Edit tour

Windows Analysis Report
SBO Catch up call pf.msg

Overview

General Information

Sample name:	SBO Catch up call pf.msg
Analysis ID:	1568924
MD5:	bd740fc68ab10ecc286c63e6fa4a9ce3
SHA1:	dc5c39e880e5ee89ad784772f85105e52a8da46c
SHA256:	430e8044df3b93d16dc5f9b2cd6b437e52b9bb5cd2356e4c07574a1af3d98d29
Infos:

Detection

HTMLPhisher

Score:	84
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

AI detected phishing page

Antivirus detection for URL or domain

Suricata IDS alerts for network traffic

Yara detected HtmlPhish54

AI detected landing page (webpage, office document or email)

AI detected potential phishing Email

AI detected suspicious Javascript

Detected hidden input values containing email addresses (often used in phishing pages)

Detected suspicious crossdomain redirect

HTML body contains low number of good links

HTML page contains hidden javascript code

HTML title does not match URL

IP address seen in connection with other malware

Queries the volume information (name, serial number etc) of a device

Sigma detected: Office Autorun Keys Modification

Stores files to the Windows start menu directory

Classification

Process Tree

System is w10x64

OUTLOOK.EXE (PID: 5604 cmdline: "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /f "C:\Users\user\Desktop\SBO Catch up call pf.msg" MD5: 91A5292942864110ED734005B7E005C0)

ai.exe (PID: 6148 cmdline: "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "70B31B44-41D0-4A8A-9A35-9C4EDE4E08A3" "394EF357-1A0B-4E1A-BBCB-9F7F5C0CEAAD" "5604" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx" MD5: EC652BEDD90E089D9406AFED89A8A8BD)

chrome.exe (PID: 6100 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://linkprotect.cudasvc.com/url?a=https%3a%2f%2fgoogle.dz%2furl%3fq%3dnrnq5JLi6z3yh%26rct%3dtTPvvq6xRyj7Y00xDjnlx9kIjusucT%26sa%3dt%26url%3damp%2fs%252falvoradavisual.com.br%252fyoya%2fcjbh%2fa2xhdXMubWFkZXJAc2JvLmNvLmF0%c3%a3%e2%82%ac%e2%80%9a%24%24%24%c3%a3%e2%82%ac%e2%80%9a&c=E,1,acdMIvaoQStC4aiulDn5jPGsnimtLMV1JFn6BeW342oWxCIFHFvSiA0y2yY0Hz6ZJg_fxZUtnDRFz4Y_7GVcOkttSEslJfLPkj2AwC2wEfirVZI,&typo=1 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6484 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 --field-trial-handle=1912,i,7133077948100089436,13748270433531493616,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Yara Signatures

HTML

Source	Rule	Description	Author
1.3.id.script.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security
1.10.id.script.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security
2.2.pages.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security
3.3.pages.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security
3.5.pages.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security
3.7.pages.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security
3.8.pages.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security
Click to see the 2 entries

Sigma Signatures

Sigma detected: Office Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 , EventID: 13, EventType: SetValue, Image: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE, ProcessId: 5604, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Addins\OneNote.OutlookAddin\1

Suricata Signatures

ETPRO PHISHING JS/PsyduckPockeball Payload Inbound

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-05T08:24:30.572131+0100	2857090	1	Successful Credential Theft Detected	164.92.191.86	443	192.168.2.8	49739	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: https://82ce8558-5bf3911d.gharelokhana.com/shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico	Avira URL Cloud: Label: malware
Source: https://djdjkdlellekkff.gharelokhana.com/5bf3911d69954dcc9f26274a1117b6fd/	Avira URL Cloud: Label: malware
Source: https://82ce8558-5bf3911d.gharelokhana.com/shared/1.0/content/js/ConvergedLogin_PCore_h6TdaK6cfsrg175w47aRCA2.js	Avira URL Cloud: Label: malware
Source: https://67f9d952-5bf3911d.gharelokhana.com/Prefetch/Prefetch.aspx	Avira URL Cloud: Label: malware
Source: https://5088df79-5bf3911d.gharelokhana.com/sbo.co.at/winauth/ssoprobe?client-request-id=8d97587d-1931-4a24-9948-0d928dffd68c&_=1733383491884	Avira URL Cloud: Label: malware
Source: https://82ce8558-5bf3911d.gharelokhana.com/shared/1.0/content/images/marching_ants_986f40b5a9dc7d39ef8396797f61b323.gif	Avira URL Cloud: Label: malware
Source: https://l1ve.gharelokhana.com/Me.htm?v=3	Avira URL Cloud: Label: malware
Source: https://82ce8558-5bf3911d.gharelokhana.com/ests/2.1/content/cdnbundles/ux.converged.login.strings-en.min_i8f-75gfk3tbsm8bmatnqa2.js	Avira URL Cloud: Label: malware
Source: https://82ce8558-5bf3911d.gharelokhana.com/shared/1.0/content/images/microsoft_logo_564db913a7fa0ca42727161c6d031bef.svg	Avira URL Cloud: Label: malware
Source: https://djdjkdlellekkff.gharelokhana.com/common/instrumentation/dssostatus	Avira URL Cloud: Label: malware
Source: https://e7a91062-5bf3911d.gharelokhana.com/shared/1.0/content/js/BssoInterrupt_Core_zKox_QMcTIVut7mG_Z9Eew2.js	Avira URL Cloud: Label: malware
Source: https://82ce8558-5bf3911d.gharelokhana.com/shared/1.0/content/images/signin-options_3e3f6b73c3f310c31d2c4d131a8ab8c6.svg	Avira URL Cloud: Label: malware

Phishing

AI detected phishing page

Source: https://djdjkdlellekkff.gharelokhana.com/?km=a2xhdXMubWFkZXJAc2JvLmNvLmF0%C3%83%C2%A3%C3%A2%C2%82%C2%AC%C3%A2%C2%80%C2%9A$$$%C3%83%C2%A3%C3%A2%C2%82%C2%AC%C3%A2%C2%80%C2%9A&sso_reload=true	Joe Sandbox AI: Score: 9 Reasons: The brand 'Microsoft' is classified as 'wellknown'., The URL 'djdjkdlellekkff.gharelokhana.com' does not match the legitimate domain 'microsoft.com'., The domain 'gharelokhana.com' is not associated with Microsoft., The subdomain 'djdjkdlellekkff' appears random and suspicious., The presence of a well-known brand name with an unrelated domain is a common phishing tactic. DOM: 3.7.pages.csv
Source: https://djdjkdlellekkff.gharelokhana.com/?km=a2xhdXMubWFkZXJAc2JvLmNvLmF0%C3%83%C2%A3%C3%A2%C2%82%C2%AC%C3%A2%C2%80%C2%9A$$$%C3%83%C2%A3%C3%A2%C2%82%C2%AC%C3%A2%C2%80%C2%9A&sso_reload=true	Joe Sandbox AI: Score: 9 Reasons: The brand 'Microsoft' is classified as 'wellknown'., The URL 'djdjkdlellekkff.gharelokhana.com' does not match the legitimate domain 'microsoft.com'., The domain 'gharelokhana.com' is unrelated to Microsoft and appears suspicious., The subdomain 'djdjkdlellekkff' is nonsensical and adds to the suspicion., The email domain 'sbo.co.at' is unrelated to Microsoft, which could indicate a phishing attempt. DOM: 3.8.pages.csv

Yara detected HtmlPhish54

Source: Yara match	File source: 1.3.id.script.csv, type: HTML
Source: Yara match	File source: 1.10.id.script.csv, type: HTML
Source: Yara match	File source: 2.2.pages.csv, type: HTML
Source: Yara match	File source: 3.3.pages.csv, type: HTML
Source: Yara match	File source: 3.5.pages.csv, type: HTML
Source: Yara match	File source: 3.7.pages.csv, type: HTML
Source: Yara match	File source: 3.8.pages.csv, type: HTML

AI detected landing page (webpage, office document or email)

Source: Email

Joe Sandbox AI: Email contains prominent button: 'listen'

AI detected potential phishing Email

Source: Email

Joe Sandbox AI: Detected potential phishing email: Suspicious sender domain 'culbertsplumbing.com' doesn't match the claimed Fujipharma business context. Multiple suspicious encoded/obfuscated URLs including a suspicious Google redirect to '.dz' domain. Multiple identical PDF attachments with non-descriptive names suggest malicious intent

AI detected suspicious Javascript

Source: 1.0.id.script.csv	Joe Sandbox AI: Detected suspicious JavaScript with source url: https://djdjkdlellekkff.gharelokhana.com/?km=a2xhd... This code shows multiple high-risk indicators: heavy obfuscation (array-based encoding), suspicious string patterns (including ad-related selectors and tracking elements), and potential DOM manipulation capabilities. The code appears to be deliberately obscured to hide its true functionality, which is a common malware technique.
Source: 1.8.id.script.csv	Joe Sandbox AI: Detected suspicious JavaScript with source url: https://djdjkdlellekkff.gharelokhana.com/?km=a2xhd... This code shows multiple high-risk indicators: heavy obfuscation (encoded strings, numeric hex values), complex control flow obfuscation (nested functions, conditional logic), and use of dynamic array manipulation. The code appears to be intentionally obscured to hide its true functionality, which is a common malware technique.
Source: 1.3.id.script.csv	Joe Sandbox AI: Detected suspicious JavaScript with source url: https://djdjkdlellekkff.gharelokhana.com/?km=a2xhd... High-risk indicators present: Script uses suspicious domains (gharelokhana.com) masquerading as Microsoft login, contains obfuscated/encoded strings, and appears to be a sophisticated phishing attempt collecting login credentials. Multiple suspicious endpoints for data collection and unusual domain patterns indicate malicious intent.
Source: 1.10.id.script.csv	Joe Sandbox AI: Detected suspicious JavaScript with source url: https://djdjkdlellekkff.gharelokhana.com/?km=a2xhd... High-risk script showing multiple red flags: 1) Suspicious redirect URLs to 'gharelokhana.com' which appears to be impersonating a legitimate service 2) OAuth flow manipulation attempting to capture authentication credentials 3) Complex URL encoding to obscure malicious parameters 4) Multiple suspicious domains used as fallbacks. This appears to be a sophisticated phishing attempt.

