Edit tour

Windows Analysis Report
Payout Receipts.pptx

Overview

General Information

Sample name:	Payout Receipts.pptx
Analysis ID:	1579932
MD5:	0e0b49b01a6738d8431c5869d4acf5fe
SHA1:	67db202829294ad5280e0b19d885f730217817e0
SHA256:	02caa19967116536da9e63ac39b4022fb566e4a12877822cf85061bdf356ad43
Infos:

Detection

HTMLPhisher

Score:	64
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

AI detected phishing page

Yara detected HtmlPhish54

AI detected landing page (webpage, office document or email)

AI detected suspicious Javascript

Detected hidden input values containing email addresses (often used in phishing pages)

Detected suspicious crossdomain redirect

Document contains embedded VBA macros

Document misses a certain OLE stream usually present in this Microsoft Office document type

HTML body contains low number of good links

HTML page contains hidden javascript code

HTML title does not match URL

IP address seen in connection with other malware

Queries the volume information (name, serial number etc) of a device

Stores files to the Windows start menu directory

Classification

Process Tree

System is w10x64_ra

POWERPNT.EXE (PID: 7016 cmdline: "C:\Program Files (x86)\Microsoft Office\Root\Office16\POWERPNT.EXE" "C:\Users\user\Desktop\Payout Receipts.pptx" /ou "" MD5: 2A43FE7F9F699F7F53FEBC254F68F46D)

ai.exe (PID: 7164 cmdline: "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "B03D092F-7F5E-4048-ACB1-F88BD33C4817" "ED1F2C40-EE04-44CB-AC33-81F3E7A49921" "7016" "C:\Program Files (x86)\Microsoft Office\Root\Office16\POWERPNT.EXE" "PowerPointCombinedFloatieLreOnline.onnx" MD5: EC652BEDD90E089D9406AFED89A8A8BD)

chrome.exe (PID: 6696 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://google.com/amp/s/salesboost.com/jf#jennifer_wylie@iamgold.com MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 3348 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2088 --field-trial-handle=1984,i,3837776693754288343,2079191398212795825,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Yara Signatures

HTML

Source	Rule	Description	Author
0.11.i.script.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security
0.7.id.script.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security
0.21.i.script.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security
3.5.pages.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security
4.7.pages.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security
4.9.pages.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security
4.8.pages.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security
4.11.pages.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security
Click to see the 3 entries

Source: https://login.365file.tech/realm?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638705623427189137.ZjMxMzIyN2QtMGE3OC00NmM0LWE1MTUtZjIyOTAzNTFjOTNiMGY1ZDEyMTItODRlOC00ZDFiLWE1OTgtZDM3NTVkYzdlMTBh&ui_locales=en-US&mkt=en-US&client-request-id=2268d124-c00f-4338-9556-dd594fce6a57&state=tvii8EXN8vdyOmZPlmgT2ozXVAsKp5O-DVucGpacp0IskL2Bo9JmytF2a-VC6Z39FKl9fed1eRAF_O8X76DyfIJy5OI8lywMpfjKpViMqKuqVoEfpn8yNcfA390oWj8P6ISNSshBJ3f0qT1W6s3evXnNQHjODWy4hzgRj6ngKoLWn5QmSBT_NySCp-LH9nKEsj-vPZ3i4dnyd2GcEnv_hQ3OKEM1EG-x5pK1vMcuNP-G0aw83WQEv9wk8aAaP-03Qil3P1TyVDr0dx5hbxf5kA&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0&sso_reload=true#jennifer_wylie@iamgold.com=

Joe Sandbox AI: Score: 9 Reasons: The brand 'Iamgold' is a known mining company with a legitimate domain likely being 'iamgold.com'., The URL 'login.365file.tech' does not match the legitimate domain associated with Iamgold., The domain '365file.tech' is unrelated to the known brand 'Iamgold' and uses a generic tech domain extension, which is suspicious., The presence of a login page with a password field on an unrelated domain is a common phishing tactic. DOM: 4.11.pages.csv

Yara detected HtmlPhish54

Source: Yara match	File source: 0.11.i.script.csv, type: HTML
Source: Yara match	File source: 0.7.id.script.csv, type: HTML
Source: Yara match	File source: 0.21.i.script.csv, type: HTML
Source: Yara match	File source: 3.5.pages.csv, type: HTML
Source: Yara match	File source: 4.7.pages.csv, type: HTML
Source: Yara match	File source: 4.9.pages.csv, type: HTML
Source: Yara match	File source: 4.8.pages.csv, type: HTML
Source: Yara match	File source: 4.11.pages.csv, type: HTML

AI detected landing page (webpage, office document or email)

Source: Screenshot id: 2	Joe Sandbox AI: Page contains button: 'Kindly Authenticate the QR code above to access your document and approve receipt' Source: 'Screenshot id: 2'
Source: Screenshot id: 2	Joe Sandbox AI: Screenshot id: 2 contains QR code

AI detected suspicious Javascript

Source: 0.25.id.script.csv	Joe Sandbox AI: Detected suspicious JavaScript with source url: https://login.365file.tech/realm?client_id=4765445... This script demonstrates several high-risk behaviors, including redirecting the user to an unknown domain and potentially collecting sensitive information (session ID) without transparency. The use of obfuscated code and the attempt to prevent the script from running in an iframe context further raise suspicions about the script's intent. While the script may have a legitimate purpose, the overall behavior and lack of transparency suggest a medium to high risk level that warrants further investigation.
Source: 0.16.id.script.csv	Joe Sandbox AI: Detected suspicious JavaScript with source url: https://login.365file.tech/realm?client_id=4765445... This script exhibits several high-risk behaviors, including data exfiltration and redirects to suspicious domains. The use of obfuscated URLs and the presence of multiple fallback domains further increase the risk. While some of the behavior may be related to legitimate functionality, the overall risk profile is high and warrants further investigation.
Source: 0.14.id.script.csv	Joe Sandbox AI: Detected suspicious JavaScript with source url: https://login.365file.tech/realm?client_id=4765445... This script demonstrates several high-risk behaviors, including dynamic code execution, data exfiltration, and redirects to potentially malicious domains. The use of an iframe to load additional scripts and the obfuscated nature of the code further increase the risk. While the script may have a legitimate purpose, such as implementing a security challenge, the overall behavior is highly suspicious and indicative of potential malicious intent.
Source: 0.24.id.script.csv	Joe Sandbox AI: Detected suspicious JavaScript with source url: https://login.365file.tech/realm?client_id=4765445... This script demonstrates several high-risk behaviors, including dynamic code execution, data exfiltration, and redirects to potentially malicious domains. The use of an iframe to load additional scripts and the obfuscated nature of the code further increase the risk. While the script may have a legitimate purpose, such as implementing a security challenge, the overall behavior is highly suspicious and indicative of potential malicious intent.

HTTP Parser: jennifer_wylie@iamgold.com

Source: https://login.365file.tech/realm?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638705623427189137.ZjMxMzIyN2QtMGE3OC00NmM0LWE1MTUtZjIyOTAzNTFjOTNiMGY1ZDEyMTItODRlOC00ZDFiLWE1OTgtZDM3NTVkYzdlMTBh&ui_locales=en-US&mkt=en-US&client-request-id=2268d124-c00f-4338-9556-dd594fce6a57&state=tvii8EXN8vdyOmZPlmgT2ozXVAsKp5O-DVucGpacp0IskL2Bo9JmytF2a-VC6Z39FKl9fed1eRAF_O8X76DyfIJy5OI8lywMpfjKpViMqKuqVoEfpn8yNcfA390oWj8P6ISNSshBJ3f0qT1W6s3evXnNQHjODWy4hzgRj6ngKoLWn5QmSBT_NySCp-LH9nKEsj-vPZ3i4dnyd2GcEnv_hQ3OKEM1EG-x5pK1vMcuNP-G0aw83WQEv9wk8aAaP-03Qil3P1TyVDr0dx5hbxf5kA&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0#jennifer_wylie@iamgold.com	HTTP Parser: Number of links: 0
Source: https://login.365file.tech/realm?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638705623427189137.ZjMxMzIyN2QtMGE3OC00NmM0LWE1MTUtZjIyOTAzNTFjOTNiMGY1ZDEyMTItODRlOC00ZDFiLWE1OTgtZDM3NTVkYzdlMTBh&ui_locales=en-US&mkt=en-US&client-request-id=2268d124-c00f-4338-9556-dd594fce6a57&state=tvii8EXN8vdyOmZPlmgT2ozXVAsKp5O-DVucGpacp0IskL2Bo9JmytF2a-VC6Z39FKl9fed1eRAF_O8X76DyfIJy5OI8lywMpfjKpViMqKuqVoEfpn8yNcfA390oWj8P6ISNSshBJ3f0qT1W6s3evXnNQHjODWy4hzgRj6ngKoLWn5QmSBT_NySCp-LH9nKEsj-vPZ3i4dnyd2GcEnv_hQ3OKEM1EG-x5pK1vMcuNP-G0aw83WQEv9wk8aAaP-03Qil3P1TyVDr0dx5hbxf5kA&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0&sso_reload=true#jennifer_wylie@iamgold.com=	HTTP Parser: Number of links: 0

Source: https://login.365file.tech/RKiKvqBc?__cf_chl_rt_tk=SEq5GNYqsowTxv8ShnxKjM6RPUYPhJRVImxgPi0yQa8-1734965511-1.0.1.1-NdBax4MXpJ7qwL2gT0Md8Vf6yl9tXWWcv8VncP5jHPo#jennifer_wylie@iamgold.com

HTTP Parser: Base64 decoded: <svg xmlns="http://www.w3.org/2000/svg" width="32" height="32" fill="none"><path fill="#B20F03" d="M16 3a13 13 0 1 0 13 13A13.015 13.015 0 0 0 16 3m0 24a11 11 0 1 1 11-11 11.01 11.01 0 0 1-11 11"/><path fill="#B20F03" d="M17.038 18.615H14.87L14.563 9.5h2....

Source: https://login.365file.tech/realm?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638705623427189137.ZjMxMzIyN2QtMGE3OC00NmM0LWE1MTUtZjIyOTAzNTFjOTNiMGY1ZDEyMTItODRlOC00ZDFiLWE1OTgtZDM3NTVkYzdlMTBh&ui_locales=en-US&mkt=en-US&client-request-id=2268d124-c00f-4338-9556-dd594fce6a57&state=tvii8EXN8vdyOmZPlmgT2ozXVAsKp5O-DVucGpacp0IskL2Bo9JmytF2a-VC6Z39FKl9fed1eRAF_O8X76DyfIJy5OI8lywMpfjKpViMqKuqVoEfpn8yNcfA390oWj8P6ISNSshBJ3f0qT1W6s3evXnNQHjODWy4hzgRj6ngKoLWn5QmSBT_NySCp-LH9nKEsj-vPZ3i4dnyd2GcEnv_hQ3OKEM1EG-x5pK1vMcuNP-G0aw83WQEv9wk8aAaP-03Qil3P1TyVDr0dx5hbxf5kA&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0#jennifer_wylie@iamgold.com	HTTP Parser: Title: Redirecting does not match URL
Source: https://login.365file.tech/realm?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638705623427189137.ZjMxMzIyN2QtMGE3OC00NmM0LWE1MTUtZjIyOTAzNTFjOTNiMGY1ZDEyMTItODRlOC00ZDFiLWE1OTgtZDM3NTVkYzdlMTBh&ui_locales=en-US&mkt=en-US&client-request-id=2268d124-c00f-4338-9556-dd594fce6a57&state=tvii8EXN8vdyOmZPlmgT2ozXVAsKp5O-DVucGpacp0IskL2Bo9JmytF2a-VC6Z39FKl9fed1eRAF_O8X76DyfIJy5OI8lywMpfjKpViMqKuqVoEfpn8yNcfA390oWj8P6ISNSshBJ3f0qT1W6s3evXnNQHjODWy4hzgRj6ngKoLWn5QmSBT_NySCp-LH9nKEsj-vPZ3i4dnyd2GcEnv_hQ3OKEM1EG-x5pK1vMcuNP-G0aw83WQEv9wk8aAaP-03Qil3P1TyVDr0dx5hbxf5kA&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0&sso_reload=true#jennifer_wylie@iamgold.com=	HTTP Parser: Title: Sign in to your account does not match URL

Source: https://login.365file.tech/realm?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638705623427189137.ZjMxMzIyN2QtMGE3OC00NmM0LWE1MTUtZjIyOTAzNTFjOTNiMGY1ZDEyMTItODRlOC00ZDFiLWE1OTgtZDM3NTVkYzdlMTBh&ui_locales=en-US&mkt=en-US&client-request-id=2268d124-c00f-4338-9556-dd594fce6a57&state=tvii8EXN8vdyOmZPlmgT2ozXVAsKp5O-DVucGpacp0IskL2Bo9JmytF2a-VC6Z39FKl9fed1eRAF_O8X76DyfIJy5OI8lywMpfjKpViMqKuqVoEfpn8yNcfA390oWj8P6ISNSshBJ3f0qT1W6s3evXnNQHjODWy4hzgRj6ngKoLWn5QmSBT_NySCp-LH9nKEsj-vPZ3i4dnyd2GcEnv_hQ3OKEM1EG-x5pK1vMcuNP-G0aw83WQEv9wk8aAaP-03Qil3P1TyVDr0dx5hbxf5kA&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0&sso_reload=true#jennifer_wylie@iamgold.com=	HTTP Parser: Iframe src: https://ywnjb.365file.tech/Me.htm?v=3
Source: https://login.365file.tech/realm?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638705623427189137.ZjMxMzIyN2QtMGE3OC00NmM0LWE1MTUtZjIyOTAzNTFjOTNiMGY1ZDEyMTItODRlOC00ZDFiLWE1OTgtZDM3NTVkYzdlMTBh&ui_locales=en-US&mkt=en-US&client-request-id=2268d124-c00f-4338-9556-dd594fce6a57&state=tvii8EXN8vdyOmZPlmgT2ozXVAsKp5O-DVucGpacp0IskL2Bo9JmytF2a-VC6Z39FKl9fed1eRAF_O8X76DyfIJy5OI8lywMpfjKpViMqKuqVoEfpn8yNcfA390oWj8P6ISNSshBJ3f0qT1W6s3evXnNQHjODWy4hzgRj6ngKoLWn5QmSBT_NySCp-LH9nKEsj-vPZ3i4dnyd2GcEnv_hQ3OKEM1EG-x5pK1vMcuNP-G0aw83WQEv9wk8aAaP-03Qil3P1TyVDr0dx5hbxf5kA&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0&sso_reload=true#jennifer_wylie@iamgold.com=	HTTP Parser: Iframe src: https://ywnjb.365file.tech/Me.htm?v=3

HTTP Parser: <input type="password" .../> found

Source: https://login.365file.tech/RKiKvqBc?__cf_chl_rt_tk=SEq5GNYqsowTxv8ShnxKjM6RPUYPhJRVImxgPi0yQa8-1734965511-1.0.1.1-NdBax4MXpJ7qwL2gT0Md8Vf6yl9tXWWcv8VncP5jHPo#jennifer_wylie@iamgold.com	HTTP Parser: No favicon
Source: https://login.365file.tech/RKiKvqBc#jennifer_wylie@iamgold.com	HTTP Parser: No favicon
Source: https://login.365file.tech/RKiKvqBc#jennifer_wylie@iamgold.com	HTTP Parser: No favicon
Source: https://login.365file.tech/realm?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638705623427189137.ZjMxMzIyN2QtMGE3OC00NmM0LWE1MTUtZjIyOTAzNTFjOTNiMGY1ZDEyMTItODRlOC00ZDFiLWE1OTgtZDM3NTVkYzdlMTBh&ui_locales=en-US&mkt=en-US&client-request-id=2268d124-c00f-4338-9556-dd594fce6a57&state=tvii8EXN8vdyOmZPlmgT2ozXVAsKp5O-DVucGpacp0IskL2Bo9JmytF2a-VC6Z39FKl9fed1eRAF_O8X76DyfIJy5OI8lywMpfjKpViMqKuqVoEfpn8yNcfA390oWj8P6ISNSshBJ3f0qT1W6s3evXnNQHjODWy4hzgRj6ngKoLWn5QmSBT_NySCp-LH9nKEsj-vPZ3i4dnyd2GcEnv_hQ3OKEM1EG-x5pK1vMcuNP-G0aw83WQEv9wk8aAaP-03Qil3P1TyVDr0dx5hbxf5kA&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0#jennifer_wylie@iamgold.com	HTTP Parser: No favicon

