Windows Analysis Report
https://0nline1.fors3650com.site/?NTMtNGYyOS1hNDc1LTA

Overview

General Information

Sample URL:	https://0nline1.fors3650com.site/?NTMtNGYyOS1hNDc1LTA
Analysis ID:	1541911
Infos:

Detection

HTMLPhisher

Score:	64
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

AI detected phishing page

Suricata IDS alerts for network traffic

Yara detected HtmlPhish54

HTML body contains low number of good links

HTML page contains hidden javascript code

HTML title does not match URL

Stores files to the Windows start menu directory

Classification

Signatures

Phishing

AI detected phishing page

Source: https://0nline1.fors3650com.site/?NTMtNGYyOS1hNDc1LTA

LLM: Score: 9 Reasons: The brand 'reCAPTCHA' is well-known and typically associated with the domain 'recaptcha.net'., The URL '0nline1.fors3650com.site' does not match the legitimate domain for reCAPTCHA., The URL contains suspicious elements such as numbers and unusual domain extension '.site'., The URL structure suggests a potential phishing attempt with the use of '0nline1' and 'fors3650com'., The input fields labeled as 'unknown' do not provide any context or association with reCAPTCHA. DOM: 1.2.pages.csv

Yara detected HtmlPhish54

Source: Yara match	File source: 0.12.id.script.csv, type: HTML
Source: Yara match	File source: 0.19.id.script.csv, type: HTML
Source: Yara match	File source: 2.5.pages.csv, type: HTML
Source: Yara match	File source: 3.6.pages.csv, type: HTML

HTML body contains low number of good links

Source: https://0nline1.fors3650com.site/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2F0ffice.fors3650com.site%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2F0ffice.fors3650com.site%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638654404594371122.YzRiMjU0N2MtNDI5NC00MDUwLTlhOWMtNDY4MjM0NGU5ZjM4OGNkOTM5YzktYzI3ZC00ZTM5LWI3NzEtOThjMTdhOGYwOWRm&ui_locales=en-US&mkt=en-US&client-request-id=a959a2c6-be90-4bbe-9620-b8571db25775&state=5RCrPRsiAriQ55RNojgGMOYvWQ7VLeP3N5DhSSnjZ0odIBnW0Gb3SI4r_o3LDWc3hQTdru7XJZVVsRMaZ1exiI6Gvk6CKH-Z6tu6tkw6BL6ipkMr9r4uIPkXCI_pqJLPd-NLoBMX2Lxwpz9grIXODO5WqDAOn5J0nJiVIdYRgUc5wjGcg_PesvZndm_f0ObCcYJcUcnNaAdu2vEBRantuuwsNyFc2i-xPOXdNw687rrL3oRtzUoqm3s8IETqN6a-dKlaS4L3sbhbEEQCwaQ6oA&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0&sso_reload=true

HTTP Parser: Number of links: 0

HTML page contains hidden javascript code

Source: https://0nline1.fors3650com.site/?NTMtNGYyOS1hNDc1LTA

HTTP Parser: Base64 decoded: a[href="http://www.salidzini.lv/"][style="display: block; width: 120px; height: 40px; overflow: hidden; position: relative;"]

HTML title does not match URL

HTTP Parser: Title: Sign in to your account does not match URL

Source: https://0nline1.fors3650com.site/?NTMtNGYyOS1hNDc1LTA	HTTP Parser: No favicon
Source: https://0nline1.fors3650com.site/?NTMtNGYyOS1hNDc1LTA	HTTP Parser: No favicon
Source: https://0nline1.fors3650com.site/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2F0ffice.fors3650com.site%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2F0ffice.fors3650com.site%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638654404594371122.YzRiMjU0N2MtNDI5NC00MDUwLTlhOWMtNDY4MjM0NGU5ZjM4OGNkOTM5YzktYzI3ZC00ZTM5LWI3NzEtOThjMTdhOGYwOWRm&ui_locales=en-US&mkt=en-US&client-request-id=a959a2c6-be90-4bbe-9620-b8571db25775&state=5RCrPRsiAriQ55RNojgGMOYvWQ7VLeP3N5DhSSnjZ0odIBnW0Gb3SI4r_o3LDWc3hQTdru7XJZVVsRMaZ1exiI6Gvk6CKH-Z6tu6tkw6BL6ipkMr9r4uIPkXCI_pqJLPd-NLoBMX2Lxwpz9grIXODO5WqDAOn5J0nJiVIdYRgUc5wjGcg_PesvZndm_f0ObCcYJcUcnNaAdu2vEBRantuuwsNyFc2i-xPOXdNw687rrL3oRtzUoqm3s8IETqN6a-dKlaS4L3sbhbEEQCwaQ6oA&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0	HTTP Parser: No favicon
Source: https://0nline1.fors3650com.site/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2F0ffice.fors3650com.site%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2F0ffice.fors3650com.site%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638654404594371122.YzRiMjU0N2MtNDI5NC00MDUwLTlhOWMtNDY4MjM0NGU5ZjM4OGNkOTM5YzktYzI3ZC00ZTM5LWI3NzEtOThjMTdhOGYwOWRm&ui_locales=en-US&mkt=en-US&client-request-id=a959a2c6-be90-4bbe-9620-b8571db25775&state=5RCrPRsiAriQ55RNojgGMOYvWQ7VLeP3N5DhSSnjZ0odIBnW0Gb3SI4r_o3LDWc3hQTdru7XJZVVsRMaZ1exiI6Gvk6CKH-Z6tu6tkw6BL6ipkMr9r4uIPkXCI_pqJLPd-NLoBMX2Lxwpz9grIXODO5WqDAOn5J0nJiVIdYRgUc5wjGcg_PesvZndm_f0ObCcYJcUcnNaAdu2vEBRantuuwsNyFc2i-xPOXdNw687rrL3oRtzUoqm3s8IETqN6a-dKlaS4L3sbhbEEQCwaQ6oA&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0&sso_reload=true	HTTP Parser: No favicon

HTTP Parser: No <meta name="author".. found

HTTP Parser: No <meta name="copyright".. found

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49720 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49725 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.16:49727 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.16:49728 version: TLS 1.2

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 2857090 - Severity 1 - ETPRO PHISHING JS/PsyduckPockeball Payload Inbound : 64.226.112.17:443 -> 192.168.2.16:49698

