Windows Analysis Report
https://google.com.mx//url?ob=pkmcekw7bljbM2dWBuuV7ic1KFgH&aw=f_rand_string_lowercase(8)n9QXkBk0w4OyBDvUpuk&sa=t&whi=f_rand_string_lowercase(8)zOPGXNRztppHiTbPIt5f&url=amp%2Fbraverygray.com/.dd/KcxwjqsanE-SUREDANN-bXdlYmJAd2luZHNvcmhvbWVzdHguY29t

Overview

General Information

Sample URL:	https://google.com.mx//url?ob=pkmcekw7bljbM2dWBuuV7ic1KFgH&aw=f_rand_string_lowercase(8)n9QXkBk0w4OyBDvUpuk&sa=t&whi=f_rand_string_lowercase(8)zOPGXNRztppHiTbPIt5f&url=amp%2Fbraverygray.com/.dd/Kcxwjq
Analysis ID:	1579104
Infos:

Detection

Fake Captcha, HTMLPhisher

Score:	76
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

AI detected phishing page

Suricata IDS alerts for network traffic

Yara detected Fake Captcha

Yara detected HtmlPhish54

AI detected suspicious Javascript

Detected hidden input values containing email addresses (often used in phishing pages)

Detected suspicious crossdomain redirect

HTML body contains low number of good links

HTML page contains hidden javascript code

HTML title does not match URL

Stores files to the Windows start menu directory

Classification

Signatures

Phishing

AI detected phishing page

Source: https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au/?777=mwebb%40windsorhomestx.com&sso_reload=true	Joe Sandbox AI: Score: 9 Reasons: The brand 'Microsoft' is well-known and typically associated with the domain 'microsoft.com'., The URL '0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au' does not match the legitimate domain for Microsoft., The use of '0nlineactivations' with zeroes instead of 'onlineactivations' is a common phishing tactic involving misspellings., The domain 'acmgs.com.au' is not associated with Microsoft, which raises suspicion., The presence of repeated words and unusual patterns in the URL is indicative of phishing., The input field 'Password' suggests an attempt to capture sensitive information, which is common in phishing sites. DOM: 3.6.pages.csv
Source: https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au/?777=mwebb%40windsorhomestx.com&sso_reload=true	Joe Sandbox AI: Score: 9 Reasons: The brand 'Microsoft' is well-known and typically associated with the domain 'microsoft.com'., The URL '0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au' does not match the legitimate domain for Microsoft., The URL contains repeated words and uses '0' instead of 'o', which is a common phishing tactic to mimic legitimate words., The domain 'acmgs.com.au' is not associated with Microsoft, and the use of multiple hyphens and repeated words is suspicious., The presence of an input field for 'Enter password' suggests an attempt to capture sensitive information, which is a common phishing strategy. DOM: 3.7.pages.csv

Yara detected Fake Captcha

Source: Yara match

File source: 2.1.pages.csv, type: HTML

Yara detected HtmlPhish54

Source: Yara match	File source: 1.24.id.script.csv, type: HTML
Source: Yara match	File source: 1.3.id.script.csv, type: HTML
Source: Yara match	File source: 1.15.i.script.csv, type: HTML
Source: Yara match	File source: 3.7.pages.csv, type: HTML
Source: Yara match	File source: 2.2.pages.csv, type: HTML
Source: Yara match	File source: 4.8.pages.csv, type: HTML
Source: Yara match	File source: 3.3.pages.csv, type: HTML
Source: Yara match	File source: 3.5.pages.csv, type: HTML

AI detected suspicious Javascript

Source: 1.0.id.script.csv

Joe Sandbox AI: Detected suspicious JavaScript with source url: https://0nlineactivations-0nlineactivations-0nline... This script exhibits several high-risk behaviors, including dynamic code execution, data exfiltration, and obfuscated code. While some of the behaviors may be related to legitimate functionality like analytics or error reporting, the overall level of risk is high due to the presence of multiple suspicious activities.

Detected hidden input values containing email addresses (often used in phishing pages)

Source: https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au/?777=mwebb%40windsorhomestx.com&sso_reload=true

HTTP Parser: mwebb@windsorhomestx.com

HTML body contains low number of good links

Source: https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au/?777=mwebb%40windsorhomestx.com&sso_reload=true

HTTP Parser: Number of links: 0

HTML page contains hidden javascript code

Source: https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au/?777=mwebb%40windsorhomestx.com

HTTP Parser: Base64 decoded: a[href="http://www.salidzini.lv/"][style="display: block; width: 120px; height: 40px; overflow: hidden; position: relative;"]

HTML title does not match URL

Source: https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au/?777=mwebb%40windsorhomestx.com&sso_reload=true	HTTP Parser: Title: Sign in to your account does not match URL
Source: https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au/common/login	HTTP Parser: Title: Sign in to your account does not match URL

Source: https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au/?777=mwebb%40windsorhomestx.com&sso_reload=true	HTTP Parser: Iframe src: https://dab02a46-e455dbd6.acmgs.com.au/Prefetch/Prefetch.aspx
Source: https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au/?777=mwebb%40windsorhomestx.com&sso_reload=true	HTTP Parser: Iframe src: https://dab02a46-e455dbd6.acmgs.com.au/Prefetch/Prefetch.aspx
Source: https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au/?777=mwebb%40windsorhomestx.com&sso_reload=true	HTTP Parser: Iframe src: https://dab02a46-e455dbd6.acmgs.com.au/Prefetch/Prefetch.aspx
Source: https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au/common/login	HTTP Parser: Iframe src: https://dab02a46-e455dbd6.acmgs.com.au/Prefetch/Prefetch.aspx

Source: https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au/?777=mwebb%40windsorhomestx.com&sso_reload=true	HTTP Parser: <input type="password" .../> found
Source: https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au/common/login	HTTP Parser: <input type="password" .../> found

Source: https://braverygray.com/.dd/KcxwjqsanE-SUREDANN-bXdlYmJAd2luZHNvcmhvbWVzdHguY29t	HTTP Parser: No favicon
Source: https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au/?777=mwebb%40windsorhomestx.com	HTTP Parser: No favicon
Source: https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au/?777=mwebb%40windsorhomestx.com&sso_reload=true	HTTP Parser: No favicon
Source: https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au/?777=mwebb%40windsorhomestx.com&sso_reload=true	HTTP Parser: No favicon
Source: https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au/?777=mwebb%40windsorhomestx.com&sso_reload=true	HTTP Parser: No favicon
Source: https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au/?777=mwebb%40windsorhomestx.com&sso_reload=true	HTTP Parser: No favicon
Source: https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au/?777=mwebb%40windsorhomestx.com&sso_reload=true	HTTP Parser: No favicon
Source: https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au/common/login	HTTP Parser: No favicon

Source: https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au/?777=mwebb%40windsorhomestx.com&sso_reload=true	HTTP Parser: No <meta name="author".. found
Source: https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au/?777=mwebb%40windsorhomestx.com&sso_reload=true	HTTP Parser: No <meta name="author".. found
Source: https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au/?777=mwebb%40windsorhomestx.com&sso_reload=true	HTTP Parser: No <meta name="author".. found
Source: https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au/common/login	HTTP Parser: No <meta name="author".. found

Source: https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au/?777=mwebb%40windsorhomestx.com&sso_reload=true	HTTP Parser: No <meta name="copyright".. found
Source: https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au/?777=mwebb%40windsorhomestx.com&sso_reload=true	HTTP Parser: No <meta name="copyright".. found
Source: https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au/?777=mwebb%40windsorhomestx.com&sso_reload=true	HTTP Parser: No <meta name="copyright".. found
Source: https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au/common/login	HTTP Parser: No <meta name="copyright".. found

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2857090 - Severity 1 - ETPRO PHISHING JS/PsyduckPockeball Payload Inbound : 159.89.96.140:443 -> 192.168.2.8:49728
Source: Network traffic	Suricata IDS: 2832046 - Severity 1 - ETPRO PHISHING Successful Office 365 Phish 2018-08-01 : 192.168.2.8:49771 -> 159.89.96.140:443
Source: Network traffic	Suricata IDS: 2832180 - Severity 1 - ETPRO PHISHING Successful Microsoft Account Phish 2018-08-15 : 192.168.2.8:49771 -> 159.89.96.140:443
Source: Network traffic	Suricata IDS: 2840426 - Severity 1 - ETPRO PHISHING Successful Microsoft Account Phish 2020-01-14 : 192.168.2.8:49771 -> 159.89.96.140:443
Source: Network traffic	Suricata IDS: 2846045 - Severity 1 - ETPRO PHISHING Successful Microsoft Account Phish 2020-12-15 : 192.168.2.8:49771 -> 159.89.96.140:443

Detected suspicious crossdomain redirect

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

HTTP traffic: Redirect from: www.google.com.mx to http://braverygray.com/.dd/kcxwjqsane-suredann-bxdlymjad2luzhnvcmhvbwvzdhguy29t

Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.226
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.226
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63