Source: https://login.365file.tech/realm?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638705623427189137.ZjMxMzIyN2QtMGE3OC00NmM0LWE1MTUtZjIyOTAzNTFjOTNiMGY1ZDEyMTItODRlOC00ZDFiLWE1OTgtZDM3NTVkYzdlMTBh&ui_locales=en-US&mkt=en-US&client-request-id=2268d124-c00f-4338-9556-dd594fce6a57&state=tvii8EXN8vdyOmZPlmgT2ozXVAsKp5O-DVucGpacp0IskL2Bo9JmytF2a-VC6Z39FKl9fed1eRAF_O8X76DyfIJy5OI8lywMpfjKpViMqKuqVoEfpn8yNcfA390oWj8P6ISNSshBJ3f0qT1W6s3evXnNQHjODWy4hzgRj6ngKoLWn5QmSBT_NySCp-LH9nKEsj-vPZ3i4dnyd2GcEnv_hQ3OKEM1EG-x5pK1vMcuNP-G0aw83WQEv9wk8aAaP-03Qil3P1TyVDr0dx5hbxf5kA&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0#jennifer_wylie@iamgold.com	HTTP Parser: No <meta name="author".. found
Source: https://login.365file.tech/realm?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638705623427189137.ZjMxMzIyN2QtMGE3OC00NmM0LWE1MTUtZjIyOTAzNTFjOTNiMGY1ZDEyMTItODRlOC00ZDFiLWE1OTgtZDM3NTVkYzdlMTBh&ui_locales=en-US&mkt=en-US&client-request-id=2268d124-c00f-4338-9556-dd594fce6a57&state=tvii8EXN8vdyOmZPlmgT2ozXVAsKp5O-DVucGpacp0IskL2Bo9JmytF2a-VC6Z39FKl9fed1eRAF_O8X76DyfIJy5OI8lywMpfjKpViMqKuqVoEfpn8yNcfA390oWj8P6ISNSshBJ3f0qT1W6s3evXnNQHjODWy4hzgRj6ngKoLWn5QmSBT_NySCp-LH9nKEsj-vPZ3i4dnyd2GcEnv_hQ3OKEM1EG-x5pK1vMcuNP-G0aw83WQEv9wk8aAaP-03Qil3P1TyVDr0dx5hbxf5kA&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0&sso_reload=true#jennifer_wylie@iamgold.com=	HTTP Parser: No <meta name="author".. found
Source: https://login.365file.tech/realm?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638705623427189137.ZjMxMzIyN2QtMGE3OC00NmM0LWE1MTUtZjIyOTAzNTFjOTNiMGY1ZDEyMTItODRlOC00ZDFiLWE1OTgtZDM3NTVkYzdlMTBh&ui_locales=en-US&mkt=en-US&client-request-id=2268d124-c00f-4338-9556-dd594fce6a57&state=tvii8EXN8vdyOmZPlmgT2ozXVAsKp5O-DVucGpacp0IskL2Bo9JmytF2a-VC6Z39FKl9fed1eRAF_O8X76DyfIJy5OI8lywMpfjKpViMqKuqVoEfpn8yNcfA390oWj8P6ISNSshBJ3f0qT1W6s3evXnNQHjODWy4hzgRj6ngKoLWn5QmSBT_NySCp-LH9nKEsj-vPZ3i4dnyd2GcEnv_hQ3OKEM1EG-x5pK1vMcuNP-G0aw83WQEv9wk8aAaP-03Qil3P1TyVDr0dx5hbxf5kA&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0&sso_reload=true#jennifer_wylie@iamgold.com=	HTTP Parser: No <meta name="author".. found
Source: https://login.365file.tech/realm?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638705623427189137.ZjMxMzIyN2QtMGE3OC00NmM0LWE1MTUtZjIyOTAzNTFjOTNiMGY1ZDEyMTItODRlOC00ZDFiLWE1OTgtZDM3NTVkYzdlMTBh&ui_locales=en-US&mkt=en-US&client-request-id=2268d124-c00f-4338-9556-dd594fce6a57&state=tvii8EXN8vdyOmZPlmgT2ozXVAsKp5O-DVucGpacp0IskL2Bo9JmytF2a-VC6Z39FKl9fed1eRAF_O8X76DyfIJy5OI8lywMpfjKpViMqKuqVoEfpn8yNcfA390oWj8P6ISNSshBJ3f0qT1W6s3evXnNQHjODWy4hzgRj6ngKoLWn5QmSBT_NySCp-LH9nKEsj-vPZ3i4dnyd2GcEnv_hQ3OKEM1EG-x5pK1vMcuNP-G0aw83WQEv9wk8aAaP-03Qil3P1TyVDr0dx5hbxf5kA&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0&sso_reload=true#jennifer_wylie@iamgold.com=	HTTP Parser: No <meta name="author".. found
Source: https://login.365file.tech/realm?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638705623427189137.ZjMxMzIyN2QtMGE3OC00NmM0LWE1MTUtZjIyOTAzNTFjOTNiMGY1ZDEyMTItODRlOC00ZDFiLWE1OTgtZDM3NTVkYzdlMTBh&ui_locales=en-US&mkt=en-US&client-request-id=2268d124-c00f-4338-9556-dd594fce6a57&state=tvii8EXN8vdyOmZPlmgT2ozXVAsKp5O-DVucGpacp0IskL2Bo9JmytF2a-VC6Z39FKl9fed1eRAF_O8X76DyfIJy5OI8lywMpfjKpViMqKuqVoEfpn8yNcfA390oWj8P6ISNSshBJ3f0qT1W6s3evXnNQHjODWy4hzgRj6ngKoLWn5QmSBT_NySCp-LH9nKEsj-vPZ3i4dnyd2GcEnv_hQ3OKEM1EG-x5pK1vMcuNP-G0aw83WQEv9wk8aAaP-03Qil3P1TyVDr0dx5hbxf5kA&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0&sso_reload=true#jennifer_wylie@iamgold.com=	HTTP Parser: No <meta name="author".. found

Source: https://login.365file.tech/realm?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638705623427189137.ZjMxMzIyN2QtMGE3OC00NmM0LWE1MTUtZjIyOTAzNTFjOTNiMGY1ZDEyMTItODRlOC00ZDFiLWE1OTgtZDM3NTVkYzdlMTBh&ui_locales=en-US&mkt=en-US&client-request-id=2268d124-c00f-4338-9556-dd594fce6a57&state=tvii8EXN8vdyOmZPlmgT2ozXVAsKp5O-DVucGpacp0IskL2Bo9JmytF2a-VC6Z39FKl9fed1eRAF_O8X76DyfIJy5OI8lywMpfjKpViMqKuqVoEfpn8yNcfA390oWj8P6ISNSshBJ3f0qT1W6s3evXnNQHjODWy4hzgRj6ngKoLWn5QmSBT_NySCp-LH9nKEsj-vPZ3i4dnyd2GcEnv_hQ3OKEM1EG-x5pK1vMcuNP-G0aw83WQEv9wk8aAaP-03Qil3P1TyVDr0dx5hbxf5kA&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0#jennifer_wylie@iamgold.com	HTTP Parser: No <meta name="copyright".. found
Source: https://login.365file.tech/realm?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638705623427189137.ZjMxMzIyN2QtMGE3OC00NmM0LWE1MTUtZjIyOTAzNTFjOTNiMGY1ZDEyMTItODRlOC00ZDFiLWE1OTgtZDM3NTVkYzdlMTBh&ui_locales=en-US&mkt=en-US&client-request-id=2268d124-c00f-4338-9556-dd594fce6a57&state=tvii8EXN8vdyOmZPlmgT2ozXVAsKp5O-DVucGpacp0IskL2Bo9JmytF2a-VC6Z39FKl9fed1eRAF_O8X76DyfIJy5OI8lywMpfjKpViMqKuqVoEfpn8yNcfA390oWj8P6ISNSshBJ3f0qT1W6s3evXnNQHjODWy4hzgRj6ngKoLWn5QmSBT_NySCp-LH9nKEsj-vPZ3i4dnyd2GcEnv_hQ3OKEM1EG-x5pK1vMcuNP-G0aw83WQEv9wk8aAaP-03Qil3P1TyVDr0dx5hbxf5kA&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0&sso_reload=true#jennifer_wylie@iamgold.com=	HTTP Parser: No <meta name="copyright".. found
Source: https://login.365file.tech/realm?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638705623427189137.ZjMxMzIyN2QtMGE3OC00NmM0LWE1MTUtZjIyOTAzNTFjOTNiMGY1ZDEyMTItODRlOC00ZDFiLWE1OTgtZDM3NTVkYzdlMTBh&ui_locales=en-US&mkt=en-US&client-request-id=2268d124-c00f-4338-9556-dd594fce6a57&state=tvii8EXN8vdyOmZPlmgT2ozXVAsKp5O-DVucGpacp0IskL2Bo9JmytF2a-VC6Z39FKl9fed1eRAF_O8X76DyfIJy5OI8lywMpfjKpViMqKuqVoEfpn8yNcfA390oWj8P6ISNSshBJ3f0qT1W6s3evXnNQHjODWy4hzgRj6ngKoLWn5QmSBT_NySCp-LH9nKEsj-vPZ3i4dnyd2GcEnv_hQ3OKEM1EG-x5pK1vMcuNP-G0aw83WQEv9wk8aAaP-03Qil3P1TyVDr0dx5hbxf5kA&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0&sso_reload=true#jennifer_wylie@iamgold.com=	HTTP Parser: No <meta name="copyright".. found
Source: https://login.365file.tech/realm?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638705623427189137.ZjMxMzIyN2QtMGE3OC00NmM0LWE1MTUtZjIyOTAzNTFjOTNiMGY1ZDEyMTItODRlOC00ZDFiLWE1OTgtZDM3NTVkYzdlMTBh&ui_locales=en-US&mkt=en-US&client-request-id=2268d124-c00f-4338-9556-dd594fce6a57&state=tvii8EXN8vdyOmZPlmgT2ozXVAsKp5O-DVucGpacp0IskL2Bo9JmytF2a-VC6Z39FKl9fed1eRAF_O8X76DyfIJy5OI8lywMpfjKpViMqKuqVoEfpn8yNcfA390oWj8P6ISNSshBJ3f0qT1W6s3evXnNQHjODWy4hzgRj6ngKoLWn5QmSBT_NySCp-LH9nKEsj-vPZ3i4dnyd2GcEnv_hQ3OKEM1EG-x5pK1vMcuNP-G0aw83WQEv9wk8aAaP-03Qil3P1TyVDr0dx5hbxf5kA&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0&sso_reload=true#jennifer_wylie@iamgold.com=	HTTP Parser: No <meta name="copyright".. found
Source: https://login.365file.tech/realm?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638705623427189137.ZjMxMzIyN2QtMGE3OC00NmM0LWE1MTUtZjIyOTAzNTFjOTNiMGY1ZDEyMTItODRlOC00ZDFiLWE1OTgtZDM3NTVkYzdlMTBh&ui_locales=en-US&mkt=en-US&client-request-id=2268d124-c00f-4338-9556-dd594fce6a57&state=tvii8EXN8vdyOmZPlmgT2ozXVAsKp5O-DVucGpacp0IskL2Bo9JmytF2a-VC6Z39FKl9fed1eRAF_O8X76DyfIJy5OI8lywMpfjKpViMqKuqVoEfpn8yNcfA390oWj8P6ISNSshBJ3f0qT1W6s3evXnNQHjODWy4hzgRj6ngKoLWn5QmSBT_NySCp-LH9nKEsj-vPZ3i4dnyd2GcEnv_hQ3OKEM1EG-x5pK1vMcuNP-G0aw83WQEv9wk8aAaP-03Qil3P1TyVDr0dx5hbxf5kA&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0&sso_reload=true#jennifer_wylie@iamgold.com=	HTTP Parser: No <meta name="copyright".. found

Source: powerpnt.exe

Memory has grown: Private usage: 2MB later: 117MB

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	HTTP traffic: Redirect from: www.google.com to https://salesboost.com/jf
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	HTTP traffic: Redirect from: salesboost.com to https://login.365file.tech/rkikvqbc
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	HTTP traffic: Redirect from: www.google.com to https://salesboost.com/jf
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	HTTP traffic: Redirect from: salesboost.com to https://login.365file.tech/rkikvqbc

Source: Joe Sandbox View	IP Address: 104.18.94.41 104.18.94.41
Source: Joe Sandbox View	IP Address: 104.18.95.41 104.18.95.41