Source: https://djdjkdlellekkff.gharelokhana.com/?km=a2xhdXMubWFkZXJAc2JvLmNvLmF0%C3%83%C2%A3%C3%A2%C2%82%C2%AC%C3%A2%C2%80%C2%9A$$$%C3%83%C2%A3%C3%A2%C2%82%C2%AC%C3%A2%C2%80%C2%9A&sso_reload=true

HTTP Parser: klaus.mader@sbo.co.at

Source: https://djdjkdlellekkff.gharelokhana.com/?km=a2xhdXMubWFkZXJAc2JvLmNvLmF0%C3%83%C2%A3%C3%A2%C2%82%C2%AC%C3%A2%C2%80%C2%9A$$$%C3%83%C2%A3%C3%A2%C2%82%C2%AC%C3%A2%C2%80%C2%9A&sso_reload=true

HTTP Parser: Number of links: 0

Source: https://djdjkdlellekkff.gharelokhana.com/?km=a2xhdXMubWFkZXJAc2JvLmNvLmF0%C3%83%C2%A3%C3%A2%C2%82%C2%AC%C3%A2%C2%80%C2%9A$$$%C3%83%C2%A3%C3%A2%C2%82%C2%AC%C3%A2%C2%80%C2%9A

HTTP Parser: Base64 decoded: a[href="http://www.salidzini.lv/"][style="display: block; width: 88px; height: 31px; overflow: hidden; position: relative;"]

Source: https://djdjkdlellekkff.gharelokhana.com/?km=a2xhdXMubWFkZXJAc2JvLmNvLmF0%C3%83%C2%A3%C3%A2%C2%82%C2%AC%C3%A2%C2%80%C2%9A$$$%C3%83%C2%A3%C3%A2%C2%82%C2%AC%C3%A2%C2%80%C2%9A&sso_reload=true

HTTP Parser: Title: Sign in to your account does not match URL

Source: Email

Classification: Invoice Scam

Source: https://djdjkdlellekkff.gharelokhana.com/?km=a2xhdXMubWFkZXJAc2JvLmNvLmF0%C3%83%C2%A3%C3%A2%C2%82%C2%AC%C3%A2%C2%80%C2%9A$$$%C3%83%C2%A3%C3%A2%C2%82%C2%AC%C3%A2%C2%80%C2%9A&sso_reload=true	HTTP Parser: Iframe src: https://67f9d952-5bf3911d.gharelokhana.com/Prefetch/Prefetch.aspx
Source: https://djdjkdlellekkff.gharelokhana.com/?km=a2xhdXMubWFkZXJAc2JvLmNvLmF0%C3%83%C2%A3%C3%A2%C2%82%C2%AC%C3%A2%C2%80%C2%9A$$$%C3%83%C2%A3%C3%A2%C2%82%C2%AC%C3%A2%C2%80%C2%9A&sso_reload=true	HTTP Parser: Iframe src: https://67f9d952-5bf3911d.gharelokhana.com/Prefetch/Prefetch.aspx
Source: https://djdjkdlellekkff.gharelokhana.com/?km=a2xhdXMubWFkZXJAc2JvLmNvLmF0%C3%83%C2%A3%C3%A2%C2%82%C2%AC%C3%A2%C2%80%C2%9A$$$%C3%83%C2%A3%C3%A2%C2%82%C2%AC%C3%A2%C2%80%C2%9A&sso_reload=true	HTTP Parser: Iframe src: https://67f9d952-5bf3911d.gharelokhana.com/Prefetch/Prefetch.aspx
Source: https://djdjkdlellekkff.gharelokhana.com/?km=a2xhdXMubWFkZXJAc2JvLmNvLmF0%C3%83%C2%A3%C3%A2%C2%82%C2%AC%C3%A2%C2%80%C2%9A$$$%C3%83%C2%A3%C3%A2%C2%82%C2%AC%C3%A2%C2%80%C2%9A&sso_reload=true	HTTP Parser: Iframe src: https://67f9d952-5bf3911d.gharelokhana.com/Prefetch/Prefetch.aspx

Source: https://djdjkdlellekkff.gharelokhana.com/?km=a2xhdXMubWFkZXJAc2JvLmNvLmF0%C3%83%C2%A3%C3%A2%C2%82%C2%AC%C3%A2%C2%80%C2%9A$$$%C3%83%C2%A3%C3%A2%C2%82%C2%AC%C3%A2%C2%80%C2%9A&sso_reload=true

HTTP Parser: <input type="password" .../> found

Source: https://djdjkdlellekkff.gharelokhana.com/?km=a2xhdXMubWFkZXJAc2JvLmNvLmF0%C3%83%C2%A3%C3%A2%C2%82%C2%AC%C3%A2%C2%80%C2%9A$$$%C3%83%C2%A3%C3%A2%C2%82%C2%AC%C3%A2%C2%80%C2%9A	HTTP Parser: No favicon
Source: https://djdjkdlellekkff.gharelokhana.com/?km=a2xhdXMubWFkZXJAc2JvLmNvLmF0%C3%83%C2%A3%C3%A2%C2%82%C2%AC%C3%A2%C2%80%C2%9A$$$%C3%83%C2%A3%C3%A2%C2%82%C2%AC%C3%A2%C2%80%C2%9A&sso_reload=true	HTTP Parser: No favicon
Source: https://djdjkdlellekkff.gharelokhana.com/?km=a2xhdXMubWFkZXJAc2JvLmNvLmF0%C3%83%C2%A3%C3%A2%C2%82%C2%AC%C3%A2%C2%80%C2%9A$$$%C3%83%C2%A3%C3%A2%C2%82%C2%AC%C3%A2%C2%80%C2%9A&sso_reload=true	HTTP Parser: No favicon
Source: https://djdjkdlellekkff.gharelokhana.com/?km=a2xhdXMubWFkZXJAc2JvLmNvLmF0%C3%83%C2%A3%C3%A2%C2%82%C2%AC%C3%A2%C2%80%C2%9A$$$%C3%83%C2%A3%C3%A2%C2%82%C2%AC%C3%A2%C2%80%C2%9A&sso_reload=true	HTTP Parser: No favicon
Source: https://djdjkdlellekkff.gharelokhana.com/?km=a2xhdXMubWFkZXJAc2JvLmNvLmF0%C3%83%C2%A3%C3%A2%C2%82%C2%AC%C3%A2%C2%80%C2%9A$$$%C3%83%C2%A3%C3%A2%C2%82%C2%AC%C3%A2%C2%80%C2%9A&sso_reload=true	HTTP Parser: No favicon
Source: https://djdjkdlellekkff.gharelokhana.com/?km=a2xhdXMubWFkZXJAc2JvLmNvLmF0%C3%83%C2%A3%C3%A2%C2%82%C2%AC%C3%A2%C2%80%C2%9A$$$%C3%83%C2%A3%C3%A2%C2%82%C2%AC%C3%A2%C2%80%C2%9A&sso_reload=true	HTTP Parser: No favicon
Source: https://djdjkdlellekkff.gharelokhana.com/?km=a2xhdXMubWFkZXJAc2JvLmNvLmF0%C3%83%C2%A3%C3%A2%C2%82%C2%AC%C3%A2%C2%80%C2%9A$$$%C3%83%C2%A3%C3%A2%C2%82%C2%AC%C3%A2%C2%80%C2%9A&sso_reload=true	HTTP Parser: No favicon

Source: https://djdjkdlellekkff.gharelokhana.com/?km=a2xhdXMubWFkZXJAc2JvLmNvLmF0%C3%83%C2%A3%C3%A2%C2%82%C2%AC%C3%A2%C2%80%C2%9A$$$%C3%83%C2%A3%C3%A2%C2%82%C2%AC%C3%A2%C2%80%C2%9A&sso_reload=true	HTTP Parser: No <meta name="author".. found
Source: https://djdjkdlellekkff.gharelokhana.com/?km=a2xhdXMubWFkZXJAc2JvLmNvLmF0%C3%83%C2%A3%C3%A2%C2%82%C2%AC%C3%A2%C2%80%C2%9A$$$%C3%83%C2%A3%C3%A2%C2%82%C2%AC%C3%A2%C2%80%C2%9A&sso_reload=true	HTTP Parser: No <meta name="author".. found
Source: https://djdjkdlellekkff.gharelokhana.com/?km=a2xhdXMubWFkZXJAc2JvLmNvLmF0%C3%83%C2%A3%C3%A2%C2%82%C2%AC%C3%A2%C2%80%C2%9A$$$%C3%83%C2%A3%C3%A2%C2%82%C2%AC%C3%A2%C2%80%C2%9A&sso_reload=true	HTTP Parser: No <meta name="author".. found
Source: https://djdjkdlellekkff.gharelokhana.com/?km=a2xhdXMubWFkZXJAc2JvLmNvLmF0%C3%83%C2%A3%C3%A2%C2%82%C2%AC%C3%A2%C2%80%C2%9A$$$%C3%83%C2%A3%C3%A2%C2%82%C2%AC%C3%A2%C2%80%C2%9A&sso_reload=true	HTTP Parser: No <meta name="author".. found

Source: https://djdjkdlellekkff.gharelokhana.com/?km=a2xhdXMubWFkZXJAc2JvLmNvLmF0%C3%83%C2%A3%C3%A2%C2%82%C2%AC%C3%A2%C2%80%C2%9A$$$%C3%83%C2%A3%C3%A2%C2%82%C2%AC%C3%A2%C2%80%C2%9A&sso_reload=true	HTTP Parser: No <meta name="copyright".. found
Source: https://djdjkdlellekkff.gharelokhana.com/?km=a2xhdXMubWFkZXJAc2JvLmNvLmF0%C3%83%C2%A3%C3%A2%C2%82%C2%AC%C3%A2%C2%80%C2%9A$$$%C3%83%C2%A3%C3%A2%C2%82%C2%AC%C3%A2%C2%80%C2%9A&sso_reload=true	HTTP Parser: No <meta name="copyright".. found
Source: https://djdjkdlellekkff.gharelokhana.com/?km=a2xhdXMubWFkZXJAc2JvLmNvLmF0%C3%83%C2%A3%C3%A2%C2%82%C2%AC%C3%A2%C2%80%C2%9A$$$%C3%83%C2%A3%C3%A2%C2%82%C2%AC%C3%A2%C2%80%C2%9A&sso_reload=true	HTTP Parser: No <meta name="copyright".. found
Source: https://djdjkdlellekkff.gharelokhana.com/?km=a2xhdXMubWFkZXJAc2JvLmNvLmF0%C3%83%C2%A3%C3%A2%C2%82%C2%AC%C3%A2%C2%80%C2%9A$$$%C3%83%C2%A3%C3%A2%C2%82%C2%AC%C3%A2%C2%80%C2%9A&sso_reload=true	HTTP Parser: No <meta name="copyright".. found

