Edit tour

Windows Analysis Report
Steelcase Series 1 Sustainable Office Chair _ Steelcase.html

Overview

General Information

Sample name:	Steelcase Series 1 Sustainable Office Chair _ Steelcase.html
Analysis ID:	1549473
MD5:	9f629ee5657dae365a3fa4828cf6f3bd
SHA1:	fdfe0c0b41c08cb4ddef74bb6303656ba0702573
SHA256:	1d6ac217624b64e51903fe8e2f542f06a4bfbd4cef1103b9c26a5351d356484a
Infos:

Detection

Score:	48
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

HTML Script injector detected

Suspicious Javascript code found in HTML file

Connects to many different domains

HTML page contains hidden javascript code

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

Suricata IDS alerts with low severity for network traffic

Uses insecure TLS / SSL version for HTTPS connection

Classification

Process Tree

System is w10x64

chrome.exe (PID: 5024 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "C:\Users\user\Desktop\Steelcase Series 1 Sustainable Office Chair _ Steelcase.html" MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 1432 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2504 --field-trial-handle=2388,i,9393863483358580948,12841882409429940968,262144 /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

cleanup

Suricata Signatures

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-05T16:36:08.689408+0100	2022930	1	A Network Trojan was detected	20.109.210.53	443	192.168.2.6	49778	TCP
2024-11-05T16:36:47.040303+0100	2022930	1	A Network Trojan was detected	20.109.210.53	443	192.168.2.6	50088	TCP

HTTP traffic detected: POST /ccm/collect?en=page_view&dl=file%3A%2F%2F%2FC%3A%2FUsers%2Fuser%2FDesktop%2FSteelcase%2520Series%25201%2520Sustainable%2520Office%2520Chair%2520_%2520Steelcase.html&scrsrc=www.googletagmanager.com&frm=0&rnd=1435847159.1730820967&npa=0&gtm=45be4au0v885279790za200&gcd=13l3l3l3l1l1&dma=0&tag_exp=101823848~101878899~101878944~101925629&tft=1730820966797&tfd=4895&apve=1 HTTP/1.1Host: www.google.comConnection: keep-aliveContent-Length: 0sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Origin: nullX-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlKHLAQj6mM0BCIWgzQEIucrNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: Steelcase Series 1 Sustainable Office Chair _ Steelcase.html	HTTP Parser: document.write
Source: Steelcase Series 1 Sustainable Office Chair _ Steelcase.html	HTTP Parser: location.href
Source: Steelcase Series 1 Sustainable Office Chair _ Steelcase.html	HTTP Parser: .location
Source: Steelcase Series 1 Sustainable Office Chair _ Steelcase.html	HTTP Parser: .location
Source: Steelcase Series 1 Sustainable Office Chair _ Steelcase.html	HTTP Parser: Combo hit

Source: file:///C:/Users/user/Desktop/Steelcase%20Series%201%20Sustainable%20Office%20Chair%20_%20Steelcase.html	HTTP Parser: No favicon
Source: https://www.steelcase.com/countries/	HTTP Parser: No favicon
Source: https://www.steelcase.com/countries/	HTTP Parser: No favicon
Source: https://www.steelcase.com/countries/	HTTP Parser: No favicon
Source: https://www.steelcase.com/countries/	HTTP Parser: No favicon
Source: https://www.steelcase.com/countries/	HTTP Parser: No favicon
Source: https://www.steelcase.com/countries/	HTTP Parser: No favicon
Source: https://www.steelcase.com/countries/	HTTP Parser: No favicon
Source: https://www.steelcase.com/countries/	HTTP Parser: No favicon
Source: https://www.steelcase.com/countries/	HTTP Parser: No favicon

Source: unknown	HTTPS traffic detected: 40.113.103.199:443 -> 192.168.2.6:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.253.45:443 -> 192.168.2.6:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.6:49778 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.6:49797 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.6:49807 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:49833 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.253.45:443 -> 192.168.2.6:49863 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.253.45:443 -> 192.168.2.6:49862 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.253.45:443 -> 192.168.2.6:49860 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.253.45:443 -> 192.168.2.6:49859 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.253.45:443 -> 192.168.2.6:49861 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.6:50088 version: TLS 1.2

Source: Joe Sandbox View	IP Address: 151.101.0.84 151.101.0.84
Source: Joe Sandbox View	IP Address: 104.18.137.17 104.18.137.17
Source: Joe Sandbox View	IP Address: 151.101.130.137 151.101.130.137
Source: Joe Sandbox View	IP Address: 151.101.130.137 151.101.130.137

Source: Joe Sandbox View	JA3 fingerprint: 1138de370e523e824bbca92d049a3777
Source: Joe Sandbox View	JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4
Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 20.109.210.53:443 -> 192.168.2.6:49778
Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 20.109.210.53:443 -> 192.168.2.6:50088

