Edit tour

Windows Analysis Report
https://cdn.ampproject.org/c/s/storage.googleapis.com/64537346863/pdpeulwim8hmijrsur818_q3ijp1j8y4ml6p47_0j2my8bsc.html?lt=t_s_jan_293241770520623800_stage&target=293241770520623800_1&utm_rid=293241770520623800_2

Overview

General Information

Sample URL:	https://cdn.ampproject.org/c/s/storage.googleapis.com/64537346863/pdpeulwim8hmijrsur818_q3ijp1j8y4ml6p47_0j2my8bsc.html?lt=t_s_jan_293241770520623800_stage&target=293241770520623800_1&utm_rid=29324177
Analysis ID:	1653607
Infos:

Detection

Score:	52
Range:	0 - 100
Confidence:	100%

Signatures

AI detected phishing page

AI detected suspicious Javascript

Creates files inside the system directory

Deletes files inside the Windows folder

HTML title does not match URL

Classification

Process Tree

System is w10x64

chrome.exe (PID: 3520 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 6068 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2028,i,7632261494517681474,106541947582837358,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2096 /prefetch:3 MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 5428 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://cdn.ampproject.org/c/s/storage.googleapis.com/64537346863/pdpeulwim8hmijrsur818_q3ijp1j8y4ml6p47_0j2my8bsc.html?lt=t_s_jan_293241770520623800_stage&target=293241770520623800_1&utm_rid=293241770520623800_2" MD5: E81F54E6C1129887AEA47E7D092680BF)

cleanup

Source: https://3474889.cfd/?pzu1ue0fb=aHR0cHM6Ly9sb2dpbi5saXZlLmNvbS9vYXV0aDIwX2F1dGhvcml6ZS5zcmY/Y2xpZW50X2lkPTIyOWY0ZDYxLTA3ZWItNDU0YS05NDUzLWQyN2JiYTdjYzk1YiZzY29wZT1TZWNyZXRzLlJlYWRXcml0ZS5DcmVhdGVkQnlBcHAuU2VjdXJlK29mZmxpbmVfYWNjZXNzJnJlZGlyZWN0X3VyaT1odHRwcyUzYSUyZiUyZmxvZ2luLm1pY3Jvc29mdG9ubGluZS5jb20lMmZjb21tb24lMmZvYXV0aDIlMmZuYXRpdmVjbGllbnQmcmVzcG9uc2VfdHlwZT1jb2RlJnN0YXRlPSU3YiUyMmlkJTIyJTNhJTIyZmllZGJmZ2NsZWRkbGJjbWdkaWdqZ2RmY2dnamNpb24lMjIlN2QmcmVzcG9uc2VfbW9kZT1xdWVyeSZ1YWlkPTdjNDg2NzA3NzFlYzRhMDE5NTQ5OGZkMzY0YjQ3OWFiJm1zcHJveHk9MSZpc3N1ZXI9bXNvJnRlbmFudD1jb25zdW1lcnMmdWlfbG9jYWxlcz1lbi1VUyZlcGN0PVBBUUFCRGdFQUFBQlZyU3BldVdhbVJhbTJqQUYxWFJRRU5PcGlacHdhejlCaEVrajBaVzZnZG9aUHk1M1ljYno1RXRUUHZ5X0lJMWh6eEZ4MTI5UmhWSzVzSllHOHFHdEdCaGZuOUJ3WmRDYkpjMkJJWGZYWFl1VFBBcTQ2bGNFMmVxZW9kRTZUcW42MGhsa091NHpCa2J0c3hzeHNaTk4xU3pBenJNNUxxRHJzWURSczVLV2FPR25CdVVGWU54dDRVRmRGNWJGWWJpNzBFc0k2cWRHbU1rVjBaZXdKWjNaY2Ixc1pKMDg0ZDFFSy1CUy1YOGFsTXlBQSZqc2hzPTAj

Joe Sandbox AI: Score: 9 Reasons: The brand 'Microsoft' is a well-known global technology company., The legitimate domain for Microsoft is 'microsoft.com'., The provided URL '3474889.cfd' does not match the legitimate domain for Microsoft., The URL uses a '.cfd' domain extension, which is unusual for a well-known brand like Microsoft., The URL does not contain any recognizable elements related to Microsoft, which is suspicious., The presence of input fields for 'Email, phone, or Skype' is typical for phishing attempts targeting Microsoft accounts. DOM: 3.3.pages.csv

AI detected suspicious Javascript

Source: 3.6..script.csv

Joe Sandbox AI: Detected suspicious JavaScript with source url: https://3474889.cfd/?pzu1ue0fb=aHR0cHM6Ly9sb2dpbi5... This script demonstrates high-risk behavior. It attempts to redirect the user to a different domain, which could be a sign of a phishing or malicious attempt. The use of `unescape` and dynamic `document.write` also indicates potential code injection or obfuscation, which are common techniques used in malicious scripts.

HTTP Parser: Title: Sign in to your Microsoft account does not match URL

Source: https://3474889.cfd/?pzu1ue0fb=aHR0cHM6Ly9sb2dpbi5saXZlLmNvbS9vYXV0aDIwX2F1dGhvcml6ZS5zcmY/Y2xpZW50X2lkPTIyOWY0ZDYxLTA3ZWItNDU0YS05NDUzLWQyN2JiYTdjYzk1YiZzY29wZT1TZWNyZXRzLlJlYWRXcml0ZS5DcmVhdGVkQnlBcHAuU2VjdXJlK29mZmxpbmVfYWNjZXNzJnJlZGlyZWN0X3VyaT1odHRwcyUzYSUyZiUyZmxvZ2luLm1pY3Jvc29mdG9ubGluZS5jb20lMmZjb21tb24lMmZvYXV0aDIlMmZuYXRpdmVjbGllbnQmcmVzcG9uc2VfdHlwZT1jb2RlJnN0YXRlPSU3YiUyMmlkJTIyJTNhJTIyZmllZGJmZ2NsZWRkbGJjbWdkaWdqZ2RmY2dnamNpb24lMjIlN2QmcmVzcG9uc2VfbW9kZT1xdWVyeSZ1YWlkPTdjNDg2NzA3NzFlYzRhMDE5NTQ5OGZkMzY0YjQ3OWFiJm1zcHJveHk9MSZpc3N1ZXI9bXNvJnRlbmFudD1jb25zdW1lcnMmdWlfbG9jYWxlcz1lbi1VUyZlcGN0PVBBUUFCRGdFQUFBQlZyU3BldVdhbVJhbTJqQUYxWFJRRU5PcGlacHdhejlCaEVrajBaVzZnZG9aUHk1M1ljYno1RXRUUHZ5X0lJMWh6eEZ4MTI5UmhWSzVzSllHOHFHdEdCaGZuOUJ3WmRDYkpjMkJJWGZYWFl1VFBBcTQ2bGNFMmVxZW9kRTZUcW42MGhsa091NHpCa2J0c3hzeHNaTk4xU3pBenJNNUxxRHJzWURSczVLV2FPR25CdVVGWU54dDRVRmRGNWJGWWJpNzBFc0k2cWRHbU1rVjBaZXdKWjNaY2Ixc1pKMDg0ZDFFSy1CUy1YOGFsTXlBQSZqc2hzPTAj	HTTP Parser: Iframe src: https://fpt.live.com?session_id=7c48670771ec4a0195498fd364b479ab&CustomerId=33e01921-4d64-4f8c-a055-5bdaffd5e33d&PageId=SI
Source: https://3474889.cfd/?pzu1ue0fb=aHR0cHM6Ly9sb2dpbi5saXZlLmNvbS9vYXV0aDIwX2F1dGhvcml6ZS5zcmY/Y2xpZW50X2lkPTIyOWY0ZDYxLTA3ZWItNDU0YS05NDUzLWQyN2JiYTdjYzk1YiZzY29wZT1TZWNyZXRzLlJlYWRXcml0ZS5DcmVhdGVkQnlBcHAuU2VjdXJlK29mZmxpbmVfYWNjZXNzJnJlZGlyZWN0X3VyaT1odHRwcyUzYSUyZiUyZmxvZ2luLm1pY3Jvc29mdG9ubGluZS5jb20lMmZjb21tb24lMmZvYXV0aDIlMmZuYXRpdmVjbGllbnQmcmVzcG9uc2VfdHlwZT1jb2RlJnN0YXRlPSU3YiUyMmlkJTIyJTNhJTIyZmllZGJmZ2NsZWRkbGJjbWdkaWdqZ2RmY2dnamNpb24lMjIlN2QmcmVzcG9uc2VfbW9kZT1xdWVyeSZ1YWlkPTdjNDg2NzA3NzFlYzRhMDE5NTQ5OGZkMzY0YjQ3OWFiJm1zcHJveHk9MSZpc3N1ZXI9bXNvJnRlbmFudD1jb25zdW1lcnMmdWlfbG9jYWxlcz1lbi1VUyZlcGN0PVBBUUFCRGdFQUFBQlZyU3BldVdhbVJhbTJqQUYxWFJRRU5PcGlacHdhejlCaEVrajBaVzZnZG9aUHk1M1ljYno1RXRUUHZ5X0lJMWh6eEZ4MTI5UmhWSzVzSllHOHFHdEdCaGZuOUJ3WmRDYkpjMkJJWGZYWFl1VFBBcTQ2bGNFMmVxZW9kRTZUcW42MGhsa091NHpCa2J0c3hzeHNaTk4xU3pBenJNNUxxRHJzWURSczVLV2FPR25CdVVGWU54dDRVRmRGNWJGWWJpNzBFc0k2cWRHbU1rVjBaZXdKWjNaY2Ixc1pKMDg0ZDFFSy1CUy1YOGFsTXlBQSZqc2hzPTAj	HTTP Parser: Iframe src: https://fpt.live.com?session_id=7c48670771ec4a0195498fd364b479ab&CustomerId=33e01921-4d64-4f8c-a055-5bdaffd5e33d&PageId=SI
Source: https://3474889.cfd/?pzu1ue0fb=aHR0cHM6Ly9sb2dpbi5saXZlLmNvbS9vYXV0aDIwX2F1dGhvcml6ZS5zcmY/Y2xpZW50X2lkPTIyOWY0ZDYxLTA3ZWItNDU0YS05NDUzLWQyN2JiYTdjYzk1YiZzY29wZT1TZWNyZXRzLlJlYWRXcml0ZS5DcmVhdGVkQnlBcHAuU2VjdXJlK29mZmxpbmVfYWNjZXNzJnJlZGlyZWN0X3VyaT1odHRwcyUzYSUyZiUyZmxvZ2luLm1pY3Jvc29mdG9ubGluZS5jb20lMmZjb21tb24lMmZvYXV0aDIlMmZuYXRpdmVjbGllbnQmcmVzcG9uc2VfdHlwZT1jb2RlJnN0YXRlPSU3YiUyMmlkJTIyJTNhJTIyZmllZGJmZ2NsZWRkbGJjbWdkaWdqZ2RmY2dnamNpb24lMjIlN2QmcmVzcG9uc2VfbW9kZT1xdWVyeSZ1YWlkPTdjNDg2NzA3NzFlYzRhMDE5NTQ5OGZkMzY0YjQ3OWFiJm1zcHJveHk9MSZpc3N1ZXI9bXNvJnRlbmFudD1jb25zdW1lcnMmdWlfbG9jYWxlcz1lbi1VUyZlcGN0PVBBUUFCRGdFQUFBQlZyU3BldVdhbVJhbTJqQUYxWFJRRU5PcGlacHdhejlCaEVrajBaVzZnZG9aUHk1M1ljYno1RXRUUHZ5X0lJMWh6eEZ4MTI5UmhWSzVzSllHOHFHdEdCaGZuOUJ3WmRDYkpjMkJJWGZYWFl1VFBBcTQ2bGNFMmVxZW9kRTZUcW42MGhsa091NHpCa2J0c3hzeHNaTk4xU3pBenJNNUxxRHJzWURSczVLV2FPR25CdVVGWU54dDRVRmRGNWJGWWJpNzBFc0k2cWRHbU1rVjBaZXdKWjNaY2Ixc1pKMDg0ZDFFSy1CUy1YOGFsTXlBQSZqc2hzPTAj	HTTP Parser: Iframe src: https://fpt.live.com?session_id=7c48670771ec4a0195498fd364b479ab&CustomerId=33e01921-4d64-4f8c-a055-5bdaffd5e33d&PageId=SI
Source: https://3474889.cfd/?pzu1ue0fb=aHR0cHM6Ly9sb2dpbi5saXZlLmNvbS9vYXV0aDIwX2F1dGhvcml6ZS5zcmY/Y2xpZW50X2lkPTIyOWY0ZDYxLTA3ZWItNDU0YS05NDUzLWQyN2JiYTdjYzk1YiZzY29wZT1TZWNyZXRzLlJlYWRXcml0ZS5DcmVhdGVkQnlBcHAuU2VjdXJlK29mZmxpbmVfYWNjZXNzJnJlZGlyZWN0X3VyaT1odHRwcyUzYSUyZiUyZmxvZ2luLm1pY3Jvc29mdG9ubGluZS5jb20lMmZjb21tb24lMmZvYXV0aDIlMmZuYXRpdmVjbGllbnQmcmVzcG9uc2VfdHlwZT1jb2RlJnN0YXRlPSU3YiUyMmlkJTIyJTNhJTIyZmllZGJmZ2NsZWRkbGJjbWdkaWdqZ2RmY2dnamNpb24lMjIlN2QmcmVzcG9uc2VfbW9kZT1xdWVyeSZ1YWlkPTdjNDg2NzA3NzFlYzRhMDE5NTQ5OGZkMzY0YjQ3OWFiJm1zcHJveHk9MSZpc3N1ZXI9bXNvJnRlbmFudD1jb25zdW1lcnMmdWlfbG9jYWxlcz1lbi1VUyZlcGN0PVBBUUFCRGdFQUFBQlZyU3BldVdhbVJhbTJqQUYxWFJRRU5PcGlacHdhejlCaEVrajBaVzZnZG9aUHk1M1ljYno1RXRUUHZ5X0lJMWh6eEZ4MTI5UmhWSzVzSllHOHFHdEdCaGZuOUJ3WmRDYkpjMkJJWGZYWFl1VFBBcTQ2bGNFMmVxZW9kRTZUcW42MGhsa091NHpCa2J0c3hzeHNaTk4xU3pBenJNNUxxRHJzWURSczVLV2FPR25CdVVGWU54dDRVRmRGNWJGWWJpNzBFc0k2cWRHbU1rVjBaZXdKWjNaY2Ixc1pKMDg0ZDFFSy1CUy1YOGFsTXlBQSZqc2hzPTAj	HTTP Parser: Iframe src: https://fpt.live.com?session_id=7c48670771ec4a0195498fd364b479ab&CustomerId=33e01921-4d64-4f8c-a055-5bdaffd5e33d&PageId=SI