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108

Source: global traffic	HTTP traffic detected: GET /?NTMtNGYyOS1hNDc1LTA HTTP/1.1Host: 0nline1.fors3650com.siteConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /recaptcha/api.js HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEIucrNAQiJ080BGMvYzQEY642lFw==Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://0nline1.fors3650com.site/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /recaptcha/api.js HTTP/1.1Host: www.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEIucrNAQiJ080BGMvYzQEY642lFw==Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /recaptcha/api2/anchor?ar=1&k=6Lce2GoqAAAAAFDFWAK7qn1wjAVmJ0geU_txTM_0&co=aHR0cHM6Ly8wbmxpbmUxLmZvcnMzNjUwY29tLnNpdGU6NDQz&hl=en&v=-ZG7BC9TxCVEbzIO2m429usb&size=normal&cb=zd5j4t2s2k7b HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEIucrNAQiJ080BGMvYzQEY642lFw==Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://0nline1.fors3650com.site/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /recaptcha/api2/webworker.js?hl=en&v=-ZG7BC9TxCVEbzIO2m429usb HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEIucrNAQiJ080BGMvYzQEY642lFw==Sec-Fetch-Site: same-originSec-Fetch-Mode: same-originSec-Fetch-Dest: workerReferer: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6Lce2GoqAAAAAFDFWAK7qn1wjAVmJ0geU_txTM_0&co=aHR0cHM6Ly8wbmxpbmUxLmZvcnMzNjUwY29tLnNpdGU6NDQz&hl=en&v=-ZG7BC9TxCVEbzIO2m429usb&size=normal&cb=zd5j4t2s2k7bAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /js/bg/p-7RyvuJU9m0QQmVDJx8SL9t4pWXVpOJSp0296ydJmo.js HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEIucrNAQiJ080BGMvYzQEY642lFw==Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6Lce2GoqAAAAAFDFWAK7qn1wjAVmJ0geU_txTM_0&co=aHR0cHM6Ly8wbmxpbmUxLmZvcnMzNjUwY29tLnNpdGU6NDQz&hl=en&v=-ZG7BC9TxCVEbzIO2m429usb&size=normal&cb=zd5j4t2s2k7bAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /recaptcha/api2/webworker.js?hl=en&v=-ZG7BC9TxCVEbzIO2m429usb HTTP/1.1Host: www.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEIucrNAQiJ080BGMvYzQEY642lFw==Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /js/bg/p-7RyvuJU9m0QQmVDJx8SL9t4pWXVpOJSp0296ydJmo.js HTTP/1.1Host: www.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEIucrNAQiJ080BGMvYzQEY642lFw==Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /recaptcha/api2/bframe?hl=en&v=-ZG7BC9TxCVEbzIO2m429usb&k=6Lce2GoqAAAAAFDFWAK7qn1wjAVmJ0geU_txTM_0 HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEIucrNAQiJ080BGMvYzQEY642lFw==Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://0nline1.fors3650com.site/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=N4T8Ct+9CmBKc9n&MD=zuN19TOb HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=N4T8Ct+9CmBKc9n&MD=zuN19TOb HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /recaptcha/api2/reload?k=6Lce2GoqAAAAAFDFWAK7qn1wjAVmJ0geU_txTM_0 HTTP/1.1Host: www.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEIucrNAQiJ080BGMvYzQEY642lFw==Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _GRECAPTCHA=09ANOXeZyq8oXgJ5XPqcasHk8eNZR3EfH5dYdesIx9DHjNQ7ufSjoc7J3MYGKzTiqfoXDZxz8sFh2A7vZFYbroyJ8
Source: global traffic	HTTP traffic detected: GET /recaptcha/api2/payload?p=06AFcWeA4hlJ_3CmIdQ6sjwCinlmpTeTtRSAtPhrq8gQottSxdIiGKfQAymtjm6POWeX8pC7-w3Xg6pNQ9N0--FLEa_6c_EVFzwBuAkMc5wyLo2fiSUSoNY2n0H85L_2o-SyWV9BoU1U1rFnRAdKRaCy-AHgcKfMrShKWG92RG6JBGVoJWmbO2CIR8KlYNSHMPlxKeLmj1TuZdq51-qfAN8s75GderRuauPw&k=6Lce2GoqAAAAAFDFWAK7qn1wjAVmJ0geU_txTM_0 HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEIucrNAQiJ080BGMvYzQEY642lFw==Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.google.com/recaptcha/api2/bframe?hl=en&v=-ZG7BC9TxCVEbzIO2m429usb&k=6Lce2GoqAAAAAFDFWAK7qn1wjAVmJ0geU_txTM_0Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _GRECAPTCHA=09ANOXeZyq8oXgJ5XPqcasHk8eNZR3EfH5dYdesIx9DHjNQ7ufSjoc7J3MYGKzTiqfoXDZxz8sFh2A7vZFYbroyJ8
Source: global traffic	HTTP traffic detected: GET /js/bg/Cyqba_K0pUDdT5_AhrcTxS5-b1C3jUsFpG6edXmCObU.js HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEIucrNAQiJ080BGMvYzQEY642lFw==Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.google.com/recaptcha/api2/bframe?hl=en&v=-ZG7BC9TxCVEbzIO2m429usb&k=6Lce2GoqAAAAAFDFWAK7qn1wjAVmJ0geU_txTM_0Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /js/bg/Cyqba_K0pUDdT5_AhrcTxS5-b1C3jUsFpG6edXmCObU.js HTTP/1.1Host: www.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEIucrNAQiJ080BGMvYzQEY642lFw==Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /recaptcha/api2/payload?p=06AFcWeA4hlJ_3CmIdQ6sjwCinlmpTeTtRSAtPhrq8gQottSxdIiGKfQAymtjm6POWeX8pC7-w3Xg6pNQ9N0--FLEa_6c_EVFzwBuAkMc5wyLo2fiSUSoNY2n0H85L_2o-SyWV9BoU1U1rFnRAdKRaCy-AHgcKfMrShKWG92RG6JBGVoJWmbO2CIR8KlYNSHMPlxKeLmj1TuZdq51-qfAN8s75GderRuauPw&k=6Lce2GoqAAAAAFDFWAK7qn1wjAVmJ0geU_txTM_0 HTTP/1.1Host: www.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEIucrNAQiJ080BGMvYzQEY642lFw==Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _GRECAPTCHA=09ANOXeZyq8oXgJ5XPqcasHk8eNZR3EfH5dYdesIx9DHjNQ7ufSjoc7J3MYGKzTiqfoXDZxz8sFh2A7vZFYbroyJ8
Source: global traffic	HTTP traffic detected: GET /recaptcha/api2/userverify?k=6Lce2GoqAAAAAFDFWAK7qn1wjAVmJ0geU_txTM_0 HTTP/1.1Host: www.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEIucrNAQiJ080BGMvYzQEY642lFw==Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _GRECAPTCHA=09ANOXeZyq8oXgJ5XPqcasHk8eNZR3EfH5dYdesIx9DHjNQ7ufSjoc7J3MYGKzTiqfoXDZxz8sFh2A7vZFYbroyJ8
Source: global traffic	HTTP traffic detected: GET /?NTMtNGYyOS1hNDc1LTA HTTP/1.1Host: 0nline1.fors3650com.siteConnection: keep-aliveCache-Control: max-age=0Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Referer: https://0nline1.fors3650com.site/?NTMtNGYyOS1hNDc1LTAAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PZMkjz="NTkwZGE5MjktYTJjOC00MGMwLTg1MmUtZTBmZDZiYWZlNDNhOmM1NjI3MDc3LWQxN2EtNGFlMi1hODM4LTQ2MDQ0MWExYjA4YQ=="
Source: global traffic	HTTP traffic detected: GET /login HTTP/1.1Host: 0ffice.fors3650com.siteConnection: keep-aliveCache-Control: max-age=0Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-siteSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Referer: https://0nline1.fors3650com.site/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PZMkjz="NTkwZGE5MjktYTJjOC00MGMwLTg1MmUtZTBmZDZiYWZlNDNhOmM1NjI3MDc3LWQxN2EtNGFlMi1hODM4LTQ2MDQ0MWExYjA4YQ=="
Source: global traffic	HTTP traffic detected: GET /common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2F0ffice.fors3650com.site%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2F0ffice.fors3650com.site%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638654404594371122.YzRiMjU0N2MtNDI5NC00MDUwLTlhOWMtNDY4MjM0NGU5ZjM4OGNkOTM5YzktYzI3ZC00ZTM5LWI3NzEtOThjMTdhOGYwOWRm&ui_locales=en-US&mkt=en-US&client-request-id=a959a2c6-be90-4bbe-9620-b8571db25775&state=5RCrPRsiAriQ55RNojgGMOYvWQ7VLeP3N5DhSSnjZ0odIBnW0Gb3SI4r_o3LDWc3hQTdru7XJZVVsRMaZ1exiI6Gvk6CKH-Z6tu6tkw6BL6ipkMr9r4uIPkXCI_pqJLPd-NLoBMX2Lxwpz9grIXODO5WqDAOn5J0nJiVIdYRgUc5wjGcg_PesvZndm_f0ObCcYJcUcnNaAdu2vEBRantuuwsNyFc2i-xPOXdNw687rrL3oRtzUoqm3s8IETqN6a-dKlaS4L3sbhbEEQCwaQ6oA&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0 HTTP/1.1Host: 0nline1.fors3650com.siteConnection: keep-aliveCache-Control: max-age=0Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-siteSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Referer: https://0nline1.fors3650com.site/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PZMkjz="NTkwZGE5MjktYTJjOC00MGMwLTg1MmUtZTBmZDZiYWZlNDNhOmM1NjI3MDc3LWQxN2EtNGFlMi1hODM4LTQ2MDQ0MWExYjA4YQ=="; MUID=19972F675CEA62CF0BD33A445D616317
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/BssoInterrupt_Core_zKox_QMcTIVut7mG_Z9Eew2.js HTTP/1.1Host: ac83b9c7-590da929.fors3650com.siteConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://0nline1.fors3650com.sitesec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://0nline1.fors3650com.site/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/BssoInterrupt_Core_zKox_QMcTIVut7mG_Z9Eew2.js HTTP/1.1Host: ac83b9c7-590da929.fors3650com.siteConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PZMkjz="NTkwZGE5MjktYTJjOC00MGMwLTg1MmUtZTBmZDZiYWZlNDNhOmM1NjI3MDc3LWQxN2EtNGFlMi1hODM4LTQ2MDQ0MWExYjA4YQ=="; MUID=19972F675CEA62CF0BD33A445D616317
Source: global traffic	HTTP traffic detected: GET /590da929a2c840c0852ee0fd6bafe43a/ HTTP/1.1Host: 0nline1.fors3650com.siteConnection: UpgradePragma: no-cacheCache-Control: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Upgrade: websocketOrigin: https://0nline1.fors3650com.siteSec-WebSocket-Version: 13Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PZMkjz="NTkwZGE5MjktYTJjOC00MGMwLTg1MmUtZTBmZDZiYWZlNDNhOmM1NjI3MDc3LWQxN2EtNGFlMi1hODM4LTQ2MDQ0MWExYjA4YQ=="; MUID=19972F675CEA62CF0BD33A445D616317Sec-WebSocket-Key: FyJwSyC58JKXJ266LOoCUQ==Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
Source: global traffic	HTTP traffic detected: GET /common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2F0ffice.fors3650com.site%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2F0ffice.fors3650com.site%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638654404594371122.YzRiMjU0N2MtNDI5NC00MDUwLTlhOWMtNDY4MjM0NGU5ZjM4OGNkOTM5YzktYzI3ZC00ZTM5LWI3NzEtOThjMTdhOGYwOWRm&ui_locales=en-US&mkt=en-US&client-request-id=a959a2c6-be90-4bbe-9620-b8571db25775&state=5RCrPRsiAriQ55RNojgGMOYvWQ7VLeP3N5DhSSnjZ0odIBnW0Gb3SI4r_o3LDWc3hQTdru7XJZVVsRMaZ1exiI6Gvk6CKH-Z6tu6tkw6BL6ipkMr9r4uIPkXCI_pqJLPd-NLoBMX2Lxwpz9grIXODO5WqDAOn5J0nJiVIdYRgUc5wjGcg_PesvZndm_f0ObCcYJcUcnNaAdu2vEBRantuuwsNyFc2i-xPOXdNw687rrL3oRtzUoqm3s8IETqN6a-dKlaS4L3sbhbEEQCwaQ6oA&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0&sso_reload=true HTTP/1.1Host: 0nline1.fors3650com.siteConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-Dest: documentReferer: https://0nline1.fors3650com.site/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2F0ffice.fors3650com.site%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2F0ffice.fors3650com.site%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638654404594371122.YzRiMjU0N2MtNDI5NC00MDUwLTlhOWMtNDY4MjM0NGU5ZjM4OGNkOTM5YzktYzI3ZC00ZTM5LWI3NzEtOThjMTdhOGYwOWRm&ui_locales=en-US&mkt=en-US&client-request-id=a959a2c6-be90-4bbe-9620-b8571db25775&state=5RCrPRsiAriQ55RNojgGMOYvWQ7VLeP3N5DhSSnjZ0odIBnW0Gb3SI4r_o3LDWc3hQTdru7XJZVVsRMaZ1exiI6Gvk6CKH-Z6tu6tkw6BL6ipkMr9r4uIPkXCI_pqJLPd-NLoBMX2Lxwpz9grIXODO5WqDAOn5J0nJiVIdYRgUc5wjGcg_PesvZndm_f0ObCcYJcUcnNaAdu2vEBRantuuwsNyFc2i-xPOXdNw687rrL3oRtzUoqm3s8IETqN6a-dKlaS4L3sbhbEEQCwaQ6oA&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PZMkjz="NTkwZGE5MjktYTJjOC00MGMwLTg1MmUtZTBmZDZiYWZlNDNhOmM1NjI3MDc3LWQxN2EtNGFlMi1hODM4LTQ2MDQ0MWExYjA4YQ=="; MUID=19972F675CEA62CF0BD33A445D616317; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: 0nline1.fors3650com.siteConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://0nline1.fors3650com.site/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2F0ffice.fors3650com.site%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2F0ffice.fors3650com.site%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638654404594371122.YzRiMjU0N2MtNDI5NC00MDUwLTlhOWMtNDY4MjM0NGU5ZjM4OGNkOTM5YzktYzI3ZC00ZTM5LWI3NzEtOThjMTdhOGYwOWRm&ui_locales=en-US&mkt=en-US&client-request-id=a959a2c6-be90-4bbe-9620-b8571db25775&state=5RCrPRsiAriQ55RNojgGMOYvWQ7VLeP3N5DhSSnjZ0odIBnW0Gb3SI4r_o3LDWc3hQTdru7XJZVVsRMaZ1exiI6Gvk6CKH-Z6tu6tkw6BL6ipkMr9r4uIPkXCI_pqJLPd-NLoBMX2Lxwpz9grIXODO5WqDAOn5J0nJiVIdYRgUc5wjGcg_PesvZndm_f0ObCcYJcUcnNaAdu2vEBRantuuwsNyFc2i-xPOXdNw687rrL3oRtzUoqm3s8IETqN6a-dKlaS4L3sbhbEEQCwaQ6oA&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PZMkjz="NTkwZGE5MjktYTJjOC00MGMwLTg1MmUtZTBmZDZiYWZlNDNhOmM1NjI3MDc3LWQxN2EtNGFlMi1hODM4LTQ2MDQ0MWExYjA4YQ=="; MUID=19972F675CEA62CF0BD33A445D616317; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1
Source: global traffic	HTTP traffic detected: GET /ests/2.1/content/cdnbundles/converged.v2.login.min_nin8k2ycrbzww8zl5vxkaq2.css HTTP/1.1Host: e62d9665-590da929.fors3650com.siteConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://0nline1.fors3650com.sitesec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: styleReferer: https://0nline1.fors3650com.site/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/ConvergedLogin_PCore_QLF_8apNRJD3OCol8jwtxw2.js HTTP/1.1Host: e62d9665-590da929.fors3650com.siteConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://0nline1.fors3650com.sitesec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://0nline1.fors3650com.site/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ests/2.1/content/cdnbundles/ux.converged.login.strings-en.min_1yb3e7oii5t28dgo4xrtow2.js HTTP/1.1Host: e62d9665-590da929.fors3650com.siteConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://0nline1.fors3650com.sitesec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://0nline1.fors3650com.site/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /Me.htm?v=3 HTTP/1.1Host: l1ve.fors3650com.siteConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Purpose: prefetchSec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyReferer: https://0nline1.fors3650com.site/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PZMkjz="NTkwZGE5MjktYTJjOC00MGMwLTg1MmUtZTBmZDZiYWZlNDNhOmM1NjI3MDc3LWQxN2EtNGFlMi1hODM4LTQ2MDQ0MWExYjA4YQ=="; MUID=19972F675CEA62CF0BD33A445D616317
Source: global traffic	HTTP traffic detected: GET /ests/2.1/content/cdnbundles/ux.converged.login.strings-en.min_1yb3e7oii5t28dgo4xrtow2.js HTTP/1.1Host: e62d9665-590da929.fors3650com.siteConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PZMkjz="NTkwZGE5MjktYTJjOC00MGMwLTg1MmUtZTBmZDZiYWZlNDNhOmM1NjI3MDc3LWQxN2EtNGFlMi1hODM4LTQ2MDQ0MWExYjA4YQ=="; MUID=19972F675CEA62CF0BD33A445D616317
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/ConvergedLogin_PCore_QLF_8apNRJD3OCol8jwtxw2.js HTTP/1.1Host: e62d9665-590da929.fors3650com.siteConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PZMkjz="NTkwZGE5MjktYTJjOC00MGMwLTg1MmUtZTBmZDZiYWZlNDNhOmM1NjI3MDc3LWQxN2EtNGFlMi1hODM4LTQ2MDQ0MWExYjA4YQ=="; MUID=19972F675CEA62CF0BD33A445D616317
Source: global traffic	HTTP traffic detected: GET /590da929a2c840c0852ee0fd6bafe43a/ HTTP/1.1Host: 0nline1.fors3650com.siteConnection: UpgradePragma: no-cacheCache-Control: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Upgrade: websocketOrigin: https://0nline1.fors3650com.siteSec-WebSocket-Version: 13Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PZMkjz="NTkwZGE5MjktYTJjOC00MGMwLTg1MmUtZTBmZDZiYWZlNDNhOmM1NjI3MDc3LWQxN2EtNGFlMi1hODM4LTQ2MDQ0MWExYjA4YQ=="; MUID=19972F675CEA62CF0BD33A445D616317; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1Sec-WebSocket-Key: kozyIY4hE7Hp3WND07mDTg==Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico HTTP/1.1Host: e62d9665-590da929.fors3650com.siteConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://0nline1.fors3650com.site/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PZMkjz="NTkwZGE5MjktYTJjOC00MGMwLTg1MmUtZTBmZDZiYWZlNDNhOmM1NjI3MDc3LWQxN2EtNGFlMi1hODM4LTQ2MDQ0MWExYjA4YQ=="; MUID=19972F675CEA62CF0BD33A445D616317
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/asyncchunk/convergedlogin_pcustomizationloader_117b650bccea354984d8.js HTTP/1.1Host: e62d9665-590da929.fors3650com.siteConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://0nline1.fors3650com.site/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PZMkjz="NTkwZGE5MjktYTJjOC00MGMwLTg1MmUtZTBmZDZiYWZlNDNhOmM1NjI3MDc3LWQxN2EtNGFlMi1hODM4LTQ2MDQ0MWExYjA4YQ=="; MUID=19972F675CEA62CF0BD33A445D616317