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /amp/s/salesboost.com/jf HTTP/1.1Host: www.google.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIkqHLAQj2mM0BCIWgzQEI3L3NAQiRys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /jf HTTP/1.1Host: salesboost.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /jf/ HTTP/1.1Host: salesboost.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /RKiKvqBc HTTP/1.1Host: login.365file.techConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /amp/s/salesboost.com/jf HTTP/1.1Host: www.google.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIkqHLAQj2mM0BCIWgzQEI3L3NAQiRys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=520=gK7O0nTsR-wPx05SrBJUd3HAfX4M9fc3aqd2XTKtTlIL-40D9SE3v73cbehuTvOeWv7KMN6SzEvw8450IfocIWnMawOJxHynYMsOO5fqWdvfMBtm--u9BujLGT0VtJ6dqbxcZjYp3EkCYhKkezVxOguXncHPaP_B08fK1K4CIpBspFVoRYKd_Yz5WTA31IXgra3h
Source: global traffic	HTTP traffic detected: GET /jf/ HTTP/1.1Host: salesboost.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /RKiKvqBc HTTP/1.1Host: login.365file.techConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-arch: "x86"sec-ch-ua-platform: "Windows"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-model: ""sec-ch-ua-bitness: "64"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/orchestrate/chl_page/v1?ray=8f692c10de854314 HTTP/1.1Host: login.365file.techConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://login.365file.tech/RKiKvqBc?__cf_chl_rt_tk=SEq5GNYqsowTxv8ShnxKjM6RPUYPhJRVImxgPi0yQa8-1734965511-1.0.1.1-NdBax4MXpJ7qwL2gT0Md8Vf6yl9tXWWcv8VncP5jHPoAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/orchestrate/chl_page/v1?ray=8f692c10de854314 HTTP/1.1Host: login.365file.techConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: login.365file.techConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://login.365file.tech/RKiKvqBcAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /turnstile/v0/b/787bc399e22f/api.js?onload=WXqDk4&render=explicit HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://login.365file.techsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/flow/ov1/737265407:1734963256:v--qV6PRwMGnawi4djvFIfSHLRJhT5kPAgN_50_G6Z4/8f692c10de854314/TOGNyk6aUIk0aC21kLKjtzNEZhHS8WCD.p47H0GGFwc-1734965511-1.2.1.1-7sDAwg8cay2RCE3vybEEKXLSGgaICCttt2YuZIwFInu4e3r4yVRObJ1QXzXyeYKi HTTP/1.1Host: login.365file.techConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /turnstile/v0/b/787bc399e22f/api.js?onload=WXqDk4&render=explicit HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv/99bnk/0x4AAAAAAADnPIDROrmt1Wwj/light/fbE/normal/auto/ HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/orchestrate/chl_api/v1?ray=8f692c38cb37c43b&lang=auto HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv/99bnk/0x4AAAAAAADnPIDROrmt1Wwj/light/fbE/normal/auto/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/cmg/1 HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv/99bnk/0x4AAAAAAADnPIDROrmt1Wwj/light/fbE/normal/auto/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/cmg/1 HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/orchestrate/chl_api/v1?ray=8f692c38cb37c43b&lang=auto HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: login.365file.techConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://login.365file.tech/RKiKvqBcAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/flow/ov1/59012872:1734963193:dJWEVcwbrnL1TTil6YmxbJ4SlF5pcoUWsQBeHspz6pg/8f692c38cb37c43b/vxu2uxafbM96ucUzDK4INX7dCY8HEjZkkcnYJbZchuI-1734965518-1.1.1.1-Eh2ysBkS1kMovo4eqQXf9rKEAPgIZYIJhkH0RyZFQodz6oLCEt8BZW60dk029qUW HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/pat/8f692c38cb37c43b/1734965522352/7339b7655fb87e4c59a48d975d045630c30639ee310f0ebce0dfc6e6e6ed9473/43Aan-x4BPJpSgM HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveCache-Control: max-age=0sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv/99bnk/0x4AAAAAAADnPIDROrmt1Wwj/light/fbE/normal/auto/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/i/8f692c38cb37c43b/1734965522353/HWsekBJnYLOyFP0 HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv/99bnk/0x4AAAAAAADnPIDROrmt1Wwj/light/fbE/normal/auto/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/i/8f692c38cb37c43b/1734965522353/HWsekBJnYLOyFP0 HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/flow/ov1/59012872:1734963193:dJWEVcwbrnL1TTil6YmxbJ4SlF5pcoUWsQBeHspz6pg/8f692c38cb37c43b/vxu2uxafbM96ucUzDK4INX7dCY8HEjZkkcnYJbZchuI-1734965518-1.1.1.1-Eh2ysBkS1kMovo4eqQXf9rKEAPgIZYIJhkH0RyZFQodz6oLCEt8BZW60dk029qUW HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/flow/ov1/59012872:1734963193:dJWEVcwbrnL1TTil6YmxbJ4SlF5pcoUWsQBeHspz6pg/8f692c38cb37c43b/vxu2uxafbM96ucUzDK4INX7dCY8HEjZkkcnYJbZchuI-1734965518-1.1.1.1-Eh2ysBkS1kMovo4eqQXf9rKEAPgIZYIJhkH0RyZFQodz6oLCEt8BZW60dk029qUW HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/flow/ov1/737265407:1734963256:v--qV6PRwMGnawi4djvFIfSHLRJhT5kPAgN_50_G6Z4/8f692c10de854314/TOGNyk6aUIk0aC21kLKjtzNEZhHS8WCD.p47H0GGFwc-1734965511-1.2.1.1-7sDAwg8cay2RCE3vybEEKXLSGgaICCttt2YuZIwFInu4e3r4yVRObJ1QXzXyeYKi HTTP/1.1Host: login.365file.techConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: login.365file.techConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://login.365file.tech/RKiKvqBc?__cf_chl_tk=SEq5GNYqsowTxv8ShnxKjM6RPUYPhJRVImxgPi0yQa8-1734965511-1.0.1.1-NdBax4MXpJ7qwL2gT0Md8Vf6yl9tXWWcv8VncP5jHPoAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: login.365file.techConnection: keep-aliveCache-Control: max-age=0Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-arch: "x86"sec-ch-ua-platform: "Windows"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-model: ""sec-ch-ua-bitness: "64"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"Referer: https://login.365file.tech/RKiKvqBc?__cf_chl_tk=SEq5GNYqsowTxv8ShnxKjM6RPUYPhJRVImxgPi0yQa8-1734965511-1.0.1.1-NdBax4MXpJ7qwL2gT0Md8Vf6yl9tXWWcv8VncP5jHPoAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: cf_clearance=BNNmnB0.21i1a2zs0dzJf4GjoCB4BeK.nWzOHhruVRc-1734965511-1.2.1.1-9J4E9tAPbb8SCdUhsJceXJpmmRagVU2D4qqzr31gzR3AqAc_jZHN79_U2g_R__.gVcJmSKCkWxXZH.OKWdK6rX5XnvgwrifEOMoTMnXu_5KcIdxtoMTtBSP3BBFNLn5GxSyxQqHZkkKifjXCIaAQKQfxcDbo9AgKh6Rrg2Ms0JnSpw7.3O9Ds2U4728tb5XCfK0WpUVjq.hOOWJ8KFqW8Bfn_kzDlbGfce9wdnRoHgvl46veIkM9w.no3M2Jbqsse2LSP9_NlhHskIHUlt3.OfFm5vYE5b.qjnI8FWclFp9vW8IrZ26gmZAxkAIu74MbkeTgvNC8wEeTNMqE32ybGNTaK26DF_v1pY_ugAxekvShPxcY6QgJJePJ2cdpMTnn.rapv16_crmCNKYGpfaLQt.JKBXyv08R3I0wsPt0xoJaA0wYLd.gLe3tJt360abD; KmAT=56313130dd0d14b933a5516ed2cadc1c539b3efae52f454c4cc516ab8ea4c21b
Source: global traffic	HTTP traffic detected: GET /login HTTP/1.1Host: www.365file.techConnection: keep-aliveCache-Control: max-age=0Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-siteSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Referer: https://login.365file.tech/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: cf_clearance=BNNmnB0.21i1a2zs0dzJf4GjoCB4BeK.nWzOHhruVRc-1734965511-1.2.1.1-9J4E9tAPbb8SCdUhsJceXJpmmRagVU2D4qqzr31gzR3AqAc_jZHN79_U2g_R__.gVcJmSKCkWxXZH.OKWdK6rX5XnvgwrifEOMoTMnXu_5KcIdxtoMTtBSP3BBFNLn5GxSyxQqHZkkKifjXCIaAQKQfxcDbo9AgKh6Rrg2Ms0JnSpw7.3O9Ds2U4728tb5XCfK0WpUVjq.hOOWJ8KFqW8Bfn_kzDlbGfce9wdnRoHgvl46veIkM9w.no3M2Jbqsse2LSP9_NlhHskIHUlt3.OfFm5vYE5b.qjnI8FWclFp9vW8IrZ26gmZAxkAIu74MbkeTgvNC8wEeTNMqE32ybGNTaK26DF_v1pY_ugAxekvShPxcY6QgJJePJ2cdpMTnn.rapv16_crmCNKYGpfaLQt.JKBXyv08R3I0wsPt0xoJaA0wYLd.gLe3tJt360abD; KmAT=56313130dd0d14b933a5516ed2cadc1c539b3efae52f454c4cc516ab8ea4c21b
Source: global traffic	HTTP traffic detected: GET /realm?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638705623427189137.ZjMxMzIyN2QtMGE3OC00NmM0LWE1MTUtZjIyOTAzNTFjOTNiMGY1ZDEyMTItODRlOC00ZDFiLWE1OTgtZDM3NTVkYzdlMTBh&ui_locales=en-US&mkt=en-US&client-request-id=2268d124-c00f-4338-9556-dd594fce6a57&state=tvii8EXN8vdyOmZPlmgT2ozXVAsKp5O-DVucGpacp0IskL2Bo9JmytF2a-VC6Z39FKl9fed1eRAF_O8X76DyfIJy5OI8lywMpfjKpViMqKuqVoEfpn8yNcfA390oWj8P6ISNSshBJ3f0qT1W6s3evXnNQHjODWy4hzgRj6ngKoLWn5QmSBT_NySCp-LH9nKEsj-vPZ3i4dnyd2GcEnv_hQ3OKEM1EG-x5pK1vMcuNP-G0aw83WQEv9wk8aAaP-03Qil3P1TyVDr0dx5hbxf5kA&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0 HTTP/1.1Host: login.365file.techConnection: keep-aliveCache-Control: max-age=0Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-siteSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-arch: "x86"sec-ch-ua-platform: "Windows"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-model: ""sec-ch-ua-bitness: "64"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"Referer: https://login.365file.tech/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: cf_clearance=BNNmnB0.21i1a2zs0dzJf4GjoCB4BeK.nWzOHhruVRc-1734965511-1.2.1.1-9J4E9tAPbb8SCdUhsJceXJpmmRagVU2D4qqzr31gzR3AqAc_jZHN79_U2g_R__.gVcJmSKCkWxXZH.OKWdK6rX5XnvgwrifEOMoTMnXu_5KcIdxtoMTtBSP3BBFNLn5GxSyxQqHZkkKifjXCIaAQKQfxcDbo9AgKh6Rrg2Ms0JnSpw7.3O9Ds2U4728tb5XCfK0WpUVjq.hOOWJ8KFqW8Bfn_kzDlbGfce9wdnRoHgvl46veIkM9w.no3M2Jbqsse2LSP9_NlhHskIHUlt3.OfFm5vYE5b.qjnI8FWclFp9vW8IrZ26gmZAxkAIu74MbkeTgvNC8wEeTNMqE32ybGNTaK26DF_v1pY_ugAxekvShPxcY6QgJJePJ2cdpMTnn.rapv16_crmCNKYGpfaLQt.JKBXyv08R3I0wsPt0xoJaA0wYLd.gLe3tJt360abD; KmAT=56313130dd0d14b933a5516ed2cadc1c539b3efae52f454c4cc516ab8ea4c21b; fpc=AgixDrZbyBxEjMXxxDPE5kQ; esctx=PAQABBwEAAADW6jl31mB3T7ugrWTT8pFenKWPcsGxmZQy0gt_zkO11mUXmzW6zLnMgjob2yl5-6kaMybRhswIm5gq8eQ2wQfBbNsDe-ThhDWS5jEU_RuAWowkHmW6d3chs3ApwCm6d49bZZpNXLF6FLfz_raz9sbDvOL-2n9dLYI3YpGZeDCI9IgCU_xZMox1urj5NrEgS8wgAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd
Source: global traffic	HTTP traffic detected: GET /realm?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638705623427189137.ZjMxMzIyN2QtMGE3OC00NmM0LWE1MTUtZjIyOTAzNTFjOTNiMGY1ZDEyMTItODRlOC00ZDFiLWE1OTgtZDM3NTVkYzdlMTBh&ui_locales=en-US&mkt=en-US&client-request-id=2268d124-c00f-4338-9556-dd594fce6a57&state=tvii8EXN8vdyOmZPlmgT2ozXVAsKp5O-DVucGpacp0IskL2Bo9JmytF2a-VC6Z39FKl9fed1eRAF_O8X76DyfIJy5OI8lywMpfjKpViMqKuqVoEfpn8yNcfA390oWj8P6ISNSshBJ3f0qT1W6s3evXnNQHjODWy4hzgRj6ngKoLWn5QmSBT_NySCp-LH9nKEsj-vPZ3i4dnyd2GcEnv_hQ3OKEM1EG-x5pK1vMcuNP-G0aw83WQEv9wk8aAaP-03Qil3P1TyVDr0dx5hbxf5kA&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0&sso_reload=true HTTP/1.1Host: login.365file.techConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-arch: "x86"sec-ch-ua-platform: "Windows"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-model: ""sec-ch-ua-bitness: "64"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-Dest: documentReferer: https://login.365file.tech/realm?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638705623427189137.ZjMxMzIyN2QtMGE3OC00NmM0LWE1MTUtZjIyOTAzNTFjOTNiMGY1ZDEyMTItODRlOC00ZDFiLWE1OTgtZDM3NTVkYzdlMTBh&ui_locales=en-US&mkt=en-US&client-request-id=2268d124-c00f-4338-9556-dd594fce6a57&state=tvii8EXN8vdyOmZPlmgT2ozXVAsKp5O-DVucGpacp0IskL2Bo9JmytF2a-VC6Z39FKl9fed1eRAF_O8X76DyfIJy5OI8lywMpfjKpViMqKuqVoEfpn8yNcfA390oWj8P6ISNSshBJ3f0qT1W6s3evXnNQHjODWy4hzgRj6ngKoLWn5QmSBT_NySCp-LH9nKEsj-vPZ3i4dnyd2GcEnv_hQ3OKEM1EG-x5pK1vMcuNP-G0aw83WQEv9wk8aAaP-03Qil3P1TyVDr0dx5hbxf5kA&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: cf_clearance=BNNmnB0.21i1a2zs0dzJf4GjoCB4BeK.nWzOHhruVRc-1734965511-1.2.1.1-9J4E9tAPbb8SCdUhsJceXJpmmRagVU2D4qqzr31gzR3AqAc_jZHN79_U2g_R__.gVcJmSKCkWxXZH.OKWdK6rX5XnvgwrifEOMoTMnXu_5KcIdxtoMTtBSP3BBFNLn5GxSyxQqHZkkKifjXCIaAQKQfxcDbo9AgKh6Rrg2Ms0JnSpw7.3O9Ds2U4728tb5XCfK0WpUVjq.hOOWJ8KFqW8Bfn_kzDlbGfce9wdnRoHgvl46veIkM9w.no3M2Jbqsse2LSP9_NlhHskIHUlt3.OfFm5vYE5b.qjnI8FWclFp9vW8IrZ26gmZAxkAIu74MbkeTgvNC8wEeTNMqE32ybGNTaK26DF_v1pY_ugAxekvShPxcY6QgJJePJ2cdpMTnn.rapv16_crmCNKYGpfaLQt
