTthvu1gKWHODS2KTHtZ2gi8jb0.55WsyEVUZX87SXscGIhn	false	unknown
https://illmuina.com/aadcdn.msftauth.net/~/ests/2.1/content/cdnbundles/converged.v2.login.min_nin8k2ycrbzww8zl5vxkaq2.css	true	unknown
https://16b69e33.0cced60565238cd25cf4ed69.workers.dev/favicon.ico	false	unknown
https://qiagens.com/?cczaakcn	false	unknown
https://illmuina.com/aadcdn.msftauth.net/~/ests/2.1/content/cdnbundles/ux.converged.login.strings-en.min_1yb3e7oii5t28dgo4xrtow2.js	true	unknown
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/orchestrate/chl_api/v1?ray=8d7cb2331df86b1f&lang=auto	false	unknown

Name	Source	Malicious	Antivirus Detection	Reputation
https://outlook.office.com/search	chromecache_1156.17.dr, chromecache_903.17.dr, chromecache_1007.17.dr, chromecache_817.17.dr	false		unknown
http://www.unicode.org/copyright.html	chromecache_901.17.dr	false	URL Reputation: safe	unknown
https://support.office.com/en-us/article/Manage-lists-and-libraries-with-many-items-b8588dae-9387-48	chromecache_900.17.dr, chromecache_1237.17.dr, chromecache_1213.17.dr, chromecache_1020.17.dr	false		unknown
https://login.windows-ppe.net	chromecache_1028.17.dr	false		unknown
https://js.monitor.azure.com/scripts/c/ms.analytics-web-2.min.js	chromecache_1133.17.dr, chromecache_874.17.dr	false		unknown
http://www.json.org/json2.js	chromecache_1133.17.dr, chromecache_874.17.dr	false		unknown
https://microsoft.spfx3rdparty.com	chromecache_877.17.dr, chromecache_1060.17.dr	false		unknown
https://reactjs.org/link/react-polyfills	chromecache_1188.17.dr	false	URL Reputation: safe	unknown
http://www.opensource.org/licenses/mit-license.php	chromecache_1041.17.dr	false	URL Reputation: safe	unknown
https://login.microsoftonline.com	chromecache_1028.17.dr, chromecache_877.17.dr, chromecache_1060.17.dr	false	URL Reputation: safe	unknown
https://onedrive.live.com/sa	chromecache_877.17.dr, chromecache_1060.17.dr	false		unknown
https://onedrive.cloud.microsoft	chromecache_1206.17.dr, chromecache_1121.17.dr, chromecache_1241.17.dr	false		unknown
https://northcentralus1-medias.svc.ms	chromecache_1206.17.dr, chromecache_1031.17.dr, chromecache_977.17.dr, chromecache_852.17.dr	false		unknown
https://centralus1-mediad.svc.ms	chromecache_1206.17.dr	false		unknown
https://onedrive.live.com/?gologin=1	chromecache_1228.17.dr	false		unknown
https://facebook.github.io/react/docs/more-about-refs.html#the-ref-callback-attribute	chromecache_809.17.dr	false		unknown
http://github.com/jquery/globalize	chromecache_1255.17.dr	false		unknown
https://16b69e33.0cced60565238cd25cf4ed69.workers.dev/)	chromecache_1130.17.dr, chromecache_1253.17.dr	false		unknown
https://neweranet0-my.sharepoint.com/:f:/g/personal/malahmar_neweranet_com/Etd2wgQOOMlAnCPcJokAti0Br	bc3c228ad2c13f96cb14375c3860e802.pdf	false		unknown
https://my.microsoftpersonalcontent.com	chromecache_1196.17.dr, chromecache_1031.17.dr, chromecache_977.17.dr, chromecache_914.17.dr	false		unknown
https://portal.office.com/	chromecache_1206.17.dr	false		unknown
https://clients.config.office.net/user/v1.0/web/policies	chromecache_1010.17.dr	false		unknown
http://knockoutjs.com/	chromecache_1133.17.dr, chromecache_874.17.dr	false	URL Reputation: safe	unknown
https://github.com/douglascrockford/JSON-js	chromecache_883.17.dr	false		unknown
http://fb.me/use-check-prop-types	chromecache_1250.17.dr, chromecache_816.17.dr, chromecache_839.17.dr, chromecache_1231.17.dr, chromecache_1176.17.dr, chromecache_1235.17.dr	false	URL Reputation: safe	unknown
https://spoprod-a.akamaihd.net/files/odsp-common-library-prod_2019-02-15_20190219.002/require.js	chromecache_1228.17.dr	false		unknown
https://1drv.com/	chromecache_1206.17.dr	false		unknown
https://livefilestore.com/	chromecache_1206.17.dr	false		unknown
https://substrate.office.com	chromecache_1206.17.dr	false	URL Reputation: safe	unknown
http://www.opensource.org/licenses/mit-license.php)	chromecache_1133.17.dr, chromecache_874.17.dr	false	URL Reputation: safe	unknown
https://illmuina.com/?dataXX0=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1cmwiOiJodHRwczovL2lsbG11aW5hL	chromecache_1146.17.dr	true		unknown
http://www.contoso.com	chromecache_1198.17.dr	false		unknown
https://lists.live.com/	chromecache_978.17.dr	false		unknown
http://feross.org	chromecache_883.17.dr	false	URL Reputation: safe	unknown
https://onedrive.dev.cloud.microsoft	chromecache_1206.17.dr, chromecache_1121.17.dr, chromecache_1241.17.dr	false		unknown
https://www.office.com/login?ru=%2Flaunch%2Fonedrive	chromecache_1228.17.dr	false		unknown
https://github.com/uuidjs/uuid#getrandomvalues-not-supported	chromecache_867.17.dr, chromecache_1254.17.dr	false		unknown
https://www.office.com/login?prompt=select_account&ru=%2Flaunch%2Fonedrive	chromecache_1228.17.dr	false		unknown

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.186.68	www.google.com	United States	15169	GOOGLEUS	false
13.107.136.10	dual-spo-0005.spo-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
104.18.94.41	unknown	United States	13335	CLOUDFLARENETUS	false
13.107.246.60	s-part-0032.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
150.171.0.2	dns.office.com	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
96.7.168.138	unknown	United States	262589	INTERNEXABRASILOPERADORADETELECOMUNICACOESSABR	false
40.99.150.114	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
40.99.150.50	HHN-efz.ms-acdc.office.com	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
104.21.52.38	16b69e33.0cced60565238cd25cf4ed69.workers.dev	United States	13335	CLOUDFLARENETUS	false
104.18.95.41	challenges.cloudflare.com	United States	13335	CLOUDFLARENETUS	false
52.123.128.14	s-0005.dual-s-msedge.net	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
152.199.21.175	sni1gl.wpc.omegacdn.net	United States	15133	EDGECASTUS	false
52.98.179.34	ooc-g2.tm-4.office.com	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
89.185.80.154	illmuina.com	Russian Federation	41757	OLIMP-SVYAZ-ASRU	true

