Edit tour

Windows Analysis Report
BGM LAW GROUP - RFP 2024.pdf

Overview

General Information

Sample name:	BGM LAW GROUP - RFP 2024.pdf
Analysis ID:	1570305
MD5:	424977cd8786ba292810d7cee41c2565
SHA1:	a24d508f9117601460b4b7ed0d5b35c155bf7a3c
SHA256:	dbc614021e52ac2d7f8560c2b0c94edfbe9abab6d86a333aef2ee21895dd9704
Infos:

Detection

Score:	52
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

AI detected suspicious Javascript

Detected hidden input values containing email addresses (often used in phishing pages)

HTML body contains low number of good links

HTML body contains password input but no form action

HTML page contains hidden javascript code

HTML title does not match URL

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

PDF is encrypted

Sample execution stops while process was sleeping (likely an evasion)

Stores files to the Windows start menu directory

Classification

Process Tree

System is w10x64_ra

Acrobat.exe (PID: 6496 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\BGM LAW GROUP - RFP 2024.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 6788 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 7048 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2252 --field-trial-handle=1600,i,13858453656838133628,2081862688306590034,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

chrome.exe (PID: 7868 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://www.rfp-documents.com/ MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)

chrome.exe (PID: 8056 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2084 --field-trial-handle=1972,i,10897460691343705023,10519775075737971033,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)

InputSwitchToastHandler.exe (PID: 8332 cmdline: C:\Windows\System32\InputSwitchToastHandler.exe -Embedding MD5: 281BE84F0D4F7AAC6A965BC84F2601ED)

conhost.exe (PID: 8340 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: https://www.rfp-documents.com/	SlashNext: Label: Credential Stealing type: Phishing & Social Engineering
Source: https://www.rfp-documents.com	Avira URL Cloud: Label: malware

Phishing

AI detected suspicious Javascript

Source: 0.18.id.script.csv	Joe Sandbox AI: Detected suspicious JavaScript with source url: https://r5k.ljxfrbcb.ru/dqhqST/... High-risk script with multiple red flags: uses atob() for obfuscation, contains an encoded suspicious URL (*.ru domain), implements anti-debugging measures, uses document.write() for DOM manipulation, and contains heavily encoded/obfuscated content. The script also attempts to block defensive measures like dev tools and includes event listeners to prevent inspection.
Source: 0.29.id.script.csv	Joe Sandbox AI: Detected suspicious JavaScript with source url: https://r5k.ljxfrbcb.ru/dqhqST/... High-risk script showing multiple suspicious behaviors: 1) Makes requests to a suspicious Russian domain (.ru) with an unusually long, seemingly random hostname, 2) Contains form data exfiltration via FormData POST, 3) Uses redirects to excel.office.com as a possible legitimate-looking fallback, 4) Implements Cloudflare Turnstile but appears to be using it maliciously, 5) Uses obfuscated/random-looking variable names and paths. The pattern suggests a sophisticated phishing or data theft attempt masquerading as legitimate Microsoft service.

Source: https://login.live.com/oauth20_authorize.srf?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&scope=openid+profile+https%3a%2f%2fwww.office.com%2fv2%2fOfficeHome.All&redirect_uri=https%3a%2f%2fwww.microsoft365.com%2flandingv2&response_type=code+id_token&state=iZWu6ChVaD7vmWA1k75lVI0DUoAKH5BZgeUQUG35ssyHYPndkIHjsnxJPZ4jwJQO2uVJMrFcYQwn0tx713caSlpvjzjVQFFcfDKxFQ8v621lQt9Fxcyh0FFAs_hRl4EMBWdajv0EqsMwPuooU-JeT_KleHNnE1AhiJqRMHcO5HT6UIDsfWgUW8lPURxZhfCkA7ZJsGcFUNrPQ53stG5MniWqbvgw5XDyBeGecKyjj3zAdRZD2TpsQPukICYaCh-Tw1SK1rlwNO_z7YH2cxktVsNEo-Gvb88din_A_ZnIBWe8W60p-xTfjngXl4BUgc6wuEqR3XhH0rN5k8dPuAWO_A&response_mode=form_post&nonce=638691055113888370.MTNlZDAyZGEtNWQ4OS00NjU4LTk0MTEtOGZiNjNhY2Y2ZGFiY2VkZDIyMTktZDVlYy00MjNhLWFmODgtYTQ0OWQ0YjYzZjBh&x-client-SKU=ID_NET8_0&x-client-Ver=7.5.1.0&uaid=b82ae0266de847a38912a18a3642a987&msproxy=1&issuer=mso&tenant=common&ui_locales=en-US&epct=PAQABDgEAAADW6jl31mB3T7ugrWTT8pFe1308fuOLqptfzg23nf6OY37D8C77hBXsXRMPjo9m5cEJYH79pUghHFhnj_OQ75cH6v3Xs1t9IUuyXnzVDyJX3GsUphevuSc49Mdu6UAZC9jbCQI5lTowYn3v1S20QLkCvJrX0ouzkju34ic51R8pswGDPibwTDBzQxQPX0VQ2f66IzW7DuOhoxr4LIW7TfC98G67QYOZ8QPPBI1fpTc1tyAA&jshs=2&jsh=&jshp=&username=fake.fake%40fake.com&login_hint=fake.fake%40fake.com

HTTP Parser: fake.fake@fake.com

Source: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.microsoft365.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638691055113888370.MTNlZDAyZGEtNWQ4OS00NjU4LTk0MTEtOGZiNjNhY2Y2ZGFiY2VkZDIyMTktZDVlYy00MjNhLWFmODgtYTQ0OWQ0YjYzZjBh&ui_locales=en-US&mkt=en-US&client-request-id=b82ae026-6de8-47a3-8912-a18a3642a987&state=iZWu6ChVaD7vmWA1k75lVI0DUoAKH5BZgeUQUG35ssyHYPndkIHjsnxJPZ4jwJQO2uVJMrFcYQwn0tx713caSlpvjzjVQFFcfDKxFQ8v621lQt9Fxcyh0FFAs_hRl4EMBWdajv0EqsMwPuooU-JeT_KleHNnE1AhiJqRMHcO5HT6UIDsfWgUW8lPURxZhfCkA7ZJsGcFUNrPQ53stG5MniWqbvgw5XDyBeGecKyjj3zAdRZD2TpsQPukICYaCh-Tw1SK1rlwNO_z7YH2cxktVsNEo-Gvb88din_A_ZnIBWe8W60p-xTfjngXl4BUgc6wuEqR3XhH0rN5k8dPuAWO_A&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0	HTTP Parser: Number of links: 0
Source: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.microsoft365.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638691055113888370.MTNlZDAyZGEtNWQ4OS00NjU4LTk0MTEtOGZiNjNhY2Y2ZGFiY2VkZDIyMTktZDVlYy00MjNhLWFmODgtYTQ0OWQ0YjYzZjBh&ui_locales=en-US&mkt=en-US&client-request-id=b82ae026-6de8-47a3-8912-a18a3642a987&state=iZWu6ChVaD7vmWA1k75lVI0DUoAKH5BZgeUQUG35ssyHYPndkIHjsnxJPZ4jwJQO2uVJMrFcYQwn0tx713caSlpvjzjVQFFcfDKxFQ8v621lQt9Fxcyh0FFAs_hRl4EMBWdajv0EqsMwPuooU-JeT_KleHNnE1AhiJqRMHcO5HT6UIDsfWgUW8lPURxZhfCkA7ZJsGcFUNrPQ53stG5MniWqbvgw5XDyBeGecKyjj3zAdRZD2TpsQPukICYaCh-Tw1SK1rlwNO_z7YH2cxktVsNEo-Gvb88din_A_ZnIBWe8W60p-xTfjngXl4BUgc6wuEqR3XhH0rN5k8dPuAWO_A&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0&sso_reload=true	HTTP Parser: Number of links: 0

HTTP Parser: <input type="password" .../> found but no <form action="...

Source: https://www.rfp-documents.com/

HTTP Parser: Base64 decoded: AIzaSyCBTROq6LuvF_IE1r46-T4AeTSV-0d7my8

Source: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.microsoft365.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638691055113888370.MTNlZDAyZGEtNWQ4OS00NjU4LTk0MTEtOGZiNjNhY2Y2ZGFiY2VkZDIyMTktZDVlYy00MjNhLWFmODgtYTQ0OWQ0YjYzZjBh&ui_locales=en-US&mkt=en-US&client-request-id=b82ae026-6de8-47a3-8912-a18a3642a987&state=iZWu6ChVaD7vmWA1k75lVI0DUoAKH5BZgeUQUG35ssyHYPndkIHjsnxJPZ4jwJQO2uVJMrFcYQwn0tx713caSlpvjzjVQFFcfDKxFQ8v621lQt9Fxcyh0FFAs_hRl4EMBWdajv0EqsMwPuooU-JeT_KleHNnE1AhiJqRMHcO5HT6UIDsfWgUW8lPURxZhfCkA7ZJsGcFUNrPQ53stG5MniWqbvgw5XDyBeGecKyjj3zAdRZD2TpsQPukICYaCh-Tw1SK1rlwNO_z7YH2cxktVsNEo-Gvb88din_A_ZnIBWe8W60p-xTfjngXl4BUgc6wuEqR3XhH0rN5k8dPuAWO_A&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0	HTTP Parser: Title: Redirecting does not match URL
Source: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.microsoft365.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638691055113888370.MTNlZDAyZGEtNWQ4OS00NjU4LTk0MTEtOGZiNjNhY2Y2ZGFiY2VkZDIyMTktZDVlYy00MjNhLWFmODgtYTQ0OWQ0YjYzZjBh&ui_locales=en-US&mkt=en-US&client-request-id=b82ae026-6de8-47a3-8912-a18a3642a987&state=iZWu6ChVaD7vmWA1k75lVI0DUoAKH5BZgeUQUG35ssyHYPndkIHjsnxJPZ4jwJQO2uVJMrFcYQwn0tx713caSlpvjzjVQFFcfDKxFQ8v621lQt9Fxcyh0FFAs_hRl4EMBWdajv0EqsMwPuooU-JeT_KleHNnE1AhiJqRMHcO5HT6UIDsfWgUW8lPURxZhfCkA7ZJsGcFUNrPQ53stG5MniWqbvgw5XDyBeGecKyjj3zAdRZD2TpsQPukICYaCh-Tw1SK1rlwNO_z7YH2cxktVsNEo-Gvb88din_A_ZnIBWe8W60p-xTfjngXl4BUgc6wuEqR3XhH0rN5k8dPuAWO_A&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0&sso_reload=true	HTTP Parser: Title: Sign in to your account does not match URL
Source: https://login.live.com/oauth20_authorize.srf?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&scope=openid+profile+https%3a%2f%2fwww.office.com%2fv2%2fOfficeHome.All&redirect_uri=https%3a%2f%2fwww.microsoft365.com%2flandingv2&response_type=code+id_token&state=iZWu6ChVaD7vmWA1k75lVI0DUoAKH5BZgeUQUG35ssyHYPndkIHjsnxJPZ4jwJQO2uVJMrFcYQwn0tx713caSlpvjzjVQFFcfDKxFQ8v621lQt9Fxcyh0FFAs_hRl4EMBWdajv0EqsMwPuooU-JeT_KleHNnE1AhiJqRMHcO5HT6UIDsfWgUW8lPURxZhfCkA7ZJsGcFUNrPQ53stG5MniWqbvgw5XDyBeGecKyjj3zAdRZD2TpsQPukICYaCh-Tw1SK1rlwNO_z7YH2cxktVsNEo-Gvb88din_A_ZnIBWe8W60p-xTfjngXl4BUgc6wuEqR3XhH0rN5k8dPuAWO_A&response_mode=form_post&nonce=638691055113888370.MTNlZDAyZGEtNWQ4OS00NjU4LTk0MTEtOGZiNjNhY2Y2ZGFiY2VkZDIyMTktZDVlYy00MjNhLWFmODgtYTQ0OWQ0YjYzZjBh&x-client-SKU=ID_NET8_0&x-client-Ver=7.5.1.0&uaid=b82ae0266de847a38912a18a3642a987&msproxy=1&issuer=mso&tenant=common&ui_locales=en-US&epct=PAQABDgEAAADW6jl31mB3T7ugrWTT8pFe1308fuOLqptfzg23nf6OY37D8C77hBXsXRMPjo9m5cEJYH79pUghHFhnj_OQ75cH6v3Xs1t9IUuyXnzVDyJX3GsUphevuSc49Mdu6UAZC...	HTTP Parser: Title: Sign in to your Microsoft account does not match URL