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: login.365file.techConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://login.365file.tech/realm?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638705623427189137.ZjMxMzIyN2QtMGE3OC00NmM0LWE1MTUtZjIyOTAzNTFjOTNiMGY1ZDEyMTItODRlOC00ZDFiLWE1OTgtZDM3NTVkYzdlMTBh&ui_locales=en-US&mkt=en-US&client-request-id=2268d124-c00f-4338-9556-dd594fce6a57&state=tvii8EXN8vdyOmZPlmgT2ozXVAsKp5O-DVucGpacp0IskL2Bo9JmytF2a-VC6Z39FKl9fed1eRAF_O8X76DyfIJy5OI8lywMpfjKpViMqKuqVoEfpn8yNcfA390oWj8P6ISNSshBJ3f0qT1W6s3evXnNQHjODWy4hzgRj6ngKoLWn5QmSBT_NySCp-LH9nKEsj-vPZ3i4dnyd2GcEnv_hQ3OKEM1EG-x5pK1vMcuNP-G0aw83WQEv9wk8aAaP-03Qil3P1TyVDr0dx5hbxf5kA&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: cf_clearance=BNNmnB0.21i1a2zs0dzJf4GjoCB4BeK.nWzOHhruVRc-1734965511-1.2.1.1-9J4E9tAPbb8SCdUhsJceXJpmmRagVU2D4qqzr31gzR3AqAc_jZHN79_U2g_R__.gVcJmSKCkWxXZH.OKWdK6rX5XnvgwrifEOMoTMnXu_5KcIdxtoMTtBSP3BBFNLn5GxSyxQqHZkkKifjXCIaAQKQfxcDbo9AgKh6Rrg2Ms0JnSpw7.3O9Ds2U4728tb5XCfK0WpUVjq.hOOWJ8KFqW8Bfn_kzDlbGfce9wdnRoHgvl46veIkM9w.no3M2Jbqsse2LSP9_NlhHskIHUlt3.OfFm5vYE5b.qjnI8FWclFp9vW8IrZ26gmZAxkAIu74MbkeTgvNC8wEeTNMqE32ybGNTaK26DF_v1pY_ugAxekvShPxcY6QgJJePJ2cdpMTnn.rapv16_crmCNKYGpfaLQt.JKBXyv08R3I0wsPt0xoJaA0wYLd.gLe3tJt360abD; KmAT=56313130dd0d14b933a5516ed2cadc1c539b3efae52f454c4cc516ab8ea4c21b; fpc=AgixDrZbyBxEjMXxxDPE5kQ; esctx=PAQABBwEAAADW6jl31mB3T7ugrWTT8pFenKWPcsGxmZQy0gt_zkO11mUXmzW6zLnMgjob2yl5-6kaMybRhswIm5gq8eQ2wQfBbNsDe-ThhDWS5jEU_RuAWowkHmW6d3chs3ApwCm6d49bZZpNXLF6FLfz_raz9sbDvOL-2n9dLYI3YpGZeDCI9IgCU_xZMox1urj5NrEgS8wgAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; esctx-NDj1gL61gzQ=AQABCQEAAADW6jl31mB3T7ugrWTT8pFeuWkNtOo4RtW9YQUmlp3AmhsWylx_-zhDOAyrMdcCjjamopW3jVcwBDQyQx5CXPNReuJ9qpSInAtzrcY83Ls8sWG8kI8Zlg5SQEzid7oR8QBSkqdXMjS3_yTPRGqF1K4pNlwCPw7-bB2jAvB9g7_2aSAA; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/scripts/jsd/main.js HTTP/1.1Host: login.365file.techConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: cf_clearance=BNNmnB0.21i1a2zs0dzJf4GjoCB4BeK.nWzOHhruVRc-1734965511-1.2.1.1-9J4E9tAPbb8SCdUhsJceXJpmmRagVU2D4qqzr31gzR3AqAc_jZHN79_U2g_R__.gVcJmSKCkWxXZH.OKWdK6rX5XnvgwrifEOMoTMnXu_5KcIdxtoMTtBSP3BBFNLn5GxSyxQqHZkkKifjXCIaAQKQfxcDbo9AgKh6Rrg2Ms0JnSpw7.3O9Ds2U4728tb5XCfK0WpUVjq.hOOWJ8KFqW8Bfn_kzDlbGfce9wdnRoHgvl46veIkM9w.no3M2Jbqsse2LSP9_NlhHskIHUlt3.OfFm5vYE5b.qjnI8FWclFp9vW8IrZ26gmZAxkAIu74MbkeTgvNC8wEeTNMqE32ybGNTaK26DF_v1pY_ugAxekvShPxcY6QgJJePJ2cdpMTnn.rapv16_crmCNKYGpfaLQt.JKBXyv08R3I0wsPt0xoJaA0wYLd.gLe3tJt360abD; KmAT=56313130dd0d14b933a5516ed2cadc1c539b3efae52f454c4cc516ab8ea4c21b; fpc=AgixDrZbyBxEjMXxxDPE5kQ; esctx=PAQABBwEAAADW6jl31mB3T7ugrWTT8pFenKWPcsGxmZQy0gt_zkO11mUXmzW6zLnMgjob2yl5-6kaMybRhswIm5gq8eQ2wQfBbNsDe-ThhDWS5jEU_RuAWowkHmW6d3chs3ApwCm6d49bZZpNXLF6FLfz_raz9sbDvOL-2n9dLYI3YpGZeDCI9IgCU_xZMox1urj5NrEgS8wgAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; esctx-NDj1gL61gzQ=AQABCQEAAADW6jl31mB3T7ugrWTT8pFeuWkNtOo4RtW9YQUmlp3AmhsWylx_-zhDOAyrMdcCjjamopW3jVcwBDQyQx5CXPNReuJ9qpSInAtzrcY83Ls8sWG8kI8Zlg5SQEzid7oR8QBSkqdXMjS3_yTPRGqF1K4pNlwCPw7-bB2jAvB9g7_2aSAA
Source: global traffic	HTTP traffic detected: GET /Me.htm?v=3 HTTP/1.1Host: ywnjb.365file.techConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Purpose: prefetchSec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyReferer: https://login.365file.tech/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: cf_clearance=BNNmnB0.21i1a2zs0dzJf4GjoCB4BeK.nWzOHhruVRc-1734965511-1.2.1.1-9J4E9tAPbb8SCdUhsJceXJpmmRagVU2D4qqzr31gzR3AqAc_jZHN79_U2g_R__.gVcJmSKCkWxXZH.OKWdK6rX5XnvgwrifEOMoTMnXu_5KcIdxtoMTtBSP3BBFNLn5GxSyxQqHZkkKifjXCIaAQKQfxcDbo9AgKh6Rrg2Ms0JnSpw7.3O9Ds2U4728tb5XCfK0WpUVjq.hOOWJ8KFqW8Bfn_kzDlbGfce9wdnRoHgvl46veIkM9w.no3M2Jbqsse2LSP9_NlhHskIHUlt3.OfFm5vYE5b.qjnI8FWclFp9vW8IrZ26gmZAxkAIu74MbkeTgvNC8wEeTNMqE32ybGNTaK26DF_v1pY_ugAxekvShPxcY6QgJJePJ2cdpMTnn.rapv16_crmCNKYGpfaLQt.JKBXyv08R3I0wsPt0xoJaA0wYLd.gLe3tJt360abD; KmAT=56313130dd0d14b933a5516ed2cadc1c539b3efae52f454c4cc516ab8ea4c21b
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/scripts/jsd/787bc399e22f/main.js? HTTP/1.1Host: login.365file.techConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: cf_clearance=BNNmnB0.21i1a2zs0dzJf4GjoCB4BeK.nWzOHhruVRc-1734965511-1.2.1.1-9J4E9tAPbb8SCdUhsJceXJpmmRagVU2D4qqzr31gzR3AqAc_jZHN79_U2g_R__.gVcJmSKCkWxXZH.OKWdK6rX5XnvgwrifEOMoTMnXu_5KcIdxtoMTtBSP3BBFNLn5GxSyxQqHZkkKifjXCIaAQKQfxcDbo9AgKh6Rrg2Ms0JnSpw7.3O9Ds2U4728tb5XCfK0WpUVjq.hOOWJ8KFqW8Bfn_kzDlbGfce9wdnRoHgvl46veIkM9w.no3M2Jbqsse2LSP9_NlhHskIHUlt3.OfFm5vYE5b.qjnI8FWclFp9vW8IrZ26gmZAxkAIu74MbkeTgvNC8wEeTNMqE32ybGNTaK26DF_v1pY_ugAxekvShPxcY6QgJJePJ2cdpMTnn.rapv16_crmCNKYGpfaLQt.JKBXyv08R3I0wsPt0xoJaA0wYLd.gLe3tJt360abD; KmAT=56313130dd0d14b933a5516ed2cadc1c539b3efae52f454c4cc516ab8ea4c21b; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; esctx-NDj1gL61gzQ=AQABCQEAAADW6jl31mB3T7ugrWTT8pFeuWkNtOo4RtW9YQUmlp3AmhsWylx_-zhDOAyrMdcCjjamopW3jVcwBDQyQx5CXPNReuJ9qpSInAtzrcY83Ls8sWG8kI8Zlg5SQEzid7oR8QBSkqdXMjS3_yTPRGqF1K4pNlwCPw7-bB2jAvB9g7_2aSAA; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=1.AXwAMe_N-B6jSkuT5F9XHpElWltEZUfGMrBJg-Ydk3ZSdsoBAAB8AA.AQABGgEAAADW6jl31mB3T7ugrWTT8pFexG2aQZCQWXTOv-IVgPPOwrhOwR3VORb_Ti8AJVzYTygYUxTgUacUYnjzk7KuzL80PWGRIc90GFaYVUa990nU-aw8ZQO0Ci9lmLvWd-uA1l4gAA; esctx=PAQABBwEAAADW6jl31mB3T7ugrWTT8pFewx3kpKEA-5BxD8Xw2KP2AA9S6OK9ozXqvKoSG_p5CFuzuIIqXweFEqnMaQmVQel6ddi1l51mKiP2hsNKZ08oQp3VlhCU65dCmdD9t75HVRi90QLuSTVM51y02U4XfTtZ-mBpBwIgP23MJA0rudrO5pE-zpaBeaU8pXqf3DHb6MQgAA; esctx-rmheRu5exY=AQABCQEAAADW6jl31mB3T7ugrWTT8pFePgdYeXbxynAIMyjthjBDe74bZL_1xKY6PArl2FF1ig2AgRmbKWaySz3f-DUDVANkzH1OQJmf0KVufjKvWWYO2M1z0BaXA_QfYBs3XsDABza3a33OXIz1Q8rUmkPQKTDY1GoqG3XybkE3UaG6qhgjQiAA; fpc=AgixDrZbyBxEjMXxxDPE5kS8Ae7AAQAAAC1w-94OAAAA
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/scripts/jsd/787bc399e22f/main.js? HTTP/1.1Host: login.365file.techConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: KmAT=56313130dd0d14b933a5516ed2cadc1c539b3efae52f454c4cc516ab8ea4c21b; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; esctx-NDj1gL61gzQ=AQABCQEAAADW6jl31mB3T7ugrWTT8pFeuWkNtOo4RtW9YQUmlp3AmhsWylx_-zhDOAyrMdcCjjamopW3jVcwBDQyQx5CXPNReuJ9qpSInAtzrcY83Ls8sWG8kI8Zlg5SQEzid7oR8QBSkqdXMjS3_yTPRGqF1K4pNlwCPw7-bB2jAvB9g7_2aSAA; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=1.AXwAMe_N-B6jSkuT5F9XHpElWltEZUfGMrBJg-Ydk3ZSdsoBAAB8AA.AQABGgEAAADW6jl31mB3T7ugrWTT8pFexG2aQZCQWXTOv-IVgPPOwrhOwR3VORb_Ti8AJVzYTygYUxTgUacUYnjzk7KuzL80PWGRIc90GFaYVUa990nU-aw8ZQO0Ci9lmLvWd-uA1l4gAA; esctx=PAQABBwEAAADW6jl31mB3T7ugrWTT8pFewx3kpKEA-5BxD8Xw2KP2AA9S6OK9ozXqvKoSG_p5CFuzuIIqXweFEqnMaQmVQel6ddi1l51mKiP2hsNKZ08oQp3VlhCU65dCmdD9t75HVRi90QLuSTVM51y02U4XfTtZ-mBpBwIgP23MJA0rudrO5pE-zpaBeaU8pXqf3DHb6MQgAA; esctx-rmheRu5exY=AQABCQEAAADW6jl31mB3T7ugrWTT8pFePgdYeXbxynAIMyjthjBDe74bZL_1xKY6PArl2FF1ig2AgRmbKWaySz3f-DUDVANkzH1OQJmf0KVufjKvWWYO2M1z0BaXA_QfYBs3XsDABza3a33OXIz1Q8rUmkPQKTDY1GoqG3XybkE3UaG6qhgjQiAA; fpc=AgixDrZbyBxEjMXxxDPE5kS8Ae7AAQAAAC1w-94OAAAA
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/jsd/r/8f692cfaadd6de93 HTTP/1.1Host: login.365file.techConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: KmAT=56313130dd0d14b933a5516ed2cadc1c539b3efae52f454c4cc516ab8ea4c21b; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; esctx-NDj1gL61gzQ=AQABCQEAAADW6jl31mB3T7ugrWTT8pFeuWkNtOo4RtW9YQUmlp3AmhsWylx_-zhDOAyrMdcCjjamopW3jVcwBDQyQx5CXPNReuJ9qpSInAtzrcY83Ls8sWG8kI8Zlg5SQEzid7oR8QBSkqdXMjS3_yTPRGqF1K4pNlwCPw7-bB2jAvB9g7_2aSAA; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=1.AXwAMe_N-B6jSkuT5F9XHpElWltEZUfGMrBJg-Ydk3ZSdsoBAAB8AA.AQABGgEAAADW6jl31mB3T7ugrWTT8pFexG2aQZCQWXTOv-IVgPPOwrhOwR3VORb_Ti8AJVzYTygYUxTgUacUYnjzk7KuzL80PWGRIc90GFaYVUa990nU-aw8ZQO0Ci9lmLvWd-uA1l4gAA; esctx=PAQABBwEAAADW6jl31mB3T7ugrWTT8pFewx3kpKEA-5BxD8Xw2KP2AA9S6OK9ozXqvKoSG_p5CFuzuIIqXweFEqnMaQmVQel6ddi1l51mKiP2hsNKZ08oQp3VlhCU65dCmdD9t75HVRi90QLuSTVM51y02U4XfTtZ-mBpBwIgP23MJA0rudrO5pE-zpaBeaU8pXqf3DHb6MQgAA; esctx-rmheRu5exY=AQABCQEAAADW6jl31mB3T7ugrWTT8pFePgdYeXbxynAIMyjthjBDe74bZL_1xKY6PArl2FF1ig2AgRmbKWaySz3f-DUDVANkzH1OQJmf0KVufjKvWWYO2M1z0BaXA_QfYBs3XsDABza3a33OXIz1Q8rUmkPQKTDY1GoqG3XybkE3UaG6qhgjQiAA; fpc=AgixDrZbyBxEjMXxxDPE5kS8Ae7AAQAAAC1w-94OAAAA; MicrosoftApplicationsTelemetryDeviceId=17dc1c87-e7dd-43ce-8236-299458bc24f2; brcap=0
Source: global traffic	HTTP traffic detected: GET /Me.htm?v=3 HTTP/1.1Host: ywnjb.365file.techConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://login.365file.tech/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: KmAT=56313130dd0d14b933a5516ed2cadc1c539b3efae52f454c4cc516ab8ea4c21b; uaid=2d486dd1a7744d3ab3c8d58ad7d20394; MSPRequ=id=N&lt=1734965552&co=1; cf_clearance=WziNiH6ygD4iqks4GG47gv1E1zwXcRzqQoNe2GBmnbE-1734965554-1.2.1.1-jsRPOeBNp8xVG4oXR6Yx2fteMWTVS_3X07jcGUsuwpWNcFPTuNbc.O4F_0y.2KKiY5eI1cq6lHYX7K4s8o7UDbN_6IJBwSsKYHD8pJSEx01GcwkVKRxJ7aQbpCGX.9BS34g8zsK6oPl9Y2kZ8Qlj.Do71dWxP8tgvGE0Psabhbj9H84AexyfAab99GRIdZyNZTwUV3PQz3l_oRn0hwC1od87ZtL.ZKBG6D3L88SFds.gGpLSXPLQ0CVlcXlqYH_JzvGJxX6HPcms5VgwKwaA9mXG6MSn8eaPapBMc_heaUVnopy12lET_YGkVbJxwLcN9K1NlTkdgGUNHoeUxBJUaGhCyI7fXCsGWs4rE78pBc8e9UQqCW3Qa3QaKoTce4uE8ps72KtaEQzW_CGLEeund.xqbXPlu5x1ec_nvjJPyOVr6LfdfqDdxuyjjLvRUUjR
Source: global traffic	HTTP traffic detected: GET /common/GetCredentialType?mkt=en-US HTTP/1.1Host: login.365file.techConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: KmAT=56313130dd0d14b933a5516ed2cadc1c539b3efae52f454c4cc516ab8ea4c21b; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; esctx-NDj1gL61gzQ=AQABCQEAAADW6jl31mB3T7ugrWTT8pFeuWkNtOo4RtW9YQUmlp3AmhsWylx_-zhDOAyrMdcCjjamopW3jVcwBDQyQx5CXPNReuJ9qpSInAtzrcY83Ls8sWG8kI8Zlg5SQEzid7oR8QBSkqdXMjS3_yTPRGqF1K4pNlwCPw7-bB2jAvB9g7_2aSAA; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=1.AXwAMe_N-B6jSkuT5F9XHpElWltEZUfGMrBJg-Ydk3ZSdsoBAAB8AA.AQABGgEAAADW6jl31mB3T7ugrWTT8pFexG2aQZCQWXTOv-IVgPPOwrhOwR3VORb_Ti8AJVzYTygYUxTgUacUYnjzk7KuzL80PWGRIc90GFaYVUa990nU-aw8ZQO0Ci9lmLvWd-uA1l4gAA; esctx=PAQABBwEAAADW6jl31mB3T7ugrWTT8pFewx3kpKEA-5BxD8Xw2KP2AA9S6OK9ozXqvKoSG_p5CFuzuIIqXweFEqnMaQmVQel6ddi1l51mKiP2hsNKZ08oQp3VlhCU65dCmdD9t75HVRi90QLuSTVM51y02U4XfTtZ-mBpBwIgP23MJA0rudrO5pE-zpaBeaU8pXqf3DHb6MQgAA; esctx-rmheRu5exY=AQABCQEAAADW6jl31mB3T7ugrWTT8pFePgdYeXbxynAIMyjthjBDe74bZL_1xKY6PArl2FF1ig2AgRmbKWaySz3f-DUDVANkzH1OQJmf0KVufjKvWWYO2M1z0BaXA_QfYBs3XsDABza3a33OXIz1Q8rUmkPQKTDY1GoqG3XybkE3UaG6qhgjQiAA; fpc=AgixDrZbyBxEjMXxxDPE5kS8Ae7AAQAAAC1w-94OAAAA; MicrosoftApplicationsTelemetryDeviceId=17dc1c87-e7dd-43ce-8236-299458bc24f2; brcap=0; ai_session=SG3pOSDJKRvDJcC5tUcpSy\|1734965559344\|1734965559344
Source: global traffic	HTTP traffic detected: GET /iamgold.com/winauth/ssoprobe?client-request-id=2268d124-c00f-4338-9556-dd594fce6a57&_=1734965562446 HTTP/1.1Host: autologon.microsoftazuread-sso.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://login.365file.tech/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /common/instrumentation/dssostatus HTTP/1.1Host: login.365file.techConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: KmAT=56313130dd0d14b933a5516ed2cadc1c539b3efae52f454c4cc516ab8ea4c21b; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; esctx-NDj1gL61gzQ=AQABCQEAAADW6jl31mB3T7ugrWTT8pFeuWkNtOo4RtW9YQUmlp3AmhsWylx_-zhDOAyrMdcCjjamopW3jVcwBDQyQx5CXPNReuJ9qpSInAtzrcY83Ls8sWG8kI8Zlg5SQEzid7oR8QBSkqdXMjS3_yTPRGqF1K4pNlwCPw7-bB2jAvB9g7_2aSAA; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=1.AXwAMe_N-B6jSkuT5F9XHpElWltEZUfGMrBJg-Ydk3ZSdsoBAAB8AA.AQABGgEAAADW6jl31mB3T7ugrWTT8pFexG2aQZCQWXTOv-IVgPPOwrhOwR3VORb_Ti8AJVzYTygYUxTgUacUYnjzk7KuzL80PWGRIc90GFaYVUa990nU-aw8ZQO0Ci9lmLvWd-uA1l4gAA; esctx=PAQABBwEAAADW6jl31mB3T7ugrWTT8pFewx3kpKEA-5BxD8Xw2KP2AA9S6OK9ozXqvKoSG_p5CFuzuIIqXweFEqnMaQmVQel6ddi1l51mKiP2hsNKZ08oQp3VlhCU65dCmdD9t75HVRi90QLuSTVM51y02U4XfTtZ-mBpBwIgP23MJA0rudrO5pE-zpaBeaU8pXqf3DHb6MQgAA; esctx-rmheRu5exY=AQABCQEAAADW6jl31mB3T7ugrWTT8pFePgdYeXbxynAIMyjthjBDe74bZL_1xKY6PArl2FF1ig2AgRmbKWaySz3f-DUDVANkzH1OQJmf0KVufjKvWWYO2M1z0BaXA_QfYBs3XsDABza3a33OXIz1Q8rUmkPQKTDY1GoqG3XybkE3UaG6qhgjQiAA; fpc=AgixDrZbyBxEjMXxxDPE5kS8Ae7AAQAAAC1w-94OAAAA; MicrosoftApplicationsTelemetryDeviceId=17dc1c87-e7dd-43ce-8236-299458bc24f2; brcap=0; ai_session=SG3pOSDJKRvDJcC5tUcpSy\|1734965559344\|1734965559344; MSFPC=GUID=c42d33f0017949b5ba853992215f1505&HASH=c42d&LV=202412&V=4&LU=1734965567178