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report bc3c228ad2c13f96cb14375c3860e802.pdf

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

HTML

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Cryptography

Phishing

Compliance

Networking

System Summary

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\93a996b7-a114-4d15-bebe-757831e2f2b7.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-241024202431Z-172.bmp

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.6632

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Windows Analysis Report
bc3c228ad2c13f96cb14375c3860e802.pdf

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1541503
Start date and time:	2024-10-24 22:23:48 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 3s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	21
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	bc3c228ad2c13f96cb14375c3860e802.pdf
Detection:	MAL
Classification:	mal72.phis.winPDF@35/836@69/16
Cookbook Comments:	Found application associated with file extension: .pdf

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
13.107.136.10	http://algestconsulting20-my.sharepoint.com/:f:/g/personal/jacques_cangah_algest-consulting_com/EkolIGllKGRKhe-gd4i73uMBzF46oqcv00d-WXGnz9D-Fw	Get hash	malicious	Unknown	Browse	algestconsulting20-my.sharepoint.com/:f:/g/personal/jacques_cangah_algest-consulting_com/EkolIGllKGRKhe-gd4i73uMBzF46oqcv00d-WXGnz9D-Fw
	http://bombeirosamora-my.sharepoint.com/:o:/g/personal/geral_comando_bombeirosamora_pt/EqT53jeWO6ZGkv1O_1FowosB2CSGfrKDmTZiEPPt31Ds7g	Get hash	malicious	HTMLPhisher	Browse	bombeirosamora-my.sharepoint.com/:o:/g/personal/geral_comando_bombeirosamora_pt/EqT53jeWO6ZGkv1O_1FowosB2CSGfrKDmTZiEPPt31Ds7g
	http://midlandlangarsevasociety-my.sharepoint.com/:w:/g/personal/sharon_bharaj_mlss_org_uk/EWiGFFYhPhtPjz5jsZdcRooBPGLh-q5SsgwgIhmP7JCmAg	Get hash	malicious	HTMLPhisher	Browse	midlandlangarsevasociety-my.sharepoint.com/:w:/g/personal/sharon_bharaj_mlss_org_uk/EWiGFFYhPhtPjz5jsZdcRooBPGLh-q5SsgwgIhmP7JCmAg
150.171.0.2	https://newmexicogov-my.sharepoint.com/:f:/g/personal/christine_fuller_newmexicogov_onmicrosoft_com/EoaWDUrKgw5NpxyRqgYpeMMB9xM6HiHeCt0mCjuvQCuY2A?e=Aa5N0v	Get hash	malicious	Unknown	Browse
	https://nmgovdot-my.sharepoint.com/:f:/g/personal/brian_filip_nmgov_co/EopUqBu8fqpOvw_R7W8qXnEBWw032PoWoE-pjka6mBLMVw?e=G3klTx	Get hash	malicious	HtmlDropper	Browse
	https://crystaliteinc-my.sharepoint.com/:f:/p/johnnyh/EuQdaH3lBSRDvT82TdxqsUoBzZkMIoxp10kCm6OSWVzrDQ?e=3jMitI	Get hash	malicious	HTMLPhisher	Browse
	https://admortonco-my.sharepoint.com/:f:/p/chris/Eqm6Y75QIl1CrUSFMrfbwLABZUl5hkjU4nihAZ0iqeCvsQ?e=ydgOgS	Get hash	malicious	HTMLPhisher	Browse
104.18.94.41	https://phisher-parts-production-us-east-1.s3.amazonaws.com/68a29cbc-d8f9-4c01-aa8b-704c527e3dea/2024-10-24/hdp1f4m0mtn58r7e5djj3r2baep1oktpuitii5o1/d493f6c6bdfdcf5959ae27c95155d91b5b3c1ce0bab14ef02ea76d7c451b0ee9?response-content-disposition=attachment%3B%20filename%3D%22FaxDocument-873422-Wcepinc-Transmission.html%22%3B%20filename%2A%3DUTF-8%27%27FaxDocument-873422-Wcepinc-Transmission.html&X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=ASIA37KREM2QLQCGJML5%2F20241024%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20241024T201816Z&X-Amz-Expires=15711&X-Amz-Security-Token=IQoJb3JpZ2luX2VjEHMaCXVzLWVhc3QtMSJIMEYCIQD5%2BhZvZGN6J3Fxb1eh7JhGJFYatdM4YSe%2FB1Lhu54clwIhAMGxuFEnQyuPv%2FCfNJf%2FM%2Bjk%2FqrMeNeOhUAY3BKeKKVEKogECNz%2F%2F%2F%2F%2F%2F%2F%2F%2F%2FwEQABoMODIzMTkzMjY1ODI0IgxkadsnklCVctvwMWIq3APvQpQpI58knFBaUI%2FesQH1FJlTX%2BlsdPXwHmIEoA7JJLDUXnDzzteCVoUwvp1olI1h3PTJSpl3WxfIUi7BTzihzEqp3qn85AWXiDO1fWB1MbpD%2FSDfsrqMEgho9OQjpzPsQHM6e%2BmLmZ1yTIHD97Pf%2FN08letrYEZz2NFJVIQrLYTvWQwr2QPEZJyIm0WnuSbbq8Q1iYmha%2FIyVB9ZKxOPpvdgR1ptXZ6oLjzsy%2Bt%2BjafEISWZYsRDWwvLzIujqWG%2B63t%2BpCq3bxmYAsSHjxnzarIm7Hms4AOj9sIvR9pkL0wwD3qkWG7oBYHnb8k0%2B1AzzdJ2e%2FfLVD9TiwcG1KsTEzsabHJpEEBXTzducKIDP%2FcB%2FYcv03kyJnwWzUMaIbwdRV3lLj4itVuLpZpUbOm8RJChRMb83TR2qZdNKkjYktSR42en1uqps%2BU0qDC%2Fg93%2FFw2lIXwuMoTybf1fWYEY2OQz6E5eRoigwQhmg4wJe1ZZgjwP8fEQSG0yo9XZnXr%2FyAu%2BEt2RNzWy2wHuoZk3HVwPs4lWnhTyTcrSndmgKXkfVSpHeqCqkF3xveAbEhd%2F9qQutDIIcWnBBAlsILK5EUpHzYLvkIMYBMTieCtf00%2FFHqO4eOCLX5sGvDCHqeq4BjqkAeyFM5a%2FebzwF4uw87xMbquzIriBZ00BbMxSr1F6iNQrK5eiAmnkSYUYh%2Fp3YJofaU0ox8%2FOVLIHBKp3WtDzd5b5%2F5WwioyMhT1u0BDnhNT%2F%2B11YTTeSy4rC4fIYdhkm7tZrFS9Sa1WIiQXgQiBqqjkRydZT%2FLrmsyVTvK8wBscWkRvZxnU%2Bsi4OUJJHkmJ27ywwC3Ob5nE4D4%2FwrYfIb%2F4HWJO4&X-Amz-SignedHeaders=host&X-Amz-Signature=4bd824e8586cb631d993afbaa40b83fff9764a3fdcecf7e4b686cf1557dfa0d0	Get hash	malicious	Phisher	Browse
	https://onlinepdf-qrsharedfile.com/index.html#XYW5uaWUua3lwcmlhbm91QGxjYXR0ZXJ0b24uY29t	Get hash	malicious	HTMLPhisher	Browse
	phish_alert_sp2_2.0.0.0 (1).eml	Get hash	malicious	Unknown	Browse
	https://view.flodesk.com/emails/671a6d1f7ce9f793bb70518a	Get hash	malicious	Unknown	Browse
	http://boulos-sharepoint.com	Get hash	malicious	HTMLPhisher	Browse
	https://u47751895.ct.sendgrid.net/ls/click?upn=u001.LUpianUM71xe7PV7wDA6i1kcuy38W249FfPzE-2Fn4iGArrL0MQBCUZHFEzmfBrwW7hf5h8aNQUml0OSIHqpXf0Hd-2FwQBg2gsGxKHK7PsY2xc-3DPya1_YT5LbHmSQ6soq50ixwpFbSYZshuq6-2FPFgRa8NDnR03IYhL-2F9Rsp4maHC7HKUeszLncLvtZaWCVsMwsguQ5-2FbgriKbvHymTrFFrqjql1V0tvMkZQvyA1xxy-2B6NtGFoUeUGIrvdabsXN8enx2k5c-2BvLXzm-2BRXmD29Cf33DbXC513Cwkuo46G2I7a1uwsANH8eVhz8r5XyLPneRi4ngixWtQkBEaLBBKkl5CzEPySNlMnqJuuWiTBlFswgUf9EX-2BEhUpqAvMFuAlKTpYcteS-2FjAegbPmUSDcSeBkfnhL6yUhTFHUFrxra-2BdIgnamsXKUUqu-2BC45G51EOfBd9qOCqWy3OeOC7KYj3-2FcaIfcOAM1Jkvyddtn3gwRC5w97RLza-2BBM2JcZLNzMYva4SJzBZv7RClCaMcjevyjP6ZFvlR0NECf5zAmWbPLmCUnefze8ZyTvnDqXVb3nrflSdnTlNxWfm617xjOrSoSu-2BVHZVqbE92ZodSyvWqgaCWZg0TMDZeq64M67nuH9ryo7I5u80SS081vnMThCYiPoN3JUoUliQPKbNY46GxAPyVhMs4qqZVi-2FFUtIGEycXziXytxfy6JCzAZ2sa7DZusc1RftLAVM4uJit-2FAhxM-2FK1sEHsKHKvs9o7uDMExZ5YqEBjrD2XHch-2BY6xwRGGg56MeC1Bpa72xAoR6DmInmiEX4j92yaROEh1-2FMsHdtSstN7zc8gxU7ETVWVMBRLf6m4dTRruSfSNaLUi9QLq9d7Qfe8VMdKN1j9FMGIYia88728BDNNxRTaT4nSNITRr9JPa4Z1K1vdUocdyCKNcYSZsN8yguI0-2FqNXUfWFuoxnz5MDqwufLzxub8Fw-3D-3D	Get hash	malicious	HTMLPhisher	Browse
	https://chapelet-mariae.com.pl/qgxPm/	Get hash	malicious	HTMLPhisher	Browse
	EXTERNALRoger Moczygemba shared DIRECT MED CLINIC - CONFIDENTIAL with you.msg	Get hash	malicious	Unknown	Browse
	https://egift.activationshub.com/gift-card/view/8lPFUrjq1LGzg7JHwS8hJJRdL	Get hash	malicious	Unknown	Browse
	http://hybrid-web.global.blackspider.com/urlwrap/?q=AXicLU67UsMwEFQBX0Gf0pbtkywxowHLiZgUDEXoGVmRjbFlJX4wk4bPgT-kJgpp9u72dnb35hZ9_SB0943Q2J8S1kTT-Bk53fbGD_Po-8h4h4C_yGb70WGgwAjaOz_q4TFAY41fhvk0mSXyY4Pe5_kw3cdxP3RRa-M8k0-72IqHZXZvRruDbptBrMLl7L5dnLAh60JMfhmNFbb3x0VfmFDBDrPYPO9Wtj--jtp0271IeaVxWlvNawq24rrmlPAKkyw3hGoetMLaNOFnloGugFFS1QmrM3IGAKg1DSLdBrM0veyzSMIsryXPOUnO_1-dYIUisgSKsdoknOWcZiBlmSvMVaZwLouSpIqRslBScsxYCkWZQUkobEByul4riRAivwj9ATUqckw&Z	Get hash	malicious	Unknown	Browse
13.107.246.60	https://protect-us.mimecast.com/s/wFHoCqxrAnt7V914iZaD1v	Get hash	malicious	Unknown	Browse	www.mimecast.com/Customers/Support/Contact-support/
13.107.246.60	http://wellsfargo.dealogic.com/clientportal/Conferences/Registration/Form/368?menuItemId=5	Get hash	malicious	Unknown	Browse	wellsfargo.dealogic.com/clientportal/Conferences/Registration/Form/368?menuItemId=5