HTTP Parser: Iframe src: https://fpt.live.com?session_id=b82ae0266de847a38912a18a3642a987&CustomerId=33e01921-4d64-4f8c-a055-5bdaffd5e33d&PageId=SI

Source: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.microsoft365.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638691055113888370.MTNlZDAyZGEtNWQ4OS00NjU4LTk0MTEtOGZiNjNhY2Y2ZGFiY2VkZDIyMTktZDVlYy00MjNhLWFmODgtYTQ0OWQ0YjYzZjBh&ui_locales=en-US&mkt=en-US&client-request-id=b82ae026-6de8-47a3-8912-a18a3642a987&state=iZWu6ChVaD7vmWA1k75lVI0DUoAKH5BZgeUQUG35ssyHYPndkIHjsnxJPZ4jwJQO2uVJMrFcYQwn0tx713caSlpvjzjVQFFcfDKxFQ8v621lQt9Fxcyh0FFAs_hRl4EMBWdajv0EqsMwPuooU-JeT_KleHNnE1AhiJqRMHcO5HT6UIDsfWgUW8lPURxZhfCkA7ZJsGcFUNrPQ53stG5MniWqbvgw5XDyBeGecKyjj3zAdRZD2TpsQPukICYaCh-Tw1SK1rlwNO_z7YH2cxktVsNEo-Gvb88din_A_ZnIBWe8W60p-xTfjngXl4BUgc6wuEqR3XhH0rN5k8dPuAWO_A&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0&sso_reload=true	HTTP Parser: <input type="password" .../> found
Source: https://login.live.com/oauth20_authorize.srf?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&scope=openid+profile+https%3a%2f%2fwww.office.com%2fv2%2fOfficeHome.All&redirect_uri=https%3a%2f%2fwww.microsoft365.com%2flandingv2&response_type=code+id_token&state=iZWu6ChVaD7vmWA1k75lVI0DUoAKH5BZgeUQUG35ssyHYPndkIHjsnxJPZ4jwJQO2uVJMrFcYQwn0tx713caSlpvjzjVQFFcfDKxFQ8v621lQt9Fxcyh0FFAs_hRl4EMBWdajv0EqsMwPuooU-JeT_KleHNnE1AhiJqRMHcO5HT6UIDsfWgUW8lPURxZhfCkA7ZJsGcFUNrPQ53stG5MniWqbvgw5XDyBeGecKyjj3zAdRZD2TpsQPukICYaCh-Tw1SK1rlwNO_z7YH2cxktVsNEo-Gvb88din_A_ZnIBWe8W60p-xTfjngXl4BUgc6wuEqR3XhH0rN5k8dPuAWO_A&response_mode=form_post&nonce=638691055113888370.MTNlZDAyZGEtNWQ4OS00NjU4LTk0MTEtOGZiNjNhY2Y2ZGFiY2VkZDIyMTktZDVlYy00MjNhLWFmODgtYTQ0OWQ0YjYzZjBh&x-client-SKU=ID_NET8_0&x-client-Ver=7.5.1.0&uaid=b82ae0266de847a38912a18a3642a987&msproxy=1&issuer=mso&tenant=common&ui_locales=en-US&epct=PAQABDgEAAADW6jl31mB3T7ugrWTT8pFe1308fuOLqptfzg23nf6OY37D8C77hBXsXRMPjo9m5cEJYH79pUghHFhnj_OQ75cH6v3Xs1t9IUuyXnzVDyJX3GsUphevuSc49Mdu6UAZC...	HTTP Parser: <input type="password" .../> found

Source: https://r5k.ljxfrbcb.ru/dqhqST/	HTTP Parser: No favicon
Source: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.microsoft365.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638691055113888370.MTNlZDAyZGEtNWQ4OS00NjU4LTk0MTEtOGZiNjNhY2Y2ZGFiY2VkZDIyMTktZDVlYy00MjNhLWFmODgtYTQ0OWQ0YjYzZjBh&ui_locales=en-US&mkt=en-US&client-request-id=b82ae026-6de8-47a3-8912-a18a3642a987&state=iZWu6ChVaD7vmWA1k75lVI0DUoAKH5BZgeUQUG35ssyHYPndkIHjsnxJPZ4jwJQO2uVJMrFcYQwn0tx713caSlpvjzjVQFFcfDKxFQ8v621lQt9Fxcyh0FFAs_hRl4EMBWdajv0EqsMwPuooU-JeT_KleHNnE1AhiJqRMHcO5HT6UIDsfWgUW8lPURxZhfCkA7ZJsGcFUNrPQ53stG5MniWqbvgw5XDyBeGecKyjj3zAdRZD2TpsQPukICYaCh-Tw1SK1rlwNO_z7YH2cxktVsNEo-Gvb88din_A_ZnIBWe8W60p-xTfjngXl4BUgc6wuEqR3XhH0rN5k8dPuAWO_A&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0	HTTP Parser: No favicon

Source: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.microsoft365.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638691055113888370.MTNlZDAyZGEtNWQ4OS00NjU4LTk0MTEtOGZiNjNhY2Y2ZGFiY2VkZDIyMTktZDVlYy00MjNhLWFmODgtYTQ0OWQ0YjYzZjBh&ui_locales=en-US&mkt=en-US&client-request-id=b82ae026-6de8-47a3-8912-a18a3642a987&state=iZWu6ChVaD7vmWA1k75lVI0DUoAKH5BZgeUQUG35ssyHYPndkIHjsnxJPZ4jwJQO2uVJMrFcYQwn0tx713caSlpvjzjVQFFcfDKxFQ8v621lQt9Fxcyh0FFAs_hRl4EMBWdajv0EqsMwPuooU-JeT_KleHNnE1AhiJqRMHcO5HT6UIDsfWgUW8lPURxZhfCkA7ZJsGcFUNrPQ53stG5MniWqbvgw5XDyBeGecKyjj3zAdRZD2TpsQPukICYaCh-Tw1SK1rlwNO_z7YH2cxktVsNEo-Gvb88din_A_ZnIBWe8W60p-xTfjngXl4BUgc6wuEqR3XhH0rN5k8dPuAWO_A&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0	HTTP Parser: No <meta name="author".. found
Source: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.microsoft365.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638691055113888370.MTNlZDAyZGEtNWQ4OS00NjU4LTk0MTEtOGZiNjNhY2Y2ZGFiY2VkZDIyMTktZDVlYy00MjNhLWFmODgtYTQ0OWQ0YjYzZjBh&ui_locales=en-US&mkt=en-US&client-request-id=b82ae026-6de8-47a3-8912-a18a3642a987&state=iZWu6ChVaD7vmWA1k75lVI0DUoAKH5BZgeUQUG35ssyHYPndkIHjsnxJPZ4jwJQO2uVJMrFcYQwn0tx713caSlpvjzjVQFFcfDKxFQ8v621lQt9Fxcyh0FFAs_hRl4EMBWdajv0EqsMwPuooU-JeT_KleHNnE1AhiJqRMHcO5HT6UIDsfWgUW8lPURxZhfCkA7ZJsGcFUNrPQ53stG5MniWqbvgw5XDyBeGecKyjj3zAdRZD2TpsQPukICYaCh-Tw1SK1rlwNO_z7YH2cxktVsNEo-Gvb88din_A_ZnIBWe8W60p-xTfjngXl4BUgc6wuEqR3XhH0rN5k8dPuAWO_A&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0&sso_reload=true	HTTP Parser: No <meta name="author".. found
Source: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.microsoft365.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638691055113888370.MTNlZDAyZGEtNWQ4OS00NjU4LTk0MTEtOGZiNjNhY2Y2ZGFiY2VkZDIyMTktZDVlYy00MjNhLWFmODgtYTQ0OWQ0YjYzZjBh&ui_locales=en-US&mkt=en-US&client-request-id=b82ae026-6de8-47a3-8912-a18a3642a987&state=iZWu6ChVaD7vmWA1k75lVI0DUoAKH5BZgeUQUG35ssyHYPndkIHjsnxJPZ4jwJQO2uVJMrFcYQwn0tx713caSlpvjzjVQFFcfDKxFQ8v621lQt9Fxcyh0FFAs_hRl4EMBWdajv0EqsMwPuooU-JeT_KleHNnE1AhiJqRMHcO5HT6UIDsfWgUW8lPURxZhfCkA7ZJsGcFUNrPQ53stG5MniWqbvgw5XDyBeGecKyjj3zAdRZD2TpsQPukICYaCh-Tw1SK1rlwNO_z7YH2cxktVsNEo-Gvb88din_A_ZnIBWe8W60p-xTfjngXl4BUgc6wuEqR3XhH0rN5k8dPuAWO_A&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0&sso_reload=true	HTTP Parser: No <meta name="author".. found
Source: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.microsoft365.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638691055113888370.MTNlZDAyZGEtNWQ4OS00NjU4LTk0MTEtOGZiNjNhY2Y2ZGFiY2VkZDIyMTktZDVlYy00MjNhLWFmODgtYTQ0OWQ0YjYzZjBh&ui_locales=en-US&mkt=en-US&client-request-id=b82ae026-6de8-47a3-8912-a18a3642a987&state=iZWu6ChVaD7vmWA1k75lVI0DUoAKH5BZgeUQUG35ssyHYPndkIHjsnxJPZ4jwJQO2uVJMrFcYQwn0tx713caSlpvjzjVQFFcfDKxFQ8v621lQt9Fxcyh0FFAs_hRl4EMBWdajv0EqsMwPuooU-JeT_KleHNnE1AhiJqRMHcO5HT6UIDsfWgUW8lPURxZhfCkA7ZJsGcFUNrPQ53stG5MniWqbvgw5XDyBeGecKyjj3zAdRZD2TpsQPukICYaCh-Tw1SK1rlwNO_z7YH2cxktVsNEo-Gvb88din_A_ZnIBWe8W60p-xTfjngXl4BUgc6wuEqR3XhH0rN5k8dPuAWO_A&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0&sso_reload=true	HTTP Parser: No <meta name="author".. found
Source: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.microsoft365.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638691055113888370.MTNlZDAyZGEtNWQ4OS00NjU4LTk0MTEtOGZiNjNhY2Y2ZGFiY2VkZDIyMTktZDVlYy00MjNhLWFmODgtYTQ0OWQ0YjYzZjBh&ui_locales=en-US&mkt=en-US&client-request-id=b82ae026-6de8-47a3-8912-a18a3642a987&state=iZWu6ChVaD7vmWA1k75lVI0DUoAKH5BZgeUQUG35ssyHYPndkIHjsnxJPZ4jwJQO2uVJMrFcYQwn0tx713caSlpvjzjVQFFcfDKxFQ8v621lQt9Fxcyh0FFAs_hRl4EMBWdajv0EqsMwPuooU-JeT_KleHNnE1AhiJqRMHcO5HT6UIDsfWgUW8lPURxZhfCkA7ZJsGcFUNrPQ53stG5MniWqbvgw5XDyBeGecKyjj3zAdRZD2TpsQPukICYaCh-Tw1SK1rlwNO_z7YH2cxktVsNEo-Gvb88din_A_ZnIBWe8W60p-xTfjngXl4BUgc6wuEqR3XhH0rN5k8dPuAWO_A&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0&sso_reload=true	HTTP Parser: No <meta name="author".. found
Source: https://login.live.com/oauth20_authorize.srf?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&scope=openid+profile+https%3a%2f%2fwww.office.com%2fv2%2fOfficeHome.All&redirect_uri=https%3a%2f%2fwww.microsoft365.com%2flandingv2&response_type=code+id_token&state=iZWu6ChVaD7vmWA1k75lVI0DUoAKH5BZgeUQUG35ssyHYPndkIHjsnxJPZ4jwJQO2uVJMrFcYQwn0tx713caSlpvjzjVQFFcfDKxFQ8v621lQt9Fxcyh0FFAs_hRl4EMBWdajv0EqsMwPuooU-JeT_KleHNnE1AhiJqRMHcO5HT6UIDsfWgUW8lPURxZhfCkA7ZJsGcFUNrPQ53stG5MniWqbvgw5XDyBeGecKyjj3zAdRZD2TpsQPukICYaCh-Tw1SK1rlwNO_z7YH2cxktVsNEo-Gvb88din_A_ZnIBWe8W60p-xTfjngXl4BUgc6wuEqR3XhH0rN5k8dPuAWO_A&response_mode=form_post&nonce=638691055113888370.MTNlZDAyZGEtNWQ4OS00NjU4LTk0MTEtOGZiNjNhY2Y2ZGFiY2VkZDIyMTktZDVlYy00MjNhLWFmODgtYTQ0OWQ0YjYzZjBh&x-client-SKU=ID_NET8_0&x-client-Ver=7.5.1.0&uaid=b82ae0266de847a38912a18a3642a987&msproxy=1&issuer=mso&tenant=common&ui_locales=en-US&epct=PAQABDgEAAADW6jl31mB3T7ugrWTT8pFe1308fuOLqptfzg23nf6OY37D8C77hBXsXRMPjo9m5cEJYH79pUghHFhnj_OQ75cH6v3Xs1t9IUuyXnzVDyJX3GsUphevuSc49Mdu6UAZC	HTTP Parser: No <meta name="author".. found