Source: global traffic	DNS traffic detected: DNS query: google.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: salesboost.com
Source: global traffic	DNS traffic detected: DNS query: login.365file.tech
Source: global traffic	DNS traffic detected: DNS query: a.nel.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: challenges.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: www.365file.tech
Source: global traffic	DNS traffic detected: DNS query: aadcdn.msftauth.net
Source: global traffic	DNS traffic detected: DNS query: ywnjb.365file.tech
Source: global traffic	DNS traffic detected: DNS query: autologon.microsoftazuread-sso.com
Source: global traffic	DNS traffic detected: DNS query: aadcdn.msauthimages.net

Source: unknown

HTTP traffic detected: POST /report/v4?s=Gi4947HrZfi9o1Ieftj0Ps5vDl%2F%2FdY8bfUKmop6%2FnbWEJQRIbqfHOVaYP%2FRf64yMeubajum%2BQF%2BJZIAaRxd2JoschL%2FQlPUIAqnrsLHeUOXW%2FcSKRnYRdKm%2BrvHI2VNOHDxKuA%3D%3D HTTP/1.1Host: a.nel.cloudflare.comConnection: keep-aliveContent-Length: 397Content-Type: application/reports+jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Mon, 23 Dec 2024 14:51:45 GMTContent-Type: text/html; charset=UTF-8Content-Length: 9043Connection: closeAccept-CH: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UACritical-CH: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UACross-Origin-Embedder-Policy: require-corpCross-Origin-Opener-Policy: same-originCross-Origin-Resource-Policy: same-originOrigin-Agent-Cluster: ?1Permissions-Policy: accelerometer=(),autoplay=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()Referrer-Policy: same-originX-Content-Options: nosniffX-Frame-Options: SAMEORIGINcf-mitigated: challenge
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Mon, 23 Dec 2024 14:51:51 GMTContent-Type: text/html; charset=UTF-8Content-Length: 9213Connection: closeAccept-CH: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UACritical-CH: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UACross-Origin-Embedder-Policy: require-corpCross-Origin-Opener-Policy: same-originCross-Origin-Resource-Policy: same-originOrigin-Agent-Cluster: ?1Permissions-Policy: accelerometer=(),autoplay=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()Referrer-Policy: same-originX-Content-Options: nosniffX-Frame-Options: SAMEORIGINcf-mitigated: challenge
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Mon, 23 Dec 2024 14:51:56 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeCF-Cache-Status: BYPASSReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=3Qbi7IajjU6MJ11HRBHSO8kmFUsMnMUv6HUBuZoD4o6oVvxzYKvAC0kE1Koi4CTT%2BaeG4tu4%2F6X0%2FbLYlPHSmoWiAn4lUn8VN3sbyABma7mBhzilx7h0ZovLQ5tWUIZnsbqNCg%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8f692c2a7f474346-EWRserver-timing: cfL4;desc="?proto=TCP&rtt=2251&min_rtt=2211&rtt_var=858&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2846&recv_bytes=1450&delivery_rate=1320669&cwnd=252&unsent_bytes=0&cid=27f072150eda4221&ts=631&x=0"
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 23 Dec 2024 14:51:57 GMTContent-Type: application/jsonContent-Length: 7Connection: closecf-chl-out: 3rbSRRwrEwpkQp47W8YTRPI2fbsqCAvrrS8=$l++cRkOkoaa3o2Cqcache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=GYwMow9NdFRzOKHBLt1IjdPKrzOpcJVvymMGVHkwJgUFRZESXNhW45zLqCRHgYK0u4eS%2BsJdoT%2FiIHx25pnD0NijPA6srxA5rqfPNCEvHufQV3jv05muToZyVcl%2BBoXRZVH%2BzA%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8f692c3448df72a4-EWRserver-timing: cfL4;desc="?proto=TCP&rtt=2039&min_rtt=2025&rtt_var=788&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2845&recv_bytes=1169&delivery_rate=1365123&cwnd=212&unsent_bytes=0&cid=a52a20ca0b1313d5&ts=448&x=0"
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Mon, 23 Dec 2024 14:52:02 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeCF-Cache-Status: BYPASSReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2dp2uQpfZ4RF3C8WBjHbWItO3EGYM2kZM48jIYjbO05yBIMayKyRB7j8unZJsbp%2F42TfRpo635f7%2Fng54gLpWEFqAGTs9S%2FrB5JOJJA4DrFBmSlWsBU406sJzmNK2sMcInuz3A%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8f692c51ae8643a3-EWRserver-timing: cfL4;desc="?proto=TCP&rtt=1873&min_rtt=1871&rtt_var=706&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2845&recv_bytes=1450&delivery_rate=1546610&cwnd=223&unsent_bytes=0&cid=0844cd3d05cdbc23&ts=697&x=0"
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 23 Dec 2024 14:52:04 GMTContent-Type: application/jsonContent-Length: 7Connection: closecache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0cf-chl-out: sG8TBoeqNB3avW9qn6epzKJ3UivvXhlK7Bw=$DpStIYQeY5GvBIQvServer: cloudflareCF-RAY: 8f692c5feb170cae-EWRalt-svc: h3=":443"; ma=86400
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 23 Dec 2024 14:52:10 GMTContent-Type: application/jsonContent-Length: 7Connection: closecf-chl-out: kS/MklzXfK90qyXp94SCWsqJ5kji1N3z0lo=$LpUqlypP1WUk9oN2cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0Server: cloudflareCF-RAY: 8f692c833b494268-EWRalt-svc: h3=":443"; ma=86400
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 23 Dec 2024 14:52:15 GMTContent-Type: application/jsonContent-Length: 7Connection: closecache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0cf-chl-out: Iu0wC3RqSHjXcLkRAbKf1rmgmznAMstJN2c=$g0yd0j+VFgG5v2hnServer: cloudflareCF-RAY: 8f692ca75f2419aa-EWRalt-svc: h3=":443"; ma=86400
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 23 Dec 2024 14:52:17 GMTContent-Type: application/jsonContent-Length: 7Connection: closecache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0cf-chl-out: desMwC8NGAwB1lpAiC8EcDY0yKhuqkpmg6E=$CzqW1wnJNyq5ZCAmReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=n%2BpkLfYA0ppX%2BtpuZED%2FAK4SNviZsZZLUw7zpmjMxo%2FIgBnJ2cZDMpydNTcFFWfdA6f3iWxxzw3PbQQgFR7j%2BJR43OVmONnY6SDVloJNTNNAo3jzbMcowlwe%2FUSC8VCu2BBdrg%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8f692cb23d7b43af-EWRserver-timing: cfL4;desc="?proto=TCP&rtt=2592&min_rtt=2569&rtt_var=980&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2845&recv_bytes=1169&delivery_rate=1136629&cwnd=230&unsent_bytes=0&cid=f9a7476a27e72c90&ts=453&x=0"
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Mon, 23 Dec 2024 14:52:17 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeCF-Cache-Status: BYPASSReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Y2pdMPKvQJyKGv1H%2F%2Fa6qfhl8IOkA5xq5sv0LsXTKpRrFrSmlrB8MLllD7UgR9GMUDBDeZsYCE5EQdOpQ7hfwvdbyE10EvJcm%2FZudWixEaRw0qcnaOQLlCndUkU35Q51deyWRg%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8f692cb2fd1743d0-EWRserver-timing: cfL4;desc="?proto=TCP&rtt=1748&min_rtt=1736&rtt_var=676&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2846&recv_bytes=1591&delivery_rate=1587819&cwnd=181&unsent_bytes=0&cid=e851b80f084809fa&ts=730&x=0"
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Mon, 23 Dec 2024 14:52:44 GMTContent-Type: text/html; charset=UTF-8Content-Length: 10148Connection: closeAccept-CH: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UACritical-CH: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UACross-Origin-Embedder-Policy: require-corpCross-Origin-Opener-Policy: same-originCross-Origin-Resource-Policy: same-originOrigin-Agent-Cluster: ?1Permissions-Policy: accelerometer=(),autoplay=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()Referrer-Policy: same-originX-Content-Options: nosniffX-Frame-Options: SAMEORIGINcf-mitigated: challenge
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Mon, 23 Dec 2024 14:52:49 GMTContent-Type: text/html; charset=UTF-8Content-Length: 10233Connection: closeAccept-CH: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UACritical-CH: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UACross-Origin-Embedder-Policy: require-corpCross-Origin-Opener-Policy: same-originCross-Origin-Resource-Policy: same-originOrigin-Agent-Cluster: ?1Permissions-Policy: accelerometer=(),autoplay=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()Referrer-Policy: same-originX-Content-Options: nosniffX-Frame-Options: SAMEORIGINcf-mitigated: challenge

Source: chromecache_241.7.dr, chromecache_274.7.dr	String found in binary or memory: https://login.365file.tech
Source: chromecache_241.7.dr, chromecache_274.7.dr	String found in binary or memory: https://login.windows-ppe.net

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 49856 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49833 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49810 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49811
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49810
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49809
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49808
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49803
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49802
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49800
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49857 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49854 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49809 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49843 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443

Source: CatalogCacheMetaData.xml.0.dr	OLE indicator, VBA macros: true
Source: 0E31D59D-7275-4D07-A5C4-416FA6F7F869.0.dr	OLE indicator, VBA macros: true

Source: CatalogCacheMetaData.xml.0.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: 0E31D59D-7275-4D07-A5C4-416FA6F7F869.0.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false

Source: unknown	Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\POWERPNT.EXE" "C:\Users\user\Desktop\Payout Receipts.pptx" /ou ""
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Process created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "B03D092F-7F5E-4048-ACB1-F88BD33C4817" "ED1F2C40-EE04-44CB-AC33-81F3E7A49921" "7016" "C:\Program Files (x86)\Microsoft Office\Root\Office16\POWERPNT.EXE" "PowerPointCombinedFloatieLreOnline.onnx"
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://google.com/amp/s/salesboost.com/jf#jennifer_wylie@iamgold.com
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2088 --field-trial-handle=1984,i,3837776693754288343,2079191398212795825,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Process created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "B03D092F-7F5E-4048-ACB1-F88BD33C4817" "ED1F2C40-EE04-44CB-AC33-81F3E7A49921" "7016" "C:\Program Files (x86)\Microsoft Office\Root\Office16\POWERPNT.EXE" "PowerPointCombinedFloatieLreOnline.onnx"	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2088 --field-trial-handle=1984,i,3837776693754288343,2079191398212795825,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: c2r64.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: gpapi.dll	Jump to behavior

Source: Payout Receipts.LNK.0.dr	LNK file: ..\..\..\..\..\Desktop\Payout Receipts.pptx
Source: Google Drive.lnk.6.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.6.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.6.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.6.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.6.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.6.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	1 Drive-by Compromise	Windows Management Instrumentation	2 Browser Extensions	1 Process Injection	1 Masquerading	OS Credential Dumping	1 Process Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 Scripting	1 Registry Run Keys / Startup Folder	1 Process Injection	LSASS Memory	1 File and Directory Discovery	Remote Desktop Protocol	Data from Removable Media	3 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 Registry Run Keys / Startup Folder	1 DLL Side-Loading	1 DLL Side-Loading	Security Account Manager	12 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	4 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	1 DLL Side-Loading	1 Extra Window Memory Injection	1 Extra Window Memory Injection	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	5 Application Layer Protocol	Traffic Duplication	Data Destruction

Source	Detection	Scanner	Label
https://login.365file.tech/cdn-cgi/challenge-platform/scripts/jsd/main.js	0%	Avira URL Cloud	safe
https://login.365file.tech/realm?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638705623427189137.ZjMxMzIyN2QtMGE3OC00NmM0LWE1MTUtZjIyOTAzNTFjOTNiMGY1ZDEyMTItODRlOC00ZDFiLWE1OTgtZDM3NTVkYzdlMTBh&ui_locales=en-US&mkt=en-US&client-request-id=2268d124-c00f-4338-9556-dd594fce6a57&state=tvii8EXN8vdyOmZPlmgT2ozXVAsKp5O-DVucGpacp0IskL2Bo9JmytF2a-VC6Z39FKl9fed1eRAF_O8X76DyfIJy5OI8lywMpfjKpViMqKuqVoEfpn8yNcfA390oWj8P6ISNSshBJ3f0qT1W6s3evXnNQHjODWy4hzgRj6ngKoLWn5QmSBT_NySCp-LH9nKEsj-vPZ3i4dnyd2GcEnv_hQ3OKEM1EG-x5pK1vMcuNP-G0aw83WQEv9wk8aAaP-03Qil3P1TyVDr0dx5hbxf5kA&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0	0%	Avira URL Cloud	safe
https://login.365file.tech/favicon.ico	0%	Avira URL Cloud	safe
https://login.365file.tech/cdn-cgi/challenge-platform/h/b/jsd/r/8f692cfaadd6de93	0%	Avira URL Cloud	safe
https://ywnjb.365file.tech/Me.htm?v=3	0%	Avira URL Cloud	safe
https://login.365file.tech/	0%	Avira URL Cloud	safe
https://salesboost.com/jf/	0%	Avira URL Cloud	safe
https://login.365file.tech/RKiKvqBc	0%	Avira URL Cloud	safe
https://login.365file.tech/common/GetCredentialType?mkt=en-US	0%	Avira URL Cloud	safe
https://login.365file.tech/cdn-cgi/challenge-platform/h/b/scripts/jsd/787bc399e22f/main.js?	0%	Avira URL Cloud	safe
https://salesboost.com/jf	0%	Avira URL Cloud	safe
https://login.365file.tech/cdn-cgi/challenge-platform/h/b/orchestrate/chl_page/v1?ray=8f692c10de854314	0%	Avira URL Cloud	safe
https://login.365file.tech/realm?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638705623427189137.ZjMxMzIyN2QtMGE3OC00NmM0LWE1MTUtZjIyOTAzNTFjOTNiMGY1ZDEyMTItODRlOC00ZDFiLWE1OTgtZDM3NTVkYzdlMTBh&ui_locales=en-US&mkt=en-US&client-request-id=2268d124-c00f-4338-9556-dd594fce6a57&state=tvii8EXN8vdyOmZPlmgT2ozXVAsKp5O-DVucGpacp0IskL2Bo9JmytF2a-VC6Z39FKl9fed1eRAF_O8X76DyfIJy5OI8lywMpfjKpViMqKuqVoEfpn8yNcfA390oWj8P6ISNSshBJ3f0qT1W6s3evXnNQHjODWy4hzgRj6ngKoLWn5QmSBT_NySCp-LH9nKEsj-vPZ3i4dnyd2GcEnv_hQ3OKEM1EG-x5pK1vMcuNP-G0aw83WQEv9wk8aAaP-03Qil3P1TyVDr0dx5hbxf5kA&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0&sso_reload=true	0%	Avira URL Cloud	safe
https://login.365file.tech/cdn-cgi/challenge-platform/h/b/flow/ov1/737265407:1734963256:v--qV6PRwMGnawi4djvFIfSHLRJhT5kPAgN_50_G6Z4/8f692c10de854314/TOGNyk6aUIk0aC21kLKjtzNEZhHS8WCD.p47H0GGFwc-1734965511-1.2.1.1-7sDAwg8cay2RCE3vybEEKXLSGgaICCttt2YuZIwFInu4e3r4yVRObJ1QXzXyeYKi	0%	Avira URL Cloud	safe
https://www.365file.tech/login	0%	Avira URL Cloud	safe
https://login.365file.tech/common/instrumentation/dssostatus	0%	Avira URL Cloud	safe
https://login.365file.tech	0%	Avira URL Cloud	safe

Name	IP	Active	Malicious	Reputation
google.com	172.217.17.46	true	false	high
a.nel.cloudflare.com	35.190.80.1	true	false	high
www.365file.tech	172.67.69.206	true	false	unknown
challenges.cloudflare.com	104.18.94.41	true	false	high
sni1gl.wpc.omegacdn.net	152.199.21.175	true	false	high
www.google.com	172.217.21.36	true	false	high
salesboost.com	52.89.58.139	true	false	unknown
s-part-0035.t-0009.t-msedge.net	13.107.246.63	true	false	high
login.365file.tech	172.67.69.206	true	false	high
ywnjb.365file.tech	104.26.13.241	true	false	unknown
autologon.microsoftazuread-sso.com	20.190.147.9	true	false	high
aadcdn.msauthimages.net	unknown	unknown	false	high
aadcdn.msftauth.net	unknown	unknown	false	high

Name	Malicious	Antivirus Detection	Reputation
https://login.365file.tech/realm?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638705623427189137.ZjMxMzIyN2QtMGE3OC00NmM0LWE1MTUtZjIyOTAzNTFjOTNiMGY1ZDEyMTItODRlOC00ZDFiLWE1OTgtZDM3NTVkYzdlMTBh&ui_locales=en-US&mkt=en-US&client-request-id=2268d124-c00f-4338-9556-dd594fce6a57&state=tvii8EXN8vdyOmZPlmgT2ozXVAsKp5O-DVucGpacp0IskL2Bo9JmytF2a-VC6Z39FKl9fed1eRAF_O8X76DyfIJy5OI8lywMpfjKpViMqKuqVoEfpn8yNcfA390oWj8P6ISNSshBJ3f0qT1W6s3evXnNQHjODWy4hzgRj6ngKoLWn5QmSBT_NySCp-LH9nKEsj-vPZ3i4dnyd2GcEnv_hQ3OKEM1EG-x5pK1vMcuNP-G0aw83WQEv9wk8aAaP-03Qil3P1TyVDr0dx5hbxf5kA&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0	false	Avira URL Cloud: safe	unknown
https://login.365file.tech/cdn-cgi/challenge-platform/scripts/jsd/main.js	false	Avira URL Cloud: safe	unknown
https://a.nel.cloudflare.com/report/v4?s=1fl16mbZGN4L%2BC0lQwIqaWE09wsbmfG0slCTbNhFwn%2FKL59MKSXOm5BohzorvipWbyXjZ9zWXZZw0%2Bl5UtAcKpAWyL3SP1gKL2jdzjEBaiAP5UiL1ZgP%2BmILzfInOQe02uGQOw%3D%3D	false		high
https://login.365file.tech/RKiKvqBc	false	Avira URL Cloud: safe	unknown
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/i/8f692c38cb37c43b/1734965522353/HWsekBJnYLOyFP0	false		high
https://login.365file.tech/	true	Avira URL Cloud: safe	unknown
https://autologon.microsoftazuread-sso.com/iamgold.com/winauth/ssoprobe?client-request-id=2268d124-c00f-4338-9556-dd594fce6a57&_=1734965562446	false		high
https://salesboost.com/jf/	false	Avira URL Cloud: safe	unknown
https://login.365file.tech/favicon.ico	false	Avira URL Cloud: safe	unknown
https://ywnjb.365file.tech/Me.htm?v=3	false	Avira URL Cloud: safe	unknown
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/cmg/1	false		high
https://login.365file.tech/common/GetCredentialType?mkt=en-US	false	Avira URL Cloud: safe	unknown
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/pat/8f692c38cb37c43b/1734965522352/7339b7655fb87e4c59a48d975d045630c30639ee310f0ebce0dfc6e6e6ed9473/43Aan-x4BPJpSgM	false		high
https://login.365file.tech/realm?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638705623427189137.ZjMxMzIyN2QtMGE3OC00NmM0LWE1MTUtZjIyOTAzNTFjOTNiMGY1ZDEyMTItODRlOC00ZDFiLWE1OTgtZDM3NTVkYzdlMTBh&ui_locales=en-US&mkt=en-US&client-request-id=2268d124-c00f-4338-9556-dd594fce6a57&state=tvii8EXN8vdyOmZPlmgT2ozXVAsKp5O-DVucGpacp0IskL2Bo9JmytF2a-VC6Z39FKl9fed1eRAF_O8X76DyfIJy5OI8lywMpfjKpViMqKuqVoEfpn8yNcfA390oWj8P6ISNSshBJ3f0qT1W6s3evXnNQHjODWy4hzgRj6ngKoLWn5QmSBT_NySCp-LH9nKEsj-vPZ3i4dnyd2GcEnv_hQ3OKEM1EG-x5pK1vMcuNP-G0aw83WQEv9wk8aAaP-03Qil3P1TyVDr0dx5hbxf5kA&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0#jennifer_wylie@iamgold.com	false		unknown
https://login.365file.tech/cdn-cgi/challenge-platform/h/b/scripts/jsd/787bc399e22f/main.js?	false	Avira URL Cloud: safe	unknown
https://login.365file.tech/cdn-cgi/challenge-platform/h/b/jsd/r/8f692cfaadd6de93	false	Avira URL Cloud: safe	unknown
https://login.365file.tech/realm?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638705623427189137.ZjMxMzIyN2QtMGE3OC00NmM0LWE1MTUtZjIyOTAzNTFjOTNiMGY1ZDEyMTItODRlOC00ZDFiLWE1OTgtZDM3NTVkYzdlMTBh&ui_locales=en-US&mkt=en-US&client-request-id=2268d124-c00f-4338-9556-dd594fce6a57&state=tvii8EXN8vdyOmZPlmgT2ozXVAsKp5O-DVucGpacp0IskL2Bo9JmytF2a-VC6Z39FKl9fed1eRAF_O8X76DyfIJy5OI8lywMpfjKpViMqKuqVoEfpn8yNcfA390oWj8P6ISNSshBJ3f0qT1W6s3evXnNQHjODWy4hzgRj6ngKoLWn5QmSBT_NySCp-LH9nKEsj-vPZ3i4dnyd2GcEnv_hQ3OKEM1EG-x5pK1vMcuNP-G0aw83WQEv9wk8aAaP-03Qil3P1TyVDr0dx5hbxf5kA&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0&sso_reload=true	false	Avira URL Cloud: safe	unknown
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/flow/ov1/59012872:1734963193:dJWEVcwbrnL1TTil6YmxbJ4SlF5pcoUWsQBeHspz6pg/8f692c38cb37c43b/vxu2uxafbM96ucUzDK4INX7dCY8HEjZkkcnYJbZchuI-1734965518-1.1.1.1-Eh2ysBkS1kMovo4eqQXf9rKEAPgIZYIJhkH0RyZFQodz6oLCEt8BZW60dk029qUW	false		high
https://www.google.com/amp/s/salesboost.com/jf	false		high
https://a.nel.cloudflare.com/report/v4?s=Gi4947HrZfi9o1Ieftj0Ps5vDl%2F%2FdY8bfUKmop6%2FnbWEJQRIbqfHOVaYP%2FRf64yMeubajum%2BQF%2BJZIAaRxd2JoschL%2FQlPUIAqnrsLHeUOXW%2FcSKRnYRdKm%2BrvHI2VNOHDxKuA%3D%3D	false		high
https://salesboost.com/jf	false	Avira URL Cloud: safe	unknown
https://login.365file.tech/cdn-cgi/challenge-platform/h/b/orchestrate/chl_page/v1?ray=8f692c10de854314	false	Avira URL Cloud: safe	unknown
https://login.365file.tech/cdn-cgi/challenge-platform/h/b/flow/ov1/737265407:1734963256:v--qV6PRwMGnawi4djvFIfSHLRJhT5kPAgN_50_G6Z4/8f692c10de854314/TOGNyk6aUIk0aC21kLKjtzNEZhHS8WCD.p47H0GGFwc-1734965511-1.2.1.1-7sDAwg8cay2RCE3vybEEKXLSGgaICCttt2YuZIwFInu4e3r4yVRObJ1QXzXyeYKi	false	Avira URL Cloud: safe	unknown
https://login.365file.tech/common/instrumentation/dssostatus	false	Avira URL Cloud: safe	unknown
https://login.365file.tech/RKiKvqBc#jennifer_wylie@iamgold.com	false		unknown
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv/99bnk/0x4AAAAAAADnPIDROrmt1Wwj/light/fbE/normal/auto/	false		high
https://a.nel.cloudflare.com/report/v4?s=WmgreJCzr0OhAa%2BUePNmLDzkZpGA%2B8fFMsUmNarKdgD4Fd6OzX0lNRlseI4uIuNV%2BgML3cRdbqW%2B%2F%2FK5zo8C6mhLybSzH6SwbodfQog3BE%2Bso%2FKAjb0uStxNEWkpyigyDgnR3g%3D%3D	false		high
https://login.365file.tech/realm?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638705623427189137.ZjMxMzIyN2QtMGE3OC00NmM0LWE1MTUtZjIyOTAzNTFjOTNiMGY1ZDEyMTItODRlOC00ZDFiLWE1OTgtZDM3NTVkYzdlMTBh&ui_locales=en-US&mkt=en-US&client-request-id=2268d124-c00f-4338-9556-dd594fce6a57&state=tvii8EXN8vdyOmZPlmgT2ozXVAsKp5O-DVucGpacp0IskL2Bo9JmytF2a-VC6Z39FKl9fed1eRAF_O8X76DyfIJy5OI8lywMpfjKpViMqKuqVoEfpn8yNcfA390oWj8P6ISNSshBJ3f0qT1W6s3evXnNQHjODWy4hzgRj6ngKoLWn5QmSBT_NySCp-LH9nKEsj-vPZ3i4dnyd2GcEnv_hQ3OKEM1EG-x5pK1vMcuNP-G0aw83WQEv9wk8aAaP-03Qil3P1TyVDr0dx5hbxf5kA&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0&sso_reload=true#jennifer_wylie@iamgold.com=	true		unknown
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/orchestrate/chl_api/v1?ray=8f692c38cb37c43b&lang=auto	false		high
https://www.365file.tech/login	false	Avira URL Cloud: safe	unknown