Source: global traffic	HTTP traffic detected: GET //url?ob=pkmcekw7bljbM2dWBuuV7ic1KFgH&aw=f_rand_string_lowercase(8)n9QXkBk0w4OyBDvUpuk&sa=t&whi=f_rand_string_lowercase(8)zOPGXNRztppHiTbPIt5f&url=amp%2Fbraverygray.com/.dd/KcxwjqsanE-SUREDANN-bXdlYmJAd2luZHNvcmhvbWVzdHguY29t HTTP/1.1Host: google.com.mxConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CIW2yQEIorbJAQipncoBCOj/ygEIk6HLAQiFoM0BCNy9zQEIucrNAQiK080BCMfUzQEIodbNAQio2M0BCPnA1BUYwcvMARi60s0BGMXYzQEY642lFw==Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /url?ob=pkmcekw7bljbM2dWBuuV7ic1KFgH&aw=f_rand_string_lowercase(8)n9QXkBk0w4OyBDvUpuk&sa=t&whi=f_rand_string_lowercase(8)zOPGXNRztppHiTbPIt5f&url=amp%2Fbraverygray.com/.dd/KcxwjqsanE-SUREDANN-bXdlYmJAd2luZHNvcmhvbWVzdHguY29t HTTP/1.1Host: www.google.com.mxConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CIW2yQEIorbJAQipncoBCOj/ygEIk6HLAQiFoM0BCNy9zQEIucrNAQiK080BCMfUzQEIodbNAQio2M0BCPnA1BUYwcvMARi60s0BGMXYzQEY642lFw==Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /amp/braverygray.com/.dd/KcxwjqsanE-SUREDANN-bXdlYmJAd2luZHNvcmhvbWVzdHguY29t HTTP/1.1Host: www.google.com.mxConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CIW2yQEIorbJAQipncoBCOj/ygEIk6HLAQiFoM0BCNy9zQEIucrNAQiK080BCMfUzQEIodbNAQio2M0BCPnA1BUYwcvMARi60s0BGMXYzQEY642lFw==Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=520=VUvrXt8kQxKIDa0UQ4sEvOreZpnVtggySdjxhXKYcIYvuWNL4YnfPN_FjaecROyQPQPOfFr24aKJLpT4gLdH78I3fU7zxwMo6YgS5UNBIAsPBi0vsoZSyamevqrVgnsuyhQYjc-OlavfUuPtbGaZJKUA9GM0_VolTVYEwa3I9p96wrAF3K5-5OGR6_ZW21mFi-UdZA
Source: global traffic	HTTP traffic detected: GET /.dd/KcxwjqsanE-SUREDANN-bXdlYmJAd2luZHNvcmhvbWVzdHguY29t HTTP/1.1Host: braverygray.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /emoji/48/check-mark-emoji.png HTTP/1.1Host: img.icons8.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://braverygray.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: braverygray.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://braverygray.com/.dd/KcxwjqsanE-SUREDANN-bXdlYmJAd2luZHNvcmhvbWVzdHguY29tAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /emoji/48/check-mark-emoji.png HTTP/1.1Host: img.icons8.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /?777=mwebb%40windsorhomestx.com HTTP/1.1Host: 0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.auConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: documentReferer: https://braverygray.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /?777=mwebb%40windsorhomestx.com HTTP/1.1Host: 0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.auConnection: keep-aliveCache-Control: max-age=0Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Referer: https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au/?777=mwebb%40windsorhomestx.comAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 6wDB08="ZTQ1NWRiZDYtMzA4MC00NWRlLWE3NDMtZjQ5ZTkyY2YzMzg4OjljYzUwYzg1LTNlZTctNDdhMy04M2QyLTM0YjE2NmNmMDE0Zg=="
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/BssoInterrupt_Core_zKox_QMcTIVut7mG_Z9Eew2.js HTTP/1.1Host: 881a0950-e455dbd6.acmgs.com.auConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.ausec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /e455dbd6308045dea743f49e92cf3388/ HTTP/1.1Host: 0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.auConnection: UpgradePragma: no-cacheCache-Control: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Upgrade: websocketOrigin: https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.auSec-WebSocket-Version: 13Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 6wDB08="ZTQ1NWRiZDYtMzA4MC00NWRlLWE3NDMtZjQ5ZTkyY2YzMzg4OjljYzUwYzg1LTNlZTctNDdhMy04M2QyLTM0YjE2NmNmMDE0Zg=="Sec-WebSocket-Key: iA8wtNfTEl5/VqcbUrU3BQ==Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
Source: global traffic	HTTP traffic detected: GET /?777=mwebb%40windsorhomestx.com&sso_reload=true HTTP/1.1Host: 0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.auConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-Dest: documentReferer: https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au/?777=mwebb%40windsorhomestx.comAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 6wDB08="ZTQ1NWRiZDYtMzA4MC00NWRlLWE3NDMtZjQ5ZTkyY2YzMzg4OjljYzUwYzg1LTNlZTctNDdhMy04M2QyLTM0YjE2NmNmMDE0Zg=="; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: 0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.auConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au/?777=mwebb%40windsorhomestx.comAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 6wDB08="ZTQ1NWRiZDYtMzA4MC00NWRlLWE3NDMtZjQ5ZTkyY2YzMzg4OjljYzUwYzg1LTNlZTctNDdhMy04M2QyLTM0YjE2NmNmMDE0Zg=="
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/BssoInterrupt_Core_zKox_QMcTIVut7mG_Z9Eew2.js HTTP/1.1Host: 881a0950-e455dbd6.acmgs.com.auConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 6wDB08="ZTQ1NWRiZDYtMzA4MC00NWRlLWE3NDMtZjQ5ZTkyY2YzMzg4OjljYzUwYzg1LTNlZTctNDdhMy04M2QyLTM0YjE2NmNmMDE0Zg=="
Source: global traffic	HTTP traffic detected: GET /e455dbd6308045dea743f49e92cf3388/ HTTP/1.1Host: 0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.auConnection: UpgradePragma: no-cacheCache-Control: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Upgrade: websocketOrigin: https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.auSec-WebSocket-Version: 13Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 6wDB08="ZTQ1NWRiZDYtMzA4MC00NWRlLWE3NDMtZjQ5ZTkyY2YzMzg4OjljYzUwYzg1LTNlZTctNDdhMy04M2QyLTM0YjE2NmNmMDE0Zg=="; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1Sec-WebSocket-Key: zFTz/7692/wtMEh4gvlD8w==Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
Source: global traffic	HTTP traffic detected: GET /e455dbd6308045dea743f49e92cf3388/ HTTP/1.1Host: 0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.auConnection: UpgradePragma: no-cacheCache-Control: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Upgrade: websocketOrigin: https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.auSec-WebSocket-Version: 13Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 6wDB08="ZTQ1NWRiZDYtMzA4MC00NWRlLWE3NDMtZjQ5ZTkyY2YzMzg4OjljYzUwYzg1LTNlZTctNDdhMy04M2QyLTM0YjE2NmNmMDE0Zg=="; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1Sec-WebSocket-Key: 7oAxvZ+Lve5XQu+IjqDuXQ==Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
Source: global traffic	HTTP traffic detected: GET /ests/2.1/content/cdnbundles/converged.v2.login.min_81imvbluez-v5hbzpkxfcg2.css HTTP/1.1Host: 881a0950-e455dbd6.acmgs.com.auConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.ausec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: styleReferer: https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ests/2.1/content/cdnbundles/ux.converged.login.strings-en.min_i8f-75gfk3tbsm8bmatnqa2.js HTTP/1.1Host: 881a0950-e455dbd6.acmgs.com.auConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.ausec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/ConvergedLogin_PCore_kAx9qZOSH4g90FNHstHMCA2.js HTTP/1.1Host: 881a0950-e455dbd6.acmgs.com.auConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.ausec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /Me.htm?v=3 HTTP/1.1Host: l1ve.acmgs.com.auConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Purpose: prefetchSec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyReferer: https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 6wDB08="ZTQ1NWRiZDYtMzA4MC00NWRlLWE3NDMtZjQ5ZTkyY2YzMzg4OjljYzUwYzg1LTNlZTctNDdhMy04M2QyLTM0YjE2NmNmMDE0Zg=="
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/oneDs_f2e0f4a029670f10d892.js HTTP/1.1Host: 881a0950-e455dbd6.acmgs.com.auConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 6wDB08="ZTQ1NWRiZDYtMzA4MC00NWRlLWE3NDMtZjQ5ZTkyY2YzMzg4OjljYzUwYzg1LTNlZTctNDdhMy04M2QyLTM0YjE2NmNmMDE0Zg=="
Source: global traffic	HTTP traffic detected: GET /ests/2.1/content/cdnbundles/ux.converged.login.strings-en.min_i8f-75gfk3tbsm8bmatnqa2.js HTTP/1.1Host: 881a0950-e455dbd6.acmgs.com.auConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 6wDB08="ZTQ1NWRiZDYtMzA4MC00NWRlLWE3NDMtZjQ5ZTkyY2YzMzg4OjljYzUwYzg1LTNlZTctNDdhMy04M2QyLTM0YjE2NmNmMDE0Zg=="
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/ConvergedLogin_PCore_kAx9qZOSH4g90FNHstHMCA2.js HTTP/1.1Host: 881a0950-e455dbd6.acmgs.com.auConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 6wDB08="ZTQ1NWRiZDYtMzA4MC00NWRlLWE3NDMtZjQ5ZTkyY2YzMzg4OjljYzUwYzg1LTNlZTctNDdhMy04M2QyLTM0YjE2NmNmMDE0Zg=="
Source: global traffic	HTTP traffic detected: GET /e455dbd6308045dea743f49e92cf3388/ HTTP/1.1Host: 0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.auConnection: UpgradePragma: no-cacheCache-Control: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Upgrade: websocketOrigin: https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.auSec-WebSocket-Version: 13Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 6wDB08="ZTQ1NWRiZDYtMzA4MC00NWRlLWE3NDMtZjQ5ZTkyY2YzMzg4OjljYzUwYzg1LTNlZTctNDdhMy04M2QyLTM0YjE2NmNmMDE0Zg=="; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1Sec-WebSocket-Key: 8/8Isgiu/aF6AjO+qpxJiQ==Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/oneDs_f2e0f4a029670f10d892.js HTTP/1.1Host: 881a0950-e455dbd6.acmgs.com.auConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 6wDB08="ZTQ1NWRiZDYtMzA4MC00NWRlLWE3NDMtZjQ5ZTkyY2YzMzg4OjljYzUwYzg1LTNlZTctNDdhMy04M2QyLTM0YjE2NmNmMDE0Zg=="
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/asyncchunk/convergedlogin_pcustomizationloader_27cef08ca792f8e8b149.js HTTP/1.1Host: 881a0950-e455dbd6.acmgs.com.auConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 6wDB08="ZTQ1NWRiZDYtMzA4MC00NWRlLWE3NDMtZjQ5ZTkyY2YzMzg4OjljYzUwYzg1LTNlZTctNDdhMy04M2QyLTM0YjE2NmNmMDE0Zg=="
Source: global traffic	HTTP traffic detected: GET /Prefetch/Prefetch.aspx HTTP/1.1Host: dab02a46-e455dbd6.acmgs.com.auConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 6wDB08="ZTQ1NWRiZDYtMzA4MC00NWRlLWE3NDMtZjQ5ZTkyY2YzMzg4OjljYzUwYzg1LTNlZTctNDdhMy04M2QyLTM0YjE2NmNmMDE0Zg=="
Source: global traffic	HTTP traffic detected: GET /e455dbd6308045dea743f49e92cf3388/ HTTP/1.1Host: 0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.auConnection: UpgradePragma: no-cacheCache-Control: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Upgrade: websocketOrigin: https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.auSec-WebSocket-Version: 13Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 6wDB08="ZTQ1NWRiZDYtMzA4MC00NWRlLWE3NDMtZjQ5ZTkyY2YzMzg4OjljYzUwYzg1LTNlZTctNDdhMy04M2QyLTM0YjE2NmNmMDE0Zg=="; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; MicrosoftApplicationsTelemetryDeviceId=babf8dd5-6ef2-4698-b5ef-479010a34193; brcap=0Sec-WebSocket-Key: ZsrViyIgMcrLTVJBqthrSg==Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/asyncchunk/convergedlogin_ppassword_b6632c4da67c72da7b92.js HTTP/1.1Host: 881a0950-e455dbd6.acmgs.com.auConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 6wDB08="ZTQ1NWRiZDYtMzA4MC00NWRlLWE3NDMtZjQ5ZTkyY2YzMzg4OjljYzUwYzg1LTNlZTctNDdhMy04M2QyLTM0YjE2NmNmMDE0Zg=="
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/asyncchunk/convergedlogin_pcustomizationloader_27cef08ca792f8e8b149.js HTTP/1.1Host: 881a0950-e455dbd6.acmgs.com.auConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 6wDB08="ZTQ1NWRiZDYtMzA4MC00NWRlLWE3NDMtZjQ5ZTkyY2YzMzg4OjljYzUwYzg1LTNlZTctNDdhMy04M2QyLTM0YjE2NmNmMDE0Zg=="
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/marching_ants_white_8257b0707cbe1d0bd2661b80068676fe.gif HTTP/1.1Host: 881a0950-e455dbd6.acmgs.com.auConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 6wDB08="ZTQ1NWRiZDYtMzA4MC00NWRlLWE3NDMtZjQ5ZTkyY2YzMzg4OjljYzUwYzg1LTNlZTctNDdhMy04M2QyLTM0YjE2NmNmMDE0Zg=="
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/marching_ants_986f40b5a9dc7d39ef8396797f61b323.gif HTTP/1.1Host: 881a0950-e455dbd6.acmgs.com.auConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 6wDB08="ZTQ1NWRiZDYtMzA4MC00NWRlLWE3NDMtZjQ5ZTkyY2YzMzg4OjljYzUwYzg1LTNlZTctNDdhMy04M2QyLTM0YjE2NmNmMDE0Zg=="
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/asyncchunk/convergedlogin_ppassword_b6632c4da67c72da7b92.js HTTP/1.1Host: 881a0950-e455dbd6.acmgs.com.auConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 6wDB08="ZTQ1NWRiZDYtMzA4MC00NWRlLWE3NDMtZjQ5ZTkyY2YzMzg4OjljYzUwYzg1LTNlZTctNDdhMy04M2QyLTM0YjE2NmNmMDE0Zg=="
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/marching_ants_white_8257b0707cbe1d0bd2661b80068676fe.gif HTTP/1.1Host: 881a0950-e455dbd6.acmgs.com.auConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 6wDB08="ZTQ1NWRiZDYtMzA4MC00NWRlLWE3NDMtZjQ5ZTkyY2YzMzg4OjljYzUwYzg1LTNlZTctNDdhMy04M2QyLTM0YjE2NmNmMDE0Zg=="
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico HTTP/1.1Host: 881a0950-e455dbd6.acmgs.com.auConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 6wDB08="ZTQ1NWRiZDYtMzA4MC00NWRlLWE3NDMtZjQ5ZTkyY2YzMzg4OjljYzUwYzg1LTNlZTctNDdhMy04M2QyLTM0YjE2NmNmMDE0Zg=="
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/backgrounds/2_11d9e3bcdfede9ce5ce5ace2d129f1c4.svg HTTP/1.1Host: 881a0950-e455dbd6.acmgs.com.auConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 6wDB08="ZTQ1NWRiZDYtMzA4MC00NWRlLWE3NDMtZjQ5ZTkyY2YzMzg4OjljYzUwYzg1LTNlZTctNDdhMy04M2QyLTM0YjE2NmNmMDE0Zg=="
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/microsoft_logo_564db913a7fa0ca42727161c6d031bef.svg HTTP/1.1Host: 881a0950-e455dbd6.acmgs.com.auConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 6wDB08="ZTQ1NWRiZDYtMzA4MC00NWRlLWE3NDMtZjQ5ZTkyY2YzMzg4OjljYzUwYzg1LTNlZTctNDdhMy04M2QyLTM0YjE2NmNmMDE0Zg=="
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/marching_ants_986f40b5a9dc7d39ef8396797f61b323.gif HTTP/1.1Host: 881a0950-e455dbd6.acmgs.com.auConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 6wDB08="ZTQ1NWRiZDYtMzA4MC00NWRlLWE3NDMtZjQ5ZTkyY2YzMzg4OjljYzUwYzg1LTNlZTctNDdhMy04M2QyLTM0YjE2NmNmMDE0Zg=="
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/backgrounds/2_11d9e3bcdfede9ce5ce5ace2d129f1c4.svg HTTP/1.1Host: 881a0950-e455dbd6.acmgs.com.auConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 6wDB08="ZTQ1NWRiZDYtMzA4MC00NWRlLWE3NDMtZjQ5ZTkyY2YzMzg4OjljYzUwYzg1LTNlZTctNDdhMy04M2QyLTM0YjE2NmNmMDE0Zg=="
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico HTTP/1.1Host: 881a0950-e455dbd6.acmgs.com.auConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 6wDB08="ZTQ1NWRiZDYtMzA4MC00NWRlLWE3NDMtZjQ5ZTkyY2YzMzg4OjljYzUwYzg1LTNlZTctNDdhMy04M2QyLTM0YjE2NmNmMDE0Zg=="
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/microsoft_logo_564db913a7fa0ca42727161c6d031bef.svg HTTP/1.1Host: 881a0950-e455dbd6.acmgs.com.auConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 6wDB08="ZTQ1NWRiZDYtMzA4MC00NWRlLWE3NDMtZjQ5ZTkyY2YzMzg4OjljYzUwYzg1LTNlZTctNDdhMy04M2QyLTM0YjE2NmNmMDE0Zg=="
Source: global traffic	HTTP traffic detected: GET /e455dbd6308045dea743f49e92cf3388/ HTTP/1.1Host: 0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.auConnection: UpgradePragma: no-cacheCache-Control: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Upgrade: websocketOrigin: https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.auSec-WebSocket-Version: 13Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 6wDB08="ZTQ1NWRiZDYtMzA4MC00NWRlLWE3NDMtZjQ5ZTkyY2YzMzg4OjljYzUwYzg1LTNlZTctNDdhMy04M2QyLTM0YjE2NmNmMDE0Zg=="; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; MicrosoftApplicationsTelemetryDeviceId=babf8dd5-6ef2-4698-b5ef-479010a34193; brcap=0Sec-WebSocket-Key: Yx/Fft81p59UYB8e2uU+8A==Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
Source: global traffic	HTTP traffic detected: GET /e455dbd6308045dea743f49e92cf3388/ HTTP/1.1Host: 0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.auConnection: UpgradePragma: no-cacheCache-Control: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Upgrade: websocketOrigin: https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.auSec-WebSocket-Version: 13Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 6wDB08="ZTQ1NWRiZDYtMzA4MC00NWRlLWE3NDMtZjQ5ZTkyY2YzMzg4OjljYzUwYzg1LTNlZTctNDdhMy04M2QyLTM0YjE2NmNmMDE0Zg=="; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; MicrosoftApplicationsTelemetryDeviceId=babf8dd5-6ef2-4698-b5ef-479010a34193; brcap=0Sec-WebSocket-Key: CSLiq/O0eSxsfZyXizgdCQ==Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
Source: global traffic	HTTP traffic detected: GET /e455dbd6308045dea743f49e92cf3388/ HTTP/1.1Host: 0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.auConnection: UpgradePragma: no-cacheCache-Control: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Upgrade: websocketOrigin: https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.auSec-WebSocket-Version: 13Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 6wDB08="ZTQ1NWRiZDYtMzA4MC00NWRlLWE3NDMtZjQ5ZTkyY2YzMzg4OjljYzUwYzg1LTNlZTctNDdhMy04M2QyLTM0YjE2NmNmMDE0Zg=="; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; MicrosoftApplicationsTelemetryDeviceId=babf8dd5-6ef2-4698-b5ef-479010a34193; brcap=0; ai_session=bGTMvv1/nABcVVGZeaGAgH\|1734723120038\|1734723120038Sec-WebSocket-Key: aRfa7ZDTsPNnbRZuk1tJ3w==Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
Source: global traffic	HTTP traffic detected: GET /Prefetch/Prefetch.aspx HTTP/1.1Host: dab02a46-e455dbd6.acmgs.com.auConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 6wDB08="ZTQ1NWRiZDYtMzA4MC00NWRlLWE3NDMtZjQ5ZTkyY2YzMzg4OjljYzUwYzg1LTNlZTctNDdhMy04M2QyLTM0YjE2NmNmMDE0Zg=="