Source: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.microsoft365.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638691055113888370.MTNlZDAyZGEtNWQ4OS00NjU4LTk0MTEtOGZiNjNhY2Y2ZGFiY2VkZDIyMTktZDVlYy00MjNhLWFmODgtYTQ0OWQ0YjYzZjBh&ui_locales=en-US&mkt=en-US&client-request-id=b82ae026-6de8-47a3-8912-a18a3642a987&state=iZWu6ChVaD7vmWA1k75lVI0DUoAKH5BZgeUQUG35ssyHYPndkIHjsnxJPZ4jwJQO2uVJMrFcYQwn0tx713caSlpvjzjVQFFcfDKxFQ8v621lQt9Fxcyh0FFAs_hRl4EMBWdajv0EqsMwPuooU-JeT_KleHNnE1AhiJqRMHcO5HT6UIDsfWgUW8lPURxZhfCkA7ZJsGcFUNrPQ53stG5MniWqbvgw5XDyBeGecKyjj3zAdRZD2TpsQPukICYaCh-Tw1SK1rlwNO_z7YH2cxktVsNEo-Gvb88din_A_ZnIBWe8W60p-xTfjngXl4BUgc6wuEqR3XhH0rN5k8dPuAWO_A&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0	HTTP Parser: No <meta name="copyright".. found
Source: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.microsoft365.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638691055113888370.MTNlZDAyZGEtNWQ4OS00NjU4LTk0MTEtOGZiNjNhY2Y2ZGFiY2VkZDIyMTktZDVlYy00MjNhLWFmODgtYTQ0OWQ0YjYzZjBh&ui_locales=en-US&mkt=en-US&client-request-id=b82ae026-6de8-47a3-8912-a18a3642a987&state=iZWu6ChVaD7vmWA1k75lVI0DUoAKH5BZgeUQUG35ssyHYPndkIHjsnxJPZ4jwJQO2uVJMrFcYQwn0tx713caSlpvjzjVQFFcfDKxFQ8v621lQt9Fxcyh0FFAs_hRl4EMBWdajv0EqsMwPuooU-JeT_KleHNnE1AhiJqRMHcO5HT6UIDsfWgUW8lPURxZhfCkA7ZJsGcFUNrPQ53stG5MniWqbvgw5XDyBeGecKyjj3zAdRZD2TpsQPukICYaCh-Tw1SK1rlwNO_z7YH2cxktVsNEo-Gvb88din_A_ZnIBWe8W60p-xTfjngXl4BUgc6wuEqR3XhH0rN5k8dPuAWO_A&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0&sso_reload=true	HTTP Parser: No <meta name="copyright".. found
Source: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.microsoft365.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638691055113888370.MTNlZDAyZGEtNWQ4OS00NjU4LTk0MTEtOGZiNjNhY2Y2ZGFiY2VkZDIyMTktZDVlYy00MjNhLWFmODgtYTQ0OWQ0YjYzZjBh&ui_locales=en-US&mkt=en-US&client-request-id=b82ae026-6de8-47a3-8912-a18a3642a987&state=iZWu6ChVaD7vmWA1k75lVI0DUoAKH5BZgeUQUG35ssyHYPndkIHjsnxJPZ4jwJQO2uVJMrFcYQwn0tx713caSlpvjzjVQFFcfDKxFQ8v621lQt9Fxcyh0FFAs_hRl4EMBWdajv0EqsMwPuooU-JeT_KleHNnE1AhiJqRMHcO5HT6UIDsfWgUW8lPURxZhfCkA7ZJsGcFUNrPQ53stG5MniWqbvgw5XDyBeGecKyjj3zAdRZD2TpsQPukICYaCh-Tw1SK1rlwNO_z7YH2cxktVsNEo-Gvb88din_A_ZnIBWe8W60p-xTfjngXl4BUgc6wuEqR3XhH0rN5k8dPuAWO_A&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0&sso_reload=true	HTTP Parser: No <meta name="copyright".. found
Source: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.microsoft365.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638691055113888370.MTNlZDAyZGEtNWQ4OS00NjU4LTk0MTEtOGZiNjNhY2Y2ZGFiY2VkZDIyMTktZDVlYy00MjNhLWFmODgtYTQ0OWQ0YjYzZjBh&ui_locales=en-US&mkt=en-US&client-request-id=b82ae026-6de8-47a3-8912-a18a3642a987&state=iZWu6ChVaD7vmWA1k75lVI0DUoAKH5BZgeUQUG35ssyHYPndkIHjsnxJPZ4jwJQO2uVJMrFcYQwn0tx713caSlpvjzjVQFFcfDKxFQ8v621lQt9Fxcyh0FFAs_hRl4EMBWdajv0EqsMwPuooU-JeT_KleHNnE1AhiJqRMHcO5HT6UIDsfWgUW8lPURxZhfCkA7ZJsGcFUNrPQ53stG5MniWqbvgw5XDyBeGecKyjj3zAdRZD2TpsQPukICYaCh-Tw1SK1rlwNO_z7YH2cxktVsNEo-Gvb88din_A_ZnIBWe8W60p-xTfjngXl4BUgc6wuEqR3XhH0rN5k8dPuAWO_A&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0&sso_reload=true	HTTP Parser: No <meta name="copyright".. found
Source: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.microsoft365.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638691055113888370.MTNlZDAyZGEtNWQ4OS00NjU4LTk0MTEtOGZiNjNhY2Y2ZGFiY2VkZDIyMTktZDVlYy00MjNhLWFmODgtYTQ0OWQ0YjYzZjBh&ui_locales=en-US&mkt=en-US&client-request-id=b82ae026-6de8-47a3-8912-a18a3642a987&state=iZWu6ChVaD7vmWA1k75lVI0DUoAKH5BZgeUQUG35ssyHYPndkIHjsnxJPZ4jwJQO2uVJMrFcYQwn0tx713caSlpvjzjVQFFcfDKxFQ8v621lQt9Fxcyh0FFAs_hRl4EMBWdajv0EqsMwPuooU-JeT_KleHNnE1AhiJqRMHcO5HT6UIDsfWgUW8lPURxZhfCkA7ZJsGcFUNrPQ53stG5MniWqbvgw5XDyBeGecKyjj3zAdRZD2TpsQPukICYaCh-Tw1SK1rlwNO_z7YH2cxktVsNEo-Gvb88din_A_ZnIBWe8W60p-xTfjngXl4BUgc6wuEqR3XhH0rN5k8dPuAWO_A&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0&sso_reload=true	HTTP Parser: No <meta name="copyright".. found
Source: https://login.live.com/oauth20_authorize.srf?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&scope=openid+profile+https%3a%2f%2fwww.office.com%2fv2%2fOfficeHome.All&redirect_uri=https%3a%2f%2fwww.microsoft365.com%2flandingv2&response_type=code+id_token&state=iZWu6ChVaD7vmWA1k75lVI0DUoAKH5BZgeUQUG35ssyHYPndkIHjsnxJPZ4jwJQO2uVJMrFcYQwn0tx713caSlpvjzjVQFFcfDKxFQ8v621lQt9Fxcyh0FFAs_hRl4EMBWdajv0EqsMwPuooU-JeT_KleHNnE1AhiJqRMHcO5HT6UIDsfWgUW8lPURxZhfCkA7ZJsGcFUNrPQ53stG5MniWqbvgw5XDyBeGecKyjj3zAdRZD2TpsQPukICYaCh-Tw1SK1rlwNO_z7YH2cxktVsNEo-Gvb88din_A_ZnIBWe8W60p-xTfjngXl4BUgc6wuEqR3XhH0rN5k8dPuAWO_A&response_mode=form_post&nonce=638691055113888370.MTNlZDAyZGEtNWQ4OS00NjU4LTk0MTEtOGZiNjNhY2Y2ZGFiY2VkZDIyMTktZDVlYy00MjNhLWFmODgtYTQ0OWQ0YjYzZjBh&x-client-SKU=ID_NET8_0&x-client-Ver=7.5.1.0&uaid=b82ae0266de847a38912a18a3642a987&msproxy=1&issuer=mso&tenant=common&ui_locales=en-US&epct=PAQABDgEAAADW6jl31mB3T7ugrWTT8pFe1308fuOLqptfzg23nf6OY37D8C77hBXsXRMPjo9m5cEJYH79pUghHFhnj_OQ75cH6v3Xs1t9IUuyXnzVDyJX3GsUphevuSc49Mdu6UAZC...	HTTP Parser: No <meta name="copyright".. found

Source: unknown	HTTPS traffic detected: 20.190.181.23:443 -> 192.168.2.17:49692 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.5.88:443 -> 192.168.2.17:49694 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.16.158.186:443 -> 192.168.2.17:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.202.163.200:443 -> 192.168.2.17:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.16.229.162:443 -> 192.168.2.17:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.16.229.162:443 -> 192.168.2.17:49717 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.202.163.200:443 -> 192.168.2.17:49792 version: TLS 1.2

Source: global traffic

HTTP traffic detected: GET /ab HTTP/1.1Host: evoke-windowsservices-tas.msedge.netCache-Control: no-store, no-cacheX-PHOTOS-CALLERID: 9NMPJ99VJBWVX-EVOKE-RING: X-WINNEXT-RING: PublicX-WINNEXT-TELEMETRYLEVEL: BasicX-WINNEXT-OSVERSION: 10.0.19045.0X-WINNEXT-APPVERSION: 1.23082.131.0X-WINNEXT-PLATFORM: DesktopX-WINNEXT-CANTAILOR: FalseX-MSEDGE-CLIENTID: {c1afbad7-f7da-40f2-92f9-8846a91d69bd}X-WINNEXT-PUBDEVICEID: dbfen2nYS7HW6ON4OdOknKxxv2CCI5LJBTojzDztjwI=If-None-Match: 2056388360_-1434155563Accept-Encoding: gzip, deflate, br

Source: Joe Sandbox View	IP Address: 13.107.246.63 13.107.246.63
Source: Joe Sandbox View	IP Address: 104.18.94.41 104.18.94.41
Source: Joe Sandbox View	IP Address: 151.101.0.237 151.101.0.237

Source: Joe Sandbox View	JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4
Source: Joe Sandbox View	JA3 fingerprint: 6271f898ce5be7dd52b0fc260d0662b3
Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.181.23
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.181.23
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.181.23
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.5.88
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.5.88
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.5.88
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.181.23
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.5.88
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.5.88
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.5.88
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.5.88
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.5.88
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.181.23
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.181.23
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.181.23
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.181.23
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.181.23
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.181.23
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.181.23
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.181.23
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.181.23
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.181.23
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.181.23
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.181.23
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.181.23
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.181.23
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.181.23
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.181.23
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.181.23
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.181.23
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.181.23
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.181.23
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.181.23
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.181.23
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.181.23
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.181.23
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.181.23
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.181.23
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.181.23
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.181.23
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.181.23