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	Doc-Secure6033.pdf	Get hash	malicious	Unknown	Browse	217.20.57.18
	QN1BkRVd.eml	Get hash	malicious	Unknown	Browse	217.20.57.18
	http://hybrid-web.global.blackspider.com/urlwrap/?q=AXicLU67UsMwEFQBX0Gf0pbtkywxowHLiZgUDEXoGVmRjbFlJX4wk4bPgT-kJgpp9u72dnb35hZ9_SB0943Q2J8S1kTT-Bk53fbGD_Po-8h4h4C_yGb70WGgwAjaOz_q4TFAY41fhvk0mSXyY4Pe5_kw3cdxP3RRa-M8k0-72IqHZXZvRruDbptBrMLl7L5dnLAh60JMfhmNFbb3x0VfmFDBDrPYPO9Wtj--jtp0271IeaVxWlvNawq24rrmlPAKkyw3hGoetMLaNOFnloGugFFS1QmrM3IGAKg1DSLdBrM0veyzSMIsryXPOUnO_1-dYIUisgSKsdoknOWcZiBlmSvMVaZwLouSpIqRslBScsxYCkWZQUkobEByul4riRAivwj9ATUqckw&Z	Get hash	malicious	Unknown	Browse	217.20.57.23
	https://click.smb-hub-amer.com/CL0/https:%2F%2Faws-experience.com%2Famer%2Fsmb%2Ffaq/1/010f0192953347ae-3c905125-2a17-4574-9bc8-91e7b29508e2-000000/yNxMb5L-NyQC__8b2PYbvEt2zZ-h7CoRCEU0OPMd7LQ=181	Get hash	malicious	Unknown	Browse	217.20.57.37
	https://click.smb-hub-amer.com/CL0/https:%2F%2Faws-experience.com%2Famer%2Fsmb%2Fverify-me-request%3Ftoken=eyJlbWFpbCI6ImJwaW5lZGFAaW1heC5jb20iLCJ2ZXJpZnktdG9rZW4iOiIxZDgyNTBlYjVlMzM4MjNkNDM1ZGIyNDQ2NTRmNGQ1MmM3MTFiNDM4N2QwZDkzNTYwZjlmYzRiYTNmNTJhZjZmNzEyMDkyODdhMzZkYzZiOWQ5ZWNiNTZjYzFjMjRkMjg2ZmYzYzRhYTgxYTQ0MTI4N2I0ODQxZjY5Njg4ZmZmZTcwZDdmZDZkNjZlYzlkMmRjMTAyNTUzZDA2YzNjNjY0ZjM1MjE5NjRhMzFmMzIwYWVhN2FlN2ZlNzU4NDdkN2E2OGQ5YWY1ZTNkYjk2MDI4ZWVlZWVmNjZiNDA4MWI3MzI0MDE0YzIzZDhkNjZmYjQ2YjRkNGQ5OGIzOWM4ZDU1In0%26type=event%26id=6585db7d-9771-4f75-83ae-d72331d5b483%26tier=basic%26path=%252Fe%252F6585d%252Ftech201-generative-ai-activation---prompt-engineering-with-amazon-bedrock/1/010f0192929ffdd9-52e8ab98-0c2d-4477-9745-d305c3580957-000000/bpy3MIKRHDhKHa3naGXB0nUpNkE0SIRP76qCITL47wA=180	Get hash	malicious	Unknown	Browse	217.20.57.18
	http://tracking.nod.ro/tracking/click?d=8REPYbZ94cOn_ul_JxRkLKBjFbxwY-GUgS6EV0s7kapGO_zjZE0f1KtLYT5c7nKgelvuD3vDbSI0lknICwSLWolTib8seslw-_rGaMeEVl6PzTFFf9lSRdtGv9cgKIAiR7f5TSW7wlUFE8pTfmAWGF-pjwVLBAEMrKv3pAyCL9Fm0	Get hash	malicious	Unknown	Browse	217.20.57.34
	Payment for outstanding statements.pdf	Get hash	malicious	HTMLPhisher	Browse	217.20.57.19
	ATT25322.html	Get hash	malicious	Unknown	Browse	217.20.57.18
	https://app.pandadoc.com/document/v2?token=69b8ae0059c2551a9a27ed1b65653c1a0b5ee1ff	Get hash	malicious	Unknown	Browse	217.20.57.34
	Urgent Quotation documents One Pdf.vbs	Get hash	malicious	AgentTesla	Browse	84.201.210.36
s-part-0017.t-0009.t-msedge.net	Inv Confirmation.htm	Get hash	malicious	HTMLPhisher	Browse	13.107.246.45
	https://t.ly/8Lgfk	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse	13.107.246.45
	SecuriteInfo.com.Other.Malware-gen.26961.24680.xlsx	Get hash	malicious	Unknown	Browse	13.107.246.45
	https://u47751895.ct.sendgrid.net/ls/click?upn=u001.LUpianUM71xe7PV7wDA6i1kcuy38W249FfPzE-2Fn4iGArrL0MQBCUZHFEzmfBrwW7hf5h8aNQUml0OSIHqpXf0Hd-2FwQBg2gsGxKHK7PsY2xc-3DPya1_YT5LbHmSQ6soq50ixwpFbSYZshuq6-2FPFgRa8NDnR03IYhL-2F9Rsp4maHC7HKUeszLncLvtZaWCVsMwsguQ5-2FbgriKbvHymTrFFrqjql1V0tvMkZQvyA1xxy-2B6NtGFoUeUGIrvdabsXN8enx2k5c-2BvLXzm-2BRXmD29Cf33DbXC513Cwkuo46G2I7a1uwsANH8eVhz8r5XyLPneRi4ngixWtQkBEaLBBKkl5CzEPySNlMnqJuuWiTBlFswgUf9EX-2BEhUpqAvMFuAlKTpYcteS-2FjAegbPmUSDcSeBkfnhL6yUhTFHUFrxra-2BdIgnamsXKUUqu-2BC45G51EOfBd9qOCqWy3OeOC7KYj3-2FcaIfcOAM1Jkvyddtn3gwRC5w97RLza-2BBM2JcZLNzMYva4SJzBZv7RClCaMcjevyjP6ZFvlR0NECf5zAmWbPLmCUnefze8ZyTvnDqXVb3nrflSdnTlNxWfm617xjOrSoSu-2BVHZVqbE92ZodSyvWqgaCWZg0TMDZeq64M67nuH9ryo7I5u80SS081vnMThCYiPoN3JUoUliQPKbNY46GxAPyVhMs4qqZVi-2FFUtIGEycXziXytxfy6JCzAZ2sa7DZusc1RftLAVM4uJit-2FAhxM-2FK1sEHsKHKvs9o7uDMExZ5YqEBjrD2XHch-2BY6xwRGGg56MeC1Bpa72xAoR6DmInmiEX4j92yaROEh1-2FMsHdtSstN7zc8gxU7ETVWVMBRLf6m4dTRruSfSNaLUi9QLq9d7Qfe8VMdKN1j9FMGIYia88728BDNNxRTaT4nSNITRr9JPa4Z1K1vdUocdyCKNcYSZsN8yguI0-2FqNXUfWFuoxnz5MDqwufLzxub8Fw-3D-3D	Get hash	malicious	HTMLPhisher	Browse	13.107.246.45
	https://na4.docusign.net/Signing/EmailStart.aspx?a=c1ee55e8-d253-4731-bf85-5377494446fc&etti=24&acct=c49653d8-ee55-4f22-afc9-287006261d0b&er=251e9446-3fcb-4714-8d01-feee559625a8	Get hash	malicious	HTMLPhisher	Browse	13.107.246.45
