Windows Analysis Report
Payout Receipts.pptx

Overview

General Information

Sample name: Payout Receipts.pptx
Analysis ID: 1579932
MD5: 0e0b49b01a6738d8431c5869d4acf5fe
SHA1: 67db202829294ad5280e0b19d885f730217817e0
SHA256: 02caa19967116536da9e63ac39b4022fb566e4a12877822cf85061bdf356ad43
Infos:

Detection

HTMLPhisher
Score: 64
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

AI detected phishing page
Yara detected HtmlPhish54
AI detected landing page (webpage, office document or email)
AI detected suspicious Javascript
Detected hidden input values containing email addresses (often used in phishing pages)
Detected suspicious crossdomain redirect
Document contains embedded VBA macros
Document misses a certain OLE stream usually present in this Microsoft Office document type
HTML body contains low number of good links
HTML page contains hidden javascript code
HTML title does not match URL
IP address seen in connection with other malware
Queries the volume information (name, serial number etc) of a device
Stores files to the Windows start menu directory

Classification

Phishing
barindex
AI detected phishing page
Source: https://login.365file.tech/realm?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638705623427189137.ZjMxMzIyN2QtMGE3OC00NmM0LWE1MTUtZjIyOTAzNTFjOTNiMGY1ZDEyMTItODRlOC00ZDFiLWE1OTgtZDM3NTVkYzdlMTBh&ui_locales=en-US&mkt=en-US&client-request-id=2268d124-c00f-4338-9556-dd594fce6a57&state=tvii8EXN8vdyOmZPlmgT2ozXVAsKp5O-DVucGpacp0IskL2Bo9JmytF2a-VC6Z39FKl9fed1eRAF_O8X76DyfIJy5OI8lywMpfjKpViMqKuqVoEfpn8yNcfA390oWj8P6ISNSshBJ3f0qT1W6s3evXnNQHjODWy4hzgRj6ngKoLWn5QmSBT_NySCp-LH9nKEsj-vPZ3i4dnyd2GcEnv_hQ3OKEM1EG-x5pK1vMcuNP-G0aw83WQEv9wk8aAaP-03Qil3P1TyVDr0dx5hbxf5kA&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0&sso_reload=true#jennifer_wylie@iamgold.com= Joe Sandbox AI: Score: 9 Reasons: The brand 'Iamgold' is a known mining company with a legitimate domain likely being 'iamgold.com'., The URL 'login.365file.tech' does not match the legitimate domain associated with Iamgold., The domain '365file.tech' is unrelated to the known brand 'Iamgold' and uses a generic tech domain extension, which is suspicious., The presence of a login page with a password field on an unrelated domain is a common phishing tactic. DOM: 4.11.pages.csv
Yara detected HtmlPhish54
Source: Yara match File source: 0.11.i.script.csv, type: HTML
Source: Yara match File source: 0.7.id.script.csv, type: HTML
Source: Yara match File source: 0.21.i.script.csv, type: HTML
Source: Yara match File source: 3.5.pages.csv, type: HTML
Source: Yara match File source: 4.7.pages.csv, type: HTML
Source: Yara match File source: 4.9.pages.csv, type: HTML
Source: Yara match File source: 4.8.pages.csv, type: HTML
Source: Yara match File source: 4.11.pages.csv, type: HTML
AI detected landing page (webpage, office document or email)
Source: Screenshot id: 2 Joe Sandbox AI: Page contains button: 'Kindly Authenticate the QR code above to access your document and approve receipt' Source: 'Screenshot id: 2'
Source: Screenshot id: 2 Joe Sandbox AI: Screenshot id: 2 contains QR code
AI detected suspicious Javascript
Source: 0.25.id.script.csv Joe Sandbox AI: Detected suspicious JavaScript with source url: https://login.365file.tech/realm?client_id=4765445... This script demonstrates several high-risk behaviors, including redirecting the user to an unknown domain and potentially collecting sensitive information (session ID) without transparency. The use of obfuscated code and the attempt to prevent the script from running in an iframe context further raise suspicions about the script's intent. While the script may have a legitimate purpose, the overall behavior and lack of transparency suggest a medium to high risk level that warrants further investigation.
Source: 0.16.id.script.csv Joe Sandbox AI: Detected suspicious JavaScript with source url: https://login.365file.tech/realm?client_id=4765445... This script exhibits several high-risk behaviors, including data exfiltration and redirects to suspicious domains. The use of obfuscated URLs and the presence of multiple fallback domains further increase the risk. While some of the behavior may be related to legitimate functionality, the overall risk profile is high and warrants further investigation.
Source: 0.14.id.script.csv Joe Sandbox AI: Detected suspicious JavaScript with source url: https://login.365file.tech/realm?client_id=4765445... This script demonstrates several high-risk behaviors, including dynamic code execution, data exfiltration, and redirects to potentially malicious domains. The use of an iframe to load additional scripts and the obfuscated nature of the code further increase the risk. While the script may have a legitimate purpose, such as implementing a security challenge, the overall behavior is highly suspicious and indicative of potential malicious intent.
Source: 0.24.id.script.csv Joe Sandbox AI: Detected suspicious JavaScript with source url: https://login.365file.tech/realm?client_id=4765445... This script demonstrates several high-risk behaviors, including dynamic code execution, data exfiltration, and redirects to potentially malicious domains. The use of an iframe to load additional scripts and the obfuscated nature of the code further increase the risk. While the script may have a legitimate purpose, such as implementing a security challenge, the overall behavior is highly suspicious and indicative of potential malicious intent.
Detected hidden input values containing email addresses (often used in phishing pages)
Source: https://login.365file.tech/realm?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638705623427189137.ZjMxMzIyN2QtMGE3OC00NmM0LWE1MTUtZjIyOTAzNTFjOTNiMGY1ZDEyMTItODRlOC00ZDFiLWE1OTgtZDM3NTVkYzdlMTBh&ui_locales=en-US&mkt=en-US&client-request-id=2268d124-c00f-4338-9556-dd594fce6a57&state=tvii8EXN8vdyOmZPlmgT2ozXVAsKp5O-DVucGpacp0IskL2Bo9JmytF2a-VC6Z39FKl9fed1eRAF_O8X76DyfIJy5OI8lywMpfjKpViMqKuqVoEfpn8yNcfA390oWj8P6ISNSshBJ3f0qT1W6s3evXnNQHjODWy4hzgRj6ngKoLWn5QmSBT_NySCp-LH9nKEsj-vPZ3i4dnyd2GcEnv_hQ3OKEM1EG-x5pK1vMcuNP-G0aw83WQEv9wk8aAaP-03Qil3P1TyVDr0dx5hbxf5kA&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0&sso_reload=true#jennifer_wylie@iamgold.com= HTTP Parser: jennifer_wylie@iamgold.com
HTML body contains low number of good links
Source: https://login.365file.tech/realm?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638705623427189137.ZjMxMzIyN2QtMGE3OC00NmM0LWE1MTUtZjIyOTAzNTFjOTNiMGY1ZDEyMTItODRlOC00ZDFiLWE1OTgtZDM3NTVkYzdlMTBh&ui_locales=en-US&mkt=en-US&client-request-id=2268d124-c00f-4338-9556-dd594fce6a57&state=tvii8EXN8vdyOmZPlmgT2ozXVAsKp5O-DVucGpacp0IskL2Bo9JmytF2a-VC6Z39FKl9fed1eRAF_O8X76DyfIJy5OI8lywMpfjKpViMqKuqVoEfpn8yNcfA390oWj8P6ISNSshBJ3f0qT1W6s3evXnNQHjODWy4hzgRj6ngKoLWn5QmSBT_NySCp-LH9nKEsj-vPZ3i4dnyd2GcEnv_hQ3OKEM1EG-x5pK1vMcuNP-G0aw83WQEv9wk8aAaP-03Qil3P1TyVDr0dx5hbxf5kA&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0#jennifer_wylie@iamgold.com HTTP Parser: Number of links: 0
Source: https://login.365file.tech/realm?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638705623427189137.ZjMxMzIyN2QtMGE3OC00NmM0LWE1MTUtZjIyOTAzNTFjOTNiMGY1ZDEyMTItODRlOC00ZDFiLWE1OTgtZDM3NTVkYzdlMTBh&ui_locales=en-US&mkt=en-US&client-request-id=2268d124-c00f-4338-9556-dd594fce6a57&state=tvii8EXN8vdyOmZPlmgT2ozXVAsKp5O-DVucGpacp0IskL2Bo9JmytF2a-VC6Z39FKl9fed1eRAF_O8X76DyfIJy5OI8lywMpfjKpViMqKuqVoEfpn8yNcfA390oWj8P6ISNSshBJ3f0qT1W6s3evXnNQHjODWy4hzgRj6ngKoLWn5QmSBT_NySCp-LH9nKEsj-vPZ3i4dnyd2GcEnv_hQ3OKEM1EG-x5pK1vMcuNP-G0aw83WQEv9wk8aAaP-03Qil3P1TyVDr0dx5hbxf5kA&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0&sso_reload=true#jennifer_wylie@iamgold.com= HTTP Parser: Number of links: 0
HTML page contains hidden javascript code
Source: https://login.365file.tech/RKiKvqBc?__cf_chl_rt_tk=SEq5GNYqsowTxv8ShnxKjM6RPUYPhJRVImxgPi0yQa8-1734965511-1.0.1.1-NdBax4MXpJ7qwL2gT0Md8Vf6yl9tXWWcv8VncP5jHPo#jennifer_wylie@iamgold.com HTTP Parser: Base64 decoded: <svg xmlns="http://www.w3.org/2000/svg" width="32" height="32" fill="none"><path fill="#B20F03" d="M16 3a13 13 0 1 0 13 13A13.015 13.015 0 0 0 16 3m0 24a11 11 0 1 1 11-11 11.01 11.01 0 0 1-11 11"/><path fill="#B20F03" d="M17.038 18.615H14.87L14.563 9.5h2....