Source: global traffic	HTTP traffic detected: GET /ab HTTP/1.1Host: evoke-windowsservices-tas.msedge.netCache-Control: no-store, no-cacheX-PHOTOS-CALLERID: 9NMPJ99VJBWVX-EVOKE-RING: X-WINNEXT-RING: PublicX-WINNEXT-TELEMETRYLEVEL: BasicX-WINNEXT-OSVERSION: 10.0.19045.0X-WINNEXT-APPVERSION: 1.23082.131.0X-WINNEXT-PLATFORM: DesktopX-WINNEXT-CANTAILOR: FalseX-MSEDGE-CLIENTID: {c1afbad7-f7da-40f2-92f9-8846a91d69bd}X-WINNEXT-PUBDEVICEID: dbfen2nYS7HW6ON4OdOknKxxv2CCI5LJBTojzDztjwI=If-None-Match: 2056388360_-1434155563Accept-Encoding: gzip, deflate, br
Source: global traffic	HTTP traffic detected: GET /client/config?cc=CH&setlang=en-CH HTTP/1.1X-Search-CortanaAvailableCapabilities: NoneX-Search-SafeSearch: ModerateAccept-Encoding: gzip, deflateX-Device-MachineId: {92C86F7C-DB2B-4F6A-95AD-98B4A2AE008A}X-UserAgeClass: UnknownX-BM-Market: CHX-BM-DateFormat: dd/MM/yyyyX-Device-OSSKU: 48X-BM-DTZ: -300X-DeviceID: 01000A41090080B6X-BM-WindowsFlights: FX:117B9872,FX:119E26AD,FX:11C0E96C,FX:11C6E5C2,FX:11C7EB6A,FX:11C9408A,FX:11C940DB,FX:11CB9A9F,FX:11CB9AC1,FX:11CC111C,FX:11D5BFCD,FX:11DF5B12,FX:11DF5B75,FX:1240931B,FX:124B38D0,FX:127FC878,FX:1283FFE8,FX:12840617,FX:128979F9,FX:128EBD7E,FX:129135BB,FX:129E053F,FX:12A74DB5,FX:12AB734D,FX:12B8450E,FX:12BD6E73,FX:12C3331B,FX:12C7D66EX-Search-TimeZone: Bias=300; StandardBias=0; TimeZoneKeyName=Eastern Standard TimeX-BM-Theme: 000000;0078d7X-Search-RPSToken: t%3DEwDoAkR8BAAUcvamItSE/vUHpyZRp3BeyOJPQDsAAbwmgMpeMqyLcwi4%2BaXgrM4o12F3Iyrn6wfmpBovFTS%2BqG%2BJK1x82uA46M5S1Zo9mnUewu/ldDV%2B3Q4uMDhR5WIk%2BSBOzPtxv38vxAGZuU7gBQ4GbS4NXVmPA0zFBRmpsuAwASMI528EKAslipNxhpWLojH7NAZrn8NndAXk9H6KnA6rX6DPsptdoUOefPENWp3aVfXsfAL1N2u9NL6vX7lDAm5sPEOQHY8SxFrg0ppXA0YG6p6XYV3FtQiJ8a1WrNWOfLpUNo6Pl/NJIUEFN7AfGRzRLamXHBKZaSG15bdah465WyGVbCBiihL5dfWGunN1R93kCkJ9hy6Pc/HjgBsQZgAAEDJ3k7wPtDm/wMxpP/4NwhawAY80RL6OIC3m42P6ivM4Q7swz1Fp9xIPUAYsGNozHSAd24wd8QO2i%2BBybaeKkfZKG6wMp42drGNT1FHfHEm0Po0IcxxoDy9P2gWYCnWblsXO5Kqb4Bfnkqm6YsrLUPVZcpyHE1N9Wm%2BXy5ybnlU8kYKwbsxlEe1MrVJMN%2BRsX3XLKtxJk1tU%2BxlwpxxZr0XW1bwGEZpaJf3ktzqHU/7P4xUAE0IC/E%2Bsj0o9T3r/g%2BB%2BlLMgQjbS046HrL7SAlB1keymrK%2BU/nUNCsNDicDXT2A8p4fxJSPEjS5pTF4UcVkf6uX83b9b0bvJM8kK/eLKZql3%2BSJ7NRBX0s2dK2KHB1U2xBMqsu1Lh7KwWBGgx9aV7QZ2ZwTKS3Hej6Z5TUX/1oS7LcFT6pFz4Y/NJ2kNbsrRabVC2/9bv0oFYU9wn30xnmMLhC9JfJxMUU8PqtbwRM92q/6fw1rE6H226Dpio9tvld8zBpJYtAFVlwfa7yMOBtYf34G6HtSJouPuZ0vYwMuvfiT7DkHrV9WQrS7%2Bpcf3ZSiCoy5hZ%2B6Yz5L1uU97InlmEGbCgQr4SDZEo/Bkv9gB%26p%3DX-Agent-DeviceId: 01000A41090080B6X-BM-CBT: 1733508630User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045X-Device-isOptin: falseAccept-language: en-GB, en, en-USX-Device-Touch: falseX-Device-ClientSession: 7EA1F92E2F2941C7B6D05AC70053D1CBX-Search-AppId: Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUIHost: www.bing.comConnection: Keep-AliveCookie: SRCHUID=V=2&GUID=C4EAB6C130004333A34B5668AE4E4D10&dmnchg=1; SRCHD=AF=NOFORM; SRCHUSR=DOB=20240207; SRCHHPGUSR=SRCHLANG=en; MUID=4590362BB5CF472B95BBEDB3112D4B7B; MUIDB=4590362BB5CF472B95BBEDB3112D4B7B
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=5LMXWADrPZVFzbl&MD=L2wbcUpC HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /onboarding/smskillreader.txt HTTP/1.1Host: armmf.adobe.comConnection: keep-aliveAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brIf-None-Match: "78-5faa31cce96da"If-Modified-Since: Mon, 01 May 2023 15:02:33 GMT
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: www.rfp-documents.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /content/v1/66a3d462e2868939fd2eca54/1722012771261-GLXOC1OOG3852XXSTKFL/58480fd7cef1014c0b5e4943.png?format=1500w HTTP/1.1Host: images.squarespace-cdn.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.rfp-documents.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /@sqs/polyfiller/1.6/modern.js HTTP/1.1Host: assets.squarespace.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.rfp-documents.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.rfp-documents.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /universal/styles-compressed/user-account-core-b6e8cafbf34b05da5c2b-min.en-US.css HTTP/1.1Host: assets.squarespace.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.rfp-documents.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /content/v1/66a3d462e2868939fd2eca54/1722014277927-MAPQVN7CBP5Y2UPB54MU/unsplash-image-ITozVZXb8_0.jpg?format=1500w HTTP/1.1Host: images.squarespace-cdn.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.rfp-documents.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/versioned-site-css/66a3d462e2868939fd2eca54/0/5c5a519771c10ba3470d8101/66a3d462e2868939fd2eca5c/1589/site.css HTTP/1.1Host: static1.squarespace.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.rfp-documents.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/vta/5c5a519771c10ba3470d8101/versioned-assets/1728407958569-DI71YIND73BBQN7RBZCZ/static.css HTTP/1.1Host: static1.squarespace.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.rfp-documents.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /content/v1/66a3d462e2868939fd2eca54/1722012771261-GLXOC1OOG3852XXSTKFL/58480fd7cef1014c0b5e4943.png?format=1500w HTTP/1.1Host: images.squarespace-cdn.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /@sqs/polyfiller/1.6/modern.js HTTP/1.1Host: assets.squarespace.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /universal/scripts-compressed/extract-css-runtime-9e425782a769a5e56f1d-min.en-US.js HTTP/1.1Host: assets.squarespace.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.rfp-documents.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.rfp-documents.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /content/v1/66a3d462e2868939fd2eca54/1722014277927-MAPQVN7CBP5Y2UPB54MU/unsplash-image-ITozVZXb8_0.jpg?format=1500w HTTP/1.1Host: images.squarespace-cdn.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /universal/scripts-compressed/extract-css-moment-js-vendor-6c569122bfa66a51a056-min.en-US.js HTTP/1.1Host: assets.squarespace.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.rfp-documents.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.rfp-documents.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /universal/scripts-compressed/cldr-resource-pack-97201f78d218632f0a8e-min.en-US.js HTTP/1.1Host: assets.squarespace.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.rfp-documents.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.rfp-documents.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /universal/scripts-compressed/common-vendors-stable-61293f01d648eef165fc-min.en-US.js HTTP/1.1Host: assets.squarespace.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.rfp-documents.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.rfp-documents.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/vta/5c5a519771c10ba3470d8101/scripts/site-bundle.72e5364d6a59fa8b809228ec33508ee5.js HTTP/1.1Host: static1.squarespace.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.rfp-documents.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /universal/scripts-compressed/common-vendors-28107424081542d5b726-min.en-US.js HTTP/1.1Host: assets.squarespace.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.rfp-documents.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.rfp-documents.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /universal/scripts-compressed/common-f7724976b1c24709c33d-min.en-US.js HTTP/1.1Host: assets.squarespace.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.rfp-documents.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.rfp-documents.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /universal/scripts-compressed/user-account-core-0ed8c44d3d37cbbea80d-min.en-US.js HTTP/1.1Host: assets.squarespace.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.rfp-documents.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.rfp-documents.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /universal/scripts-compressed/extract-css-runtime-9e425782a769a5e56f1d-min.en-US.js HTTP/1.1Host: assets.squarespace.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /universal/scripts-compressed/performance-f2cc9cec97bcdc0555a8-min.en-US.js HTTP/1.1Host: assets.squarespace.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.rfp-documents.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.rfp-documents.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /universal/scripts-compressed/cldr-resource-pack-97201f78d218632f0a8e-min.en-US.js HTTP/1.1Host: assets.squarespace.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /universal/scripts-compressed/user-account-core-0ed8c44d3d37cbbea80d-min.en-US.js HTTP/1.1Host: assets.squarespace.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /universal/scripts-compressed/common-vendors-stable-61293f01d648eef165fc-min.en-US.js HTTP/1.1Host: assets.squarespace.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/vta/5c5a519771c10ba3470d8101/scripts/site-bundle.72e5364d6a59fa8b809228ec33508ee5.js HTTP/1.1Host: static1.squarespace.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /universal/scripts-compressed/common-vendors-28107424081542d5b726-min.en-US.js HTTP/1.1Host: assets.squarespace.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /universal/scripts-compressed/extract-css-moment-js-vendor-6c569122bfa66a51a056-min.en-US.js HTTP/1.1Host: assets.squarespace.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /dqhqST/ HTTP/1.1Host: r5k.ljxfrbcb.ruConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentReferer: https://www.rfp-documents.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /universal/scripts-compressed/performance-f2cc9cec97bcdc0555a8-min.en-US.js HTTP/1.1Host: assets.squarespace.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/vta/5c5a519771c10ba3470d8101/scripts/user-account-link.ebcfaf0db367f03f76d6.js HTTP/1.1Host: static1.squarespace.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.rfp-documents.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /universal/scripts-compressed/common-f7724976b1c24709c33d-min.en-US.js HTTP/1.1Host: assets.squarespace.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /universal/scripts-compressed/15606-23a36b9881317ec771ab-min.en-US.js HTTP/1.1Host: assets.squarespace.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.rfp-documents.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /universal/scripts-compressed/2775-cc7fc3b53a8197587aa5-min.en-US.js HTTP/1.1Host: assets.squarespace.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.rfp-documents.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /api/census/RecordHit HTTP/1.1Host: www.rfp-documents.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: crumb=BdwPd6wVMUYuZTVmZjk3Y2EzMGQ2OTZjOWIwY2IxNTAxZjJhMDNi; ss_cvr=01d3d588-c13c-49f0-98c4-1b489fe931f7\|1733508675397\|1733508675397\|1733508675397\|1; ss_cvt=1733508675397
Source: global traffic	HTTP traffic detected: GET /universal/styles-compressed/2356ee25bed07678b7ee-min.en-US.css HTTP/1.1Host: assets.squarespace.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.rfp-documents.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/vta/5c5a519771c10ba3470d8101/scripts/user-account-link.ebcfaf0db367f03f76d6.js HTTP/1.1Host: static1.squarespace.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /universal/scripts-compressed/async-gdpr-cookie-banner-65225d6cedd9f0b07f87-min.en-US.js HTTP/1.1Host: assets.squarespace.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.rfp-documents.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /universal/scripts-compressed/2775-cc7fc3b53a8197587aa5-min.en-US.js HTTP/1.1Host: assets.squarespace.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /api/census/button-render HTTP/1.1Host: www.rfp-documents.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: crumb=BdwPd6wVMUYuZTVmZjk3Y2EzMGQ2OTZjOWIwY2IxNTAxZjJhMDNi; ss_cvr=01d3d588-c13c-49f0-98c4-1b489fe931f7\|1733508675397\|1733508675397\|1733508675397\|1; ss_cvt=1733508675397