	https://8jkfw9cqp7ep.z13.web.core.windows.net/?zpbid=78432_55610c1d-9229-11ef-824f-03718b6de7bb#	Get hash	malicious	HTMLPhisher, TechSupportScam	Browse	13.107.246.45
	SecuriteInfo.com.Trojan.Siggen29.57841.15930.23271.exe	Get hash	malicious	RedLine	Browse	13.107.246.45
	https://1drv.ms/o/c/76471f3776916fd0/EomjtsItbi9Ag0bnzrJDx08BhxVWepFoAXrJFoYeR9IZ0A?e=5%3aEFCh5b&sharingv2=true&fromShare=true&at=9	Get hash	malicious	Unknown	Browse	13.107.246.45
	https://www.canva.com/design/DAGUUU-VdiI/DdL4Z-_loK4X7NMMbGGnJg/view?utm_content=DAGUUU-VdiI&utm_campaign=designshare&utm_medium=link&utm_source=editor	Get hash	malicious	Unknown	Browse	13.107.246.45
	https://egift.activationshub.com/gift-card/view/8lPFUrjq1LGzg7JHwS8hJJRdL/	Get hash	malicious	HTMLPhisher	Browse	13.107.246.45
dual-spo-0005.spo-msedge.net	EXTERNALRoger Moczygemba shared DIRECT MED CLINIC - CONFIDENTIAL with you.msg	Get hash	malicious	Unknown	Browse	13.107.136.10
	https://merzcon-my.sharepoint.com/:f:/g/personal/cnico_merzcon_onmicrosoft_com/EmjHG5K9dP9BtgBBeTTFhjABJRRLGM6IhVrJlwBTMWY8rg?e=pfkS1f	Get hash	malicious	Unknown	Browse	13.107.136.10
	https://1drv.ms/o/c/fca0349b9dac3054/Egg4xW-gVZtFnFIBDYLqn3IBzvGvLdCTacUKBwENWO33dQ?e=nEqWJi	Get hash	malicious	Unknown	Browse	13.107.136.10
	https://netorg11230081-my.sharepoint.com/:f:/g/personal/info_onafastpacecontracting_com/Eoa77Lo8BXlOut3qDNQUDAQBBgmgCvIALxhAXrlqjk9Asw?e=2UKAY6	Get hash	malicious	Unknown	Browse	13.107.136.10
	https://churchillmcgee-my.sharepoint.com/:u:/p/tholtzclaw/EZYLQhunQLxJgDl2GitW_PEBRKvAR7X0yXjbidcIUQwyng?e=tBP41r	Get hash	malicious	Unknown	Browse	13.107.136.10
	https://churchillmcgee-my.sharepoint.com/:u:/p/tholtzclaw/EZYLQhunQLxJgDl2GitW_PEBRKvAR7X0yXjbidcIUQwyng?e=tBP41r	Get hash	malicious	Unknown	Browse	13.107.136.10
	https://1drv.ms/o/c/14c2aef4e2cd9199/EmKMpCkEfbpDs04MuZdva6IBilCqbzQYZtfiLbdaioNL0w?e=E2gYSO	Get hash	malicious	Unknown	Browse	13.107.136.10
	https://tcmedcenter-my.sharepoint.com/:f:/g/personal/jessica_larson_tcmedcenter_org/Ek1X93Tsfp5KoiWqKbJ_ocQBqlE2wGVJqWkJh4H7mn0vuw?e=Yni2o7	Get hash	malicious	Unknown	Browse	13.107.136.10
	https://weiderergmbh-my.sharepoint.de/:o:/g/personal/s_kreuzer_luxapark_de/En8ihQEtXF1HtuEzkWTEmvQBXZUe8GC_guY4c0qSMi2Czg?e=5%3aJCIXIb&at=9	Get hash	malicious	Unknown	Browse	13.107.136.10
	ComSource Inc.pdf	Get hash	malicious	Unknown	Browse	13.107.136.10
HHN-efz.ms-acdc.office.com	https://merzcon-my.sharepoint.com/:f:/g/personal/cnico_merzcon_onmicrosoft_com/EmjHG5K9dP9BtgBBeTTFhjABJRRLGM6IhVrJlwBTMWY8rg?e=pfkS1f	Get hash	malicious	Unknown	Browse	40.99.214.34
	https://tcmedcenter-my.sharepoint.com/:f:/g/personal/jessica_larson_tcmedcenter_org/Ek1X93Tsfp5KoiWqKbJ_ocQBqlE2wGVJqWkJh4H7mn0vuw?e=Yni2o7	Get hash	malicious	Unknown	Browse	52.98.179.34
	https://www.guidedtrack.com/programs/i6rkt1s/run	Get hash	malicious	HTMLPhisher	Browse	52.98.152.194
	phish_alert_sp2_2.0.0.0.eml	Get hash	malicious	Unknown	Browse	40.99.150.82
	https://tzr7wtjq.r.us-east-1.awstrack.me/L0/https:%2F%2Fclickproxy.retailrocket.net%2F%3Furl=https%253A%252F%252Fneamunit.ro%2F%2Fwinners%2F%2Fnatalie.gilbert%2FbmF0YWxpZS5naWxiZXJ0QGJlbm5ldHRzLmNvLnVr/1/010001927b41f2f4-541067bc-8926-4dcb-8f02-24fcf186dd1a-000000/pqvbHhvZKuWAqkc2J1BWoU1pciA=395	Get hash	malicious	HTMLPhisher	Browse	52.98.243.50
	cfev.-Information refb08b4d10f3ce74a317adeabab8ac66ad.htm	Get hash	malicious	Unknown	Browse	40.99.150.98
	https://architekturgaleriegreven418-my.sharepoint.com/:f:/g/personal/s_mueller_ag-greven_de/EqHjHq0duZlPnK1b0Ad0gnQBDkq1USn2N3DBCaPZle5J1Q?e=5aU8Ja	Get hash	malicious	Unknown	Browse	52.98.241.162
	https://url.us.m.mimecastprotect.com/s/8I0_CKrkVEt48y6BzfMfWF5hBIN?domain=woems-my.sharepoint.com	Get hash	malicious	Unknown	Browse	52.98.179.34
	https://terryatchison-my.sharepoint.com/:f:/g/personal/terry_terryatchison_com_au/ElPLLTBYg_xBi3psE6F6HW0BDiAPLHOUdwoTRpPTGgsocg?e=hlVHMO	Get hash	malicious	Unknown	Browse	52.98.179.82
	https://url.uk.m.mimecastprotect.com/s/879wCp9pjInpwnDHPf7CG_Zsy?domain=aerographicsut-my.sharepoint.com	Get hash	malicious	HTMLPhisher	Browse	52.98.228.50