HTML title does not match URL
Source: https://login.365file.tech/realm?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638705623427189137.ZjMxMzIyN2QtMGE3OC00NmM0LWE1MTUtZjIyOTAzNTFjOTNiMGY1ZDEyMTItODRlOC00ZDFiLWE1OTgtZDM3NTVkYzdlMTBh&ui_locales=en-US&mkt=en-US&client-request-id=2268d124-c00f-4338-9556-dd594fce6a57&state=tvii8EXN8vdyOmZPlmgT2ozXVAsKp5O-DVucGpacp0IskL2Bo9JmytF2a-VC6Z39FKl9fed1eRAF_O8X76DyfIJy5OI8lywMpfjKpViMqKuqVoEfpn8yNcfA390oWj8P6ISNSshBJ3f0qT1W6s3evXnNQHjODWy4hzgRj6ngKoLWn5QmSBT_NySCp-LH9nKEsj-vPZ3i4dnyd2GcEnv_hQ3OKEM1EG-x5pK1vMcuNP-G0aw83WQEv9wk8aAaP-03Qil3P1TyVDr0dx5hbxf5kA&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0#jennifer_wylie@iamgold.com HTTP Parser: Title: Redirecting does not match URL
Source: https://login.365file.tech/realm?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638705623427189137.ZjMxMzIyN2QtMGE3OC00NmM0LWE1MTUtZjIyOTAzNTFjOTNiMGY1ZDEyMTItODRlOC00ZDFiLWE1OTgtZDM3NTVkYzdlMTBh&ui_locales=en-US&mkt=en-US&client-request-id=2268d124-c00f-4338-9556-dd594fce6a57&state=tvii8EXN8vdyOmZPlmgT2ozXVAsKp5O-DVucGpacp0IskL2Bo9JmytF2a-VC6Z39FKl9fed1eRAF_O8X76DyfIJy5OI8lywMpfjKpViMqKuqVoEfpn8yNcfA390oWj8P6ISNSshBJ3f0qT1W6s3evXnNQHjODWy4hzgRj6ngKoLWn5QmSBT_NySCp-LH9nKEsj-vPZ3i4dnyd2GcEnv_hQ3OKEM1EG-x5pK1vMcuNP-G0aw83WQEv9wk8aAaP-03Qil3P1TyVDr0dx5hbxf5kA&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0&sso_reload=true#jennifer_wylie@iamgold.com= HTTP Parser: Title: Sign in to your account does not match URL
Source: https://login.365file.tech/realm?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638705623427189137.ZjMxMzIyN2QtMGE3OC00NmM0LWE1MTUtZjIyOTAzNTFjOTNiMGY1ZDEyMTItODRlOC00ZDFiLWE1OTgtZDM3NTVkYzdlMTBh&ui_locales=en-US&mkt=en-US&client-request-id=2268d124-c00f-4338-9556-dd594fce6a57&state=tvii8EXN8vdyOmZPlmgT2ozXVAsKp5O-DVucGpacp0IskL2Bo9JmytF2a-VC6Z39FKl9fed1eRAF_O8X76DyfIJy5OI8lywMpfjKpViMqKuqVoEfpn8yNcfA390oWj8P6ISNSshBJ3f0qT1W6s3evXnNQHjODWy4hzgRj6ngKoLWn5QmSBT_NySCp-LH9nKEsj-vPZ3i4dnyd2GcEnv_hQ3OKEM1EG-x5pK1vMcuNP-G0aw83WQEv9wk8aAaP-03Qil3P1TyVDr0dx5hbxf5kA&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0&sso_reload=true#jennifer_wylie@iamgold.com= HTTP Parser: Iframe src: https://ywnjb.365file.tech/Me.htm?v=3
Source: https://login.365file.tech/realm?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638705623427189137.ZjMxMzIyN2QtMGE3OC00NmM0LWE1MTUtZjIyOTAzNTFjOTNiMGY1ZDEyMTItODRlOC00ZDFiLWE1OTgtZDM3NTVkYzdlMTBh&ui_locales=en-US&mkt=en-US&client-request-id=2268d124-c00f-4338-9556-dd594fce6a57&state=tvii8EXN8vdyOmZPlmgT2ozXVAsKp5O-DVucGpacp0IskL2Bo9JmytF2a-VC6Z39FKl9fed1eRAF_O8X76DyfIJy5OI8lywMpfjKpViMqKuqVoEfpn8yNcfA390oWj8P6ISNSshBJ3f0qT1W6s3evXnNQHjODWy4hzgRj6ngKoLWn5QmSBT_NySCp-LH9nKEsj-vPZ3i4dnyd2GcEnv_hQ3OKEM1EG-x5pK1vMcuNP-G0aw83WQEv9wk8aAaP-03Qil3P1TyVDr0dx5hbxf5kA&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0&sso_reload=true#jennifer_wylie@iamgold.com= HTTP Parser: Iframe src: https://ywnjb.365file.tech/Me.htm?v=3
Source: https://login.365file.tech/realm?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638705623427189137.ZjMxMzIyN2QtMGE3OC00NmM0LWE1MTUtZjIyOTAzNTFjOTNiMGY1ZDEyMTItODRlOC00ZDFiLWE1OTgtZDM3NTVkYzdlMTBh&ui_locales=en-US&mkt=en-US&client-request-id=2268d124-c00f-4338-9556-dd594fce6a57&state=tvii8EXN8vdyOmZPlmgT2ozXVAsKp5O-DVucGpacp0IskL2Bo9JmytF2a-VC6Z39FKl9fed1eRAF_O8X76DyfIJy5OI8lywMpfjKpViMqKuqVoEfpn8yNcfA390oWj8P6ISNSshBJ3f0qT1W6s3evXnNQHjODWy4hzgRj6ngKoLWn5QmSBT_NySCp-LH9nKEsj-vPZ3i4dnyd2GcEnv_hQ3OKEM1EG-x5pK1vMcuNP-G0aw83WQEv9wk8aAaP-03Qil3P1TyVDr0dx5hbxf5kA&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0&sso_reload=true#jennifer_wylie@iamgold.com= HTTP Parser: <input type="password" .../> found
Source: https://login.365file.tech/RKiKvqBc?__cf_chl_rt_tk=SEq5GNYqsowTxv8ShnxKjM6RPUYPhJRVImxgPi0yQa8-1734965511-1.0.1.1-NdBax4MXpJ7qwL2gT0Md8Vf6yl9tXWWcv8VncP5jHPo#jennifer_wylie@iamgold.com HTTP Parser: No favicon
Source: https://login.365file.tech/RKiKvqBc#jennifer_wylie@iamgold.com HTTP Parser: No favicon
Source: https://login.365file.tech/RKiKvqBc#jennifer_wylie@iamgold.com HTTP Parser: No favicon
Source: https://login.365file.tech/realm?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638705623427189137.ZjMxMzIyN2QtMGE3OC00NmM0LWE1MTUtZjIyOTAzNTFjOTNiMGY1ZDEyMTItODRlOC00ZDFiLWE1OTgtZDM3NTVkYzdlMTBh&ui_locales=en-US&mkt=en-US&client-request-id=2268d124-c00f-4338-9556-dd594fce6a57&state=tvii8EXN8vdyOmZPlmgT2ozXVAsKp5O-DVucGpacp0IskL2Bo9JmytF2a-VC6Z39FKl9fed1eRAF_O8X76DyfIJy5OI8lywMpfjKpViMqKuqVoEfpn8yNcfA390oWj8P6ISNSshBJ3f0qT1W6s3evXnNQHjODWy4hzgRj6ngKoLWn5QmSBT_NySCp-LH9nKEsj-vPZ3i4dnyd2GcEnv_hQ3OKEM1EG-x5pK1vMcuNP-G0aw83WQEv9wk8aAaP-03Qil3P1TyVDr0dx5hbxf5kA&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0#jennifer_wylie@iamgold.com HTTP Parser: No favicon
Source: https://login.365file.tech/realm?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638705623427189137.ZjMxMzIyN2QtMGE3OC00NmM0LWE1MTUtZjIyOTAzNTFjOTNiMGY1ZDEyMTItODRlOC00ZDFiLWE1OTgtZDM3NTVkYzdlMTBh&ui_locales=en-US&mkt=en-US&client-request-id=2268d124-c00f-4338-9556-dd594fce6a57&state=tvii8EXN8vdyOmZPlmgT2ozXVAsKp5O-DVucGpacp0IskL2Bo9JmytF2a-VC6Z39FKl9fed1eRAF_O8X76DyfIJy5OI8lywMpfjKpViMqKuqVoEfpn8yNcfA390oWj8P6ISNSshBJ3f0qT1W6s3evXnNQHjODWy4hzgRj6ngKoLWn5QmSBT_NySCp-LH9nKEsj-vPZ3i4dnyd2GcEnv_hQ3OKEM1EG-x5pK1vMcuNP-G0aw83WQEv9wk8aAaP-03Qil3P1TyVDr0dx5hbxf5kA&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0#jennifer_wylie@iamgold.com HTTP Parser: No <meta name="author".. found
Source: https://login.365file.tech/realm?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638705623427189137.ZjMxMzIyN2QtMGE3OC00NmM0LWE1MTUtZjIyOTAzNTFjOTNiMGY1ZDEyMTItODRlOC00ZDFiLWE1OTgtZDM3NTVkYzdlMTBh&ui_locales=en-US&mkt=en-US&client-request-id=2268d124-c00f-4338-9556-dd594fce6a57&state=tvii8EXN8vdyOmZPlmgT2ozXVAsKp5O-DVucGpacp0IskL2Bo9JmytF2a-VC6Z39FKl9fed1eRAF_O8X76DyfIJy5OI8lywMpfjKpViMqKuqVoEfpn8yNcfA390oWj8P6ISNSshBJ3f0qT1W6s3evXnNQHjODWy4hzgRj6ngKoLWn5QmSBT_NySCp-LH9nKEsj-vPZ3i4dnyd2GcEnv_hQ3OKEM1EG-x5pK1vMcuNP-G0aw83WQEv9wk8aAaP-03Qil3P1TyVDr0dx5hbxf5kA&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0&sso_reload=true#jennifer_wylie@iamgold.com= HTTP Parser: No <meta name="author".. found
Source: https://login.365file.tech/realm?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638705623427189137.ZjMxMzIyN2QtMGE3OC00NmM0LWE1MTUtZjIyOTAzNTFjOTNiMGY1ZDEyMTItODRlOC00ZDFiLWE1OTgtZDM3NTVkYzdlMTBh&ui_locales=en-US&mkt=en-US&client-request-id=2268d124-c00f-4338-9556-dd594fce6a57&state=tvii8EXN8vdyOmZPlmgT2ozXVAsKp5O-DVucGpacp0IskL2Bo9JmytF2a-VC6Z39FKl9fed1eRAF_O8X76DyfIJy5OI8lywMpfjKpViMqKuqVoEfpn8yNcfA390oWj8P6ISNSshBJ3f0qT1W6s3evXnNQHjODWy4hzgRj6ngKoLWn5QmSBT_NySCp-LH9nKEsj-vPZ3i4dnyd2GcEnv_hQ3OKEM1EG-x5pK1vMcuNP-G0aw83WQEv9wk8aAaP-03Qil3P1TyVDr0dx5hbxf5kA&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0&sso_reload=true#jennifer_wylie@iamgold.com= HTTP Parser: No <meta name="author".. found
Source: https://login.365file.tech/realm?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638705623427189137.ZjMxMzIyN2QtMGE3OC00NmM0LWE1MTUtZjIyOTAzNTFjOTNiMGY1ZDEyMTItODRlOC00ZDFiLWE1OTgtZDM3NTVkYzdlMTBh&ui_locales=en-US&mkt=en-US&client-request-id=2268d124-c00f-4338-9556-dd594fce6a57&state=tvii8EXN8vdyOmZPlmgT2ozXVAsKp5O-DVucGpacp0IskL2Bo9JmytF2a-VC6Z39FKl9fed1eRAF_O8X76DyfIJy5OI8lywMpfjKpViMqKuqVoEfpn8yNcfA390oWj8P6ISNSshBJ3f0qT1W6s3evXnNQHjODWy4hzgRj6ngKoLWn5QmSBT_NySCp-LH9nKEsj-vPZ3i4dnyd2GcEnv_hQ3OKEM1EG-x5pK1vMcuNP-G0aw83WQEv9wk8aAaP-03Qil3P1TyVDr0dx5hbxf5kA&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0&sso_reload=true#jennifer_wylie@iamgold.com= HTTP Parser: No <meta name="author".. found
Source: https://login.365file.tech/realm?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638705623427189137.ZjMxMzIyN2QtMGE3OC00NmM0LWE1MTUtZjIyOTAzNTFjOTNiMGY1ZDEyMTItODRlOC00ZDFiLWE1OTgtZDM3NTVkYzdlMTBh&ui_locales=en-US&mkt=en-US&client-request-id=2268d124-c00f-4338-9556-dd594fce6a57&state=tvii8EXN8vdyOmZPlmgT2ozXVAsKp5O-DVucGpacp0IskL2Bo9JmytF2a-VC6Z39FKl9fed1eRAF_O8X76DyfIJy5OI8lywMpfjKpViMqKuqVoEfpn8yNcfA390oWj8P6ISNSshBJ3f0qT1W6s3evXnNQHjODWy4hzgRj6ngKoLWn5QmSBT_NySCp-LH9nKEsj-vPZ3i4dnyd2GcEnv_hQ3OKEM1EG-x5pK1vMcuNP-G0aw83WQEv9wk8aAaP-03Qil3P1TyVDr0dx5hbxf5kA&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0&sso_reload=true#jennifer_wylie@iamgold.com= HTTP Parser: No <meta name="author".. found