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 2857090 - Severity 1 - ETPRO PHISHING JS/PsyduckPockeball Payload Inbound : 164.92.191.86:443 -> 192.168.2.8:49739

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

HTTP traffic: Redirect from: www.google.dz to https://alvoradavisual.com.br/yoya/cjbh/a2xhdxmubwfkzxjac2jvlmnvlmf0$$$

Source: Joe Sandbox View

IP Address: 239.255.255.250 239.255.255.250

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /url?a=https%3a%2f%2fgoogle.dz%2furl%3fq%3dnrnq5JLi6z3yh%26rct%3dtTPvvq6xRyj7Y00xDjnlx9kIjusucT%26sa%3dt%26url%3damp%2fs%252falvoradavisual.com.br%252fyoya%2fcjbh%2fa2xhdXMubWFkZXJAc2JvLmNvLmF0%c3%a3%e2%82%ac%e2%80%9a%24%24%24%c3%a3%e2%82%ac%e2%80%9a&c=E,1,acdMIvaoQStC4aiulDn5jPGsnimtLMV1JFn6BeW342oWxCIFHFvSiA0y2yY0Hz6ZJg_fxZUtnDRFz4Y_7GVcOkttSEslJfLPkj2AwC2wEfirVZI,&typo=1 HTTP/1.1Host: linkprotect.cudasvc.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /url?q=nrnq5JLi6z3yh&rct=tTPvvq6xRyj7Y00xDjnlx9kIjusucT&sa=t&url=amp/s%2falvoradavisual.com.br%2fyoya/cjbh/a2xhdXMubWFkZXJAc2JvLmNvLmF0%C3%A3%E2%82%AC%E2%80%9A$$$%C3%A3%E2%82%AC%E2%80%9A HTTP/1.1Host: google.dzConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /url?q=nrnq5JLi6z3yh&rct=tTPvvq6xRyj7Y00xDjnlx9kIjusucT&sa=t&url=amp/s%2Falvoradavisual.com.br%2Fyoya/cjbh/a2xhdXMubWFkZXJAc2JvLmNvLmF0%C3%A3%E2%82%AC%E2%80%9A$$$%C3%A3%E2%82%AC%E2%80%9A HTTP/1.1Host: www.google.dzConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /amp/s/alvoradavisual.com.br/yoya/cjbh/a2xhdXMubWFkZXJAc2JvLmNvLmF0%C3%A3%E2%82%AC%E2%80%9A$$$%C3%A3%E2%82%AC%E2%80%9A HTTP/1.1Host: www.google.dzConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=519=XLauBolikN8BvpO6I94MfjjYrrc1I2vuKBeoFz4JwYCDpIAGHZr8E1dgQI4LBPJ-6O5XgjO_ZunkkZ8urlfPDzEznulx5_nu1vDHQ-TLJvT-m0xlD4v95igolfBrd2Ti4um52EBdiK-f8HKhG22KVw8g7Bo2crY6B0D0VdPzzUBvE7vIJHEDJCIlT6U0UVfiPaDc
Source: global traffic	HTTP traffic detected: GET /yoya/cjbh/a2xhdXMubWFkZXJAc2JvLmNvLmF0%C3%A3%E2%82%AC%E2%80%9A$$$%C3%A3%E2%82%AC%E2%80%9A HTTP/1.1Host: alvoradavisual.com.brConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: alvoradavisual.com.brConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://alvoradavisual.com.br/yoya/cjbh/a2xhdXMubWFkZXJAc2JvLmNvLmF0%C3%A3%E2%82%AC%E2%80%9A$$$%C3%A3%E2%82%AC%E2%80%9AAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /?km=a2xhdXMubWFkZXJAc2JvLmNvLmF0%C3%83%C2%A3%C3%A2%C2%82%C2%AC%C3%A2%C2%80%C2%9A$$$%C3%83%C2%A3%C3%A2%C2%82%C2%AC%C3%A2%C2%80%C2%9A HTTP/1.1Host: djdjkdlellekkff.gharelokhana.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: documentReferer: https://alvoradavisual.com.br/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /?km=a2xhdXMubWFkZXJAc2JvLmNvLmF0%C3%83%C2%A3%C3%A2%C2%82%C2%AC%C3%A2%C2%80%C2%9A$$$%C3%83%C2%A3%C3%A2%C2%82%C2%AC%C3%A2%C2%80%C2%9A HTTP/1.1Host: djdjkdlellekkff.gharelokhana.comConnection: keep-aliveCache-Control: max-age=0Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Referer: https://djdjkdlellekkff.gharelokhana.com/?km=a2xhdXMubWFkZXJAc2JvLmNvLmF0%C3%83%C2%A3%C3%A2%C2%82%C2%AC%C3%A2%C2%80%C2%9A$$$%C3%83%C2%A3%C3%A2%C2%82%C2%AC%C3%A2%C2%80%C2%9AAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: zQt4SK="NWJmMzkxMWQtNjk5NS00ZGNjLTlmMjYtMjc0YTExMTdiNmZkOmFkNmQ3ZGY4LWUzYzQtNDRhZS1hNDVhLWFkMzBkMDQ3NTIzNg=="
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/BssoInterrupt_Core_zKox_QMcTIVut7mG_Z9Eew2.js HTTP/1.1Host: e7a91062-5bf3911d.gharelokhana.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://djdjkdlellekkff.gharelokhana.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://djdjkdlellekkff.gharelokhana.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /5bf3911d69954dcc9f26274a1117b6fd/ HTTP/1.1Host: djdjkdlellekkff.gharelokhana.comConnection: UpgradePragma: no-cacheCache-Control: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Upgrade: websocketOrigin: https://djdjkdlellekkff.gharelokhana.comSec-WebSocket-Version: 13Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: zQt4SK="NWJmMzkxMWQtNjk5NS00ZGNjLTlmMjYtMjc0YTExMTdiNmZkOmFkNmQ3ZGY4LWUzYzQtNDRhZS1hNDVhLWFkMzBkMDQ3NTIzNg=="Sec-WebSocket-Key: cAtyGZPXWa2iYTHSEyGLWA==Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
Source: global traffic	HTTP traffic detected: GET /?km=a2xhdXMubWFkZXJAc2JvLmNvLmF0%C3%83%C2%A3%C3%A2%C2%82%C2%AC%C3%A2%C2%80%C2%9A$$$%C3%83%C2%A3%C3%A2%C2%82%C2%AC%C3%A2%C2%80%C2%9A&sso_reload=true HTTP/1.1Host: djdjkdlellekkff.gharelokhana.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-Dest: documentReferer: https://djdjkdlellekkff.gharelokhana.com/?km=a2xhdXMubWFkZXJAc2JvLmNvLmF0%C3%83%C2%A3%C3%A2%C2%82%C2%AC%C3%A2%C2%80%C2%9A$$$%C3%83%C2%A3%C3%A2%C2%82%C2%AC%C3%A2%C2%80%C2%9AAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: zQt4SK="NWJmMzkxMWQtNjk5NS00ZGNjLTlmMjYtMjc0YTExMTdiNmZkOmFkNmQ3ZGY4LWUzYzQtNDRhZS1hNDVhLWFkMzBkMDQ3NTIzNg=="; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: djdjkdlellekkff.gharelokhana.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://djdjkdlellekkff.gharelokhana.com/?km=a2xhdXMubWFkZXJAc2JvLmNvLmF0%C3%83%C2%A3%C3%A2%C2%82%C2%AC%C3%A2%C2%80%C2%9A$$$%C3%83%C2%A3%C3%A2%C2%82%C2%AC%C3%A2%C2%80%C2%9AAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: zQt4SK="NWJmMzkxMWQtNjk5NS00ZGNjLTlmMjYtMjc0YTExMTdiNmZkOmFkNmQ3ZGY4LWUzYzQtNDRhZS1hNDVhLWFkMzBkMDQ3NTIzNg=="
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/BssoInterrupt_Core_zKox_QMcTIVut7mG_Z9Eew2.js HTTP/1.1Host: e7a91062-5bf3911d.gharelokhana.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: zQt4SK="NWJmMzkxMWQtNjk5NS00ZGNjLTlmMjYtMjc0YTExMTdiNmZkOmFkNmQ3ZGY4LWUzYzQtNDRhZS1hNDVhLWFkMzBkMDQ3NTIzNg=="
Source: global traffic	HTTP traffic detected: GET /ests/2.1/content/cdnbundles/converged.v2.login.min_nin8k2ycrbzww8zl5vxkaq2.css HTTP/1.1Host: 82ce8558-5bf3911d.gharelokhana.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://djdjkdlellekkff.gharelokhana.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: styleReferer: https://djdjkdlellekkff.gharelokhana.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/ConvergedLogin_PCore_h6TdaK6cfsrg175w47aRCA2.js HTTP/1.1Host: 82ce8558-5bf3911d.gharelokhana.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://djdjkdlellekkff.gharelokhana.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://djdjkdlellekkff.gharelokhana.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ests/2.1/content/cdnbundles/ux.converged.login.strings-en.min_i8f-75gfk3tbsm8bmatnqa2.js HTTP/1.1Host: 82ce8558-5bf3911d.gharelokhana.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://djdjkdlellekkff.gharelokhana.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://djdjkdlellekkff.gharelokhana.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /Me.htm?v=3 HTTP/1.1Host: l1ve.gharelokhana.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Purpose: prefetchSec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyReferer: https://djdjkdlellekkff.gharelokhana.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: zQt4SK="NWJmMzkxMWQtNjk5NS00ZGNjLTlmMjYtMjc0YTExMTdiNmZkOmFkNmQ3ZGY4LWUzYzQtNDRhZS1hNDVhLWFkMzBkMDQ3NTIzNg=="
Source: global traffic	HTTP traffic detected: GET /ests/2.1/content/cdnbundles/ux.converged.login.strings-en.min_i8f-75gfk3tbsm8bmatnqa2.js HTTP/1.1Host: 82ce8558-5bf3911d.gharelokhana.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: zQt4SK="NWJmMzkxMWQtNjk5NS00ZGNjLTlmMjYtMjc0YTExMTdiNmZkOmFkNmQ3ZGY4LWUzYzQtNDRhZS1hNDVhLWFkMzBkMDQ3NTIzNg=="
Source: global traffic	HTTP traffic detected: GET /5bf3911d69954dcc9f26274a1117b6fd/ HTTP/1.1Host: djdjkdlellekkff.gharelokhana.comConnection: UpgradePragma: no-cacheCache-Control: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Upgrade: websocketOrigin: https://djdjkdlellekkff.gharelokhana.comSec-WebSocket-Version: 13Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: zQt4SK="NWJmMzkxMWQtNjk5NS00ZGNjLTlmMjYtMjc0YTExMTdiNmZkOmFkNmQ3ZGY4LWUzYzQtNDRhZS1hNDVhLWFkMzBkMDQ3NTIzNg=="; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1Sec-WebSocket-Key: 1Lv6nqYKBI+cV+CyYjVvjA==Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/asyncchunk/convergedlogin_pcustomizationloader_117b650bccea354984d8.js HTTP/1.1Host: 82ce8558-5bf3911d.gharelokhana.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://djdjkdlellekkff.gharelokhana.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: zQt4SK="NWJmMzkxMWQtNjk5NS00ZGNjLTlmMjYtMjc0YTExMTdiNmZkOmFkNmQ3ZGY4LWUzYzQtNDRhZS1hNDVhLWFkMzBkMDQ3NTIzNg=="