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.22
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.22
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.22
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.22
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: Steelcase Series 1 Sustainable Office Chair _ Steelcase.html, chromecache_390.2.dr	String found in binary or memory: <li id="menu-item-705" class="facebook menu-item menu-item-type-custom menu-item-object-custom menu-item-705"><a target="_blank" rel="noopener" href="https://www.facebook.com/Steelcase" itemprop="sameAs">Facebook</a></li> equals www.facebook.com (Facebook)
Source: Steelcase Series 1 Sustainable Office Chair _ Steelcase.html, chromecache_390.2.dr	String found in binary or memory: <li id="menu-item-706" class="linkedin menu-item menu-item-type-custom menu-item-object-custom menu-item-706"><a target="_blank" rel="noopener" href="https://www.linkedin.com/company/steelcase" itemprop="sameAs">LinkedIn</a></li> equals www.linkedin.com (Linkedin)
Source: Steelcase Series 1 Sustainable Office Chair _ Steelcase.html, chromecache_390.2.dr	String found in binary or memory: <li id="menu-item-709" class="youtube menu-item menu-item-type-custom menu-item-object-custom menu-item-709"><a target="_blank" rel="noopener" href="https://www.youtube.com/@steelcase" itemprop="sameAs">YouTube</a></li> equals www.youtube.com (Youtube)
Source: chromecache_615.2.dr	String found in binary or memory: <li id="menu-item-75" class="facebook menu-item menu-item-type-custom menu-item-object-custom menu-item-75"><a target="_blank" rel="noopener" href="https://www.facebook.com/steelcase.emea" itemprop="sameAs">Facebook</a></li> equals www.facebook.com (Facebook)
Source: chromecache_615.2.dr	String found in binary or memory: <li id="menu-item-76" class="linkedin menu-item menu-item-type-custom menu-item-object-custom menu-item-76"><a target="_blank" rel="noopener" href="https://www.linkedin.com/company/steelcase" itemprop="sameAs">LinkedIn</a></li> equals www.linkedin.com (Linkedin)
Source: chromecache_615.2.dr	String found in binary or memory: <li id="menu-item-80" class="youtube menu-item menu-item-type-custom menu-item-object-custom menu-item-80"><a target="_blank" rel="noopener" href="https://www.youtube.com/user/STEELCASETV" itemprop="sameAs">Youtube</a></li> equals www.youtube.com (Youtube)
Source: chromecache_615.2.dr	String found in binary or memory: <meta property="article:publisher" content="https://www.facebook.com/Steelcase.France?fref=ts" /> equals www.facebook.com (Facebook)
Source: Steelcase Series 1 Sustainable Office Chair _ Steelcase.html	String found in binary or memory: //_satellite.loadScript('//www.youtube.com/iframe_api', function () { equals www.youtube.com (Youtube)
Source: Steelcase Series 1 Sustainable Office Chair _ Steelcase.html	String found in binary or memory: _sdi.util.loadScript('//www.youtube.com/iframe_api', function(){ equals www.youtube.com (Youtube)
Source: chromecache_437.2.dr	String found in binary or memory: comme un domaine principalement de suivi / ciblage.","patternKey":null,"thirdPartyKey":"Cookie\|linkedin.com","firstPartyKey":"","DurationType":1,"category":null,"isThirdParty":false}]},{"HostName":"www.facebook.com","DisplayName":"www.facebook.com","HostId":"H9","Description":"","PrivacyPolicy":"","Cookies":[{"id":"1988dba1-e4b6-44c7-ad72-dc4a26b1fb14","Name":"","Host":"www.facebook.com","IsSession":true,"Length":"0","description":"This domain is owned by Facebook, which is the world's largest social networking service. As a third party host provider, it mostly collects data on the interests of users via widgets such as the 'Like' button found on many websites. This is used to serve targeted advertising to its users when logged into its services. In 2014 it also started serving up behaviourally targeted advertising on other websites, similar to most dedicated online marketing companies.","thirdPartyDescription":"This domain is owned by Facebook, which is the world's largest social networking service. As a third party host provider, it mostly collects data on the interests of users via widgets such as the 'Like' button found on many websites. This is used to serve targeted advertising to its users when logged into its services. In 2014 it also started serving up behaviourally targeted advertising on other websites, similar to most dedicated online marketing companies.","patternKey":null,"thirdPartyKey":"Cookie\|www.facebook.com","firstPartyKey":null,"DurationType":1,"category":null,"isThirdParty":false}]},{"HostName":"www.steelcase.com","DisplayName":"www.steelcase.com","HostId":"H36","Description":"","PrivacyPolicy":"","Cookies":[{"id":"64120b6f-2c9f-4c4d-95db-4b2092504f22","Name":"check","Host":"www.steelcase.com","IsSession":false,"Length":"0","description":"","thirdPartyDescription":"","patternKey":null,"thirdPartyKey":null,"firstPartyKey":null,"DurationType":1,"category":null,"isThirdParty":false}]},{"HostName":"zoominfo.com","DisplayName":"zoominfo.com","HostId":"H77","Description":"","PrivacyPolicy":"","Cookies":[{"id":"bb37c5a8-7115-49ca-adb7-3accb59d42c7","Name":"__cf_bm","Host":"zoominfo.com","IsSession":false,"Length":"0","description":"This is a CloudFoundry cookie","thirdPartyDescription":"This is a CloudFoundry cookie","patternKey":"_cf_bm","thirdPartyKey":"Pattern\|_cf_bm","firstPartyKey":"Cookie__cf_bm,Pattern\|_cf_bm","DurationType":1,"category":null,"isThirdParty":false},{"id":"5c26a939-1d1d-482c-aeee-617e774b2a16","Name":"_cfuvid","Host":"zoominfo.com","IsSession":true,"Length":"0","description":"Testing","thirdPartyDescription":"Testing","patternKey":null,"thirdPartyKey":"Cookie\|zoominfo.com","firstPartyKey":null,"DurationType":1,"category":null,"isThirdParty":false}]},{"HostName":"bidr.io","DisplayName":"bidr.io","HostId":"H23","Description":"","PrivacyPolicy":"","Cookies":[{"id":"80af5c95-bcc2-4d78-b8c1-77532e56c59e","Name":"checkForPermission","Host":"bidr.io","IsSession":false,"Length":"0","description":"Ce domaine semb
Source: chromecache_437.2.dr	String found in binary or memory: fournit une gamme de technologies et de services de marketing et de vente en ligne.","patternKey":null,"thirdPartyKey":"Cookie\|hsforms.com","firstPartyKey":null,"DurationType":1,"category":null,"isThirdParty":false}]},{"HostName":"hsforms.net","DisplayName":"hsforms.net","HostId":"H30","Description":"","PrivacyPolicy":"","Cookies":[{"id":"019019d7-853b-7ca3-9b5a-e331a7295ba2","Name":"__cf_bm","Host":"hsforms.net","IsSession":false,"Length":"0","description":"This is a CloudFoundry cookie","thirdPartyDescription":"This is a CloudFoundry cookie","patternKey":"_cf_bm","thirdPartyKey":"Pattern\|_cf_bm","firstPartyKey":"Cookie__cf_bm,Pattern\|_cf_bm","DurationType":1,"category":null,"isThirdParty":false}]},{"HostName":"www.youtube.com","DisplayName":"www.youtube.com","HostId":"H121","Description":"","PrivacyPolicy":"","Cookies":[{"id":"4ce59cd7-728b-415d-acd8-e53c6e679713","Name":"TESTCOOKIESENABLED","Host":"www.youtube.com","IsSession":false,"Length":"0","description":"YouTube is a Google owned platform for hosting and sharing videos. YouTube collects user data through videos embedded in websites, which is aggregated with profile data from other Google services in order to display targeted advertising to web visitors across a broad range of their own and other websites.","thirdPartyDescription":"YouTube is a Google owned platform for hosting and sharing videos. YouTube collects user data through videos embedded in websites, which is aggregated with profile data from other Google services in order to display targeted advertising to web visitors across a broad range of their own and other websites.","patternKey":null,"thirdPartyKey":"Cookie\|www.youtube.com","firstPartyKey":null,"DurationType":1,"category":null,"isThirdParty":false}]},{"HostName":"c.bing.com","DisplayName":"c.bing.com","HostId":"H46","Description":"","PrivacyPolicy":"","Cookies":[{"id":"cde3c4c3-5973-4e1e-9d58-25f25f7f672e","Name":"SRM_B","Host":"c.bing.com","IsSession":false,"Length":"389","description":"Ce domaine appartient equals www.youtube.com (Youtube)
Source: Steelcase Series 1 Sustainable Office Chair _ Steelcase.html	String found in binary or memory: <p><a class="button-dark" href="https://www.youtube.com/watch?v=svXI9tWZIKU" target="_blank" rel="noopener">Watch Video</a></p> equals www.youtube.com (Youtube)
Source: chromecache_544.2.dr, chromecache_351.2.dr, chromecache_398.2.dr, chromecache_540.2.dr, chromecache_628.2.dr	String found in binary or memory: Math.round(q);t["gtm.videoElapsedTime"]=Math.round(f);t["gtm.videoPercent"]=r;t["gtm.videoVisible"]=u;return t},rk:function(){e=pb()},zd:function(){d()}}};var Yb=ka(["data-gtm-yt-inspected-"]),nD=["www.youtube.com","www.youtube-nocookie.com"],oD,pD=!1; equals www.youtube.com (Youtube)
Source: chromecache_428.2.dr, chromecache_408.2.dr, chromecache_555.2.dr, chromecache_542.2.dr, chromecache_648.2.dr	String found in binary or memory: c?"runIfCanceled":"runIfUncanceled",[]);if(!g.length)return!0;var k=UA(a,c,e);S(121);if(k["gtm.elementUrl"]==="https://www.facebook.com/tr/")return S(122),!0;if(d&&f){for(var m=Ab(b,g.length),n=0;n<g.length;++n)g[n](k,m);return m.done}for(var p=0;p<g.length;++p)g[p](k,function(){});return!0},XA=function(){var a=[],b=function(c){return db(a,function(d){return d.form===c})};return{store:function(c,d){var e=b(c);e?e.button=d:a.push({form:c,button:d})},get:function(c){var d=b(c);return d?d.button:null}}}, equals www.facebook.com (Facebook)
Source: chromecache_595.2.dr	String found in binary or memory: function X(a,b){this.v={};this.playerInfo={};this.videoTitle="";this.j=this.g=null;this.h=0;this.m=!1;this.l=[];this.i=null;this.A={};this.options=null;if(!a)throw Error("YouTube player element ID required.");this.id=qa(this);b=Object.assign({title:"video player",videoId:"",width:640,height:360},b\|\|{});var c=document;if(a=typeof a==="string"?c.getElementById(a):a){W.yt_embedsEnableRsaforFromIframeApi&&tb();c=a.tagName.toLowerCase()==="iframe";b.host\|\|(b.host=c?mb(a.src):"https://www.youtube.com");this.options= equals www.youtube.com (Youtube)
Source: chromecache_595.2.dr	String found in binary or memory: function tb(){var a=new rb,b=["https://www.youtube.com"];b=b===void 0?qb:b;oa(function(c){switch(c.g){case 1:return C(c,sb(),2);case 2:if(!c.m){c.g=3;break}return C(c,Promise.all(b.map(function(d){var g;return oa(function(k){if(k.g==1)return k.l=2,C(k,navigator.permissions.query({name:"top-level-storage-access",requestedOrigin:d}),4);k.g!=2?(g=k.m,g.state==="prompt"&&a.g.push(d),k.g=0,k.l=0):(k.l=0,k.i=null,k.g=0)})})),4); equals www.youtube.com (Youtube)
Source: chromecache_544.2.dr, chromecache_351.2.dr, chromecache_398.2.dr, chromecache_540.2.dr, chromecache_628.2.dr	String found in binary or memory: if(!(e\|\|f\|\|g\|\|k.length\|\|m.length))return;var p={Ah:e,yh:f,zh:g,ii:k,ji:m,Qe:n,Ib:b},q=C.YT;if(q)return q.ready&&q.ready(d),b;var r=C.onYouTubeIframeAPIReady;C.onYouTubeIframeAPIReady=function(){r&&r();d()};G(function(){for(var u=E.getElementsByTagName("script"),v=u.length,t=0;t<v;t++){var w=u[t].getAttribute("src");if(yD(w,"iframe_api")\|\|yD(w,"player_api"))return b}for(var x=E.getElementsByTagName("iframe"),y=x.length,A=0;A<y;A++)if(!pD&&wD(x[A],p.Qe))return oc("https://www.youtube.com/iframe_api"), equals www.youtube.com (Youtube)
Source: chromecache_721.2.dr, chromecache_677.2.dr, chromecache_428.2.dr, chromecache_321.2.dr, chromecache_452.2.dr, chromecache_408.2.dr, chromecache_555.2.dr, chromecache_542.2.dr, chromecache_648.2.dr, chromecache_482.2.dr	String found in binary or memory: return b}lD.F="internal.enableAutoEventOnTimer";var Yb=ka(["data-gtm-yt-inspected-"]),nD=["www.youtube.com","www.youtube-nocookie.com"],oD,pD=!1; equals www.youtube.com (Youtube)
Source: chromecache_343.2.dr	String found in binary or memory: return function(a,b,c,d){var e={exports:{}};e.exports;(function(){"use strict";var b=f.getFbeventsModules("signalsFBEventsGetTier"),c=d();function d(){try{if(a.trustedTypes&&a.trustedTypes.createPolicy){var b=a.trustedTypes;return b.createPolicy("facebook.com/signals/iwl",{createScriptURL:function(a){var b=new URL(a);b=b.hostname.endsWith(".facebook.com")&&b.pathname=="/signals/iwl.js";if(!b)throw new Error("Disallowed script URL");return a}})}}catch(a){}return null}e.exports=function(a,d){d=b(d);d=d==null?"www.facebook.com":"www."+d+".facebook.com";d="https://"+d+"/signals/iwl.js?pixel_id="+a;if(c!=null)return c.createScriptURL(d);else return d}})();return e.exports}(a,b,c,d)}); equals www.facebook.com (Facebook)
Source: chromecache_343.2.dr	String found in binary or memory: return function(f,b,c,d){var e={exports:{}};e.exports;(function(){"use strict";var a=/^https:\/\/www\.([A-Za-z0-9\.]+)\.facebook\.com\/tr\/?$/,b=["https://www.facebook.com/tr","https://www.facebook.com/tr/"];e.exports=function(c){if(b.indexOf(c)!==-1)return null;var d=a.exec(c);if(d==null)throw new Error("Malformed tier: "+c);return d[1]}})();return e.exports}(a,b,c,d)}); equals www.facebook.com (Facebook)
Source: chromecache_343.2.dr	String found in binary or memory: return function(f,g,h,i){var j={exports:{}};j.exports;(function(){"use strict";var a={ENDPOINT:"https://www.facebook.com/tr/",INSTAGRAM_TRIGGER_ATTRIBUTION:"https://www.instagram.com/tr/",AEM_ENDPOINT:"https://www.facebook.com/.well-known/aggregated-event-measurement/",GPS_ENDPOINT:"https://www.facebook.com/privacy_sandbox/pixel/register/trigger/",TOPICS_API_ENDPOINT:"https://www.facebook.com/privacy_sandbox/topics/registration/"};j.exports=a})();return j.exports}(a,b,c,d)}); equals www.facebook.com (Facebook)
Source: chromecache_437.2.dr	String found in binary or memory: sultats publicitaires des podcasts Hubspots.","patternKey":null,"thirdPartyKey":"","firstPartyKey":"Cookie__pdst","DurationType":1,"category":null,"isThirdParty":false}]},{"HostName":"www.linkedin.com","DisplayName":"www.linkedin.com","HostId":"H16","Description":"","PrivacyPolicy":"","Cookies":[{"id":"44d9eb2f-d446-432a-961a-eaf8802a93f7","Name":"bscookie","Host":"www.linkedin.com","IsSession":false,"Length":"730","description":"This domain is owned by LinkedIn, the business networking platform. It typically acts as a third party host where website owners have placed one of its content sharing buttons in their pages, although its content and services can be embedded in other ways. Although such buttons add functionality to the website they are on, cookies are set regardless of whether or not the visitor has an active Linkedin profile, or agreed to their terms and conditions. For this reason it is classified as a primarily tracking/targeting domain.","thirdPartyDescription":"This domain is owned by LinkedIn, the business networking platform. It typically acts as a third party host where website owners have placed one of its content sharing buttons in their pages, although its content and services can be embedded in other ways. Although such buttons add functionality to the website they are on, cookies are set regardless of whether or not the visitor has an active Linkedin profile, or agreed to their terms and conditions. For this reason it is classified as a primarily tracking/targeting domain.","patternKey":null,"thirdPartyKey":"Cookie\|www.linkedin.com","firstPartyKey":"Cookiebscookie","DurationType":1,"category":null,"isThirdParty":false}]},{"HostName":"hubspot.com","DisplayName":"hubspot.com","HostId":"H2","Description":"","PrivacyPolicy":"","Cookies":[{"id":"e3099ce0-f66f-495a-b9a3-91031508fa9b","Name":"_cfuvid","Host":"hubspot.com","IsSession":false,"Length":"364","description":"Ce domaine appartient equals www.linkedin.com (Linkedin)
Source: chromecache_428.2.dr, chromecache_408.2.dr, chromecache_555.2.dr, chromecache_542.2.dr, chromecache_648.2.dr	String found in binary or memory: var AC=function(a,b,c,d,e){var f=rA("fsl",c?"nv.mwt":"mwt",0),g;g=c?rA("fsl","nv.ids",[]):rA("fsl","ids",[]);if(!g.length)return!0;var k=wA(a,"gtm.formSubmit",g),m=a.action;m&&m.tagName&&(m=a.cloneNode(!1).action);S(121);if(m==="https://www.facebook.com/tr/")return S(122),!0;k["gtm.elementUrl"]=m;k["gtm.formCanceled"]=c;a.getAttribute("name")!=null&&(k["gtm.interactedFormName"]=a.getAttribute("name"));e&&(k["gtm.formSubmitElement"]=e,k["gtm.formSubmitElementText"]=e.value);if(d&&f){if(!dz(k,fz(b, equals www.facebook.com (Facebook)
Source: chromecache_607.2.dr	String found in binary or memory: var scriptUrl = 'https:\/\/www.youtube.com\/s\/player\/4e23410d\/www-widgetapi.vflset\/www-widgetapi.js';try{var ttPolicy=window.trustedTypes.createPolicy("youtube-widget-api",{createScriptURL:function(x){return x}});scriptUrl=ttPolicy.createScriptURL(scriptUrl)}catch(e){}var YT;if(!window["YT"])YT={loading:0,loaded:0};var YTConfig;if(!window["YTConfig"])YTConfig={"host":"https://www.youtube.com"}; equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: www.steelcase.com
Source: global traffic	DNS traffic detected: DNS query: widget-cart.materialbank.com
Source: global traffic	DNS traffic detected: DNS query: dumy1g3ng547g.cloudfront.net
Source: global traffic	DNS traffic detected: DNS query: images.steelcase.com
Source: global traffic	DNS traffic detected: DNS query: www.datadoghq-browser-agent.com
Source: global traffic	DNS traffic detected: DNS query: www.googleoptimize.com
Source: global traffic	DNS traffic detected: DNS query: s.w.org
Source: global traffic	DNS traffic detected: DNS query: widget.cloudinary.com
Source: global traffic	DNS traffic detected: DNS query: configurator.steelcase.com
Source: global traffic	DNS traffic detected: DNS query: admin-fts.threekit.com
Source: global traffic	DNS traffic detected: DNS query: w.usabilla.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: googleads.g.doubleclick.net
Source: global traffic	DNS traffic detected: DNS query: td.doubleclick.net
Source: global traffic	DNS traffic detected: DNS query: cdn.cookielaw.org
Source: global traffic	DNS traffic detected: DNS query: assets.adobedtm.com
Source: global traffic	DNS traffic detected: DNS query: geolocation.onetrust.com
Source: global traffic	DNS traffic detected: DNS query: cpat.steelcase.com
Source: global traffic	DNS traffic detected: DNS query: upload-widget.cloudinary.com
Source: global traffic	DNS traffic detected: DNS query: api.ipify.org
Source: global traffic	DNS traffic detected: DNS query: api.ipapi.com
Source: global traffic	DNS traffic detected: DNS query: rum-http-intake.logs.datadoghq.com
Source: global traffic	DNS traffic detected: DNS query: log.pinterest.com
Source: global traffic	DNS traffic detected: DNS query: steelcase-privacy.my.onetrust.com
Source: global traffic	DNS traffic detected: DNS query: dpm.demdex.net
Source: global traffic	DNS traffic detected: DNS query: ws.zoominfo.com
Source: global traffic	DNS traffic detected: DNS query: snap.licdn.com
Source: global traffic	DNS traffic detected: DNS query: js.hs-analytics.net
Source: global traffic	DNS traffic detected: DNS query: steelcase.demdex.net
Source: global traffic	DNS traffic detected: DNS query: metrics.steelcase.com
Source: global traffic	DNS traffic detected: DNS query: s.pinimg.com
Source: global traffic	DNS traffic detected: DNS query: static.oktopost.com
Source: global traffic	DNS traffic detected: DNS query: www.youtube.com
Source: global traffic	DNS traffic detected: DNS query: static.hotjar.com
Source: global traffic	DNS traffic detected: DNS query: px.ads.linkedin.com
Source: global traffic	DNS traffic detected: DNS query: cm.everesttech.net
Source: global traffic	DNS traffic detected: DNS query: tags.clickagy.com
Source: global traffic	DNS traffic detected: DNS query: js.adsrvr.org
Source: global traffic	DNS traffic detected: DNS query: aorta.clickagy.com
Source: global traffic	DNS traffic detected: DNS query: hemsync.clickagy.com
Source: global traffic	DNS traffic detected: DNS query: www.linkedin.com
Source: global traffic	DNS traffic detected: DNS query: okt.to
Source: global traffic	DNS traffic detected: DNS query: cdn.pdst.fm
Source: global traffic	DNS traffic detected: DNS query: ct.pinterest.com
Source: global traffic	DNS traffic detected: DNS query: pixels.spotify.com
Source: global traffic	DNS traffic detected: DNS query: us-u.openx.net
Source: global traffic	DNS traffic detected: DNS query: js-na1.hs-scripts.com
Source: global traffic	DNS traffic detected: DNS query: track.hubspot.com
Source: global traffic	DNS traffic detected: DNS query: insight.adsrvr.org
Source: global traffic	DNS traffic detected: DNS query: js.hsleadflows.net
Source: global traffic	DNS traffic detected: DNS query: js.hubspot.com
Source: global traffic	DNS traffic detected: DNS query: js.hsadspixel.net
Source: global traffic	DNS traffic detected: DNS query: js.hs-banner.com
Source: global traffic	DNS traffic detected: DNS query: match.adsrvr.org
Source: global traffic	DNS traffic detected: DNS query: cta-service-cms2.hubspot.com
Source: global traffic	DNS traffic detected: DNS query: api.hubapi.com
Source: global traffic	DNS traffic detected: DNS query: perf-na1.hsforms.com
Source: global traffic	DNS traffic detected: DNS query: pixel.rubiconproject.com
Source: global traffic	DNS traffic detected: DNS query: ib.adnxs.com
Source: global traffic	DNS traffic detected: DNS query: cm.g.doubleclick.net
Source: global traffic	DNS traffic detected: DNS query: forms.hubspot.com
Source: global traffic	DNS traffic detected: DNS query: code.jquery.com
Source: global traffic	DNS traffic detected: DNS query: connect.facebook.net
Source: global traffic	DNS traffic detected: DNS query: b4nhq3u8yn.us-west-2.awsapprunner.com
Source: global traffic	DNS traffic detected: DNS query: www.facebook.com
Source: global traffic	DNS traffic detected: DNS query: steelcase-res.cloudinary.com
Source: global traffic	DNS traffic detected: DNS query: d2mtu7swxcf684.cloudfront.net