Source: https://storage.googleapis.com/64537346863/pdpeulwim8hmijrsur818_q3ijp1j8y4ml6p47_0j2my8bsc.html?lt=t_s_jan_293241770520623800_stage&target=293241770520623800_1&utm_rid=293241770520623800_2	HTTP Parser: No favicon
Source: https://3474889.cfd/?pzu1ue0fb=aHR0cHM6Ly9sb2dpbi5saXZlLmNvbS9vYXV0aDIwX2F1dGhvcml6ZS5zcmY/Y2xpZW50X2lkPTIyOWY0ZDYxLTA3ZWItNDU0YS05NDUzLWQyN2JiYTdjYzk1YiZzY29wZT1TZWNyZXRzLlJlYWRXcml0ZS5DcmVhdGVkQnlBcHAuU2VjdXJlK29mZmxpbmVfYWNjZXNzJnJlZGlyZWN0X3VyaT1odHRwcyUzYSUyZiUyZmxvZ2luLm1pY3Jvc29mdG9ubGluZS5jb20lMmZjb21tb24lMmZvYXV0aDIlMmZuYXRpdmVjbGllbnQmcmVzcG9uc2VfdHlwZT1jb2RlJnN0YXRlPSU3YiUyMmlkJTIyJTNhJTIyZmllZGJmZ2NsZWRkbGJjbWdkaWdqZ2RmY2dnamNpb24lMjIlN2QmcmVzcG9uc2VfbW9kZT1xdWVyeSZ1YWlkPTdjNDg2NzA3NzFlYzRhMDE5NTQ5OGZkMzY0YjQ3OWFiJm1zcHJveHk9MSZpc3N1ZXI9bXNvJnRlbmFudD1jb25zdW1lcnMmdWlfbG9jYWxlcz1lbi1VUyZlcGN0PVBBUUFCRGdFQUFBQlZyU3BldVdhbVJhbTJqQUYxWFJRRU5PcGlacHdhejlCaEVrajBaVzZnZG9aUHk1M1ljYno1RXRUUHZ5X0lJMWh6eEZ4MTI5UmhWSzVzSllHOHFHdEdCaGZuOUJ3WmRDYkpjMkJJWGZYWFl1VFBBcTQ2bGNFMmVxZW9kRTZUcW42MGhsa091NHpCa2J0c3hzeHNaTk4xU3pBenJNNUxxRHJzWURSczVLV2FPR25CdVVGWU54dDRVRmRGNWJGWWJpNzBFc0k2cWRHbU1rVjBaZXdKWjNaY2Ixc1pKMDg0ZDFFSy1CUy1YOGFsTXlBQSZqc2hzPTAj	HTTP Parser: No favicon
Source: https://3474889.cfd/?pzu1ue0fb=aHR0cHM6Ly9sb2dpbi5saXZlLmNvbS9vYXV0aDIwX2F1dGhvcml6ZS5zcmY/Y2xpZW50X2lkPTIyOWY0ZDYxLTA3ZWItNDU0YS05NDUzLWQyN2JiYTdjYzk1YiZzY29wZT1TZWNyZXRzLlJlYWRXcml0ZS5DcmVhdGVkQnlBcHAuU2VjdXJlK29mZmxpbmVfYWNjZXNzJnJlZGlyZWN0X3VyaT1odHRwcyUzYSUyZiUyZmxvZ2luLm1pY3Jvc29mdG9ubGluZS5jb20lMmZjb21tb24lMmZvYXV0aDIlMmZuYXRpdmVjbGllbnQmcmVzcG9uc2VfdHlwZT1jb2RlJnN0YXRlPSU3YiUyMmlkJTIyJTNhJTIyZmllZGJmZ2NsZWRkbGJjbWdkaWdqZ2RmY2dnamNpb24lMjIlN2QmcmVzcG9uc2VfbW9kZT1xdWVyeSZ1YWlkPTdjNDg2NzA3NzFlYzRhMDE5NTQ5OGZkMzY0YjQ3OWFiJm1zcHJveHk9MSZpc3N1ZXI9bXNvJnRlbmFudD1jb25zdW1lcnMmdWlfbG9jYWxlcz1lbi1VUyZlcGN0PVBBUUFCRGdFQUFBQlZyU3BldVdhbVJhbTJqQUYxWFJRRU5PcGlacHdhejlCaEVrajBaVzZnZG9aUHk1M1ljYno1RXRUUHZ5X0lJMWh6eEZ4MTI5UmhWSzVzSllHOHFHdEdCaGZuOUJ3WmRDYkpjMkJJWGZYWFl1VFBBcTQ2bGNFMmVxZW9kRTZUcW42MGhsa091NHpCa2J0c3hzeHNaTk4xU3pBenJNNUxxRHJzWURSczVLV2FPR25CdVVGWU54dDRVRmRGNWJGWWJpNzBFc0k2cWRHbU1rVjBaZXdKWjNaY2Ixc1pKMDg0ZDFFSy1CUy1YOGFsTXlBQSZqc2hzPTAj	HTTP Parser: No favicon