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
MICROSOFT-CORP-MSN-AS-BLOCKUS	la.bot.sparc.elf	Get hash	malicious	Unknown	Browse	191.233.184.223
	Inv Confirmation.htm	Get hash	malicious	HTMLPhisher	Browse	13.107.246.44
	la.bot.arm5.elf	Get hash	malicious	Unknown	Browse	52.181.233.52
	la.bot.sparc.elf	Get hash	malicious	Unknown	Browse	21.215.245.118
	la.bot.sh4.elf	Get hash	malicious	Unknown	Browse	21.157.124.152
	https://t.ly/8Lgfk	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse	13.107.253.45
	la.bot.mipsel.elf	Get hash	malicious	Unknown	Browse	22.254.231.213
	la.bot.mipsel.elf	Get hash	malicious	Unknown	Browse	21.43.25.174
	SecuriteInfo.com.Other.Malware-gen.26961.24680.xlsx	Get hash	malicious	Unknown	Browse	13.107.246.67
	phish_alert_sp2_2.0.0.0 (1).eml	Get hash	malicious	Unknown	Browse	52.113.194.132
CLOUDFLARENETUS	https://nimb.ws/uRSOy9q	Get hash	malicious	HTMLPhisher	Browse	1.1.1.1
	https://phisher-parts-production-us-east-1.s3.amazonaws.com/68a29cbc-d8f9-4c01-aa8b-704c527e3dea/2024-10-24/hdp1f4m0mtn58r7e5djj3r2baep1oktpuitii5o1/d493f6c6bdfdcf5959ae27c95155d91b5b3c1ce0bab14ef02ea76d7c451b0ee9?response-content-disposition=attachment%3B%20filename%3D%22FaxDocument-873422-Wcepinc-Transmission.html%22%3B%20filename%2A%3DUTF-8%27%27FaxDocument-873422-Wcepinc-Transmission.html&X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=ASIA37KREM2QLQCGJML5%2F20241024%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20241024T201816Z&X-Amz-Expires=15711&X-Amz-Security-Token=IQoJb3JpZ2luX2VjEHMaCXVzLWVhc3QtMSJIMEYCIQD5%2BhZvZGN6J3Fxb1eh7JhGJFYatdM4YSe%2FB1Lhu54clwIhAMGxuFEnQyuPv%2FCfNJf%2FM%2Bjk%2FqrMeNeOhUAY3BKeKKVEKogECNz%2F%2F%2F%2F%2F%2F%2F%2F%2F%2FwEQABoMODIzMTkzMjY1ODI0IgxkadsnklCVctvwMWIq3APvQpQpI58knFBaUI%2FesQH1FJlTX%2BlsdPXwHmIEoA7JJLDUXnDzzteCVoUwvp1olI1h3PTJSpl3WxfIUi7BTzihzEqp3qn85AWXiDO1fWB1MbpD%2FSDfsrqMEgho9OQjpzPsQHM6e%2BmLmZ1yTIHD97Pf%2FN08letrYEZz2NFJVIQrLYTvWQwr2QPEZJyIm0WnuSbbq8Q1iYmha%2FIyVB9ZKxOPpvdgR1ptXZ6oLjzsy%2Bt%2BjafEISWZYsRDWwvLzIujqWG%2B63t%2BpCq3bxmYAsSHjxnzarIm7Hms4AOj9sIvR9pkL0wwD3qkWG7oBYHnb8k0%2B1AzzdJ2e%2FfLVD9TiwcG1KsTEzsabHJpEEBXTzducKIDP%2FcB%2FYcv03kyJnwWzUMaIbwdRV3lLj4itVuLpZpUbOm8RJChRMb83TR2qZdNKkjYktSR42en1uqps%2BU0qDC%2Fg93%2FFw2lIXwuMoTybf1fWYEY2OQz6E5eRoigwQhmg4wJe1ZZgjwP8fEQSG0yo9XZnXr%2FyAu%2BEt2RNzWy2wHuoZk3HVwPs4lWnhTyTcrSndmgKXkfVSpHeqCqkF3xveAbEhd%2F9qQutDIIcWnBBAlsILK5EUpHzYLvkIMYBMTieCtf00%2FFHqO4eOCLX5sGvDCHqeq4BjqkAeyFM5a%2FebzwF4uw87xMbquzIriBZ00BbMxSr1F6iNQrK5eiAmnkSYUYh%2Fp3YJofaU0ox8%2FOVLIHBKp3WtDzd5b5%2F5WwioyMhT1u0BDnhNT%2F%2B11YTTeSy4rC4fIYdhkm7tZrFS9Sa1WIiQXgQiBqqjkRydZT%2FLrmsyVTvK8wBscWkRvZxnU%2Bsi4OUJJHkmJ27ywwC3Ob5nE4D4%2FwrYfIb%2F4HWJO4&X-Amz-SignedHeaders=host&X-Amz-Signature=4bd824e8586cb631d993afbaa40b83fff9764a3fdcecf7e4b686cf1557dfa0d0	Get hash	malicious	Phisher	Browse	104.17.25.14
	SecuriteInfo.com.Variant.Lazy.618554.7337.5785.exe	Get hash	malicious	Unknown	Browse	172.67.68.136
	https://cswlawgroup.artoffice.cloud/	Get hash	malicious	Unknown	Browse	172.64.146.38
	msvcp110.dll	Get hash	malicious	LummaC	Browse	188.114.97.3
	Setup.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	Loader.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	https://onlinepdf-qrsharedfile.com/index.html#XYW5uaWUua3lwcmlhbm91QGxjYXR0ZXJ0b24uY29t	Get hash	malicious	HTMLPhisher	Browse	104.16.123.96
	https://t.ly/8Lgfk	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse	104.17.25.14
	phish_alert_sp2_2.0.0.0 (1).eml	Get hash	malicious	Unknown	Browse	188.114.96.3
MICROSOFT-CORP-MSN-AS-BLOCKUS	la.bot.sparc.elf	Get hash	malicious	Unknown	Browse	191.233.184.223
	Inv Confirmation.htm	Get hash	malicious	HTMLPhisher	Browse	13.107.246.44
	la.bot.arm5.elf	Get hash	malicious	Unknown	Browse	52.181.233.52
	la.bot.sparc.elf	Get hash	malicious	Unknown	Browse	21.215.245.118
	la.bot.sh4.elf	Get hash	malicious	Unknown	Browse	21.157.124.152
	https://t.ly/8Lgfk	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse	13.107.253.45
	la.bot.mipsel.elf	Get hash	malicious	Unknown	Browse	22.254.231.213
	la.bot.mipsel.elf	Get hash	malicious	Unknown	Browse	21.43.25.174
	SecuriteInfo.com.Other.Malware-gen.26961.24680.xlsx	Get hash	malicious	Unknown	Browse	13.107.246.67
	phish_alert_sp2_2.0.0.0 (1).eml	Get hash	malicious	Unknown	Browse	52.113.194.132
MICROSOFT-CORP-MSN-AS-BLOCKUS	la.bot.sparc.elf	Get hash	malicious	Unknown	Browse	191.233.184.223
	Inv Confirmation.htm	Get hash	malicious	HTMLPhisher	Browse	13.107.246.44
	la.bot.arm5.elf	Get hash	malicious	Unknown	Browse	52.181.233.52
	la.bot.sparc.elf	Get hash	malicious	Unknown	Browse	21.215.245.118
	la.bot.sh4.elf	Get hash	malicious	Unknown	Browse	21.157.124.152
	https://t.ly/8Lgfk	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse	13.107.253.45
	la.bot.mipsel.elf	Get hash	malicious	Unknown	Browse	22.254.231.213
	la.bot.mipsel.elf	Get hash	malicious	Unknown	Browse	21.43.25.174
	SecuriteInfo.com.Other.Malware-gen.26961.24680.xlsx	Get hash	malicious	Unknown	Browse	13.107.246.67
	phish_alert_sp2_2.0.0.0 (1).eml	Get hash	malicious	Unknown	Browse	52.113.194.132