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not Founddate: Tue, 05 Nov 2024 15:37:08 GMTserver: envoyContent-Length: 0strict-transport-security: max-age=31536000x-content-type-options: nosniffVia: HTTP/2 edgeproxy, 1.1 googleAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not Founddate: Tue, 05 Nov 2024 15:37:29 GMTserver: envoyContent-Length: 0strict-transport-security: max-age=31536000x-content-type-options: nosniffVia: HTTP/2 edgeproxy, 1.1 googleAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Connection: close

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "C:\Users\user\Desktop\Steelcase Series 1 Sustainable Office Chair _ Steelcase.html"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2504 --field-trial-handle=2388,i,9393863483358580948,12841882409429940968,262144 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2504 --field-trial-handle=2388,i,9393863483358580948,12841882409429940968,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	1 Process Injection	1 Process Injection	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	4 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	5 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	3 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Source	Detection	Scanner	Label
https://dumy1g3ng547g.cloudfront.net/content/plugins/events-calendar-pro/src/resources/css/tribe-events-pro-mini-calendar-block.min.css?ver=5.13.0	0%	Avira URL Cloud	safe
https://metrics.steelcase.com/id?d_visid_ver=5.5.0&d_fieldgroup=A&mcorgid=F0F10C735475E8D10A4C98A4%40AdobeOrg&mid=63035469441787979282254228121187811956&ts=1730821015469	0%	Avira URL Cloud	safe
https://dumy1g3ng547g.cloudfront.net/content/themes/steelcase/css/archives-old.min.css?ver=888e8e301	0%	Avira URL Cloud	safe
http://store.steelcase.com/	0%	Avira URL Cloud	safe
https://dumy1g3ng547g.cloudfront.net/content/themes/steelcase/img/logos/orangebox-hover.png	0%	Avira URL Cloud	safe
https://images.steelcase.com/image/upload/v1667986016/22-0185122.jpg	0%	Avira URL Cloud	safe
https://images.steelcase.com/image/upload/v1653061674/21-0169102_1x1.jpg	0%	Avira URL Cloud	safe
https://images.steelcase.com/image/upload/v1652359538/22-0176276-scaled.jpg	0%	Avira URL Cloud	safe
https://dumy1g3ng547g.cloudfront.net/content/themes/steelcase/img/logos/steelcase-hover.png	0%	Avira URL Cloud	safe
https://dumy1g3ng547g.cloudfront.net/content/plugins/revslider/public/assets/css/rs6.css?ver=6.6.10	0%	Avira URL Cloud	safe
https://cpat.steelcase.com/slideout/js/anchor-scroll.min.js	0%	Avira URL Cloud	safe
https://cpat.steelcase.com/js/sf-usabilla.min.js	0%	Avira URL Cloud	safe
https://cpat.steelcase.com/test/page-podcast-fix.min.js	0%	Avira URL Cloud	safe
https://dumy1g3ng547g.cloudfront.net/content/themes/steelcase/img/logos/coalesse-hover.png	0%	Avira URL Cloud	safe
https://cpat.steelcase.com/new-notable-winter-2023/js/new-notable-winter-2023-scripts-inject.min.js	0%	Avira URL Cloud	safe
https://dumy1g3ng547g.cloudfront.net/content/themes/steelcase/img/logos/viccarbe.png	0%	Avira URL Cloud	safe
https://dumy1g3ng547g.cloudfront.net/eu-fr/wp-includes/css/dist/block-library/style.min.css?ver=6.4.3	0%	Avira URL Cloud	safe
https://dumy1g3ng547g.cloudfront.net/content/themes/steelcase/img/logos/smith-system.png	0%	Avira URL Cloud	safe
https://dumy1g3ng547g.cloudfront.net/content/themes/steelcase/css/print.min.css?ver=888e8e3019d9f036	0%	Avira URL Cloud	safe
https://projects.steelcase.com/	0%	Avira URL Cloud	safe
https://images.steelcase.com/image/upload/v1718702539/24-0229087.jpg	0%	Avira URL Cloud	safe
https://store.steelcase.com/	0%	Avira URL Cloud	safe
https://dumy1g3ng547g.cloudfront.net/content/themes/steelcase/js/slick.min.js?ver=888e8e3019d9f0361d	0%	Avira URL Cloud	safe
https://cpat.steelcase.com/slideout/js/anchor-injects.min.js	0%	Avira URL Cloud	safe
https://images.steelcase.com/image/upload/c_fill,q_auto,f_auto,h_900,w_1600/v1590008013/www.steelcase.com/2020/05/20/20-0140283.jpg	0%	Avira URL Cloud	safe
https://images.steelcase.com/image/upload/c_fill,q_auto,f_auto,h_900,w_1600/v1590008017/www.steelcase.com/2020/05/20/20-0140284.jpg	0%	Avira URL Cloud	safe
https://dumy1g3ng547g.cloudfront.net/content/themes/steelcase/img/logos/steelcase.png	0%	Avira URL Cloud	safe
https://dumy1g3ng547g.cloudfront.net/content/themes/steelcase/js/modernizr.min.js?ver=888e8e3019d9f0	0%	Avira URL Cloud	safe
https://dumy1g3ng547g.cloudfront.net/content/themes/steelcase/img/logos/amq.png	0%	Avira URL Cloud	safe

Name	Malicious	Antivirus Detection	Reputation
https://dumy1g3ng547g.cloudfront.net/content/themes/steelcase/img/logos/orangebox-hover.png	false	Avira URL Cloud: safe	unknown
https://images.steelcase.com/image/upload/v1667986016/22-0185122.jpg	false	Avira URL Cloud: safe	unknown
https://metrics.steelcase.com/id?d_visid_ver=5.5.0&d_fieldgroup=A&mcorgid=F0F10C735475E8D10A4C98A4%40AdobeOrg&mid=63035469441787979282254228121187811956&ts=1730821015469	false	Avira URL Cloud: safe	unknown
https://static.oktopost.com/oktrk.js	false		high
https://dumy1g3ng547g.cloudfront.net/content/plugins/events-calendar-pro/src/resources/css/tribe-events-pro-mini-calendar-block.min.css?ver=5.13.0	false	Avira URL Cloud: safe	unknown
https://cdn.cookielaw.org/consent/3bb64076-fbe2-46f6-8225-e256883b99d1/3bb64076-fbe2-46f6-8225-e256883b99d1.json	false		high
https://images.steelcase.com/image/upload/v1652359538/22-0176276-scaled.jpg	false	Avira URL Cloud: safe	unknown
https://dumy1g3ng547g.cloudfront.net/content/themes/steelcase/img/logos/steelcase-hover.png	false	Avira URL Cloud: safe	unknown
https://dumy1g3ng547g.cloudfront.net/content/plugins/revslider/public/assets/css/rs6.css?ver=6.6.10	false	Avira URL Cloud: safe	unknown
https://rum-http-intake.logs.datadoghq.com/v1/input/pub7f170ab8c7381319ef634471d8c6d0a7?ddsource=browser&ddtags=sdk_version%3A2.18.0%2Cenv%3APRODUCTION%2Cservice%3Asteelcase.com%2Cversion%3A2024.09.03.08.24&batch_time=1730821019982	false		high
https://cpat.steelcase.com/slideout/js/anchor-scroll.min.js	false	Avira URL Cloud: safe	unknown
https://js.adsrvr.org/up_loader.1.1.0.js	false		high
https://www.steelcase.com/content/plugins/revslider/public/assets/assets/dummy.png	false		high
https://cpat.steelcase.com/js/sf-usabilla.min.js	false	Avira URL Cloud: safe	unknown
https://cpat.steelcase.com/test/page-podcast-fix.min.js	false	Avira URL Cloud: safe	unknown
https://dumy1g3ng547g.cloudfront.net/content/themes/steelcase/img/logos/coalesse-hover.png	false	Avira URL Cloud: safe	unknown
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%253a%252f%252fmatch.adsrvr.org%252ftrack%252fcmf%252fappnexus%253fttd%253d1%2526anid%253d%2524UID%26ttd_tdid%3D29e037a6-84aa-4055-8ca6-ada34db320b9	false		high
https://cdn.cookielaw.org/consent/3bb64076-fbe2-46f6-8225-e256883b99d1/0191522f-b9d5-7498-ab87-554276bc4254/en.json	false		high
https://cpat.steelcase.com/new-notable-winter-2023/js/new-notable-winter-2023-scripts-inject.min.js	false	Avira URL Cloud: safe	unknown
https://images.steelcase.com/image/upload/v1718702539/24-0229087.jpg	false	Avira URL Cloud: safe	unknown
https://dumy1g3ng547g.cloudfront.net/content/themes/steelcase/img/logos/viccarbe.png	false	Avira URL Cloud: safe	unknown
https://rum-http-intake.logs.datadoghq.com/v1/input/pub7f170ab8c7381319ef634471d8c6d0a7?ddsource=browser&ddtags=sdk_version%3A2.18.0%2Cenv%3APRODUCTION%2Cservice%3Asteelcase.com%2Cversion%3A2024.09.03.08.24&batch_time=1730821075551	false		high
https://dumy1g3ng547g.cloudfront.net/eu-fr/wp-includes/css/dist/block-library/style.min.css?ver=6.4.3	false	Avira URL Cloud: safe	unknown
https://dumy1g3ng547g.cloudfront.net/content/themes/steelcase/img/logos/amq.png	false	Avira URL Cloud: safe	unknown
https://dumy1g3ng547g.cloudfront.net/content/themes/steelcase/img/logos/smith-system.png	false	Avira URL Cloud: safe	unknown
https://www.steelcase.com/eu-fr/	false		high
https://assets.pinterest.com/js/pinit_main.js?0.45226694366910203	false		high
https://cdn.cookielaw.org/scripttemplates/otSDKStub.js	false		high
https://dumy1g3ng547g.cloudfront.net/content/themes/steelcase/img/logos/steelcase.png	false	Avira URL Cloud: safe	unknown
https://ct.pinterest.com/user/?tid=2619121677351&cb=1730821023519&dep=2%2CPAGE_LOAD	false		high
https://aorta.clickagy.com/pixel.gif?ch=4&cm=e8c5d747-0894-40f7-8984-748f0e601790&redir=https%3A%2F%2Fus-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D537073026%26val%3D%7Bvisitor_id%7D	false		high
https://www.steelcase.com/content/plugins/revslider/public/assets/fonts/revicons/revicons.woff?5510888	false		high
https://images.steelcase.com/image/upload/c_fill,q_auto,f_auto,h_900,w_1600/v1590008017/www.steelcase.com/2020/05/20/20-0140284.jpg	false	Avira URL Cloud: safe	unknown
https://rum-http-intake.logs.datadoghq.com/v1/input/pub7f170ab8c7381319ef634471d8c6d0a7?ddsource=browser&ddtags=sdk_version%3A2.18.0%2Cenv%3APRODUCTION%2Cservice%3Asteelcase.com%2Cversion%3A2024.09.03.08.24&batch_time=1730821014131	false		high
https://cpat.steelcase.com/slideout/js/anchor-injects.min.js	false	Avira URL Cloud: safe	unknown
https://rum-http-intake.logs.datadoghq.com/v1/input/pub7f170ab8c7381319ef634471d8c6d0a7?ddsource=browser&ddtags=sdk_version%3A2.18.0%2Cenv%3APRODUCTION%2Cservice%3Asteelcase.com%2Cversion%3A2024.09.03.08.24&batch_time=1730821014135	false		high
https://aorta.clickagy.com/pixel.gif?clkgypv=jstag&ws=1	false		high
https://www.facebook.com/tr/?id=177426299267154&ev=PageView&dl=https%3A%2F%2Fwww.steelcase.com%2Feu-fr%2F&rl=https%3A%2F%2Fwww.steelcase.com%2Fcountries%2F&if=false&ts=1730821049217&sw=1280&sh=1024&v=2.9.176&r=stable&ec=0&o=4126&fbp=fb.1.1730821049192.309379371975545274&eid=ob3_plugin-set_c859d3afbcafd0f8df713fd4599ef6ef08e48cdcdf816ed886ed13a722731b9e&cs_est=true&cdl=API_unavailable&it=1730821046079&coo=false&rqm=GET	false		high
https://images.steelcase.com/image/upload/c_fill,q_auto,f_auto,h_900,w_1600/v1590008013/www.steelcase.com/2020/05/20/20-0140283.jpg	false	Avira URL Cloud: safe	unknown
https://rum-http-intake.logs.datadoghq.com/v1/input/pub7f170ab8c7381319ef634471d8c6d0a7?ddsource=browser&ddtags=sdk_version%3A2.18.0%2Cenv%3APRODUCTION%2Cservice%3Asteelcase.com%2Cversion%3A2024.09.03.08.24&batch_time=1730820999629	false		high