Source: global traffic	DNS traffic detected: DNS query: 0nline1.fors3650com.site
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: 0ffice.fors3650com.site
Source: global traffic	DNS traffic detected: DNS query: ac83b9c7-590da929.fors3650com.site
Source: global traffic	DNS traffic detected: DNS query: 39540c2c-590da929.fors3650com.site
Source: global traffic	DNS traffic detected: DNS query: e62d9665-590da929.fors3650com.site
Source: global traffic	DNS traffic detected: DNS query: l1ve.fors3650com.site

Source: unknown

HTTP traffic detected: POST /recaptcha/api2/reload?k=6Lce2GoqAAAAAFDFWAK7qn1wjAVmJ0geU_txTM_0 HTTP/1.1Host: www.google.comConnection: keep-aliveContent-Length: 10009sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Type: application/x-protobufferAccept: */*Origin: https://www.google.comX-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEIucrNAQiJ080BGMvYzQEY642lFw==Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.google.com/recaptcha/api2/bframe?hl=en&v=-ZG7BC9TxCVEbzIO2m429usb&k=6Lce2GoqAAAAAFDFWAK7qn1wjAVmJ0geU_txTM_0Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Fri, 25 Oct 2024 08:07:45 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-Encodingcache-control: privatep3p: CP="DSP CUR OTPi IND OTRi ONL FIN"x-ms-request-id: 80a4afa2-b940-4c92-a7b0-e2486dac0301x-ms-ests-server: 2.1.19184.6 - SEC ProdSlicesreport-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://39540c2c-590da929.fors3650com.site/api/report?catId=GW+estsfd+SEC"}]}nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0}x-ms-srs: 1.Preferrer-policy: strict-origin-when-cross-originaccess-control-allow-origin: access-control-allow-headers:
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Fri, 25 Oct 2024 08:07:45 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-Encodingcache-control: privatep3p: CP="DSP CUR OTPi IND OTRi ONL FIN"x-ms-request-id: 9ea78ea6-5999-4ba2-8a31-9fe8e8190600x-ms-ests-server: 2.1.19267.5 - WEULR1 ProdSlicesreport-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://39540c2c-590da929.fors3650com.site/api/report?catId=GW+estsfd+SEC"}]}nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0}x-ms-srs: 1.Preferrer-policy: strict-origin-when-cross-originaccess-control-allow-origin: access-control-allow-headers:
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Fri, 25 Oct 2024 08:07:50 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-Encodingcache-control: privatep3p: CP="DSP CUR OTPi IND OTRi ONL FIN"x-ms-request-id: e2d8ba5b-e0be-44da-beef-c5ed69550a00x-ms-ests-server: 2.1.19267.5 - SEC ProdSlicesreport-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://39540c2c-590da929.fors3650com.site/api/report?catId=GW+estsfd+SEC"}]}nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0}x-ms-srs: 1.Preferrer-policy: strict-origin-when-cross-originaccess-control-allow-origin: access-control-allow-headers:

Source: chromecache_94.1.dr, chromecache_87.1.dr, chromecache_110.1.dr	String found in binary or memory: https://cloud.google.com/contact
Source: chromecache_94.1.dr, chromecache_87.1.dr, chromecache_110.1.dr	String found in binary or memory: https://cloud.google.com/recaptcha-enterprise/billing-information
Source: chromecache_94.1.dr, chromecache_87.1.dr, chromecache_110.1.dr	String found in binary or memory: https://developers.google.com/recaptcha/docs/faq#are-there-any-qps-or-daily-limits-on-my-use-of-reca
Source: chromecache_94.1.dr, chromecache_87.1.dr, chromecache_110.1.dr	String found in binary or memory: https://developers.google.com/recaptcha/docs/faq#localhost_support
Source: chromecache_94.1.dr, chromecache_87.1.dr, chromecache_110.1.dr	String found in binary or memory: https://developers.google.com/recaptcha/docs/faq#my-computer-or-network-may-be-sending-automated-que
Source: chromecache_110.1.dr	String found in binary or memory: https://play.google.com/log?format=json&hasfast=true
Source: chromecache_110.1.dr	String found in binary or memory: https://support.google.com/recaptcha
Source: chromecache_94.1.dr, chromecache_87.1.dr, chromecache_110.1.dr	String found in binary or memory: https://support.google.com/recaptcha#6262736
Source: chromecache_94.1.dr, chromecache_87.1.dr, chromecache_110.1.dr	String found in binary or memory: https://support.google.com/recaptcha/#6175971
Source: chromecache_94.1.dr, chromecache_87.1.dr, chromecache_110.1.dr	String found in binary or memory: https://support.google.com/recaptcha/?hl=en#6223828
Source: chromecache_94.1.dr, chromecache_87.1.dr, chromecache_86.1.dr, chromecache_110.1.dr, chromecache_97.1.dr	String found in binary or memory: https://www.google.com/recaptcha/api2/
Source: chromecache_94.1.dr, chromecache_87.1.dr, chromecache_110.1.dr	String found in binary or memory: https://www.gstatic.c..?/recaptcha/releases/-ZG7BC9TxCVEbzIO2m429usb/recaptcha__.
Source: chromecache_81.1.dr, chromecache_100.1.dr, chromecache_86.1.dr, chromecache_97.1.dr	String found in binary or memory: https://www.gstatic.com/recaptcha/releases/-ZG7BC9TxCVEbzIO2m429usb/recaptcha__en.js

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49699
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49698
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49701
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49699 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 49698 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49720 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49725 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.16:49727 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.16:49728 version: TLS 1.2

Source: classification engine

Classification label: mal64.phis.win@18/60@26/8

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Jump to behavior

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2144 --field-trial-handle=1956,i,15424997094793907970,14375061747430374650,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://0nline1.fors3650com.site/?NTMtNGYyOS1hNDc1LTA"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2144 --field-trial-handle=1956,i,15424997094793907970,14375061747430374650,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Google Drive.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Stores files to the Windows start menu directory

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.184.196	unknown	United States	15169	GOOGLEUS	false
142.250.185.228	www.google.com	United States	15169	GOOGLEUS	false
64.226.112.17	0nline1.fors3650com.site	Canada	13768	COGECO-PEER1CA	true
239.255.255.250	unknown	Reserved	unknown	unknown	false
142.250.185.196	unknown	United States	15169	GOOGLEUS	false
142.250.186.164	unknown	United States	15169	GOOGLEUS	false
142.250.186.100	unknown	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.16

Contacted Domains

Name	IP	Active
0nline1.fors3650com.site	64.226.112.17	true
l1ve.fors3650com.site	64.226.112.17	true
www.google.com	142.250.185.228	true
ac83b9c7-590da929.fors3650com.site	64.226.112.17	true
e62d9665-590da929.fors3650com.site	64.226.112.17	true
39540c2c-590da929.fors3650com.site	64.226.112.17	true
0ffice.fors3650com.site	64.226.112.17	true

Contacted URLs

Name	Malicious	Reputation
https://www.google.com/js/bg/Cyqba_K0pUDdT5_AhrcTxS5-b1C3jUsFpG6edXmCObU.js	false	unknown
https://0nline1.fors3650com.site/590da929a2c840c0852ee0fd6bafe43a/	true	unknown
https://e62d9665-590da929.fors3650com.site/shared/1.0/content/js/ConvergedLogin_PCore_QLF_8apNRJD3OCol8jwtxw2.js	true	unknown
https://e62d9665-590da929.fors3650com.site/shared/1.0/content/js/asyncchunk/convergedlogin_pcustomizationloader_117b650bccea354984d8.js	true	unknown
https://e62d9665-590da929.fors3650com.site/ests/2.1/content/cdnbundles/converged.v2.login.min_nin8k2ycrbzww8zl5vxkaq2.css	true	unknown
https://0nline1.fors3650com.site/?NTMtNGYyOS1hNDc1LTA	true	unknown
https://www.google.com/js/bg/p-7RyvuJU9m0QQmVDJx8SL9t4pWXVpOJSp0296ydJmo.js	false	unknown
https://www.google.com/recaptcha/api2/userverify?k=6Lce2GoqAAAAAFDFWAK7qn1wjAVmJ0geU_txTM_0	false	unknown
https://www.google.com/recaptcha/api2/webworker.js?hl=en&v=-ZG7BC9TxCVEbzIO2m429usb	false	unknown
https://0ffice.fors3650com.site/login	true	unknown
https://www.google.com/recaptcha/api2/reload?k=6Lce2GoqAAAAAFDFWAK7qn1wjAVmJ0geU_txTM_0	false	unknown
https://l1ve.fors3650com.site/Me.htm?v=3	true	unknown
https://39540c2c-590da929.fors3650com.site/api/report?catId=GW+estsfd+SEC	true	unknown
https://e62d9665-590da929.fors3650com.site/ests/2.1/content/cdnbundles/ux.converged.login.strings-en.min_1yb3e7oii5t28dgo4xrtow2.js	true	unknown
https://www.google.com/recaptcha/api.js	false	unknown
https://ac83b9c7-590da929.fors3650com.site/shared/1.0/content/js/BssoInterrupt_Core_zKox_QMcTIVut7mG_Z9Eew2.js	true	unknown
https://0nline1.fors3650com.site/favicon.ico	true	unknown
https://0nline1.fors3650com.site/?	true	unknown
https://www.google.com/recaptcha/api2/payload?p=06AFcWeA4hlJ_3CmIdQ6sjwCinlmpTeTtRSAtPhrq8gQottSxdIiGKfQAymtjm6POWeX8pC7-w3Xg6pNQ9N0--FLEa_6c_EVFzwBuAkMc5wyLo2fiSUSoNY2n0H85L_2o-SyWV9BoU1U1rFnRAdKRaCy-AHgcKfMrShKWG92RG6JBGVoJWmbO2CIR8KlYNSHMPlxKeLmj1TuZdq51-qfAN8s75GderRuauPw&k=6Lce2GoqAAAAAFDFWAK7qn1wjAVmJ0geU_txTM_0	false	unknown
https://e62d9665-590da929.fors3650com.site/shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico	true	unknown
https://www.google.com/recaptcha/api2/bframe?hl=en&v=-ZG7BC9TxCVEbzIO2m429usb&k=6Lce2GoqAAAAAFDFWAK7qn1wjAVmJ0geU_txTM_0	false	unknown