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/ConvergedLogin_PCore_h6TdaK6cfsrg175w47aRCA2.js HTTP/1.1Host: 82ce8558-5bf3911d.gharelokhana.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: zQt4SK="NWJmMzkxMWQtNjk5NS00ZGNjLTlmMjYtMjc0YTExMTdiNmZkOmFkNmQ3ZGY4LWUzYzQtNDRhZS1hNDVhLWFkMzBkMDQ3NTIzNg=="
Source: global traffic	HTTP traffic detected: GET /Prefetch/Prefetch.aspx HTTP/1.1Host: 67f9d952-5bf3911d.gharelokhana.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://djdjkdlellekkff.gharelokhana.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: zQt4SK="NWJmMzkxMWQtNjk5NS00ZGNjLTlmMjYtMjc0YTExMTdiNmZkOmFkNmQ3ZGY4LWUzYzQtNDRhZS1hNDVhLWFkMzBkMDQ3NTIzNg=="
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/asyncchunk/convergedlogin_pfetchsessionsprogress_d0a803279e7397bef834.js HTTP/1.1Host: 82ce8558-5bf3911d.gharelokhana.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://djdjkdlellekkff.gharelokhana.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: zQt4SK="NWJmMzkxMWQtNjk5NS00ZGNjLTlmMjYtMjc0YTExMTdiNmZkOmFkNmQ3ZGY4LWUzYzQtNDRhZS1hNDVhLWFkMzBkMDQ3NTIzNg=="
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/marching_ants_white_8257b0707cbe1d0bd2661b80068676fe.gif HTTP/1.1Host: 82ce8558-5bf3911d.gharelokhana.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://djdjkdlellekkff.gharelokhana.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: zQt4SK="NWJmMzkxMWQtNjk5NS00ZGNjLTlmMjYtMjc0YTExMTdiNmZkOmFkNmQ3ZGY4LWUzYzQtNDRhZS1hNDVhLWFkMzBkMDQ3NTIzNg=="
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/marching_ants_986f40b5a9dc7d39ef8396797f61b323.gif HTTP/1.1Host: 82ce8558-5bf3911d.gharelokhana.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://djdjkdlellekkff.gharelokhana.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: zQt4SK="NWJmMzkxMWQtNjk5NS00ZGNjLTlmMjYtMjc0YTExMTdiNmZkOmFkNmQ3ZGY4LWUzYzQtNDRhZS1hNDVhLWFkMzBkMDQ3NTIzNg=="
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/asyncchunk/convergedlogin_pcustomizationloader_117b650bccea354984d8.js HTTP/1.1Host: 82ce8558-5bf3911d.gharelokhana.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: zQt4SK="NWJmMzkxMWQtNjk5NS00ZGNjLTlmMjYtMjc0YTExMTdiNmZkOmFkNmQ3ZGY4LWUzYzQtNDRhZS1hNDVhLWFkMzBkMDQ3NTIzNg=="
Source: global traffic	HTTP traffic detected: GET /5bf3911d69954dcc9f26274a1117b6fd/ HTTP/1.1Host: djdjkdlellekkff.gharelokhana.comConnection: UpgradePragma: no-cacheCache-Control: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Upgrade: websocketOrigin: https://djdjkdlellekkff.gharelokhana.comSec-WebSocket-Version: 13Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: zQt4SK="NWJmMzkxMWQtNjk5NS00ZGNjLTlmMjYtMjc0YTExMTdiNmZkOmFkNmQ3ZGY4LWUzYzQtNDRhZS1hNDVhLWFkMzBkMDQ3NTIzNg=="; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; brcap=0Sec-WebSocket-Key: dqP/U45K2Fb1jc/ls5NZPw==Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/backgrounds/2_11d9e3bcdfede9ce5ce5ace2d129f1c4.svg HTTP/1.1Host: 82ce8558-5bf3911d.gharelokhana.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://djdjkdlellekkff.gharelokhana.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: zQt4SK="NWJmMzkxMWQtNjk5NS00ZGNjLTlmMjYtMjc0YTExMTdiNmZkOmFkNmQ3ZGY4LWUzYzQtNDRhZS1hNDVhLWFkMzBkMDQ3NTIzNg=="
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/microsoft_logo_564db913a7fa0ca42727161c6d031bef.svg HTTP/1.1Host: 82ce8558-5bf3911d.gharelokhana.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://djdjkdlellekkff.gharelokhana.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: zQt4SK="NWJmMzkxMWQtNjk5NS00ZGNjLTlmMjYtMjc0YTExMTdiNmZkOmFkNmQ3ZGY4LWUzYzQtNDRhZS1hNDVhLWFkMzBkMDQ3NTIzNg=="
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico HTTP/1.1Host: 82ce8558-5bf3911d.gharelokhana.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://djdjkdlellekkff.gharelokhana.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: zQt4SK="NWJmMzkxMWQtNjk5NS00ZGNjLTlmMjYtMjc0YTExMTdiNmZkOmFkNmQ3ZGY4LWUzYzQtNDRhZS1hNDVhLWFkMzBkMDQ3NTIzNg=="
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/marching_ants_986f40b5a9dc7d39ef8396797f61b323.gif HTTP/1.1Host: 82ce8558-5bf3911d.gharelokhana.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: zQt4SK="NWJmMzkxMWQtNjk5NS00ZGNjLTlmMjYtMjc0YTExMTdiNmZkOmFkNmQ3ZGY4LWUzYzQtNDRhZS1hNDVhLWFkMzBkMDQ3NTIzNg=="
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/marching_ants_white_8257b0707cbe1d0bd2661b80068676fe.gif HTTP/1.1Host: 82ce8558-5bf3911d.gharelokhana.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: zQt4SK="NWJmMzkxMWQtNjk5NS00ZGNjLTlmMjYtMjc0YTExMTdiNmZkOmFkNmQ3ZGY4LWUzYzQtNDRhZS1hNDVhLWFkMzBkMDQ3NTIzNg=="
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/asyncchunk/convergedlogin_pfetchsessionsprogress_d0a803279e7397bef834.js HTTP/1.1Host: 82ce8558-5bf3911d.gharelokhana.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: zQt4SK="NWJmMzkxMWQtNjk5NS00ZGNjLTlmMjYtMjc0YTExMTdiNmZkOmFkNmQ3ZGY4LWUzYzQtNDRhZS1hNDVhLWFkMzBkMDQ3NTIzNg=="
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/microsoft_logo_564db913a7fa0ca42727161c6d031bef.svg HTTP/1.1Host: 82ce8558-5bf3911d.gharelokhana.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: zQt4SK="NWJmMzkxMWQtNjk5NS00ZGNjLTlmMjYtMjc0YTExMTdiNmZkOmFkNmQ3ZGY4LWUzYzQtNDRhZS1hNDVhLWFkMzBkMDQ3NTIzNg=="
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/backgrounds/2_11d9e3bcdfede9ce5ce5ace2d129f1c4.svg HTTP/1.1Host: 82ce8558-5bf3911d.gharelokhana.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: zQt4SK="NWJmMzkxMWQtNjk5NS00ZGNjLTlmMjYtMjc0YTExMTdiNmZkOmFkNmQ3ZGY4LWUzYzQtNDRhZS1hNDVhLWFkMzBkMDQ3NTIzNg=="
Source: global traffic	HTTP traffic detected: GET /sbo.co.at/winauth/ssoprobe?client-request-id=8d97587d-1931-4a24-9948-0d928dffd68c&_=1733383491884 HTTP/1.1Host: 5088df79-5bf3911d.gharelokhana.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://djdjkdlellekkff.gharelokhana.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: zQt4SK="NWJmMzkxMWQtNjk5NS00ZGNjLTlmMjYtMjc0YTExMTdiNmZkOmFkNmQ3ZGY4LWUzYzQtNDRhZS1hNDVhLWFkMzBkMDQ3NTIzNg=="
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico HTTP/1.1Host: 82ce8558-5bf3911d.gharelokhana.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: zQt4SK="NWJmMzkxMWQtNjk5NS00ZGNjLTlmMjYtMjc0YTExMTdiNmZkOmFkNmQ3ZGY4LWUzYzQtNDRhZS1hNDVhLWFkMzBkMDQ3NTIzNg=="
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/asyncchunk/convergedlogin_pstringcustomizationhelper_4285088f1dbaf52a876d.js HTTP/1.1Host: 82ce8558-5bf3911d.gharelokhana.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://djdjkdlellekkff.gharelokhana.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: zQt4SK="NWJmMzkxMWQtNjk5NS00ZGNjLTlmMjYtMjc0YTExMTdiNmZkOmFkNmQ3ZGY4LWUzYzQtNDRhZS1hNDVhLWFkMzBkMDQ3NTIzNg=="
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/signin-options_3e3f6b73c3f310c31d2c4d131a8ab8c6.svg HTTP/1.1Host: 82ce8558-5bf3911d.gharelokhana.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://djdjkdlellekkff.gharelokhana.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: zQt4SK="NWJmMzkxMWQtNjk5NS00ZGNjLTlmMjYtMjc0YTExMTdiNmZkOmFkNmQ3ZGY4LWUzYzQtNDRhZS1hNDVhLWFkMzBkMDQ3NTIzNg=="
Source: global traffic	HTTP traffic detected: GET /5bf3911d69954dcc9f26274a1117b6fd/ HTTP/1.1Host: djdjkdlellekkff.gharelokhana.comConnection: UpgradePragma: no-cacheCache-Control: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Upgrade: websocketOrigin: https://djdjkdlellekkff.gharelokhana.comSec-WebSocket-Version: 13Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: zQt4SK="NWJmMzkxMWQtNjk5NS00ZGNjLTlmMjYtMjc0YTExMTdiNmZkOmFkNmQ3ZGY4LWUzYzQtNDRhZS1hNDVhLWFkMzBkMDQ3NTIzNg=="; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; brcap=0Sec-WebSocket-Key: pKuI03QTsSX4tFr4lzWD4A==Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/signin-options_3e3f6b73c3f310c31d2c4d131a8ab8c6.svg HTTP/1.1Host: 82ce8558-5bf3911d.gharelokhana.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: zQt4SK="NWJmMzkxMWQtNjk5NS00ZGNjLTlmMjYtMjc0YTExMTdiNmZkOmFkNmQ3ZGY4LWUzYzQtNDRhZS1hNDVhLWFkMzBkMDQ3NTIzNg=="
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/asyncchunk/convergedlogin_pstringcustomizationhelper_4285088f1dbaf52a876d.js HTTP/1.1Host: 82ce8558-5bf3911d.gharelokhana.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: zQt4SK="NWJmMzkxMWQtNjk5NS00ZGNjLTlmMjYtMjc0YTExMTdiNmZkOmFkNmQ3ZGY4LWUzYzQtNDRhZS1hNDVhLWFkMzBkMDQ3NTIzNg=="