Name	IP	Active	Malicious	Reputation
forms.hubspot.com	104.16.118.116	true	false	high
cta-service-cms2.hubspot.com	104.16.118.116	true	false	high
d30vw4rsryuu67.cloudfront.net	18.245.31.78	true	false	unknown
w.usabilla.com	52.16.17.254	true	false	high
okt.to	34.200.97.200	true	false	high
track.hubspot.com	104.16.118.116	true	false	high
cm.g.doubleclick.net	142.250.184.194	true	false	high
www.google.com	172.217.18.100	true	false	high
static-cdn.hotjar.com	18.66.102.53	true	false	high
match.adsrvr.org	52.223.40.198	true	false	high
js.hs-banner.com	104.18.40.240	true	false	high
star-mini.c10r.facebook.com	157.240.252.35	true	false	high
wwwprod.sc-cloud.net	100.25.175.69	true	false	unknown
us-u.openx.net	34.98.64.218	true	false	high
d3i9xyriglxn0r.cloudfront.net	13.32.27.121	true	false	unknown
js.hsadspixel.net	104.17.223.152	true	false	high
www.googleoptimize.com	142.250.184.206	true	false	high
b4nhq3u8yn.us-west-2.awsapprunner.com	35.160.245.229	true	false	unknown
prod.pinterest.global.map.fastly.net	151.101.0.84	true	false	high
youtube-ui.l.google.com	142.250.186.174	true	false	high
googleads.g.doubleclick.net	142.250.185.98	true	false	high
dualstack.pinterest.map.fastly.net	151.101.128.84	true	false	high
api.hubapi.com	104.18.241.108	true	false	high
td.doubleclick.net	172.217.18.2	true	false	high
api.ipify.org	104.26.12.205	true	false	high
s.w.org	192.0.77.48	true	false	high
cdn.cookielaw.org	104.18.87.42	true	false	high
widget-cart.materialbank.com	143.204.215.88	true	false	unknown
steelcase-privacy.my.onetrust.com	104.18.32.137	true	false	unknown
hem-sync-prod-lb-7374702.us-east-1.elb.amazonaws.com	3.222.78.236	true	false	high
js.hs-analytics.net	104.16.160.168	true	false	high
s4-cloudinary-pin.map.fastly.net	151.101.2.102	true	false	high
dg2iu7dxxehbo.cloudfront.net	18.172.103.101	true	false	unknown
insight.adsrvr.org	52.223.40.198	true	false	high
scontent.xx.fbcdn.net	157.240.253.1	true	false	high
code.jquery.com	151.101.130.137	true	false	high
cdn.pdst.fm	35.244.142.80	true	false	high
d25huln01wxk5o.cloudfront.net	18.172.112.94	true	false	unknown
dcs-public-edge-irl1-150041215.eu-west-1.elb.amazonaws.com	3.248.133.173	true	false	high
edge-web.dual-gslb.spotify.com	35.186.224.24	true	false	high
d21prwqavi0i2.cloudfront.net	18.244.18.11	true	false	unknown
d2mtu7swxcf684.cloudfront.net	18.66.92.185	true	false	unknown
ws.zoominfo.com	104.16.118.43	true	false	high
s-part-0017.t-0009.fb-t-msedge.net	13.107.253.45	true	false	high
js.hubspot.com	104.16.118.116	true	false	high
dumy1g3ng547g.cloudfront.net	65.9.7.20	true	false	unknown
l4-logs-http-rum-pub-s0-7d264be627ade923.elb.us-east-1.amazonaws.com	3.233.158.31	true	false	high
ax-0001.ax-msedge.net	150.171.27.10	true	false	high
js.hsleadflows.net	104.18.137.17	true	false	high
js-na1.hs-scripts.com	104.16.141.209	true	false	high
www.datadoghq-browser-agent.com	18.239.49.193	true	false	high
cloudinary.map.fastly.net	151.101.129.137	true	false	high
l4-logs-http-rum-pub-s1-6386d34262e59173.elb.us-east-1.amazonaws.com	3.233.158.34	true	false	high
admin-fts.threekit.com	104.18.27.208	true	false	high
api.ipapi.com	172.67.74.51	true	false	high
perf-na1.hsforms.com	104.19.175.188	true	false	high
ib.anycast.adnxs.com	185.89.210.46	true	false	high
geolocation.onetrust.com	172.64.155.119	true	false	high
aorta.clickagy.com	23.23.205.18	true	false	high
steelcase.com.ssl.sc.omtrdc.net	63.140.62.222	true	false	unknown
tags.clickagy.com	unknown	unknown	false	high
cm.everesttech.net	unknown	unknown	false	high
static.oktopost.com	unknown	unknown	false	high
hemsync.clickagy.com	unknown	unknown	false	high
static.hotjar.com	unknown	unknown	false	high
pixels.spotify.com	unknown	unknown	false	high
log.pinterest.com	unknown	unknown	false	high
www.youtube.com	unknown	unknown	false	high
js.adsrvr.org	unknown	unknown	false	high
assets.adobedtm.com	unknown	unknown	false	high
pixel.rubiconproject.com	unknown	unknown	false	high
px.ads.linkedin.com	unknown	unknown	false	high
connect.facebook.net	unknown	unknown	false	high
images.steelcase.com	unknown	unknown	false	high
configurator.steelcase.com	unknown	unknown	false	unknown
steelcase-res.cloudinary.com	unknown	unknown	false	unknown
upload-widget.cloudinary.com	unknown	unknown	false	high
www.steelcase.com	unknown	unknown	false	high
ct.pinterest.com	unknown	unknown	false	high
dpm.demdex.net	unknown	unknown	false	high
www.facebook.com	unknown	unknown	false	high
metrics.steelcase.com	unknown	unknown	false	high
www.linkedin.com	unknown	unknown	false	high
cpat.steelcase.com	unknown	unknown	false	unknown
widget.cloudinary.com	unknown	unknown	false	high
steelcase.demdex.net	unknown	unknown	false	unknown
rum-http-intake.logs.datadoghq.com	unknown	unknown	false	high
snap.licdn.com	unknown	unknown	false	high
s.pinimg.com	unknown	unknown	false	high
ib.adnxs.com	unknown	unknown	false	high

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.steelcase.com/finishlibrary	Steelcase Series 1 Sustainable Office Chair _ Steelcase.html	false		high
https://www.steelcase.com/countries/ethiopia/	chromecache_390.2.dr	false		high
https://www.steelcase.com/projects	chromecache_390.2.dr	false		high
https://www.steelcase.com/products/monitor-arms-desk-accessories/	Steelcase Series 1 Sustainable Office Chair _ Steelcase.html	false		high
https://www.steelcase.com/brands/partners/polyvision/	Steelcase Series 1 Sustainable Office Chair _ Steelcase.html	false		high
http://store.steelcase.com/	Steelcase Series 1 Sustainable Office Chair _ Steelcase.html	false	Avira URL Cloud: safe	unknown
https://www.steelcase.com/products/pods/	Steelcase Series 1 Sustainable Office Chair _ Steelcase.html	false		high
https://ampcid.google.com/v1/publisher:getClientId	chromecache_485.2.dr, chromecache_601.2.dr	false		high
https://dumy1g3ng547g.cloudfront.net/content/themes/steelcase/css/archives-old.min.css?ver=888e8e301	chromecache_390.2.dr	false	Avira URL Cloud: safe	unknown
https://images.steelcase.com/image/upload/v1653061674/21-0169102_1x1.jpg	Steelcase Series 1 Sustainable Office Chair _ Steelcase.html	false	Avira URL Cloud: safe	unknown
https://www.steelcase.com/products/healthcare-casework-casegoods/	Steelcase Series 1 Sustainable Office Chair _ Steelcase.html	false		high
https://www.steelcase.com/resources/space-planning-ideas/industry/healthcare/	Steelcase Series 1 Sustainable Office Chair _ Steelcase.html	false		high
https://www.steelcase.com/countries/croatia/	chromecache_390.2.dr	false		high
https://www.steelcase.com/countries/san-marino/	chromecache_390.2.dr	false		high
https://github.com/MoonScript/jQuery-ajaxTransport-XDomainRequest	chromecache_443.2.dr, chromecache_471.2.dr	false		high
https://www.themepunch.com/support-center	chromecache_358.2.dr, chromecache_715.2.dr	false		high
https://www.steelcase.com/countries/niger/	chromecache_390.2.dr	false		high
https://www.steelcase.com/countries/serbia/	chromecache_390.2.dr	false		high
http://schema.org/SiteNavigationElement	Steelcase Series 1 Sustainable Office Chair _ Steelcase.html, chromecache_390.2.dr, chromecache_615.2.dr	false		high
https://www.steelcase.com/discover/steelcase/esg-overview/environmental/#sustainable-product-design	Steelcase Series 1 Sustainable Office Chair _ Steelcase.html, chromecache_395.2.dr	false		high
https://www.steelcase.com/countries/ivory-coast/	chromecache_390.2.dr	false		high
https://www.google.com/pagead/1p-user-list/10990831492/?random	chromecache_684.2.dr, chromecache_369.2.dr, chromecache_651.2.dr, chromecache_611.2.dr, chromecache_571.2.dr, chromecache_663.2.dr, chromecache_515.2.dr, chromecache_450.2.dr, chromecache_310.2.dr, chromecache_325.2.dr	false		high
https://www.steelcase.com/research/topics/design	Steelcase Series 1 Sustainable Office Chair _ Steelcase.html	false		high
https://www.steelcase.com/brands/partners/established-sons/	Steelcase Series 1 Sustainable Office Chair _ Steelcase.html	false		high
https://www.steelcase.com/wp-includes/wlwmanifest.xml	Steelcase Series 1 Sustainable Office Chair _ Steelcase.html	false		high
https://www.steelcase.com/xmlrpc.php?rsd	Steelcase Series 1 Sustainable Office Chair _ Steelcase.html, chromecache_390.2.dr	false		high
https://www.steelcase.com/countries/equatorial-guinea/	chromecache_390.2.dr	false		high
https://ib.adnxs.com/getuid?https%3a%2f%2fmatch.adsrvr.org%2ftrack%2fcmf%2fappnexus%3fttd%3d1%26anid	chromecache_710.2.dr	false		high
https://www.steelcase.com/products/office-chairs/	Steelcase Series 1 Sustainable Office Chair _ Steelcase.html	false		high
https://projects.steelcase.com/	Steelcase Series 1 Sustainable Office Chair _ Steelcase.html	false	Avira URL Cloud: safe	unknown
https://www.steelcase.com/west-elm-health/	Steelcase Series 1 Sustainable Office Chair _ Steelcase.html	false		high
https://www.steelcase.com/download/?url=//steelcase-res.cloudinary.com/image/upload/v1610502986/20-0	Steelcase Series 1 Sustainable Office Chair _ Steelcase.html	false		high
https://www.steelcase.com/download/?url=//steelcase-res.cloudinary.com/image/upload/v1610976344/www.	Steelcase Series 1 Sustainable Office Chair _ Steelcase.html	false		high
https://assets.adobedtm.com/051db1293195/ff145d2d4e21/d3f0702dcf67/RC111332007d9949ffaf9cc058f1b09b4	chromecache_589.2.dr, chromecache_359.2.dr	false		high
https://www.steelcase.com/countries/bahrain/	chromecache_390.2.dr	false		high
https://www.steelcase.com/products/stools/	Steelcase Series 1 Sustainable Office Chair _ Steelcase.html	false		high
https://www.steelcase.com/brands/partners/flos/	Steelcase Series 1 Sustainable Office Chair _ Steelcase.html	false		high
https://dumy1g3ng547g.cloudfront.net/content/themes/steelcase/css/print.min.css?ver=888e8e3019d9f036	chromecache_390.2.dr, chromecache_615.2.dr	false	Avira URL Cloud: safe	unknown
https://www.steelcase.com/countries/jordan/	chromecache_390.2.dr	false		high
https://www.steelcase.com/financial-services/	Steelcase Series 1 Sustainable Office Chair _ Steelcase.html	false		high
https://www.steelcase.com/countries/poland/	chromecache_390.2.dr	false		high
https://store.steelcase.com/	Steelcase Series 1 Sustainable Office Chair _ Steelcase.html, chromecache_390.2.dr	false	Avira URL Cloud: safe	unknown
https://dumy1g3ng547g.cloudfront.net/content/themes/steelcase/js/modernizr.min.js?ver=888e8e3019d9f0	chromecache_390.2.dr, chromecache_615.2.dr	false	Avira URL Cloud: safe	unknown
https://www.steelcase.com/countries/greece/	chromecache_390.2.dr	false		high
https://www.steelcase.com/download/?url=https://images.steelcase.com/image/upload/v1590008017/www.st	Steelcase Series 1 Sustainable Office Chair _ Steelcase.html	false		high
https://www.steelcase.com/download/?url=https://images.steelcase.com/image/upload/v1590008013/www.st	Steelcase Series 1 Sustainable Office Chair _ Steelcase.html	false		high
https://www.steelcase.com/quick-ship/	Steelcase Series 1 Sustainable Office Chair _ Steelcase.html	false		high
http://www.hubspot.com	chromecache_337.2.dr, chromecache_529.2.dr, chromecache_680.2.dr, chromecache_531.2.dr	false		high
https://www.steelcase.com/download/?url=https://images.steelcase.com/image/upload/v1653060603/21-016	Steelcase Series 1 Sustainable Office Chair _ Steelcase.html	false		high
https://www.steelcase.com/download/?url=//steelcase-res.cloudinary.com/image/upload/v1610976542/www.	Steelcase Series 1 Sustainable Office Chair _ Steelcase.html	false		high
https://www.steelcase.com/logitech/	Steelcase Series 1 Sustainable Office Chair _ Steelcase.html	false		high
https://dumy1g3ng547g.cloudfront.net/content/themes/steelcase/js/slick.min.js?ver=888e8e3019d9f0361d	chromecache_390.2.dr, chromecache_615.2.dr	false	Avira URL Cloud: safe	unknown
https://www.steelcase.com/resources/space-planning-ideas/industry/workplace/?tax%5bidea_collection%5	Steelcase Series 1 Sustainable Office Chair _ Steelcase.html	false		high
https://developers.google.com/youtube/iframe_api_reference#Events	chromecache_595.2.dr	false		high
https://www.steelcase.com/products/healthcare-seating/	Steelcase Series 1 Sustainable Office Chair _ Steelcase.html	false		high
https://www.steelcase.com/countries/oman/	chromecache_390.2.dr	false		high
https://www.steelcase.com/terms-of-use/	Steelcase Series 1 Sustainable Office Chair _ Steelcase.html, chromecache_390.2.dr	false		high
https://www.steelcase.com/brands/orangebox/	Steelcase Series 1 Sustainable Office Chair _ Steelcase.html	false		high
https://assets.adobedtm.com/extensions/EP8757b503532a44a68eee17773f6f10a0/AppMeasurement_Module_Acti	chromecache_699.2.dr, chromecache_451.2.dr	false		high
https://cdn.cookielaw.org/logos/static/ot_persistent_cookie.png	Steelcase Series 1 Sustainable Office Chair _ Steelcase.html	false		high