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 25 07:05:47 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	ED8D3B0E92AC6912684169CCEF4DB4B7	E27D4954F21FA97B9803698886C868E5935BDA9D	0CFB7316CE566D2E02C8CAEF8D4F127F6B256FE286517B931623209757F5949C
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 25 07:05:47 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	5B479C285222681FF71C386EBFED0369	FDC60BB0C8F592E4DA5871BCEF7F99F2C72C9A49	8D7C93F83A2B511CD7676EF0321D5FCD287A80B4D19C004C9014AA590EE59D67
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:05:01 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	065B666AFE3D02892248702AB7E23A30	8F189C0613C0098FE6117BE9C0B1922EC92B15FB	FA87FB3076FC45FA881EF08F0E37C2C1FA515BAE83908D4C06E1BD5BB92233A8
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 25 07:05:47 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	3EF0834A4CB13BBB6C4FB007D740014A	EDFD1F59411B57154493735FEC501BA3BD376EB3	6254A6EA8ABBC8EABA0A8525CB7E095D38F75590BC557E0E9D52AC61E84326F0
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 25 07:05:47 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	E72E8EDEE87471763ED3A8090FF6E58A	7881FA1A3F8295E222A3C8895FB2EBD4196433A8	54F2E24E1E5F96E5E7742A71A407E56B9BF32C817D2C296974F760434DFEA25C
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 25 07:05:47 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	6718C7A71AAFEB4BBE76142F6202E4A6	32AA820C2FE473D9E6AFBAF7864976D1C50BB92A	9AA7AEF46B766A22ECE79F7DBB365DC66294DCFE0CFFC1AC3AD6F1B1A5EFDE0F
Chrome Cache Entry: 100	ASCII text, with no line terminators	9AFB0D35BB088B3036561313BF7CE1F4	C7F3FDE34C537242969FBBD736B5B129611F1694	6E4501CE6F65A1B8671A9D31A8F5AB56DFA4E30AA7A4A971DAA1544AB2EB53C1
Chrome Cache Entry: 101	gzip compressed data, from Unix, original size modulo 2^32 57443	210F3C4E623D333CB94746CEC563DE09	887911B0BCA564AFEC25787B44A98F16EBF7ACA3	4792643ECEBF0EEAA641474C9A1BA39D16D2F924C6B5A6FCB8FC443A5FE59F44
Chrome Cache Entry: 102	Web Open Font Format (Version 2), TrueType, length 15552, version 1.0	285467176F7FE6BB6A9C6873B3DAD2CC	EA04E4FF5142DDD69307C183DEF721A160E0A64E	5A8C1E7681318CAA29E9F44E8A6E271F6A4067A2703E9916DFD4FE9099241DB7
Chrome Cache Entry: 103	Web Open Font Format (Version 2), TrueType, length 15340, version 1.0	19B7A0ADFDD4F808B53AF7E2CE2AD4E5	81D5D4C7B5035AD10CCE63CF7100295E0C51FDDA	C912A9CE0C3122D4B2B29AD26BFE06B0390D1A5BDAA5D6128692C0BEFD1DFBBD
Chrome Cache Entry: 104	PNG image data, 48 x 48, 8-bit gray+alpha, non-interlaced	07BF314AAB04047B9E9A959EE6F63DA3	17BEF6602672E2FD9956381E01356245144003E5	55EAF62CB05DA20088DC12B39D7D254D046CB1FD61DDF3AE641F1439EFD0A5EE
Chrome Cache Entry: 105	gzip compressed data, from Unix, original size modulo 2^32 57443	210F3C4E623D333CB94746CEC563DE09	887911B0BCA564AFEC25787B44A98F16EBF7ACA3	4792643ECEBF0EEAA641474C9A1BA39D16D2F924C6B5A6FCB8FC443A5FE59F44
Chrome Cache Entry: 106	ASCII text, with very long lines (65536), with no line terminators	47BEA70318B724B1A99A1D571FF58807	B66FFE704AD2FE84DA8211D6351727568FD68B78	11A188A204934185AB5649A1F838FE771C3D84C928BC8286EF999FB5B8DEDA69
Chrome Cache Entry: 107	gzip compressed data, from Unix, original size modulo 2^32 113378	D5B89CEEC2B024C565802C0E51607044	74696825D59F384D3D874638537BB4920FDB60CB	05DC99C6E0751D3A98E970F628C8426A967CF068A4BD681BDBAF6F627D54C7E2
Chrome Cache Entry: 108	ASCII text, with very long lines (18272)	51577CA8402B9A0AC5D7BA6D0C802355	7B7690BC3F57AF01AF9DF7632DE3D444CB585B9B	0B2A9B6BF2B4A540DD4F9FC086B713C52E7E6F50B78D4B05A46E9E75798239B5
Chrome Cache Entry: 109	PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced	EF9941290C50CD3866E2BA6B793F010D	4736508C795667DCEA21F8D864233031223B7832	1B9EFB22C938500971AAC2B2130A475FA23684DD69E43103894968DF83145B8A
Chrome Cache Entry: 110	ASCII text, with very long lines (701)	88A5FED5C87B1D3704AB225CFBE7A130	D64243C18FBAA356E4ABAE8414CCC4772D64060B	F8E5F5CE9FF44073CFF24BCD3D2B8AA4E67B67891B14FF929FE4743880FDF82E
Chrome Cache Entry: 111	PNG image data, 48 x 48, 8-bit gray+alpha, non-interlaced	88E0F42C9FA4F94AA8BCD54D1685C180	5AD9D47A49B82718BAA3BE88550A0B3350270C42	89C62095126FCA89EA1511CF35B49B8306162946B0C26D6F60C5506C51D85992
Chrome Cache Entry: 112	gzip compressed data, from Unix, original size modulo 2^32 449694	6C22C7CFFEBF7F29E2D286DAB9A0734D	EF9C8596E5EB09636DCED5C92E4964C15041D953	AD163D7E4D8AF1F7079E129ED31D45BB878F6B239511AF804E0DE3F9555D8C21
Chrome Cache Entry: 113	gzip compressed data, from Unix, original size modulo 2^32 142323	73A6DE7A6B0D12F6C789F10BD48FA150	C3243B25BFE83FAD6CBF77676810982F8FF7C35A	FB52F7930908705BEF3D5971011C65DEED0B29876B28112E7A5FEBF6996336DB
Chrome Cache Entry: 81	ASCII text, with no line terminators	9AFB0D35BB088B3036561313BF7CE1F4	C7F3FDE34C537242969FBBD736B5B129611F1694	6E4501CE6F65A1B8671A9D31A8F5AB56DFA4E30AA7A4A971DAA1544AB2EB53C1
Chrome Cache Entry: 82	gzip compressed data, from Unix, original size modulo 2^32 142323	73A6DE7A6B0D12F6C789F10BD48FA150	C3243B25BFE83FAD6CBF77676810982F8FF7C35A	FB52F7930908705BEF3D5971011C65DEED0B29876B28112E7A5FEBF6996336DB
Chrome Cache Entry: 83	Web Open Font Format (Version 2), TrueType, length 15344, version 1.0	5D4AEB4E5F5EF754E307D7FFAEF688BD	06DB651CDF354C64A7383EA9C77024EF4FB4CEF8	3E253B66056519AA065B00A453BAC37AC5ED8F3E6FE7B542E93A9DCDCC11D0BC
Chrome Cache Entry: 84	ASCII text, with very long lines (18298)	87F3F1784464A56B80F04D1C64FAC841	66ED80D249257F5352375A3F12103538963D7CFD	A7EED1CAFB8953D9B44109950C9C7C48BF6DE295975693894A9D36F7AC9D266A
Chrome Cache Entry: 85	JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 300x300, components 3	1C1E5A8A1678EA2C22C800B42806CB83	CD02A7A34ECF7F40F01A57BDC8D859E4E7D4A560	63FFE534FA28299CF9471C85C8B3855DE78B829DF7CB773E00FF42FB18CCC972
Chrome Cache Entry: 86	ASCII text, with very long lines (1434), with no line terminators	D65A07148C3BC2CAA55AA19EEB08BF83	FEE4A6CB2887B32B69F2539AB85073051CFEA226	B7920C3EE4D6BB39BEE9AEAD6CBF6E02254F8B2EC119B695FE252837CB2E69A0
Chrome Cache Entry: 87	ASCII text, with very long lines (701)	88A5FED5C87B1D3704AB225CFBE7A130	D64243C18FBAA356E4ABAE8414CCC4772D64060B	F8E5F5CE9FF44073CFF24BCD3D2B8AA4E67B67891B14FF929FE4743880FDF82E
Chrome Cache Entry: 88	JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 300x300, components 3	1C1E5A8A1678EA2C22C800B42806CB83	CD02A7A34ECF7F40F01A57BDC8D859E4E7D4A560	63FFE534FA28299CF9471C85C8B3855DE78B829DF7CB773E00FF42FB18CCC972
Chrome Cache Entry: 89	ASCII text, with no line terminators	AFB69DF47958EB78B4E941270772BD6A	D9FE9A625E906FF25C1F165E7872B1D9C731E78E	874809FB1235F80831B706B9E9B903D80BD5662D036B7712CC76F8C684118878
Chrome Cache Entry: 90	PNG image data, 48 x 48, 8-bit gray+alpha, non-interlaced	0F2A4639B8A4CB30C76E8333C00D30A6	57E273A270BB864970D747C74B3F0A7C8E515B13	44B988703019CD6BFA86C91840FECF2A42B611B364E3EEA2F4EB63BF62714E98
Chrome Cache Entry: 91	PNG image data, 48 x 48, 8-bit gray+alpha, non-interlaced	88E0F42C9FA4F94AA8BCD54D1685C180	5AD9D47A49B82718BAA3BE88550A0B3350270C42	89C62095126FCA89EA1511CF35B49B8306162946B0C26D6F60C5506C51D85992
Chrome Cache Entry: 92	gzip compressed data, from Unix, original size modulo 2^32 3558	B1DB17E152EDCF96376F348F3FA6CCA5	0CA84391F6D16181677F149B5A4871435C242A71	D99868F9A5B718D6DBAA03A29D4ABE87A80AEBC92E353BB7C60CD39C9CD678C2
Chrome Cache Entry: 93	PNG image data, 48 x 48, 8-bit gray+alpha, non-interlaced	0F2A4639B8A4CB30C76E8333C00D30A6	57E273A270BB864970D747C74B3F0A7C8E515B13	44B988703019CD6BFA86C91840FECF2A42B611B364E3EEA2F4EB63BF62714E98
Chrome Cache Entry: 94	ASCII text, with very long lines (701)	88A5FED5C87B1D3704AB225CFBE7A130	D64243C18FBAA356E4ABAE8414CCC4772D64060B	F8E5F5CE9FF44073CFF24BCD3D2B8AA4E67B67891B14FF929FE4743880FDF82E
Chrome Cache Entry: 95	PNG image data, 48 x 48, 8-bit gray+alpha, non-interlaced	07BF314AAB04047B9E9A959EE6F63DA3	17BEF6602672E2FD9956381E01356245144003E5	55EAF62CB05DA20088DC12B39D7D254D046CB1FD61DDF3AE641F1439EFD0A5EE
Chrome Cache Entry: 96	ASCII text, with very long lines (18298)	87F3F1784464A56B80F04D1C64FAC841	66ED80D249257F5352375A3F12103538963D7CFD	A7EED1CAFB8953D9B44109950C9C7C48BF6DE295975693894A9D36F7AC9D266A
Chrome Cache Entry: 97	ASCII text, with very long lines (1434), with no line terminators	D65A07148C3BC2CAA55AA19EEB08BF83	FEE4A6CB2887B32B69F2539AB85073051CFEA226	B7920C3EE4D6BB39BEE9AEAD6CBF6E02254F8B2EC119B695FE252837CB2E69A0
Chrome Cache Entry: 98	ASCII text, with very long lines (18272)	51577CA8402B9A0AC5D7BA6D0C802355	7B7690BC3F57AF01AF9DF7632DE3D444CB585B9B	0B2A9B6BF2B4A540DD4F9FC086B713C52E7E6F50B78D4B05A46E9E75798239B5
Chrome Cache Entry: 99	PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced	EF9941290C50CD3866E2BA6B793F010D	4736508C795667DCEA21F8D864233031223B7832	1B9EFB22C938500971AAC2B2130A475FA23684DD69E43103894968DF83145B8A

Phishing

AI detected phishing page

Source: https://0nline1.fors3650com.site/?NTMtNGYyOS1hNDc1LTA

Yara detected HtmlPhish54

Source: Yara match	File source: 0.12.id.script.csv, type: HTML
Source: Yara match	File source: 0.19.id.script.csv, type: HTML
Source: Yara match	File source: 2.5.pages.csv, type: HTML
Source: Yara match	File source: 3.6.pages.csv, type: HTML