Name	Source	Malicious	Antivirus Detection	Reputation
https://login.windows-ppe.net	chromecache_241.7.dr, chromecache_274.7.dr	false		high
https://login.365file.tech	chromecache_241.7.dr, chromecache_274.7.dr	true	Avira URL Cloud: safe	unknown

IP	Domain	Country	ASN	ASN Name	Malicious
104.18.94.41	challenges.cloudflare.com	United States	13335	CLOUDFLARENETUS	false
172.67.69.206	www.365file.tech	United States	13335	CLOUDFLARENETUS	false
104.26.13.241	ywnjb.365file.tech	United States	13335	CLOUDFLARENETUS	false
172.217.21.36	www.google.com	United States	15169	GOOGLEUS	false
35.190.80.1	a.nel.cloudflare.com	United States	15169	GOOGLEUS	false
20.190.147.9	autologon.microsoftazuread-sso.com	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
104.18.95.41	unknown	United States	13335	CLOUDFLARENETUS	false
52.89.58.139	salesboost.com	United States	16509	AMAZON-02US	false
239.255.255.250	unknown	Reserved	unknown	unknown	false

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1579932
Start date and time:	2024-12-23 15:51:00 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 2s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Payout Receipts.pptx
Detection:	MAL
Classification:	mal64.phis.winPPTX@20/294@32/11
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .pptx

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
172.67.69.206	http://twbcompany.com	Get hash	malicious	Unknown	Browse
	https://www.givingday.communityschoolnaples.org/	Get hash	malicious	Unknown	Browse
	https://hbagc.net	Get hash	malicious	Unknown	Browse
	ACH933.htm	Get hash	malicious	HTMLPhisher	Browse
104.26.13.241	http://www.twbcompany.com	Get hash	malicious	Unknown	Browse
	http://ec44d1ee.freyy.pages.dev/Zimbra%20Web%20Client%20Sign%20In/	Get hash	malicious	Unknown	Browse
	https://hbagc.net	Get hash	malicious	Unknown	Browse
	ACH933.htm	Get hash	malicious	HTMLPhisher	Browse
104.18.94.41	7394231845.html	Get hash	malicious	Unknown	Browse
	https://gADK.quantumdhub.ru/HX8hiLPadaz1N7WrltpPjHg34q_2C98ig/	Get hash	malicious	Unknown	Browse
	YearEnd_Benefit_Bonus_Payout__Details__ChasChas.html	Get hash	malicious	Unknown	Browse
	https://contractorssteelform1flows.powerappsportals.com/	Get hash	malicious	HTMLPhisher	Browse
	https://dnearymedahealthstaffing.wordpress.com/medahealthstaffing-proposal/	Get hash	malicious	HTMLPhisher	Browse
	http://northwesthousingservices.discussripped.com	Get hash	malicious	HTMLPhisher	Browse
	https://account.book-ver.one	Get hash	malicious	Unknown	Browse
	https://click.pstmrk.it/3s/veed.io%2Fshare-video-link%3Ftoken%3DeyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJleHAiOjE3MzQ2MzE2NDgsImlhdCI6MTczNDYzMDc0OCwic3ViIjoiZmY0NTdiM2MtYjI3MC00YzA0LWEwOTEtYjY3ZDJkOGQ3ZTU1Iiwicm9sZXMiOltdLCJraWQiOiJwcm9qZWN0cy92ZWVkLXByb2Qtc2VydmVyL2xvY2F0aW9ucy9ldXJvcGUtd2VzdDEva2V5UmluZ3MvdmVlZC1wcm9kLWtleXJpbmcvY3J5cHRvS2V5cy92ZWVkLXByb2QtandrLWtleS9jcnlwdG9LZXlWZXJzaW9ucy8xIiwiZmVhdHVyZXMiOnt9LCJzY29wZXMiOltdfQ.f-EtSCYYeQiR4cEb8w5ABF3koXpbxl8QeFIarADkLP6q32DzsnFZl76Y98Uad7M8RBPPuOQOV9SUbCY1hRa4IbqV9_4cTm0v7DuBTCKOZbHN1NiATZOGw2BzdEMqIEfnNo5A_H2_DLVQZLtd6sZzcRoNBzbmcq2_xlzWgmqIErGV0VYXIb-Vac1b-3wmAgIyE-VS7Cd5aHYtVyiV9T5HfrpjPl7-M6dLIaQqm6103z7gO_qoKow1qbFmNgGaUsQED1CHbqo-hCgXzib7NToyu0Qq4kSl-2NEzgLMKy1zFR2J0E0vr9FHirjR9fmmDF2nk76Ht8L2WbV-dRyXZBZaUikfojo56vYWI9cfSQrG_awuFNR0M1s6dpPwumDM8sXlMZYt4u5WZaNcRZynPHXeqNZcdwKhlZrFN0U3B3U7B69avz_FlMxw6Or_0aeJkUP5YZP3wH-IIbwwa6es37u8G7gWYINEfp-pJlKV7klV1CcskLf_53iNx7MtxgvAXLMNZJ2tnuxY8W6w_E-pchjpNP2I5NV2Ui2_bNSgl3kBuX3oWsX0m_wL3MZ39pE3paPp2FAIgQPpZ5a0BhmPYsMk2IPPel2dll8j1IYBwHsZ5a1IHsHA6gTMWkJl-uhAjN4mnXo7Om0NWRZvfFvatgA4YCoTXdntM31GIZxAyWF9a14%26postLoginUrl%3D%252Fview%252F3ab9b7be-178c-4289-b29e-75921856f7f5%252F/oMlP/0SC6AQ/AQ/15f5e010-d260-490a-9e5d-79f5643b5481/1/HSOO9aL291	Get hash	malicious	Unknown	Browse
	https://p.placed.com/api/v2/sync/impression?partner=barkley&plaid=0063o000014sWgoAAE&version=1.0&payload_campaign_identifier=71700000100870630&payload_timestamp=5943094174221506287&payload_type=impression&redirect=http%3A%2F%2Fgoogle.com%2Famp%2Fs%2Fgoal.com.co%2Fwp%2Fpayment	Get hash	malicious	HTMLPhisher	Browse
	Executed_Innocap-#81(Final.pdf	Get hash	malicious	Unknown	Browse
104.18.95.41	7394231845.html	Get hash	malicious	Unknown	Browse
	https://gADK.quantumdhub.ru/HX8hiLPadaz1N7WrltpPjHg34q_2C98ig/	Get hash	malicious	Unknown	Browse
	YearEnd_Benefit_Bonus_Payout__Details__ChasChas.html	Get hash	malicious	Unknown	Browse
	https://contractorssteelform1flows.powerappsportals.com/	Get hash	malicious	HTMLPhisher	Browse
	https://lvxsystem.info/	Get hash	malicious	Unknown	Browse
	https://dnearymedahealthstaffing.wordpress.com/medahealthstaffing-proposal/	Get hash	malicious	HTMLPhisher	Browse
	https://account.book-ver.one	Get hash	malicious	Unknown	Browse
	https://p.placed.com/api/v2/sync/impression?partner=barkley&plaid=0063o000014sWgoAAE&version=1.0&payload_campaign_identifier=71700000100870630&payload_timestamp=5943094174221506287&payload_type=impression&redirect=http%3A%2F%2Fgoogle.com%2Famp%2Fs%2Fgoal.com.co%2Fwp%2Fpayment	Get hash	malicious	HTMLPhisher	Browse
	Executed_Innocap-#81(Final.pdf	Get hash	malicious	Unknown	Browse
	http://supplytic.ca/chuu/wpia/posha/sf_rand_string_mixed(24)/terence.tinnelly@innocapglobal.com	Get hash	malicious	Unknown	Browse

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	http://tax-com.com	Get hash	malicious	Unknown	Browse	172.67.203.198
	https://www.cocol88.site/l6v3z.php	Get hash	malicious	Unknown	Browse	104.21.63.207
	https://mandrillapp.com/track/click/30363981/app.salesforceiq.com?p=eyJzIjoiQ21jNldfVTIxTkdJZi1NQzQ1SGE3SXJFTW1RIiwidiI6MSwicCI6IntcInVcIjozMDM2Mzk4MSxcInZcIjoxLFwidXJsXCI6XCJodHRwczpcXFwvXFxcL2FwcC5zYWxlc2ZvcmNlaXEuY29tXFxcL3I_dD1BRndoWmYwNjV0QlFRSnRiMVFmd1A1dC0tMHZnQkowaF9lYklFcTVLRlhTWHFVWmFpNUo4RlFTd1dycTkzR1FPbEFuczlLREd2VzRJQ2Z2eGo4WjVDSkQxUTlXdDVvME5XNWMwY0tIaXpVQWJ1YnBhT2dtS2pjVkxkaDFZWE8ybklsdFRlb2VQZ2dVTCZ0YXJnZXQ9NjMxZjQyMGVlZDEzY2EzYmNmNzdjMzI0JnVybD1odHRwczpcXFwvXFxcL21haW4uZDNxczBuMG9xdjNnN28uYW1wbGlmeWFwcC5jb21cIixcImlkXCI6XCI5ZTdkODJiNWQ0NzA0YWVhYTQ1ZjkxY2Y0ZTFmNGRiMFwiLFwidXJsX2lkc1wiOltcImY5ODQ5NWVhMjMyYTgzNjg1ODUxN2Y4ZTRiOTVjZjg4MWZlODExNmJcIl19In0	Get hash	malicious	Unknown	Browse	172.67.69.226
	file.exe	Get hash	malicious	LummaC	Browse	104.21.95.235
	file.exe	Get hash	malicious	FormBook	Browse	104.21.40.196
	https://mandrillapp.com/track/click/30903880/lamp.avocet.io?p=eyJzIjoiM2NCLS1TMlk4RWF3Nl9vVXV4SHlzRDZ5dmJJIiwidiI6MSwicCI6IntcInVcIjozMDkwMzg4MCxcInZcIjoxLFwidXJsXCI6XCJodHRwczpcXFwvXFxcL2xhbXAuYXZvY2V0LmlvXFxcL25ldy11c2VyXCIsXCJpZFwiOlwiMTMxMTQyZmQwMzMxNDA4MWE0YmQyOGYzZDRmYmViYzRcIixcInVybF9pZHNcIjpbXCI0OWFlZTViODJkYzk4NGYxNTg2ZGIzZTYzNGE5ZWUxMDgxYjVmMDY5XCJdfSJ9	Get hash	malicious	Unknown	Browse	104.18.16.155
	https://laimilano.powerappsportals.com/	Get hash	malicious	Unknown	Browse	104.21.22.164
	Order_12232024.exe	Get hash	malicious	MassLogger RAT	Browse	172.67.177.134
	acronis recovery expert deluxe 1.0.0.132.rarl.exe	Get hash	malicious	LummaC	Browse	104.21.35.89
	rTTSWIFTCOPIES.exe	Get hash	malicious	MassLogger RAT	Browse	172.67.177.134
CLOUDFLARENETUS	http://tax-com.com	Get hash	malicious	Unknown	Browse	172.67.203.198
	https://www.cocol88.site/l6v3z.php	Get hash	malicious	Unknown	Browse	104.21.63.207
	https://mandrillapp.com/track/click/30363981/app.salesforceiq.com?p=eyJzIjoiQ21jNldfVTIxTkdJZi1NQzQ1SGE3SXJFTW1RIiwidiI6MSwicCI6IntcInVcIjozMDM2Mzk4MSxcInZcIjoxLFwidXJsXCI6XCJodHRwczpcXFwvXFxcL2FwcC5zYWxlc2ZvcmNlaXEuY29tXFxcL3I_dD1BRndoWmYwNjV0QlFRSnRiMVFmd1A1dC0tMHZnQkowaF9lYklFcTVLRlhTWHFVWmFpNUo4RlFTd1dycTkzR1FPbEFuczlLREd2VzRJQ2Z2eGo4WjVDSkQxUTlXdDVvME5XNWMwY0tIaXpVQWJ1YnBhT2dtS2pjVkxkaDFZWE8ybklsdFRlb2VQZ2dVTCZ0YXJnZXQ9NjMxZjQyMGVlZDEzY2EzYmNmNzdjMzI0JnVybD1odHRwczpcXFwvXFxcL21haW4uZDNxczBuMG9xdjNnN28uYW1wbGlmeWFwcC5jb21cIixcImlkXCI6XCI5ZTdkODJiNWQ0NzA0YWVhYTQ1ZjkxY2Y0ZTFmNGRiMFwiLFwidXJsX2lkc1wiOltcImY5ODQ5NWVhMjMyYTgzNjg1ODUxN2Y4ZTRiOTVjZjg4MWZlODExNmJcIl19In0	Get hash	malicious	Unknown	Browse	172.67.69.226
	file.exe	Get hash	malicious	LummaC	Browse	104.21.95.235
	file.exe	Get hash	malicious	FormBook	Browse	104.21.40.196
	https://mandrillapp.com/track/click/30903880/lamp.avocet.io?p=eyJzIjoiM2NCLS1TMlk4RWF3Nl9vVXV4SHlzRDZ5dmJJIiwidiI6MSwicCI6IntcInVcIjozMDkwMzg4MCxcInZcIjoxLFwidXJsXCI6XCJodHRwczpcXFwvXFxcL2xhbXAuYXZvY2V0LmlvXFxcL25ldy11c2VyXCIsXCJpZFwiOlwiMTMxMTQyZmQwMzMxNDA4MWE0YmQyOGYzZDRmYmViYzRcIixcInVybF9pZHNcIjpbXCI0OWFlZTViODJkYzk4NGYxNTg2ZGIzZTYzNGE5ZWUxMDgxYjVmMDY5XCJdfSJ9	Get hash	malicious	Unknown	Browse	104.18.16.155
	https://laimilano.powerappsportals.com/	Get hash	malicious	Unknown	Browse	104.21.22.164
	Order_12232024.exe	Get hash	malicious	MassLogger RAT	Browse	172.67.177.134
	acronis recovery expert deluxe 1.0.0.132.rarl.exe	Get hash	malicious	LummaC	Browse	104.21.35.89
	rTTSWIFTCOPIES.exe	Get hash	malicious	MassLogger RAT	Browse	172.67.177.134
CLOUDFLARENETUS	http://tax-com.com	Get hash	malicious	Unknown	Browse	172.67.203.198
	https://www.cocol88.site/l6v3z.php	Get hash	malicious	Unknown	Browse	104.21.63.207
	https://mandrillapp.com/track/click/30363981/app.salesforceiq.com?p=eyJzIjoiQ21jNldfVTIxTkdJZi1NQzQ1SGE3SXJFTW1RIiwidiI6MSwicCI6IntcInVcIjozMDM2Mzk4MSxcInZcIjoxLFwidXJsXCI6XCJodHRwczpcXFwvXFxcL2FwcC5zYWxlc2ZvcmNlaXEuY29tXFxcL3I_dD1BRndoWmYwNjV0QlFRSnRiMVFmd1A1dC0tMHZnQkowaF9lYklFcTVLRlhTWHFVWmFpNUo4RlFTd1dycTkzR1FPbEFuczlLREd2VzRJQ2Z2eGo4WjVDSkQxUTlXdDVvME5XNWMwY0tIaXpVQWJ1YnBhT2dtS2pjVkxkaDFZWE8ybklsdFRlb2VQZ2dVTCZ0YXJnZXQ9NjMxZjQyMGVlZDEzY2EzYmNmNzdjMzI0JnVybD1odHRwczpcXFwvXFxcL21haW4uZDNxczBuMG9xdjNnN28uYW1wbGlmeWFwcC5jb21cIixcImlkXCI6XCI5ZTdkODJiNWQ0NzA0YWVhYTQ1ZjkxY2Y0ZTFmNGRiMFwiLFwidXJsX2lkc1wiOltcImY5ODQ5NWVhMjMyYTgzNjg1ODUxN2Y4ZTRiOTVjZjg4MWZlODExNmJcIl19In0	Get hash	malicious	Unknown	Browse	172.67.69.226
	file.exe	Get hash	malicious	LummaC	Browse	104.21.95.235
	file.exe	Get hash	malicious	FormBook	Browse	104.21.40.196
	https://mandrillapp.com/track/click/30903880/lamp.avocet.io?p=eyJzIjoiM2NCLS1TMlk4RWF3Nl9vVXV4SHlzRDZ5dmJJIiwidiI6MSwicCI6IntcInVcIjozMDkwMzg4MCxcInZcIjoxLFwidXJsXCI6XCJodHRwczpcXFwvXFxcL2xhbXAuYXZvY2V0LmlvXFxcL25ldy11c2VyXCIsXCJpZFwiOlwiMTMxMTQyZmQwMzMxNDA4MWE0YmQyOGYzZDRmYmViYzRcIixcInVybF9pZHNcIjpbXCI0OWFlZTViODJkYzk4NGYxNTg2ZGIzZTYzNGE5ZWUxMDgxYjVmMDY5XCJdfSJ9	Get hash	malicious	Unknown	Browse	104.18.16.155
	https://laimilano.powerappsportals.com/	Get hash	malicious	Unknown	Browse	104.21.22.164
	Order_12232024.exe	Get hash	malicious	MassLogger RAT	Browse	172.67.177.134
	acronis recovery expert deluxe 1.0.0.132.rarl.exe	Get hash	malicious	LummaC	Browse	104.21.35.89
	rTTSWIFTCOPIES.exe	Get hash	malicious	MassLogger RAT	Browse	172.67.177.134