Source: global traffic	HTTP traffic detected: GET /jquery-3.6.0.min.js HTTP/1.1Host: code.jquery.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://r5k.ljxfrbcb.ru/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ajax/libs/crypto-js/4.1.1/crypto-js.min.js HTTP/1.1Host: cdnjs.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://r5k.ljxfrbcb.ru/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/vta/5c5a519771c10ba3470d8101/scripts/floating-cart.11c2f1b3c1cb2ba0d418.js HTTP/1.1Host: static1.squarespace.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.rfp-documents.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /universal/scripts-compressed/15606-23a36b9881317ec771ab-min.en-US.js HTTP/1.1Host: assets.squarespace.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /turnstile/v0/api.js?render=explicit HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://r5k.ljxfrbcb.ru/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/vta/5c5a519771c10ba3470d8101/scripts/floating-cart.11c2f1b3c1cb2ba0d418.js HTTP/1.1Host: static1.squarespace.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /universal/scripts-compressed/async-gdpr-cookie-banner-65225d6cedd9f0b07f87-min.en-US.js HTTP/1.1Host: assets.squarespace.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /content/v1/66a3d462e2868939fd2eca54/1722012772778-9SDIZRKEI2F0Q3SDOWOM/favicon.ico?format=100w HTTP/1.1Host: images.squarespace-cdn.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.rfp-documents.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /turnstile/v0/g/f9063374b04d/api.js HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://r5k.ljxfrbcb.ru/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ajax/libs/crypto-js/4.1.1/crypto-js.min.js HTTP/1.1Host: cdnjs.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /jquery-3.6.0.min.js HTTP/1.1Host: code.jquery.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /content/v1/66a3d462e2868939fd2eca54/1722012772778-9SDIZRKEI2F0Q3SDOWOM/favicon.ico?format=100w HTTP/1.1Host: images.squarespace-cdn.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /turnstile/v0/g/f9063374b04d/api.js HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv/vchi6/0x4AAAAAAA0NWSRzOUHOvAa6/auto/fbE/normal/auto/ HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: iframeReferer: https://r5k.ljxfrbcb.ru/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/orchestrate/chl_api/v1?ray=8ede3cfb78370cc6&lang=auto HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv/vchi6/0x4AAAAAAA0NWSRzOUHOvAa6/auto/fbE/normal/auto/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/cmg/1 HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv/vchi6/0x4AAAAAAA0NWSRzOUHOvAa6/auto/fbE/normal/auto/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: r5k.ljxfrbcb.ruConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://r5k.ljxfrbcb.ru/dqhqST/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IkFlK1NFeURUSUg2SVJVUVRmTnQycXc9PSIsInZhbHVlIjoiUUhJTDM5TktYNzkyQ3JQcnVrNWsvR0J6Yk4zbU1FaHBocFkydnNUTElaRnV4V25uK1ZycHpjYUNpRmFzV1Nsd3BVTHpMV0oza0NXNjRQQzE5dm9uNzhZVytmSTB2cTBJSXhDYkZ4OFhGSi9vTmdhL29kL1JHVDBLamxMUGFkQ3kiLCJtYWMiOiI4ZTI2MTM3YjAzYjk2OWNhZThhNWQxZjJhYzliZmUxNmRkMjJmZDRkNGNhN2RkOThjMjcwYTZlZWI1MTAxMWQ1IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6InppTU1BSlUzaFFlclUrdXN2aWNudGc9PSIsInZhbHVlIjoieDVNdlRYb291RWQ2RHVJSmFDdDBZMW1zU3lwdk1WTnpOaUp4RGZZelZPLy9USXQ4YTZuNk5DTjJMalhoeGIyNE5MTE9FSTBjTjN4ZDduMUhRR1RpeEpWOEVrOU9sUjA4U3ZSYUFEUEd2YXJGc1FWd0pWQ2daN1RsRlBFbUM0RUoiLCJtYWMiOiJmOGQzYWQxMDk1ZDlhMTkzODFkYjRhOTJlYzdiOWJmMzJkODMzODU3N2E3ZDA5MDYxNjg0ODU0M2QyYTJhMThjIiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=5LMXWADrPZVFzbl&MD=L2wbcUpC HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/cmg/1 HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/orchestrate/chl_api/v1?ray=8ede3cfb78370cc6&lang=auto HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/flow/ov1/1847671344:1733505165:JE2UVF14CIUNyxYyFqCUW68CDkk1JWs8XmF3dRrc1Uk/8ede3cfb78370cc6/cxkTEv8GEPZ5EiC_wml74DNC5dc_TvMdQQ3X8thO8RQ-1733508684-1.1.1.1-jurIFDJFuz5Pp5PD2zFIomss4j_hma_A2aArKMCYMcZygxLQzdhfwe26DScI6vHM HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/i/8ede3cfb78370cc6/1733508688151/6bvhidxf7M30WER HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv/vchi6/0x4AAAAAAA0NWSRzOUHOvAa6/auto/fbE/normal/auto/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/i/8ede3cfb78370cc6/1733508688151/6bvhidxf7M30WER HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/pat/8ede3cfb78370cc6/1733508688161/afb7eff80115cf2347d6bad20b04505c0e67c622843f8b78197ca95bb02e4d7f/IWE6LrcTaSibyvG HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveCache-Control: max-age=0sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv/vchi6/0x4AAAAAAA0NWSRzOUHOvAa6/auto/fbE/normal/auto/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/flow/ov1/1847671344:1733505165:JE2UVF14CIUNyxYyFqCUW68CDkk1JWs8XmF3dRrc1Uk/8ede3cfb78370cc6/cxkTEv8GEPZ5EiC_wml74DNC5dc_TvMdQQ3X8thO8RQ-1733508684-1.1.1.1-jurIFDJFuz5Pp5PD2zFIomss4j_hma_A2aArKMCYMcZygxLQzdhfwe26DScI6vHM HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/flow/ov1/1847671344:1733505165:JE2UVF14CIUNyxYyFqCUW68CDkk1JWs8XmF3dRrc1Uk/8ede3cfb78370cc6/cxkTEv8GEPZ5EiC_wml74DNC5dc_TvMdQQ3X8thO8RQ-1733508684-1.1.1.1-jurIFDJFuz5Pp5PD2zFIomss4j_hma_A2aArKMCYMcZygxLQzdhfwe26DScI6vHM HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /TvsEJLOTWbExKTWyAKzDBACEIPzNZfrzVyVFEQNHQKMWGINHTGHMCCCKBPYJUFTBYEBAGK HTTP/1.1Host: rojqgx5a4qvzw6a2ghba47pqhgurojcqq1d6dohirqvvkmobwapnc9xf.ygncsqvu.ruConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Origin: https://r5k.ljxfrbcb.ruSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://r5k.ljxfrbcb.ru/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /TvsEJLOTWbExKTWyAKzDBACEIPzNZfrzVyVFEQNHQKMWGINHTGHMCCCKBPYJUFTBYEBAGK HTTP/1.1Host: rojqgx5a4qvzw6a2ghba47pqhgurojcqq1d6dohirqvvkmobwapnc9xf.ygncsqvu.ruConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/BssoInterrupt_Core_zKox_QMcTIVut7mG_Z9Eew2.js HTTP/1.1Host: aadcdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://login.microsoftonline.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/BssoInterrupt_Core_zKox_QMcTIVut7mG_Z9Eew2.js HTTP/1.1Host: aadcdn.msauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ests/2.1/content/cdnbundles/converged.v2.login.min_81imvbluez-v5hbzpkxfcg2.css HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://login.microsoftonline.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: styleReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/ConvergedLogin_PCore_i5YupurhQAo9inu_OetqHw2.js HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://login.microsoftonline.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ests/2.1/content/cdnbundles/ux.converged.login.strings-en.min_i8f-75gfk3tbsm8bmatnqa2.js HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://login.microsoftonline.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /Me.htm?v=3 HTTP/1.1Host: login.live.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Purpose: prefetchSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ests/2.1/content/cdnbundles/ux.converged.login.strings-en.min_i8f-75gfk3tbsm8bmatnqa2.js HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/oneDs_f2e0f4a029670f10d892.js HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/ConvergedLogin_PCore_i5YupurhQAo9inu_OetqHw2.js HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/oneDs_f2e0f4a029670f10d892.js HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/asyncchunk/convergedlogin_pcustomizationloader_117b650bccea354984d8.js HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/asyncchunk/convergedlogin_pcustomizationloader_117b650bccea354984d8.js HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/asyncchunk/convergedlogin_pfetchsessionsprogress_d0a803279e7397bef834.js HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/marching_ants_white_8257b0707cbe1d0bd2661b80068676fe.gif HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/marching_ants_986f40b5a9dc7d39ef8396797f61b323.gif HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/marching_ants_white_8257b0707cbe1d0bd2661b80068676fe.gif HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/marching_ants_986f40b5a9dc7d39ef8396797f61b323.gif HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/asyncchunk/convergedlogin_pfetchsessionsprogress_d0a803279e7397bef834.js HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/backgrounds/2_11d9e3bcdfede9ce5ce5ace2d129f1c4.svg HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/microsoft_logo_564db913a7fa0ca42727161c6d031bef.svg HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/backgrounds/2_11d9e3bcdfede9ce5ce5ace2d129f1c4.svg HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/microsoft_logo_564db913a7fa0ca42727161c6d031bef.svg HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/asyncchunk/convergedlogin_pstringcustomizationhelper_4285088f1dbaf52a876d.js HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/signin-options_3e3f6b73c3f310c31d2c4d131a8ab8c6.svg HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/signin-options_3e3f6b73c3f310c31d2c4d131a8ab8c6.svg HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/asyncchunk/convergedlogin_pstringcustomizationhelper_4285088f1dbaf52a876d.js HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /oauth20_authorize.srf?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&scope=openid+profile+https%3a%2f%2fwww.office.com%2fv2%2fOfficeHome.All&redirect_uri=https%3a%2f%2fwww.microsoft365.com%2flandingv2&response_type=code+id_token&state=iZWu6ChVaD7vmWA1k75lVI0DUoAKH5BZgeUQUG35ssyHYPndkIHjsnxJPZ4jwJQO2uVJMrFcYQwn0tx713caSlpvjzjVQFFcfDKxFQ8v621lQt9Fxcyh0FFAs_hRl4EMBWdajv0EqsMwPuooU-JeT_KleHNnE1AhiJqRMHcO5HT6UIDsfWgUW8lPURxZhfCkA7ZJsGcFUNrPQ53stG5MniWqbvgw5XDyBeGecKyjj3zAdRZD2TpsQPukICYaCh-Tw1SK1rlwNO_z7YH2cxktVsNEo-Gvb88din_A_ZnIBWe8W60p-xTfjngXl4BUgc6wuEqR3XhH0rN5k8dPuAWO_A&response_mode=form_post&nonce=638691055113888370.MTNlZDAyZGEtNWQ4OS00NjU4LTk0MTEtOGZiNjNhY2Y2ZGFiY2VkZDIyMTktZDVlYy00MjNhLWFmODgtYTQ0OWQ0YjYzZjBh&x-client-SKU=ID_NET8_0&x-client-Ver=7.5.1.0&uaid=b82ae0266de847a38912a18a3642a987&msproxy=1&issuer=mso&tenant=common&ui_locales=en-US&epct=PAQABDgEAAADW6jl31mB3T7ugrWTT8pFe1308fuOLqptfzg23nf6OY37D8C77hBXsXRMPjo9m5cEJYH79pUghHFhnj_OQ75cH6v3Xs1t9IUuyXnzVDyJX3GsUphevuSc49Mdu6UAZC9jbCQI5lTowYn3v1S20QLkCvJrX0ouzkju34ic51R8pswGDPibwTDBzQxQPX0VQ2f66IzW7DuOhoxr4LIW7TfC98G67QYOZ8QPPBI1fpTc1tyAA&jshs=2&jsh=&jshp=&username=fake.fake%40fake.com&login_hint=fake.fake%40fake.com HTTP/1.1Host: login.live.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: uaid=9765ffa0bdf84341ba8408d888917320; MSPRequ=id=N&lt=1733508734&co=0
Source: global traffic	HTTP traffic detected: GET /shared/5/js/login_en_GZu1H3AHaJ0ROCr2BSwwfw2.js HTTP/1.1Host: logincdn.msftauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://login.live.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://login.live.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/5/chunks/oneds-analytics-js_077217740c853b5d4fe8.js HTTP/1.1Host: logincdn.msftauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://login.live.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://login.live.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/5/images/microsoft_logo_ee5c8d9fb6248c938fd0.svg HTTP/1.1Host: logincdn.msftauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://login.live.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/5/images/2_bc3d32a696895f78c19d.svg HTTP/1.1Host: logincdn.msftauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://login.live.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/5/js/login_en_GZu1H3AHaJ0ROCr2BSwwfw2.js HTTP/1.1Host: logincdn.msftauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /GetExperimentAssignments.srf HTTP/1.1Host: login.live.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: MSPRequ=id=N&lt=1733508752&co=0; uaid=b82ae0266de847a38912a18a3642a987; MSCC=8.46.123.228-US; MSPOK=$uuid-0af0051e-3841-4d19-999a-e408a8e2aa95; OParams=11O.DjnCykfhA0QhrnErKnmrHszZK0cMNcXgLn6mMjJUctkCUHy1eafRzBoZJu3qyiYzKZoND3IOhwryK90GdlVstoUk7D!6c1GuVRgRjQMH80PUyLlu0bvBOouycvwjcG2Oy9C1doLci5IoQQyVVxebOQB2bCfLr48jShVRpOIRnDFQHpyH9X5eou!EVK459HsMCFLrczdM3DrU8h59sd8jW5ULqLJVvtYNFdBR3xjQwBpV5rzQfLMYQZ2qmjar6DZVJp0AJs3mT5sXxAk66yUL2jacIjf2ldV9HQB6s2b7oJErjpnLF!5GYVXhl!rk9ruhjlblL9GRW3aQNtFQH!I!JNIagIlp04e8WLI0b8C7AcHKM3cZXqzA0Mfj4qdcWSDBTK69bII75Lyx0Qz3ARTPNXIBPWa9JFuFDUmQGt3qQpE4HnnLZ2ssNpoJrBvL7VNUproYqjeEzJJykZH892aVVA5!EOr6kge6wGhYWCfKy8wbESS5LbUfX2Mk3aMb04cAuZeDH8gQsk6sQ5YgAAUDuir46ESfk6wWZe61dAogEySXnRbsMIePggGIrkGAffMbI1kbFTRNWJ1VGXaW3kd9414!iNe2s3bwtCKEJ0YQTYR!P!Rix3cD4oTfihQvauDbhEhvBKnRyKOSNdPiovXLqPm3V8W2fpkHutAhAjeTcDTt5KG!B5C0!MGHDWcLLJM!J84fxslWfHMx0WWr3s!yThtBYsYraPWwA4AsUW9JfrMU4wj3SwRoChyrNjZqPE4J0T6XS4RYxZDgryYGxCsRX9ukgvG5OKucGnnveKCS28BZMbdkMIx63CqjzSXLmCYdRNmgcwaTpGGIHdV0DGGi25unpWdIlej3Zp9UnBaHMbP3uIx1Vzzo1q8ejngIZpFrBjhv8c1PRtRf9dpYkKw9TIaH!O68Ebt1Vdud5irsF6z4gHpuuVfqzhXlfJ98CL!Gggavj4!f!G4Rf6vv5AkQHbuT!j4WPgUS00e4y9bwXzu4SZ3CSbpBVd6V6qbPr7d4B2mlWlfuTSQOn41DYXvdtlG25Qww32s0w8knDOX7bHiyyj9maBVx0W25!8kbRmC8DUUpCA6JuRNbtN4TLzmhPa28sYeHSBBde9UCichmorPNTOasBaxr0aRXF4B1grtOHBIVVFOD738mpGkLmeyiz9pXDCduZFBHNhnnK!jopky1UUaYIFhFoo9BP!7XDAZoJtPs2FJc9XmgmMZ9RtZPt9!IoaLiz8LwX!UOZlxOjsqmRhGtAOvWCOfD4rsSBrgWOsP!gNpWFl*cs!e5Ong4EUQz