Source: https://login.365file.tech/realm?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638705623427189137.ZjMxMzIyN2QtMGE3OC00NmM0LWE1MTUtZjIyOTAzNTFjOTNiMGY1ZDEyMTItODRlOC00ZDFiLWE1OTgtZDM3NTVkYzdlMTBh&ui_locales=en-US&mkt=en-US&client-request-id=2268d124-c00f-4338-9556-dd594fce6a57&state=tvii8EXN8vdyOmZPlmgT2ozXVAsKp5O-DVucGpacp0IskL2Bo9JmytF2a-VC6Z39FKl9fed1eRAF_O8X76DyfIJy5OI8lywMpfjKpViMqKuqVoEfpn8yNcfA390oWj8P6ISNSshBJ3f0qT1W6s3evXnNQHjODWy4hzgRj6ngKoLWn5QmSBT_NySCp-LH9nKEsj-vPZ3i4dnyd2GcEnv_hQ3OKEM1EG-x5pK1vMcuNP-G0aw83WQEv9wk8aAaP-03Qil3P1TyVDr0dx5hbxf5kA&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0#jennifer_wylie@iamgold.com HTTP Parser: No <meta name="copyright".. found
Source: https://login.365file.tech/realm?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638705623427189137.ZjMxMzIyN2QtMGE3OC00NmM0LWE1MTUtZjIyOTAzNTFjOTNiMGY1ZDEyMTItODRlOC00ZDFiLWE1OTgtZDM3NTVkYzdlMTBh&ui_locales=en-US&mkt=en-US&client-request-id=2268d124-c00f-4338-9556-dd594fce6a57&state=tvii8EXN8vdyOmZPlmgT2ozXVAsKp5O-DVucGpacp0IskL2Bo9JmytF2a-VC6Z39FKl9fed1eRAF_O8X76DyfIJy5OI8lywMpfjKpViMqKuqVoEfpn8yNcfA390oWj8P6ISNSshBJ3f0qT1W6s3evXnNQHjODWy4hzgRj6ngKoLWn5QmSBT_NySCp-LH9nKEsj-vPZ3i4dnyd2GcEnv_hQ3OKEM1EG-x5pK1vMcuNP-G0aw83WQEv9wk8aAaP-03Qil3P1TyVDr0dx5hbxf5kA&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0&sso_reload=true#jennifer_wylie@iamgold.com= HTTP Parser: No <meta name="copyright".. found
Source: https://login.365file.tech/realm?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638705623427189137.ZjMxMzIyN2QtMGE3OC00NmM0LWE1MTUtZjIyOTAzNTFjOTNiMGY1ZDEyMTItODRlOC00ZDFiLWE1OTgtZDM3NTVkYzdlMTBh&ui_locales=en-US&mkt=en-US&client-request-id=2268d124-c00f-4338-9556-dd594fce6a57&state=tvii8EXN8vdyOmZPlmgT2ozXVAsKp5O-DVucGpacp0IskL2Bo9JmytF2a-VC6Z39FKl9fed1eRAF_O8X76DyfIJy5OI8lywMpfjKpViMqKuqVoEfpn8yNcfA390oWj8P6ISNSshBJ3f0qT1W6s3evXnNQHjODWy4hzgRj6ngKoLWn5QmSBT_NySCp-LH9nKEsj-vPZ3i4dnyd2GcEnv_hQ3OKEM1EG-x5pK1vMcuNP-G0aw83WQEv9wk8aAaP-03Qil3P1TyVDr0dx5hbxf5kA&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0&sso_reload=true#jennifer_wylie@iamgold.com= HTTP Parser: No <meta name="copyright".. found
Source: https://login.365file.tech/realm?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638705623427189137.ZjMxMzIyN2QtMGE3OC00NmM0LWE1MTUtZjIyOTAzNTFjOTNiMGY1ZDEyMTItODRlOC00ZDFiLWE1OTgtZDM3NTVkYzdlMTBh&ui_locales=en-US&mkt=en-US&client-request-id=2268d124-c00f-4338-9556-dd594fce6a57&state=tvii8EXN8vdyOmZPlmgT2ozXVAsKp5O-DVucGpacp0IskL2Bo9JmytF2a-VC6Z39FKl9fed1eRAF_O8X76DyfIJy5OI8lywMpfjKpViMqKuqVoEfpn8yNcfA390oWj8P6ISNSshBJ3f0qT1W6s3evXnNQHjODWy4hzgRj6ngKoLWn5QmSBT_NySCp-LH9nKEsj-vPZ3i4dnyd2GcEnv_hQ3OKEM1EG-x5pK1vMcuNP-G0aw83WQEv9wk8aAaP-03Qil3P1TyVDr0dx5hbxf5kA&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0&sso_reload=true#jennifer_wylie@iamgold.com= HTTP Parser: No <meta name="copyright".. found
Source: https://login.365file.tech/realm?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638705623427189137.ZjMxMzIyN2QtMGE3OC00NmM0LWE1MTUtZjIyOTAzNTFjOTNiMGY1ZDEyMTItODRlOC00ZDFiLWE1OTgtZDM3NTVkYzdlMTBh&ui_locales=en-US&mkt=en-US&client-request-id=2268d124-c00f-4338-9556-dd594fce6a57&state=tvii8EXN8vdyOmZPlmgT2ozXVAsKp5O-DVucGpacp0IskL2Bo9JmytF2a-VC6Z39FKl9fed1eRAF_O8X76DyfIJy5OI8lywMpfjKpViMqKuqVoEfpn8yNcfA390oWj8P6ISNSshBJ3f0qT1W6s3evXnNQHjODWy4hzgRj6ngKoLWn5QmSBT_NySCp-LH9nKEsj-vPZ3i4dnyd2GcEnv_hQ3OKEM1EG-x5pK1vMcuNP-G0aw83WQEv9wk8aAaP-03Qil3P1TyVDr0dx5hbxf5kA&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0&sso_reload=true#jennifer_wylie@iamgold.com= HTTP Parser: No <meta name="copyright".. found
Source: powerpnt.exe Memory has grown: Private usage: 2MB later: 117MB
Detected suspicious crossdomain redirect
Source: C:\Program Files\Google\Chrome\Application\chrome.exe HTTP traffic: Redirect from: www.google.com to https://salesboost.com/jf
Source: C:\Program Files\Google\Chrome\Application\chrome.exe HTTP traffic: Redirect from: salesboost.com to https://login.365file.tech/rkikvqbc
Source: C:\Program Files\Google\Chrome\Application\chrome.exe HTTP traffic: Redirect from: www.google.com to https://salesboost.com/jf
Source: C:\Program Files\Google\Chrome\Application\chrome.exe HTTP traffic: Redirect from: salesboost.com to https://login.365file.tech/rkikvqbc
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 104.18.94.41 104.18.94.41
Source: Joe Sandbox View IP Address: 104.18.95.41 104.18.95.41
Source: unknown TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: global traffic HTTP traffic detected: GET /amp/s/salesboost.com/jf HTTP/1.1Host: www.google.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIkqHLAQj2mM0BCIWgzQEI3L3NAQiRys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /jf HTTP/1.1Host: salesboost.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /jf/ HTTP/1.1Host: salesboost.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /RKiKvqBc HTTP/1.1Host: login.365file.techConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /amp/s/salesboost.com/jf HTTP/1.1Host: www.google.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIkqHLAQj2mM0BCIWgzQEI3L3NAQiRys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=520=gK7O0nTsR-wPx05SrBJUd3HAfX4M9fc3aqd2XTKtTlIL-40D9SE3v73cbehuTvOeWv7KMN6SzEvw8450IfocIWnMawOJxHynYMsOO5fqWdvfMBtm--u9BujLGT0VtJ6dqbxcZjYp3EkCYhKkezVxOguXncHPaP_B08fK1K4CIpBspFVoRYKd_Yz5WTA31IXgra3h
Source: global traffic HTTP traffic detected: GET /jf/ HTTP/1.1Host: salesboost.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /RKiKvqBc HTTP/1.1Host: login.365file.techConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-arch: "x86"sec-ch-ua-platform: "Windows"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-model: ""sec-ch-ua-bitness: "64"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/orchestrate/chl_page/v1?ray=8f692c10de854314 HTTP/1.1Host: login.365file.techConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://login.365file.tech/RKiKvqBc?__cf_chl_rt_tk=SEq5GNYqsowTxv8ShnxKjM6RPUYPhJRVImxgPi0yQa8-1734965511-1.0.1.1-NdBax4MXpJ7qwL2gT0Md8Vf6yl9tXWWcv8VncP5jHPoAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/orchestrate/chl_page/v1?ray=8f692c10de854314 HTTP/1.1Host: login.365file.techConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: login.365file.techConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://login.365file.tech/RKiKvqBcAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /turnstile/v0/b/787bc399e22f/api.js?onload=WXqDk4&render=explicit HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://login.365file.techsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/flow/ov1/737265407:1734963256:v--qV6PRwMGnawi4djvFIfSHLRJhT5kPAgN_50_G6Z4/8f692c10de854314/TOGNyk6aUIk0aC21kLKjtzNEZhHS8WCD.p47H0GGFwc-1734965511-1.2.1.1-7sDAwg8cay2RCE3vybEEKXLSGgaICCttt2YuZIwFInu4e3r4yVRObJ1QXzXyeYKi HTTP/1.1Host: login.365file.techConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /turnstile/v0/b/787bc399e22f/api.js?onload=WXqDk4&render=explicit HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv/99bnk/0x4AAAAAAADnPIDROrmt1Wwj/light/fbE/normal/auto/ HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/orchestrate/chl_api/v1?ray=8f692c38cb37c43b&lang=auto HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv/99bnk/0x4AAAAAAADnPIDROrmt1Wwj/light/fbE/normal/auto/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/cmg/1 HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv/99bnk/0x4AAAAAAADnPIDROrmt1Wwj/light/fbE/normal/auto/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/cmg/1 HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/orchestrate/chl_api/v1?ray=8f692c38cb37c43b&lang=auto HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: login.365file.techConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://login.365file.tech/RKiKvqBcAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/flow/ov1/59012872:1734963193:dJWEVcwbrnL1TTil6YmxbJ4SlF5pcoUWsQBeHspz6pg/8f692c38cb37c43b/vxu2uxafbM96ucUzDK4INX7dCY8HEjZkkcnYJbZchuI-1734965518-1.1.1.1-Eh2ysBkS1kMovo4eqQXf9rKEAPgIZYIJhkH0RyZFQodz6oLCEt8BZW60dk029qUW HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/pat/8f692c38cb37c43b/1734965522352/7339b7655fb87e4c59a48d975d045630c30639ee310f0ebce0dfc6e6e6ed9473/43Aan-x4BPJpSgM HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveCache-Control: max-age=0sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv/99bnk/0x4AAAAAAADnPIDROrmt1Wwj/light/fbE/normal/auto/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/i/8f692c38cb37c43b/1734965522353/HWsekBJnYLOyFP0 HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv/99bnk/0x4AAAAAAADnPIDROrmt1Wwj/light/fbE/normal/auto/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/i/8f692c38cb37c43b/1734965522353/HWsekBJnYLOyFP0 HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/flow/ov1/59012872:1734963193:dJWEVcwbrnL1TTil6YmxbJ4SlF5pcoUWsQBeHspz6pg/8f692c38cb37c43b/vxu2uxafbM96ucUzDK4INX7dCY8HEjZkkcnYJbZchuI-1734965518-1.1.1.1-Eh2ysBkS1kMovo4eqQXf9rKEAPgIZYIJhkH0RyZFQodz6oLCEt8BZW60dk029qUW HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/flow/ov1/59012872:1734963193:dJWEVcwbrnL1TTil6YmxbJ4SlF5pcoUWsQBeHspz6pg/8f692c38cb37c43b/vxu2uxafbM96ucUzDK4INX7dCY8HEjZkkcnYJbZchuI-1734965518-1.1.1.1-Eh2ysBkS1kMovo4eqQXf9rKEAPgIZYIJhkH0RyZFQodz6oLCEt8BZW60dk029qUW HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/flow/ov1/737265407:1734963256:v--qV6PRwMGnawi4djvFIfSHLRJhT5kPAgN_50_G6Z4/8f692c10de854314/TOGNyk6aUIk0aC21kLKjtzNEZhHS8WCD.p47H0GGFwc-1734965511-1.2.1.1-7sDAwg8cay2RCE3vybEEKXLSGgaICCttt2YuZIwFInu4e3r4yVRObJ1QXzXyeYKi HTTP/1.1Host: login.365file.techConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: login.365file.techConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://login.365file.tech/RKiKvqBc?__cf_chl_tk=SEq5GNYqsowTxv8ShnxKjM6RPUYPhJRVImxgPi0yQa8-1734965511-1.0.1.1-NdBax4MXpJ7qwL2gT0Md8Vf6yl9tXWWcv8VncP5jHPoAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Host: login.365file.techConnection: keep-aliveCache-Control: max-age=0Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-arch: "x86"sec-ch-ua-platform: "Windows"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-model: ""sec-ch-ua-bitness: "64"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"Referer: https://login.365file.tech/RKiKvqBc?__cf_chl_tk=SEq5GNYqsowTxv8ShnxKjM6RPUYPhJRVImxgPi0yQa8-1734965511-1.0.1.1-NdBax4MXpJ7qwL2gT0Md8Vf6yl9tXWWcv8VncP5jHPoAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: cf_clearance=BNNmnB0.21i1a2zs0dzJf4GjoCB4BeK.nWzOHhruVRc-1734965511-1.2.1.1-9J4E9tAPbb8SCdUhsJceXJpmmRagVU2D4qqzr31gzR3AqAc_jZHN79_U2g_R__.gVcJmSKCkWxXZH.OKWdK6rX5XnvgwrifEOMoTMnXu_5KcIdxtoMTtBSP3BBFNLn5GxSyxQqHZkkKifjXCIaAQKQfxcDbo9AgKh6Rrg2Ms0JnSpw7.3O9Ds2U4728tb5XCfK0WpUVjq.hOOWJ8KFqW8Bfn_kzDlbGfce9wdnRoHgvl46veIkM9w.no3M2Jbqsse2LSP9_NlhHskIHUlt3.OfFm5vYE5b.qjnI8FWclFp9vW8IrZ26gmZAxkAIu74MbkeTgvNC8wEeTNMqE32ybGNTaK26DF_v1pY_ugAxekvShPxcY6QgJJePJ2cdpMTnn.rapv16_crmCNKYGpfaLQt.JKBXyv08R3I0wsPt0xoJaA0wYLd.gLe3tJt360abD; KmAT=56313130dd0d14b933a5516ed2cadc1c539b3efae52f454c4cc516ab8ea4c21b
Source: global traffic HTTP traffic detected: GET /login HTTP/1.1Host: www.365file.techConnection: keep-aliveCache-Control: max-age=0Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-siteSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Referer: https://login.365file.tech/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: cf_clearance=BNNmnB0.21i1a2zs0dzJf4GjoCB4BeK.nWzOHhruVRc-1734965511-1.2.1.1-9J4E9tAPbb8SCdUhsJceXJpmmRagVU2D4qqzr31gzR3AqAc_jZHN79_U2g_R__.gVcJmSKCkWxXZH.OKWdK6rX5XnvgwrifEOMoTMnXu_5KcIdxtoMTtBSP3BBFNLn5GxSyxQqHZkkKifjXCIaAQKQfxcDbo9AgKh6Rrg2Ms0JnSpw7.3O9Ds2U4728tb5XCfK0WpUVjq.hOOWJ8KFqW8Bfn_kzDlbGfce9wdnRoHgvl46veIkM9w.no3M2Jbqsse2LSP9_NlhHskIHUlt3.OfFm5vYE5b.qjnI8FWclFp9vW8IrZ26gmZAxkAIu74MbkeTgvNC8wEeTNMqE32ybGNTaK26DF_v1pY_ugAxekvShPxcY6QgJJePJ2cdpMTnn.rapv16_crmCNKYGpfaLQt.JKBXyv08R3I0wsPt0xoJaA0wYLd.gLe3tJt360abD; KmAT=56313130dd0d14b933a5516ed2cadc1c539b3efae52f454c4cc516ab8ea4c21b
Source: global traffic HTTP traffic detected: GET /realm?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638705623427189137.ZjMxMzIyN2QtMGE3OC00NmM0LWE1MTUtZjIyOTAzNTFjOTNiMGY1ZDEyMTItODRlOC00ZDFiLWE1OTgtZDM3NTVkYzdlMTBh&ui_locales=en-US&mkt=en-US&client-request-id=2268d124-c00f-4338-9556-dd594fce6a57&state=tvii8EXN8vdyOmZPlmgT2ozXVAsKp5O-DVucGpacp0IskL2Bo9JmytF2a-VC6Z39FKl9fed1eRAF_O8X76DyfIJy5OI8lywMpfjKpViMqKuqVoEfpn8yNcfA390oWj8P6ISNSshBJ3f0qT1W6s3evXnNQHjODWy4hzgRj6ngKoLWn5QmSBT_NySCp-LH9nKEsj-vPZ3i4dnyd2GcEnv_hQ3OKEM1EG-x5pK1vMcuNP-G0aw83WQEv9wk8aAaP-03Qil3P1TyVDr0dx5hbxf5kA&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0 HTTP/1.1Host: login.365file.techConnection: keep-aliveCache-Control: max-age=0Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-siteSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-arch: "x86"sec-ch-ua-platform: "Windows"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-model: ""sec-ch-ua-bitness: "64"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"Referer: https://login.365file.tech/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: cf_clearance=BNNmnB0.21i1a2zs0dzJf4GjoCB4BeK.nWzOHhruVRc-1734965511-1.2.1.1-9J4E9tAPbb8SCdUhsJceXJpmmRagVU2D4qqzr31gzR3AqAc_jZHN79_U2g_R__.gVcJmSKCkWxXZH.OKWdK6rX5XnvgwrifEOMoTMnXu_5KcIdxtoMTtBSP3BBFNLn5GxSyxQqHZkkKifjXCIaAQKQfxcDbo9AgKh6Rrg2Ms0JnSpw7.3O9Ds2U4728tb5XCfK0WpUVjq.hOOWJ8KFqW8Bfn_kzDlbGfce9wdnRoHgvl46veIkM9w.no3M2Jbqsse2LSP9_NlhHskIHUlt3.OfFm5vYE5b.qjnI8FWclFp9vW8IrZ26gmZAxkAIu74MbkeTgvNC8wEeTNMqE32ybGNTaK26DF_v1pY_ugAxekvShPxcY6QgJJePJ2cdpMTnn.rapv16_crmCNKYGpfaLQt.JKBXyv08R3I0wsPt0xoJaA0wYLd.gLe3tJt360abD; KmAT=56313130dd0d14b933a5516ed2cadc1c539b3efae52f454c4cc516ab8ea4c21b; fpc=AgixDrZbyBxEjMXxxDPE5kQ; esctx=PAQABBwEAAADW6jl31mB3T7ugrWTT8pFenKWPcsGxmZQy0gt_zkO11mUXmzW6zLnMgjob2yl5-6kaMybRhswIm5gq8eQ2wQfBbNsDe-ThhDWS5jEU_RuAWowkHmW6d3chs3ApwCm6d49bZZpNXLF6FLfz_raz9sbDvOL-2n9dLYI3YpGZeDCI9IgCU_xZMox1urj5NrEgS8wgAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd
Source: global traffic HTTP traffic detected: GET /realm?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638705623427189137.ZjMxMzIyN2QtMGE3OC00NmM0LWE1MTUtZjIyOTAzNTFjOTNiMGY1ZDEyMTItODRlOC00ZDFiLWE1OTgtZDM3NTVkYzdlMTBh&ui_locales=en-US&mkt=en-US&client-request-id=2268d124-c00f-4338-9556-dd594fce6a57&state=tvii8EXN8vdyOmZPlmgT2ozXVAsKp5O-DVucGpacp0IskL2Bo9JmytF2a-VC6Z39FKl9fed1eRAF_O8X76DyfIJy5OI8lywMpfjKpViMqKuqVoEfpn8yNcfA390oWj8P6ISNSshBJ3f0qT1W6s3evXnNQHjODWy4hzgRj6ngKoLWn5QmSBT_NySCp-LH9nKEsj-vPZ3i4dnyd2GcEnv_hQ3OKEM1EG-x5pK1vMcuNP-G0aw83WQEv9wk8aAaP-03Qil3P1TyVDr0dx5hbxf5kA&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0&sso_reload=true HTTP/1.1Host: login.365file.techConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-arch: "x86"sec-ch-ua-platform: "Windows"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-model: ""sec-ch-ua-bitness: "64"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-Dest: documentReferer: https://login.365file.tech/realm?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638705623427189137.ZjMxMzIyN2QtMGE3OC00NmM0LWE1MTUtZjIyOTAzNTFjOTNiMGY1ZDEyMTItODRlOC00ZDFiLWE1OTgtZDM3NTVkYzdlMTBh&ui_locales=en-US&mkt=en-US&client-request-id=2268d124-c00f-4338-9556-dd594fce6a57&state=tvii8EXN8vdyOmZPlmgT2ozXVAsKp5O-DVucGpacp0IskL2Bo9JmytF2a-VC6Z39FKl9fed1eRAF_O8X76DyfIJy5OI8lywMpfjKpViMqKuqVoEfpn8yNcfA390oWj8P6ISNSshBJ3f0qT1W6s3evXnNQHjODWy4hzgRj6ngKoLWn5QmSBT_NySCp-LH9nKEsj-vPZ3i4dnyd2GcEnv_hQ3OKEM1EG-x5pK1vMcuNP-G0aw83WQEv9wk8aAaP-03Qil3P1TyVDr0dx5hbxf5kA&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: cf_clearance=BNNmnB0.21i1a2zs0dzJf4GjoCB4BeK.nWzOHhruVRc-1734965511-1.2.1.1-9J4E9tAPbb8SCdUhsJceXJpmmRagVU2D4qqzr31gzR3AqAc_jZHN79_U2g_R__.gVcJmSKCkWxXZH.OKWdK6rX5XnvgwrifEOMoTMnXu_5KcIdxtoMTtBSP3BBFNLn5GxSyxQqHZkkKifjXCIaAQKQfxcDbo9AgKh6Rrg2Ms0JnSpw7.3O9Ds2U4728tb5XCfK0WpUVjq.hOOWJ8KFqW8Bfn_kzDlbGfce9wdnRoHgvl46veIkM9w.no3M2Jbqsse2LSP9_NlhHskIHUlt3.OfFm5vYE5b.qjnI8FWclFp9vW8IrZ26gmZAxkAIu74MbkeTgvNC8wEeTNMqE32ybGNTaK26DF_v1pY_ugAxekvShPxcY6QgJJePJ2cdpMTnn.rapv16_crmCNKYGpfaLQt