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 4761 bytes, 1 file, at 0x2c +A "disallowedcert.stl", number 1, 1 datablock, 0x1 compression
Category:	dropped
Size (bytes):	4761
Entropy (8bit):	7.945585251880973
Encrypted:	false
SSDEEP:	96:6ZUpZsm0HwZ8FLSeXs+aiL9qcZ7KtlAD1GlNHgdkVI5F11AcNmwkVFzGz6ENhZC7:62T0QOLl8vAqcZ7K3AUNAdx5FAx9VEOj
MD5:	77B20B5CD41BC6BB475CCA3F91AE6E3C
SHA1:	9E98ACE72BD2AB931341427A856EF4CEA6FAF806
SHA-256:	5511A9B9F9144ED7BDE4CCB074733B7C564D918D2A8B10D391AFC6BE5B3B1509
SHA-512:	3537DA5E7F3ABA3DAFE6A86E9511ABA20B7A3D34F30AEA6CC11FEEF7768BD63C0C85679C49E99C3291BD1B552DED2C6973B6C2F7F6D731BCFACECAB218E72FD4
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	MSCF............,...................O..................YWP .disallowedcert.stl.lJ..B...CK.wTS.....{.&Uz.I."E".HS@. .P.!.....E. .DQ..... EDA.H. E..""/.s<.s.9.....&#.{~k.VV..7@......b.R....MdT..B.L..%.C......" ....%.4%..%.B..T.d...S.....pem..$....&.q.`.+...E..C.....$.\|.A.!~d.H>w%S$...QC't..;..<..R@....2. .l..?..c..A....Ew...l..K$.. ~...'......Mt^c..s.Y%..}......h......m....h.......~d...,...=ge3.....2%..(...T..!].....!C~.X..MHU.o[.z].Y...&lXG;uW.:...2!..][\/.G..]6#.I...S..#F.X.k.j.....)Nc.].t^.-l.Y...4?.b...rY....A......7.D.H\.R...s.L,.6.\|.....VQ....<........... [Z....].N0LU.X........6..C\....F.....KbZ..^=.@.B..MyH...%.2.>...]..E.....sZ.f..3z.].Y.t.d$.....P...,. .~..mNZ[PL.<....d..+...l.-...b.^....6F..z.&.;D.._..c."...d..... k9....60?&..Y.v.dgu...{.....{..d=..$......@^..qA..*uJ..@W.V..eC..AV.e+21...N.{.]..]..f]..`Z.....]2.....x..f..K...t. ...e.V.U.$PV..@6W\_nsm.n.........A<.......d....@f..Z... >R..k.....8..Y....E>..2o7..........c..K7n....

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Payout Receipts.pptx

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

HTML

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Phishing

Software Vulnerabilities

Networking

System Summary

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

QR Codes

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157

C:\Users\user\AppData\Local\Microsoft\FontCache\4\CatalogCacheMetaData.xml

C:\Users\user\AppData\Local\Microsoft\FontCache\4\Catalog\ListAll.Json

C:\Users\user\AppData\Local\Microsoft\FontCache\4\PreviewFont\flat_officeFontsPreview_4_40.ttf

C:\Users\user\AppData\Local\Microsoft\Office\16.0\UsageMetricsStore\FileActivityStore\PowerPoint\1380790193167760279.C4

C:\Users\user\AppData\Local\Microsoft\Office\16.0\UsageMetricsStore\FileActivityStore\PowerPoint\ASkwMDAwMDAwMC0wMDAwLTAwMDAtMDAwMC0wMDAwMDAwMDAwMDBfTnVsbAA.S

C:\Users\user\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\0E31D59D-7275-4D07-A5C4-416FA6F7F869

C:\Users\user\AppData\Local\Microsoft\Office\OTele\powerpnt.exe.db

C:\Users\user\AppData\Local\Microsoft\Office\OTele\powerpnt.exe.db-journal

C:\Users\user\AppData\Local\Microsoft\Office\OTele\powerpnt.exe.db-shm

C:\Users\user\AppData\Local\Microsoft\Office\OTele\powerpnt.exe.db-wal

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\089d66ba04a8cec4bdc5267f42f39cf84278bb67.tbres

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\5475cb191e478c39370a215b2da98a37e9dc813d.tbres

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\56a61aeb75d8f5be186c26607f4bb213abe7c5ec.tbres

C:\Users\user\AppData\Local\Temp\Diagnostics\POWERPNT\App1734965486125046100_D29EDC9C-05D7-4422-9E4E-DB7CF31D8F9D.log

C:\Users\user\AppData\Local\Temp\Diagnostics\POWERPNT\App1734965486125627200_D29EDC9C-05D7-4422-9E4E-DB7CF31D8F9D.log

C:\Users\user\AppData\Local\Temp\TCD1378.tmp\Content.inf

C:\Users\user\AppData\Local\Temp\TCD1378.tmp\ThemePictureAccent.glox

C:\Users\user\AppData\Local\Temp\TCD1379.tmp\Content.inf

C:\Users\user\AppData\Local\Temp\TCD1379.tmp\VaryingWidthList.glox

C:\Users\user\AppData\Local\Temp\TCD137A.tmp\Content.inf

Windows Analysis Report
Payout Receipts.pptx

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Dec 23 13:51:33 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2673
Entropy (8bit):	3.985692059049181
Encrypted:	false
SSDEEP:	48:8el8d5ThhncHQidAKZdA1FehwiZUklqehey+3:8ekbn3xy
MD5:	5D1217401FDBE8EB5F288637B3968F27
SHA1:	5A7A92F9D45C90EFC11623AF93B25ACA6C845CAD
SHA-256:	665976B065C5B0EF3B78D1D29BF9B9109DE8869E553D84A0DFA434635B6BBF74
SHA-512:	9E874079A0646D43FDB9B0BBAC5D348E41F28EA0058C2AF4E8C280E514A03C5D9D95351530308F006E05C716E7A04CBF66CE923AA8D1B18254CC75994C7834D1
Malicious:	false
Preview:	L..................F.@.. ...$+.,....n..(JU..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.Yev....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Ypv....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Ypv....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Ypv..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Yqv...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i....................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

File type:	Microsoft PowerPoint 2007+
Entropy (8bit):	7.978450677471967
TrID:	PowerPoint Microsoft Office Open XML Format document (133004/1) 76.65% Microsoft PowerPoint Macro-enabled Open XML add-in (32504/1) 18.73% ZIP compressed archive (8000/1) 4.61% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	Payout Receipts.pptx
File size:	210'772 bytes
MD5:	0e0b49b01a6738d8431c5869d4acf5fe
SHA1:	67db202829294ad5280e0b19d885f730217817e0
SHA256:	02caa19967116536da9e63ac39b4022fb566e4a12877822cf85061bdf356ad43
SHA512:	e5ddcd59d60d5d1fd53cd3af4dd7c3236ecd3484b444d91c3b253dd8299dbde217dcfd5117cd97423ad8f85d4b2cce46eea0b4019670cd6089f22bbe6649b5d4
SSDEEP:	3072:lDxdq3Nng2RQj3MTokJuEulCGZquL2tIueTHXsFmnnPqguXABcuQwtdoD3:la3NgQ18muS4qhaCtX0QKds
TLSH:	43241259FE034222C2B31AB0D139E29491B9CD92A54BEE49E9F275C2071DD510B8FBDE
File Content Preview:	PK............................[Content_Types].xml...n.:....8. p.X..6M..Y...%@..`....7p.....h.Q..Jj..F.......x.^...k...........J.E...~.]..I8%.wP.. ......v.......[.....\..X....f..........)........#p4.F....a.V...5......`..m...b.6...w.....<...`. E.`.....k..j.

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 23, 2024 15:51:32.722528934 CET	54208	53	192.168.2.16	1.1.1.1
Dec 23, 2024 15:51:32.722670078 CET	53862	53	192.168.2.16	1.1.1.1
Dec 23, 2024 15:51:32.860204935 CET	53	54208	1.1.1.1	192.168.2.16
Dec 23, 2024 15:51:32.860933065 CET	53	51405	1.1.1.1	192.168.2.16
Dec 23, 2024 15:51:32.862896919 CET	53	53862	1.1.1.1	192.168.2.16
Dec 23, 2024 15:51:32.894838095 CET	53	49456	1.1.1.1	192.168.2.16
Dec 23, 2024 15:51:35.541538000 CET	57357	53	192.168.2.16	1.1.1.1
Dec 23, 2024 15:51:35.541671991 CET	54530	53	192.168.2.16	1.1.1.1
Dec 23, 2024 15:51:35.678553104 CET	53	54530	1.1.1.1	192.168.2.16
Dec 23, 2024 15:51:35.679387093 CET	53	57357	1.1.1.1	192.168.2.16
Dec 23, 2024 15:51:35.696598053 CET	53	60584	1.1.1.1	192.168.2.16
Dec 23, 2024 15:51:39.202078104 CET	54113	53	192.168.2.16	1.1.1.1
Dec 23, 2024 15:51:39.202224016 CET	64186	53	192.168.2.16	1.1.1.1
Dec 23, 2024 15:51:39.568820000 CET	53	64186	1.1.1.1	192.168.2.16
Dec 23, 2024 15:51:39.603868961 CET	53	54113	1.1.1.1	192.168.2.16
Dec 23, 2024 15:51:43.492150068 CET	53559	53	192.168.2.16	1.1.1.1
Dec 23, 2024 15:51:43.492283106 CET	53597	53	192.168.2.16	1.1.1.1
Dec 23, 2024 15:51:43.898793936 CET	53	53559	1.1.1.1	192.168.2.16
Dec 23, 2024 15:51:43.899501085 CET	53	53597	1.1.1.1	192.168.2.16
Dec 23, 2024 15:51:45.565320015 CET	61203	53	192.168.2.16	1.1.1.1
Dec 23, 2024 15:51:45.566093922 CET	50819	53	192.168.2.16	1.1.1.1
Dec 23, 2024 15:51:45.702544928 CET	53	61203	1.1.1.1	192.168.2.16
Dec 23, 2024 15:51:45.705600023 CET	53	50819	1.1.1.1	192.168.2.16
Dec 23, 2024 15:51:52.591056108 CET	53	54899	1.1.1.1	192.168.2.16
Dec 23, 2024 15:51:54.268104076 CET	53168	53	192.168.2.16	1.1.1.1
Dec 23, 2024 15:51:54.268384933 CET	49494	53	192.168.2.16	1.1.1.1
Dec 23, 2024 15:51:54.286190033 CET	63613	53	192.168.2.16	1.1.1.1
Dec 23, 2024 15:51:54.286355972 CET	63161	53	192.168.2.16	1.1.1.1
Dec 23, 2024 15:51:54.405772924 CET	53	53168	1.1.1.1	192.168.2.16
Dec 23, 2024 15:51:54.406544924 CET	53	49494	1.1.1.1	192.168.2.16
Dec 23, 2024 15:51:54.423145056 CET	53	63161	1.1.1.1	192.168.2.16
Dec 23, 2024 15:51:54.427495003 CET	53	63613	1.1.1.1	192.168.2.16
Dec 23, 2024 15:51:56.466197968 CET	49617	53	192.168.2.16	1.1.1.1
Dec 23, 2024 15:51:56.466495991 CET	50600	53	192.168.2.16	1.1.1.1
Dec 23, 2024 15:51:56.474411011 CET	58744	53	192.168.2.16	1.1.1.1
Dec 23, 2024 15:51:56.474556923 CET	65148	53	192.168.2.16	1.1.1.1
Dec 23, 2024 15:51:56.603359938 CET	53	49617	1.1.1.1	192.168.2.16
Dec 23, 2024 15:51:56.603404045 CET	53	50600	1.1.1.1	192.168.2.16
Dec 23, 2024 15:51:56.611437082 CET	53	58744	1.1.1.1	192.168.2.16
Dec 23, 2024 15:51:56.611968994 CET	53	65148	1.1.1.1	192.168.2.16
Dec 23, 2024 15:52:11.289483070 CET	53	53161	1.1.1.1	192.168.2.16
Dec 23, 2024 15:52:20.658997059 CET	59278	53	192.168.2.16	1.1.1.1
Dec 23, 2024 15:52:20.659166098 CET	55200	53	192.168.2.16	1.1.1.1
Dec 23, 2024 15:52:20.801528931 CET	53	55200	1.1.1.1	192.168.2.16
Dec 23, 2024 15:52:20.801558018 CET	53	59278	1.1.1.1	192.168.2.16
Dec 23, 2024 15:52:29.833749056 CET	60487	53	192.168.2.16	1.1.1.1
Dec 23, 2024 15:52:29.833935976 CET	64679	53	192.168.2.16	1.1.1.1
Dec 23, 2024 15:52:29.971834898 CET	53	60487	1.1.1.1	192.168.2.16
Dec 23, 2024 15:52:29.971911907 CET	53	64679	1.1.1.1	192.168.2.16
Dec 23, 2024 15:52:30.208796024 CET	65025	53	192.168.2.16	1.1.1.1
Dec 23, 2024 15:52:30.209093094 CET	63465	53	192.168.2.16	1.1.1.1
Dec 23, 2024 15:52:30.352341890 CET	53	63465	1.1.1.1	192.168.2.16
Dec 23, 2024 15:52:30.352471113 CET	53	65025	1.1.1.1	192.168.2.16
Dec 23, 2024 15:52:32.749006987 CET	53	54289	1.1.1.1	192.168.2.16
Dec 23, 2024 15:52:34.341854095 CET	53	49996	1.1.1.1	192.168.2.16
Dec 23, 2024 15:52:35.031272888 CET	138	138	192.168.2.16	192.168.2.255
Dec 23, 2024 15:52:41.064071894 CET	53	60317	1.1.1.1	192.168.2.16
Dec 23, 2024 15:52:43.652776957 CET	54156	53	192.168.2.16	1.1.1.1
Dec 23, 2024 15:52:43.652905941 CET	54682	53	192.168.2.16	1.1.1.1
Dec 23, 2024 15:52:43.790489912 CET	53	54156	1.1.1.1	192.168.2.16
Dec 23, 2024 15:52:43.890898943 CET	53	54682	1.1.1.1	192.168.2.16
Dec 23, 2024 15:52:45.572784901 CET	59891	53	192.168.2.16	1.1.1.1
Dec 23, 2024 15:52:45.572906971 CET	54594	53	192.168.2.16	1.1.1.1
Dec 23, 2024 15:52:45.710817099 CET	53	54594	1.1.1.1	192.168.2.16
Dec 23, 2024 15:52:45.711520910 CET	53	59891	1.1.1.1	192.168.2.16
Dec 23, 2024 15:52:48.753592968 CET	59967	53	192.168.2.16	1.1.1.1
Dec 23, 2024 15:52:48.753743887 CET	62494	53	192.168.2.16	1.1.1.1
Dec 23, 2024 15:52:51.712394953 CET	59946	53	192.168.2.16	1.1.1.1
Dec 23, 2024 15:52:51.712693930 CET	63177	53	192.168.2.16	1.1.1.1
Dec 23, 2024 15:53:05.073168039 CET	53	50672	1.1.1.1	192.168.2.16