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: google.com.mx
Source: global traffic	DNS traffic detected: DNS query: www.google.com.mx
Source: global traffic	DNS traffic detected: DNS query: braverygray.com
Source: global traffic	DNS traffic detected: DNS query: img.icons8.com
Source: global traffic	DNS traffic detected: DNS query: 0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au
Source: global traffic	DNS traffic detected: DNS query: 881a0950-e455dbd6.acmgs.com.au
Source: global traffic	DNS traffic detected: DNS query: 85089a4f-e455dbd6.acmgs.com.au
Source: global traffic	DNS traffic detected: DNS query: 2394395c-e455dbd6.acmgs.com.au
Source: global traffic	DNS traffic detected: DNS query: l1ve.acmgs.com.au
Source: global traffic	DNS traffic detected: DNS query: dab02a46-e455dbd6.acmgs.com.au
Source: global traffic	DNS traffic detected: DNS query: 754c237a-e455dbd6.acmgs.com.au

Source: unknown

HTTP traffic detected: POST /?777=mwebb%40windsorhomestx.com HTTP/1.1Host: 0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.auConnection: keep-aliveContent-Length: 5303Cache-Control: max-age=0sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1Origin: https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.auContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentReferer: https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au/?777=mwebb%40windsorhomestx.comAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 20 Dec 2024 19:30:59 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Fri, 20 Dec 2024 19:31:23 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-Encodingcache-control: privatep3p: CP="DSP CUR OTPi IND OTRi ONL FIN"x-ms-request-id: 39ab6885-6b5f-45dc-b4f7-9ebeb83af400x-ms-ests-server: 2.1.19683.3 - SEC ProdSlicesreport-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://85089a4f-e455dbd6.acmgs.com.au/api/report?catId=GW+estsfd+SEC"}]}nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0}x-ms-srs: 1.Preferrer-policy: strict-origin-when-cross-originaccess-control-allow-origin: access-control-allow-headers:
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Fri, 20 Dec 2024 19:31:23 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-Encodingcache-control: privatep3p: CP="DSP CUR OTPi IND OTRi ONL FIN"x-ms-request-id: 93536d39-0618-46f2-a07a-6da399bc1501x-ms-ests-server: 2.1.19683.3 - FRC ProdSlicesreport-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://85089a4f-e455dbd6.acmgs.com.au/api/report?catId=GW+estsfd+SEC"}]}nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0}x-ms-srs: 1.Preferrer-policy: strict-origin-when-cross-originaccess-control-allow-origin: access-control-allow-headers:
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Fri, 20 Dec 2024 19:31:27 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-Encodingcache-control: privatep3p: CP="DSP CUR OTPi IND OTRi ONL FIN"x-ms-request-id: 1b8e4abe-8426-482e-9a63-e1fa19b23700x-ms-ests-server: 2.1.19683.6 - FRC ProdSlicesreport-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://85089a4f-e455dbd6.acmgs.com.au/api/report?catId=GW+estsfd+SEC"}]}nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0}x-ms-srs: 1.Preferrer-policy: strict-origin-when-cross-originaccess-control-allow-origin: access-control-allow-headers:
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Fri, 20 Dec 2024 19:31:34 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-Encodingcache-control: privatep3p: CP="DSP CUR OTPi IND OTRi ONL FIN"x-ms-request-id: 3f11e5d2-edaa-4f56-b71b-296046841a01x-ms-ests-server: 2.1.19683.3 - SEC ProdSlicesreport-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://85089a4f-e455dbd6.acmgs.com.au/api/report?catId=GW+estsfd+SEC"}]}nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0}x-ms-srs: 1.Preferrer-policy: strict-origin-when-cross-originaccess-control-allow-origin: access-control-allow-headers:
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Fri, 20 Dec 2024 19:31:41 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-Encodingcache-control: privatep3p: CP="DSP CUR OTPi IND OTRi ONL FIN"x-ms-request-id: 733a3a80-2be4-42ef-8010-961eca882e03x-ms-ests-server: 2.1.19683.3 - SEC ProdSlicesreport-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://85089a4f-e455dbd6.acmgs.com.au/api/report?catId=GW+estsfd+SEC"}]}nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0}x-ms-srs: 1.Preferrer-policy: strict-origin-when-cross-originaccess-control-allow-origin: access-control-allow-headers:
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Fri, 20 Dec 2024 19:31:43 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeVary: Accept-Encodingcache-control: no-store, no-cachex-ms-correlation-id: fd632a89-dee0-4601-b247-25e5c6fdcdd0x-ua-compatible: IE=Edgex-cache: CONFIG_NOCACHEx-msedge-ref: Ref A: B8C99E4E529D4016B9A97FCD9553A729 Ref B: AMS231032601045 Ref C: 2024-12-20T19:31:42Zaccess-control-allow-origin: access-control-allow-headers:
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Fri, 20 Dec 2024 19:31:45 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-Encodingcache-control: privatep3p: CP="DSP CUR OTPi IND OTRi ONL FIN"x-ms-request-id: 536cb2fa-d4df-461a-8104-e39de1414103x-ms-ests-server: 2.1.19683.3 - WEULR1 ProdSlicesreport-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://85089a4f-e455dbd6.acmgs.com.au/api/report?catId=GW+estsfd+SEC"}]}nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0}x-ms-srs: 1.Preferrer-policy: strict-origin-when-cross-originaccess-control-allow-origin: access-control-allow-headers:
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Fri, 20 Dec 2024 19:31:52 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-Encodingcache-control: privatep3p: CP="DSP CUR OTPi IND OTRi ONL FIN"x-ms-request-id: 661b7100-dd9c-40e9-a76e-c3263e66ef02x-ms-ests-server: 2.1.19683.3 - WEULR1 ProdSlicesreport-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://85089a4f-e455dbd6.acmgs.com.au/api/report?catId=GW+estsfd+SEC"}]}nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0}x-ms-srs: 1.Preferrer-policy: strict-origin-when-cross-originaccess-control-allow-origin: access-control-allow-headers:
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Fri, 20 Dec 2024 19:32:00 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-Encodingcache-control: privatep3p: CP="DSP CUR OTPi IND OTRi ONL FIN"x-ms-request-id: b0ee43bd-e85e-4cc6-b375-fd075d36c802x-ms-ests-server: 2.1.19683.3 - SEC ProdSlicesreport-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://85089a4f-e455dbd6.acmgs.com.au/api/report?catId=GW+estsfd+SEC"}]}nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0}x-ms-srs: 1.Preferrer-policy: strict-origin-when-cross-originaccess-control-allow-origin: access-control-allow-headers:
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Fri, 20 Dec 2024 19:32:03 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeVary: Accept-Encodingcache-control: no-store, no-cachex-ms-correlation-id: 48cb4fa0-3273-408c-a6e5-f9296c2e381fx-ua-compatible: IE=Edgex-cache: CONFIG_NOCACHEx-msedge-ref: Ref A: 47CC2B815773461ABD94E31F72FDDDE3 Ref B: AMS231032603045 Ref C: 2024-12-20T19:32:03Zaccess-control-allow-origin: access-control-allow-headers:
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Fri, 20 Dec 2024 19:32:04 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-Encodingcache-control: privatep3p: CP="DSP CUR OTPi IND OTRi ONL FIN"x-ms-request-id: b1a9b518-c1aa-497f-a10e-06cdbdc2c700x-ms-ests-server: 2.1.19683.3 - NCUS ProdSlicesreport-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://85089a4f-e455dbd6.acmgs.com.au/api/report?catId=GW+estsfd+SEC"}]}nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0}x-ms-srs: 1.Preferrer-policy: strict-origin-when-cross-originaccess-control-allow-origin: access-control-allow-headers:

Source: chromecache_90.2.dr

String found in binary or memory: https://img.icons8.com/emoji/48/check-mark-emoji.png

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49676 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49671 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: classification engine

Classification label: mal76.phis.win@18/52@28/8

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Jump to behavior

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 --field-trial-handle=1904,i,18366170521209709358,2107059869103542779,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://google.com.mx//url?ob=pkmcekw7bljbM2dWBuuV7ic1KFgH&aw=f_rand_string_lowercase(8)n9QXkBk0w4OyBDvUpuk&sa=t&whi=f_rand_string_lowercase(8)zOPGXNRztppHiTbPIt5f&url=amp%2Fbraverygray.com/.dd/KcxwjqsanE-SUREDANN-bXdlYmJAd2luZHNvcmhvbWVzdHguY29t"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 --field-trial-handle=1904,i,18366170521209709358,2107059869103542779,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Google Drive.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Stores files to the Windows start menu directory

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.181.131	www.google.com.mx	United States	15169	GOOGLEUS	false
216.58.208.227	google.com.mx	United States	15169	GOOGLEUS	false
142.250.181.132	www.google.com	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
159.89.96.140	l1ve.acmgs.com.au	United States	14061	DIGITALOCEAN-ASNUS	true
169.150.255.183	1004834818.rsc.cdn77.org	United States	2711	SPIRITTEL-ASUS	false
162.241.114.35	braverygray.com	United States	46606	UNIFIEDLAYER-AS-1US	false

Private

IP
192.168.2.8

Contacted Domains

Name	IP	Active
1004834818.rsc.cdn77.org	169.150.255.183	true
l1ve.acmgs.com.au	159.89.96.140	true
754c237a-e455dbd6.acmgs.com.au	159.89.96.140	true
www.google.com.mx	142.250.181.131	true
881a0950-e455dbd6.acmgs.com.au	159.89.96.140	true
www.google.com	142.250.181.132	true
85089a4f-e455dbd6.acmgs.com.au	159.89.96.140	true
google.com.mx	216.58.208.227	true
braverygray.com	162.241.114.35	true
0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au	159.89.96.140	true
2394395c-e455dbd6.acmgs.com.au	159.89.96.140	true
dab02a46-e455dbd6.acmgs.com.au	159.89.96.140	true
img.icons8.com	unknown	unknown

Contacted URLs

Name	Malicious	Reputation
https://881a0950-e455dbd6.acmgs.com.au/shared/1.0/content/js/oneDs_f2e0f4a029670f10d892.js	true	unknown
https://img.icons8.com/emoji/48/check-mark-emoji.png	false	high
https://881a0950-e455dbd6.acmgs.com.au/shared/1.0/content/images/marching_ants_white_8257b0707cbe1d0bd2661b80068676fe.gif	true	unknown
https://881a0950-e455dbd6.acmgs.com.au/shared/1.0/content/images/microsoft_logo_564db913a7fa0ca42727161c6d031bef.svg	true	unknown
https://braverygray.com/.dd/KcxwjqsanE-SUREDANN-bXdlYmJAd2luZHNvcmhvbWVzdHguY29t	false	unknown
https://881a0950-e455dbd6.acmgs.com.au/shared/1.0/content/images/backgrounds/2_11d9e3bcdfede9ce5ce5ace2d129f1c4.svg	true	unknown
https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au/?777=mwebb%40windsorhomestx.com&sso_reload=true	true	unknown
https://braverygray.com/favicon.ico	false	unknown
https://881a0950-e455dbd6.acmgs.com.au/shared/1.0/content/js/BssoInterrupt_Core_zKox_QMcTIVut7mG_Z9Eew2.js	true	unknown
https://881a0950-e455dbd6.acmgs.com.au/shared/1.0/content/js/asyncchunk/convergedlogin_ppassword_b6632c4da67c72da7b92.js	true	unknown
https://754c237a-e455dbd6.acmgs.com.au/OneCollector/1.0/?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.6&apikey=b0c252808e614e949086e019ae1cb300-e0c02060-e3b3-4965-bd7c-415e1a7a9fde-6951&upload-time=1734723120041&time-delta-to-apply-millis=use-collector-delta&w=0&NoResponseBody=true	true	unknown
https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au/favicon.ico	true	unknown
https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au/common/login	false	unknown
https://l1ve.acmgs.com.au/Me.htm?v=3	true	unknown
https://881a0950-e455dbd6.acmgs.com.au/shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico	true	unknown
https://85089a4f-e455dbd6.acmgs.com.au/api/report?catId=GW+estsfd+SEC	true	unknown
https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au/?777=mwebb%40windsorhomestx.com	false	unknown
https://881a0950-e455dbd6.acmgs.com.au/ests/2.1/content/cdnbundles/ux.converged.login.strings-en.min_i8f-75gfk3tbsm8bmatnqa2.js	true	unknown
https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au/e455dbd6308045dea743f49e92cf3388/	true	unknown
https://881a0950-e455dbd6.acmgs.com.au/shared/1.0/content/js/asyncchunk/convergedlogin_pcustomizationloader_27cef08ca792f8e8b149.js	true	unknown
https://881a0950-e455dbd6.acmgs.com.au/shared/1.0/content/images/marching_ants_986f40b5a9dc7d39ef8396797f61b323.gif	true	unknown
https://www.google.com.mx/url?ob=pkmcekw7bljbM2dWBuuV7ic1KFgH&aw=f_rand_string_lowercase(8)n9QXkBk0w4OyBDvUpuk&sa=t&whi=f_rand_string_lowercase(8)zOPGXNRztppHiTbPIt5f&url=amp%2Fbraverygray.com/.dd/KcxwjqsanE-SUREDANN-bXdlYmJAd2luZHNvcmhvbWVzdHguY29t	false	high
https://google.com.mx//url?ob=pkmcekw7bljbM2dWBuuV7ic1KFgH&aw=f_rand_string_lowercase(8)n9QXkBk0w4OyBDvUpuk&sa=t&whi=f_rand_string_lowercase(8)zOPGXNRztppHiTbPIt5f&url=amp%2Fbraverygray.com/.dd/KcxwjqsanE-SUREDANN-bXdlYmJAd2luZHNvcmhvbWVzdHguY29t	false	high
https://dab02a46-e455dbd6.acmgs.com.au/Prefetch/Prefetch.aspx	true	unknown
https://www.google.com.mx/amp/braverygray.com/.dd/KcxwjqsanE-SUREDANN-bXdlYmJAd2luZHNvcmhvbWVzdHguY29t	false	high
https://881a0950-e455dbd6.acmgs.com.au/shared/1.0/content/js/ConvergedLogin_PCore_kAx9qZOSH4g90FNHstHMCA2.js	true	unknown
https://881a0950-e455dbd6.acmgs.com.au/ests/2.1/content/cdnbundles/converged.v2.login.min_81imvbluez-v5hbzpkxfcg2.css	true	unknown