Source: global traffic HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: login.365file.techConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://login.365file.tech/realm?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638705623427189137.ZjMxMzIyN2QtMGE3OC00NmM0LWE1MTUtZjIyOTAzNTFjOTNiMGY1ZDEyMTItODRlOC00ZDFiLWE1OTgtZDM3NTVkYzdlMTBh&ui_locales=en-US&mkt=en-US&client-request-id=2268d124-c00f-4338-9556-dd594fce6a57&state=tvii8EXN8vdyOmZPlmgT2ozXVAsKp5O-DVucGpacp0IskL2Bo9JmytF2a-VC6Z39FKl9fed1eRAF_O8X76DyfIJy5OI8lywMpfjKpViMqKuqVoEfpn8yNcfA390oWj8P6ISNSshBJ3f0qT1W6s3evXnNQHjODWy4hzgRj6ngKoLWn5QmSBT_NySCp-LH9nKEsj-vPZ3i4dnyd2GcEnv_hQ3OKEM1EG-x5pK1vMcuNP-G0aw83WQEv9wk8aAaP-03Qil3P1TyVDr0dx5hbxf5kA&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: cf_clearance=BNNmnB0.21i1a2zs0dzJf4GjoCB4BeK.nWzOHhruVRc-1734965511-1.2.1.1-9J4E9tAPbb8SCdUhsJceXJpmmRagVU2D4qqzr31gzR3AqAc_jZHN79_U2g_R__.gVcJmSKCkWxXZH.OKWdK6rX5XnvgwrifEOMoTMnXu_5KcIdxtoMTtBSP3BBFNLn5GxSyxQqHZkkKifjXCIaAQKQfxcDbo9AgKh6Rrg2Ms0JnSpw7.3O9Ds2U4728tb5XCfK0WpUVjq.hOOWJ8KFqW8Bfn_kzDlbGfce9wdnRoHgvl46veIkM9w.no3M2Jbqsse2LSP9_NlhHskIHUlt3.OfFm5vYE5b.qjnI8FWclFp9vW8IrZ26gmZAxkAIu74MbkeTgvNC8wEeTNMqE32ybGNTaK26DF_v1pY_ugAxekvShPxcY6QgJJePJ2cdpMTnn.rapv16_crmCNKYGpfaLQt.JKBXyv08R3I0wsPt0xoJaA0wYLd.gLe3tJt360abD; KmAT=56313130dd0d14b933a5516ed2cadc1c539b3efae52f454c4cc516ab8ea4c21b; fpc=AgixDrZbyBxEjMXxxDPE5kQ; esctx=PAQABBwEAAADW6jl31mB3T7ugrWTT8pFenKWPcsGxmZQy0gt_zkO11mUXmzW6zLnMgjob2yl5-6kaMybRhswIm5gq8eQ2wQfBbNsDe-ThhDWS5jEU_RuAWowkHmW6d3chs3ApwCm6d49bZZpNXLF6FLfz_raz9sbDvOL-2n9dLYI3YpGZeDCI9IgCU_xZMox1urj5NrEgS8wgAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; esctx-NDj1gL61gzQ=AQABCQEAAADW6jl31mB3T7ugrWTT8pFeuWkNtOo4RtW9YQUmlp3AmhsWylx_-zhDOAyrMdcCjjamopW3jVcwBDQyQx5CXPNReuJ9qpSInAtzrcY83Ls8sWG8kI8Zlg5SQEzid7oR8QBSkqdXMjS3_yTPRGqF1K4pNlwCPw7-bB2jAvB9g7_2aSAA; AADSSO=NA|NoExtension; SSOCOOKIEPULLED=1
Source: global traffic HTTP traffic detected: GET /cdn-cgi/challenge-platform/scripts/jsd/main.js HTTP/1.1Host: login.365file.techConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: cf_clearance=BNNmnB0.21i1a2zs0dzJf4GjoCB4BeK.nWzOHhruVRc-1734965511-1.2.1.1-9J4E9tAPbb8SCdUhsJceXJpmmRagVU2D4qqzr31gzR3AqAc_jZHN79_U2g_R__.gVcJmSKCkWxXZH.OKWdK6rX5XnvgwrifEOMoTMnXu_5KcIdxtoMTtBSP3BBFNLn5GxSyxQqHZkkKifjXCIaAQKQfxcDbo9AgKh6Rrg2Ms0JnSpw7.3O9Ds2U4728tb5XCfK0WpUVjq.hOOWJ8KFqW8Bfn_kzDlbGfce9wdnRoHgvl46veIkM9w.no3M2Jbqsse2LSP9_NlhHskIHUlt3.OfFm5vYE5b.qjnI8FWclFp9vW8IrZ26gmZAxkAIu74MbkeTgvNC8wEeTNMqE32ybGNTaK26DF_v1pY_ugAxekvShPxcY6QgJJePJ2cdpMTnn.rapv16_crmCNKYGpfaLQt.JKBXyv08R3I0wsPt0xoJaA0wYLd.gLe3tJt360abD; KmAT=56313130dd0d14b933a5516ed2cadc1c539b3efae52f454c4cc516ab8ea4c21b; fpc=AgixDrZbyBxEjMXxxDPE5kQ; esctx=PAQABBwEAAADW6jl31mB3T7ugrWTT8pFenKWPcsGxmZQy0gt_zkO11mUXmzW6zLnMgjob2yl5-6kaMybRhswIm5gq8eQ2wQfBbNsDe-ThhDWS5jEU_RuAWowkHmW6d3chs3ApwCm6d49bZZpNXLF6FLfz_raz9sbDvOL-2n9dLYI3YpGZeDCI9IgCU_xZMox1urj5NrEgS8wgAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; esctx-NDj1gL61gzQ=AQABCQEAAADW6jl31mB3T7ugrWTT8pFeuWkNtOo4RtW9YQUmlp3AmhsWylx_-zhDOAyrMdcCjjamopW3jVcwBDQyQx5CXPNReuJ9qpSInAtzrcY83Ls8sWG8kI8Zlg5SQEzid7oR8QBSkqdXMjS3_yTPRGqF1K4pNlwCPw7-bB2jAvB9g7_2aSAA
Source: global traffic HTTP traffic detected: GET /Me.htm?v=3 HTTP/1.1Host: ywnjb.365file.techConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Purpose: prefetchSec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyReferer: https://login.365file.tech/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: cf_clearance=BNNmnB0.21i1a2zs0dzJf4GjoCB4BeK.nWzOHhruVRc-1734965511-1.2.1.1-9J4E9tAPbb8SCdUhsJceXJpmmRagVU2D4qqzr31gzR3AqAc_jZHN79_U2g_R__.gVcJmSKCkWxXZH.OKWdK6rX5XnvgwrifEOMoTMnXu_5KcIdxtoMTtBSP3BBFNLn5GxSyxQqHZkkKifjXCIaAQKQfxcDbo9AgKh6Rrg2Ms0JnSpw7.3O9Ds2U4728tb5XCfK0WpUVjq.hOOWJ8KFqW8Bfn_kzDlbGfce9wdnRoHgvl46veIkM9w.no3M2Jbqsse2LSP9_NlhHskIHUlt3.OfFm5vYE5b.qjnI8FWclFp9vW8IrZ26gmZAxkAIu74MbkeTgvNC8wEeTNMqE32ybGNTaK26DF_v1pY_ugAxekvShPxcY6QgJJePJ2cdpMTnn.rapv16_crmCNKYGpfaLQt.JKBXyv08R3I0wsPt0xoJaA0wYLd.gLe3tJt360abD; KmAT=56313130dd0d14b933a5516ed2cadc1c539b3efae52f454c4cc516ab8ea4c21b
Source: global traffic HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/scripts/jsd/787bc399e22f/main.js? HTTP/1.1Host: login.365file.techConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: cf_clearance=BNNmnB0.21i1a2zs0dzJf4GjoCB4BeK.nWzOHhruVRc-1734965511-1.2.1.1-9J4E9tAPbb8SCdUhsJceXJpmmRagVU2D4qqzr31gzR3AqAc_jZHN79_U2g_R__.gVcJmSKCkWxXZH.OKWdK6rX5XnvgwrifEOMoTMnXu_5KcIdxtoMTtBSP3BBFNLn5GxSyxQqHZkkKifjXCIaAQKQfxcDbo9AgKh6Rrg2Ms0JnSpw7.3O9Ds2U4728tb5XCfK0WpUVjq.hOOWJ8KFqW8Bfn_kzDlbGfce9wdnRoHgvl46veIkM9w.no3M2Jbqsse2LSP9_NlhHskIHUlt3.OfFm5vYE5b.qjnI8FWclFp9vW8IrZ26gmZAxkAIu74MbkeTgvNC8wEeTNMqE32ybGNTaK26DF_v1pY_ugAxekvShPxcY6QgJJePJ2cdpMTnn.rapv16_crmCNKYGpfaLQt.JKBXyv08R3I0wsPt0xoJaA0wYLd.gLe3tJt360abD; KmAT=56313130dd0d14b933a5516ed2cadc1c539b3efae52f454c4cc516ab8ea4c21b; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; esctx-NDj1gL61gzQ=AQABCQEAAADW6jl31mB3T7ugrWTT8pFeuWkNtOo4RtW9YQUmlp3AmhsWylx_-zhDOAyrMdcCjjamopW3jVcwBDQyQx5CXPNReuJ9qpSInAtzrcY83Ls8sWG8kI8Zlg5SQEzid7oR8QBSkqdXMjS3_yTPRGqF1K4pNlwCPw7-bB2jAvB9g7_2aSAA; AADSSO=NA|NoExtension; SSOCOOKIEPULLED=1; buid=1.AXwAMe_N-B6jSkuT5F9XHpElWltEZUfGMrBJg-Ydk3ZSdsoBAAB8AA.AQABGgEAAADW6jl31mB3T7ugrWTT8pFexG2aQZCQWXTOv-IVgPPOwrhOwR3VORb_Ti8AJVzYTygYUxTgUacUYnjzk7KuzL80PWGRIc90GFaYVUa990nU-aw8ZQO0Ci9lmLvWd-uA1l4gAA; esctx=PAQABBwEAAADW6jl31mB3T7ugrWTT8pFewx3kpKEA-5BxD8Xw2KP2AA9S6OK9ozXqvKoSG_p5CFuzuIIqXweFEqnMaQmVQel6ddi1l51mKiP2hsNKZ08oQp3VlhCU65dCmdD9t75HVRi90QLuSTVM51y02U4XfTtZ-mBpBwIgP23MJA0rudrO5pE-zpaBeaU8pXqf3DHb6MQgAA; esctx-rmheRu5exY=AQABCQEAAADW6jl31mB3T7ugrWTT8pFePgdYeXbxynAIMyjthjBDe74bZL_1xKY6PArl2FF1ig2AgRmbKWaySz3f-DUDVANkzH1OQJmf0KVufjKvWWYO2M1z0BaXA_QfYBs3XsDABza3a33OXIz1Q8rUmkPQKTDY1GoqG3XybkE3UaG6qhgjQiAA; fpc=AgixDrZbyBxEjMXxxDPE5kS8Ae7AAQAAAC1w-94OAAAA
Source: global traffic HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/scripts/jsd/787bc399e22f/main.js? HTTP/1.1Host: login.365file.techConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: KmAT=56313130dd0d14b933a5516ed2cadc1c539b3efae52f454c4cc516ab8ea4c21b; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; esctx-NDj1gL61gzQ=AQABCQEAAADW6jl31mB3T7ugrWTT8pFeuWkNtOo4RtW9YQUmlp3AmhsWylx_-zhDOAyrMdcCjjamopW3jVcwBDQyQx5CXPNReuJ9qpSInAtzrcY83Ls8sWG8kI8Zlg5SQEzid7oR8QBSkqdXMjS3_yTPRGqF1K4pNlwCPw7-bB2jAvB9g7_2aSAA; AADSSO=NA|NoExtension; SSOCOOKIEPULLED=1; buid=1.AXwAMe_N-B6jSkuT5F9XHpElWltEZUfGMrBJg-Ydk3ZSdsoBAAB8AA.AQABGgEAAADW6jl31mB3T7ugrWTT8pFexG2aQZCQWXTOv-IVgPPOwrhOwR3VORb_Ti8AJVzYTygYUxTgUacUYnjzk7KuzL80PWGRIc90GFaYVUa990nU-aw8ZQO0Ci9lmLvWd-uA1l4gAA; esctx=PAQABBwEAAADW6jl31mB3T7ugrWTT8pFewx3kpKEA-5BxD8Xw2KP2AA9S6OK9ozXqvKoSG_p5CFuzuIIqXweFEqnMaQmVQel6ddi1l51mKiP2hsNKZ08oQp3VlhCU65dCmdD9t75HVRi90QLuSTVM51y02U4XfTtZ-mBpBwIgP23MJA0rudrO5pE-zpaBeaU8pXqf3DHb6MQgAA; esctx-rmheRu5exY=AQABCQEAAADW6jl31mB3T7ugrWTT8pFePgdYeXbxynAIMyjthjBDe74bZL_1xKY6PArl2FF1ig2AgRmbKWaySz3f-DUDVANkzH1OQJmf0KVufjKvWWYO2M1z0BaXA_QfYBs3XsDABza3a33OXIz1Q8rUmkPQKTDY1GoqG3XybkE3UaG6qhgjQiAA; fpc=AgixDrZbyBxEjMXxxDPE5kS8Ae7AAQAAAC1w-94OAAAA
Source: global traffic HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/jsd/r/8f692cfaadd6de93 HTTP/1.1Host: login.365file.techConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: KmAT=56313130dd0d14b933a5516ed2cadc1c539b3efae52f454c4cc516ab8ea4c21b; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; esctx-NDj1gL61gzQ=AQABCQEAAADW6jl31mB3T7ugrWTT8pFeuWkNtOo4RtW9YQUmlp3AmhsWylx_-zhDOAyrMdcCjjamopW3jVcwBDQyQx5CXPNReuJ9qpSInAtzrcY83Ls8sWG8kI8Zlg5SQEzid7oR8QBSkqdXMjS3_yTPRGqF1K4pNlwCPw7-bB2jAvB9g7_2aSAA; AADSSO=NA|NoExtension; SSOCOOKIEPULLED=1; buid=1.AXwAMe_N-B6jSkuT5F9XHpElWltEZUfGMrBJg-Ydk3ZSdsoBAAB8AA.AQABGgEAAADW6jl31mB3T7ugrWTT8pFexG2aQZCQWXTOv-IVgPPOwrhOwR3VORb_Ti8AJVzYTygYUxTgUacUYnjzk7KuzL80PWGRIc90GFaYVUa990nU-aw8ZQO0Ci9lmLvWd-uA1l4gAA; esctx=PAQABBwEAAADW6jl31mB3T7ugrWTT8pFewx3kpKEA-5BxD8Xw2KP2AA9S6OK9ozXqvKoSG_p5CFuzuIIqXweFEqnMaQmVQel6ddi1l51mKiP2hsNKZ08oQp3VlhCU65dCmdD9t75HVRi90QLuSTVM51y02U4XfTtZ-mBpBwIgP23MJA0rudrO5pE-zpaBeaU8pXqf3DHb6MQgAA; esctx-rmheRu5exY=AQABCQEAAADW6jl31mB3T7ugrWTT8pFePgdYeXbxynAIMyjthjBDe74bZL_1xKY6PArl2FF1ig2AgRmbKWaySz3f-DUDVANkzH1OQJmf0KVufjKvWWYO2M1z0BaXA_QfYBs3XsDABza3a33OXIz1Q8rUmkPQKTDY1GoqG3XybkE3UaG6qhgjQiAA; fpc=AgixDrZbyBxEjMXxxDPE5kS8Ae7AAQAAAC1w-94OAAAA; MicrosoftApplicationsTelemetryDeviceId=17dc1c87-e7dd-43ce-8236-299458bc24f2; brcap=0
Source: global traffic HTTP traffic detected: GET /Me.htm?v=3 HTTP/1.1Host: ywnjb.365file.techConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://login.365file.tech/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: KmAT=56313130dd0d14b933a5516ed2cadc1c539b3efae52f454c4cc516ab8ea4c21b; uaid=2d486dd1a7744d3ab3c8d58ad7d20394; MSPRequ=id=N&lt=1734965552&co=1; cf_clearance=WziNiH6ygD4iqks4GG47gv1E1zwXcRzqQoNe2GBmnbE-1734965554-1.2.1.1-jsRPOeBNp8xVG4oXR6Yx2fteMWTVS_3X07jcGUsuwpWNcFPTuNbc.O4F_0y.2KKiY5eI1cq6lHYX7K4s8o7UDbN_6IJBwSsKYHD8pJSEx01GcwkVKRxJ7aQbpCGX.9BS34g8zsK6oPl9Y2kZ8Qlj.Do71dWxP8tgvGE0Psabhbj9H84AexyfAab99GRIdZyNZTwUV3PQz3l_oRn0hwC1od87ZtL.ZKBG6D3L88SFds.gGpLSXPLQ0CVlcXlqYH_JzvGJxX6HPcms5VgwKwaA9mXG6MSn8eaPapBMc_heaUVnopy12lET_YGkVbJxwLcN9K1NlTkdgGUNHoeUxBJUaGhCyI7fXCsGWs4rE78pBc8e9UQqCW3Qa3QaKoTce4uE8ps72KtaEQzW_CGLEeund.xqbXPlu5x1ec_nvjJPyOVr6LfdfqDdxuyjjLvRUUjR