IP	Domain	Country	ASN	ASN Name	Malicious
151.101.0.84	prod.pinterest.global.map.fastly.net	United States	54113	FASTLYUS	false
104.18.137.17	js.hsleadflows.net	United States	13335	CLOUDFLARENETUS	false
142.250.185.100	unknown	United States	15169	GOOGLEUS	false
3.222.78.236	hem-sync-prod-lb-7374702.us-east-1.elb.amazonaws.com	United States	14618	AMAZON-AESUS	false
151.101.130.137	code.jquery.com	United States	54113	FASTLYUS	false
151.101.128.84	dualstack.pinterest.map.fastly.net	United States	54113	FASTLYUS	false
104.16.118.116	forms.hubspot.com	United States	13335	CLOUDFLARENETUS	false
100.25.175.69	wwwprod.sc-cloud.net	United States	14618	AMAZON-AESUS	false
104.18.87.42	cdn.cookielaw.org	United States	13335	CLOUDFLARENETUS	false
104.26.12.205	api.ipify.org	United States	13335	CLOUDFLARENETUS	false
18.66.92.185	d2mtu7swxcf684.cloudfront.net	United States	3	MIT-GATEWAYSUS	false
34.200.97.200	okt.to	United States	14618	AMAZON-AESUS	false
142.250.185.238	unknown	United States	15169	GOOGLEUS	false
172.217.18.2	td.doubleclick.net	United States	15169	GOOGLEUS	false
104.16.118.43	ws.zoominfo.com	United States	13335	CLOUDFLARENETUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
142.250.185.196	unknown	United States	15169	GOOGLEUS	false
52.16.17.254	w.usabilla.com	United States	16509	AMAZON-02US	false
52.213.0.145	unknown	United States	16509	AMAZON-02US	false
151.101.192.84	unknown	United States	54113	FASTLYUS	false
142.250.186.46	unknown	United States	15169	GOOGLEUS	false
104.18.139.17	unknown	United States	13335	CLOUDFLARENETUS	false
52.13.147.112	unknown	United States	16509	AMAZON-02US	false
172.217.18.14	unknown	United States	15169	GOOGLEUS	false
142.250.186.130	unknown	United States	15169	GOOGLEUS	false
216.58.206.36	unknown	United States	15169	GOOGLEUS	false
157.240.0.6	unknown	United States	32934	FACEBOOKUS	false
142.250.186.132	unknown	United States	15169	GOOGLEUS	false
18.244.18.70	unknown	United States	16509	AMAZON-02US	false
157.240.252.35	star-mini.c10r.facebook.com	United States	32934	FACEBOOKUS	false
185.89.210.46	ib.anycast.adnxs.com	Germany	29990	ASN-APPNEXUS	false
151.101.129.137	cloudinary.map.fastly.net	United States	54113	FASTLYUS	false
35.186.224.24	edge-web.dual-gslb.spotify.com	United States	15169	GOOGLEUS	false
150.171.27.10	ax-0001.ax-msedge.net	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
13.33.219.205	unknown	United States	16509	AMAZON-02US	false
157.240.253.1	scontent.xx.fbcdn.net	United States	32934	FACEBOOKUS	false
104.17.223.152	js.hsadspixel.net	United States	13335	CLOUDFLARENETUS	false
104.16.117.116	unknown	United States	13335	CLOUDFLARENETUS	false
34.192.184.91	unknown	United States	14618	AMAZON-AESUS	false
142.250.185.98	googleads.g.doubleclick.net	United States	15169	GOOGLEUS	false
18.66.102.53	static-cdn.hotjar.com	United States	3	MIT-GATEWAYSUS	false
23.23.205.18	aorta.clickagy.com	United States	14618	AMAZON-AESUS	false
13.32.27.121	d3i9xyriglxn0r.cloudfront.net	United States	7018	ATT-INTERNET4US	false
65.9.7.97	unknown	United States	16509	AMAZON-02US	false
18.172.112.94	d25huln01wxk5o.cloudfront.net	United States	3	MIT-GATEWAYSUS	false
104.16.117.43	unknown	United States	13335	CLOUDFLARENETUS	false
35.160.245.229	b4nhq3u8yn.us-west-2.awsapprunner.com	United States	16509	AMAZON-02US	false
104.18.40.240	js.hs-banner.com	United States	13335	CLOUDFLARENETUS	false
104.18.32.137	steelcase-privacy.my.onetrust.com	United States	13335	CLOUDFLARENETUS	false
63.140.62.222	steelcase.com.ssl.sc.omtrdc.net	United States	15224	OMNITUREUS	false
151.101.2.102	s4-cloudinary-pin.map.fastly.net	United States	54113	FASTLYUS	false
151.101.66.137	unknown	United States	54113	FASTLYUS	false
172.67.74.51	api.ipapi.com	United States	13335	CLOUDFLARENETUS	false
142.250.184.226	unknown	United States	15169	GOOGLEUS	false
34.250.133.195	unknown	United States	16509	AMAZON-02US	false
3.233.158.34	l4-logs-http-rum-pub-s1-6386d34262e59173.elb.us-east-1.amazonaws.com	United States	14618	AMAZON-AESUS	false
104.18.80.204	unknown	United States	13335	CLOUDFLARENETUS	false
3.233.158.32	unknown	United States	14618	AMAZON-AESUS	false
18.239.49.193	www.datadoghq-browser-agent.com	United States	16509	AMAZON-02US	false
104.18.241.108	api.hubapi.com	United States	13335	CLOUDFLARENETUS	false
142.250.184.194	cm.g.doubleclick.net	United States	15169	GOOGLEUS	false
65.9.7.20	dumy1g3ng547g.cloudfront.net	United States	16509	AMAZON-02US	false
172.64.155.119	geolocation.onetrust.com	United States	13335	CLOUDFLARENETUS	false
65.9.7.19	unknown	United States	16509	AMAZON-02US	false
104.16.141.209	js-na1.hs-scripts.com	United States	13335	CLOUDFLARENETUS	false
3.248.133.173	dcs-public-edge-irl1-150041215.eu-west-1.elb.amazonaws.com	United States	16509	AMAZON-02US	false
157.240.253.35	unknown	United States	32934	FACEBOOKUS	false
52.223.40.198	match.adsrvr.org	United States	8987	AMAZONEXPANSIONGB	false
3.233.158.31	l4-logs-http-rum-pub-s0-7d264be627ade923.elb.us-east-1.amazonaws.com	United States	14618	AMAZON-AESUS	false
18.66.102.51	unknown	United States	3	MIT-GATEWAYSUS	false
172.217.18.100	www.google.com	United States	15169	GOOGLEUS	false
104.19.175.188	perf-na1.hsforms.com	United States	13335	CLOUDFLARENETUS	false
142.250.186.174	youtube-ui.l.google.com	United States	15169	GOOGLEUS	false
18.172.103.101	dg2iu7dxxehbo.cloudfront.net	United States	3	MIT-GATEWAYSUS	false
18.172.112.31	unknown	United States	3	MIT-GATEWAYSUS	false
151.101.64.84	unknown	United States	54113	FASTLYUS	false
63.140.62.27	unknown	United States	15224	OMNITUREUS	false
23.22.90.252	unknown	United States	14618	AMAZON-AESUS	false
104.16.160.168	js.hs-analytics.net	United States	13335	CLOUDFLARENETUS	false
142.250.184.206	www.googleoptimize.com	United States	15169	GOOGLEUS	false
18.244.18.11	d21prwqavi0i2.cloudfront.net	United States	16509	AMAZON-02US	false
44.218.158.12	unknown	United States	14618	AMAZON-AESUS	false
3.229.99.144	unknown	United States	14618	AMAZON-AESUS	false
13.32.27.64	unknown	United States	7018	ATT-INTERNET4US	false
34.98.64.218	us-u.openx.net	United States	15169	GOOGLEUS	false
35.244.142.80	cdn.pdst.fm	United States	15169	GOOGLEUS	false

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1549473
Start date and time:	2024-11-05 16:34:55 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 27s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowshtmlcookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Steelcase Series 1 Sustainable Office Chair _ Steelcase.html
Detection:	MAL
Classification:	mal48.phis.winHTML@41/654@290/90
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .html

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
151.101.0.84	http://www.kidsocialstudies.com/3rd-grade-worksheets.html	Get hash	malicious	Unknown	Browse	widgets.pinterest.com/v1/urls/count.json?url=https%3A%2F%2Fwww.kidsocialstudies.com%2Findex.html&callback=window._ate.cbs.rcb_4pj90
104.18.137.17	https://krebsonsecurity.com/2024/10/patch-tuesday-october-2024-edition	Get hash	malicious	Unknown	Browse
	https://coisunibaseaiusignin.gitbook.io/	Get hash	malicious	HTMLPhisher	Browse
	http://uppholldbcloginn.gitbook.io/us/	Get hash	malicious	HTMLPhisher	Browse
	http://geminislogins.gitbook.io/us/	Get hash	malicious	HTMLPhisher	Browse
	http://web-walletconnct.gitbook.io/us/	Get hash	malicious	HTMLPhisher	Browse
	http://secure--trezorr-logun-sso.gitbook.io/us/	Get hash	malicious	HTMLPhisher	Browse
	http://cryptoocumlugin.gitbook.io/us/	Get hash	malicious	Unknown	Browse
	http://trezsor-login.gitbook.io/us/	Get hash	malicious	HTMLPhisher	Browse
	AHCHICSvjmApRFFQmAQXRyNbw.ps1	Get hash	malicious	Unknown	Browse
	phish_alert_sp2_2.0.0.0.eml	Get hash	malicious	Unknown	Browse
151.101.130.137	http://mi-outlook-loggin.click/icloud2022-esp.php	Get hash	malicious	Unknown	Browse	code.jquery.com/jquery-1.11.3.min.js
	http://imaps-support.us/icloud2022-esp.php	Get hash	malicious	Unknown	Browse	code.jquery.com/jquery-1.11.3.min.js
	http://facebooksecurity.blogspot.ch/	Get hash	malicious	Unknown	Browse	code.jquery.com/jquery-1.7.min.js
	https://m.exactag.com/ai.aspx?tc=d9912543bc40b07205bbd26a23a8d2e6b6b4f9&url=http%253AING.shalominternationalministry.com/index.xml%23?email=amFtZXMubGVhZGJlYXRlckBsb2dpY2FsaXMuY29t	Get hash	malicious	Unknown	Browse	code.jquery.com/jquery-3.3.1.min.js
	http://site9613885.92.webydo.com/?v=1	Get hash	malicious	Unknown	Browse	code.jquery.com/jquery-1.7.2.min.js