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Dec 20 18:30:41 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	D885DDDD5075A3A31668EDEBF71B495B	01D7ACCAA4EE2C1483A9CEDA4662AB9FC16564B7	1264FDB29A5FF0DE2DDC4F32D241D6BDD860D31DC2B2C54FC227490C67CED26E
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Dec 20 18:30:41 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	D43882CC2B687A9801EBFFF4FBF72D3A	0AA14BE1B47A4A28E30239B73F9E1CF30D9A3D65	F000FAF237965EB20F9914440AD7764B8A3D03697BA7338ED28884224E74F2CA
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 5 07:00:51 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	9E5B9C8BDF9693774B47B63A33590539	6A6E4D979AB2CC6BC8478A8E30E4195F74F0C7F8	FCCCDC42EE5BEB65FFCC1C2BDBF353C83FD7460DD920AEB3B0D68AA8A94F1A51
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Dec 20 18:30:41 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	7141488BCD93F9CAC3B52A0E6B0DF055	D200FB0B0579C2727E2A5F3964DFEF7F915A72A8	5CE3A8901562EE92C7794CA5C666A55C33417BFE4DB5FF41963224287842D460
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Dec 20 18:30:41 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	7E6123352B9677226AD7CFB475579153	2CE24D3AD651405E29DB4B32A12320C9F66B62E9	C6B09A7426AF12796380B5275D21ED5B7BC18B3561997B2411C8CED3FCA0C145
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Dec 20 18:30:41 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	5E84194CCC6B2FD16003FD8C8BC5D084	6F79C53A066098FD9364D599EDABA19EC4E4EB8F	C9AAB8CBADF24CBC4D48178F9EBBDC36F4449A0BAC2E28ED02589C3A727F376B
Chrome Cache Entry: 100	gzip compressed data, original size modulo 2^32 1864	2D2CBA7D7DC75F3BA9DC756738D41A6E	F87FD26066ED5E52A65DEE0ED2D581D3C3EA15AC	00E21864CF1BC70302EBB5B496C6C471A7DA8CBF600630B478A3E2376ED20EA2
Chrome Cache Entry: 101	gzip compressed data, from Unix, original size modulo 2^32 190247	8454267BD2AAC8DF159D46D2AB0243DF	A5845FDA8F417FE8CB762B681F06043BB6FFC24F	A8390E73FE4C1BD495B5B656054CA7D3987BBA17BF150C88FD42A9E01DE1EBE0
Chrome Cache Entry: 102	MS Windows icon resource - 6 icons, 16x16 with PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced, 32 bits/pixel, 24x24 with PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced, 32 bits/pixel	7E0D59593F3377B72C29435C4B43954A	B4C5C39A6DFB460BBD2EACCEB09EC8079FB6A8E2	62D706019A0D80173113EF70FBBEE12F286E8E221534BE788448AADA4B14C8E8
Chrome Cache Entry: 103	gzip compressed data, from Unix, original size modulo 2^32 450747	25D9C95337763C4B6244D554123EE6E6	1DE455976631E49A1FDC407BA64940EC4774D998	246BE008C46254A847BA7D041F61F538EB85F4CAD37252BEE8BBD21271F69FD9
Chrome Cache Entry: 75	gzip compressed data, from Unix, original size modulo 2^32 57510	1BB2645B377E0429225D33E4E2CC6E3F	A40797795C77CDFF574080B506BAB17DB38494B5	B3B869875C7655F97500FBA0BCE74BCE7CC1DEE31D7CE5B93EA5D6457E07F08E
Chrome Cache Entry: 76	gzip compressed data, from Unix, original size modulo 2^32 142353	5709394A3D23A759FB796AB64D2FFEBD	A673D5B0089FE0EDBD9017F11621F9380CE27979	42886E243CB053AECDF6D243ADECD74B4A30AEAB6497F9EA9E5BC7BFB61A0472
Chrome Cache Entry: 77	GIF image data, version 89a, 352 x 3	B540A8E518037192E32C4FE58BF2DBAB	3047C1DB97B86F6981E0AD2F96AF40CDF43511AF	8737D721808655F37B333F08A90185699E7E8B9BDAAA15CDB63C8448B426F95D
Chrome Cache Entry: 78	gzip compressed data, from Unix, original size modulo 2^32 3556	CD89734771ECEF8B525000E9FC5ABFB1	21F36960248FD2CC24A5D7816C55A266E7F577D5	DBC6403CD3DE50848A94887C2DF3908CB5D71382806315E5CE707C68107A0ACD
Chrome Cache Entry: 79	gzip compressed data, from Unix, original size modulo 2^32 450747	0E7E4FD8C8CBC7DB166EAA7D16C42A43	89C882A4104638B5DE447212A4670D0286EE404C	24F7819A3F8F0943EF0341DCA755DD31521DFAFCFF8DA26B3A2714EAA6A87DD0
Chrome Cache Entry: 80	gzip compressed data, from Unix, original size modulo 2^32 407071	344D26ABD55FB5997E279E501C8CA158	7E158842760ADDC8B248A31D3253F4C81FE7843A	D04C47F972403E9BBA75E152EA920B6E553AB95715DCEFBC385C202943A2DE46
Chrome Cache Entry: 81	HTML document, ASCII text	A34AC19F4AFAE63ADC5D2F7BC970C07F	A82190FC530C265AA40A045C21770D967F4767B8	D5A89E26BEAE0BC03AD18A0B0D1D3D75F87C32047879D25DA11970CB5C4662A3
Chrome Cache Entry: 82	gzip compressed data, from Unix, original size modulo 2^32 113424	69F909D3BA8C6B993DD001B8B9F54F55	F9EAAAA6BC33CE60A2DA8E9FF0F3408CC21CC9EA	5DEB7C0DFBFFCA6439CADD009CD4F57AF7C3E8B6AD9B1467DB95A1B0DC262B0C
Chrome Cache Entry: 83	gzip compressed data, from Unix, original size modulo 2^32 142353	5709394A3D23A759FB796AB64D2FFEBD	A673D5B0089FE0EDBD9017F11621F9380CE27979	42886E243CB053AECDF6D243ADECD74B4A30AEAB6497F9EA9E5BC7BFB61A0472
Chrome Cache Entry: 84	gzip compressed data, original size modulo 2^32 3651	DF6A7721C242813411CC6950DF40F9B3	B2068C4A65C183AAD6FC22A44CC1FA449CD355B4	AA53B6DC744357B392FC57C34E516BAE465D4A6837775C137A176D599C8EA948
Chrome Cache Entry: 85	gzip compressed data, from Unix, original size modulo 2^32 407071	BE0ACB3ACCFE48C74839EA9712B42CEF	7D6D92D815C783D2214F33A519BACF28996717F6	75DA5887CBB633CACD48E66829CC647ACBB0C862B53C55389B2671D518497CBF
Chrome Cache Entry: 86	PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced	EB3AE4074D724A8A564173B2894A4F2B	21B8D9360555EE90B16CC4F70DEC8B652F643C8C	3E35566DD05C266A577E5DB23F903458D297463E95FC6F7E4CE2D044FAB20885
Chrome Cache Entry: 87	gzip compressed data, from Unix, original size modulo 2^32 26677	C94522CB4B4F00AC8B245E9C8E1493C7	611B3D8F548A79F9335A3758EB02858A2333CC68	F6E99224DB77432B577F3B9130662851411A83626B857CCD387D8381BA22056B
Chrome Cache Entry: 88	gzip compressed data, original size modulo 2^32 3651	DF6A7721C242813411CC6950DF40F9B3	B2068C4A65C183AAD6FC22A44CC1FA449CD355B4	AA53B6DC744357B392FC57C34E516BAE465D4A6837775C137A176D599C8EA948
Chrome Cache Entry: 89	GIF image data, version 89a, 352 x 3	166DE53471265253AB3A456DEFE6DA23	17C6DF4D7CCF1FA2C9EFD716FBAE0FC2C71C8D6D	A46201581A7C7C667FD42787CD1E9ADF2F6BF809EFB7596E61A03E8DBA9ADA13
Chrome Cache Entry: 90	ASCII text, with CRLF line terminators	ABAD45001799DA6A457B4903D1CC13D0	152707D5F31E75B959AC37F6799D12281B1702A7	4016D62F71F8C2EB1FEA341895EFC94BB020BC1F5A6C58972B440E977D5390A0
Chrome Cache Entry: 91	gzip compressed data, from Unix, original size modulo 2^32 190247	8454267BD2AAC8DF159D46D2AB0243DF	A5845FDA8F417FE8CB762B681F06043BB6FFC24F	A8390E73FE4C1BD495B5B656054CA7D3987BBA17BF150C88FD42A9E01DE1EBE0
Chrome Cache Entry: 92	MS Windows icon resource - 6 icons, 16x16 with PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced, 32 bits/pixel, 24x24 with PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced, 32 bits/pixel	7E0D59593F3377B72C29435C4B43954A	B4C5C39A6DFB460BBD2EACCEB09EC8079FB6A8E2	62D706019A0D80173113EF70FBBEE12F286E8E221534BE788448AADA4B14C8E8
Chrome Cache Entry: 93	ASCII text, with no line terminators	17C4BD96DCB397D1D62D24921BC4FEBA	2C0F2AFF858069D582A97867B183EBD5DC8A9FCB	3549DBC06BDD994A38C9A29AECD7E8F9577E2150D15F8D6B0533B4D250666514
Chrome Cache Entry: 94	gzip compressed data, original size modulo 2^32 1864	2D2CBA7D7DC75F3BA9DC756738D41A6E	F87FD26066ED5E52A65DEE0ED2D581D3C3EA15AC	00E21864CF1BC70302EBB5B496C6C471A7DA8CBF600630B478A3E2376ED20EA2
Chrome Cache Entry: 95	GIF image data, version 89a, 352 x 3	B540A8E518037192E32C4FE58BF2DBAB	3047C1DB97B86F6981E0AD2F96AF40CDF43511AF	8737D721808655F37B333F08A90185699E7E8B9BDAAA15CDB63C8448B426F95D
Chrome Cache Entry: 96	PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced	EB3AE4074D724A8A564173B2894A4F2B	21B8D9360555EE90B16CC4F70DEC8B652F643C8C	3E35566DD05C266A577E5DB23F903458D297463E95FC6F7E4CE2D044FAB20885
Chrome Cache Entry: 97	GIF image data, version 89a, 352 x 3	166DE53471265253AB3A456DEFE6DA23	17C6DF4D7CCF1FA2C9EFD716FBAE0FC2C71C8D6D	A46201581A7C7C667FD42787CD1E9ADF2F6BF809EFB7596E61A03E8DBA9ADA13
Chrome Cache Entry: 98	gzip compressed data, from Unix, original size modulo 2^32 57510	1BB2645B377E0429225D33E4E2CC6E3F	A40797795C77CDFF574080B506BAB17DB38494B5	B3B869875C7655F97500FBA0BCE74BCE7CC1DEE31D7CE5B93EA5D6457E07F08E
Chrome Cache Entry: 99	gzip compressed data, from Unix, original size modulo 2^32 26677	C94522CB4B4F00AC8B245E9C8E1493C7	611B3D8F548A79F9335A3758EB02858A2333CC68	F6E99224DB77432B577F3B9130662851411A83626B857CCD387D8381BA22056B

Phishing

AI detected phishing page

Source: https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au/?777=mwebb%40windsorhomestx.com&sso_reload=true	Joe Sandbox AI: Score: 9 Reasons: The brand 'Microsoft' is well-known and typically associated with the domain 'microsoft.com'., The URL '0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au' does not match the legitimate domain for Microsoft., The use of '0nlineactivations' with zeroes instead of 'onlineactivations' is a common phishing tactic involving misspellings., The domain 'acmgs.com.au' is not associated with Microsoft, which raises suspicion., The presence of repeated words and unusual patterns in the URL is indicative of phishing., The input field 'Password' suggests an attempt to capture sensitive information, which is common in phishing sites. DOM: 3.6.pages.csv
Source: https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au/?777=mwebb%40windsorhomestx.com&sso_reload=true	Joe Sandbox AI: Score: 9 Reasons: The brand 'Microsoft' is well-known and typically associated with the domain 'microsoft.com'., The URL '0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au' does not match the legitimate domain for Microsoft., The URL contains repeated words and uses '0' instead of 'o', which is a common phishing tactic to mimic legitimate words., The domain 'acmgs.com.au' is not associated with Microsoft, and the use of multiple hyphens and repeated words is suspicious., The presence of an input field for 'Enter password' suggests an attempt to capture sensitive information, which is a common phishing strategy. DOM: 3.7.pages.csv

Yara detected Fake Captcha

Source: Yara match

File source: 2.1.pages.csv, type: HTML

Yara detected HtmlPhish54

Source: Yara match	File source: 1.24.id.script.csv, type: HTML
Source: Yara match	File source: 1.3.id.script.csv, type: HTML
Source: Yara match	File source: 1.15.i.script.csv, type: HTML
Source: Yara match	File source: 3.7.pages.csv, type: HTML
Source: Yara match	File source: 2.2.pages.csv, type: HTML
Source: Yara match	File source: 4.8.pages.csv, type: HTML
Source: Yara match	File source: 3.3.pages.csv, type: HTML
Source: Yara match	File source: 3.5.pages.csv, type: HTML

AI detected suspicious Javascript

Source: 1.0.id.script.csv

Detected hidden input values containing email addresses (often used in phishing pages)

Source: https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au/?777=mwebb%40windsorhomestx.com&sso_reload=true

HTTP Parser: mwebb@windsorhomestx.com

HTML body contains low number of good links

Source: https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au/?777=mwebb%40windsorhomestx.com&sso_reload=true

HTTP Parser: Number of links: 0

HTML page contains hidden javascript code

Source: https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au/?777=mwebb%40windsorhomestx.com

HTTP Parser: Base64 decoded: a[href="http://www.salidzini.lv/"][style="display: block; width: 120px; height: 40px; overflow: hidden; position: relative;"]

HTML title does not match URL

Source: https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au/?777=mwebb%40windsorhomestx.com&sso_reload=true	HTTP Parser: Title: Sign in to your account does not match URL
Source: https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au/common/login	HTTP Parser: Title: Sign in to your account does not match URL