HTML body contains low number of good links

HTTP Parser: Number of links: 0

HTML page contains hidden javascript code

Source: https://0nline1.fors3650com.site/?NTMtNGYyOS1hNDc1LTA

HTTP Parser: Base64 decoded: a[href="http://www.salidzini.lv/"][style="display: block; width: 120px; height: 40px; overflow: hidden; position: relative;"]

HTML title does not match URL

HTTP Parser: Title: Sign in to your account does not match URL

Source: https://0nline1.fors3650com.site/?NTMtNGYyOS1hNDc1LTA	HTTP Parser: No favicon
Source: https://0nline1.fors3650com.site/?NTMtNGYyOS1hNDc1LTA	HTTP Parser: No favicon
Source: https://0nline1.fors3650com.site/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2F0ffice.fors3650com.site%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2F0ffice.fors3650com.site%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638654404594371122.YzRiMjU0N2MtNDI5NC00MDUwLTlhOWMtNDY4MjM0NGU5ZjM4OGNkOTM5YzktYzI3ZC00ZTM5LWI3NzEtOThjMTdhOGYwOWRm&ui_locales=en-US&mkt=en-US&client-request-id=a959a2c6-be90-4bbe-9620-b8571db25775&state=5RCrPRsiAriQ55RNojgGMOYvWQ7VLeP3N5DhSSnjZ0odIBnW0Gb3SI4r_o3LDWc3hQTdru7XJZVVsRMaZ1exiI6Gvk6CKH-Z6tu6tkw6BL6ipkMr9r4uIPkXCI_pqJLPd-NLoBMX2Lxwpz9grIXODO5WqDAOn5J0nJiVIdYRgUc5wjGcg_PesvZndm_f0ObCcYJcUcnNaAdu2vEBRantuuwsNyFc2i-xPOXdNw687rrL3oRtzUoqm3s8IETqN6a-dKlaS4L3sbhbEEQCwaQ6oA&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0	HTTP Parser: No favicon
Source: https://0nline1.fors3650com.site/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2F0ffice.fors3650com.site%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2F0ffice.fors3650com.site%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638654404594371122.YzRiMjU0N2MtNDI5NC00MDUwLTlhOWMtNDY4MjM0NGU5ZjM4OGNkOTM5YzktYzI3ZC00ZTM5LWI3NzEtOThjMTdhOGYwOWRm&ui_locales=en-US&mkt=en-US&client-request-id=a959a2c6-be90-4bbe-9620-b8571db25775&state=5RCrPRsiAriQ55RNojgGMOYvWQ7VLeP3N5DhSSnjZ0odIBnW0Gb3SI4r_o3LDWc3hQTdru7XJZVVsRMaZ1exiI6Gvk6CKH-Z6tu6tkw6BL6ipkMr9r4uIPkXCI_pqJLPd-NLoBMX2Lxwpz9grIXODO5WqDAOn5J0nJiVIdYRgUc5wjGcg_PesvZndm_f0ObCcYJcUcnNaAdu2vEBRantuuwsNyFc2i-xPOXdNw687rrL3oRtzUoqm3s8IETqN6a-dKlaS4L3sbhbEEQCwaQ6oA&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0&sso_reload=true	HTTP Parser: No favicon

HTTP Parser: No <meta name="author".. found

HTTP Parser: No <meta name="copyright".. found

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49720 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49725 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.16:49727 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.16:49728 version: TLS 1.2

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 2857090 - Severity 1 - ETPRO PHISHING JS/PsyduckPockeball Payload Inbound : 64.226.112.17:443 -> 192.168.2.16:49698