Source: https://3474889.cfd/?pzu1ue0fb=aHR0cHM6Ly9sb2dpbi5saXZlLmNvbS9vYXV0aDIwX2F1dGhvcml6ZS5zcmY/Y2xpZW50X2lkPTIyOWY0ZDYxLTA3ZWItNDU0YS05NDUzLWQyN2JiYTdjYzk1YiZzY29wZT1TZWNyZXRzLlJlYWRXcml0ZS5DcmVhdGVkQnlBcHAuU2VjdXJlK29mZmxpbmVfYWNjZXNzJnJlZGlyZWN0X3VyaT1odHRwcyUzYSUyZiUyZmxvZ2luLm1pY3Jvc29mdG9ubGluZS5jb20lMmZjb21tb24lMmZvYXV0aDIlMmZuYXRpdmVjbGllbnQmcmVzcG9uc2VfdHlwZT1jb2RlJnN0YXRlPSU3YiUyMmlkJTIyJTNhJTIyZmllZGJmZ2NsZWRkbGJjbWdkaWdqZ2RmY2dnamNpb24lMjIlN2QmcmVzcG9uc2VfbW9kZT1xdWVyeSZ1YWlkPTdjNDg2NzA3NzFlYzRhMDE5NTQ5OGZkMzY0YjQ3OWFiJm1zcHJveHk9MSZpc3N1ZXI9bXNvJnRlbmFudD1jb25zdW1lcnMmdWlfbG9jYWxlcz1lbi1VUyZlcGN0PVBBUUFCRGdFQUFBQlZyU3BldVdhbVJhbTJqQUYxWFJRRU5PcGlacHdhejlCaEVrajBaVzZnZG9aUHk1M1ljYno1RXRUUHZ5X0lJMWh6eEZ4MTI5UmhWSzVzSllHOHFHdEdCaGZuOUJ3WmRDYkpjMkJJWGZYWFl1VFBBcTQ2bGNFMmVxZW9kRTZUcW42MGhsa091NHpCa2J0c3hzeHNaTk4xU3pBenJNNUxxRHJzWURSczVLV2FPR25CdVVGWU54dDRVRmRGNWJGWWJpNzBFc0k2cWRHbU1rVjBaZXdKWjNaY2Ixc1pKMDg0ZDFFSy1CUy1YOGFsTXlBQSZqc2hzPTAj	HTTP Parser: No <meta name="author".. found
Source: https://3474889.cfd/?pzu1ue0fb=aHR0cHM6Ly9sb2dpbi5saXZlLmNvbS9vYXV0aDIwX2F1dGhvcml6ZS5zcmY/Y2xpZW50X2lkPTIyOWY0ZDYxLTA3ZWItNDU0YS05NDUzLWQyN2JiYTdjYzk1YiZzY29wZT1TZWNyZXRzLlJlYWRXcml0ZS5DcmVhdGVkQnlBcHAuU2VjdXJlK29mZmxpbmVfYWNjZXNzJnJlZGlyZWN0X3VyaT1odHRwcyUzYSUyZiUyZmxvZ2luLm1pY3Jvc29mdG9ubGluZS5jb20lMmZjb21tb24lMmZvYXV0aDIlMmZuYXRpdmVjbGllbnQmcmVzcG9uc2VfdHlwZT1jb2RlJnN0YXRlPSU3YiUyMmlkJTIyJTNhJTIyZmllZGJmZ2NsZWRkbGJjbWdkaWdqZ2RmY2dnamNpb24lMjIlN2QmcmVzcG9uc2VfbW9kZT1xdWVyeSZ1YWlkPTdjNDg2NzA3NzFlYzRhMDE5NTQ5OGZkMzY0YjQ3OWFiJm1zcHJveHk9MSZpc3N1ZXI9bXNvJnRlbmFudD1jb25zdW1lcnMmdWlfbG9jYWxlcz1lbi1VUyZlcGN0PVBBUUFCRGdFQUFBQlZyU3BldVdhbVJhbTJqQUYxWFJRRU5PcGlacHdhejlCaEVrajBaVzZnZG9aUHk1M1ljYno1RXRUUHZ5X0lJMWh6eEZ4MTI5UmhWSzVzSllHOHFHdEdCaGZuOUJ3WmRDYkpjMkJJWGZYWFl1VFBBcTQ2bGNFMmVxZW9kRTZUcW42MGhsa091NHpCa2J0c3hzeHNaTk4xU3pBenJNNUxxRHJzWURSczVLV2FPR25CdVVGWU54dDRVRmRGNWJGWWJpNzBFc0k2cWRHbU1rVjBaZXdKWjNaY2Ixc1pKMDg0ZDFFSy1CUy1YOGFsTXlBQSZqc2hzPTAj	HTTP Parser: No <meta name="author".. found
Source: https://3474889.cfd/?pzu1ue0fb=aHR0cHM6Ly9sb2dpbi5saXZlLmNvbS9vYXV0aDIwX2F1dGhvcml6ZS5zcmY/Y2xpZW50X2lkPTIyOWY0ZDYxLTA3ZWItNDU0YS05NDUzLWQyN2JiYTdjYzk1YiZzY29wZT1TZWNyZXRzLlJlYWRXcml0ZS5DcmVhdGVkQnlBcHAuU2VjdXJlK29mZmxpbmVfYWNjZXNzJnJlZGlyZWN0X3VyaT1odHRwcyUzYSUyZiUyZmxvZ2luLm1pY3Jvc29mdG9ubGluZS5jb20lMmZjb21tb24lMmZvYXV0aDIlMmZuYXRpdmVjbGllbnQmcmVzcG9uc2VfdHlwZT1jb2RlJnN0YXRlPSU3YiUyMmlkJTIyJTNhJTIyZmllZGJmZ2NsZWRkbGJjbWdkaWdqZ2RmY2dnamNpb24lMjIlN2QmcmVzcG9uc2VfbW9kZT1xdWVyeSZ1YWlkPTdjNDg2NzA3NzFlYzRhMDE5NTQ5OGZkMzY0YjQ3OWFiJm1zcHJveHk9MSZpc3N1ZXI9bXNvJnRlbmFudD1jb25zdW1lcnMmdWlfbG9jYWxlcz1lbi1VUyZlcGN0PVBBUUFCRGdFQUFBQlZyU3BldVdhbVJhbTJqQUYxWFJRRU5PcGlacHdhejlCaEVrajBaVzZnZG9aUHk1M1ljYno1RXRUUHZ5X0lJMWh6eEZ4MTI5UmhWSzVzSllHOHFHdEdCaGZuOUJ3WmRDYkpjMkJJWGZYWFl1VFBBcTQ2bGNFMmVxZW9kRTZUcW42MGhsa091NHpCa2J0c3hzeHNaTk4xU3pBenJNNUxxRHJzWURSczVLV2FPR25CdVVGWU54dDRVRmRGNWJGWWJpNzBFc0k2cWRHbU1rVjBaZXdKWjNaY2Ixc1pKMDg0ZDFFSy1CUy1YOGFsTXlBQSZqc2hzPTAj	HTTP Parser: No <meta name="author".. found
Source: https://3474889.cfd/?pzu1ue0fb=aHR0cHM6Ly9sb2dpbi5saXZlLmNvbS9vYXV0aDIwX2F1dGhvcml6ZS5zcmY/Y2xpZW50X2lkPTIyOWY0ZDYxLTA3ZWItNDU0YS05NDUzLWQyN2JiYTdjYzk1YiZzY29wZT1TZWNyZXRzLlJlYWRXcml0ZS5DcmVhdGVkQnlBcHAuU2VjdXJlK29mZmxpbmVfYWNjZXNzJnJlZGlyZWN0X3VyaT1odHRwcyUzYSUyZiUyZmxvZ2luLm1pY3Jvc29mdG9ubGluZS5jb20lMmZjb21tb24lMmZvYXV0aDIlMmZuYXRpdmVjbGllbnQmcmVzcG9uc2VfdHlwZT1jb2RlJnN0YXRlPSU3YiUyMmlkJTIyJTNhJTIyZmllZGJmZ2NsZWRkbGJjbWdkaWdqZ2RmY2dnamNpb24lMjIlN2QmcmVzcG9uc2VfbW9kZT1xdWVyeSZ1YWlkPTdjNDg2NzA3NzFlYzRhMDE5NTQ5OGZkMzY0YjQ3OWFiJm1zcHJveHk9MSZpc3N1ZXI9bXNvJnRlbmFudD1jb25zdW1lcnMmdWlfbG9jYWxlcz1lbi1VUyZlcGN0PVBBUUFCRGdFQUFBQlZyU3BldVdhbVJhbTJqQUYxWFJRRU5PcGlacHdhejlCaEVrajBaVzZnZG9aUHk1M1ljYno1RXRUUHZ5X0lJMWh6eEZ4MTI5UmhWSzVzSllHOHFHdEdCaGZuOUJ3WmRDYkpjMkJJWGZYWFl1VFBBcTQ2bGNFMmVxZW9kRTZUcW42MGhsa091NHpCa2J0c3hzeHNaTk4xU3pBenJNNUxxRHJzWURSczVLV2FPR25CdVVGWU54dDRVRmRGNWJGWWJpNzBFc0k2cWRHbU1rVjBaZXdKWjNaY2Ixc1pKMDg0ZDFFSy1CUy1YOGFsTXlBQSZqc2hzPTAj	HTTP Parser: No <meta name="author".. found

Source: https://3474889.cfd/?pzu1ue0fb=aHR0cHM6Ly9sb2dpbi5saXZlLmNvbS9vYXV0aDIwX2F1dGhvcml6ZS5zcmY/Y2xpZW50X2lkPTIyOWY0ZDYxLTA3ZWItNDU0YS05NDUzLWQyN2JiYTdjYzk1YiZzY29wZT1TZWNyZXRzLlJlYWRXcml0ZS5DcmVhdGVkQnlBcHAuU2VjdXJlK29mZmxpbmVfYWNjZXNzJnJlZGlyZWN0X3VyaT1odHRwcyUzYSUyZiUyZmxvZ2luLm1pY3Jvc29mdG9ubGluZS5jb20lMmZjb21tb24lMmZvYXV0aDIlMmZuYXRpdmVjbGllbnQmcmVzcG9uc2VfdHlwZT1jb2RlJnN0YXRlPSU3YiUyMmlkJTIyJTNhJTIyZmllZGJmZ2NsZWRkbGJjbWdkaWdqZ2RmY2dnamNpb24lMjIlN2QmcmVzcG9uc2VfbW9kZT1xdWVyeSZ1YWlkPTdjNDg2NzA3NzFlYzRhMDE5NTQ5OGZkMzY0YjQ3OWFiJm1zcHJveHk9MSZpc3N1ZXI9bXNvJnRlbmFudD1jb25zdW1lcnMmdWlfbG9jYWxlcz1lbi1VUyZlcGN0PVBBUUFCRGdFQUFBQlZyU3BldVdhbVJhbTJqQUYxWFJRRU5PcGlacHdhejlCaEVrajBaVzZnZG9aUHk1M1ljYno1RXRUUHZ5X0lJMWh6eEZ4MTI5UmhWSzVzSllHOHFHdEdCaGZuOUJ3WmRDYkpjMkJJWGZYWFl1VFBBcTQ2bGNFMmVxZW9kRTZUcW42MGhsa091NHpCa2J0c3hzeHNaTk4xU3pBenJNNUxxRHJzWURSczVLV2FPR25CdVVGWU54dDRVRmRGNWJGWWJpNzBFc0k2cWRHbU1rVjBaZXdKWjNaY2Ixc1pKMDg0ZDFFSy1CUy1YOGFsTXlBQSZqc2hzPTAj	HTTP Parser: No <meta name="copyright".. found
Source: https://3474889.cfd/?pzu1ue0fb=aHR0cHM6Ly9sb2dpbi5saXZlLmNvbS9vYXV0aDIwX2F1dGhvcml6ZS5zcmY/Y2xpZW50X2lkPTIyOWY0ZDYxLTA3ZWItNDU0YS05NDUzLWQyN2JiYTdjYzk1YiZzY29wZT1TZWNyZXRzLlJlYWRXcml0ZS5DcmVhdGVkQnlBcHAuU2VjdXJlK29mZmxpbmVfYWNjZXNzJnJlZGlyZWN0X3VyaT1odHRwcyUzYSUyZiUyZmxvZ2luLm1pY3Jvc29mdG9ubGluZS5jb20lMmZjb21tb24lMmZvYXV0aDIlMmZuYXRpdmVjbGllbnQmcmVzcG9uc2VfdHlwZT1jb2RlJnN0YXRlPSU3YiUyMmlkJTIyJTNhJTIyZmllZGJmZ2NsZWRkbGJjbWdkaWdqZ2RmY2dnamNpb24lMjIlN2QmcmVzcG9uc2VfbW9kZT1xdWVyeSZ1YWlkPTdjNDg2NzA3NzFlYzRhMDE5NTQ5OGZkMzY0YjQ3OWFiJm1zcHJveHk9MSZpc3N1ZXI9bXNvJnRlbmFudD1jb25zdW1lcnMmdWlfbG9jYWxlcz1lbi1VUyZlcGN0PVBBUUFCRGdFQUFBQlZyU3BldVdhbVJhbTJqQUYxWFJRRU5PcGlacHdhejlCaEVrajBaVzZnZG9aUHk1M1ljYno1RXRUUHZ5X0lJMWh6eEZ4MTI5UmhWSzVzSllHOHFHdEdCaGZuOUJ3WmRDYkpjMkJJWGZYWFl1VFBBcTQ2bGNFMmVxZW9kRTZUcW42MGhsa091NHpCa2J0c3hzeHNaTk4xU3pBenJNNUxxRHJzWURSczVLV2FPR25CdVVGWU54dDRVRmRGNWJGWWJpNzBFc0k2cWRHbU1rVjBaZXdKWjNaY2Ixc1pKMDg0ZDFFSy1CUy1YOGFsTXlBQSZqc2hzPTAj	HTTP Parser: No <meta name="copyright".. found
Source: https://3474889.cfd/?pzu1ue0fb=aHR0cHM6Ly9sb2dpbi5saXZlLmNvbS9vYXV0aDIwX2F1dGhvcml6ZS5zcmY/Y2xpZW50X2lkPTIyOWY0ZDYxLTA3ZWItNDU0YS05NDUzLWQyN2JiYTdjYzk1YiZzY29wZT1TZWNyZXRzLlJlYWRXcml0ZS5DcmVhdGVkQnlBcHAuU2VjdXJlK29mZmxpbmVfYWNjZXNzJnJlZGlyZWN0X3VyaT1odHRwcyUzYSUyZiUyZmxvZ2luLm1pY3Jvc29mdG9ubGluZS5jb20lMmZjb21tb24lMmZvYXV0aDIlMmZuYXRpdmVjbGllbnQmcmVzcG9uc2VfdHlwZT1jb2RlJnN0YXRlPSU3YiUyMmlkJTIyJTNhJTIyZmllZGJmZ2NsZWRkbGJjbWdkaWdqZ2RmY2dnamNpb24lMjIlN2QmcmVzcG9uc2VfbW9kZT1xdWVyeSZ1YWlkPTdjNDg2NzA3NzFlYzRhMDE5NTQ5OGZkMzY0YjQ3OWFiJm1zcHJveHk9MSZpc3N1ZXI9bXNvJnRlbmFudD1jb25zdW1lcnMmdWlfbG9jYWxlcz1lbi1VUyZlcGN0PVBBUUFCRGdFQUFBQlZyU3BldVdhbVJhbTJqQUYxWFJRRU5PcGlacHdhejlCaEVrajBaVzZnZG9aUHk1M1ljYno1RXRUUHZ5X0lJMWh6eEZ4MTI5UmhWSzVzSllHOHFHdEdCaGZuOUJ3WmRDYkpjMkJJWGZYWFl1VFBBcTQ2bGNFMmVxZW9kRTZUcW42MGhsa091NHpCa2J0c3hzeHNaTk4xU3pBenJNNUxxRHJzWURSczVLV2FPR25CdVVGWU54dDRVRmRGNWJGWWJpNzBFc0k2cWRHbU1rVjBaZXdKWjNaY2Ixc1pKMDg0ZDFFSy1CUy1YOGFsTXlBQSZqc2hzPTAj	HTTP Parser: No <meta name="copyright".. found
Source: https://3474889.cfd/?pzu1ue0fb=aHR0cHM6Ly9sb2dpbi5saXZlLmNvbS9vYXV0aDIwX2F1dGhvcml6ZS5zcmY/Y2xpZW50X2lkPTIyOWY0ZDYxLTA3ZWItNDU0YS05NDUzLWQyN2JiYTdjYzk1YiZzY29wZT1TZWNyZXRzLlJlYWRXcml0ZS5DcmVhdGVkQnlBcHAuU2VjdXJlK29mZmxpbmVfYWNjZXNzJnJlZGlyZWN0X3VyaT1odHRwcyUzYSUyZiUyZmxvZ2luLm1pY3Jvc29mdG9ubGluZS5jb20lMmZjb21tb24lMmZvYXV0aDIlMmZuYXRpdmVjbGllbnQmcmVzcG9uc2VfdHlwZT1jb2RlJnN0YXRlPSU3YiUyMmlkJTIyJTNhJTIyZmllZGJmZ2NsZWRkbGJjbWdkaWdqZ2RmY2dnamNpb24lMjIlN2QmcmVzcG9uc2VfbW9kZT1xdWVyeSZ1YWlkPTdjNDg2NzA3NzFlYzRhMDE5NTQ5OGZkMzY0YjQ3OWFiJm1zcHJveHk9MSZpc3N1ZXI9bXNvJnRlbmFudD1jb25zdW1lcnMmdWlfbG9jYWxlcz1lbi1VUyZlcGN0PVBBUUFCRGdFQUFBQlZyU3BldVdhbVJhbTJqQUYxWFJRRU5PcGlacHdhejlCaEVrajBaVzZnZG9aUHk1M1ljYno1RXRUUHZ5X0lJMWh6eEZ4MTI5UmhWSzVzSllHOHFHdEdCaGZuOUJ3WmRDYkpjMkJJWGZYWFl1VFBBcTQ2bGNFMmVxZW9kRTZUcW42MGhsa091NHpCa2J0c3hzeHNaTk4xU3pBenJNNUxxRHJzWURSczVLV2FPR25CdVVGWU54dDRVRmRGNWJGWWJpNzBFc0k2cWRHbU1rVjBaZXdKWjNaY2Ixc1pKMDg0ZDFFSy1CUy1YOGFsTXlBQSZqc2hzPTAj	HTTP Parser: No <meta name="copyright".. found