Source: chromecache_307.17.dr

String found in binary or memory: <html xmlns:og="http://opengraphprotocol.org/schema/" xmlns:fb="http://www.facebook.com/2008/fbml" lang="en-US" > equals www.facebook.com (Facebook)

Source: global traffic	DNS traffic detected: DNS query: x1.i.lencr.org
Source: global traffic	DNS traffic detected: DNS query: images.squarespace-cdn.com
Source: global traffic	DNS traffic detected: DNS query: assets.squarespace.com
Source: global traffic	DNS traffic detected: DNS query: static1.squarespace.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: r5k.ljxfrbcb.ru
Source: global traffic	DNS traffic detected: DNS query: code.jquery.com
Source: global traffic	DNS traffic detected: DNS query: challenges.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: cdnjs.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: performance.squarespace.com
Source: global traffic	DNS traffic detected: DNS query: a.nel.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: rojqgx5a4qvzw6a2ghba47pqhgurojcqq1d6dohirqvvkmobwapnc9xf.ygncsqvu.ru
Source: global traffic	DNS traffic detected: DNS query: excel.office.com
Source: global traffic	DNS traffic detected: DNS query: www.microsoft365.com
Source: global traffic	DNS traffic detected: DNS query: login.microsoftonline.com
Source: global traffic	DNS traffic detected: DNS query: aadcdn.msftauth.net
Source: global traffic	DNS traffic detected: DNS query: identity.nel.measure.office.net
Source: global traffic	DNS traffic detected: DNS query: logincdn.msftauth.net
Source: global traffic	DNS traffic detected: DNS query: acctcdn.msftauth.net
Source: global traffic	DNS traffic detected: DNS query: fpt.live.com

Source: unknown

HTTP traffic detected: POST /RST2.srf HTTP/1.0Connection: Keep-AliveContent-Type: application/soap+xmlAccept: */*User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68})Content-Length: 3592Host: login.live.com

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 06 Dec 2024 18:11:26 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeCache-Control: max-age=14400Age: 2265Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=kduPFyqRXtAkj4BagseAn35vVpdHkoMJ3qAMm0K0U291Tlkzbmy%2BXc%2BsgoyUdJ5iuytHxa9cUgoieZLUxrTay753C0%2FTRmyXORn%2BdhClP7dimPVaTxur8%2FC8S0b1ZA%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Vary: Accept-Encodingalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=5061&min_rtt=4937&rtt_var=1482&sent=4&recv=8&lost=0&retrans=0&sent_bytes=2826&recv_bytes=2248&delivery_rate=571199&cwnd=250&unsent_bytes=0&cid=1077037c41ea54b5&ts=39&x=0"CF-Cache-Status: HITServer: cloudflareCF-RAY: 8ede3d0b6d220f83-EWRserver-timing: cfL4;desc="?proto=TCP&rtt=1760&min_rtt=1724&rtt_var=720&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2826&recv_bytes=1894&delivery_rate=1446977&cwnd=230&unsent_bytes=0&cid=a863e77d07ad3d6b&ts=9257&x=0"
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 06 Dec 2024 18:11:30 GMTContent-Type: application/jsonContent-Length: 7Connection: closecache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0cf-chl-out: IODSVFPnxWUaiVE2LVW2VNfQQFvMyokLVwI=$bJYO+msuEAwOYqFRServer: cloudflareCF-RAY: 8ede3d23a96941ff-EWRalt-svc: h3=":443"; ma=86400
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 06 Dec 2024 18:11:36 GMTContent-Type: application/jsonContent-Length: 7Connection: closecf-chl-out: lkAi+WNxezjtUeEtoJkRhLeRlwKiUUxOL70=$3EOktn5QPMVmCDF4cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0Server: cloudflareCF-RAY: 8ede3d4b5a98f5fa-EWRalt-svc: h3=":443"; ma=86400
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 06 Dec 2024 18:11:44 GMTContent-Type: application/jsonContent-Length: 7Connection: closecf-chl-out: EczZbyEs63HwJlwOWx/r8irRQbcivgyUaWY=$gPVbDIDODRmMZMQAcache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0Server: cloudflareCF-RAY: 8ede3d7c7c373308-EWRalt-svc: h3=":443"; ma=86400