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108

Source: global traffic	HTTP traffic detected: GET /?NTMtNGYyOS1hNDc1LTA HTTP/1.1Host: 0nline1.fors3650com.siteConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /recaptcha/api.js HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEIucrNAQiJ080BGMvYzQEY642lFw==Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://0nline1.fors3650com.site/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /recaptcha/api.js HTTP/1.1Host: www.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEIucrNAQiJ080BGMvYzQEY642lFw==Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /recaptcha/api2/anchor?ar=1&k=6Lce2GoqAAAAAFDFWAK7qn1wjAVmJ0geU_txTM_0&co=aHR0cHM6Ly8wbmxpbmUxLmZvcnMzNjUwY29tLnNpdGU6NDQz&hl=en&v=-ZG7BC9TxCVEbzIO2m429usb&size=normal&cb=zd5j4t2s2k7b HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEIucrNAQiJ080BGMvYzQEY642lFw==Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://0nline1.fors3650com.site/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /recaptcha/api2/webworker.js?hl=en&v=-ZG7BC9TxCVEbzIO2m429usb HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEIucrNAQiJ080BGMvYzQEY642lFw==Sec-Fetch-Site: same-originSec-Fetch-Mode: same-originSec-Fetch-Dest: workerReferer: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6Lce2GoqAAAAAFDFWAK7qn1wjAVmJ0geU_txTM_0&co=aHR0cHM6Ly8wbmxpbmUxLmZvcnMzNjUwY29tLnNpdGU6NDQz&hl=en&v=-ZG7BC9TxCVEbzIO2m429usb&size=normal&cb=zd5j4t2s2k7bAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /js/bg/p-7RyvuJU9m0QQmVDJx8SL9t4pWXVpOJSp0296ydJmo.js HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEIucrNAQiJ080BGMvYzQEY642lFw==Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6Lce2GoqAAAAAFDFWAK7qn1wjAVmJ0geU_txTM_0&co=aHR0cHM6Ly8wbmxpbmUxLmZvcnMzNjUwY29tLnNpdGU6NDQz&hl=en&v=-ZG7BC9TxCVEbzIO2m429usb&size=normal&cb=zd5j4t2s2k7bAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /recaptcha/api2/webworker.js?hl=en&v=-ZG7BC9TxCVEbzIO2m429usb HTTP/1.1Host: www.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEIucrNAQiJ080BGMvYzQEY642lFw==Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /js/bg/p-7RyvuJU9m0QQmVDJx8SL9t4pWXVpOJSp0296ydJmo.js HTTP/1.1Host: www.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEIucrNAQiJ080BGMvYzQEY642lFw==Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /recaptcha/api2/bframe?hl=en&v=-ZG7BC9TxCVEbzIO2m429usb&k=6Lce2GoqAAAAAFDFWAK7qn1wjAVmJ0geU_txTM_0 HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEIucrNAQiJ080BGMvYzQEY642lFw==Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://0nline1.fors3650com.site/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=N4T8Ct+9CmBKc9n&MD=zuN19TOb HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=N4T8Ct+9CmBKc9n&MD=zuN19TOb HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /recaptcha/api2/reload?k=6Lce2GoqAAAAAFDFWAK7qn1wjAVmJ0geU_txTM_0 HTTP/1.1Host: www.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEIucrNAQiJ080BGMvYzQEY642lFw==Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _GRECAPTCHA=09ANOXeZyq8oXgJ5XPqcasHk8eNZR3EfH5dYdesIx9DHjNQ7ufSjoc7J3MYGKzTiqfoXDZxz8sFh2A7vZFYbroyJ8
Source: global traffic	HTTP traffic detected: GET /recaptcha/api2/payload?p=06AFcWeA4hlJ_3CmIdQ6sjwCinlmpTeTtRSAtPhrq8gQottSxdIiGKfQAymtjm6POWeX8pC7-w3Xg6pNQ9N0--FLEa_6c_EVFzwBuAkMc5wyLo2fiSUSoNY2n0H85L_2o-SyWV9BoU1U1rFnRAdKRaCy-AHgcKfMrShKWG92RG6JBGVoJWmbO2CIR8KlYNSHMPlxKeLmj1TuZdq51-qfAN8s75GderRuauPw&k=6Lce2GoqAAAAAFDFWAK7qn1wjAVmJ0geU_txTM_0 HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEIucrNAQiJ080BGMvYzQEY642lFw==Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.google.com/recaptcha/api2/bframe?hl=en&v=-ZG7BC9TxCVEbzIO2m429usb&k=6Lce2GoqAAAAAFDFWAK7qn1wjAVmJ0geU_txTM_0Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _GRECAPTCHA=09ANOXeZyq8oXgJ5XPqcasHk8eNZR3EfH5dYdesIx9DHjNQ7ufSjoc7J3MYGKzTiqfoXDZxz8sFh2A7vZFYbroyJ8
Source: global traffic	HTTP traffic detected: GET /js/bg/Cyqba_K0pUDdT5_AhrcTxS5-b1C3jUsFpG6edXmCObU.js HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEIucrNAQiJ080BGMvYzQEY642lFw==Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.google.com/recaptcha/api2/bframe?hl=en&v=-ZG7BC9TxCVEbzIO2m429usb&k=6Lce2GoqAAAAAFDFWAK7qn1wjAVmJ0geU_txTM_0Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /js/bg/Cyqba_K0pUDdT5_AhrcTxS5-b1C3jUsFpG6edXmCObU.js HTTP/1.1Host: www.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEIucrNAQiJ080BGMvYzQEY642lFw==Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /recaptcha/api2/payload?p=06AFcWeA4hlJ_3CmIdQ6sjwCinlmpTeTtRSAtPhrq8gQottSxdIiGKfQAymtjm6POWeX8pC7-w3Xg6pNQ9N0--FLEa_6c_EVFzwBuAkMc5wyLo2fiSUSoNY2n0H85L_2o-SyWV9BoU1U1rFnRAdKRaCy-AHgcKfMrShKWG92RG6JBGVoJWmbO2CIR8KlYNSHMPlxKeLmj1TuZdq51-qfAN8s75GderRuauPw&k=6Lce2GoqAAAAAFDFWAK7qn1wjAVmJ0geU_txTM_0 HTTP/1.1Host: www.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEIucrNAQiJ080BGMvYzQEY642lFw==Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _GRECAPTCHA=09ANOXeZyq8oXgJ5XPqcasHk8eNZR3EfH5dYdesIx9DHjNQ7ufSjoc7J3MYGKzTiqfoXDZxz8sFh2A7vZFYbroyJ8
Source: global traffic	HTTP traffic detected: GET /recaptcha/api2/userverify?k=6Lce2GoqAAAAAFDFWAK7qn1wjAVmJ0geU_txTM_0 HTTP/1.1Host: www.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEIucrNAQiJ080BGMvYzQEY642lFw==Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _GRECAPTCHA=09ANOXeZyq8oXgJ5XPqcasHk8eNZR3EfH5dYdesIx9DHjNQ7ufSjoc7J3MYGKzTiqfoXDZxz8sFh2A7vZFYbroyJ8
Source: global traffic	HTTP traffic detected: GET /?NTMtNGYyOS1hNDc1LTA HTTP/1.1Host: 0nline1.fors3650com.siteConnection: keep-aliveCache-Control: max-age=0Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Referer: https://0nline1.fors3650com.site/?NTMtNGYyOS1hNDc1LTAAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PZMkjz="NTkwZGE5MjktYTJjOC00MGMwLTg1MmUtZTBmZDZiYWZlNDNhOmM1NjI3MDc3LWQxN2EtNGFlMi1hODM4LTQ2MDQ0MWExYjA4YQ=="
Source: global traffic	HTTP traffic detected: GET /login HTTP/1.1Host: 0ffice.fors3650com.siteConnection: keep-aliveCache-Control: max-age=0Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-siteSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Referer: https://0nline1.fors3650com.site/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PZMkjz="NTkwZGE5MjktYTJjOC00MGMwLTg1MmUtZTBmZDZiYWZlNDNhOmM1NjI3MDc3LWQxN2EtNGFlMi1hODM4LTQ2MDQ0MWExYjA4YQ=="
Source: global traffic	HTTP traffic detected: GET /common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2F0ffice.fors3650com.site%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2F0ffice.fors3650com.site%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638654404594371122.YzRiMjU0N2MtNDI5NC00MDUwLTlhOWMtNDY4MjM0NGU5ZjM4OGNkOTM5YzktYzI3ZC00ZTM5LWI3NzEtOThjMTdhOGYwOWRm&ui_locales=en-US&mkt=en-US&client-request-id=a959a2c6-be90-4bbe-9620-b8571db25775&state=5RCrPRsiAriQ55RNojgGMOYvWQ7VLeP3N5DhSSnjZ0odIBnW0Gb3SI4r_o3LDWc3hQTdru7XJZVVsRMaZ1exiI6Gvk6CKH-Z6tu6tkw6BL6ipkMr9r4uIPkXCI_pqJLPd-NLoBMX2Lxwpz9grIXODO5WqDAOn5J0nJiVIdYRgUc5wjGcg_PesvZndm_f0ObCcYJcUcnNaAdu2vEBRantuuwsNyFc2i-xPOXdNw687rrL3oRtzUoqm3s8IETqN6a-dKlaS4L3sbhbEEQCwaQ6oA&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0 HTTP/1.1Host: 0nline1.fors3650com.siteConnection: keep-aliveCache-Control: max-age=0Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-siteSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Referer: https://0nline1.fors3650com.site/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PZMkjz="NTkwZGE5MjktYTJjOC00MGMwLTg1MmUtZTBmZDZiYWZlNDNhOmM1NjI3MDc3LWQxN2EtNGFlMi1hODM4LTQ2MDQ0MWExYjA4YQ=="; MUID=19972F675CEA62CF0BD33A445D616317
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/BssoInterrupt_Core_zKox_QMcTIVut7mG_Z9Eew2.js HTTP/1.1Host: ac83b9c7-590da929.fors3650com.siteConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://0nline1.fors3650com.sitesec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://0nline1.fors3650com.site/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/BssoInterrupt_Core_zKox_QMcTIVut7mG_Z9Eew2.js HTTP/1.1Host: ac83b9c7-590da929.fors3650com.siteConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PZMkjz="NTkwZGE5MjktYTJjOC00MGMwLTg1MmUtZTBmZDZiYWZlNDNhOmM1NjI3MDc3LWQxN2EtNGFlMi1hODM4LTQ2MDQ0MWExYjA4YQ=="; MUID=19972F675CEA62CF0BD33A445D616317
Source: global traffic	HTTP traffic detected: GET /590da929a2c840c0852ee0fd6bafe43a/ HTTP/1.1Host: 0nline1.fors3650com.siteConnection: UpgradePragma: no-cacheCache-Control: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Upgrade: websocketOrigin: https://0nline1.fors3650com.siteSec-WebSocket-Version: 13Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PZMkjz="NTkwZGE5MjktYTJjOC00MGMwLTg1MmUtZTBmZDZiYWZlNDNhOmM1NjI3MDc3LWQxN2EtNGFlMi1hODM4LTQ2MDQ0MWExYjA4YQ=="; MUID=19972F675CEA62CF0BD33A445D616317Sec-WebSocket-Key: FyJwSyC58JKXJ266LOoCUQ==Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
Source: global traffic	HTTP traffic detected: GET /common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2F0ffice.fors3650com.site%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2F0ffice.fors3650com.site%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638654404594371122.YzRiMjU0N2MtNDI5NC00MDUwLTlhOWMtNDY4MjM0NGU5ZjM4OGNkOTM5YzktYzI3ZC00ZTM5LWI3NzEtOThjMTdhOGYwOWRm&ui_locales=en-US&mkt=en-US&client-request-id=a959a2c6-be90-4bbe-9620-b8571db25775&state=5RCrPRsiAriQ55RNojgGMOYvWQ7VLeP3N5DhSSnjZ0odIBnW0Gb3SI4r_o3LDWc3hQTdru7XJZVVsRMaZ1exiI6Gvk6CKH-Z6tu6tkw6BL6ipkMr9r4uIPkXCI_pqJLPd-NLoBMX2Lxwpz9grIXODO5WqDAOn5J0nJiVIdYRgUc5wjGcg_PesvZndm_f0ObCcYJcUcnNaAdu2vEBRantuuwsNyFc2i-xPOXdNw687rrL3oRtzUoqm3s8IETqN6a-dKlaS4L3sbhbEEQCwaQ6oA&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0&sso_reload=true HTTP/1.1Host: 0nline1.fors3650com.siteConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-Dest: documentReferer: https://0nline1.fors3650com.site/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2F0ffice.fors3650com.site%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2F0ffice.fors3650com.site%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638654404594371122.YzRiMjU0N2MtNDI5NC00MDUwLTlhOWMtNDY4MjM0NGU5ZjM4OGNkOTM5YzktYzI3ZC00ZTM5LWI3NzEtOThjMTdhOGYwOWRm&ui_locales=en-US&mkt=en-US&client-request-id=a959a2c6-be90-4bbe-9620-b8571db25775&state=5RCrPRsiAriQ55RNojgGMOYvWQ7VLeP3N5DhSSnjZ0odIBnW0Gb3SI4r_o3LDWc3hQTdru7XJZVVsRMaZ1exiI6Gvk6CKH-Z6tu6tkw6BL6ipkMr9r4uIPkXCI_pqJLPd-NLoBMX2Lxwpz9grIXODO5WqDAOn5J0nJiVIdYRgUc5wjGcg_PesvZndm_f0ObCcYJcUcnNaAdu2vEBRantuuwsNyFc2i-xPOXdNw687rrL3oRtzUoqm3s8IETqN6a-dKlaS4L3sbhbEEQCwaQ6oA&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PZMkjz="NTkwZGE5MjktYTJjOC00MGMwLTg1MmUtZTBmZDZiYWZlNDNhOmM1NjI3MDc3LWQxN2EtNGFlMi1hODM4LTQ2MDQ0MWExYjA4YQ=="; MUID=19972F675CEA62CF0BD33A445D616317; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: 0nline1.fors3650com.siteConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://0nline1.fors3650com.site/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2F0ffice.fors3650com.site%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2F0ffice.fors3650com.site%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638654404594371122.YzRiMjU0N2MtNDI5NC00MDUwLTlhOWMtNDY4MjM0NGU5ZjM4OGNkOTM5YzktYzI3ZC00ZTM5LWI3NzEtOThjMTdhOGYwOWRm&ui_locales=en-US&mkt=en-US&client-request-id=a959a2c6-be90-4bbe-9620-b8571db25775&state=5RCrPRsiAriQ55RNojgGMOYvWQ7VLeP3N5DhSSnjZ0odIBnW0Gb3SI4r_o3LDWc3hQTdru7XJZVVsRMaZ1exiI6Gvk6CKH-Z6tu6tkw6BL6ipkMr9r4uIPkXCI_pqJLPd-NLoBMX2Lxwpz9grIXODO5WqDAOn5J0nJiVIdYRgUc5wjGcg_PesvZndm_f0ObCcYJcUcnNaAdu2vEBRantuuwsNyFc2i-xPOXdNw687rrL3oRtzUoqm3s8IETqN6a-dKlaS4L3sbhbEEQCwaQ6oA&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PZMkjz="NTkwZGE5MjktYTJjOC00MGMwLTg1MmUtZTBmZDZiYWZlNDNhOmM1NjI3MDc3LWQxN2EtNGFlMi1hODM4LTQ2MDQ0MWExYjA4YQ=="; MUID=19972F675CEA62CF0BD33A445D616317; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1
Source: global traffic	HTTP traffic detected: GET /ests/2.1/content/cdnbundles/converged.v2.login.min_nin8k2ycrbzww8zl5vxkaq2.css HTTP/1.1Host: e62d9665-590da929.fors3650com.siteConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://0nline1.fors3650com.sitesec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: styleReferer: https://0nline1.fors3650com.site/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/ConvergedLogin_PCore_QLF_8apNRJD3OCol8jwtxw2.js HTTP/1.1Host: e62d9665-590da929.fors3650com.siteConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://0nline1.fors3650com.sitesec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://0nline1.fors3650com.site/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ests/2.1/content/cdnbundles/ux.converged.login.strings-en.min_1yb3e7oii5t28dgo4xrtow2.js HTTP/1.1Host: e62d9665-590da929.fors3650com.siteConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://0nline1.fors3650com.sitesec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://0nline1.fors3650com.site/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /Me.htm?v=3 HTTP/1.1Host: l1ve.fors3650com.siteConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Purpose: prefetchSec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyReferer: https://0nline1.fors3650com.site/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PZMkjz="NTkwZGE5MjktYTJjOC00MGMwLTg1MmUtZTBmZDZiYWZlNDNhOmM1NjI3MDc3LWQxN2EtNGFlMi1hODM4LTQ2MDQ0MWExYjA4YQ=="; MUID=19972F675CEA62CF0BD33A445D616317
Source: global traffic	HTTP traffic detected: GET /ests/2.1/content/cdnbundles/ux.converged.login.strings-en.min_1yb3e7oii5t28dgo4xrtow2.js HTTP/1.1Host: e62d9665-590da929.fors3650com.siteConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PZMkjz="NTkwZGE5MjktYTJjOC00MGMwLTg1MmUtZTBmZDZiYWZlNDNhOmM1NjI3MDc3LWQxN2EtNGFlMi1hODM4LTQ2MDQ0MWExYjA4YQ=="; MUID=19972F675CEA62CF0BD33A445D616317
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/ConvergedLogin_PCore_QLF_8apNRJD3OCol8jwtxw2.js HTTP/1.1Host: e62d9665-590da929.fors3650com.siteConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PZMkjz="NTkwZGE5MjktYTJjOC00MGMwLTg1MmUtZTBmZDZiYWZlNDNhOmM1NjI3MDc3LWQxN2EtNGFlMi1hODM4LTQ2MDQ0MWExYjA4YQ=="; MUID=19972F675CEA62CF0BD33A445D616317
Source: global traffic	HTTP traffic detected: GET /590da929a2c840c0852ee0fd6bafe43a/ HTTP/1.1Host: 0nline1.fors3650com.siteConnection: UpgradePragma: no-cacheCache-Control: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Upgrade: websocketOrigin: https://0nline1.fors3650com.siteSec-WebSocket-Version: 13Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PZMkjz="NTkwZGE5MjktYTJjOC00MGMwLTg1MmUtZTBmZDZiYWZlNDNhOmM1NjI3MDc3LWQxN2EtNGFlMi1hODM4LTQ2MDQ0MWExYjA4YQ=="; MUID=19972F675CEA62CF0BD33A445D616317; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1Sec-WebSocket-Key: kozyIY4hE7Hp3WND07mDTg==Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico HTTP/1.1Host: e62d9665-590da929.fors3650com.siteConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://0nline1.fors3650com.site/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PZMkjz="NTkwZGE5MjktYTJjOC00MGMwLTg1MmUtZTBmZDZiYWZlNDNhOmM1NjI3MDc3LWQxN2EtNGFlMi1hODM4LTQ2MDQ0MWExYjA4YQ=="; MUID=19972F675CEA62CF0BD33A445D616317
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/asyncchunk/convergedlogin_pcustomizationloader_117b650bccea354984d8.js HTTP/1.1Host: e62d9665-590da929.fors3650com.siteConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://0nline1.fors3650com.site/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PZMkjz="NTkwZGE5MjktYTJjOC00MGMwLTg1MmUtZTBmZDZiYWZlNDNhOmM1NjI3MDc3LWQxN2EtNGFlMi1hODM4LTQ2MDQ0MWExYjA4YQ=="; MUID=19972F675CEA62CF0BD33A445D616317