Source: global traffic HTTP traffic detected: GET /common/GetCredentialType?mkt=en-US HTTP/1.1Host: login.365file.techConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: KmAT=56313130dd0d14b933a5516ed2cadc1c539b3efae52f454c4cc516ab8ea4c21b; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; esctx-NDj1gL61gzQ=AQABCQEAAADW6jl31mB3T7ugrWTT8pFeuWkNtOo4RtW9YQUmlp3AmhsWylx_-zhDOAyrMdcCjjamopW3jVcwBDQyQx5CXPNReuJ9qpSInAtzrcY83Ls8sWG8kI8Zlg5SQEzid7oR8QBSkqdXMjS3_yTPRGqF1K4pNlwCPw7-bB2jAvB9g7_2aSAA; AADSSO=NA|NoExtension; SSOCOOKIEPULLED=1; buid=1.AXwAMe_N-B6jSkuT5F9XHpElWltEZUfGMrBJg-Ydk3ZSdsoBAAB8AA.AQABGgEAAADW6jl31mB3T7ugrWTT8pFexG2aQZCQWXTOv-IVgPPOwrhOwR3VORb_Ti8AJVzYTygYUxTgUacUYnjzk7KuzL80PWGRIc90GFaYVUa990nU-aw8ZQO0Ci9lmLvWd-uA1l4gAA; esctx=PAQABBwEAAADW6jl31mB3T7ugrWTT8pFewx3kpKEA-5BxD8Xw2KP2AA9S6OK9ozXqvKoSG_p5CFuzuIIqXweFEqnMaQmVQel6ddi1l51mKiP2hsNKZ08oQp3VlhCU65dCmdD9t75HVRi90QLuSTVM51y02U4XfTtZ-mBpBwIgP23MJA0rudrO5pE-zpaBeaU8pXqf3DHb6MQgAA; esctx-rmheRu5exY=AQABCQEAAADW6jl31mB3T7ugrWTT8pFePgdYeXbxynAIMyjthjBDe74bZL_1xKY6PArl2FF1ig2AgRmbKWaySz3f-DUDVANkzH1OQJmf0KVufjKvWWYO2M1z0BaXA_QfYBs3XsDABza3a33OXIz1Q8rUmkPQKTDY1GoqG3XybkE3UaG6qhgjQiAA; fpc=AgixDrZbyBxEjMXxxDPE5kS8Ae7AAQAAAC1w-94OAAAA; MicrosoftApplicationsTelemetryDeviceId=17dc1c87-e7dd-43ce-8236-299458bc24f2; brcap=0; ai_session=SG3pOSDJKRvDJcC5tUcpSy|1734965559344|1734965559344
Source: global traffic HTTP traffic detected: GET /iamgold.com/winauth/ssoprobe?client-request-id=2268d124-c00f-4338-9556-dd594fce6a57&_=1734965562446 HTTP/1.1Host: autologon.microsoftazuread-sso.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://login.365file.tech/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /common/instrumentation/dssostatus HTTP/1.1Host: login.365file.techConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: KmAT=56313130dd0d14b933a5516ed2cadc1c539b3efae52f454c4cc516ab8ea4c21b; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; esctx-NDj1gL61gzQ=AQABCQEAAADW6jl31mB3T7ugrWTT8pFeuWkNtOo4RtW9YQUmlp3AmhsWylx_-zhDOAyrMdcCjjamopW3jVcwBDQyQx5CXPNReuJ9qpSInAtzrcY83Ls8sWG8kI8Zlg5SQEzid7oR8QBSkqdXMjS3_yTPRGqF1K4pNlwCPw7-bB2jAvB9g7_2aSAA; AADSSO=NA|NoExtension; SSOCOOKIEPULLED=1; buid=1.AXwAMe_N-B6jSkuT5F9XHpElWltEZUfGMrBJg-Ydk3ZSdsoBAAB8AA.AQABGgEAAADW6jl31mB3T7ugrWTT8pFexG2aQZCQWXTOv-IVgPPOwrhOwR3VORb_Ti8AJVzYTygYUxTgUacUYnjzk7KuzL80PWGRIc90GFaYVUa990nU-aw8ZQO0Ci9lmLvWd-uA1l4gAA; esctx=PAQABBwEAAADW6jl31mB3T7ugrWTT8pFewx3kpKEA-5BxD8Xw2KP2AA9S6OK9ozXqvKoSG_p5CFuzuIIqXweFEqnMaQmVQel6ddi1l51mKiP2hsNKZ08oQp3VlhCU65dCmdD9t75HVRi90QLuSTVM51y02U4XfTtZ-mBpBwIgP23MJA0rudrO5pE-zpaBeaU8pXqf3DHb6MQgAA; esctx-rmheRu5exY=AQABCQEAAADW6jl31mB3T7ugrWTT8pFePgdYeXbxynAIMyjthjBDe74bZL_1xKY6PArl2FF1ig2AgRmbKWaySz3f-DUDVANkzH1OQJmf0KVufjKvWWYO2M1z0BaXA_QfYBs3XsDABza3a33OXIz1Q8rUmkPQKTDY1GoqG3XybkE3UaG6qhgjQiAA; fpc=AgixDrZbyBxEjMXxxDPE5kS8Ae7AAQAAAC1w-94OAAAA; MicrosoftApplicationsTelemetryDeviceId=17dc1c87-e7dd-43ce-8236-299458bc24f2; brcap=0; ai_session=SG3pOSDJKRvDJcC5tUcpSy|1734965559344|1734965559344; MSFPC=GUID=c42d33f0017949b5ba853992215f1505&HASH=c42d&LV=202412&V=4&LU=1734965567178
Source: global traffic DNS traffic detected: DNS query: google.com
Source: global traffic DNS traffic detected: DNS query: www.google.com
Source: global traffic DNS traffic detected: DNS query: salesboost.com
Source: global traffic DNS traffic detected: DNS query: login.365file.tech
Source: global traffic DNS traffic detected: DNS query: a.nel.cloudflare.com
Source: global traffic DNS traffic detected: DNS query: challenges.cloudflare.com
Source: global traffic DNS traffic detected: DNS query: www.365file.tech
Source: global traffic DNS traffic detected: DNS query: aadcdn.msftauth.net
Source: global traffic DNS traffic detected: DNS query: ywnjb.365file.tech
Source: global traffic DNS traffic detected: DNS query: autologon.microsoftazuread-sso.com
Source: global traffic DNS traffic detected: DNS query: aadcdn.msauthimages.net
Source: unknown HTTP traffic detected: POST /report/v4?s=Gi4947HrZfi9o1Ieftj0Ps5vDl%2F%2FdY8bfUKmop6%2FnbWEJQRIbqfHOVaYP%2FRf64yMeubajum%2BQF%2BJZIAaRxd2JoschL%2FQlPUIAqnrsLHeUOXW%2FcSKRnYRdKm%2BrvHI2VNOHDxKuA%3D%3D HTTP/1.1Host: a.nel.cloudflare.comConnection: keep-aliveContent-Length: 397Content-Type: application/reports+jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Mon, 23 Dec 2024 14:51:45 GMTContent-Type: text/html; charset=UTF-8Content-Length: 9043Connection: closeAccept-CH: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UACritical-CH: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UACross-Origin-Embedder-Policy: require-corpCross-Origin-Opener-Policy: same-originCross-Origin-Resource-Policy: same-originOrigin-Agent-Cluster: ?1Permissions-Policy: accelerometer=(),autoplay=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()Referrer-Policy: same-originX-Content-Options: nosniffX-Frame-Options: SAMEORIGINcf-mitigated: challenge
Source: global traffic HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Mon, 23 Dec 2024 14:51:51 GMTContent-Type: text/html; charset=UTF-8Content-Length: 9213Connection: closeAccept-CH: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UACritical-CH: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UACross-Origin-Embedder-Policy: require-corpCross-Origin-Opener-Policy: same-originCross-Origin-Resource-Policy: same-originOrigin-Agent-Cluster: ?1Permissions-Policy: accelerometer=(),autoplay=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()Referrer-Policy: same-originX-Content-Options: nosniffX-Frame-Options: SAMEORIGINcf-mitigated: challenge
Source: global traffic HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Mon, 23 Dec 2024 14:51:56 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeCF-Cache-Status: BYPASSReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=3Qbi7IajjU6MJ11HRBHSO8kmFUsMnMUv6HUBuZoD4o6oVvxzYKvAC0kE1Koi4CTT%2BaeG4tu4%2F6X0%2FbLYlPHSmoWiAn4lUn8VN3sbyABma7mBhzilx7h0ZovLQ5tWUIZnsbqNCg%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8f692c2a7f474346-EWRserver-timing: cfL4;desc="?proto=TCP&rtt=2251&min_rtt=2211&rtt_var=858&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2846&recv_bytes=1450&delivery_rate=1320669&cwnd=252&unsent_bytes=0&cid=27f072150eda4221&ts=631&x=0"
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 23 Dec 2024 14:51:57 GMTContent-Type: application/jsonContent-Length: 7Connection: closecf-chl-out: 3rbSRRwrEwpkQp47W8YTRPI2fbsqCAvrrS8=$l++cRkOkoaa3o2Cqcache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=GYwMow9NdFRzOKHBLt1IjdPKrzOpcJVvymMGVHkwJgUFRZESXNhW45zLqCRHgYK0u4eS%2BsJdoT%2FiIHx25pnD0NijPA6srxA5rqfPNCEvHufQV3jv05muToZyVcl%2BBoXRZVH%2BzA%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8f692c3448df72a4-EWRserver-timing: cfL4;desc="?proto=TCP&rtt=2039&min_rtt=2025&rtt_var=788&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2845&recv_bytes=1169&delivery_rate=1365123&cwnd=212&unsent_bytes=0&cid=a52a20ca0b1313d5&ts=448&x=0"
Source: global traffic HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Mon, 23 Dec 2024 14:52:02 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeCF-Cache-Status: BYPASSReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2dp2uQpfZ4RF3C8WBjHbWItO3EGYM2kZM48jIYjbO05yBIMayKyRB7j8unZJsbp%2F42TfRpo635f7%2Fng54gLpWEFqAGTs9S%2FrB5JOJJA4DrFBmSlWsBU406sJzmNK2sMcInuz3A%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8f692c51ae8643a3-EWRserver-timing: cfL4;desc="?proto=TCP&rtt=1873&min_rtt=1871&rtt_var=706&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2845&recv_bytes=1450&delivery_rate=1546610&cwnd=223&unsent_bytes=0&cid=0844cd3d05cdbc23&ts=697&x=0"
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 23 Dec 2024 14:52:04 GMTContent-Type: application/jsonContent-Length: 7Connection: closecache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0cf-chl-out: sG8TBoeqNB3avW9qn6epzKJ3UivvXhlK7Bw=$DpStIYQeY5GvBIQvServer: cloudflareCF-RAY: 8f692c5feb170cae-EWRalt-svc: h3=":443"; ma=86400
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 23 Dec 2024 14:52:10 GMTContent-Type: application/jsonContent-Length: 7Connection: closecf-chl-out: kS/MklzXfK90qyXp94SCWsqJ5kji1N3z0lo=$LpUqlypP1WUk9oN2cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0Server: cloudflareCF-RAY: 8f692c833b494268-EWRalt-svc: h3=":443"; ma=86400