Source: unknown	HTTPS traffic detected: 142.251.32.100:443 -> 192.168.2.7:49688 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.65.225:443 -> 192.168.2.7:49689 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.65.225:443 -> 192.168.2.7:49690 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.251.35.161:443 -> 192.168.2.7:49691 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.251.40.196:443 -> 192.168.2.7:49698 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.251.32.100:443 -> 192.168.2.7:49699 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 5.255.106.15:443 -> 192.168.2.7:49701 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 5.255.106.15:443 -> 192.168.2.7:49702 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 5.255.117.88:443 -> 192.168.2.7:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 5.255.117.88:443 -> 192.168.2.7:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.209.72.31:443 -> 192.168.2.7:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.40:443 -> 192.168.2.7:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.72.243.62:443 -> 192.168.2.7:49719 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 5.255.117.88:443 -> 192.168.2.7:49724 version: TLS 1.2

Source: unknown	TCP traffic detected without corresponding DNS query: 23.199.215.203
Source: unknown	TCP traffic detected without corresponding DNS query: 2.18.98.62
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.227.208
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.227.208
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.227.208
Source: unknown	TCP traffic detected without corresponding DNS query: 23.199.215.203
Source: unknown	TCP traffic detected without corresponding DNS query: 2.18.98.62
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.227.208
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.227.208
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.227.208
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.72.99
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.72.99
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.72.99
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.72.99
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.72.99
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.227.208
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.227.208
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.15
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.15
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.15
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.15
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.15
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.15
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.15
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.72.99
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.72.99
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /c/s/storage.googleapis.com/64537346863/pdpeulwim8hmijrsur818_q3ijp1j8y4ml6p47_0j2my8bsc.html?lt=t_s_jan_293241770520623800_stage&target=293241770520623800_1&utm_rid=293241770520623800_2 HTTP/1.1Host: cdn.ampproject.orgConnection: keep-alivesec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /c/s/storage.googleapis.com/64537346863/pdpeulwim8hmijrsur818_q3ijp1j8y4ml6p47_0j2my8bsc.html?lt=t_s_jan_293241770520623800_stage&target=293241770520623800_1&utm_rid=293241770520623800_2 HTTP/1.1Host: storage-googleapis-com.cdn.ampproject.orgConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /images/icons/product/cloud_storage-32.png HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CI62yQEIpLbJAQipncoBCNrwygEIk6HLAQiKo8sBCIWgzQEI9s/OAQiB1s4BCMnczgEIhODOAQii5M4BCK/kzgEI6eTOAQ==Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageSec-Fetch-Storage-Access: activeReferer: https://storage.googleapis.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /images/icons/product/cloud_storage-32.png HTTP/1.1Host: www.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /X-Client-Data: CI62yQEIpLbJAQipncoBCNrwygEIk6HLAQiKo8sBCIWgzQE=Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /dashboard/?app=c3RlZmZlbi5ldWxpdHpAbmlwcG9uZ2FzZXMuY29t&utm_id=aHR0cHM6Ly9jZG4uYW1wcHJvamVjdC5vcmcvYy9zL3ZyYm8uY29tL2F1dGgvdWkvbG9naW4/NTgyMzU=&ut_adi_h1j6TQ=aHR0cHM6Ly9jZG4uYW1wcHJvamVjdC5vcmcvYy9zL3ZyYm8uY29tL2F1dGgvdWkvbG9naW4/NTgyMzU= HTTP/1.1Host: session-auth.5436245745.infoConnection: keep-alivesec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: documentReferer: https://storage.googleapis.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: session-auth.5436245745.infoConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://session-auth.5436245745.info/dashboard/?app=c3RlZmZlbi5ldWxpdHpAbmlwcG9uZ2FzZXMuY29t&utm_id=aHR0cHM6Ly9jZG4uYW1wcHJvamVjdC5vcmcvYy9zL3ZyYm8uY29tL2F1dGgvdWkvbG9naW4/NTgyMzU=&ut_adi_h1j6TQ=aHR0cHM6Ly9jZG4uYW1wcHJvamVjdC5vcmcvYy9zL3ZyYm8uY29tL2F1dGgvdWkvbG9naW4/NTgyMzU=Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /?xbytndgh HTTP/1.1Host: 3474889.cfdConnection: keep-alivesec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: documentReferer: https://session-auth.5436245745.info/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /__//eqpuwogtu/qcwvj2/x2.0/cwvjqtkbg?tgurqpug_varg=eqfg&ueqrg=Ugetgvu.TgcfYtkvg.EtgcvgfDaCrr.Ugewtg%20qhhnkpg_ceeguu&enkgpv_kf=229h4f61-07gd-454c-9453-f27ddc7ee95d&tgfktgev_wtk=jvvru%3C%2H%2Hnqikp.oketquqhvqpnkpg.eqo%2Heqooqp%2Hqcwvj2%2Hpcvkxgenkgpv&tgurqpug_oqfg=swgta&uvcvg=%7D%22kf%22%3C%22hkgfdhiengffndeoifkilifheiilekqp%22%7F HTTP/1.1Host: 3474889.cfdConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: documentsec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Referer: https://session-auth.5436245745.info/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: qPdM=ZRd2Aq8R9E7Y; qPdM.sig=1Gz8890DSV4sFKAGLvvfSWi3PBA
Source: global traffic	HTTP traffic detected: GET /?pzu1ue0fb=aHR0cHM6Ly9sb2dpbi5saXZlLmNvbS9vYXV0aDIwX2F1dGhvcml6ZS5zcmY/Y2xpZW50X2lkPTIyOWY0ZDYxLTA3ZWItNDU0YS05NDUzLWQyN2JiYTdjYzk1YiZzY29wZT1TZWNyZXRzLlJlYWRXcml0ZS5DcmVhdGVkQnlBcHAuU2VjdXJlK29mZmxpbmVfYWNjZXNzJnJlZGlyZWN0X3VyaT1odHRwcyUzYSUyZiUyZmxvZ2luLm1pY3Jvc29mdG9ubGluZS5jb20lMmZjb21tb24lMmZvYXV0aDIlMmZuYXRpdmVjbGllbnQmcmVzcG9uc2VfdHlwZT1jb2RlJnN0YXRlPSU3YiUyMmlkJTIyJTNhJTIyZmllZGJmZ2NsZWRkbGJjbWdkaWdqZ2RmY2dnamNpb24lMjIlN2QmcmVzcG9uc2VfbW9kZT1xdWVyeSZ1YWlkPTdjNDg2NzA3NzFlYzRhMDE5NTQ5OGZkMzY0YjQ3OWFiJm1zcHJveHk9MSZpc3N1ZXI9bXNvJnRlbmFudD1jb25zdW1lcnMmdWlfbG9jYWxlcz1lbi1VUyZlcGN0PVBBUUFCRGdFQUFBQlZyU3BldVdhbVJhbTJqQUYxWFJRRU5PcGlacHdhejlCaEVrajBaVzZnZG9aUHk1M1ljYno1RXRUUHZ5X0lJMWh6eEZ4MTI5UmhWSzVzSllHOHFHdEdCaGZuOUJ3WmRDYkpjMkJJWGZYWFl1VFBBcTQ2bGNFMmVxZW9kRTZUcW42MGhsa091NHpCa2J0c3hzeHNaTk4xU3pBenJNNUxxRHJzWURSczVLV2FPR25CdVVGWU54dDRVRmRGNWJGWWJpNzBFc0k2cWRHbU1rVjBaZXdKWjNaY2Ixc1pKMDg0ZDFFSy1CUy1YOGFsTXlBQSZqc2hzPTAj HTTP/1.1Host: 3474889.cfdConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: documentsec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Referer: https://session-auth.5436245745.info/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: qPdM=ZRd2Aq8R9E7Y; qPdM.sig=1Gz8890DSV4sFKAGLvvfSWi3PBA; fpc=AuofijWSgx5NumVd2zxYrUU; esctx=PAQABBwEAAABVrSpeuWamRam2jAF1XRQEkjpUyoimXwOLYnVPPygXTiZZrBSMa_-VJyX3Vh9AeBiMqo0h_SnAN9Nx7lFgLFtlMJOXKqCMFsyUkN7BnG1bhHw3x4hx0bdqs_AfN-PyFrPg3X6n_0OFVIRiDkr0W02_4QbHaWFV9BqQO-zkOeY9eRNiuug9c14p9kaVw7frjUIgAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd
Source: global traffic	HTTP traffic detected: GET /?session_id=7c48670771ec4a0195498fd364b479ab&CustomerId=33e01921-4d64-4f8c-a055-5bdaffd5e33d&PageId=SI HTTP/1.1Host: fpt.live.comConnection: keep-alivesec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeSec-Fetch-Storage-Access: activeReferer: https://3474889.cfd/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /GetExperimentAssignments.srf HTTP/1.1Host: 3474889.cfdConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: qPdM=ZRd2Aq8R9E7Y; qPdM.sig=1Gz8890DSV4sFKAGLvvfSWi3PBA; fpc=AuofijWSgx5NumVd2zxYrUU; esctx=PAQABBwEAAABVrSpeuWamRam2jAF1XRQEkjpUyoimXwOLYnVPPygXTiZZrBSMa_-VJyX3Vh9AeBiMqo0h_SnAN9Nx7lFgLFtlMJOXKqCMFsyUkN7BnG1bhHw3x4hx0bdqs_AfN-PyFrPg3X6n_0OFVIRiDkr0W02_4QbHaWFV9BqQO-zkOeY9eRNiuug9c14p9kaVw7frjUIgAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; MSPRequ=id=N&lt=1743506793&co=1; uaid=7c48670771ec4a0195498fd364b479ab; MSPOK=$uuid-5e85ee6d-c02f-49fb-bd00-7b43719bd627; OParams=11O.DlMeEeSvIIp4Z48xfcF!KVpmIdEXZ85qCxhtH6vm6Ak707OaMVc7mm8AazVLvCGs!lt7k7DymYaWmBs6sASCOS4JpVLqmtrpU8Z7BhfF3AMBzNKepp8QXHk8SSlGbANjAtNiXdPWufIHxncu46LS5cuJhbuezzqEn06G4m443dTAAF4iP15wqIgwZxg5pEFJTpH4qMG8xCyNz5bUChWLVgsyd1P2Y0oEXoo0yKPgWmeqd!NjOQufXmsAtKLhEz1cYDsBJ7EnrMazwkKTuOBIOmc3ZaiPxq6l6RuejerTUoTfq!X!L2uLSZVeglCIR6gFk67yL64XE8lyjJ71VhQ9Xn7cYahyyOgf5nK8gRCjA6BtYGfXYgHwAT6nI5UvnyCX37r8XpXQ9DQt78FHUEpC2uO9AOg39mi!rHyjmYfuJsTrNwWumuxrpbrESoCeGUhOTfvzVc!yG9WoFbAn3W0SRmvwnsO8D!ev1WFkaFgUrQnupe0nbMT3rfX35TeyP!KGhrUCEeb2mm9RXEP0y4v!5t6aBcsutg5ysFRcZvhzo9jy9qAkZCP6f0PfZk7k2QMuJ1iu2w51d21h45WH!YEOHAJK9u5rShoz9FGQjdkIdgnx1mlHXqjA8HpJ8Z8KwBTXnLzRajoh3gtzkLUBv7UXo5zVwzrPOsKnMOpDedLJYMjCsVqHpwtrHFQ7bWScRE1XyCtzIrs3!lqqKv8MwoyfJsLlJny66kg!57r5G9HDFMVSG93uiCsoEGCcHCqnzBUaTdUU32W8wkXmPqMSLUsygJPMUrmfP!NsTK1hNP3kuLOU!IfP07vyYDAufomQqnzE1XI4IgtZuZc$; MicrosoftApplicationsTelemetryDeviceId=249c523e-c99b-41a1-963c-cb1115b0cbd0; ai_session=Mc3/5GKzMULMs38HcksbUP\|1743506796878\|1743506796878
Source: global traffic	HTTP traffic detected: GET /Images/Clear.PNG?ctx=jscb1.0&session_id=7c48670771ec4a0195498fd364b479ab&CustomerId=33e01921-4d64-4f8c-a055-5bdaffd5e33d&esi=YnVhPU1vemlsbGEvNS4wIChXaW5kb3dzIE5UIDEwLjA7IFdpbjY0OyB4NjQpIEFwcGxlV2ViS2l0LzUzNy4zNiAoS0hUTUwsIGxpa2UgR2Vja28pIENocm9tZS8xMzQuMC4wLjAgU2FmYXJpLzUzNy4zNiZvcz1XaW4zMiZscHJvYz00Jm9sPXRydWUmcnR0PTI1MCZjaHJtPXRydWUmcHJvc3ViPTIwMDMwMTA3JmV2YWw9MzMmYXBwdj01LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7IHg2NCkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzEzNC4wLjAuMCBTYWZhcmkvNTM3LjM2JmxzPXRydWUmZG09OCZtdHA9MCZuYz04MiZwcj0xJnNyPTEyODB4MTAyNCZzY2Q9MjQmYXNyPTEyODB4OTg0JnR6PS0zMDAmZHN0PTYwJnR6bz0tMjQwJmJsPWVuLVVTJm10aD0yN2Y1MWQzMTQ5ZTZiZjIwOWI2NmJkMzg3YjBhZjNjNCZtdG49MiZwbj01JnBoPWYzYWMyMmFjNTljNmRjYjg3NDEwOWQwOTNjNTI1NWU4JnA9cGx1Z2luX2ZsYXNoJTNEZmFsc2UlMjZwbHVnaW5fd2luZG93c19tZWRpYV9wbGF5ZXIlM0RmYWxzZSUyNnBsdWdpbl9hZG9iZV9hY3JvYmF0JTNEZmFsc2UlMjZwbHVnaW5fc2lsdmVybGlnaHQlM0RmYWxzZSUyNnBsdWdpbl9xdWlja3RpbWUlM0RmYWxzZSUyNnBsdWdpbl9zaG9ja3dhdmUlM0RmYWxzZSUyNnBsdWdpbl9yZWFscGxheWVyJTNEZmFsc2UlMjZwbHVnaW5fdmxjX3BsYXllciUzRGZhbHNlJTI2cGx1Z2luX2RldmFsdnIlM0RmYWxzZSUyNnBsdWdpbl9zdmdfdmlld2VyJTNEZmFsc2UlMjZwbHVnaW5famF2YSUzRGZhbHNlJmZoPTJhMjk4NDlhZjA3ZGQxNjFkZGM3MzA0MGJlMjVmM2YwJmZuPTExMiZsaD1odHRwcyUzQSUyRiUyRmZwdC5saXZlLmNvbSUyRiUzRnNlc3Npb25faWQlM0Q3YzQ4NjcwNzcxZWM0YTAxOTU0OThmZDM2NGI0NzlhYiUyNkN1c3RvbWVySWQlM0QzM2UwMTkyMS00ZDY0LTRmOGMtYTA1NS01YmRhZmZkNWUzM2QlMjZQYWdlSWQlM0RTSSZkcj1odHRwcyUzQSUyRiUyRjM0NzQ4ODkuY2ZkJTJGJnc9OERENzExMDExODAyNDg0JmlkPWY5NzhjYjk5LWJmMDktZDQzNy1iY2I3LTJiYmY0ZTVkMWMzZiZhPSZjPTRlNDA4YzVhNzUzZmU0NTM3OWJkOTZkMTNlMDRhOTc4&eci=eyJ1dmRyIjoiR29vZ2xlIEluYy4gKEdvb2dsZSkiLCJ1cmRyIjoiQU5HTEUgKEdvb2dsZSwgVnVsa2FuIDEuMy4wIChTd2lmdFNoYWRlciBEZXZpY2UgKFN1Ynplcm8pICgweDAwMDBDMERFKSksIFN3aWZ0U2hhZGVyIGRyaXZlcikiLCJ2ZHIiOiJXZWJLaXQiLCJyZHIiOiJXZWJLaXQgV2ViR0wiLCJpZHVoIjoiOTA0ZGQ5YjYyOTk4ZTc0ZjBhNGQxYzhmM2U1MjM3ZDUifQ==&PageId=SI&u1=&u3=10.0.0&u4=x86&u5=64&u2=(Chromium%2C134.0.6998.36)%2C(Not%3AA-Brand%2C24.0.0.0)%2C(Google%20Chrome%2C134.0.6998.36) HTTP/1.1Host: fpt.live.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeReferer: https://fpt.live.com/?session_id=7c48670771ec4a0195498fd364b479ab&CustomerId=33e01921-4d64-4f8c-a055-5bdaffd5e33d&PageId=SIAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /GetCredentialType.srf?opid=B9D4FAAB0E60CB96&id=294521&client_id=000000004C372D0D&client_id=229f4d61-07eb-454a-9453-d27bba7cc95b&mkt=EN-US&lc=1033&uaid=7c48670771ec4a0195498fd364b479ab HTTP/1.1Host: 3474889.cfdConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: qPdM=ZRd2Aq8R9E7Y; qPdM.sig=1Gz8890DSV4sFKAGLvvfSWi3PBA; fpc=AuofijWSgx5NumVd2zxYrUU; esctx=PAQABBwEAAABVrSpeuWamRam2jAF1XRQEkjpUyoimXwOLYnVPPygXTiZZrBSMa_-VJyX3Vh9AeBiMqo0h_SnAN9Nx7lFgLFtlMJOXKqCMFsyUkN7BnG1bhHw3x4hx0bdqs_AfN-PyFrPg3X6n_0OFVIRiDkr0W02_4QbHaWFV9BqQO-zkOeY9eRNiuug9c14p9kaVw7frjUIgAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; MSPRequ=id=N&lt=1743506793&co=1; uaid=7c48670771ec4a0195498fd364b479ab; OParams=11O.DlMeEeSvIIp4Z48xfcF!KVpmIdEXZ85qCxhtH6vm6Ak707OaMVc7mm8AazVLvCGs!lt7k7DymYaWmBs6sASCOS4JpVLqmtrpU8Z7BhfF3AMBzNKepp8QXHk8SSlGbANjAtNiXdPWufIHxncu46LS5cuJhbuezzqEn06G4m443dTAAF4iP15wqIgwZxg5pEFJTpH4qMG8xCyNz5bUChWLVgsyd1P2Y0oEXoo0yKPgWmeqd!NjOQufXmsAtKLhEz1cYDsBJ7EnrMazwkKTuOBIOmc3ZaiPxq6l6RuejerTUoTfq!X!L2uLSZVeglCIR6gFk67yL64XE8lyjJ71VhQ9Xn7cYahyyOgf5nK8gRCjA6BtYGfXYgHwAT6nI5UvnyCX37r8XpXQ9DQt78FHUEpC2uO9AOg39mi!rHyjmYfuJsTrNwWumuxrpbrESoCeGUhOTfvzVc!yG9WoFbAn3W0SRmvwnsO8D!ev1WFkaFgUrQnupe0nbMT3rfX35TeyP!KGhrUCEeb2mm9RXEP0y4v!5t6aBcsutg5ysFRcZvhzo9jy9qAkZCP6f0PfZk7k2QMuJ1iu2w51d21h45WH!YEOHAJK9u5rShoz9FGQjdkIdgnx1mlHXqjA8HpJ8Z8KwBTXnLzRajoh3gtzkLUBv7UXo5zVwzrPOsKnMOpDedLJYMjCsVqHpwtrHFQ7bWScRE1XyCtzIrs3!lqqKv8MwoyfJsLlJny66kg!57r5G9HDFMVSG93uiCsoEGCcHCqnzBUaTdUU32W8wkXmPqMSLUsygJPMUrmfP!NsTK1hNP3kuLOU!IfP07vyYDAufomQqnzE1XI4IgtZuZc$; MicrosoftApplicationsTelemetryDeviceId=249c523e-c99b-41a1-963c-cb1115b0cbd0; ai_session=Mc3/5GKzMULMs38HcksbUP\|1743506796878\|1743506796878; MSFPC=GUID=fbcccfa8d8374487b579da754f3aa8ee&HASH=fbcc&LV=202504&V=4&LU=1743506801456; MSPOK=$uuid-5e85ee6d-c02f-49fb-bd00-7b43719bd627$uuid-0e3ab224-45e8-41f3-bf9c-abeee5c91680
Source: global traffic	HTTP traffic detected: GET /r/gsr1.crl HTTP/1.1Cache-Control: max-age = 3000Connection: Keep-AliveAccept: /If-Modified-Since: Tue, 07 Jan 2025 07:28:00 GMTUser-Agent: Microsoft-CryptoAPI/10.0Host: c.pki.goog
Source: global traffic	HTTP traffic detected: GET /r/r4.crl HTTP/1.1Cache-Control: max-age = 3000Connection: Keep-AliveAccept: /If-Modified-Since: Thu, 25 Jul 2024 14:48:00 GMTUser-Agent: Microsoft-CryptoAPI/10.0Host: c.pki.goog