Source: global traffic	HTTP traffic detected: GET /common/instrumentation/dssostatus HTTP/1.1Host: djdjkdlellekkff.gharelokhana.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: zQt4SK="NWJmMzkxMWQtNjk5NS00ZGNjLTlmMjYtMjc0YTExMTdiNmZkOmFkNmQ3ZGY4LWUzYzQtNDRhZS1hNDVhLWFkMzBkMDQ3NTIzNg=="; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; brcap=0
Source: global traffic	HTTP traffic detected: GET /5bf3911d69954dcc9f26274a1117b6fd/ HTTP/1.1Host: djdjkdlellekkff.gharelokhana.comConnection: UpgradePragma: no-cacheCache-Control: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Upgrade: websocketOrigin: https://djdjkdlellekkff.gharelokhana.comSec-WebSocket-Version: 13Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: zQt4SK="NWJmMzkxMWQtNjk5NS00ZGNjLTlmMjYtMjc0YTExMTdiNmZkOmFkNmQ3ZGY4LWUzYzQtNDRhZS1hNDVhLWFkMzBkMDQ3NTIzNg=="; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; brcap=0Sec-WebSocket-Key: SzkEBxFnDrbAW8ZJfQXPHQ==Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
Source: global traffic	HTTP traffic detected: GET /5bf3911d69954dcc9f26274a1117b6fd/ HTTP/1.1Host: djdjkdlellekkff.gharelokhana.comConnection: UpgradePragma: no-cacheCache-Control: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Upgrade: websocketOrigin: https://djdjkdlellekkff.gharelokhana.comSec-WebSocket-Version: 13Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: zQt4SK="NWJmMzkxMWQtNjk5NS00ZGNjLTlmMjYtMjc0YTExMTdiNmZkOmFkNmQ3ZGY4LWUzYzQtNDRhZS1hNDVhLWFkMzBkMDQ3NTIzNg=="; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; brcap=0Sec-WebSocket-Key: NJjrd1Wyk2YdfBgR/4U5WA==Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
Source: global traffic	HTTP traffic detected: GET /5bf3911d69954dcc9f26274a1117b6fd/ HTTP/1.1Host: djdjkdlellekkff.gharelokhana.comConnection: UpgradePragma: no-cacheCache-Control: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Upgrade: websocketOrigin: https://djdjkdlellekkff.gharelokhana.comSec-WebSocket-Version: 13Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: zQt4SK="NWJmMzkxMWQtNjk5NS00ZGNjLTlmMjYtMjc0YTExMTdiNmZkOmFkNmQ3ZGY4LWUzYzQtNDRhZS1hNDVhLWFkMzBkMDQ3NTIzNg=="; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; brcap=0Sec-WebSocket-Key: 8IUm0HYxC7F0Pubj0TCIAg==Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
Source: global traffic	HTTP traffic detected: GET /5bf3911d69954dcc9f26274a1117b6fd/ HTTP/1.1Host: djdjkdlellekkff.gharelokhana.comConnection: UpgradePragma: no-cacheCache-Control: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Upgrade: websocketOrigin: https://djdjkdlellekkff.gharelokhana.comSec-WebSocket-Version: 13Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: zQt4SK="NWJmMzkxMWQtNjk5NS00ZGNjLTlmMjYtMjc0YTExMTdiNmZkOmFkNmQ3ZGY4LWUzYzQtNDRhZS1hNDVhLWFkMzBkMDQ3NTIzNg=="; AADSSO=NA\|NoExtension; brcap=0Sec-WebSocket-Key: 3gu1mlhK/I6QVYN1Ldc5tQ==Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
Source: global traffic	HTTP traffic detected: GET /5bf3911d69954dcc9f26274a1117b6fd/ HTTP/1.1Host: djdjkdlellekkff.gharelokhana.comConnection: UpgradePragma: no-cacheCache-Control: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Upgrade: websocketOrigin: https://djdjkdlellekkff.gharelokhana.comSec-WebSocket-Version: 13Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: zQt4SK="NWJmMzkxMWQtNjk5NS00ZGNjLTlmMjYtMjc0YTExMTdiNmZkOmFkNmQ3ZGY4LWUzYzQtNDRhZS1hNDVhLWFkMzBkMDQ3NTIzNg=="; AADSSO=NA\|NoExtension; brcap=0Sec-WebSocket-Key: nB5nUKYjSWUUM2IeJszgvQ==Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
Source: global traffic	HTTP traffic detected: GET /5bf3911d69954dcc9f26274a1117b6fd/ HTTP/1.1Host: djdjkdlellekkff.gharelokhana.comConnection: UpgradePragma: no-cacheCache-Control: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Upgrade: websocketOrigin: https://djdjkdlellekkff.gharelokhana.comSec-WebSocket-Version: 13Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: zQt4SK="NWJmMzkxMWQtNjk5NS00ZGNjLTlmMjYtMjc0YTExMTdiNmZkOmFkNmQ3ZGY4LWUzYzQtNDRhZS1hNDVhLWFkMzBkMDQ3NTIzNg=="; AADSSO=NA\|NoExtension; brcap=0Sec-WebSocket-Key: BTiy7LKwCIUvNrGTG/iqew==Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
Source: global traffic	HTTP traffic detected: GET /5bf3911d69954dcc9f26274a1117b6fd/ HTTP/1.1Host: djdjkdlellekkff.gharelokhana.comConnection: UpgradePragma: no-cacheCache-Control: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Upgrade: websocketOrigin: https://djdjkdlellekkff.gharelokhana.comSec-WebSocket-Version: 13Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: zQt4SK="NWJmMzkxMWQtNjk5NS00ZGNjLTlmMjYtMjc0YTExMTdiNmZkOmFkNmQ3ZGY4LWUzYzQtNDRhZS1hNDVhLWFkMzBkMDQ3NTIzNg=="; AADSSO=NA\|NoExtension; brcap=0Sec-WebSocket-Key: /AqC7Lx6K6mLPC7QDIE/Zw==Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
Source: global traffic	HTTP traffic detected: GET /5bf3911d69954dcc9f26274a1117b6fd/ HTTP/1.1Host: djdjkdlellekkff.gharelokhana.comConnection: UpgradePragma: no-cacheCache-Control: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Upgrade: websocketOrigin: https://djdjkdlellekkff.gharelokhana.comSec-WebSocket-Version: 13Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: zQt4SK="NWJmMzkxMWQtNjk5NS00ZGNjLTlmMjYtMjc0YTExMTdiNmZkOmFkNmQ3ZGY4LWUzYzQtNDRhZS1hNDVhLWFkMzBkMDQ3NTIzNg=="; AADSSO=NA\|NoExtension; brcap=0Sec-WebSocket-Key: YJO9FgX9QSCi5rvDpIA1Hg==Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
Source: global traffic	HTTP traffic detected: GET /5bf3911d69954dcc9f26274a1117b6fd/ HTTP/1.1Host: djdjkdlellekkff.gharelokhana.comConnection: UpgradePragma: no-cacheCache-Control: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Upgrade: websocketOrigin: https://djdjkdlellekkff.gharelokhana.comSec-WebSocket-Version: 13Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: zQt4SK="NWJmMzkxMWQtNjk5NS00ZGNjLTlmMjYtMjc0YTExMTdiNmZkOmFkNmQ3ZGY4LWUzYzQtNDRhZS1hNDVhLWFkMzBkMDQ3NTIzNg=="; AADSSO=NA\|NoExtension; brcap=0Sec-WebSocket-Key: 9GYZ6r0MH1FrVFFleA1O4w==Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
Source: global traffic	HTTP traffic detected: GET /5bf3911d69954dcc9f26274a1117b6fd/ HTTP/1.1Host: djdjkdlellekkff.gharelokhana.comConnection: UpgradePragma: no-cacheCache-Control: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Upgrade: websocketOrigin: https://djdjkdlellekkff.gharelokhana.comSec-WebSocket-Version: 13Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: zQt4SK="NWJmMzkxMWQtNjk5NS00ZGNjLTlmMjYtMjc0YTExMTdiNmZkOmFkNmQ3ZGY4LWUzYzQtNDRhZS1hNDVhLWFkMzBkMDQ3NTIzNg=="; AADSSO=NA\|NoExtension; brcap=0Sec-WebSocket-Key: x9Vt/SDt0JE+s/8hgaAZkw==Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
Source: global traffic	HTTP traffic detected: GET /5bf3911d69954dcc9f26274a1117b6fd/ HTTP/1.1Host: djdjkdlellekkff.gharelokhana.comConnection: UpgradePragma: no-cacheCache-Control: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Upgrade: websocketOrigin: https://djdjkdlellekkff.gharelokhana.comSec-WebSocket-Version: 13Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: zQt4SK="NWJmMzkxMWQtNjk5NS00ZGNjLTlmMjYtMjc0YTExMTdiNmZkOmFkNmQ3ZGY4LWUzYzQtNDRhZS1hNDVhLWFkMzBkMDQ3NTIzNg=="; AADSSO=NA\|NoExtension; brcap=0Sec-WebSocket-Key: d9XFz1lKG4ywGolkYqwOYg==Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
Source: global traffic	HTTP traffic detected: GET /5bf3911d69954dcc9f26274a1117b6fd/ HTTP/1.1Host: djdjkdlellekkff.gharelokhana.comConnection: UpgradePragma: no-cacheCache-Control: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Upgrade: websocketOrigin: https://djdjkdlellekkff.gharelokhana.comSec-WebSocket-Version: 13Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: zQt4SK="NWJmMzkxMWQtNjk5NS00ZGNjLTlmMjYtMjc0YTExMTdiNmZkOmFkNmQ3ZGY4LWUzYzQtNDRhZS1hNDVhLWFkMzBkMDQ3NTIzNg=="; AADSSO=NA\|NoExtension; brcap=0Sec-WebSocket-Key: bGRlan2jHQSq7eQrtpFPcQ==Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
Source: global traffic	HTTP traffic detected: GET /5bf3911d69954dcc9f26274a1117b6fd/ HTTP/1.1Host: djdjkdlellekkff.gharelokhana.comConnection: UpgradePragma: no-cacheCache-Control: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Upgrade: websocketOrigin: https://djdjkdlellekkff.gharelokhana.comSec-WebSocket-Version: 13Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: zQt4SK="NWJmMzkxMWQtNjk5NS00ZGNjLTlmMjYtMjc0YTExMTdiNmZkOmFkNmQ3ZGY4LWUzYzQtNDRhZS1hNDVhLWFkMzBkMDQ3NTIzNg=="; AADSSO=NA\|NoExtension; brcap=0Sec-WebSocket-Key: uJe7cZLbEZ1ebTcDlTD8OA==Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits

Source: global traffic	DNS traffic detected: DNS query: linkprotect.cudasvc.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: google.dz
Source: global traffic	DNS traffic detected: DNS query: www.google.dz
Source: global traffic	DNS traffic detected: DNS query: alvoradavisual.com.br
Source: global traffic	DNS traffic detected: DNS query: djdjkdlellekkff.gharelokhana.com
Source: global traffic	DNS traffic detected: DNS query: e7a91062-5bf3911d.gharelokhana.com
Source: global traffic	DNS traffic detected: DNS query: 43042841-5bf3911d.gharelokhana.com
Source: global traffic	DNS traffic detected: DNS query: 82ce8558-5bf3911d.gharelokhana.com
Source: global traffic	DNS traffic detected: DNS query: l1ve.gharelokhana.com
Source: global traffic	DNS traffic detected: DNS query: 67f9d952-5bf3911d.gharelokhana.com
Source: global traffic	DNS traffic detected: DNS query: 5088df79-5bf3911d.gharelokhana.com
Source: global traffic	DNS traffic detected: DNS query: wwwms.gharelokhana.com

Source: unknown

HTTP traffic detected: POST /?km=a2xhdXMubWFkZXJAc2JvLmNvLmF0%C3%83%C2%A3%C3%A2%C2%82%C2%AC%C3%A2%C2%80%C2%9A$$$%C3%83%C2%A3%C3%A2%C2%82%C2%AC%C3%A2%C2%80%C2%9A HTTP/1.1Host: djdjkdlellekkff.gharelokhana.comConnection: keep-aliveContent-Length: 5206Cache-Control: max-age=0sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1Origin: https://djdjkdlellekkff.gharelokhana.comContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentReferer: https://djdjkdlellekkff.gharelokhana.com/?km=a2xhdXMubWFkZXJAc2JvLmNvLmF0%C3%83%C2%A3%C3%A2%C2%82%C2%AC%C3%A2%C2%80%C2%9A$$$%C3%83%C2%A3%C3%A2%C2%82%C2%AC%C3%A2%C2%80%C2%9AAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 05 Dec 2024 07:24:30 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 05 Dec 2024 07:24:42 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-Encodingcache-control: privatep3p: CP="DSP CUR OTPi IND OTRi ONL FIN"x-ms-request-id: 73783743-244d-455c-b441-0047e8dbb100x-ms-ests-server: 2.1.19568.3 - SEC ProdSlicesreport-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://43042841-5bf3911d.gharelokhana.com/api/report?catId=GW+estsfd+SEC"}]}nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0}x-ms-srs: 1.Preferrer-policy: strict-origin-when-cross-originaccess-control-allow-origin: access-control-allow-headers:
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 05 Dec 2024 07:24:42 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-Encodingcache-control: privatep3p: CP="DSP CUR OTPi IND OTRi ONL FIN"x-ms-request-id: 50c1e8d7-743b-4097-84d4-ab0eb0d40300x-ms-ests-server: 2.1.19492.3 - SEC ProdSlicesreport-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://43042841-5bf3911d.gharelokhana.com/api/report?catId=GW+estsfd+SEC"}]}nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0}x-ms-srs: 1.Preferrer-policy: strict-origin-when-cross-originaccess-control-allow-origin: access-control-allow-headers:
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 05 Dec 2024 07:24:49 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-Encodingcache-control: privatep3p: CP="DSP CUR OTPi IND OTRi ONL FIN"x-ms-request-id: eac4b1bb-d9ec-45a2-991a-84a861388201x-ms-ests-server: 2.1.19492.3 - SEC ProdSlicesreport-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://43042841-5bf3911d.gharelokhana.com/api/report?catId=GW+estsfd+SEC"}]}nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0}x-ms-srs: 1.Preferrer-policy: strict-origin-when-cross-originaccess-control-allow-origin: access-control-allow-headers:
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 05 Dec 2024 07:24:49 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeVary: Accept-Encodingcache-control: no-store, no-cachex-ms-correlation-id: d9dda0c3-f1df-40aa-9481-7bbba057574bx-ua-compatible: IE=Edgex-cache: CONFIG_NOCACHEx-msedge-ref: Ref A: 2EBDA27659CF4F16BE1D4C5A5E4AD0D4 Ref B: AMS231032604035 Ref C: 2024-12-05T07:24:49Zaccess-control-allow-origin: access-control-allow-headers:
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 05 Dec 2024 07:24:53 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-Encodingcache-control: privatep3p: CP="DSP CUR OTPi IND OTRi ONL FIN"x-ms-request-id: 713cb92a-3ead-48e3-bdad-6d59e967a301x-ms-ests-server: 2.1.19492.3 - FRC ProdSlicesreport-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://43042841-5bf3911d.gharelokhana.com/api/report?catId=GW+estsfd+SEC"}]}nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0}x-ms-srs: 1.Preferrer-policy: strict-origin-when-cross-originaccess-control-allow-origin: access-control-allow-headers:
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 05 Dec 2024 07:25:01 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-Encodingcache-control: privatep3p: CP="DSP CUR OTPi IND OTRi ONL FIN"x-ms-request-id: 6bd0b468-503d-4678-8aef-df1fc7e10c00x-ms-ests-server: 2.1.19492.3 - SEC ProdSlicesreport-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://43042841-5bf3911d.gharelokhana.com/api/report?catId=GW+estsfd+SEC"}]}nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0}x-ms-srs: 1.Preferrer-policy: strict-origin-when-cross-originaccess-control-allow-origin: access-control-allow-headers:
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 05 Dec 2024 07:25:09 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-Encodingcache-control: privatep3p: CP="DSP CUR OTPi IND OTRi ONL FIN"x-ms-request-id: b6dff307-74e4-4260-b77d-a31814300a00x-ms-ests-server: 2.1.19568.3 - WEULR1 ProdSlicesreport-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://43042841-5bf3911d.gharelokhana.com/api/report?catId=GW+estsfd+SEC"}]}nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0}x-ms-srs: 1.Preferrer-policy: strict-origin-when-cross-originaccess-control-allow-origin: access-control-allow-headers:
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 05 Dec 2024 07:25:19 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-Encodingcache-control: privatep3p: CP="DSP CUR OTPi IND OTRi ONL FIN"x-ms-request-id: 4cffd087-8a4a-487d-ac0a-b13f98949b01x-ms-ests-server: 2.1.19492.3 - FRC ProdSlicesreport-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://43042841-5bf3911d.gharelokhana.com/api/report?catId=GW+estsfd+SEC"}]}nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0}x-ms-srs: 1.Preferrer-policy: strict-origin-when-cross-originaccess-control-allow-origin: access-control-allow-headers:
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 05 Dec 2024 07:25:32 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-Encodingcache-control: privatep3p: CP="DSP CUR OTPi IND OTRi ONL FIN"x-ms-request-id: 3309dc19-c186-4179-b53d-0dff4cc90e00x-ms-ests-server: 2.1.19568.3 - WEULR1 ProdSlicesreport-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://43042841-5bf3911d.gharelokhana.com/api/report?catId=GW+estsfd+SEC"}]}nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0}x-ms-srs: 1.Preferrer-policy: strict-origin-when-cross-originaccess-control-allow-origin: access-control-allow-headers:
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 05 Dec 2024 07:25:46 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-Encodingcache-control: privatep3p: CP="DSP CUR OTPi IND OTRi ONL FIN"x-ms-request-id: 12e44ffb-0746-4858-b289-2a0dcd727700x-ms-ests-server: 2.1.19492.3 - NEULR1 ProdSlicesreport-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://43042841-5bf3911d.gharelokhana.com/api/report?catId=GW+estsfd+SEC"}]}nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0}x-ms-srs: 1.Preferrer-policy: strict-origin-when-cross-originaccess-control-allow-origin: access-control-allow-headers:
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 05 Dec 2024 07:25:50 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-Encodingcache-control: privatep3p: CP="DSP CUR OTPi IND OTRi ONL FIN"x-ms-request-id: b9c06676-a621-4407-907a-3e014c9c4b00x-ms-ests-server: 2.1.19492.3 - FRC ProdSlicesreport-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://43042841-5bf3911d.gharelokhana.com/api/report?catId=GW+estsfd+SEC"}]}nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0}x-ms-srs: 1.Preferrer-policy: strict-origin-when-cross-originaccess-control-allow-origin: access-control-allow-headers:
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 05 Dec 2024 07:26:02 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-Encodingcache-control: privatep3p: CP="DSP CUR OTPi IND OTRi ONL FIN"x-ms-request-id: cf117a4c-e308-41ec-88ae-bf2977b59d01x-ms-ests-server: 2.1.19492.3 - FRC ProdSlicesreport-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://43042841-5bf3911d.gharelokhana.com/api/report?catId=GW+estsfd+SEC"}]}nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0}x-ms-srs: 1.Preferrer-policy: strict-origin-when-cross-originaccess-control-allow-origin: access-control-allow-headers:
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 05 Dec 2024 07:26:20 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-Encodingcache-control: privatep3p: CP="DSP CUR OTPi IND OTRi ONL FIN"x-ms-request-id: d3e330e8-12d7-4743-8cb4-73dbd5dd7101x-ms-ests-server: 2.1.19492.3 - SEC ProdSlicesreport-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://43042841-5bf3911d.gharelokhana.com/api/report?catId=GW+estsfd+SEC"}]}nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0}x-ms-srs: 1.Preferrer-policy: strict-origin-when-cross-originaccess-control-allow-origin: access-control-allow-headers:
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 05 Dec 2024 07:26:40 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-Encodingcache-control: privatep3p: CP="DSP CUR OTPi IND OTRi ONL FIN"x-ms-request-id: 7d5f50b4-631d-4ba0-a1c4-cfb2c4428101x-ms-ests-server: 2.1.19492.3 - SEC ProdSlicesreport-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://43042841-5bf3911d.gharelokhana.com/api/report?catId=GW+estsfd+SEC"}]}nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0}x-ms-srs: 1.Preferrer-policy: strict-origin-when-cross-originaccess-control-allow-origin: access-control-allow-headers:
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 05 Dec 2024 07:26:50 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-Encodingcache-control: privatep3p: CP="DSP CUR OTPi IND OTRi ONL FIN"x-ms-request-id: 79999ed5-e2ba-41de-95a6-cf6723bb9e01x-ms-ests-server: 2.1.19492.3 - FRC ProdSlicesreport-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://43042841-5bf3911d.gharelokhana.com/api/report?catId=GW+estsfd+SEC"}]}nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0}x-ms-srs: 1.Preferrer-policy: strict-origin-when-cross-originaccess-control-allow-origin: access-control-allow-headers:
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 05 Dec 2024 07:27:03 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-Encodingcache-control: privatep3p: CP="DSP CUR OTPi IND OTRi ONL FIN"x-ms-request-id: f66d5a13-7b57-49c0-8b00-f9467d6ea701x-ms-ests-server: 2.1.19492.3 - FRC ProdSlicesreport-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://43042841-5bf3911d.gharelokhana.com/api/report?catId=GW+estsfd+SEC"}]}nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0}x-ms-srs: 1.Preferrer-policy: strict-origin-when-cross-originaccess-control-allow-origin: access-control-allow-headers:
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 05 Dec 2024 07:27:20 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-Encodingcache-control: privatep3p: CP="DSP CUR OTPi IND OTRi ONL FIN"x-ms-request-id: 06fbc155-3601-4999-ba2c-47be24db5800x-ms-ests-server: 2.1.19492.3 - SEC ProdSlicesreport-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://43042841-5bf3911d.gharelokhana.com/api/report?catId=GW+estsfd+SEC"}]}nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0}x-ms-srs: 1.Preferrer-policy: strict-origin-when-cross-originaccess-control-allow-origin: access-control-allow-headers:
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 05 Dec 2024 07:27:28 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-Encodingcache-control: privatep3p: CP="DSP CUR OTPi IND OTRi ONL FIN"x-ms-request-id: 6329a10d-3673-4587-8ed1-6c9c3cac6f01x-ms-ests-server: 2.1.19492.3 - SEC ProdSlicesreport-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://43042841-5bf3911d.gharelokhana.com/api/report?catId=GW+estsfd+SEC"}]}nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0}x-ms-srs: 1.Preferrer-policy: strict-origin-when-cross-originaccess-control-allow-origin: access-control-allow-headers:
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 05 Dec 2024 07:27:58 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-Encodingcache-control: privatep3p: CP="DSP CUR OTPi IND OTRi ONL FIN"x-ms-request-id: dcda2ac7-519c-4c48-a94a-0335536e0b00x-ms-ests-server: 2.1.19568.3 - WEULR1 ProdSlicesreport-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://43042841-5bf3911d.gharelokhana.com/api/report?catId=GW+estsfd+SEC"}]}nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0}x-ms-srs: 1.Preferrer-policy: strict-origin-when-cross-originaccess-control-allow-origin: access-control-allow-headers:

Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: http://b.c2r.ts.cdn.office.net/pr
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: http://olkflt.edog.officeapps.live.com/olkflt/outlookflighting.svc/api/glides
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: http://weather.service.msn.com/data.aspx
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://addinsinstallation.store.office.com/app/acquisitionlogging
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://addinsinstallation.store.office.com/app/download
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://addinsinstallation.store.office.com/appinstall/authenticated
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://addinsinstallation.store.office.com/appinstall/preinstalled
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://addinsinstallation.store.office.com/appinstall/unauthenticated
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://addinsinstallation.store.office.com/orgid/appinstall/authenticated
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://addinslicensing.store.office.com/apps/remove
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://addinslicensing.store.office.com/commerce/query
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://addinslicensing.store.office.com/entitlement/query
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://addinslicensing.store.office.com/orgid/apps/remove
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://addinslicensing.store.office.com/orgid/entitlement/query
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://analysis.windows.net/powerbi/api
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://apc.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://api.aadrm.com
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://api.aadrm.com/
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://api.addins.omex.office.net/api/addins/search
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://api.addins.omex.office.net/appinfo/query
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://api.addins.omex.office.net/appstate/query
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://api.addins.store.office.com/addinstemplate
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://api.addins.store.office.com/app/query
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://api.addins.store.officeppe.com/addinstemplate
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://api.cortana.ai
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://api.diagnostics.office.com
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://api.diagnosticssdf.office.com
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://api.diagnosticssdf.office.com/v2/feedback
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://api.diagnosticssdf.office.com/v2/file
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://api.microsoftstream.com
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://api.microsoftstream.com/api/
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://api.office.net
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://api.officescripts.microsoftusercontent.com/api
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://api.onedrive.com
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://api.powerbi.com/v1.0/myorg/datasets
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://api.powerbi.com/v1.0/myorg/groups
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://api.powerbi.com/v1.0/myorg/imports
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://api.scheduler.
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://apis.live.net/v5.0/
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://apis.mobile.m365.svc.cloud.microsoft
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://app.powerbi.com
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://arc.msn.com/v4/api/selection
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://asgsmsproxyapi.azurewebsites.net/
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://augloop.office.com
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://augloop.office.com/v2
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://augloop.office.com;https://augloop-int.officeppe.com;https://augloop-dogfood.officeppe.com;h
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://autodiscover-s.outlook.com/
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://autodiscover-s.outlook.com/autodiscover/autodiscover.xml
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://canary.designerapp.
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://cdn.designerapp.osi.office.net
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://cdn.designerapp.osi.office.net/designer-mobile
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://cdn.designerapp.osi.office.net/designerapp/fonts
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://cdn.designerapp.osi.office.net/designerapp/mobile-assets
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://cdn.designerapp.osi.office.net/designerapp/mobile-dynamic-strings
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://cdn.designerapp.osi.office.net/designerapp/mobile-home-screen
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://cdn.designerapp.osi.office.net/designerapp/mobile-toolbar
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://cdn.entity.
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://cdn.hubblecontent.osi.office.net/
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://cdn.int.designerapp.osi.office.net/fonts
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://client-office365-tas.msedge.net/ab
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://clients.config.office.net
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://clients.config.office.net/
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://clients.config.office.net/c2r/v1.0/DeltaAdvisory
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://clients.config.office.net/c2r/v1.0/InteractiveInstallation
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/android/policies
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/ios
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/mac
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/tenantassociationkey
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://cloudfiles.onenote.com/upload.aspx
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://config.edge.skype.com/config/v1/Office
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://config.edge.skype.com/config/v2/Office
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://consent.config.office.com/consentcheckin/v1.0/consents
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://consent.config.office.com/consentweb/v1.0/consents
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://cortana.ai
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://cortana.ai/api
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://cr.office.com
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://d.docs.live.net
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://dataservice.o365filtering.com
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://dataservice.o365filtering.com/
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://dataservice.o365filtering.com/PolicySync/PolicySync.svc/SyncFile
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://dataservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://dataservice.protection.outlook.com/PsorWebService/v1/ClientSyncFile/MipPolicies
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://designerapp.azurewebsites.net
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://designerappservice.officeapps.live.com
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://dev.cortana.ai
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://dev.virtualearth.net/REST/V1/GeospatialEndpoint/
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://dev0-api.acompli.net/autodetect
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://devnull.onenote.com
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://directory.services.
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://ecs.office.com
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://ecs.office.com/config/v1/Designer
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://ecs.office.com/config/v2/Office
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://edge.skype.com/registrar/prod
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://edge.skype.com/rps
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://enrichment.osi.office.net/
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Refresh/v1
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Resolve/v1
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Search/v1
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/StockHistory/v1
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/ipcheck/v1
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/v2.1601652342626
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/Metadata/
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/Metadata/metadata.json
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/view/desktop/main.cshtml
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/view/web/main.cshtml
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://entitlement.diagnostics.office.com
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://entitlement.diagnosticssdf.office.com
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://eur.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://excel.uservoice.com/forums/304936-excel-for-mobile-devices-tablets-phones-android
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://fpastorage.cdn.office.net/%s
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://fpastorage.cdn.office.net/firstpartyapp/addins.xml
Source: SBO Catch up call pf.msg, ~WRS{C0DF673B-3183-4731-BD91-7280094AF956}.tmp.1.dr	String found in binary or memory: https://fujipharma.box.com/s/4x9v4qxcj0rgtoah4if5h4f4p9cwtz7n
Source: SBO Catch up call pf.msg	String found in binary or memory: https://fujipharma.box.com/s/a7tvuywnn5igwj1mrqx03mquos4hiec6
Source: SBO Catch up call pf.msg, ~WRS{C0DF673B-3183-4731-BD91-7280094AF956}.tmp.1.dr	String found in binary or memory: https://fujipharma.box.com/s/pezxwn32zbr37fbrrrqh18g3y8eulbk2
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://globaldisco.crm.dynamics.com
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://graph.ppe.windows.net
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://graph.ppe.windows.net/
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://graph.windows.net
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://graph.windows.net/
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/api/pivots/
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/api/telemetry
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/browse?cp=remix3d
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/browse?secureurl=1
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=icons
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=stockimages
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=stockvideos
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsofticon?
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://ic3.teams.office.com
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://incidents.diagnostics.office.com
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://incidents.diagnosticssdf.office.com
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://inclient.store.office.com/gyro/client
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://inclient.store.office.com/gyro/clientstore
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/hosted?host=office&adlt=strict&hostType=Immersive
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Bing
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=ClipArt
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Facebook
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Flickr
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=OneDrive
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://insertmedia.bing.office.net/odc/insertmedia
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://invites.office.com/
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://learningtools.onenote.com/learningtoolsapi/v2.0/GetFreeformSpeech
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://learningtools.onenote.com/learningtoolsapi/v2.0/Getvoices
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://lifecycle.office.com
Source: SBO Catch up call pf.msg, ~WRS{C0DF673B-3183-4731-BD91-7280094AF956}.tmp.1.dr	String found in binary or memory: https://linkprotect.cudasvc.com/url?a=https%3a%2f%2ffujipharma.box.com%2fs%2f4x9v4qxcj0rgtoah4if5h4f
Source: SBO Catch up call pf.msg, ~WRS{C0DF673B-3183-4731-BD91-7280094AF956}.tmp.1.dr	String found in binary or memory: https://linkprotect.cudasvc.com/url?a=https%3a%2f%2ffujipharma.box.com%2fs%2fa7tvuywnn5igwj1mrqx03mq
Source: SBO Catch up call pf.msg, ~WRS{C0DF673B-3183-4731-BD91-7280094AF956}.tmp.1.dr	String found in binary or memory: https://linkprotect.cudasvc.com/url?a=https%3a%2f%2ffujipharma.box.com%2fs%2fpezxwn32zbr37fbrrrqh18g
Source: SBO Catch up call pf.msg, ~WRS{C0DF673B-3183-4731-BD91-7280094AF956}.tmp.1.dr	String found in binary or memory: https://linkprotect.cudasvc.com/url?a=https%3a%2f%2fgoogle.dz%2furl%3fq%3dnrnq5JLi6z3yh%26rct%3dtTPv
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://login.microsoftonline.com