Source: chromecache_301.17.dr, chromecache_294.17.dr	String found in binary or memory: http://brm.io/matter-js/
Source: 77EC63BDA74BD0D0E0426DC8F80085060.1.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: chromecache_275.17.dr, chromecache_285.17.dr, chromecache_301.17.dr, chromecache_294.17.dr	String found in binary or memory: http://feross.org
Source: chromecache_282.17.dr, chromecache_251.17.dr	String found in binary or memory: http://id.wikisource.org/wiki/Pedoman_Umum_Ejaan_Bahasa_Indonesia_yang_Disempurnakan
Source: chromecache_262.17.dr, chromecache_224.17.dr	String found in binary or memory: http://jedwatson.github.io/classnames
Source: chromecache_295.17.dr, chromecache_287.17.dr	String found in binary or memory: http://knockoutjs.com/
Source: chromecache_307.17.dr	String found in binary or memory: http://opengraphprotocol.org/schema/
Source: chromecache_282.17.dr, chromecache_251.17.dr	String found in binary or memory: http://praleska.pro/
Source: chromecache_307.17.dr	String found in binary or memory: http://static1.squarespace.com/static/66a3d462e2868939fd2eca54/t/66a3d463e2868939fd2eca8d/1683039996
Source: chromecache_301.17.dr, chromecache_294.17.dr	String found in binary or memory: http://underscorejs.org/LICENSE
Source: chromecache_295.17.dr, chromecache_287.17.dr	String found in binary or memory: http://www.opensource.org/licenses/mit-license.php)
Source: 2D85F72862B55C4EADD9E66E06947F3D0.1.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: chromecache_283.17.dr, chromecache_276.17.dr	String found in binary or memory: http://yuilibrary.com/license/
Source: chromecache_298.17.dr	String found in binary or memory: https://easings.net/en#easeOutExpo)
Source: chromecache_296.17.dr, chromecache_248.17.dr	String found in binary or memory: https://feross.org
Source: chromecache_307.17.dr	String found in binary or memory: https://fonts.googleapis.com/css2?family=Poppins:ital
Source: chromecache_241.17.dr	String found in binary or memory: https://fonts.gstatic.com/s/poppins/v22/pxiByp8kv8JHgFVrLCz7Z1JlFc-K.woff2)
Source: chromecache_241.17.dr	String found in binary or memory: https://fonts.gstatic.com/s/poppins/v22/pxiByp8kv8JHgFVrLCz7Z1xlFQ.woff2)
Source: chromecache_241.17.dr	String found in binary or memory: https://fonts.gstatic.com/s/poppins/v22/pxiByp8kv8JHgFVrLDz8Z1JlFc-K.woff2)
Source: chromecache_241.17.dr	String found in binary or memory: https://fonts.gstatic.com/s/poppins/v22/pxiByp8kv8JHgFVrLDz8Z1xlFQ.woff2)
Source: chromecache_241.17.dr	String found in binary or memory: https://fonts.gstatic.com/s/poppins/v22/pxiByp8kv8JHgFVrLGT9Z1JlFc-K.woff2)
Source: chromecache_241.17.dr	String found in binary or memory: https://fonts.gstatic.com/s/poppins/v22/pxiByp8kv8JHgFVrLGT9Z1xlFQ.woff2)
Source: chromecache_241.17.dr	String found in binary or memory: https://fonts.gstatic.com/s/poppins/v22/pxiDyp8kv8JHgFVrJJLm21lVF9eO.woff2)
Source: chromecache_241.17.dr	String found in binary or memory: https://fonts.gstatic.com/s/poppins/v22/pxiDyp8kv8JHgFVrJJLm21lVGdeOcEg.woff2)
Source: chromecache_241.17.dr	String found in binary or memory: https://fonts.gstatic.com/s/poppins/v22/pxiDyp8kv8JHgFVrJJLmg1hVF9eO.woff2)
Source: chromecache_241.17.dr	String found in binary or memory: https://fonts.gstatic.com/s/poppins/v22/pxiDyp8kv8JHgFVrJJLmg1hVGdeOcEg.woff2)
Source: chromecache_241.17.dr	String found in binary or memory: https://fonts.gstatic.com/s/poppins/v22/pxiDyp8kv8JHgFVrJJLmy15VF9eO.woff2)
Source: chromecache_241.17.dr	String found in binary or memory: https://fonts.gstatic.com/s/poppins/v22/pxiDyp8kv8JHgFVrJJLmy15VGdeOcEg.woff2)
Source: chromecache_241.17.dr	String found in binary or memory: https://fonts.gstatic.com/s/poppins/v22/pxiEyp8kv8JHgFVrJJfecg.woff2)
Source: chromecache_241.17.dr	String found in binary or memory: https://fonts.gstatic.com/s/poppins/v22/pxiEyp8kv8JHgFVrJJnecmNE.woff2)
Source: chromecache_282.17.dr, chromecache_251.17.dr	String found in binary or memory: https://github.com/Amine27
Source: chromecache_282.17.dr, chromecache_251.17.dr	String found in binary or memory: https://github.com/B0k0
Source: chromecache_282.17.dr, chromecache_251.17.dr	String found in binary or memory: https://github.com/BYK
Source: chromecache_282.17.dr, chromecache_251.17.dr	String found in binary or memory: https://github.com/DevelopmentIL
Source: chromecache_282.17.dr, chromecache_251.17.dr	String found in binary or memory: https://github.com/ElFadiliY
Source: chromecache_282.17.dr, chromecache_251.17.dr	String found in binary or memory: https://github.com/IrakliJani
Source: chromecache_282.17.dr, chromecache_251.17.dr	String found in binary or memory: https://github.com/JanisE
Source: chromecache_282.17.dr, chromecache_251.17.dr	String found in binary or memory: https://github.com/Kaushik1987
Source: chromecache_282.17.dr, chromecache_251.17.dr	String found in binary or memory: https://github.com/MadMG
Source: chromecache_282.17.dr, chromecache_251.17.dr	String found in binary or memory: https://github.com/Manfre98
Source: chromecache_251.17.dr	String found in binary or memory: https://github.com/Oire
Source: chromecache_282.17.dr, chromecache_251.17.dr	String found in binary or memory: https://github.com/Quenty31
Source: chromecache_282.17.dr, chromecache_251.17.dr	String found in binary or memory: https://github.com/ShahramMebashar
Source: chromecache_282.17.dr, chromecache_251.17.dr	String found in binary or memory: https://github.com/TalAter
Source: chromecache_282.17.dr, chromecache_251.17.dr	String found in binary or memory: https://github.com/Viktorminator
Source: chromecache_282.17.dr, chromecache_251.17.dr	String found in binary or memory: https://github.com/WikiDiscoverer
Source: chromecache_282.17.dr, chromecache_251.17.dr	String found in binary or memory: https://github.com/ZackVision
Source: chromecache_251.17.dr	String found in binary or memory: https://github.com/abdelsaid
Source: chromecache_282.17.dr, chromecache_251.17.dr	String found in binary or memory: https://github.com/adambrunner
Source: chromecache_282.17.dr, chromecache_251.17.dr	String found in binary or memory: https://github.com/alesma
Source: chromecache_282.17.dr, chromecache_251.17.dr	String found in binary or memory: https://github.com/aliem
Source: chromecache_282.17.dr, chromecache_251.17.dr	String found in binary or memory: https://github.com/amaranthrose
Source: chromecache_282.17.dr, chromecache_251.17.dr	String found in binary or memory: https://github.com/andela-batolagbe
Source: chromecache_282.17.dr, chromecache_251.17.dr	String found in binary or memory: https://github.com/andrewhood125
Source: chromecache_282.17.dr, chromecache_251.17.dr	String found in binary or memory: https://github.com/anthonylau
Source: chromecache_282.17.dr, chromecache_251.17.dr	String found in binary or memory: https://github.com/armendarabyan
Source: chromecache_294.17.dr	String found in binary or memory: https://github.com/ashima/webgl-noise
Source: chromecache_282.17.dr, chromecache_251.17.dr	String found in binary or memory: https://github.com/ashwoolford
Source: chromecache_282.17.dr, chromecache_251.17.dr	String found in binary or memory: https://github.com/askpt
Source: chromecache_282.17.dr, chromecache_251.17.dr	String found in binary or memory: https://github.com/atamyratabdy
Source: chromecache_282.17.dr, chromecache_251.17.dr	String found in binary or memory: https://github.com/avaly
Source: chromecache_282.17.dr, chromecache_251.17.dr	String found in binary or memory: https://github.com/bangnk
Source: chromecache_282.17.dr, chromecache_251.17.dr	String found in binary or memory: https://github.com/baryon
Source: chromecache_282.17.dr, chromecache_251.17.dr	String found in binary or memory: https://github.com/ben-lin
Source: chromecache_282.17.dr, chromecache_251.17.dr	String found in binary or memory: https://github.com/bkyceh
Source: chromecache_282.17.dr, chromecache_251.17.dr	String found in binary or memory: https://github.com/bleadof
Source: chromecache_282.17.dr, chromecache_251.17.dr	String found in binary or memory: https://github.com/bmarkovic
Source: chromecache_282.17.dr, chromecache_251.17.dr	String found in binary or memory: https://github.com/boyaq
Source: chromecache_282.17.dr, chromecache_251.17.dr	String found in binary or memory: https://github.com/bustta
Source: chromecache_282.17.dr, chromecache_251.17.dr	String found in binary or memory: https://github.com/caio-ribeiro-pereira
Source: chromecache_282.17.dr, chromecache_251.17.dr	String found in binary or memory: https://github.com/cepem
Source: chromecache_282.17.dr, chromecache_251.17.dr	String found in binary or memory: https://github.com/chienkira
Source: chromecache_282.17.dr, chromecache_251.17.dr	String found in binary or memory: https://github.com/chriscartlidge
Source: chromecache_282.17.dr, chromecache_251.17.dr	String found in binary or memory: https://github.com/chrisgedrim
Source: chromecache_282.17.dr, chromecache_251.17.dr	String found in binary or memory: https://github.com/chrisrodz
Source: chromecache_282.17.dr, chromecache_251.17.dr	String found in binary or memory: https://github.com/chyngyz
Source: chromecache_282.17.dr, chromecache_251.17.dr	String found in binary or memory: https://github.com/colindean
Source: chromecache_282.17.dr, chromecache_251.17.dr	String found in binary or memory: https://github.com/crnjakovic
Source: chromecache_282.17.dr, chromecache_251.17.dr	String found in binary or memory: https://github.com/demidov91
Source: chromecache_249.17.dr, chromecache_295.17.dr, chromecache_309.17.dr, chromecache_275.17.dr, chromecache_289.17.dr, chromecache_285.17.dr, chromecache_287.17.dr, chromecache_255.17.dr	String found in binary or memory: https://github.com/douglascrockford/JSON-js
Source: chromecache_282.17.dr, chromecache_251.17.dr	String found in binary or memory: https://github.com/ebraminio
Source: chromecache_282.17.dr, chromecache_251.17.dr	String found in binary or memory: https://github.com/eillarra
Source: chromecache_282.17.dr, chromecache_251.17.dr	String found in binary or memory: https://github.com/erhangundogan
Source: chromecache_282.17.dr, chromecache_251.17.dr	String found in binary or memory: https://github.com/estellecomment
Source: chromecache_282.17.dr, chromecache_251.17.dr	String found in binary or memory: https://github.com/evoL
Source: chromecache_282.17.dr, chromecache_251.17.dr	String found in binary or memory: https://github.com/fadsel
Source: chromecache_282.17.dr, chromecache_251.17.dr	String found in binary or memory: https://github.com/flakerimi
Source: chromecache_282.17.dr, chromecache_251.17.dr	String found in binary or memory: https://github.com/floydpink
Source: chromecache_282.17.dr, chromecache_251.17.dr	String found in binary or memory: https://github.com/forabi
Source: chromecache_282.17.dr, chromecache_251.17.dr	String found in binary or memory: https://github.com/frontyard
Source: chromecache_282.17.dr, chromecache_251.17.dr	String found in binary or memory: https://github.com/gaspard
Source: chromecache_282.17.dr, chromecache_251.17.dr	String found in binary or memory: https://github.com/gholadr
Source: chromecache_282.17.dr, chromecache_251.17.dr	String found in binary or memory: https://github.com/gurdiga
Source: chromecache_282.17.dr, chromecache_251.17.dr	String found in binary or memory: https://github.com/hagmandan
Source: chromecache_282.17.dr, chromecache_251.17.dr	String found in binary or memory: https://github.com/harpreetkhalsagtbit
Source: chromecache_282.17.dr, chromecache_251.17.dr	String found in binary or memory: https://github.com/hehachris
Source: chromecache_282.17.dr, chromecache_251.17.dr	String found in binary or memory: https://github.com/hinrik
Source: chromecache_282.17.dr, chromecache_251.17.dr	String found in binary or memory: https://github.com/ibnesayeed
Source: chromecache_282.17.dr, chromecache_251.17.dr	String found in binary or memory: https://github.com/jalex79
Source: chromecache_282.17.dr, chromecache_251.17.dr	String found in binary or memory: https://github.com/jarcoal
Source: chromecache_282.17.dr, chromecache_251.17.dr	String found in binary or memory: https://github.com/jatinag22
Source: chromecache_282.17.dr, chromecache_251.17.dr	String found in binary or memory: https://github.com/javkhaanj7
Source: chromecache_282.17.dr, chromecache_251.17.dr	String found in binary or memory: https://github.com/jawish
Source: chromecache_282.17.dr, chromecache_251.17.dr	String found in binary or memory: https://github.com/jbleduigou
Source: chromecache_282.17.dr, chromecache_251.17.dr	String found in binary or memory: https://github.com/jcfranco
Source: chromecache_282.17.dr, chromecache_251.17.dr	String found in binary or memory: https://github.com/jfroffice
Source: chromecache_282.17.dr, chromecache_251.17.dr	String found in binary or memory: https://github.com/johnideal
Source: chromecache_282.17.dr, chromecache_251.17.dr	String found in binary or memory: https://github.com/jonashdown
Source: chromecache_282.17.dr, chromecache_251.17.dr	String found in binary or memory: https://github.com/jonbca
Source: chromecache_282.17.dr, chromecache_251.17.dr	String found in binary or memory: https://github.com/jorisroling
Source: chromecache_282.17.dr, chromecache_251.17.dr	String found in binary or memory: https://github.com/joshbrooks
Source: chromecache_282.17.dr, chromecache_251.17.dr	String found in binary or memory: https://github.com/juanghurtado
Source: chromecache_282.17.dr, chromecache_251.17.dr	String found in binary or memory: https://github.com/julionc
Source: chromecache_282.17.dr, chromecache_251.17.dr	String found in binary or memory: https://github.com/k2s
Source: chromecache_282.17.dr, chromecache_251.17.dr	String found in binary or memory: https://github.com/kalehv
Source: chromecache_282.17.dr, chromecache_251.17.dr	String found in binary or memory: https://github.com/karamell
Source: chromecache_282.17.dr, chromecache_251.17.dr	String found in binary or memory: https://github.com/kaushikgandhi
Source: chromecache_282.17.dr, chromecache_251.17.dr	String found in binary or memory: https://github.com/kcthota
Source: chromecache_282.17.dr, chromecache_251.17.dr	String found in binary or memory: https://github.com/kikoanis
Source: chromecache_282.17.dr, chromecache_251.17.dr	String found in binary or memory: https://github.com/kraz
Source: chromecache_282.17.dr, chromecache_251.17.dr	String found in binary or memory: https://github.com/kruyvanna
Source: chromecache_282.17.dr, chromecache_251.17.dr	String found in binary or memory: https://github.com/kwisatz
Source: chromecache_282.17.dr, chromecache_251.17.dr	String found in binary or memory: https://github.com/kyungw00k
Source: chromecache_282.17.dr, chromecache_251.17.dr	String found in binary or memory: https://github.com/lantip
Source: chromecache_282.17.dr, chromecache_251.17.dr	String found in binary or memory: https://github.com/le0tan
Source: chromecache_301.17.dr, chromecache_294.17.dr	String found in binary or memory: https://github.com/liabru/matter-wrap
Source: chromecache_282.17.dr, chromecache_251.17.dr	String found in binary or memory: https://github.com/lluchs
Source: chromecache_282.17.dr, chromecache_251.17.dr	String found in binary or memory: https://github.com/lukemcgregor
Source: chromecache_282.17.dr, chromecache_251.17.dr	String found in binary or memory: https://github.com/madhenry
Source: chromecache_282.17.dr, chromecache_251.17.dr	String found in binary or memory: https://github.com/majdal
Source: chromecache_282.17.dr, chromecache_251.17.dr	String found in binary or memory: https://github.com/marobo
Source: chromecache_282.17.dr, chromecache_251.17.dr	String found in binary or memory: https://github.com/matthewdeeco
Source: chromecache_282.17.dr, chromecache_251.17.dr	String found in binary or memory: https://github.com/mayanksinghal
Source: chromecache_282.17.dr, chromecache_251.17.dr	String found in binary or memory: https://github.com/mechuwind
Source: chromecache_282.17.dr, chromecache_251.17.dr	String found in binary or memory: https://github.com/mehiel
Source: chromecache_282.17.dr, chromecache_251.17.dr	String found in binary or memory: https://github.com/mergehez
Source: chromecache_282.17.dr, chromecache_251.17.dr	String found in binary or memory: https://github.com/middagj
Source: chromecache_282.17.dr, chromecache_251.17.dr	String found in binary or memory: https://github.com/miestasmia
Source: chromecache_282.17.dr, chromecache_251.17.dr	String found in binary or memory: https://github.com/mik01aj
Source: chromecache_282.17.dr, chromecache_251.17.dr	String found in binary or memory: https://github.com/milan-j
Source: chromecache_282.17.dr, chromecache_251.17.dr	String found in binary or memory: https://github.com/miodragnikac
Source: chromecache_282.17.dr, chromecache_251.17.dr	String found in binary or memory: https://github.com/mirontoli
Source: chromecache_282.17.dr, chromecache_251.17.dr	String found in binary or memory: https://github.com/mmozuras
Source: chromecache_282.17.dr, chromecache_251.17.dr	String found in binary or memory: https://github.com/mrbase
Source: chromecache_282.17.dr, chromecache_251.17.dr	String found in binary or memory: https://github.com/muminoff
Source: chromecache_282.17.dr, chromecache_251.17.dr	String found in binary or memory: https://github.com/mweimerskirch
Source: chromecache_282.17.dr, chromecache_251.17.dr	String found in binary or memory: https://github.com/naderio
Source: chromecache_282.17.dr, chromecache_251.17.dr	String found in binary or memory: https://github.com/narainsagar
Source: chromecache_282.17.dr, chromecache_251.17.dr	String found in binary or memory: https://github.com/nicolaidavies
Source: chromecache_282.17.dr, chromecache_251.17.dr	String found in binary or memory: https://github.com/nostalgiaz
Source: chromecache_282.17.dr, chromecache_251.17.dr	String found in binary or memory: https://github.com/noureddinem
Source: chromecache_282.17.dr, chromecache_251.17.dr	String found in binary or memory: https://github.com/nurlan
Source: chromecache_282.17.dr, chromecache_251.17.dr	String found in binary or memory: https://github.com/nusretparlak
Source: chromecache_282.17.dr, chromecache_251.17.dr	String found in binary or memory: https://github.com/oerd
Source: chromecache_282.17.dr, chromecache_251.17.dr	String found in binary or memory: https://github.com/orif-jr
Source: chromecache_282.17.dr, chromecache_251.17.dr	String found in binary or memory: https://github.com/passatgt
Source: chromecache_251.17.dr	String found in binary or memory: https://github.com/petrbela
Source: chromecache_282.17.dr, chromecache_251.17.dr	String found in binary or memory: https://github.com/ragnar123
Source: chromecache_282.17.dr, chromecache_251.17.dr	String found in binary or memory: https://github.com/ragulka
Source: chromecache_282.17.dr, chromecache_251.17.dr	String found in binary or memory: https://github.com/rajeevnaikte
Source: chromecache_282.17.dr, chromecache_251.17.dr	String found in binary or memory: https://github.com/rasidre
Source: chromecache_282.17.dr, chromecache_251.17.dr	String found in binary or memory: https://github.com/rexxars
Source: chromecache_282.17.dr, chromecache_251.17.dr	String found in binary or memory: https://github.com/robgallen
Source: chromecache_282.17.dr, chromecache_251.17.dr	String found in binary or memory: https://github.com/robin0van0der0v
Source: chromecache_282.17.dr, chromecache_251.17.dr	String found in binary or memory: https://github.com/ryangreaves
Source: chromecache_282.17.dr, chromecache_251.17.dr	String found in binary or memory: https://github.com/ryanhart2
Source: chromecache_282.17.dr, chromecache_251.17.dr	String found in binary or memory: https://github.com/sakarisson
Source: chromecache_282.17.dr, chromecache_251.17.dr	String found in binary or memory: https://github.com/sampathsris
Source: chromecache_282.17.dr, chromecache_251.17.dr	String found in binary or memory: https://github.com/sedovsek
Source: chromecache_282.17.dr, chromecache_251.17.dr	String found in binary or memory: https://github.com/sigurdga
Source: chromecache_282.17.dr, chromecache_251.17.dr	String found in binary or memory: https://github.com/sirn
Source: chromecache_282.17.dr, chromecache_251.17.dr	String found in binary or memory: https://github.com/skakri
Source: chromecache_282.17.dr, chromecache_251.17.dr	String found in binary or memory: https://github.com/skfd
Source: chromecache_282.17.dr, chromecache_251.17.dr	String found in binary or memory: https://github.com/socketpair
Source: chromecache_282.17.dr, chromecache_251.17.dr	String found in binary or memory: https://github.com/soniasimoes
Source: chromecache_282.17.dr, chromecache_251.17.dr	String found in binary or memory: https://github.com/sschueller
Source: chromecache_282.17.dr, chromecache_251.17.dr	String found in binary or memory: https://github.com/stephenramthun
Source: chromecache_282.17.dr, chromecache_251.17.dr	String found in binary or memory: https://github.com/suupic
Source: chromecache_282.17.dr, chromecache_251.17.dr	String found in binary or memory: https://github.com/suvash
Source: chromecache_282.17.dr, chromecache_251.17.dr	String found in binary or memory: https://github.com/techdimension
Source: chromecache_282.17.dr, chromecache_251.17.dr	String found in binary or memory: https://github.com/thanyawzinmin
Source: chromecache_282.17.dr, chromecache_251.17.dr	String found in binary or memory: https://github.com/tk120404
Source: chromecache_282.17.dr, chromecache_251.17.dr	String found in binary or memory: https://github.com/tomer
Source: chromecache_282.17.dr, chromecache_251.17.dr	String found in binary or memory: https://github.com/topchiyev
Source: chromecache_282.17.dr, chromecache_251.17.dr	String found in binary or memory: https://github.com/tyok
Source: chromecache_282.17.dr, chromecache_251.17.dr	String found in binary or memory: https://github.com/ulmus
Source: chromecache_282.17.dr, chromecache_251.17.dr	String found in binary or memory: https://github.com/uu109
Source: chromecache_282.17.dr, chromecache_251.17.dr	String found in binary or memory: https://github.com/vajradog
Source: chromecache_282.17.dr, chromecache_251.17.dr	String found in binary or memory: https://github.com/vnathalye
Source: chromecache_282.17.dr, chromecache_251.17.dr	String found in binary or memory: https://github.com/weldan
Source: chromecache_282.17.dr, chromecache_251.17.dr	String found in binary or memory: https://github.com/wernerm
Source: chromecache_282.17.dr, chromecache_251.17.dr	String found in binary or memory: https://github.com/xfh
Source: chromecache_282.17.dr, chromecache_251.17.dr	String found in binary or memory: https://github.com/xsoh
Source: chromecache_282.17.dr, chromecache_251.17.dr	String found in binary or memory: https://github.com/zemlanin
Source: chromecache_282.17.dr, chromecache_251.17.dr	String found in binary or memory: https://github.com/zenozeng
Source: chromecache_271.17.dr, chromecache_303.17.dr	String found in binary or memory: https://github.com/zloirock/core-js
Source: chromecache_271.17.dr, chromecache_303.17.dr	String found in binary or memory: https://github.com/zloirock/core-js/blob/v3.26.0/LICENSE
Source: chromecache_307.17.dr	String found in binary or memory: https://images.squarespace-cdn.com
Source: chromecache_307.17.dr	String found in binary or memory: https://images.squarespace-cdn.com/content/v1/66a3d462e2868939fd2eca54/1722012772778-9SDIZRKEI2F0Q3S
Source: chromecache_307.17.dr	String found in binary or memory: https://images.squarespace-cdn.com/content/v1/66a3d462e2868939fd2eca54/1722014277927-MAPQVN7CBP5Y2UP
Source: chromecache_301.17.dr, chromecache_294.17.dr	String found in binary or memory: https://lodash.com/
Source: chromecache_301.17.dr, chromecache_294.17.dr	String found in binary or memory: https://lodash.com/license
Source: chromecache_242.17.dr, chromecache_223.17.dr	String found in binary or memory: https://login.microsoftonline.com
Source: chromecache_242.17.dr, chromecache_223.17.dr	String found in binary or memory: https://login.windows-ppe.net
Source: chromecache_301.17.dr, chromecache_294.17.dr	String found in binary or memory: https://openjsf.org/
Source: chromecache_307.17.dr	String found in binary or memory: https://r5k.ljxfrbcb.ru/dqhqST/
Source: chromecache_280.17.dr, chromecache_310.17.dr	String found in binary or memory: https://sourcemaps.squarespace.net/universal/scripts-compressed/sourcemaps/0547d9eb3c14a0b5faede36cc
Source: chromecache_279.17.dr, chromecache_305.17.dr	String found in binary or memory: https://sourcemaps.squarespace.net/universal/scripts-compressed/sourcemaps/07fb3cc130a679048ce2e8730
Source: chromecache_270.17.dr, chromecache_263.17.dr	String found in binary or memory: https://sourcemaps.squarespace.net/universal/scripts-compressed/sourcemaps/128d75462b51e168e774c85ce
Source: chromecache_230.17.dr, chromecache_247.17.dr	String found in binary or memory: https://sourcemaps.squarespace.net/universal/scripts-compressed/sourcemaps/543d05bbd0cc4c88cecf9ec58
Source: chromecache_254.17.dr, chromecache_258.17.dr	String found in binary or memory: https://sourcemaps.squarespace.net/universal/scripts-compressed/sourcemaps/575eb05aad4b56c30067bcda6
Source: chromecache_250.17.dr, chromecache_290.17.dr	String found in binary or memory: https://sourcemaps.squarespace.net/universal/scripts-compressed/sourcemaps/67bdd0168dd99446af548567b
Source: chromecache_282.17.dr, chromecache_251.17.dr	String found in binary or memory: https://sourcemaps.squarespace.net/universal/scripts-compressed/sourcemaps/7b318b5ff90f74fe7b3ad4f9d
Source: chromecache_296.17.dr, chromecache_248.17.dr	String found in binary or memory: https://sourcemaps.squarespace.net/universal/scripts-compressed/sourcemaps/8a4e2924c723d3c381861c44d
Source: chromecache_283.17.dr, chromecache_276.17.dr	String found in binary or memory: https://sourcemaps.squarespace.net/universal/scripts-compressed/sourcemaps/ae41d9b0bb0674c5af2363e92
Source: chromecache_262.17.dr, chromecache_224.17.dr	String found in binary or memory: https://sourcemaps.squarespace.net/universal/scripts-compressed/sourcemaps/f1a89dafc81a3a2016dd57784
Source: chromecache_301.17.dr, chromecache_294.17.dr	String found in binary or memory: https://sourcemaps.squarespace.net/universal/scripts-compressed/sourcemaps/ffba7541cb2564c3971004dd5
Source: chromecache_307.17.dr	String found in binary or memory: https://static1.squarespace.com/static/vta/5c5a519771c10ba3470d8101/scripts/site-bundle.72e5364d6a59
Source: chromecache_307.17.dr	String found in binary or memory: https://static1.squarespace.com/static/vta/5c5a519771c10ba3470d8101/versioned-assets/1728407958569-D
Source: chromecache_307.17.dr	String found in binary or memory: https://www.rfp-documents.com