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Dec 23, 2024 15:52:43.891036987 CET	192.168.2.16	1.1.1.1	c24d	(Port unreachable)	Destination Unreachable
Dec 23, 2024 15:53:02.695574045 CET	192.168.2.16	1.1.1.1	c23f	(Port unreachable)	Destination Unreachable

Timestamp	Bytes transferred	Direction	Data
2024-12-23 14:51:37 UTC	837	OUT	GET /amp/s/salesboost.com/jf HTTP/1.1 Host: www.google.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIkqHLAQj2mM0BCIWgzQEI3L3NAQiRys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-23 14:51:39 UTC	1181	IN	HTTP/1.1 302 Found Location: https://salesboost.com/jf Cache-Control: private X-Robots-Tag: noindex Content-Type: text/html; charset=UTF-8 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-xh72AMr97RYmTGSDgDR-ZA' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Permissions-Policy: unload=() P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Date: Mon, 23 Dec 2024 14:51:38 GMT Server: gws Content-Length: 222 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Set-Cookie: NID=520=gK7O0nTsR-wPx05SrBJUd3HAfX4M9fc3aqd2XTKtTlIL-40D9SE3v73cbehuTvOeWv7KMN6SzEvw8450IfocIWnMawOJxHynYMsOO5fqWdvfMBtm--u9BujLGT0VtJ6dqbxcZjYp3EkCYhKkezVxOguXncHPaP_B08fK1K4CIpBspFVoRYKd_Yz5WTA31IXgra3h; expires=Tue, 24-Jun-2025 14:51:38 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-12-23 14:51:39 UTC	209	IN	Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 3c 54 49 54 4c 45 3e 33 30 32 20 4d 6f 76 65 64 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 33 30 32 20 4d 6f 76 65 64 3c 2f 48 31 3e 0a 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 0a 3c 41 20 48 52 45 46 3d 22 68 74 74 70 73 3a 2f 2f 73 61 6c 65 73 62 6f 6f 73 74 2e 63 6f 6d 2f 6a 66 22 3e 68 65 72 65 3c 2f 41 3e 2e 0d 0a 3c 2f 42 Data Ascii: <HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8"><TITLE>302 Moved</TITLE></HEAD><BODY><H1>302 Moved</H1>The document has moved<A HREF="https://salesboost.com/jf">here</A>.</B
2024-12-23 14:51:39 UTC	13	IN	Data Raw: 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: ODY></HTML>

Timestamp	Bytes transferred	Direction	Data
2024-12-23 14:51:41 UTC	659	OUT	GET /jf HTTP/1.1 Host: salesboost.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-23 14:51:41 UTC	589	IN	HTTP/1.1 301 Moved Permanently Date: Mon, 23 Dec 2024 14:51:41 GMT Server: Apache/2.4.62 (Ubuntu) x-xss-protection: 1; mode=block x-frame-options: SAMEORIGIN x-content-type-options: nosniff Strict-Transport-Security: max-age=31536000; includeSubDomains; preload feature-policy: autoplay 'none'; camera 'none' Content-Security-Policy: upgrade-insecure-requests; Referrer-Policy: same-origin Permissions-Policy: geolocation=(self https://salesboost.com); Location: https://salesboost.com/jf/ Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1
2024-12-23 14:51:41 UTC	315	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 61 6c 65 73 62 6f 6f 73 74 2e 63 6f 6d 2f 6a 66 2f 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 36 32 20 28 55 62 75 6e 74 75 29 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>301 Moved Permanently</title></head><body><h1>Moved Permanently</h1><p>The document has moved <a href="https://salesboost.com/jf/">here</a>.</p><hr><address>Apache/2.4.62 (Ubuntu)

Timestamp	Bytes transferred	Direction	Data
2024-12-23 14:51:42 UTC	660	OUT	GET /jf/ HTTP/1.1 Host: salesboost.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-23 14:51:43 UTC	612	IN	HTTP/1.1 302 Found Date: Mon, 23 Dec 2024 14:51:43 GMT Server: Apache/2.4.62 (Ubuntu) x-xss-protection: 1; mode=block x-frame-options: SAMEORIGIN x-content-type-options: nosniff Strict-Transport-Security: max-age=31536000; includeSubDomains; preload feature-policy: autoplay 'none'; camera 'none' Content-Security-Policy: upgrade-insecure-requests; Referrer-Policy: same-origin Permissions-Policy: geolocation=(self https://salesboost.com); Location: https://login.365file.tech/RKiKvqBc X-Content-Type-Options: nosniff Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Timestamp	Bytes transferred	Direction	Data
2024-12-23 14:51:45 UTC	669	OUT	GET /RKiKvqBc HTTP/1.1 Host: login.365file.tech Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-23 14:51:45 UTC	1279	IN	HTTP/1.1 403 Forbidden Date: Mon, 23 Dec 2024 14:51:45 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 9043 Connection: close Accept-CH: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA Critical-CH: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA Cross-Origin-Embedder-Policy: require-corp Cross-Origin-Opener-Policy: same-origin Cross-Origin-Resource-Policy: same-origin Origin-Agent-Cluster: ?1 Permissions-Policy: accelerometer=(),autoplay=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=() Referrer-Policy: same-origin X-Content-Options: nosniff X-Frame-Options: SAMEORIGIN cf-mitigated: challenge
2024-12-23 14:51:45 UTC	895	IN	Data Raw: 63 66 2d 63 68 6c 2d 6f 75 74 3a 20 71 67 5a 32 33 6e 2b 6a 64 6b 6f 76 48 73 77 62 51 64 62 62 6e 47 74 2b 67 74 30 66 57 61 39 53 6e 59 73 48 31 79 35 64 4f 54 54 2f 6c 44 75 37 7a 50 6b 76 6d 66 6f 37 42 70 49 57 4b 71 2b 65 54 64 69 50 50 5a 32 54 41 36 79 53 6a 62 34 2b 52 6d 54 4e 4d 47 43 41 61 4f 71 51 64 58 58 61 36 57 36 37 6a 35 6a 71 68 37 49 3d 24 35 54 6e 2f 4d 33 4c 59 68 53 6c 49 6f 70 36 62 73 72 52 46 48 41 3d 3d 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f 6c 3a 20 70 72 69 76 61 74 65 2c 20 6d 61 78 2d 61 67 65 3d 30 2c 20 6e 6f 2d 73 74 6f 72 65 2c 20 6e 6f 2d 63 61 63 68 65 2c 20 6d 75 73 74 2d 72 65 76 61 6c 69 64 61 74 65 2c 20 70 6f 73 74 2d 63 68 65 63 6b 3d 30 2c 20 70 72 65 2d 63 68 65 63 6b 3d 30 0d 0a 45 78 70 69 72 65 73 3a 20 Data Ascii: cf-chl-out: qgZ23n+jdkovHswbQdbbnGt+gt0fWa9SnYsH1y5dOTT/lDu7zPkvmfo7BpIWKq+eTdiPPZ2TA6ySjb4+RmTNMGCAaOqQdXXa6W67j5jqh7I=$5Tn/M3LYhSlIop6bsrRFHA==Cache-Control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0Expires:
2024-12-23 14:51:45 UTC	564	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 4a 75 73 74 20 61 20 6d 6f 6d 65 6e 74 2e 2e 2e 3c 2f 74 69 74 6c 65 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 45 64 67 65 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 69 6e 64 65 78 2c 6e 6f 66 6f 6c 6c 6f 77 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 Data Ascii: <!DOCTYPE html><html lang="en-US"><head><title>Just a moment...</title><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta http-equiv="X-UA-Compatible" content="IE=Edge"><meta name="robots" content="noindex,nofollow"><meta name="viewp
2024-12-23 14:51:45 UTC	1369	IN	Data Raw: 6a 69 2c 53 65 67 6f 65 20 55 49 20 53 79 6d 62 6f 6c 2c 4e 6f 74 6f 20 43 6f 6c 6f 72 20 45 6d 6f 6a 69 7d 62 6f 64 79 7b 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 63 6f 6c 75 6d 6e 3b 68 65 69 67 68 74 3a 31 30 30 76 68 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 76 68 7d 2e 6d 61 69 6e 2d 63 6f 6e 74 65 6e 74 7b 6d 61 72 67 69 6e 3a 38 72 65 6d 20 61 75 74 6f 3b 6d 61 78 2d 77 69 64 74 68 3a 36 30 72 65 6d 3b 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 31 2e 35 72 65 6d 7d 40 6d 65 64 69 61 20 28 77 69 64 74 68 20 3c 3d 20 37 32 30 70 78 29 7b 2e 6d 61 69 6e 2d 63 6f 6e 74 65 6e 74 7b 6d 61 72 67 69 6e 2d 74 6f 70 3a 34 72 65 6d 7d 7d 2e 68 32 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 35 72 65 6d 3b 66 6f 6e 74 2d 77 Data Ascii: ji,Segoe UI Symbol,Noto Color Emoji}body{display:flex;flex-direction:column;height:100vh;min-height:100vh}.main-content{margin:8rem auto;max-width:60rem;padding-left:1.5rem}@media (width <= 720px){.main-content{margin-top:4rem}}.h2{font-size:1.5rem;font-w
2024-12-23 14:51:45 UTC	1369	IN	Data Raw: 2f 73 70 61 6e 3e 3c 2f 64 69 76 3e 3c 2f 6e 6f 73 63 72 69 70 74 3e 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 73 63 72 69 70 74 3e 28 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 5f 63 66 5f 63 68 6c 5f 6f 70 74 3d 7b 63 76 49 64 3a 20 27 33 27 2c 63 5a 6f 6e 65 3a 20 22 6c 6f 67 69 6e 2e 33 36 35 66 69 6c 65 2e 74 65 63 68 22 2c 63 54 79 70 65 3a 20 27 6d 61 6e 61 67 65 64 27 2c 63 52 61 79 3a 20 27 38 66 36 39 32 62 65 38 63 64 63 65 31 39 31 65 27 2c 63 48 3a 20 27 70 48 78 74 6c 4e 74 6d 30 31 6e 56 41 71 32 73 4e 56 6c 73 66 33 4b 67 5f 44 46 42 51 45 39 74 34 59 76 66 33 50 4f 34 4c 50 67 2d 31 37 33 34 39 36 35 35 30 35 2d 31 2e 32 2e 31 2e 31 2d 30 66 47 46 4f 39 76 6d 43 5f 52 63 54 6e 41 34 71 50 4f 42 6e 57 65 75 6d 55 38 42 64 31 76 68 Data Ascii: /span></div></noscript></div></div><script>(function(){window._cf_chl_opt={cvId: '3',cZone: "login.365file.tech",cType: 'managed',cRay: '8f692be8cdce191e',cH: 'pHxtlNtm01nVAq2sNVlsf3Kg_DFBQE9t4Yvf3PO4LPg-1734965505-1.2.1.1-0fGFO9vmC_RcTnA4qPOBnWeumU8Bd1vh
2024-12-23 14:51:45 UTC	1369	IN	Data Raw: 70 6e 61 65 6e 46 73 42 71 2e 5f 67 37 45 6e 59 77 46 6f 72 58 51 67 77 30 4f 44 6e 77 4e 78 65 52 4d 71 6a 7a 4f 33 42 42 76 66 4a 72 64 67 53 53 7a 34 36 35 64 34 50 78 45 49 65 7a 64 4c 35 41 41 68 34 48 4a 49 64 69 64 5a 39 79 47 38 76 54 4a 47 71 6d 45 76 37 2e 46 71 58 6c 66 63 70 46 39 33 6c 79 59 32 61 6a 32 68 53 64 6c 46 54 6f 43 36 2e 54 6b 4c 34 46 79 43 59 57 49 67 5f 63 53 2e 6b 66 51 35 5f 37 74 4c 4a 5f 63 35 50 4a 6d 5a 6a 36 42 33 74 72 52 6f 32 77 4e 45 7a 52 76 2e 31 34 54 2e 6f 67 4d 62 6a 6c 74 4c 55 31 73 4b 67 50 79 2e 71 4c 50 6f 51 36 4a 2e 68 43 6b 61 4d 45 49 53 43 57 5f 7a 68 49 2e 4e 59 67 36 30 58 52 38 72 62 56 53 75 68 54 4f 31 54 6f 55 73 68 71 30 44 53 32 49 33 79 73 6d 34 75 4b 75 6b 6a 61 4d 5a 34 66 4a 7a 53 64 50 65 Data Ascii: pnaenFsBq._g7EnYwForXQgw0ODnwNxeRMqjzO3BBvfJrdgSSz465d4PxEIezdL5AAh4HJIdidZ9yG8vTJGqmEv7.FqXlfcpF93lyY2aj2hSdlFToC6.TkL4FyCYWIg_cS.kfQ5_7tLJ_c5PJmZj6B3trRo2wNEzRv.14T.ogMbjltLU1sKgPy.qLPoQ6J.hCkaMEISCW_zhI.NYg60XR8rbVSuhTO1ToUshq0DS2I3ysm4uKukjaMZ4fJzSdPe
2024-12-23 14:51:45 UTC	1369	IN	Data Raw: 46 53 50 66 30 75 71 5f 44 49 64 6d 6b 74 76 5a 33 49 59 7a 6e 47 37 61 6a 46 6c 63 66 4a 32 6b 42 61 6c 58 63 5f 65 6c 55 7a 72 46 39 50 34 41 45 59 79 38 38 65 56 53 46 38 67 42 58 37 77 52 61 65 70 6d 55 53 37 51 30 6d 36 61 6f 63 73 74 75 61 61 77 2e 44 30 46 53 34 34 65 54 69 6a 30 69 63 77 56 4c 41 54 68 4f 76 44 44 74 6b 53 69 79 4a 5f 4b 7a 63 75 48 33 4f 50 48 55 55 72 34 64 4b 70 77 34 66 34 43 51 4d 5f 4d 43 58 32 36 51 6c 41 74 64 46 55 69 75 30 4d 6a 6a 35 32 75 54 73 47 4a 62 6c 65 68 7a 66 35 78 71 41 43 4c 4d 77 39 6b 50 33 2e 6f 47 47 4c 41 78 68 68 7a 5f 42 68 74 6b 4c 42 53 63 34 32 6b 6a 6f 75 72 36 39 78 64 31 58 78 51 74 4e 6c 73 7a 54 77 31 79 4b 75 6d 4f 41 43 36 78 50 49 4d 48 41 4a 41 6d 64 57 71 4a 42 35 39 45 79 42 36 70 31 30 Data Ascii: FSPf0uq_DIdmktvZ3IYznG7ajFlcfJ2kBalXc_elUzrF9P4AEYy88eVSF8gBX7wRaepmUS7Q0m6aocstuaaw.D0FS44eTij0icwVLAThOvDDtkSiyJ_KzcuH3OPHUUr4dKpw4f4CQM_MCX26QlAtdFUiu0Mjj52uTsGJblehzf5xqACLMw9kP3.oGGLAxhhz_BhtkLBSc42kjour69xd1XxQtNlszTw1yKumOAC6xPIMHAJAmdWqJB59EyB6p10

Timestamp	Bytes transferred	Direction	Data
2024-12-23 14:51:46 UTC	557	OUT	OPTIONS /report/v4?s=Gi4947HrZfi9o1Ieftj0Ps5vDl%2F%2FdY8bfUKmop6%2FnbWEJQRIbqfHOVaYP%2FRf64yMeubajum%2BQF%2BJZIAaRxd2JoschL%2FQlPUIAqnrsLHeUOXW%2FcSKRnYRdKm%2BrvHI2VNOHDxKuA%3D%3D HTTP/1.1 Host: a.nel.cloudflare.com Connection: keep-alive Origin: https://login.365file.tech Access-Control-Request-Method: POST Access-Control-Request-Headers: content-type User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-23 14:51:47 UTC	336	IN	HTTP/1.1 200 OK Content-Length: 0 access-control-max-age: 86400 access-control-allow-methods: POST, OPTIONS access-control-allow-origin: * access-control-allow-headers: content-length, content-type date: Mon, 23 Dec 2024 14:51:47 GMT Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Timestamp	Bytes transferred	Direction	Data
2024-12-23 14:51:47 UTC	1051	OUT	GET /amp/s/salesboost.com/jf HTTP/1.1 Host: www.google.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIkqHLAQj2mM0BCIWgzQEI3L3NAQiRys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=520=gK7O0nTsR-wPx05SrBJUd3HAfX4M9fc3aqd2XTKtTlIL-40D9SE3v73cbehuTvOeWv7KMN6SzEvw8450IfocIWnMawOJxHynYMsOO5fqWdvfMBtm--u9BujLGT0VtJ6dqbxcZjYp3EkCYhKkezVxOguXncHPaP_B08fK1K4CIpBspFVoRYKd_Yz5WTA31IXgra3h
2024-12-23 14:51:48 UTC	794	IN	HTTP/1.1 302 Found Location: https://salesboost.com/jf Cache-Control: private X-Robots-Tag: noindex Content-Type: text/html; charset=UTF-8 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-PkfNP-RrsM5zbyZWWmr3Hw' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Permissions-Policy: unload=() Date: Mon, 23 Dec 2024 14:51:47 GMT Server: gws Content-Length: 222 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-12-23 14:51:48 UTC	222	IN	Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 3c 54 49 54 4c 45 3e 33 30 32 20 4d 6f 76 65 64 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 33 30 32 20 4d 6f 76 65 64 3c 2f 48 31 3e 0a 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 0a 3c 41 20 48 52 45 46 3d 22 68 74 74 70 73 3a 2f 2f 73 61 6c 65 73 62 6f 6f 73 74 2e 63 6f 6d 2f 6a 66 22 3e 68 65 72 65 3c 2f 41 3e 2e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8"><TITLE>302 Moved</TITLE></HEAD><BODY><H1>302 Moved</H1>The document has moved<A HREF="https://salesboost.com/jf">here</A>.</BODY></HTML>