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	https://phisher-parts-production-us-east-1.s3.amazonaws.com/68a29cbc-d8f9-4c01-aa8b-704c527e3dea/2024-10-24/hdp1f4m0mtn58r7e5djj3r2baep1oktpuitii5o1/d493f6c6bdfdcf5959ae27c95155d91b5b3c1ce0bab14ef02ea76d7c451b0ee9?response-content-disposition=attachment%3B%20filename%3D%22FaxDocument-873422-Wcepinc-Transmission.html%22%3B%20filename%2A%3DUTF-8%27%27FaxDocument-873422-Wcepinc-Transmission.html&X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=ASIA37KREM2QLQCGJML5%2F20241024%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20241024T201816Z&X-Amz-Expires=15711&X-Amz-Security-Token=IQoJb3JpZ2luX2VjEHMaCXVzLWVhc3QtMSJIMEYCIQD5%2BhZvZGN6J3Fxb1eh7JhGJFYatdM4YSe%2FB1Lhu54clwIhAMGxuFEnQyuPv%2FCfNJf%2FM%2Bjk%2FqrMeNeOhUAY3BKeKKVEKogECNz%2F%2F%2F%2F%2F%2F%2F%2F%2F%2FwEQABoMODIzMTkzMjY1ODI0IgxkadsnklCVctvwMWIq3APvQpQpI58knFBaUI%2FesQH1FJlTX%2BlsdPXwHmIEoA7JJLDUXnDzzteCVoUwvp1olI1h3PTJSpl3WxfIUi7BTzihzEqp3qn85AWXiDO1fWB1MbpD%2FSDfsrqMEgho9OQjpzPsQHM6e%2BmLmZ1yTIHD97Pf%2FN08letrYEZz2NFJVIQrLYTvWQwr2QPEZJyIm0WnuSbbq8Q1iYmha%2FIyVB9ZKxOPpvdgR1ptXZ6oLjzsy%2Bt%2BjafEISWZYsRDWwvLzIujqWG%2B63t%2BpCq3bxmYAsSHjxnzarIm7Hms4AOj9sIvR9pkL0wwD3qkWG7oBYHnb8k0%2B1AzzdJ2e%2FfLVD9TiwcG1KsTEzsabHJpEEBXTzducKIDP%2FcB%2FYcv03kyJnwWzUMaIbwdRV3lLj4itVuLpZpUbOm8RJChRMb83TR2qZdNKkjYktSR42en1uqps%2BU0qDC%2Fg93%2FFw2lIXwuMoTybf1fWYEY2OQz6E5eRoigwQhmg4wJe1ZZgjwP8fEQSG0yo9XZnXr%2FyAu%2BEt2RNzWy2wHuoZk3HVwPs4lWnhTyTcrSndmgKXkfVSpHeqCqkF3xveAbEhd%2F9qQutDIIcWnBBAlsILK5EUpHzYLvkIMYBMTieCtf00%2FFHqO4eOCLX5sGvDCHqeq4BjqkAeyFM5a%2FebzwF4uw87xMbquzIriBZ00BbMxSr1F6iNQrK5eiAmnkSYUYh%2Fp3YJofaU0ox8%2FOVLIHBKp3WtDzd5b5%2F5WwioyMhT1u0BDnhNT%2F%2B11YTTeSy4rC4fIYdhkm7tZrFS9Sa1WIiQXgQiBqqjkRydZT%2FLrmsyVTvK8wBscWkRvZxnU%2Bsi4OUJJHkmJ27ywwC3Ob5nE4D4%2FwrYfIb%2F4HWJO4&X-Amz-SignedHeaders=host&X-Amz-Signature=4bd824e8586cb631d993afbaa40b83fff9764a3fdcecf7e4b686cf1557dfa0d0	Get hash	malicious	Phisher	Browse	172.202.163.200 184.28.90.27
	Inv Confirmation.htm	Get hash	malicious	HTMLPhisher	Browse	172.202.163.200 184.28.90.27
	https://cswlawgroup.artoffice.cloud/	Get hash	malicious	Unknown	Browse	172.202.163.200 184.28.90.27
	https://onlinepdf-qrsharedfile.com/index.html#XYW5uaWUua3lwcmlhbm91QGxjYXR0ZXJ0b24uY29t	Get hash	malicious	HTMLPhisher	Browse	172.202.163.200 184.28.90.27
	https://t.ly/8Lgfk	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse	172.202.163.200 184.28.90.27
	Doc-Secure6033.pdf	Get hash	malicious	Unknown	Browse	172.202.163.200 184.28.90.27
	https://novisurvey.net/ns/n/z133i.aspx	Get hash	malicious	Unknown	Browse	172.202.163.200 184.28.90.27
	https://u47751895.ct.sendgrid.net/ls/click?upn=u001.LUpianUM71xe7PV7wDA6i1kcuy38W249FfPzE-2Fn4iGArrL0MQBCUZHFEzmfBrwW7hf5h8aNQUml0OSIHqpXf0Hd-2FwQBg2gsGxKHK7PsY2xc-3DPya1_YT5LbHmSQ6soq50ixwpFbSYZshuq6-2FPFgRa8NDnR03IYhL-2F9Rsp4maHC7HKUeszLncLvtZaWCVsMwsguQ5-2FbgriKbvHymTrFFrqjql1V0tvMkZQvyA1xxy-2B6NtGFoUeUGIrvdabsXN8enx2k5c-2BvLXzm-2BRXmD29Cf33DbXC513Cwkuo46G2I7a1uwsANH8eVhz8r5XyLPneRi4ngixWtQkBEaLBBKkl5CzEPySNlMnqJuuWiTBlFswgUf9EX-2BEhUpqAvMFuAlKTpYcteS-2FjAegbPmUSDcSeBkfnhL6yUhTFHUFrxra-2BdIgnamsXKUUqu-2BC45G51EOfBd9qOCqWy3OeOC7KYj3-2FcaIfcOAM1Jkvyddtn3gwRC5w97RLza-2BBM2JcZLNzMYva4SJzBZv7RClCaMcjevyjP6ZFvlR0NECf5zAmWbPLmCUnefze8ZyTvnDqXVb3nrflSdnTlNxWfm617xjOrSoSu-2BVHZVqbE92ZodSyvWqgaCWZg0TMDZeq64M67nuH9ryo7I5u80SS081vnMThCYiPoN3JUoUliQPKbNY46GxAPyVhMs4qqZVi-2FFUtIGEycXziXytxfy6JCzAZ2sa7DZusc1RftLAVM4uJit-2FAhxM-2FK1sEHsKHKvs9o7uDMExZ5YqEBjrD2XHch-2BY6xwRGGg56MeC1Bpa72xAoR6DmInmiEX4j92yaROEh1-2FMsHdtSstN7zc8gxU7ETVWVMBRLf6m4dTRruSfSNaLUi9QLq9d7Qfe8VMdKN1j9FMGIYia88728BDNNxRTaT4nSNITRr9JPa4Z1K1vdUocdyCKNcYSZsN8yguI0-2FqNXUfWFuoxnz5MDqwufLzxub8Fw-3D-3D	Get hash	malicious	HTMLPhisher	Browse	172.202.163.200 184.28.90.27
	http://lowes.mooo.com/index.php?search=4&d16852&morde=354-1256&lm=400100KWWT29761&sd=15&page=9u6rpKHD2TMFWFa#izRRKlsmoFgLg4jmhaU9	Get hash	malicious	Phisher	Browse	172.202.163.200 184.28.90.27
	https://chapelet-mariae.com.pl/qgxPm/	Get hash	malicious	HTMLPhisher	Browse	172.202.163.200 184.28.90.27