Source: https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au/?777=mwebb%40windsorhomestx.com&sso_reload=true	HTTP Parser: Iframe src: https://dab02a46-e455dbd6.acmgs.com.au/Prefetch/Prefetch.aspx
Source: https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au/?777=mwebb%40windsorhomestx.com&sso_reload=true	HTTP Parser: Iframe src: https://dab02a46-e455dbd6.acmgs.com.au/Prefetch/Prefetch.aspx
Source: https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au/?777=mwebb%40windsorhomestx.com&sso_reload=true	HTTP Parser: Iframe src: https://dab02a46-e455dbd6.acmgs.com.au/Prefetch/Prefetch.aspx
Source: https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au/common/login	HTTP Parser: Iframe src: https://dab02a46-e455dbd6.acmgs.com.au/Prefetch/Prefetch.aspx

Source: https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au/?777=mwebb%40windsorhomestx.com&sso_reload=true	HTTP Parser: <input type="password" .../> found
Source: https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au/common/login	HTTP Parser: <input type="password" .../> found

Source: https://braverygray.com/.dd/KcxwjqsanE-SUREDANN-bXdlYmJAd2luZHNvcmhvbWVzdHguY29t	HTTP Parser: No favicon
Source: https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au/?777=mwebb%40windsorhomestx.com	HTTP Parser: No favicon
Source: https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au/?777=mwebb%40windsorhomestx.com&sso_reload=true	HTTP Parser: No favicon
Source: https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au/?777=mwebb%40windsorhomestx.com&sso_reload=true	HTTP Parser: No favicon
Source: https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au/?777=mwebb%40windsorhomestx.com&sso_reload=true	HTTP Parser: No favicon
Source: https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au/?777=mwebb%40windsorhomestx.com&sso_reload=true	HTTP Parser: No favicon
Source: https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au/?777=mwebb%40windsorhomestx.com&sso_reload=true	HTTP Parser: No favicon
Source: https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au/common/login	HTTP Parser: No favicon

Source: https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au/?777=mwebb%40windsorhomestx.com&sso_reload=true	HTTP Parser: No <meta name="author".. found
Source: https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au/?777=mwebb%40windsorhomestx.com&sso_reload=true	HTTP Parser: No <meta name="author".. found
Source: https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au/?777=mwebb%40windsorhomestx.com&sso_reload=true	HTTP Parser: No <meta name="author".. found
Source: https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au/common/login	HTTP Parser: No <meta name="author".. found

Source: https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au/?777=mwebb%40windsorhomestx.com&sso_reload=true	HTTP Parser: No <meta name="copyright".. found
Source: https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au/?777=mwebb%40windsorhomestx.com&sso_reload=true	HTTP Parser: No <meta name="copyright".. found
Source: https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au/?777=mwebb%40windsorhomestx.com&sso_reload=true	HTTP Parser: No <meta name="copyright".. found
Source: https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au/common/login	HTTP Parser: No <meta name="copyright".. found

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2857090 - Severity 1 - ETPRO PHISHING JS/PsyduckPockeball Payload Inbound : 159.89.96.140:443 -> 192.168.2.8:49728
Source: Network traffic	Suricata IDS: 2832046 - Severity 1 - ETPRO PHISHING Successful Office 365 Phish 2018-08-01 : 192.168.2.8:49771 -> 159.89.96.140:443
Source: Network traffic	Suricata IDS: 2832180 - Severity 1 - ETPRO PHISHING Successful Microsoft Account Phish 2018-08-15 : 192.168.2.8:49771 -> 159.89.96.140:443
Source: Network traffic	Suricata IDS: 2840426 - Severity 1 - ETPRO PHISHING Successful Microsoft Account Phish 2020-01-14 : 192.168.2.8:49771 -> 159.89.96.140:443
Source: Network traffic	Suricata IDS: 2846045 - Severity 1 - ETPRO PHISHING Successful Microsoft Account Phish 2020-12-15 : 192.168.2.8:49771 -> 159.89.96.140:443

Detected suspicious crossdomain redirect

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

HTTP traffic: Redirect from: www.google.com.mx to http://braverygray.com/.dd/kcxwjqsane-suredann-bxdlymjad2luzhnvcmhvbwvzdhguy29t

Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.226
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.226
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63