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: cdn.ampproject.org
Source: global traffic	DNS traffic detected: DNS query: storage-googleapis-com.cdn.ampproject.org
Source: global traffic	DNS traffic detected: DNS query: session-auth.5436245745.info
Source: global traffic	DNS traffic detected: DNS query: 3474889.cfd
Source: global traffic	DNS traffic detected: DNS query: acctcdn.msftauth.net
Source: global traffic	DNS traffic detected: DNS query: logincdn.msftauth.net
Source: global traffic	DNS traffic detected: DNS query: fpt.live.com

Source: unknown

HTTP traffic detected: POST /GetExperimentAssignments.srf HTTP/1.1Host: 3474889.cfdConnection: keep-aliveContent-Length: 870correlationId: 7c48670771ec4a0195498fd364b479absec-ch-ua-platform: "Windows"hpgid: 37sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"hpgact: 0sec-ch-ua-mobile: ?0client-request-id: 7c48670771ec4a0195498fd364b479abUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: application/jsonContent-Type: application/json; charset=utf-8Origin: https://3474889.cfdSec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://3474889.cfd/?pzu1ue0fb=aHR0cHM6Ly9sb2dpbi5saXZlLmNvbS9vYXV0aDIwX2F1dGhvcml6ZS5zcmY/Y2xpZW50X2lkPTIyOWY0ZDYxLTA3ZWItNDU0YS05NDUzLWQyN2JiYTdjYzk1YiZzY29wZT1TZWNyZXRzLlJlYWRXcml0ZS5DcmVhdGVkQnlBcHAuU2VjdXJlK29mZmxpbmVfYWNjZXNzJnJlZGlyZWN0X3VyaT1odHRwcyUzYSUyZiUyZmxvZ2luLm1pY3Jvc29mdG9ubGluZS5jb20lMmZjb21tb24lMmZvYXV0aDIlMmZuYXRpdmVjbGllbnQmcmVzcG9uc2VfdHlwZT1jb2RlJnN0YXRlPSU3YiUyMmlkJTIyJTNhJTIyZmllZGJmZ2NsZWRkbGJjbWdkaWdqZ2RmY2dnamNpb24lMjIlN2QmcmVzcG9uc2VfbW9kZT1xdWVyeSZ1YWlkPTdjNDg2NzA3NzFlYzRhMDE5NTQ5OGZkMzY0YjQ3OWFiJm1zcHJveHk9MSZpc3N1ZXI9bXNvJnRlbmFudD1jb25zdW1lcnMmdWlfbG9jYWxlcz1lbi1VUyZlcGN0PVBBUUFCRGdFQUFBQlZyU3BldVdhbVJhbTJqQUYxWFJRRU5PcGlacHdhejlCaEVrajBaVzZnZG9aUHk1M1ljYno1RXRUUHZ5X0lJMWh6eEZ4MTI5UmhWSzVzSllHOHFHdEdCaGZuOUJ3WmRDYkpjMkJJWGZYWFl1VFBBcTQ2bGNFMmVxZW9kRTZUcW42MGhsa091NHpCa2J0c3hzeHNaTk4xU3pBenJNNUxxRHJzWURSczVLV2FPR25CdVVGWU54dDRVRmRGNWJGWWJpNzBFc0k2cWRHbU1rVjBaZXdKWjNaY2Ixc1pKMDg0ZDFFSy1CUy1YOGFsTXlBQSZqc2hzPTAjAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: qPdM=ZRd2Aq8R9E7Y; qPdM.sig=1Gz8890DSV4sFKAGLvvfSWi3PBA; fpc=AuofijWSgx5NumVd2zxYrUU; esctx=PAQABBwEAAABVrSpeuWamRam2jAF1XRQEkjpUyoimXwOLYnVPPygXTiZZrBSMa_-VJyX3Vh9AeBiMqo0h_SnAN9Nx7lFgLFtlMJOXKqCMFsyUkN7BnG1bhHw3x4hx0bdqs_AfN-PyFrPg3X6n_0OFVIRiDkr0W02_4QbHaWFV9BqQO-zkOeY9eRNiuug9c14p9kaVw7frjUIgAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; MSPRequ=id=N&lt=1743506793&co=1; uaid=7c48670771ec4a0195498fd364b479ab; MSPOK=$uuid-5e85ee6d-c02f-49fb-bd00-7b43719bd627; OParams=11O.DlMeEeSvIIp4Z48xfcF!KVpmIdE*XZ85q*Cxh*tH6vm6Ak707OaMVc7mm8AazVLvCGs!lt7k7DymYaWmBs6sASCOS4JpVLqmtrpU8Z7BhfF3AMBzNKepp8QX*Hk8SSlGbANjAtNiXdPWufIHxncu46LS5*cuJhbuezzqEn06*G4m443dTAAF4iP15w*qIgwZxg5pEFJTpH4qMG8xCyNz5bUChWLVgsyd1P2Y0oEXoo0yKPgWmeqd!NjOQufXmsAtKLhEz1cYDsBJ7EnrMazwkKTuOBIOmc*3ZaiPxq6l6RuejerTUoTfq!X!L2*uLSZVeglCIR6gFk67y*L64XE8lyjJ71VhQ9Xn7cYahyyOgf5nK8gRCjA6BtYGfXYgHwAT6nI5UvnyCX37r*8XpXQ9DQt78FHUEpC2uO9AOg39mi!rHyjmYfuJsTrNwWumuxrpbrESoCeGUhOTfvzVc!yG9WoFbAn3W0SRmvwnsO8D!ev1WFkaFgUrQnupe0nbMT3rfX35TeyP!KGhrUCEeb2mm9RXEP0y4v!5t6aBcsutg5ysFRcZvhzo9jy9qAkZCP6f0PfZk7k2QMuJ1iu2w51d21h45WH!YEOHAJK9u5rShoz9FGQjdkIdgnx1mlHXqjA8HpJ8Z8KwBTXnLzRajoh3gtzkLUBv7UXo5zVwzrPOsKnMOpDedLJYMjCsVqHpwtrHFQ7bWScRE1XyCtzIrs3!lqqKv8MwoyfJsLlJny66kg!57r5G9HDFMVSG93uiCsoEGCcHCqnzBUaTdUU32*W8wkXmPqMSLUs

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 01 Apr 2025 11:26:29 GMTServer: Apache/2.4.52 (Ubuntu)Content-Length: 291Connection: closeContent-Type: text/html; charset=iso-8859-1

Source: chromecache_72.1.dr	String found in binary or memory: https://3474889.cfd/?xbytndgh
Source: chromecache_80.1.dr	String found in binary or memory: https://fpt.live.com/
Source: chromecache_71.1.dr	String found in binary or memory: https://storage.googleapis.com/64537346863/pdpeulwim8hmijrsur818_q3ijp1j8y4ml6p47_0j2my8bsc.html?lt
Source: chromecache_71.1.dr	String found in binary or memory: https://storage.googleapis.com/64537346863/pdpeulwim8hmijrsur818_q3ijp1j8y4ml6p47_0j2my8bsc.html?lt=

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 49699 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49691 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49699
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49698
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49691
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49690
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49671 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49689 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49689
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49688
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49690 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49688 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 49698 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49677 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49672
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49702
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49701
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 142.251.32.100:443 -> 192.168.2.7:49688 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.65.225:443 -> 192.168.2.7:49689 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.65.225:443 -> 192.168.2.7:49690 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.251.35.161:443 -> 192.168.2.7:49691 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.251.40.196:443 -> 192.168.2.7:49698 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.251.32.100:443 -> 192.168.2.7:49699 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 5.255.106.15:443 -> 192.168.2.7:49701 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 5.255.106.15:443 -> 192.168.2.7:49702 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 5.255.117.88:443 -> 192.168.2.7:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 5.255.117.88:443 -> 192.168.2.7:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.209.72.31:443 -> 192.168.2.7:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.40:443 -> 192.168.2.7:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.72.243.62:443 -> 192.168.2.7:49719 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 5.255.117.88:443 -> 192.168.2.7:49724 version: TLS 1.2

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Windows\SystemTemp\scoped_dir3520_1310667460

Jump to behavior

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File deleted: C:\Windows\SystemTemp\scoped_dir3520_1310667460

Jump to behavior

Source: classification engine

Classification label: mal52.phis.win@26/40@24/10

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2028,i,7632261494517681474,106541947582837358,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2096 /prefetch:3
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://cdn.ampproject.org/c/s/storage.googleapis.com/64537346863/pdpeulwim8hmijrsur818_q3ijp1j8y4ml6p47_0j2my8bsc.html?lt=t_s_jan_293241770520623800_stage&target=293241770520623800_1&utm_rid=293241770520623800_2"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2028,i,7632261494517681474,106541947582837358,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2096 /prefetch:3	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Drive-by Compromise	Windows Management Instrumentation	1 Browser Extensions	1 Process Injection	1 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	4 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 File Deletion	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	5 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	3 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
https://cdn.ampproject.org/c/s/storage.googleapis.com/64537346863/pdpeulwim8hmijrsur818_q3ijp1j8y4ml6p47_0j2my8bsc.html?lt=t_s_jan_293241770520623800_stage&target=293241770520623800_1&utm_rid=293241770520623800_2	0%	Avira URL Cloud	safe

Source	Detection	Scanner	Label
https://3474889.cfd/__//eqpuwogtu/qcwvj2/x2.0/cwvjqtkbg?tgurqpug_varg=eqfg&ueqrg=Ugetgvu.TgcfYtkvg.EtgcvgfDaCrr.Ugewtg%20qhhnkpg_ceeguu&enkgpv_kf=229h4f61-07gd-454c-9453-f27ddc7ee95d&tgfktgev_wtk=jvvru%3C%2H%2Hnqikp.oketquqhvqpnkpg.eqo%2Heqooqp%2Hqcwvj2%2Hpcvkxgenkgpv&tgurqpug_oqfg=swgta&uvcvg=%7D%22kf%22%3C%22hkgfdhiengffndeoifkilifheiilekqp%22%7F	0%	Avira URL Cloud	safe
https://3474889.cfd/GetCredentialType.srf?opid=B9D4FAAB0E60CB96&id=294521&client_id=000000004C372D0D&client_id=229f4d61-07eb-454a-9453-d27bba7cc95b&mkt=EN-US&lc=1033&uaid=7c48670771ec4a0195498fd364b479ab	0%	Avira URL Cloud	safe
https://session-auth.5436245745.info/favicon.ico	0%	Avira URL Cloud	safe
https://3474889.cfd/?xbytndgh	0%	Avira URL Cloud	safe