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://login.microsoftonline.com/
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://login.microsoftonline.com/organizations
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://login.windows-ppe.net/common/oauth2/authorize
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://login.windows.local
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://login.windows.net/72f988bf-86f1-41af-91ab-2d7cd011db47/oauth2/authorize
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://login.windows.net/common/oauth2/authorize
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://loki.delve.office.com/api/v1/configuration/officewin32/
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://lookup.onenote.com/lookup/geolocation/v1
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://make.powerautomate.com
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://management.azure.com
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://management.azure.com/
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://messagebroker.mobile.m365.svc.cloud.microsoft
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://messaging.action.office.com/
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://messaging.action.office.com/setcampaignaction
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://messaging.action.office.com/setuseraction16
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://messaging.engagement.office.com/
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://messaging.engagement.office.com/campaignmetadataaggregator
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://messaging.lifecycle.office.com/
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://messaging.lifecycle.office.com/getcustommessage16
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://messaging.office.com/
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://metadata.templates.cdn.office.net/client/log
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://mss.office.com
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://my.microsoftpersonalcontent.com
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://nam.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://ncus.contentsync.
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://ncus.pagecontentsync.
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://notification.m365.svc.cloud.microsoft/
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://notification.m365.svc.cloud.microsoft/PushNotifications.Register
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://o365auditrealtimeingestion.manage.office.com/api/userauditrecord
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://ocos-office365-s2s.msedge.net/ab
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://odc.officeapps.live.com/odc/stat/images/OneDriveUpsell.png
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://odc.officeapps.live.com/odc/xml?resource=OneDriveSignUpUpsell
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://odc.officeapps.live.com/odc/xml?resource=OneDriveSyncClientUpsell
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://ods-diagnostics-ppe.trafficmanager.net
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://ofcrecsvcapi-int.azurewebsites.net/
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://officeapps.live.com
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://officeci.azurewebsites.net/api/
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://officemobile.uservoice.com/forums/929800-office-app-ios-and-ipad-asks
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://officepyservice.office.net/
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://officepyservice.office.net/service.functionality
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://officesetup.getmicrosoftkey.com
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://ogma.osi.office.net/TradukoApi/api/v1.0/
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officeentities
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officeentitiesupdated
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officesharedentities
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officesharedentitiesupdated
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://onedrive.live.com
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://onedrive.live.com/about/download/?windows10SyncClientInstalled=false
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://onedrive.live.com/embed?
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://otelrules.azureedge.net
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://otelrules.svc.static.microsoft
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://outlook.office.com
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://outlook.office.com/
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://outlook.office.com/autosuggest/api/v1/init?cvid=
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://outlook.office365.com
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://outlook.office365.com/
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://outlook.office365.com/api/v1.0/me/Activities
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://outlook.office365.com/autodiscover/autodiscover.json
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://outlook.office365.com/connectors
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://ovisualuiapp.azurewebsites.net/pbiagave/
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://pages.store.office.com/appshome.aspx?productgroup=Outlook
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://pages.store.office.com/review/query
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://pages.store.office.com/webapplandingpage.aspx
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://partnerservices.getmicrosoftkey.com/PartnerProvisioning.svc/v1/subscriptions
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://pf.directory.live.com/profile/mine/System.ShortCircuitProfile.json
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://pf.directory.live.com/profile/mine/WLX.Profiles.IC.json
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://planner.cloud.microsoft
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://portal.office.com/account/?ref=ClientMeControl
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://posarprodcssservice.accesscontrol.windows.net/v2/OAuth2-13
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://powerlift-frontdesk.acompli.net
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://powerlift.acompli.net
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://powerpoint.uservoice.com/forums/288952-powerpoint-for-ipad-iphone-ios
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://prod-global-autodetect.acompli.net/autodetect
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://prod.mds.office.com/mds/api/v1.0/clientmodeldirectory
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://pushchannel.1drv.ms
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://r4.res.office365.com/footprintconfig/v1.7/scripts/fpconfig.json
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://res.cdn.office.net
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://res.cdn.office.net/mro1cdnstorage/fonts/prod/4.40
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://res.cdn.office.net/polymer/models
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://res.getmicrosoftkey.com/api/redemptionevents
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://rpsticket.partnerservices.getmicrosoftkey.com
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://safelinks.protection.outlook.com/api/GetPolicy
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://service.officepy.microsoftusercontent.com/
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://service.powerapps.com
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://settings.outlook.com
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://shell.suite.office.com:1443
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://skyapi.live.net/Activity/
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://sr.outlook.office.net/ws/speech/recognize/assistant/work
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://staging.cortana.ai
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://statics.teams.cdn.office.net/evergreen-assets/illustrations/win32/m365-device-desktop-dark-1
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://statics.teams.cdn.office.net/evergreen-assets/illustrations/win32/m365-device-desktop-dark-2
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://statics.teams.cdn.office.net/evergreen-assets/illustrations/win32/m365-device-desktop-hc-100
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://statics.teams.cdn.office.net/evergreen-assets/illustrations/win32/m365-device-desktop-hc-150
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://statics.teams.cdn.office.net/evergreen-assets/illustrations/win32/m365-device-desktop-hc-200
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://statics.teams.cdn.office.net/evergreen-assets/illustrations/win32/m365-device-desktop-light-
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://storage.live.com/clientlogs/uploadlocation
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://store.office.cn/addinstemplate
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://store.office.de/addinstemplate
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://substrate.office.com
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://substrate.office.com/Notes-Internal.ReadWrite
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://substrate.office.com/search/api/v1/SearchHistory
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://substrate.office.com/search/api/v2/init
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://syncservice.o365syncservice.com/"
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://syncservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://templatesmetadata.office.net/
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://uci.cdn.office.net/mirrored/smartlookup/current/
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://uci.officeapps.live.com/OfficeInsights/web/views/insights.desktop.html
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://uci.officeapps.live.com/OfficeInsights/web/views/insights.immersive.html
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://useraudit.o365auditrealtimeingestion.manage.office.com
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://visio.uservoice.com/forums/368202-visio-on-devices
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://web.microsoftstream.com/video/
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://webdir.online.lync.com/autodiscover/autodiscoverservice.svc/root/
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://webshell.suite.office.com
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://word-edit.officeapps.live.com/we/rrdiscovery.ashx
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://word.uservoice.com/forums/304948-word-for-ipad-iphone-ios
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://wus2.contentsync.
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://wus2.pagecontentsync.
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://www.bingapis.com/api/v7/urlpreview/search?appid=E93048236FE27D972F67C5AF722136866DF65FA2
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://www.odwebp.svc.ms
Source: 0CDD6D76-FE6D-4BCF-84FA-1D3949395ABA.1.dr	String found in binary or memory: https://www.yammer.com

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50057
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50063
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 49889 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50074 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49855 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50072
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50074
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50073
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49960
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50076
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50075
Source: unknown	Network traffic detected: HTTP traffic on port 50057 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50076 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50073 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 49921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 49994 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50000
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50075 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49932
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49960 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50000 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50046 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49808
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49889
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49800
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49921
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50063 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49994
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50046
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50072 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: classification engine

Classification label: mal84.phis.winMSG@20/63@32/8