Source: global traffic	HTTP traffic detected: GET //url?ob=pkmcekw7bljbM2dWBuuV7ic1KFgH&aw=f_rand_string_lowercase(8)n9QXkBk0w4OyBDvUpuk&sa=t&whi=f_rand_string_lowercase(8)zOPGXNRztppHiTbPIt5f&url=amp%2Fbraverygray.com/.dd/KcxwjqsanE-SUREDANN-bXdlYmJAd2luZHNvcmhvbWVzdHguY29t HTTP/1.1Host: google.com.mxConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CIW2yQEIorbJAQipncoBCOj/ygEIk6HLAQiFoM0BCNy9zQEIucrNAQiK080BCMfUzQEIodbNAQio2M0BCPnA1BUYwcvMARi60s0BGMXYzQEY642lFw==Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /url?ob=pkmcekw7bljbM2dWBuuV7ic1KFgH&aw=f_rand_string_lowercase(8)n9QXkBk0w4OyBDvUpuk&sa=t&whi=f_rand_string_lowercase(8)zOPGXNRztppHiTbPIt5f&url=amp%2Fbraverygray.com/.dd/KcxwjqsanE-SUREDANN-bXdlYmJAd2luZHNvcmhvbWVzdHguY29t HTTP/1.1Host: www.google.com.mxConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CIW2yQEIorbJAQipncoBCOj/ygEIk6HLAQiFoM0BCNy9zQEIucrNAQiK080BCMfUzQEIodbNAQio2M0BCPnA1BUYwcvMARi60s0BGMXYzQEY642lFw==Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /amp/braverygray.com/.dd/KcxwjqsanE-SUREDANN-bXdlYmJAd2luZHNvcmhvbWVzdHguY29t HTTP/1.1Host: www.google.com.mxConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CIW2yQEIorbJAQipncoBCOj/ygEIk6HLAQiFoM0BCNy9zQEIucrNAQiK080BCMfUzQEIodbNAQio2M0BCPnA1BUYwcvMARi60s0BGMXYzQEY642lFw==Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=520=VUvrXt8kQxKIDa0UQ4sEvOreZpnVtggySdjxhXKYcIYvuWNL4YnfPN_FjaecROyQPQPOfFr24aKJLpT4gLdH78I3fU7zxwMo6YgS5UNBIAsPBi0vsoZSyamevqrVgnsuyhQYjc-OlavfUuPtbGaZJKUA9GM0_VolTVYEwa3I9p96wrAF3K5-5OGR6_ZW21mFi-UdZA
Source: global traffic	HTTP traffic detected: GET /.dd/KcxwjqsanE-SUREDANN-bXdlYmJAd2luZHNvcmhvbWVzdHguY29t HTTP/1.1Host: braverygray.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /emoji/48/check-mark-emoji.png HTTP/1.1Host: img.icons8.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://braverygray.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: braverygray.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://braverygray.com/.dd/KcxwjqsanE-SUREDANN-bXdlYmJAd2luZHNvcmhvbWVzdHguY29tAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /emoji/48/check-mark-emoji.png HTTP/1.1Host: img.icons8.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /?777=mwebb%40windsorhomestx.com HTTP/1.1Host: 0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.auConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: documentReferer: https://braverygray.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /?777=mwebb%40windsorhomestx.com HTTP/1.1Host: 0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.auConnection: keep-aliveCache-Control: max-age=0Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Referer: https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au/?777=mwebb%40windsorhomestx.comAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 6wDB08="ZTQ1NWRiZDYtMzA4MC00NWRlLWE3NDMtZjQ5ZTkyY2YzMzg4OjljYzUwYzg1LTNlZTctNDdhMy04M2QyLTM0YjE2NmNmMDE0Zg=="
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/BssoInterrupt_Core_zKox_QMcTIVut7mG_Z9Eew2.js HTTP/1.1Host: 881a0950-e455dbd6.acmgs.com.auConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.ausec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /e455dbd6308045dea743f49e92cf3388/ HTTP/1.1Host: 0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.auConnection: UpgradePragma: no-cacheCache-Control: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Upgrade: websocketOrigin: https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.auSec-WebSocket-Version: 13Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 6wDB08="ZTQ1NWRiZDYtMzA4MC00NWRlLWE3NDMtZjQ5ZTkyY2YzMzg4OjljYzUwYzg1LTNlZTctNDdhMy04M2QyLTM0YjE2NmNmMDE0Zg=="Sec-WebSocket-Key: iA8wtNfTEl5/VqcbUrU3BQ==Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
Source: global traffic	HTTP traffic detected: GET /?777=mwebb%40windsorhomestx.com&sso_reload=true HTTP/1.1Host: 0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.auConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-Dest: documentReferer: https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au/?777=mwebb%40windsorhomestx.comAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 6wDB08="ZTQ1NWRiZDYtMzA4MC00NWRlLWE3NDMtZjQ5ZTkyY2YzMzg4OjljYzUwYzg1LTNlZTctNDdhMy04M2QyLTM0YjE2NmNmMDE0Zg=="; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: 0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.auConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au/?777=mwebb%40windsorhomestx.comAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 6wDB08="ZTQ1NWRiZDYtMzA4MC00NWRlLWE3NDMtZjQ5ZTkyY2YzMzg4OjljYzUwYzg1LTNlZTctNDdhMy04M2QyLTM0YjE2NmNmMDE0Zg=="
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/BssoInterrupt_Core_zKox_QMcTIVut7mG_Z9Eew2.js HTTP/1.1Host: 881a0950-e455dbd6.acmgs.com.auConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 6wDB08="ZTQ1NWRiZDYtMzA4MC00NWRlLWE3NDMtZjQ5ZTkyY2YzMzg4OjljYzUwYzg1LTNlZTctNDdhMy04M2QyLTM0YjE2NmNmMDE0Zg=="
Source: global traffic	HTTP traffic detected: GET /e455dbd6308045dea743f49e92cf3388/ HTTP/1.1Host: 0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.auConnection: UpgradePragma: no-cacheCache-Control: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Upgrade: websocketOrigin: https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.auSec-WebSocket-Version: 13Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 6wDB08="ZTQ1NWRiZDYtMzA4MC00NWRlLWE3NDMtZjQ5ZTkyY2YzMzg4OjljYzUwYzg1LTNlZTctNDdhMy04M2QyLTM0YjE2NmNmMDE0Zg=="; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1Sec-WebSocket-Key: zFTz/7692/wtMEh4gvlD8w==Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
Source: global traffic	HTTP traffic detected: GET /e455dbd6308045dea743f49e92cf3388/ HTTP/1.1Host: 0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.auConnection: UpgradePragma: no-cacheCache-Control: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Upgrade: websocketOrigin: https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.auSec-WebSocket-Version: 13Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 6wDB08="ZTQ1NWRiZDYtMzA4MC00NWRlLWE3NDMtZjQ5ZTkyY2YzMzg4OjljYzUwYzg1LTNlZTctNDdhMy04M2QyLTM0YjE2NmNmMDE0Zg=="; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1Sec-WebSocket-Key: 7oAxvZ+Lve5XQu+IjqDuXQ==Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
Source: global traffic	HTTP traffic detected: GET /ests/2.1/content/cdnbundles/converged.v2.login.min_81imvbluez-v5hbzpkxfcg2.css HTTP/1.1Host: 881a0950-e455dbd6.acmgs.com.auConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.ausec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: styleReferer: https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ests/2.1/content/cdnbundles/ux.converged.login.strings-en.min_i8f-75gfk3tbsm8bmatnqa2.js HTTP/1.1Host: 881a0950-e455dbd6.acmgs.com.auConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.ausec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/ConvergedLogin_PCore_kAx9qZOSH4g90FNHstHMCA2.js HTTP/1.1Host: 881a0950-e455dbd6.acmgs.com.auConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.ausec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /Me.htm?v=3 HTTP/1.1Host: l1ve.acmgs.com.auConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Purpose: prefetchSec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyReferer: https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 6wDB08="ZTQ1NWRiZDYtMzA4MC00NWRlLWE3NDMtZjQ5ZTkyY2YzMzg4OjljYzUwYzg1LTNlZTctNDdhMy04M2QyLTM0YjE2NmNmMDE0Zg=="
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/oneDs_f2e0f4a029670f10d892.js HTTP/1.1Host: 881a0950-e455dbd6.acmgs.com.auConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 6wDB08="ZTQ1NWRiZDYtMzA4MC00NWRlLWE3NDMtZjQ5ZTkyY2YzMzg4OjljYzUwYzg1LTNlZTctNDdhMy04M2QyLTM0YjE2NmNmMDE0Zg=="
Source: global traffic	HTTP traffic detected: GET /ests/2.1/content/cdnbundles/ux.converged.login.strings-en.min_i8f-75gfk3tbsm8bmatnqa2.js HTTP/1.1Host: 881a0950-e455dbd6.acmgs.com.auConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 6wDB08="ZTQ1NWRiZDYtMzA4MC00NWRlLWE3NDMtZjQ5ZTkyY2YzMzg4OjljYzUwYzg1LTNlZTctNDdhMy04M2QyLTM0YjE2NmNmMDE0Zg=="
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/ConvergedLogin_PCore_kAx9qZOSH4g90FNHstHMCA2.js HTTP/1.1Host: 881a0950-e455dbd6.acmgs.com.auConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 6wDB08="ZTQ1NWRiZDYtMzA4MC00NWRlLWE3NDMtZjQ5ZTkyY2YzMzg4OjljYzUwYzg1LTNlZTctNDdhMy04M2QyLTM0YjE2NmNmMDE0Zg=="
Source: global traffic	HTTP traffic detected: GET /e455dbd6308045dea743f49e92cf3388/ HTTP/1.1Host: 0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.auConnection: UpgradePragma: no-cacheCache-Control: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Upgrade: websocketOrigin: https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.auSec-WebSocket-Version: 13Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 6wDB08="ZTQ1NWRiZDYtMzA4MC00NWRlLWE3NDMtZjQ5ZTkyY2YzMzg4OjljYzUwYzg1LTNlZTctNDdhMy04M2QyLTM0YjE2NmNmMDE0Zg=="; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1Sec-WebSocket-Key: 8/8Isgiu/aF6AjO+qpxJiQ==Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/oneDs_f2e0f4a029670f10d892.js HTTP/1.1Host: 881a0950-e455dbd6.acmgs.com.auConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 6wDB08="ZTQ1NWRiZDYtMzA4MC00NWRlLWE3NDMtZjQ5ZTkyY2YzMzg4OjljYzUwYzg1LTNlZTctNDdhMy04M2QyLTM0YjE2NmNmMDE0Zg=="
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/asyncchunk/convergedlogin_pcustomizationloader_27cef08ca792f8e8b149.js HTTP/1.1Host: 881a0950-e455dbd6.acmgs.com.auConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 6wDB08="ZTQ1NWRiZDYtMzA4MC00NWRlLWE3NDMtZjQ5ZTkyY2YzMzg4OjljYzUwYzg1LTNlZTctNDdhMy04M2QyLTM0YjE2NmNmMDE0Zg=="
Source: global traffic	HTTP traffic detected: GET /Prefetch/Prefetch.aspx HTTP/1.1Host: dab02a46-e455dbd6.acmgs.com.auConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 6wDB08="ZTQ1NWRiZDYtMzA4MC00NWRlLWE3NDMtZjQ5ZTkyY2YzMzg4OjljYzUwYzg1LTNlZTctNDdhMy04M2QyLTM0YjE2NmNmMDE0Zg=="
Source: global traffic	HTTP traffic detected: GET /e455dbd6308045dea743f49e92cf3388/ HTTP/1.1Host: 0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.auConnection: UpgradePragma: no-cacheCache-Control: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Upgrade: websocketOrigin: https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.auSec-WebSocket-Version: 13Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 6wDB08="ZTQ1NWRiZDYtMzA4MC00NWRlLWE3NDMtZjQ5ZTkyY2YzMzg4OjljYzUwYzg1LTNlZTctNDdhMy04M2QyLTM0YjE2NmNmMDE0Zg=="; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; MicrosoftApplicationsTelemetryDeviceId=babf8dd5-6ef2-4698-b5ef-479010a34193; brcap=0Sec-WebSocket-Key: ZsrViyIgMcrLTVJBqthrSg==Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/asyncchunk/convergedlogin_ppassword_b6632c4da67c72da7b92.js HTTP/1.1Host: 881a0950-e455dbd6.acmgs.com.auConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 6wDB08="ZTQ1NWRiZDYtMzA4MC00NWRlLWE3NDMtZjQ5ZTkyY2YzMzg4OjljYzUwYzg1LTNlZTctNDdhMy04M2QyLTM0YjE2NmNmMDE0Zg=="
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/asyncchunk/convergedlogin_pcustomizationloader_27cef08ca792f8e8b149.js HTTP/1.1Host: 881a0950-e455dbd6.acmgs.com.auConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 6wDB08="ZTQ1NWRiZDYtMzA4MC00NWRlLWE3NDMtZjQ5ZTkyY2YzMzg4OjljYzUwYzg1LTNlZTctNDdhMy04M2QyLTM0YjE2NmNmMDE0Zg=="
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/marching_ants_white_8257b0707cbe1d0bd2661b80068676fe.gif HTTP/1.1Host: 881a0950-e455dbd6.acmgs.com.auConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 6wDB08="ZTQ1NWRiZDYtMzA4MC00NWRlLWE3NDMtZjQ5ZTkyY2YzMzg4OjljYzUwYzg1LTNlZTctNDdhMy04M2QyLTM0YjE2NmNmMDE0Zg=="
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/marching_ants_986f40b5a9dc7d39ef8396797f61b323.gif HTTP/1.1Host: 881a0950-e455dbd6.acmgs.com.auConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 6wDB08="ZTQ1NWRiZDYtMzA4MC00NWRlLWE3NDMtZjQ5ZTkyY2YzMzg4OjljYzUwYzg1LTNlZTctNDdhMy04M2QyLTM0YjE2NmNmMDE0Zg=="
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/asyncchunk/convergedlogin_ppassword_b6632c4da67c72da7b92.js HTTP/1.1Host: 881a0950-e455dbd6.acmgs.com.auConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 6wDB08="ZTQ1NWRiZDYtMzA4MC00NWRlLWE3NDMtZjQ5ZTkyY2YzMzg4OjljYzUwYzg1LTNlZTctNDdhMy04M2QyLTM0YjE2NmNmMDE0Zg=="
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/marching_ants_white_8257b0707cbe1d0bd2661b80068676fe.gif HTTP/1.1Host: 881a0950-e455dbd6.acmgs.com.auConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 6wDB08="ZTQ1NWRiZDYtMzA4MC00NWRlLWE3NDMtZjQ5ZTkyY2YzMzg4OjljYzUwYzg1LTNlZTctNDdhMy04M2QyLTM0YjE2NmNmMDE0Zg=="
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico HTTP/1.1Host: 881a0950-e455dbd6.acmgs.com.auConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 6wDB08="ZTQ1NWRiZDYtMzA4MC00NWRlLWE3NDMtZjQ5ZTkyY2YzMzg4OjljYzUwYzg1LTNlZTctNDdhMy04M2QyLTM0YjE2NmNmMDE0Zg=="
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/backgrounds/2_11d9e3bcdfede9ce5ce5ace2d129f1c4.svg HTTP/1.1Host: 881a0950-e455dbd6.acmgs.com.auConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 6wDB08="ZTQ1NWRiZDYtMzA4MC00NWRlLWE3NDMtZjQ5ZTkyY2YzMzg4OjljYzUwYzg1LTNlZTctNDdhMy04M2QyLTM0YjE2NmNmMDE0Zg=="
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/microsoft_logo_564db913a7fa0ca42727161c6d031bef.svg HTTP/1.1Host: 881a0950-e455dbd6.acmgs.com.auConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 6wDB08="ZTQ1NWRiZDYtMzA4MC00NWRlLWE3NDMtZjQ5ZTkyY2YzMzg4OjljYzUwYzg1LTNlZTctNDdhMy04M2QyLTM0YjE2NmNmMDE0Zg=="
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/marching_ants_986f40b5a9dc7d39ef8396797f61b323.gif HTTP/1.1Host: 881a0950-e455dbd6.acmgs.com.auConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 6wDB08="ZTQ1NWRiZDYtMzA4MC00NWRlLWE3NDMtZjQ5ZTkyY2YzMzg4OjljYzUwYzg1LTNlZTctNDdhMy04M2QyLTM0YjE2NmNmMDE0Zg=="
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/backgrounds/2_11d9e3bcdfede9ce5ce5ace2d129f1c4.svg HTTP/1.1Host: 881a0950-e455dbd6.acmgs.com.auConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 6wDB08="ZTQ1NWRiZDYtMzA4MC00NWRlLWE3NDMtZjQ5ZTkyY2YzMzg4OjljYzUwYzg1LTNlZTctNDdhMy04M2QyLTM0YjE2NmNmMDE0Zg=="
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico HTTP/1.1Host: 881a0950-e455dbd6.acmgs.com.auConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 6wDB08="ZTQ1NWRiZDYtMzA4MC00NWRlLWE3NDMtZjQ5ZTkyY2YzMzg4OjljYzUwYzg1LTNlZTctNDdhMy04M2QyLTM0YjE2NmNmMDE0Zg=="
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/microsoft_logo_564db913a7fa0ca42727161c6d031bef.svg HTTP/1.1Host: 881a0950-e455dbd6.acmgs.com.auConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 6wDB08="ZTQ1NWRiZDYtMzA4MC00NWRlLWE3NDMtZjQ5ZTkyY2YzMzg4OjljYzUwYzg1LTNlZTctNDdhMy04M2QyLTM0YjE2NmNmMDE0Zg=="
Source: global traffic	HTTP traffic detected: GET /e455dbd6308045dea743f49e92cf3388/ HTTP/1.1Host: 0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.auConnection: UpgradePragma: no-cacheCache-Control: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Upgrade: websocketOrigin: https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.auSec-WebSocket-Version: 13Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 6wDB08="ZTQ1NWRiZDYtMzA4MC00NWRlLWE3NDMtZjQ5ZTkyY2YzMzg4OjljYzUwYzg1LTNlZTctNDdhMy04M2QyLTM0YjE2NmNmMDE0Zg=="; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; MicrosoftApplicationsTelemetryDeviceId=babf8dd5-6ef2-4698-b5ef-479010a34193; brcap=0Sec-WebSocket-Key: Yx/Fft81p59UYB8e2uU+8A==Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
Source: global traffic	HTTP traffic detected: GET /e455dbd6308045dea743f49e92cf3388/ HTTP/1.1Host: 0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.auConnection: UpgradePragma: no-cacheCache-Control: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Upgrade: websocketOrigin: https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.auSec-WebSocket-Version: 13Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 6wDB08="ZTQ1NWRiZDYtMzA4MC00NWRlLWE3NDMtZjQ5ZTkyY2YzMzg4OjljYzUwYzg1LTNlZTctNDdhMy04M2QyLTM0YjE2NmNmMDE0Zg=="; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; MicrosoftApplicationsTelemetryDeviceId=babf8dd5-6ef2-4698-b5ef-479010a34193; brcap=0Sec-WebSocket-Key: CSLiq/O0eSxsfZyXizgdCQ==Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
Source: global traffic	HTTP traffic detected: GET /e455dbd6308045dea743f49e92cf3388/ HTTP/1.1Host: 0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.auConnection: UpgradePragma: no-cacheCache-Control: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Upgrade: websocketOrigin: https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.auSec-WebSocket-Version: 13Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 6wDB08="ZTQ1NWRiZDYtMzA4MC00NWRlLWE3NDMtZjQ5ZTkyY2YzMzg4OjljYzUwYzg1LTNlZTctNDdhMy04M2QyLTM0YjE2NmNmMDE0Zg=="; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; MicrosoftApplicationsTelemetryDeviceId=babf8dd5-6ef2-4698-b5ef-479010a34193; brcap=0; ai_session=bGTMvv1/nABcVVGZeaGAgH\|1734723120038\|1734723120038Sec-WebSocket-Key: aRfa7ZDTsPNnbRZuk1tJ3w==Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
Source: global traffic	HTTP traffic detected: GET /Prefetch/Prefetch.aspx HTTP/1.1Host: dab02a46-e455dbd6.acmgs.com.auConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 6wDB08="ZTQ1NWRiZDYtMzA4MC00NWRlLWE3NDMtZjQ5ZTkyY2YzMzg4OjljYzUwYzg1LTNlZTctNDdhMy04M2QyLTM0YjE2NmNmMDE0Zg=="