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.146018707800029
Encrypted:	false
SSDEEP:	6:+bCR+q2PsHO2nKuAl9OmbnIFUt8tbCLZmw+tbCbVkwOsHO2nKuAl9OmbjLJ:+vvkHVHAahFUt8dA/+do51HVHAaSJ
MD5:	4E5782221B13C42CB49E0EB62E869BDF
SHA1:	BD244C0D10A3B28137C38E9E4CFC483F932119A2
SHA-256:	C8D562F70CA9DCC98BB2824C9AFA7D3C4D176A3A11C28590BE2CEC30F9FA408E
SHA-512:	1C654CF28FD73F81386BE07BA8894C31A5821038CB4FA9908E019E542541C23F745A6CA4DB6D58D9C2478761A45436ED9702D84EA74492378547FE34B398B23D
Malicious:	false
Reputation:	low
Preview:	2024/10/24-16:24:28.121 1b48 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2024/10/24-16:24:28.123 1b48 Recovering log #3.2024/10/24-16:24:28.123 1b48 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 24 19:24:43 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.994748651915993
Encrypted:	false
SSDEEP:	48:8f0d1Te7rTH6idAKZdA1JehwiZUklqehay+3:8fCQYZy
MD5:	6F81E5D8814F63690A9BECA88CA14D0F
SHA1:	2B3115E0DEE3D4129CA59DF29883DFD088214918
SHA-256:	95E003F731F85C1CC976CA50527E36CEAF815A06FABC8946F8F68E30CA0BD94E
SHA-512:	FD44A587C5FD1FAD400C9ED955A6416CD26519CD5F7B1B11C42064ED1196787E3EE11E5DC3A0A2F1C2FE1711A1D24CB3C69ACA6F407C9B2BD4FAAA02F95E71B1
Malicious:	false
Preview:	L..................F.@.. ...$+.,....z..R&......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.IXY......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VXY......L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.VXY......M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.VXY.............................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.VXY.............................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............/.y.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