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
forms.hubspot.com	https://hy.markkasmick.click/cx/tbSgVco_akr35UznLBgMmL_dGwr4A9B_vyg2WwEB0w1LRjKjQMyEnB89mCfTRy8oqnbpdFunqinBhx0TsHvSJdUHnbksc3kdcKecoDvVHa5LAm46atMmRo3D2CHoEu2bmOqt4Ic8O_7AE7Igwgbi5c8zmZf6Fqp_XqcjREPr7609oL7vKm8FfjGLhMetr2oxtpR3ywH4BUElgc7EI7usxj8CJYEUMktwlb7YUzPvYQ7P1PilEV0LqiXI5sm6QVF4ZGl5TIXhnQLOG0kl6WQ0miiZysBfhaNojnPTUvisUUkwOp2fYTxkXEIhZ7ESJ7qXYLxQbmy4RJVeZZZ3RY5rX8W5t8cudSM9Zx7UaxgLH56aOv81v4QfUnzroT9v7LR3jPEjzYXr2LwuykYQnzvV6boWlogU4jkPE6MocRRlRoC6uUx2e1Wseo8MqGWTT2uXo4HbQDneiMF84sQ34*3TnbAxXWu8xLbb_mAOQxUTA3T5TUUZKeU3ziolM8TSVV5Y5LQTFGtNArddwJKdWCb_cLYMxUJpZ3cqM_A	Get hash	malicious	Unknown	Browse	104.16.118.116
	https://krebsonsecurity.com/2024/10/patch-tuesday-october-2024-edition	Get hash	malicious	Unknown	Browse	104.16.117.116
	https://coisunibaseaiusignin.gitbook.io/	Get hash	malicious	HTMLPhisher	Browse	104.16.117.116
	http://uppholldbcloginn.gitbook.io/us/	Get hash	malicious	HTMLPhisher	Browse	104.16.117.116
	http://geminislogins.gitbook.io/us/	Get hash	malicious	HTMLPhisher	Browse	104.16.117.116
	http://coinbassewalletextensin.gitbook.io/us	Get hash	malicious	Unknown	Browse	104.16.117.116
	https://metamaseiklogin.gitbook.io/	Get hash	malicious	HTMLPhisher	Browse	104.16.118.116
	https://mmetmask-login.gitbook.io/	Get hash	malicious	HTMLPhisher	Browse	104.16.117.116
	http://coinbassewalletextensin.gitbook.io/	Get hash	malicious	Unknown	Browse	104.16.117.116
	http://web-walletconnct.gitbook.io/us/	Get hash	malicious	HTMLPhisher	Browse	104.16.117.116
cta-service-cms2.hubspot.com	https://www.jasper.ai/	Get hash	malicious	Unknown	Browse	104.16.117.116
	https://app.creatopy.com/share/d/qvnqyxdo8o7m	Get hash	malicious	Unknown	Browse	104.16.117.116
	https://app.creatopy.com/share/d/qvnqyxdo8o7m	Get hash	malicious	Unknown	Browse	104.16.118.116
	https://click.pstmrk.it/3s/app.markup.io%2Finvite%2Faccept%2FGAelUtD0/OI9N/z2q4AQ/AQ/914fb818-2548-4566-aa09-a2d85ddc613b/2/KJFV2S8Gzw	Get hash	malicious	Unknown	Browse	104.16.118.116
	https://hy.markkasmick.click/cx/tbSgVco_akr35UznLBgMmL_dGwr4A9B_vyg2WwEB0w1LRjKjQMyEnB89mCfTRy8oqnbpdFunqinBhx0TsHvSJdUHnbksc3kdcKecoDvVHa5LAm46atMmRo3D2CHoEu2bmOqt4Ic8O_7AE7Igwgbi5c8zmZf6Fqp_XqcjREPr7609oL7vKm8FfjGLhMetr2oxtpR3ywH4BUElgc7EI7usxj8CJYEUMktwlb7YUzPvYQ7P1PilEV0LqiXI5sm6QVF4ZGl5TIXhnQLOG0kl6WQ0miiZysBfhaNojnPTUvisUUkwOp2fYTxkXEIhZ7ESJ7qXYLxQbmy4RJVeZZZ3RY5rX8W5t8cudSM9Zx7UaxgLH56aOv81v4QfUnzroT9v7LR3jPEjzYXr2LwuykYQnzvV6boWlogU4jkPE6MocRRlRoC6uUx2e1Wseo8MqGWTT2uXo4HbQDneiMF84sQ34*3TnbAxXWu8xLbb_mAOQxUTA3T5TUUZKeU3ziolM8TSVV5Y5LQTFGtNArddwJKdWCb_cLYMxUJpZ3cqM_A	Get hash	malicious	Unknown	Browse	104.16.118.116
	https://all-seasons-custom-apparel.printavo.com/invoice/d737c3f58fce8a3f391367c903598233?preauth=eyJhbGciOiJSUzI1NiJ9.eyJleHAiOjE3Mjg5MzIwMTYsImlzcyI6NTgzNTkwNywidmVyIjoiY3VzdG9tZXItcHJlYXV0aC12MiIsInBheWFibGUiOiJnaWQ6Ly9wcmludGF2by9PcmRlci8xNjg1NjM0NiJ9.LtnCZuP7zuLtxrc0qbRVc6D_HBV5HHWCYKF01jdBqYuyRzcwCAYTob8CmMYRp7Sn00U104lhcfqDv7qsmGMnOH78EaGpveHtDYtxUOElE7wAp52mtirat1X6dyvgpRhT6-eDCGCiJGzxy-YKbE_aw8K9Fw7pCzHFK5Bt7nHyz1If3LLIeBwZbi0mQUn5emqAgeKnBMJ2XFzw5Q-DA83g9HgPpmp25RoTsyHIpHXM8qV9IeOjy_mBPVDrol9kKUE7ihWInuSSYMoe2wcHXsN_CYjRq-xL5WOOWElhHTzXUkVDNZjQiBTchiuo_h5Ozhh3KZ3eiTryy5PQBER3_8r08A	Get hash	malicious	Unknown	Browse	104.16.118.116
	https://w7950.app.blinkops.com/	Get hash	malicious	Unknown	Browse	104.16.117.116
	https://krebsonsecurity.com/2024/10/patch-tuesday-october-2024-edition	Get hash	malicious	Unknown	Browse	104.16.118.116
	https://email.oxblue.com/e3t/Ctc/Q+113/cdDrv04/VXdfjN46m5dxW4GJlKB4fd0DdW2sbCLr5lTFq6N7Hm8xT3qgyTW7Y8-PT6lZ3lzW1ccS1H8Y8rzXW1hrlTV77h1NhW5_pVzH8bsnn6W1PWxqV8D5TN_W4_z5yx2Cz_4sMrZF-GqDHzcW8pZQ3N3BhYgKW3tmwg72n4TxDW4fS46V1-s7dgW57YVF64HfrMMW2BxxC75X21XdW1nBYw_1PMVGyW8s_YKQ6BTQZmW8wDJ4k3-yNbbW2_BGfy66mfVdW937hqt5kq1CcW4XD3mN54BQSWW4G8TK98NTx7zW74frv25zlZbQW5ztJ6n6fGJFrMSqBjr36qwYW2tk9Xh21wMKrW5RXwDq1M2mmrW3nyq_P20wBvNN8-tVH1nqcD1W5m3Vz04sj9CQf2ygfDq04	Get hash	malicious	Unknown	Browse	104.16.118.116
	AHCHICSvjmApRFFQmAQXRyNbw.ps1	Get hash	malicious	Unknown	Browse	104.16.117.116
w.usabilla.com	http://serviceappinfms12.pages.dev/	Get hash	malicious	TechSupportScam	Browse	52.214.55.116
	http://meta-reboot-server.vercel.app/	Get hash	malicious	HTMLPhisher	Browse	54.171.172.96
	http://vimuscle.vi/css/TB.html	Get hash	malicious	Unknown	Browse	108.128.207.30
	http://learn-help---mettamsks.webflow.io/	Get hash	malicious	Unknown	Browse	63.34.5.20
	https://www.telekom.de/start?wt_mc=er_sososoxx_in2s-reofn-rechnungonline-logo&wt_cc3=f1	Get hash	malicious	Unknown	Browse	52.49.182.89
	http://yathuchandran.github.io/Metamask.clone	Get hash	malicious	Unknown	Browse	52.210.199.131
	https://admin-154.pages.dev/privacy/your-privacy-choices	Get hash	malicious	HTMLPhisher	Browse	34.251.132.192
	https://admin-154.pages.dev/privacy/policy/cookienotice	Get hash	malicious	HTMLPhisher	Browse	34.251.132.192
	http://big-c88.pages.dev/xfi_files/bundle-53da3fe.js	Get hash	malicious	HTMLPhisher	Browse	54.195.151.221
	https://sumptuous-mouse-dd9684.instawp.xyz/voice/	Get hash	malicious	Unknown	Browse	34.253.51.102
okt.to	https://www3.fpn-process.com/l/cwc7633Xt4MIlPv5J4seP14A/WKmE4gZBtNw1bbV1a2SuWw/wT4d892OTJwVFpaejOq977XA	Get hash	malicious	Unknown	Browse	52.20.195.32
	http://www.alliedvalveinc.com	Get hash	malicious	Unknown	Browse	52.20.195.32
	https://bitmovin.com/demos/drm	Get hash	malicious	Unknown	Browse	23.22.90.252
	https://web.koerber-supplychain.com/MjcwLUZISy0zMTYAAAGNeqQP5Mnji6Dw7hofc3d4MBJOuWLKLzyRdXI-7trBqQXuT4HfjxXCqwTDsROzNKtDiEBtR1U=	Get hash	malicious	Unknown	Browse	23.22.90.252
	https://www.fpn-process.com/l/TyZN763xMp892zEfA892EBbNVMhA/DYdwxnt8lUBrG892X4X4yZFQ/whDhTJ892OaA4ungZUWejZdQ	Get hash	malicious	Unknown	Browse	52.20.195.32
	http://highradiuscorp.com	Get hash	malicious	Unknown	Browse	34.200.97.200
	https://videos.rzsoftware.com/watch/Q7BrcumWmoQMARoDExy3Lg?vyetoken=20536f58-cd36-4a35-b987-4ad673b3bfd5&vydata=%7B%22_om_id%22%3A125077%2C%22_op_id%22%3A73415%7D	Get hash	malicious	Unknown	Browse	23.22.90.252
	https://services.intralinks.com/AZ?w=14717155&br=1&p=3&urlId=1584287538	Get hash	malicious	Unknown	Browse	34.200.97.200
	https://go.aveva.com/OTg2LVlJUy04MDUAAAGMWG5aVTUhBphAqbvXfguCebwaXAgzXV6scPvkj1L-TJ6jfodFKKfJSaAUIo9XR06LRXukXGc=	Get hash	malicious	Unknown	Browse	23.22.90.252
	https://auth.dialogue.co/	Get hash	malicious	Unknown	Browse	34.200.97.200