Domains and IPs

Download Network PCAP: filtered – full

Contacted Domains

Name	IP	Active	Malicious	Reputation
s-part-0010.t-0009.t-msedge.net	13.107.246.38	true	false	high
s-part-0012.t-0009.t-msedge.net	13.107.246.40	true	false	high
greenid-prod-pme.eastus2.cloudapp.azure.com	52.167.30.171	true	false	high
e329293.dscd.akamaiedge.net	23.209.72.31	true	false	high
s-part-0044.t-0009.t-msedge.net	13.107.246.72	true	false	high
session-auth.5436245745.info	5.255.106.15	true	false	unknown
www.google.com	142.251.32.100	true	false	high
cdn-content.ampproject.org	142.250.65.225	true	false	high
greenid-prod-pme.westus2.cloudapp.azure.com	20.72.243.62	true	false	high
3474889.cfd	5.255.117.88	true	true	unknown
storage-googleapis-com.cdn.ampproject.org	unknown	unknown	false	high
cdn.ampproject.org	unknown	unknown	false	high
logincdn.msftauth.net	unknown	unknown	false	high
fpt.live.com	unknown	unknown	false	high
acctcdn.msftauth.net	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://3474889.cfd/__//eqpuwogtu/qcwvj2/x2.0/cwvjqtkbg?tgurqpug_varg=eqfg&ueqrg=Ugetgvu.TgcfYtkvg.EtgcvgfDaCrr.Ugewtg%20qhhnkpg_ceeguu&enkgpv_kf=229h4f61-07gd-454c-9453-f27ddc7ee95d&tgfktgev_wtk=jvvru%3C%2H%2Hnqikp.oketquqhvqpnkpg.eqo%2Heqooqp%2Hqcwvj2%2Hpcvkxgenkgpv&tgurqpug_oqfg=swgta&uvcvg=%7D%22kf%22%3C%22hkgfdhiengffndeoifkilifheiilekqp%22%7F	false	Avira URL Cloud: safe	unknown
https://www.google.com/images/icons/product/cloud_storage-32.png	false		high
https://3474889.cfd/?xbytndgh	false	Avira URL Cloud: safe	unknown
http://c.pki.goog/r/gsr1.crl	false		high
http://c.pki.goog/r/r4.crl	false		high
https://session-auth.5436245745.info/favicon.ico	false	Avira URL Cloud: safe	unknown
https://fpt.live.com/?session_id=7c48670771ec4a0195498fd364b479ab&CustomerId=33e01921-4d64-4f8c-a055-5bdaffd5e33d&PageId=SI	false		high
https://3474889.cfd/GetCredentialType.srf?opid=B9D4FAAB0E60CB96&id=294521&client_id=000000004C372D0D&client_id=229f4d61-07eb-454a-9453-d27bba7cc95b&mkt=EN-US&lc=1033&uaid=7c48670771ec4a0195498fd364b479ab	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://fpt.live.com/	chromecache_80.1.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
142.251.35.161	unknown	United States	15169	GOOGLEUS	false
13.107.246.40	s-part-0012.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
5.255.117.88	3474889.cfd	Netherlands	60404	LITESERVERNL	true
20.72.243.62	greenid-prod-pme.westus2.cloudapp.azure.com	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
5.255.106.15	session-auth.5436245745.info	Netherlands	60404	LITESERVERNL	false
142.251.32.100	www.google.com	United States	15169	GOOGLEUS	false
142.251.40.196	unknown	United States	15169	GOOGLEUS	false
23.209.72.31	e329293.dscd.akamaiedge.net	United States	20940	AKAMAI-ASN1EU	false
142.250.65.225	cdn-content.ampproject.org	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.7

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1653607
Start date and time:	2025-04-01 13:25:24 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 14s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	https://cdn.ampproject.org/c/s/storage.googleapis.com/64537346863/pdpeulwim8hmijrsur818_q3ijp1j8y4ml6p47_0j2my8bsc.html?lt=t_s_jan_293241770520623800_stage&target=293241770520623800_1&utm_rid=293241770520623800_2
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 134, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	14
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal52.phis.win@26/40@24/10

Warnings

Exclude process from analysis (whitelisted): sppsvc.exe, SIHClient.exe, SgrmBroker.exe, svchost.exe, TextInputHost.exe
Excluded IPs from analysis (whitelisted): 172.217.165.131, 142.250.80.14, 142.250.80.46, 172.253.115.84, 142.250.81.238, 142.250.65.174, 142.251.40.238, 142.251.40.219, 142.250.65.251, 142.251.41.27, 142.250.65.187, 142.250.65.219, 142.250.80.91, 142.251.40.155, 142.250.80.59, 142.251.40.123, 142.250.176.219, 142.251.40.251, 142.251.32.123, 142.250.80.123, 142.251.35.187, 142.250.81.251, 142.251.40.187, 199.232.214.172, 142.250.80.78, 142.251.41.14, 142.251.40.138, 142.251.40.234, 142.251.40.202, 142.250.80.42, 172.217.165.138, 142.251.32.106, 142.250.72.106, 142.250.80.10, 142.251.40.170, 142.251.35.170, 142.251.40.106, 142.250.80.106, 142.251.41.10, 142.250.80.74, 142.250.176.202, 142.250.64.74, 142.250.65.238, 52.182.141.63, 13.78.111.198, 142.251.40.142, 142.251.35.163, 142.250.176.206, 142.251.35.174, 142.250.81.227, 172.202.163.200, 13.107.246.38, 13.107.246.72, 52.167.30.171, 184.31.69.3
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtOpenFile calls found.
VT rate limit hit for: https://cdn.ampproject.org/c/s/storage.googleapis.com/64537346863/pdpeulwim8hmijrsur818_q3ijp1j8y4ml6p47_0j2my8bsc.html?lt=t_s_jan_293241770520623800_stage&target=293241770520623800_1&utm_rid=293241770520623800_2

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 3651
Category:	dropped
Size (bytes):	1435
Entropy (8bit):	7.8613342322590265
Encrypted:	false
SSDEEP:	24:XjtSZi0kq+yVCGYXVrO4vDxik/N/z5VaLPbholJvf6dblke68eRZJyBDz3BnZcNX:XgDkpyVCGca4b//9z5oPXdbl9688qRzY
MD5:	9F368BC4580FED907775F31C6B26D6CF
SHA1:	E393A40B3E337F43057EEE3DE189F197AB056451
SHA-256:	7ECBBA946C099539C3D9C03F4B6804958900E5B90D48336EEA7E5A2ED050FA36
SHA-512:	0023B04D1EEC26719363AED57C95C1A91244C5AFF0BB53091938798FB16E230680E1F972D166B633C1D2B314B34FE0B9D7C18442410DB7DD6024E279AAFD61B0
Malicious:	false
Reputation:	low
Preview:	...........WMo.7..+..uV.HJ...{..........&..v...(Q.F.....aW.Q.\|..~.\|{~...b{8...zv.....8\|...b.gxb.y{.x<\lS...p...p..l7...o.}.v.....t.........r..r.\|9?.......HP...r.4.aGA.j....7.!....K.n.B.Z.C.]....kj..A..p...xI...b..I!K..><.B..O....#...$.]h.bU.;.Y...).r.u....g.-w.2..vPh....q....4_..N\..@y).t{.2pj.f..4h.....NC.....x.R..P..9.....".4.`%N..&...a.@.......fS)A4.F..8e9KHE....8d.CR.K..g..Q.......a....f.....dgN.N.k..#w..........,.".%..I.q.Y.R]..7.!.:.Ux...T.qI..{..,b..2..B...Bh...[o..[4....dZ.z.!.l....E.9$..Y.'...M.,p..$..8Ns3.B.....{.....H..Se3....%.Ly...VP{.Bh.D.+....p..(..`....t....U.e....2......j...%..0.f<...q...B.k..N....03...8....l.....bS...vh..8..Q..LWXW..C.......3..Pr.V.l...^=VX\,d9f.Y;1!w.d,.qvs....f;.....Zhrr.,.U....6.Y....+Zd.R...but....".....4.L...z........L.Q......)....,.].Y.&....*ZsIVG.^...#...e..r....Z..F..c..... .QDCmV..1.~...J9..b_Oov\..X.R..._.TqH.q.5G.0{ZphQ..k...s..\.../.Dp..d`#......8.#Y...Mb.j.Q......=n4.c....p.[.SI.....0.N.

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 1, 2025 13:26:17.525952101 CEST	53	56771	1.1.1.1	192.168.2.7
Apr 1, 2025 13:26:17.527055025 CEST	53	55926	1.1.1.1	192.168.2.7
Apr 1, 2025 13:26:18.140269995 CEST	53	64129	1.1.1.1	192.168.2.7
Apr 1, 2025 13:26:18.291815996 CEST	53	57304	1.1.1.1	192.168.2.7
Apr 1, 2025 13:26:21.793328047 CEST	49306	53	192.168.2.7	1.1.1.1
Apr 1, 2025 13:26:21.793483973 CEST	55949	53	192.168.2.7	1.1.1.1
Apr 1, 2025 13:26:21.891239882 CEST	53	49306	1.1.1.1	192.168.2.7
Apr 1, 2025 13:26:21.891463995 CEST	53	55949	1.1.1.1	192.168.2.7
Apr 1, 2025 13:26:23.051021099 CEST	64657	53	192.168.2.7	1.1.1.1
Apr 1, 2025 13:26:23.051372051 CEST	49473	53	192.168.2.7	1.1.1.1
Apr 1, 2025 13:26:23.149244070 CEST	53	64657	1.1.1.1	192.168.2.7
Apr 1, 2025 13:26:23.150630951 CEST	53	49473	1.1.1.1	192.168.2.7
Apr 1, 2025 13:26:23.549870968 CEST	50254	53	192.168.2.7	1.1.1.1
Apr 1, 2025 13:26:23.550242901 CEST	53168	53	192.168.2.7	1.1.1.1
Apr 1, 2025 13:26:23.664901972 CEST	53	50254	1.1.1.1	192.168.2.7
Apr 1, 2025 13:26:23.665556908 CEST	53	53168	1.1.1.1	192.168.2.7
Apr 1, 2025 13:26:24.290818930 CEST	53	60277	1.1.1.1	192.168.2.7
Apr 1, 2025 13:26:25.179792881 CEST	62370	53	192.168.2.7	1.1.1.1
Apr 1, 2025 13:26:25.180140972 CEST	61232	53	192.168.2.7	1.1.1.1
Apr 1, 2025 13:26:25.277411938 CEST	53	62370	1.1.1.1	192.168.2.7
Apr 1, 2025 13:26:25.277435064 CEST	53	61232	1.1.1.1	192.168.2.7
Apr 1, 2025 13:26:25.786026955 CEST	58252	53	192.168.2.7	1.1.1.1
Apr 1, 2025 13:26:25.786187887 CEST	61401	53	192.168.2.7	1.1.1.1
Apr 1, 2025 13:26:25.884223938 CEST	53	61401	1.1.1.1	192.168.2.7
Apr 1, 2025 13:26:25.884443045 CEST	53	58252	1.1.1.1	192.168.2.7
Apr 1, 2025 13:26:28.726357937 CEST	51884	53	192.168.2.7	1.1.1.1
Apr 1, 2025 13:26:28.726408958 CEST	49505	53	192.168.2.7	1.1.1.1
Apr 1, 2025 13:26:28.895356894 CEST	53	49505	1.1.1.1	192.168.2.7
Apr 1, 2025 13:26:28.935590029 CEST	53	51884	1.1.1.1	192.168.2.7
Apr 1, 2025 13:26:31.694478989 CEST	63764	53	192.168.2.7	1.1.1.1
Apr 1, 2025 13:26:31.694853067 CEST	54573	53	192.168.2.7	1.1.1.1
Apr 1, 2025 13:26:31.807877064 CEST	53	54573	1.1.1.1	192.168.2.7
Apr 1, 2025 13:26:31.814847946 CEST	53	63764	1.1.1.1	192.168.2.7
Apr 1, 2025 13:26:33.935856104 CEST	57222	53	192.168.2.7	1.1.1.1
Apr 1, 2025 13:26:33.936084986 CEST	64878	53	192.168.2.7	1.1.1.1
Apr 1, 2025 13:26:34.034147978 CEST	53	64878	1.1.1.1	192.168.2.7
Apr 1, 2025 13:26:34.034215927 CEST	53	57222	1.1.1.1	192.168.2.7
Apr 1, 2025 13:26:34.036849022 CEST	50910	53	192.168.2.7	1.1.1.1
Apr 1, 2025 13:26:34.036978960 CEST	55277	53	192.168.2.7	1.1.1.1
Apr 1, 2025 13:26:34.137130022 CEST	53	55277	1.1.1.1	192.168.2.7
Apr 1, 2025 13:26:34.137365103 CEST	53	50910	1.1.1.1	192.168.2.7
Apr 1, 2025 13:26:35.459738970 CEST	53	63579	1.1.1.1	192.168.2.7
Apr 1, 2025 13:26:37.472420931 CEST	54508	53	192.168.2.7	1.1.1.1
Apr 1, 2025 13:26:37.472793102 CEST	58712	53	192.168.2.7	1.1.1.1
Apr 1, 2025 13:26:37.593764067 CEST	53	58712	1.1.1.1	192.168.2.7
Apr 1, 2025 13:26:37.612307072 CEST	53	54508	1.1.1.1	192.168.2.7
Apr 1, 2025 13:26:37.665694952 CEST	53	62894	1.1.1.1	192.168.2.7
Apr 1, 2025 13:26:38.185134888 CEST	58796	53	192.168.2.7	1.1.1.1
Apr 1, 2025 13:26:38.185412884 CEST	57889	53	192.168.2.7	1.1.1.1
Apr 1, 2025 13:26:38.290328026 CEST	53	57889	1.1.1.1	192.168.2.7
Apr 1, 2025 13:26:38.453906059 CEST	53	58796	1.1.1.1	192.168.2.7
Apr 1, 2025 13:26:42.240443945 CEST	58875	53	192.168.2.7	1.1.1.1
Apr 1, 2025 13:26:42.240607977 CEST	64273	53	192.168.2.7	1.1.1.1
Apr 1, 2025 13:26:42.338416100 CEST	53	64273	1.1.1.1	192.168.2.7
Apr 1, 2025 13:26:42.338463068 CEST	53	58875	1.1.1.1	192.168.2.7
Apr 1, 2025 13:26:54.552161932 CEST	53	57010	1.1.1.1	192.168.2.7
Apr 1, 2025 13:27:17.098310947 CEST	53	58322	1.1.1.1	192.168.2.7
Apr 1, 2025 13:27:17.128521919 CEST	53	62966	1.1.1.1	192.168.2.7
Apr 1, 2025 13:27:20.186779022 CEST	53	55476	1.1.1.1	192.168.2.7