Source: global traffic	DNS traffic detected: DNS query: 0nline1.fors3650com.site
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: 0ffice.fors3650com.site
Source: global traffic	DNS traffic detected: DNS query: ac83b9c7-590da929.fors3650com.site
Source: global traffic	DNS traffic detected: DNS query: 39540c2c-590da929.fors3650com.site
Source: global traffic	DNS traffic detected: DNS query: e62d9665-590da929.fors3650com.site
Source: global traffic	DNS traffic detected: DNS query: l1ve.fors3650com.site

Source: unknown

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Fri, 25 Oct 2024 08:07:45 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-Encodingcache-control: privatep3p: CP="DSP CUR OTPi IND OTRi ONL FIN"x-ms-request-id: 80a4afa2-b940-4c92-a7b0-e2486dac0301x-ms-ests-server: 2.1.19184.6 - SEC ProdSlicesreport-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://39540c2c-590da929.fors3650com.site/api/report?catId=GW+estsfd+SEC"}]}nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0}x-ms-srs: 1.Preferrer-policy: strict-origin-when-cross-originaccess-control-allow-origin: access-control-allow-headers:
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Fri, 25 Oct 2024 08:07:45 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-Encodingcache-control: privatep3p: CP="DSP CUR OTPi IND OTRi ONL FIN"x-ms-request-id: 9ea78ea6-5999-4ba2-8a31-9fe8e8190600x-ms-ests-server: 2.1.19267.5 - WEULR1 ProdSlicesreport-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://39540c2c-590da929.fors3650com.site/api/report?catId=GW+estsfd+SEC"}]}nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0}x-ms-srs: 1.Preferrer-policy: strict-origin-when-cross-originaccess-control-allow-origin: access-control-allow-headers:
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Fri, 25 Oct 2024 08:07:50 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-Encodingcache-control: privatep3p: CP="DSP CUR OTPi IND OTRi ONL FIN"x-ms-request-id: e2d8ba5b-e0be-44da-beef-c5ed69550a00x-ms-ests-server: 2.1.19267.5 - SEC ProdSlicesreport-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://39540c2c-590da929.fors3650com.site/api/report?catId=GW+estsfd+SEC"}]}nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0}x-ms-srs: 1.Preferrer-policy: strict-origin-when-cross-originaccess-control-allow-origin: access-control-allow-headers:

Source: chromecache_94.1.dr, chromecache_87.1.dr, chromecache_110.1.dr	String found in binary or memory: https://cloud.google.com/contact
Source: chromecache_94.1.dr, chromecache_87.1.dr, chromecache_110.1.dr	String found in binary or memory: https://cloud.google.com/recaptcha-enterprise/billing-information
Source: chromecache_94.1.dr, chromecache_87.1.dr, chromecache_110.1.dr	String found in binary or memory: https://developers.google.com/recaptcha/docs/faq#are-there-any-qps-or-daily-limits-on-my-use-of-reca
Source: chromecache_94.1.dr, chromecache_87.1.dr, chromecache_110.1.dr	String found in binary or memory: https://developers.google.com/recaptcha/docs/faq#localhost_support
Source: chromecache_94.1.dr, chromecache_87.1.dr, chromecache_110.1.dr	String found in binary or memory: https://developers.google.com/recaptcha/docs/faq#my-computer-or-network-may-be-sending-automated-que
Source: chromecache_110.1.dr	String found in binary or memory: https://play.google.com/log?format=json&hasfast=true
Source: chromecache_110.1.dr	String found in binary or memory: https://support.google.com/recaptcha
Source: chromecache_94.1.dr, chromecache_87.1.dr, chromecache_110.1.dr	String found in binary or memory: https://support.google.com/recaptcha#6262736
Source: chromecache_94.1.dr, chromecache_87.1.dr, chromecache_110.1.dr	String found in binary or memory: https://support.google.com/recaptcha/#6175971
Source: chromecache_94.1.dr, chromecache_87.1.dr, chromecache_110.1.dr	String found in binary or memory: https://support.google.com/recaptcha/?hl=en#6223828
Source: chromecache_94.1.dr, chromecache_87.1.dr, chromecache_86.1.dr, chromecache_110.1.dr, chromecache_97.1.dr	String found in binary or memory: https://www.google.com/recaptcha/api2/
Source: chromecache_94.1.dr, chromecache_87.1.dr, chromecache_110.1.dr	String found in binary or memory: https://www.gstatic.c..?/recaptcha/releases/-ZG7BC9TxCVEbzIO2m429usb/recaptcha__.
Source: chromecache_81.1.dr, chromecache_100.1.dr, chromecache_86.1.dr, chromecache_97.1.dr	String found in binary or memory: https://www.gstatic.com/recaptcha/releases/-ZG7BC9TxCVEbzIO2m429usb/recaptcha__en.js

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49699
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49698
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49701
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49699 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 49698 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49720 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49725 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.16:49727 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.16:49728 version: TLS 1.2

Source: classification engine

Classification label: mal64.phis.win@18/60@26/8

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Jump to behavior

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2144 --field-trial-handle=1956,i,15424997094793907970,14375061747430374650,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://0nline1.fors3650com.site/?NTMtNGYyOS1hNDc1LTA"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2144 --field-trial-handle=1956,i,15424997094793907970,14375061747430374650,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Google Drive.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Stores files to the Windows start menu directory

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

ID:	1541911
Product:	CloudBasic
Start time:	10:05:17
Start date:	25.10.2024
Cookbook:	defaultwindowsinteractivecookbook.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS

Windows Analysis Report
https://0nline1.fors3650com.site/?NTMtNGYyOS1hNDc1LTA

Overview

General Information

Detection

Signatures

Classification

Signatures

Phishing

Compliance

Networking

System Summary

Boot Survival

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Private

Contacted Domains

Contacted URLs

Windows Analysis Report https://0nline1.fors3650com.site/?NTMtNGYyOS1hNDc1LTA

Overview

General Information

Detection

Signatures

Classification

Signatures

Phishing

Compliance

Networking

System Summary

Boot Survival

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Private

Contacted Domains

Contacted URLs

Windows Analysis Report
https://0nline1.fors3650com.site/?NTMtNGYyOS1hNDc1LTA