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	NIlfETZ9aE.exe	Get hash	malicious	FormBook	Browse	188.114.96.3
	YvY5omjy2a.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger	Browse	188.114.97.3
	https://me-qr.com/f/tritonstone?hash=	Get hash	malicious	Unknown	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	172.67.133.135
	ulf4JrCRk2.exe	Get hash	malicious	AgentTesla, GuLoader	Browse	172.67.74.152
	https://micheline.aceflavall.com/	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse	104.21.20.47
	D6yz87XjgM.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	http://www.axa-assistance.co.uk	Get hash	malicious	Unknown	Browse	104.18.86.42
	Nt8BLNLKN7.exe	Get hash	malicious	AgentTesla, GuLoader	Browse	172.67.74.152
	L#U043e#U0430der.exe	Get hash	malicious	LummaC	Browse	172.67.187.9
AMAZON-AESUS	http://www.axa-assistance.co.uk	Get hash	malicious	Unknown	Browse	52.55.147.112
	p4rsJEIb7k.exe	Get hash	malicious	FormBook	Browse	50.19.214.227
	wODub61gZe.exe	Get hash	malicious	FormBook	Browse	52.20.84.62
	Employee bonus and payroll 74ae5652.pdf	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse	18.207.85.246
	POP (2).pdf	Get hash	malicious	Unknown	Browse	54.227.187.23
	https://bulbapp.com/u/sharefile?sharedLink=1db1fe96-5bdb-4c8c-ba45-33caa906abdd	Get hash	malicious	HTMLPhisher	Browse	107.20.231.112
	Eveshaw.pdf	Get hash	malicious	Unknown	Browse	3.5.12.139
	https://mlflegal.sharefile.com/public/share/web-s929b2bfc135a4aadb68ad5b8c7324a2e	Get hash	malicious	Unknown	Browse	35.174.123.65
	http://mibc-gtp.bigdatapppp.com/api/mibc-bd/gs/log	Get hash	malicious	Unknown	Browse	44.200.43.61
	https://t.ly/Oppenheim0511	Get hash	malicious	GO Backdoor	Browse	3.5.25.76
FASTLYUS	http://www.axa-assistance.co.uk	Get hash	malicious	Unknown	Browse	151.101.2.208
	file.exe	Get hash	malicious	Credential Flusher	Browse	151.101.1.91
	https://www.primechoicefinance.com.au/dykjj.php?7096797967704b53693230746450797938717a5330754c4530737a736a58533837503155744a31533870547662544277413dYnJhc3dlbGxzQGhlbGVuYWluZHVzdHJpZXMuY29t	Get hash	malicious	HTMLPhisher	Browse	151.101.65.229
	file.exe	Get hash	malicious	Credential Flusher	Browse	151.101.129.91
	Fuji Xerox ENCLOSED - Revised DRAFT.pdf	Get hash	malicious	Unknown	Browse	151.101.194.137
	QzX4KXBXPq.exe	Get hash	malicious	LummaC	Browse	185.199.110.133
	VoiceOfRefugees_xls.html	Get hash	malicious	Unknown	Browse	151.101.66.137
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, XWorm	Browse	199.232.210.172
	Employee bonus and payroll 74ae5652.pdf	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse	199.232.210.172
	Iamgold_Docs_Access5420bfea-53a5-4f8a-b2e1-aea0c34067c9_F5jLb.pdf	Get hash	malicious	HTMLPhisher	Browse	151.101.1.229
FASTLYUS	http://www.axa-assistance.co.uk	Get hash	malicious	Unknown	Browse	151.101.2.208
	file.exe	Get hash	malicious	Credential Flusher	Browse	151.101.1.91
	https://www.primechoicefinance.com.au/dykjj.php?7096797967704b53693230746450797938717a5330754c4530737a736a58533837503155744a31533870547662544277413dYnJhc3dlbGxzQGhlbGVuYWluZHVzdHJpZXMuY29t	Get hash	malicious	HTMLPhisher	Browse	151.101.65.229
	file.exe	Get hash	malicious	Credential Flusher	Browse	151.101.129.91
	Fuji Xerox ENCLOSED - Revised DRAFT.pdf	Get hash	malicious	Unknown	Browse	151.101.194.137
	QzX4KXBXPq.exe	Get hash	malicious	LummaC	Browse	185.199.110.133
	VoiceOfRefugees_xls.html	Get hash	malicious	Unknown	Browse	151.101.66.137
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, XWorm	Browse	199.232.210.172
	Employee bonus and payroll 74ae5652.pdf	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse	199.232.210.172
	Iamgold_Docs_Access5420bfea-53a5-4f8a-b2e1-aea0c34067c9_F5jLb.pdf	Get hash	malicious	HTMLPhisher	Browse	151.101.1.229

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
1138de370e523e824bbca92d049a3777	VoiceOfRefugees_xls.html	Get hash	malicious	Unknown	Browse	173.222.162.64
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, XWorm	Browse	173.222.162.64
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	173.222.162.64
	https://load.contbot.com.br/	Get hash	malicious	Unknown	Browse	173.222.162.64
	https://s.id/bFnCb	Get hash	malicious	Unknown	Browse	173.222.162.64
	National Association of State Procurement Officials.pdf	Get hash	malicious	Unknown	Browse	173.222.162.64
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	173.222.162.64
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	173.222.162.64
	https://www.google.lu/url?q=dK5oN8bP2yJ1vL3qF6gT0cR9mW4sH7jD2uY8kX5zM0nW4rT9pB6yG3lF1oJ8qV2kN7dP5uC3xH6tR0jL4wY1vS9mD2bT8nK7yX5rJ3qG0sW6lP9oF2aH1kpQvvq6xRyj7Y00xDjnlx9kIHOSozurMOiaAkImPuQJnOIWtJjqJLi6stjtDz3yh&rct=tTPSrMOiaAkImPuQJnOIWtJjqJLi6stjtFX08pQvvq6xRyj7Y00xDjnlx9kIjusucT&sa=t&esrc=026rlFgECA0xys8Em2FL&source=&cd=HXUursu8uEcr4eTiw9XH&cad=XpPkDfJ6CHARlDJVS0Y&ved=xjnktlqryYWwZIBRrgvK&uact=&url=amp%2F%E2%80%8Bgalapagos%C2%ADhostal%C2%AD%C2%ADtintorera%C2%AD.com%2Fauoth%2Fmeme%2Fnexpoint.com/c2pvaG5zb25AbmV4cG9pbnQuY29t	Get hash	malicious	Mamba2FA	Browse	173.222.162.64
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	173.222.162.64
28a2c9bd18a11de089ef85a160da29e4	https://virtual.urban-orthodontics.com	Get hash	malicious	Unknown	Browse	20.109.210.53 13.107.253.45 184.28.90.27
	http://usps.com-trackinse.vip/i	Get hash	malicious	Unknown	Browse	20.109.210.53 13.107.253.45 184.28.90.27
	https://www.solutionfun.info/landingpage/e7038827-a406-4c54-823b-7c3a83053840/7F8TFt1HKugpNPzdYf4k9JkOT83-qSoBFdtvBauuf98	Get hash	malicious	HTMLPhisher	Browse	20.109.210.53 13.107.253.45 184.28.90.27
	http://www.axa-assistance.co.uk	Get hash	malicious	Unknown	Browse	20.109.210.53 13.107.253.45 184.28.90.27
	https://www.primechoicefinance.com.au/dykjj.php?7096797967704b53693230746450797938717a5330754c4530737a736a58533837503155744a31533870547662544277413dYnJhc3dlbGxzQGhlbGVuYWluZHVzdHJpZXMuY29t	Get hash	malicious	HTMLPhisher	Browse	20.109.210.53 13.107.253.45 184.28.90.27
	https://www.imap.ne.jp/banner_click/add/20/1/?a&url=http://uniteseoul.com	Get hash	malicious	HTMLPhisher	Browse	20.109.210.53 13.107.253.45 184.28.90.27
	Fuji Xerox ENCLOSED - Revised DRAFT.pdf	Get hash	malicious	Unknown	Browse	20.109.210.53 13.107.253.45 184.28.90.27
	VoiceOfRefugees_xls.html	Get hash	malicious	Unknown	Browse	20.109.210.53 13.107.253.45 184.28.90.27
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, XWorm	Browse	20.109.210.53 13.107.253.45 184.28.90.27
	Iamgold_Docs_Access5420bfea-53a5-4f8a-b2e1-aea0c34067c9_F5jLb.pdf	Get hash	malicious	HTMLPhisher	Browse	20.109.210.53 13.107.253.45 184.28.90.27
3b5074b1b5d032e5620f69f9f700ff0e	REnBTVfW8q.exe	Get hash	malicious	AgentTesla, GuLoader	Browse	40.113.110.67 40.113.103.199
	ulf4JrCRk2.exe	Get hash	malicious	AgentTesla, GuLoader	Browse	40.113.110.67 40.113.103.199
	D6yz87XjgM.exe	Get hash	malicious	AgentTesla	Browse	40.113.110.67 40.113.103.199
	http://www.axa-assistance.co.uk	Get hash	malicious	Unknown	Browse	40.113.110.67 40.113.103.199
	Nt8BLNLKN7.exe	Get hash	malicious	AgentTesla, GuLoader	Browse	40.113.110.67 40.113.103.199
	https://www.imap.ne.jp/banner_click/add/20/1/?a&url=http://uniteseoul.com	Get hash	malicious	HTMLPhisher	Browse	40.113.110.67 40.113.103.199
	QzX4KXBXPq.exe	Get hash	malicious	LummaC	Browse	40.113.110.67 40.113.103.199
	5jh97SOa7H.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	40.113.110.67 40.113.103.199
	Quotation.exe	Get hash	malicious	AgentTesla, GuLoader	Browse	40.113.110.67 40.113.103.199
	RFQABCO004806L____________________pdf.exe	Get hash	malicious	Snake Keylogger	Browse	40.113.110.67 40.113.103.199

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (11084), with no line terminators
Category:	downloaded
Size (bytes):	11084
Entropy (8bit):	5.26714858103651
Encrypted:	false
SSDEEP:	192:sANzVNUBOebwvXDA+mJ4fXOrTIjDJfiRxug9xx+EMZajp:PNbUBOjHmJcOgjDJaR1bMZip
MD5:	65F1D21D5FCC9D21DA758ADABABD0C3C
SHA1:	E0661D07D64C00008BC9D013D16EEC0A0F156DC7
SHA-256:	D2B82E612D2A812E8BE2A57300DAB8923C4F2EDBE7A799E7DA70791B595646FE
SHA-512:	DE7D7DC739CED2E6CFA52C1809144180787ADC3AD5F9B7597C72B9D9BD5EB2F21DE06B1FC12B5034F2458DE428B368772700A6665D3F2E02F148A300239E6183
Malicious:	false
Reputation:	moderate, very likely benign file
URL:	https://dumy1g3ng547g.cloudfront.net/content/themes/steelcase/js/modernizr.min.js?ver=888e8e3019d9f0361d5427b03ddb95148e2f86ab
Preview:	window.Modernizr=function(e,t,n){function r(e){b.cssText=e}function o(e,t){return r(S.join(e+";")+(t\|\|""))}function a(e,t){return typeof e===t}function i(e,t){return!!~(""+e).indexOf(t)}function c(e,t){for(var r in e){var o=e[r];if(!i(o,"-")&&b[o]!==n)return"pfx"==t?o:!0}return!1}function s(e,t,r){for(var o in e){var i=t[e[o]];if(i!==n)return r===!1?e[o]:a(i,"function")?i.bind(r\|\|t):i}return!1}function u(e,t,n){var r=e.charAt(0).toUpperCase()+e.slice(1),o=(e+" "+k.join(r+" ")+r).split(" ");return a(t,"string")\|\|a(t,"undefined")?c(o,t):(o=(e+" "+T.join(r+" ")+r).split(" "),s(o,t,n))}function l(){p.input=function(n){for(var r=0,o=n.length;o>r;r++)j[n[r]]=!!(n[r]in E);return j.list&&(j.list=!(!t.createElement("datalist")\|\|!e.HTMLDataListElement)),j}("autocomplete autofocus list placeholder max min multiple pattern required step".split(" ")),p.inputtypes=function(e){for(var r,o,a,i=0,c=e.length;c>i;i++)E.setAttribute("type",o=e[i]),r="text"!==E.type,r&&(E.value=x,E.style.cssText="position:

File type:	HTML document, Unicode text, UTF-8 text, with very long lines (3265)
Entropy (8bit):	5.3779713720645
TrID:	Scalable Vector Graphics (18501/1) 15.61% HyperText Markup Language (15015/1) 12.67% Artificial Intelligence Markup Language (14501/1) 12.23% HyperText Markup Language with DOCTYPE (12503/2) 10.55% HyperText Markup Language (12001/1) 10.13%
File name:	Steelcase Series 1 Sustainable Office Chair _ Steelcase.html
File size:	1'119'705 bytes
MD5:	9f629ee5657dae365a3fa4828cf6f3bd
SHA1:	fdfe0c0b41c08cb4ddef74bb6303656ba0702573
SHA256:	1d6ac217624b64e51903fe8e2f542f06a4bfbd4cef1103b9c26a5351d356484a
SHA512:	7f3b47534de57a9b05cde68851f01dfe173ce6c7267812ee42e46d4bc7f796abcc7b31e4998e3af053f7ae92ed7da2b2f943e2f0a20c88d7ab89b668efbe7421
SSDEEP:	12288:eEFZkDQrHVOMrCXrxrXVOurB2rjkjX8xOw1vRt602kxQMGfalwXJvZ:0MIXJR
TLSH:	6C3508975D68183D51179F9BA0CEB254375B5022DA8BFCACF7AE212CCF88E8191B3354
File Content Preview:	<!DOCTYPE html>. saved from url=(0085)https://www.steelcase.com/products/office-chairs/steelcase-series-1/#product-features -->.<html class="en_US js flexbox flexboxlegacy canvas canvastext webgl no-touch geolocation postmessage websqldatabase indexed

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Steelcase Series 1 Sustainable Office Chair _ Steelcase.html

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Phishing

Compliance

Networking

System Summary

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Chrome Cache Entry: 306

Chrome Cache Entry: 307

Chrome Cache Entry: 308

Chrome Cache Entry: 309

Chrome Cache Entry: 310

Chrome Cache Entry: 311

Chrome Cache Entry: 312

Chrome Cache Entry: 313

Chrome Cache Entry: 314

Chrome Cache Entry: 315

Chrome Cache Entry: 316

Chrome Cache Entry: 317

Chrome Cache Entry: 318

Chrome Cache Entry: 319

Chrome Cache Entry: 320

Chrome Cache Entry: 321

Chrome Cache Entry: 322

Chrome Cache Entry: 323

Chrome Cache Entry: 324

Chrome Cache Entry: 325

Chrome Cache Entry: 326

Chrome Cache Entry: 327

Chrome Cache Entry: 328

Chrome Cache Entry: 329

Chrome Cache Entry: 330

Chrome Cache Entry: 331

Chrome Cache Entry: 332

Chrome Cache Entry: 333

Windows Analysis Report
Steelcase Series 1 Sustainable Office Chair _ Steelcase.html

Timestamp	Bytes transferred	Direction	Data
2024-11-05 15:35:51 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 6d 45 4c 76 49 52 77 43 59 45 75 62 2b 34 4e 4d 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 33 33 30 30 38 66 66 33 33 39 66 38 66 34 36 39 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: mELvIRwCYEub+4NM.1Context: 33008ff339f8f469
2024-11-05 15:35:51 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-11-05 15:35:51 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 6d 45 4c 76 49 52 77 43 59 45 75 62 2b 34 4e 4d 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 33 33 30 30 38 66 66 33 33 39 66 38 66 34 36 39 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 5a 73 77 73 73 71 57 5a 71 4c 66 46 41 4b 75 53 46 49 52 6b 51 4c 61 4a 4d 4c 6e 6e 4f 4c 51 32 52 59 5a 4e 39 6c 71 70 53 33 79 57 5a 51 58 61 42 71 52 6a 4e 75 6e 4e 43 63 35 59 49 64 34 6f 65 66 6e 54 6e 4a 66 68 51 54 69 71 56 75 6c 72 6b 65 4b 32 41 68 59 74 67 75 44 66 73 2f 71 37 79 63 42 48 74 48 33 50 71 39 4e 66 52 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: mELvIRwCYEub+4NM.2Context: 33008ff339f8f469<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAZswssqWZqLfFAKuSFIRkQLaJMLnnOLQ2RYZN9lqpS3yWZQXaBqRjNunNCc5YId4oefnTnJfhQTiqVulrkeK2AhYtguDfs/q7ycBHtH3Pq9NfR
2024-11-05 15:35:51 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 6d 45 4c 76 49 52 77 43 59 45 75 62 2b 34 4e 4d 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 33 33 30 30 38 66 66 33 33 39 66 38 66 34 36 39 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: mELvIRwCYEub+4NM.3Context: 33008ff339f8f469<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-11-05 15:35:51 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-11-05 15:35:51 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 4e 6c 42 35 37 48 62 44 70 45 69 64 6c 66 49 45 76 35 44 6d 6f 51 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: NlB57HbDpEidlfIEv5DmoQ.0Payload parsing failed.