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 23 Dec 2024 14:52:15 GMTContent-Type: application/jsonContent-Length: 7Connection: closecache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0cf-chl-out: Iu0wC3RqSHjXcLkRAbKf1rmgmznAMstJN2c=$g0yd0j+VFgG5v2hnServer: cloudflareCF-RAY: 8f692ca75f2419aa-EWRalt-svc: h3=":443"; ma=86400
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 23 Dec 2024 14:52:17 GMTContent-Type: application/jsonContent-Length: 7Connection: closecache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0cf-chl-out: desMwC8NGAwB1lpAiC8EcDY0yKhuqkpmg6E=$CzqW1wnJNyq5ZCAmReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=n%2BpkLfYA0ppX%2BtpuZED%2FAK4SNviZsZZLUw7zpmjMxo%2FIgBnJ2cZDMpydNTcFFWfdA6f3iWxxzw3PbQQgFR7j%2BJR43OVmONnY6SDVloJNTNNAo3jzbMcowlwe%2FUSC8VCu2BBdrg%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8f692cb23d7b43af-EWRserver-timing: cfL4;desc="?proto=TCP&rtt=2592&min_rtt=2569&rtt_var=980&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2845&recv_bytes=1169&delivery_rate=1136629&cwnd=230&unsent_bytes=0&cid=f9a7476a27e72c90&ts=453&x=0"
Source: global traffic HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Mon, 23 Dec 2024 14:52:17 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeCF-Cache-Status: BYPASSReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Y2pdMPKvQJyKGv1H%2F%2Fa6qfhl8IOkA5xq5sv0LsXTKpRrFrSmlrB8MLllD7UgR9GMUDBDeZsYCE5EQdOpQ7hfwvdbyE10EvJcm%2FZudWixEaRw0qcnaOQLlCndUkU35Q51deyWRg%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8f692cb2fd1743d0-EWRserver-timing: cfL4;desc="?proto=TCP&rtt=1748&min_rtt=1736&rtt_var=676&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2846&recv_bytes=1591&delivery_rate=1587819&cwnd=181&unsent_bytes=0&cid=e851b80f084809fa&ts=730&x=0"
Source: global traffic HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Mon, 23 Dec 2024 14:52:44 GMTContent-Type: text/html; charset=UTF-8Content-Length: 10148Connection: closeAccept-CH: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UACritical-CH: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UACross-Origin-Embedder-Policy: require-corpCross-Origin-Opener-Policy: same-originCross-Origin-Resource-Policy: same-originOrigin-Agent-Cluster: ?1Permissions-Policy: accelerometer=(),autoplay=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()Referrer-Policy: same-originX-Content-Options: nosniffX-Frame-Options: SAMEORIGINcf-mitigated: challenge
Source: global traffic HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Mon, 23 Dec 2024 14:52:49 GMTContent-Type: text/html; charset=UTF-8Content-Length: 10233Connection: closeAccept-CH: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UACritical-CH: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UACross-Origin-Embedder-Policy: require-corpCross-Origin-Opener-Policy: same-originCross-Origin-Resource-Policy: same-originOrigin-Agent-Cluster: ?1Permissions-Policy: accelerometer=(),autoplay=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()Referrer-Policy: same-originX-Content-Options: nosniffX-Frame-Options: SAMEORIGINcf-mitigated: challenge
Source: chromecache_241.7.dr, chromecache_274.7.dr String found in binary or memory: https://login.365file.tech
Source: chromecache_241.7.dr, chromecache_274.7.dr String found in binary or memory: https://login.windows-ppe.net
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown Network traffic detected: HTTP traffic on port 49856 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49833 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49810 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49811
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49810
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49809
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49808
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49806
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49803
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49802
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49800
Source: unknown Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49857 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49854 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49809 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49843 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49792 -> 443
Document contains embedded VBA macros
Source: CatalogCacheMetaData.xml.0.dr OLE indicator, VBA macros: true
Source: 0E31D59D-7275-4D07-A5C4-416FA6F7F869.0.dr OLE indicator, VBA macros: true
Document misses a certain OLE stream usually present in this Microsoft Office document type
Source: CatalogCacheMetaData.xml.0.dr OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: 0E31D59D-7275-4D07-A5C4-416FA6F7F869.0.dr OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: classification engine Classification label: mal64.phis.winPPTX@20/294@32/11
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE File created: C:\Users\user\AppData\Roaming\Microsoft\PowerPoint Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE File created: C:\Users\user\AppData\Local\Temp\{D29EDC9C-05D7-4422-9E4E-DB7CF31D8F9D} - OProcSessId.dat Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE File read: C:\Users\desktop.ini Jump to behavior
Source: unknown Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\POWERPNT.EXE" "C:\Users\user\Desktop\Payout Receipts.pptx" /ou ""
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE Process created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "B03D092F-7F5E-4048-ACB1-F88BD33C4817" "ED1F2C40-EE04-44CB-AC33-81F3E7A49921" "7016" "C:\Program Files (x86)\Microsoft Office\Root\Office16\POWERPNT.EXE" "PowerPointCombinedFloatieLreOnline.onnx"
Source: unknown Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://google.com/amp/s/salesboost.com/jf#jennifer_wylie@iamgold.com
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2088 --field-trial-handle=1984,i,3837776693754288343,2079191398212795825,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE Process created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "B03D092F-7F5E-4048-ACB1-F88BD33C4817" "ED1F2C40-EE04-44CB-AC33-81F3E7A49921" "7016" "C:\Program Files (x86)\Microsoft Office\Root\Office16\POWERPNT.EXE" "PowerPointCombinedFloatieLreOnline.onnx" Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2088 --field-trial-handle=1984,i,3837776693754288343,2079191398212795825,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe Section loaded: c2r64.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe Section loaded: gpapi.dll Jump to behavior
Source: Payout Receipts.LNK.0.dr LNK file: ..\..\..\..\..\Desktop\Payout Receipts.pptx
Source: Google Drive.lnk.6.dr LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.6.dr LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.6.dr LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.6.dr LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.6.dr LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.6.dr LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Common Jump to behavior
Stores files to the Windows start menu directory
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE Process information queried: ProcessInformation Jump to behavior
Queries the volume information (name, serial number etc) of a device
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe Queries volume information: C:\Program Files (x86)\Microsoft Office\root\Office16\AI\PowerPointCombinedFloatieLreOnline.onnx VolumeInformation Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1579932 Sample: Payout Receipts.pptx Startdate: 23/12/2024 Architecture: WINDOWS Score: 64 28 AI detected phishing page 2->28 30 Yara detected HtmlPhish54 2->30 32 AI detected suspicious Javascript 2->32 34 AI detected landing page (webpage, office document or email) 2->34 6 chrome.exe 9 2->6         started        9 POWERPNT.EXE 275 381 2->9         started        process3 dnsIp4 16 192.168.2.16, 138, 443, 49456 unknown unknown 6->16 18 192.168.2.4 unknown unknown 6->18 20 239.255.255.250 unknown Reserved 6->20 11 chrome.exe 6->11         started        14 ai.exe 9->14         started        process5 dnsIp6 22 autologon.microsoftazuread-sso.com 20.190.147.9, 443, 49850 MICROSOFT-CORP-MSN-AS-BLOCKUS United States 11->22 24 www.google.com 172.217.21.36, 443, 49709, 49722 GOOGLEUS United States 11->24 26 14 other IPs or domains 11->26
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