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: google.com.mx
Source: global traffic	DNS traffic detected: DNS query: www.google.com.mx
Source: global traffic	DNS traffic detected: DNS query: braverygray.com
Source: global traffic	DNS traffic detected: DNS query: img.icons8.com
Source: global traffic	DNS traffic detected: DNS query: 0nlineactivations-0nlineactivations-0nlineactivations.acmgs.com.au
Source: global traffic	DNS traffic detected: DNS query: 881a0950-e455dbd6.acmgs.com.au
Source: global traffic	DNS traffic detected: DNS query: 85089a4f-e455dbd6.acmgs.com.au
Source: global traffic	DNS traffic detected: DNS query: 2394395c-e455dbd6.acmgs.com.au
Source: global traffic	DNS traffic detected: DNS query: l1ve.acmgs.com.au
Source: global traffic	DNS traffic detected: DNS query: dab02a46-e455dbd6.acmgs.com.au
Source: global traffic	DNS traffic detected: DNS query: 754c237a-e455dbd6.acmgs.com.au

Source: unknown

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 20 Dec 2024 19:30:59 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Fri, 20 Dec 2024 19:31:23 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-Encodingcache-control: privatep3p: CP="DSP CUR OTPi IND OTRi ONL FIN"x-ms-request-id: 39ab6885-6b5f-45dc-b4f7-9ebeb83af400x-ms-ests-server: 2.1.19683.3 - SEC ProdSlicesreport-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://85089a4f-e455dbd6.acmgs.com.au/api/report?catId=GW+estsfd+SEC"}]}nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0}x-ms-srs: 1.Preferrer-policy: strict-origin-when-cross-originaccess-control-allow-origin: access-control-allow-headers:
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Fri, 20 Dec 2024 19:31:23 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-Encodingcache-control: privatep3p: CP="DSP CUR OTPi IND OTRi ONL FIN"x-ms-request-id: 93536d39-0618-46f2-a07a-6da399bc1501x-ms-ests-server: 2.1.19683.3 - FRC ProdSlicesreport-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://85089a4f-e455dbd6.acmgs.com.au/api/report?catId=GW+estsfd+SEC"}]}nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0}x-ms-srs: 1.Preferrer-policy: strict-origin-when-cross-originaccess-control-allow-origin: access-control-allow-headers:
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Fri, 20 Dec 2024 19:31:27 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-Encodingcache-control: privatep3p: CP="DSP CUR OTPi IND OTRi ONL FIN"x-ms-request-id: 1b8e4abe-8426-482e-9a63-e1fa19b23700x-ms-ests-server: 2.1.19683.6 - FRC ProdSlicesreport-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://85089a4f-e455dbd6.acmgs.com.au/api/report?catId=GW+estsfd+SEC"}]}nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0}x-ms-srs: 1.Preferrer-policy: strict-origin-when-cross-originaccess-control-allow-origin: access-control-allow-headers:
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Fri, 20 Dec 2024 19:31:34 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-Encodingcache-control: privatep3p: CP="DSP CUR OTPi IND OTRi ONL FIN"x-ms-request-id: 3f11e5d2-edaa-4f56-b71b-296046841a01x-ms-ests-server: 2.1.19683.3 - SEC ProdSlicesreport-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://85089a4f-e455dbd6.acmgs.com.au/api/report?catId=GW+estsfd+SEC"}]}nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0}x-ms-srs: 1.Preferrer-policy: strict-origin-when-cross-originaccess-control-allow-origin: access-control-allow-headers:
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Fri, 20 Dec 2024 19:31:41 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-Encodingcache-control: privatep3p: CP="DSP CUR OTPi IND OTRi ONL FIN"x-ms-request-id: 733a3a80-2be4-42ef-8010-961eca882e03x-ms-ests-server: 2.1.19683.3 - SEC ProdSlicesreport-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://85089a4f-e455dbd6.acmgs.com.au/api/report?catId=GW+estsfd+SEC"}]}nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0}x-ms-srs: 1.Preferrer-policy: strict-origin-when-cross-originaccess-control-allow-origin: access-control-allow-headers:
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Fri, 20 Dec 2024 19:31:43 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeVary: Accept-Encodingcache-control: no-store, no-cachex-ms-correlation-id: fd632a89-dee0-4601-b247-25e5c6fdcdd0x-ua-compatible: IE=Edgex-cache: CONFIG_NOCACHEx-msedge-ref: Ref A: B8C99E4E529D4016B9A97FCD9553A729 Ref B: AMS231032601045 Ref C: 2024-12-20T19:31:42Zaccess-control-allow-origin: access-control-allow-headers:
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Fri, 20 Dec 2024 19:31:45 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-Encodingcache-control: privatep3p: CP="DSP CUR OTPi IND OTRi ONL FIN"x-ms-request-id: 536cb2fa-d4df-461a-8104-e39de1414103x-ms-ests-server: 2.1.19683.3 - WEULR1 ProdSlicesreport-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://85089a4f-e455dbd6.acmgs.com.au/api/report?catId=GW+estsfd+SEC"}]}nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0}x-ms-srs: 1.Preferrer-policy: strict-origin-when-cross-originaccess-control-allow-origin: access-control-allow-headers:
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Fri, 20 Dec 2024 19:31:52 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-Encodingcache-control: privatep3p: CP="DSP CUR OTPi IND OTRi ONL FIN"x-ms-request-id: 661b7100-dd9c-40e9-a76e-c3263e66ef02x-ms-ests-server: 2.1.19683.3 - WEULR1 ProdSlicesreport-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://85089a4f-e455dbd6.acmgs.com.au/api/report?catId=GW+estsfd+SEC"}]}nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0}x-ms-srs: 1.Preferrer-policy: strict-origin-when-cross-originaccess-control-allow-origin: access-control-allow-headers:
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Fri, 20 Dec 2024 19:32:00 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-Encodingcache-control: privatep3p: CP="DSP CUR OTPi IND OTRi ONL FIN"x-ms-request-id: b0ee43bd-e85e-4cc6-b375-fd075d36c802x-ms-ests-server: 2.1.19683.3 - SEC ProdSlicesreport-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://85089a4f-e455dbd6.acmgs.com.au/api/report?catId=GW+estsfd+SEC"}]}nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0}x-ms-srs: 1.Preferrer-policy: strict-origin-when-cross-originaccess-control-allow-origin: access-control-allow-headers:
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Fri, 20 Dec 2024 19:32:03 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeVary: Accept-Encodingcache-control: no-store, no-cachex-ms-correlation-id: 48cb4fa0-3273-408c-a6e5-f9296c2e381fx-ua-compatible: IE=Edgex-cache: CONFIG_NOCACHEx-msedge-ref: Ref A: 47CC2B815773461ABD94E31F72FDDDE3 Ref B: AMS231032603045 Ref C: 2024-12-20T19:32:03Zaccess-control-allow-origin: access-control-allow-headers:
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Fri, 20 Dec 2024 19:32:04 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-Encodingcache-control: privatep3p: CP="DSP CUR OTPi IND OTRi ONL FIN"x-ms-request-id: b1a9b518-c1aa-497f-a10e-06cdbdc2c700x-ms-ests-server: 2.1.19683.3 - NCUS ProdSlicesreport-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://85089a4f-e455dbd6.acmgs.com.au/api/report?catId=GW+estsfd+SEC"}]}nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0}x-ms-srs: 1.Preferrer-policy: strict-origin-when-cross-originaccess-control-allow-origin: access-control-allow-headers:

Source: chromecache_90.2.dr

String found in binary or memory: https://img.icons8.com/emoji/48/check-mark-emoji.png

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49676 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49671 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: classification engine

Classification label: mal76.phis.win@18/52@28/8

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Jump to behavior

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 --field-trial-handle=1904,i,18366170521209709358,2107059869103542779,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://google.com.mx//url?ob=pkmcekw7bljbM2dWBuuV7ic1KFgH&aw=f_rand_string_lowercase(8)n9QXkBk0w4OyBDvUpuk&sa=t&whi=f_rand_string_lowercase(8)zOPGXNRztppHiTbPIt5f&url=amp%2Fbraverygray.com/.dd/KcxwjqsanE-SUREDANN-bXdlYmJAd2luZHNvcmhvbWVzdHguY29t"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 --field-trial-handle=1904,i,18366170521209709358,2107059869103542779,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Google Drive.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Stores files to the Windows start menu directory

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

ID:	1579104
Product:	CloudBasic
Start time:	20:29:41
Start date:	20.12.2024
Cookbook:	browseurl.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS

Windows Analysis Report
https://google.com.mx//url?ob=pkmcekw7bljbM2dWBuuV7ic1KFgH&aw=f_rand_string_lowercase(8)n9QXkBk0w4OyBDvUpuk&sa=t&whi=f_rand_string_lowercase(8)zOPGXNRztppHiTbPIt5f&url=amp%2Fbraverygray.com/.dd/KcxwjqsanE-SUREDANN-bXdlYmJAd2luZHNvcmhvbWVzdHguY29t

Overview

General Information

Detection

Signatures

Classification

Signatures

Phishing

Networking

System Summary

Boot Survival

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Private

Contacted Domains

Contacted URLs

Windows Analysis Report https://google.com.mx//url?ob=pkmcekw7bljbM2dWBuuV7ic1KFgH&aw=f_rand_string_lowercase(8)n9QXkBk0w4OyBDvUpuk&sa=t&whi=f_rand_string_lowercase(8)zOPGXNRztppHiTbPIt5f&url=amp%2Fbraverygray.com/.dd/KcxwjqsanE-SUREDANN-bXdlYmJAd2luZHNvcmhvbWVzdHguY29t

Overview

General Information

Detection

Signatures

Classification

Signatures

Phishing

Networking

System Summary

Boot Survival

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Private

Contacted Domains

Contacted URLs

Windows Analysis Report
https://google.com.mx//url?ob=pkmcekw7bljbM2dWBuuV7ic1KFgH&aw=f_rand_string_lowercase(8)n9QXkBk0w4OyBDvUpuk&sa=t&whi=f_rand_string_lowercase(8)zOPGXNRztppHiTbPIt5f&url=amp%2Fbraverygray.com/.dd/KcxwjqsanE-SUREDANN-bXdlYmJAd2luZHNvcmhvbWVzdHguY29t