Timestamp	Bytes transferred	Direction	Data
2024-11-05 15:35:54 UTC	195	OUT	GET /rules/other-Win32-v19.bundle HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 15:35:55 UTC	471	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 15:35:55 GMT Content-Type: text/plain Content-Length: 218853 Connection: close Vary: Accept-Encoding Cache-Control: public Last-Modified: Tue, 05 Nov 2024 00:45:17 GMT ETag: "0x8DCFD331E45FB54" x-ms-request-id: d6fc9ab7-901e-008f-8051-2f67a6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T153555Z-157b9fd754ff4xnphC1SN1wuxg00000004mg00000000aa68 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 15:35:55 UTC	15913	IN	Data Raw: 31 30 30 30 76 35 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 30 22 20 56 3d 22 35 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 52 75 6c 65 45 72 72 6f 72 73 41 67 67 72 65 67 61 74 65 64 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 53 3d 22 37 30 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 Data Ascii: 1000v5+<?xml version="1.0" encoding="utf-8"?><R Id="1000" V="5" DC="ESM" EN="Office.Telemetry.RuleErrorsAggregated" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" SP="CriticalBusinessImpact" S="70" DL="A" DCa="PSP PSU"
2024-11-05 15:35:55 UTC	16384	IN	Data Raw: 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 42 22 20 49 3d 22 35 22 20 4f 3d 22 66 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 Data Ascii: /> </R> </O> </R> </O> </C> <C T="B" I="5" O="false"> <O T="AND"> <L> <O T="GE"> <L> <S T="1" F="0" /> </L> <R> <V V="400" T="I32" />
2024-11-05 15:35:55 UTC	16384	IN	Data Raw: 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 38 32 30 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 6f 6e 74 61 63 74 43 61 72 64 50 72 6f 70 65 72 74 69 65 73 43 6f 75 6e 74 73 22 20 41 54 54 3d 22 64 38 30 37 36 30 39 32 37 36 37 34 34 32 34 35 62 61 66 38 31 62 66 37 62 63 38 30 33 33 66 36 2d 32 32 36 38 65 33 37 34 2d 37 37 36 36 2d 34 39 37 36 2d 62 65 34 34 2d 62 36 61 64 35 62 64 64 63 35 62 36 2d 37 38 31 33 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 68 75 74 64 6f 77 6e 22 20 2f 3e 0d Data Ascii: .0" encoding="utf-8"?><R Id="10820" V="3" DC="SM" EN="Office.Outlook.Desktop.ContactCardPropertiesCounts" ATT="d807609276744245baf81bf7bc8033f6-2268e374-7766-4976-be44-b6ad5bddc5b6-7813" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryShutdown" />
2024-11-05 15:35:55 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 39 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 41 67 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 34 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 30 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 31 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 46 69 6c 65 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 38 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 Data Ascii: </C> <C T="U32" I="9" O="true" N="Purged_Age"> <S T="4" F="Count" /> </C> <C T="U32" I="10" O="true" N="Purged_Count"> <S T="5" F="Count" /> </C> <C T="U32" I="11" O="true" N="File_Count"> <S T="8" F="Count" /> </C>
2024-11-05 15:35:55 UTC	16384	IN	Data Raw: 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 4d 61 6e 61 67 65 72 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 52 65 73 75 6c 74 5f 56 61 6c 69 64 50 65 72 73 6f 6e 61 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 32 22 20 2f 3e 0d 0a 20 Data Ascii: <S T="10" /> </C> </C> <C T="U32" I="1" O="false" N="Count_CreateCard_ValidManager_False"> <C> <S T="11" /> </C> </C> <C T="U32" I="2" O="false" N="Count_CreateResult_ValidPersona_False"> <C> <S T="12" />
2024-11-05 15:35:55 UTC	16384	IN	Data Raw: 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 57 61 73 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6c 65 61 6e 75 70 4d 73 6f 50 65 72 73 6f 6e 61 5f 49 4d 73 6f 50 65 72 73 6f 6e Data Ascii: Paint_IMsoPersona_WasNull_Count"> <C> <S T="32" /> </C> </C> <C T="U32" I="20" O="false" N="Paint_IMsoPersona_Null_Count"> <C> <S T="33" /> </C> </C> <C T="U32" I="21" O="false" N="CleanupMsoPersona_IMsoPerson
2024-11-05 15:35:55 UTC	16384	IN	Data Raw: 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 32 30 30 22 20 54 3d 22 49 36 34 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 6f 6e 64 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 Data Ascii: <R> <V V="200" T="I64" /> </R> </O> </L> <R> <O T="LT"> <L> <S T="3" F="RetrievalMilliseconds" /> </L> <R> <V V="400"
2024-11-05 15:35:55 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 53 75 63 63 65 73 73 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 46 61 69 6c 65 64 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 Data Ascii: </S> <C T="U32" I="0" O="false" N="Ocom2IUCOfficeIntegrationFirstCallSuccessCount"> <C> <S T="9" /> </C> </C> <C T="U32" I="1" O="false" N="Ocom2IUCOfficeIntegrationFirstCallFailedCount"> <C> <S T="10" /> </C
2024-11-05 15:35:55 UTC	16384	IN	Data Raw: 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 54 65 6e 61 6e 74 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 55 73 65 72 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 66 61 6c 73 65 22 20 54 3d 22 42 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 Data Ascii: L> <S T="3" F="Tenant enabled" /> </L> <R> <O T="EQ"> <L> <S T="3" F="User enabled" /> </L> <R> <V V="false" T="B" /> </R>
2024-11-05 15:35:55 UTC	16384	IN	Data Raw: 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 34 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 37 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 Data Ascii: us" /> </L> <R> <V V="404" T="U32" /> </R> </O> </F> <F T="7"> <O T="AND"> <L> <O T="GE"> <L> <S T="2" F="HttpStatus" /> </L>

Timestamp	Bytes transferred	Direction	Data
2024-11-05 15:35:56 UTC	192	OUT	GET /rules/rule120609v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 15:35:56 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 15:35:56 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB56D3AFB" x-ms-request-id: 281ea711-401e-0047-215f-2e8597000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T153556Z-158dbd74bf4hfx6nhC1SN1z1dw00000004500000000000bu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 15:35:56 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 44 64 5d 5b 45 65 5d 5b 4c 6c 5d 5b 4c 6c 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120609" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120682" /> <SR T="2" R="^([Dd][Ee][Ll][Ll])"> <S T="1" F="0" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Timestamp	Bytes transferred	Direction	Data
2024-11-05 15:35:56 UTC	193	OUT	GET /rules/rule120402v21s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 15:35:56 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 15:35:56 GMT Content-Type: text/xml Content-Length: 3788 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC2126A6" x-ms-request-id: ece73ca0-101e-007a-073f-2e047e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T153556Z-157b9fd754fdsnsqhC1SN1tzrn00000004t000000000414d x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 15:35:56 UTC	3788	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 34 30 32 22 20 56 3d 22 32 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 55 6e 67 72 61 63 65 66 75 6c 41 70 70 45 78 69 74 44 65 73 6b 74 6f 70 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 22 20 78 6d 6c 6e 73 3d 22 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120402" V="21" DC="SM" EN="Office.System.SystemHealthUngracefulAppExitDesktop" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalCensus" DL="A" DCa="PSP" xmlns=""

Timestamp	Bytes transferred	Direction	Data
2024-11-05 15:35:56 UTC	192	OUT	GET /rules/rule224902v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 15:35:56 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 15:35:56 GMT Content-Type: text/xml Content-Length: 450 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:25 GMT ETag: "0x8DC582BD4C869AE" x-ms-request-id: 5dfad506-901e-0029-2a46-2e274a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T153556Z-158dbd74bf4rcgjxhC1SN1a3yn000000041g000000009cx5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 15:35:56 UTC	450	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 32 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 32 22 20 49 64 3d 22 62 62 72 35 71 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 61 33 36 61 39 37 30 64 2d 34 35 61 39 2d 34 65 30 64 2d 39 63 61 62 2d 32 61 32 33 35 63 63 39 64 37 63 36 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 47 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 4e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224902" V="2" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120100" /> <UTS T="2" Id="bbr5q" /> <SS T="3" G="{a36a970d-45a9-4e0d-9cab-2a235cc9d7c6}" /> </S> <C T="G" I="0" O="falseN

Timestamp	Bytes transferred	Direction	Data
2024-11-05 15:35:56 UTC	192	OUT	GET /rules/rule120600v4s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 15:35:56 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 15:35:56 GMT Content-Type: text/xml Content-Length: 2980 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 23b843a5-001e-0065-686a-2e0b73000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T153556Z-158dbd74bf4dtwdphC1SN1ubaw00000003r0000000008d56 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 15:35:56 UTC	2980	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 30 22 20 56 3d 22 34 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 44 65 76 69 63 65 43 6f 6e 73 6f 6c 69 64 61 74 65 64 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120600" V="4" DC="SM" EN="Office.System.SystemHealthMetadataDeviceConsolidated" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC"

Timestamp	Bytes transferred	Direction	Data
2024-11-05 15:35:56 UTC	192	OUT	GET /rules/rule120608v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 15:35:56 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 15:35:56 GMT Content-Type: text/xml Content-Length: 2160 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA3B95D81" x-ms-request-id: d78ce712-d01e-007a-194f-2ef38c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T153556Z-157b9fd754fk82tlhC1SN1x7tg00000004sg0000000025x4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 15:35:56 UTC	2160	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 37 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 33 22 20 52 3d 22 31 32 30 36 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 34 22 20 52 3d 22 31 32 30 36 31 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 35 22 20 52 3d 22 31 32 30 36 31 34 22 20 2f 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120608" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120609" /> <R T="2" R="120679" /> <R T="3" R="120610" /> <R T="4" R="120612" /> <R T="5" R="120614" />

Timestamp	Bytes transferred	Direction	Data
2024-11-05 15:35:57 UTC	192	OUT	GET /rules/rule120610v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 15:35:57 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 15:35:57 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:46 GMT ETag: "0x8DC582B9964B277" x-ms-request-id: 7b71120f-601e-0050-0560-2e2c9c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T153557Z-158dbd74bf49tqzmhC1SN1qum800000004400000000043nq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 15:35:57 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120610" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Timestamp	Bytes transferred	Direction	Data
2024-11-05 15:35:57 UTC	192	OUT	GET /rules/rule120611v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 15:35:57 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 15:35:57 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:56 GMT ETag: "0x8DC582B9F6F3512" x-ms-request-id: 2b307645-e01e-001f-335c-2e1633000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T153557Z-158dbd74bf4t6ws7hC1SN1rd6c000000046g000000008hw4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 15:35:57 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4c 6c 5d 5b 45 65 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 56 76 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120611" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <SR T="2" R="([Ll][Ee][Nn][Oo][Vv][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Timestamp	Bytes transferred	Direction	Data
2024-11-05 15:35:57 UTC	192	OUT	GET /rules/rule120613v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 15:35:57 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 15:35:57 GMT Content-Type: text/xml Content-Length: 632 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6E3779E" x-ms-request-id: 94eba7f5-101e-0079-455c-2e5913000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T153557Z-157b9fd754fslm5zhC1SN1s0vn00000004p0000000007123 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 15:35:57 UTC	632	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 48 68 5d 5b 50 70 5d 28 5b 5e 45 5d 7c 24 29 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 33 22 20 52 3d 22 28 5b 48 68 5d 5b 45 65 5d 5b 57 77 5d 5b 4c 6c 5d 5b 45 65 5d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120613" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <SR T="2" R="^([Hh][Pp]([^E]\|$))"> <S T="1" F="1" M="Ignore" /> </SR> <SR T="3" R="([Hh][Ee][Ww][Ll][Ee]