104.18.94.41
 challenges.cloudflare.com United States
13335 CLOUDFLARENETUS false
172.67.69.206
 www.365file.tech United States
13335 CLOUDFLARENETUS false
104.26.13.241
 ywnjb.365file.tech United States
13335 CLOUDFLARENETUS false
172.217.21.36
 www.google.com United States
15169 GOOGLEUS false
35.190.80.1
 a.nel.cloudflare.com United States
15169 GOOGLEUS false
20.190.147.9
 autologon.microsoftazuread-sso.com United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
104.18.95.41
 unknown United States
13335 CLOUDFLARENETUS false
52.89.58.139
 salesboost.com United States
16509 AMAZON-02US false
239.255.255.250
 unknown Reserved
unknown unknown false

Private

IP
192.168.2.16
192.168.2.4

Contacted Domains

Name IP Active
google.com 172.217.17.46 true
a.nel.cloudflare.com 35.190.80.1 true
www.365file.tech 172.67.69.206 true
challenges.cloudflare.com 104.18.94.41 true
sni1gl.wpc.omegacdn.net 152.199.21.175 true
www.google.com 172.217.21.36 true
salesboost.com 52.89.58.139 true
s-part-0035.t-0009.t-msedge.net 13.107.246.63 true
login.365file.tech 172.67.69.206 true
ywnjb.365file.tech 104.26.13.241 true
autologon.microsoftazuread-sso.com 20.190.147.9 true
aadcdn.msauthimages.net unknown unknown
aadcdn.msftauth.net unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
https://login.365file.tech/realm?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638705623427189137.ZjMxMzIyN2QtMGE3OC00NmM0LWE1MTUtZjIyOTAzNTFjOTNiMGY1ZDEyMTItODRlOC00ZDFiLWE1OTgtZDM3NTVkYzdlMTBh&ui_locales=en-US&mkt=en-US&client-request-id=2268d124-c00f-4338-9556-dd594fce6a57&state=tvii8EXN8vdyOmZPlmgT2ozXVAsKp5O-DVucGpacp0IskL2Bo9JmytF2a-VC6Z39FKl9fed1eRAF_O8X76DyfIJy5OI8lywMpfjKpViMqKuqVoEfpn8yNcfA390oWj8P6ISNSshBJ3f0qT1W6s3evXnNQHjODWy4hzgRj6ngKoLWn5QmSBT_NySCp-LH9nKEsj-vPZ3i4dnyd2GcEnv_hQ3OKEM1EG-x5pK1vMcuNP-G0aw83WQEv9wk8aAaP-03Qil3P1TyVDr0dx5hbxf5kA&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0 false
  • Avira URL Cloud: safe
 unknown
https://login.365file.tech/cdn-cgi/challenge-platform/scripts/jsd/main.js false
  • Avira URL Cloud: safe
 unknown
https://a.nel.cloudflare.com/report/v4?s=1fl16mbZGN4L%2BC0lQwIqaWE09wsbmfG0slCTbNhFwn%2FKL59MKSXOm5BohzorvipWbyXjZ9zWXZZw0%2Bl5UtAcKpAWyL3SP1gKL2jdzjEBaiAP5UiL1ZgP%2BmILzfInOQe02uGQOw%3D%3D false
    		high
    https://login.365file.tech/RKiKvqBc false
    • Avira URL Cloud: safe
    		 unknown
    https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/i/8f692c38cb37c43b/1734965522353/HWsekBJnYLOyFP0 false
      		high
      https://login.365file.tech/ true
      • Avira URL Cloud: safe
      		 unknown
      https://autologon.microsoftazuread-sso.com/iamgold.com/winauth/ssoprobe?client-request-id=2268d124-c00f-4338-9556-dd594fce6a57&_=1734965562446 false
        		high
        https://salesboost.com/jf/ false
        • Avira URL Cloud: safe
        		 unknown
        https://login.365file.tech/favicon.ico false
        • Avira URL Cloud: safe
        		 unknown
        https://ywnjb.365file.tech/Me.htm?v=3 false
        • Avira URL Cloud: safe
        		 unknown
        https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/cmg/1 false
          		high
          https://login.365file.tech/common/GetCredentialType?mkt=en-US false
          • Avira URL Cloud: safe
          		 unknown
          https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/pat/8f692c38cb37c43b/1734965522352/7339b7655fb87e4c59a48d975d045630c30639ee310f0ebce0dfc6e6e6ed9473/43Aan-x4BPJpSgM false
            		high
            https://login.365file.tech/realm?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638705623427189137.ZjMxMzIyN2QtMGE3OC00NmM0LWE1MTUtZjIyOTAzNTFjOTNiMGY1ZDEyMTItODRlOC00ZDFiLWE1OTgtZDM3NTVkYzdlMTBh&ui_locales=en-US&mkt=en-US&client-request-id=2268d124-c00f-4338-9556-dd594fce6a57&state=tvii8EXN8vdyOmZPlmgT2ozXVAsKp5O-DVucGpacp0IskL2Bo9JmytF2a-VC6Z39FKl9fed1eRAF_O8X76DyfIJy5OI8lywMpfjKpViMqKuqVoEfpn8yNcfA390oWj8P6ISNSshBJ3f0qT1W6s3evXnNQHjODWy4hzgRj6ngKoLWn5QmSBT_NySCp-LH9nKEsj-vPZ3i4dnyd2GcEnv_hQ3OKEM1EG-x5pK1vMcuNP-G0aw83WQEv9wk8aAaP-03Qil3P1TyVDr0dx5hbxf5kA&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0#jennifer_wylie@iamgold.com false
              		unknown
              https://login.365file.tech/cdn-cgi/challenge-platform/h/b/scripts/jsd/787bc399e22f/main.js? false
              • Avira URL Cloud: safe
              		 unknown
              https://login.365file.tech/cdn-cgi/challenge-platform/h/b/jsd/r/8f692cfaadd6de93 false
              • Avira URL Cloud: safe
              		 unknown
              https://login.365file.tech/realm?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638705623427189137.ZjMxMzIyN2QtMGE3OC00NmM0LWE1MTUtZjIyOTAzNTFjOTNiMGY1ZDEyMTItODRlOC00ZDFiLWE1OTgtZDM3NTVkYzdlMTBh&ui_locales=en-US&mkt=en-US&client-request-id=2268d124-c00f-4338-9556-dd594fce6a57&state=tvii8EXN8vdyOmZPlmgT2ozXVAsKp5O-DVucGpacp0IskL2Bo9JmytF2a-VC6Z39FKl9fed1eRAF_O8X76DyfIJy5OI8lywMpfjKpViMqKuqVoEfpn8yNcfA390oWj8P6ISNSshBJ3f0qT1W6s3evXnNQHjODWy4hzgRj6ngKoLWn5QmSBT_NySCp-LH9nKEsj-vPZ3i4dnyd2GcEnv_hQ3OKEM1EG-x5pK1vMcuNP-G0aw83WQEv9wk8aAaP-03Qil3P1TyVDr0dx5hbxf5kA&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0&sso_reload=true false
              • Avira URL Cloud: safe
              		 unknown
              https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/flow/ov1/59012872:1734963193:dJWEVcwbrnL1TTil6YmxbJ4SlF5pcoUWsQBeHspz6pg/8f692c38cb37c43b/vxu2uxafbM96ucUzDK4INX7dCY8HEjZkkcnYJbZchuI-1734965518-1.1.1.1-Eh2ysBkS1kMovo4eqQXf9rKEAPgIZYIJhkH0RyZFQodz6oLCEt8BZW60dk029qUW false
                		high
                https://www.google.com/amp/s/salesboost.com/jf false
                  		high
                  https://a.nel.cloudflare.com/report/v4?s=Gi4947HrZfi9o1Ieftj0Ps5vDl%2F%2FdY8bfUKmop6%2FnbWEJQRIbqfHOVaYP%2FRf64yMeubajum%2BQF%2BJZIAaRxd2JoschL%2FQlPUIAqnrsLHeUOXW%2FcSKRnYRdKm%2BrvHI2VNOHDxKuA%3D%3D false
                    		high
                    https://salesboost.com/jf false
                    • Avira URL Cloud: safe
                    		 unknown
                    https://login.365file.tech/cdn-cgi/challenge-platform/h/b/orchestrate/chl_page/v1?ray=8f692c10de854314 false
                    • Avira URL Cloud: safe
                    		 unknown
                    https://login.365file.tech/cdn-cgi/challenge-platform/h/b/flow/ov1/737265407:1734963256:v--qV6PRwMGnawi4djvFIfSHLRJhT5kPAgN_50_G6Z4/8f692c10de854314/TOGNyk6aUIk0aC21kLKjtzNEZhHS8WCD.p47H0GGFwc-1734965511-1.2.1.1-7sDAwg8cay2RCE3vybEEKXLSGgaICCttt2YuZIwFInu4e3r4yVRObJ1QXzXyeYKi false
                    • Avira URL Cloud: safe
                    		 unknown
                    https://login.365file.tech/common/instrumentation/dssostatus false
                    • Avira URL Cloud: safe
                    		 unknown
                    https://login.365file.tech/RKiKvqBc#jennifer_wylie@iamgold.com false
                      		unknown
                      https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv/99bnk/0x4AAAAAAADnPIDROrmt1Wwj/light/fbE/normal/auto/ false
                        		high
                        https://a.nel.cloudflare.com/report/v4?s=WmgreJCzr0OhAa%2BUePNmLDzkZpGA%2B8fFMsUmNarKdgD4Fd6OzX0lNRlseI4uIuNV%2BgML3cRdbqW%2B%2F%2FK5zo8C6mhLybSzH6SwbodfQog3BE%2Bso%2FKAjb0uStxNEWkpyigyDgnR3g%3D%3D false
                          		high
                          https://login.365file.tech/realm?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638705623427189137.ZjMxMzIyN2QtMGE3OC00NmM0LWE1MTUtZjIyOTAzNTFjOTNiMGY1ZDEyMTItODRlOC00ZDFiLWE1OTgtZDM3NTVkYzdlMTBh&ui_locales=en-US&mkt=en-US&client-request-id=2268d124-c00f-4338-9556-dd594fce6a57&state=tvii8EXN8vdyOmZPlmgT2ozXVAsKp5O-DVucGpacp0IskL2Bo9JmytF2a-VC6Z39FKl9fed1eRAF_O8X76DyfIJy5OI8lywMpfjKpViMqKuqVoEfpn8yNcfA390oWj8P6ISNSshBJ3f0qT1W6s3evXnNQHjODWy4hzgRj6ngKoLWn5QmSBT_NySCp-LH9nKEsj-vPZ3i4dnyd2GcEnv_hQ3OKEM1EG-x5pK1vMcuNP-G0aw83WQEv9wk8aAaP-03Qil3P1TyVDr0dx5hbxf5kA&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0&sso_reload=true#jennifer_wylie@iamgold.com= true
                            		unknown
                            https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/orchestrate/chl_api/v1?ray=8f692c38cb37c43b&lang=auto false
                              		high
                              https://www.365file.tech/login false
                              • Avira URL Cloud: safe
                              		 unknown