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 49692 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 49697 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 49680 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49676 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49845 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49857 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 49698 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 49846 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49867
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49866
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49866 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49698
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49697
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49694
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49692
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49690
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49700 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49844 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 49677 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 49694 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49856 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49867 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49700
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown	Network traffic detected: HTTP traffic on port 49865 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49820
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49833 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49811
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49876 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49808
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49804
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49803
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49802
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49800
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49821 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49690 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49843 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49832 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443

Source: unknown	HTTPS traffic detected: 20.190.181.23:443 -> 192.168.2.17:49692 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.5.88:443 -> 192.168.2.17:49694 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.16.158.186:443 -> 192.168.2.17:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.202.163.200:443 -> 192.168.2.17:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.16.229.162:443 -> 192.168.2.17:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.16.229.162:443 -> 192.168.2.17:49717 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.202.163.200:443 -> 192.168.2.17:49792 version: TLS 1.2

Source: classification engine

Classification label: mal52.winPDF@38/197@65/25

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8340:120:WilError_03

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-12-06 13-10-35-793.log

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: unknown	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\BGM LAW GROUP - RFP 2024.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2252 --field-trial-handle=1600,i,13858453656838133628,2081862688306590034,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://www.rfp-documents.com/
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2084 --field-trial-handle=1972,i,10897460691343705023,10519775075737971033,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Windows\System32\InputSwitchToastHandler.exe C:\Windows\System32\InputSwitchToastHandler.exe -Embedding
Source: C:\Windows\System32\InputSwitchToastHandler.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://www.rfp-documents.com/	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2252 --field-trial-handle=1600,i,13858453656838133628,2081862688306590034,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2084 --field-trial-handle=1972,i,10897460691343705023,10519775075737971033,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\InputSwitchToastHandler.exe	Section loaded: kernel.appcore.dll			Jump to behavior
Source: C:\Windows\System32\InputSwitchToastHandler.exe	Section loaded: onecoreuapcommonproxystub.dll			Jump to behavior

Source: C:\Windows\System32\InputSwitchToastHandler.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\InProcServer32

Jump to behavior

Source: Google Drive.lnk.16.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.16.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.16.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.16.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.16.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.16.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: BGM LAW GROUP - RFP 2024.pdf	Initial sample: PDF keyword /JS count = 0
Source: BGM LAW GROUP - RFP 2024.pdf	Initial sample: PDF keyword /JavaScript count = 0