File type:	PDF document, version 1.7, 1 pages
Entropy (8bit):	7.979891406734971
TrID:	Adobe Portable Document Format (5005/1) 100.00%
File name:	bc3c228ad2c13f96cb14375c3860e802.pdf
File size:	133'758 bytes
MD5:	5448dddeb4ccaa5cf39694f5c28a4b76
SHA1:	a64f68d8253c21beb398272f795aaa62db4de3f4
SHA256:	3d54f8929f551c67e0bec56d1a7c13be514b799da109ab85f3edb06681a32e2a
SHA512:	e5e4b1b0c07c8a3c2e0a6755a2fe0e8dc17a774bf0bc4d49d10dfa8802df115975527002d40fcb6e3c34b050e347161f150a49d79524f85c065e55f98397abab
SSDEEP:	3072:w1kesM92EapSJeCGvZ3Ed/k69/Lc2bNKW9L7zb/ctV:w1YAap9v0LcZW9LfLSV
TLSH:	43D301BA961163DCE40903D19E8B3C921F5DB33D71D8A0AF145F89472988B32D9EF58D
File Content Preview:	%PDF-1.7.%.....1 0 obj.<<./Type /Catalog./Pages 3 0 R./Lang (en-US).>>.endobj.2 0 obj.<<./Title <FEFF0055006E007400690074006C00650064>./Creator <FEFF004D006900630072006F0073006F006600740020004F0066006600690063006500200057006F00720064>./Producer (3.0.20 \(

General
Header:	%PDF-1.7
Total Entropy:	7.979891
Total Bytes:	133758
Stream Entropy:	7.985691
Stream Bytes:	128989
Entropy outside Streams:	5.085563
Bytes outside Streams:	4769
Number of EOF found:	1
Bytes after EOF:

Name	Count
obj	29
endobj	29
stream	9
endstream	9
xref	1
trailer	1
startxref	1
/Page	1
/Encrypt	0
/ObjStm	0
/URI	2
/JS	0
/JavaScript	0
/AA	0
/OpenAction	0
/AcroForm	0
/JBIG2Decode	0
/RichMedia	0
/Launch	0
/EmbeddedFile	0