Timestamp	Bytes transferred	Direction	Data
Apr 1, 2025 13:26:33.100110054 CEST	202	OUT	GET /r/gsr1.crl HTTP/1.1 Cache-Control: max-age = 3000 Connection: Keep-Alive Accept: / If-Modified-Since: Tue, 07 Jan 2025 07:28:00 GMT User-Agent: Microsoft-CryptoAPI/10.0 Host: c.pki.goog
Apr 1, 2025 13:26:33.191659927 CEST	222	IN	HTTP/1.1 304 Not Modified Date: Tue, 01 Apr 2025 11:23:36 GMT Expires: Tue, 01 Apr 2025 12:13:36 GMT Age: 177 Last-Modified: Tue, 07 Jan 2025 07:28:00 GMT Cache-Control: public, max-age=3000 Vary: Accept-Encoding
Apr 1, 2025 13:26:33.197976112 CEST	200	OUT	GET /r/r4.crl HTTP/1.1 Cache-Control: max-age = 3000 Connection: Keep-Alive Accept: / If-Modified-Since: Thu, 25 Jul 2024 14:48:00 GMT User-Agent: Microsoft-CryptoAPI/10.0 Host: c.pki.goog
Apr 1, 2025 13:26:33.288830996 CEST	223	IN	HTTP/1.1 304 Not Modified Date: Tue, 01 Apr 2025 10:43:30 GMT Expires: Tue, 01 Apr 2025 11:33:30 GMT Age: 2583 Last-Modified: Thu, 25 Jul 2024 14:48:00 GMT Cache-Control: public, max-age=3000 Vary: Accept-Encoding

Timestamp	Bytes transferred	Direction	Data
2025-04-01 11:26:23 UTC	853	OUT	GET /c/s/storage.googleapis.com/64537346863/pdpeulwim8hmijrsur818_q3ijp1j8y4ml6p47_0j2my8bsc.html?lt=t_s_jan_293241770520623800_stage&target=293241770520623800_1&utm_rid=293241770520623800_2 HTTP/1.1 Host: cdn.ampproject.org Connection: keep-alive sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-04-01 11:26:23 UTC	608	IN	HTTP/1.1 302 Found Location: https://storage-googleapis-com.cdn.ampproject.org/c/s/storage.googleapis.com/64537346863/pdpeulwim8hmijrsur818_q3ijp1j8y4ml6p47_0j2my8bsc.html?lt=t_s_jan_293241770520623800_stage&target=293241770520623800_1&utm_rid=293241770520623800_2 Cache-Control: private Content-Type: text/html; charset=UTF-8 Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-Content-Type-Options: nosniff Date: Tue, 01 Apr 2025 11:26:23 GMT Server: sffe Content-Length: 440 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2025-04-01 11:26:23 UTC	440	IN	Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 3c 54 49 54 4c 45 3e 33 30 32 20 4d 6f 76 65 64 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 33 30 32 20 4d 6f 76 65 64 3c 2f 48 31 3e 0a 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 0a 3c 41 20 48 52 45 46 3d 22 68 74 74 70 73 3a 2f 2f 73 74 6f 72 61 67 65 2d 67 6f 6f 67 6c 65 61 70 69 73 2d 63 6f 6d 2e 63 64 6e 2e 61 6d 70 70 72 6f 6a 65 63 74 2e 6f 72 67 2f 63 2f 73 2f 73 74 6f 72 61 67 65 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 36 34 35 33 37 33 34 36 38 36 Data Ascii: <HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8"><TITLE>302 Moved</TITLE></HEAD><BODY><H1>302 Moved</H1>The document has moved<A HREF="https://storage-googleapis-com.cdn.ampproject.org/c/s/storage.googleapis.com/6453734686

Timestamp	Bytes transferred	Direction	Data
2025-04-01 11:26:23 UTC	876	OUT	GET /c/s/storage.googleapis.com/64537346863/pdpeulwim8hmijrsur818_q3ijp1j8y4ml6p47_0j2my8bsc.html?lt=t_s_jan_293241770520623800_stage&target=293241770520623800_1&utm_rid=293241770520623800_2 HTTP/1.1 Host: storage-googleapis-com.cdn.ampproject.org Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-04-01 11:26:24 UTC	626	IN	HTTP/1.1 200 OK Location: https://storage.googleapis.com/64537346863/pdpeulwim8hmijrsur818_q3ijp1j8y4ml6p47_0j2my8bsc.html?lt=t_s_jan_293241770520623800_stage&target=293241770520623800_1&utm_rid=293241770520623800_2 Cache-Control: private X-Silent-Redirect: true Warning: 199 - "Failed to validate PCU." Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-Content-Type-Options: nosniff Date: Tue, 01 Apr 2025 11:26:24 GMT Content-Type: text/html; charset=UTF-8 Server: sffe Content-Length: 638 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2025-04-01 11:26:24 UTC	594	IN	Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 3c 54 49 54 4c 45 3e 52 65 64 69 72 65 63 74 69 6e 67 3c 2f 54 49 54 4c 45 3e 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 20 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 74 6f 72 61 67 65 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 36 34 35 33 37 33 34 36 38 36 33 2f 70 64 70 65 75 6c 77 69 6d 38 68 6d 69 6a 72 73 75 72 38 31 38 5f 71 33 69 6a 70 31 6a 38 79 34 6d 6c 36 70 34 37 5f 30 6a 32 6d 79 38 62 73 63 2e 68 74 6d 6c 3f 6c 74 3d 74 5f 73 5f 6a Data Ascii: <HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8"><TITLE>Redirecting</TITLE><META HTTP-EQUIV="refresh" content="0; url=https://storage.googleapis.com/64537346863/pdpeulwim8hmijrsur818_q3ijp1j8y4ml6p47_0j2my8bsc.html?lt=t_s_j
2025-04-01 11:26:24 UTC	44	IN	Data Raw: 27 2b 64 6f 63 75 6d 65 6e 74 2e 6c 6f 63 61 74 69 6f 6e 2e 68 61 73 68 29 22 3e 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: '+document.location.hash)"></BODY></HTML>

Timestamp	Bytes transferred	Direction	Data
2025-04-01 11:26:25 UTC	775	OUT	GET /images/icons/product/cloud_storage-32.png HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 X-Client-Data: CI62yQEIpLbJAQipncoBCNrwygEIk6HLAQiKo8sBCIWgzQEI9s/OAQiB1s4BCMnczgEIhODOAQii5M4BCK/kzgEI6eTOAQ== Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Sec-Fetch-Storage-Access: active Referer: https://storage.googleapis.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-04-01 11:26:25 UTC	670	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Content-Type: image/png Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="static-on-bigtable" Report-To: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]} Content-Length: 850 Date: Tue, 01 Apr 2025 11:26:25 GMT Expires: Tue, 01 Apr 2025 11:26:25 GMT Cache-Control: private, max-age=31536000 Last-Modified: Tue, 22 Oct 2019 18:30:00 GMT X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2025-04-01 11:26:25 UTC	550	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 20 00 00 00 20 08 06 00 00 00 73 7a 7a f4 00 00 03 19 49 44 41 54 58 c3 cd 97 dd 6b d3 50 18 c6 83 37 ea ed 10 ff 84 dd 28 c8 c6 50 44 71 fd 48 ba 75 0c 3b 2f 74 75 30 61 e8 86 55 71 8c 31 d0 75 28 36 4d 5a 6d ad ab db 98 ba 2f 86 4c c1 4b 91 81 8c 81 57 fb 0f 44 f6 65 bb 8f 8b b9 2d 5d d6 36 6d d3 26 3d 9e d3 b4 83 b0 b6 49 fa 01 3b f0 a3 17 c9 fb 3c 4f 72 4e 7a de 83 61 27 7d 00 00 ce 76 4f a5 1b 1e ce 88 9a e8 9e 12 1b 50 6d 59 e6 d6 51 b1 cf 40 0b 40 4f 8b 25 22 00 eb 98 38 a0 d9 78 e0 ab 88 3d fd 2c 5e 44 02 46 57 79 20 8d 27 b3 42 5d d7 84 a8 2d 44 8b 57 f8 63 74 a5 40 25 30 7b 84 15 4d e6 1d 63 a9 bb 7a 2a 09 8c 74 65 30 40 2d eb 48 ea 9e a2 31 9f 02 99 5f 93 2b 19 c3 61 61 25 21 5c 49 1e 69 Data Ascii: PNGIHDR szzIDATXkP7(PDqHu;/tu0aUq1u(6MZm/LKWDe-]6m&=I;<OrNza'}vOPmYQ@@O%"8x=,^DFWy 'B]-DWct@%0{Mcz*te0@-H1_+aa%!\Ii
2025-04-01 11:26:25 UTC	300	IN	Data Raw: 7d 18 94 0c d9 02 c0 6b b0 18 89 e8 ec c1 32 08 00 33 cd 6c c9 cc 2d de 30 66 9b 8c 5e 36 92 6c 91 00 12 f8 51 88 d2 b8 31 18 00 f7 47 b6 af d5 f6 32 c7 37 23 8b 87 fd 41 a0 79 52 00 27 19 cd 9f 63 8e 16 47 f0 67 de 9d f0 db 52 02 6e c7 89 1a c9 24 a4 08 4e ee 43 c1 75 cd 01 7c df f7 cf cd 2c 1e 14 69 48 bc 2c ad 26 80 3c 84 3a 5a 9d 41 4f d1 6e 28 29 48 ed 52 13 c5 70 26 27 03 94 20 10 e4 1e 14 5f 03 7a 88 ae 00 e8 9a 61 68 3d 81 b4 63 7c 5a b9 29 ed 1c 65 ad e8 e9 4c 4e 75 10 e4 2e 34 59 cd 18 e5 a3 71 70 15 b4 7b 82 9d 9a 3a e3 56 17 f3 db 84 42 a8 84 70 fc 03 7a 68 94 8f a6 17 6b cb 9a cc 9f cd 85 b1 be 59 f6 02 ee d8 83 e2 ea 91 42 ac c8 68 7c be 02 1e 8f 6f 5e ea 9b d8 d6 7e 34 eb f0 87 7a 09 18 02 77 ec aa e7 d5 0e 34 5d ce a0 83 dc 71 07 fa cb 3d Data Ascii: }k23l-0f^6lQ1G27#AyR'cGgRn$NCu\|,iH,&<:ZAOn()HRp&' _zah=c\|Z)eLNu.4Yqp{:VBpzhkYBh\|o^~4zw4]q=

Timestamp	Bytes transferred	Direction	Data
2025-04-01 11:26:26 UTC	484	OUT	GET /images/icons/product/cloud_storage-32.png HTTP/1.1 Host: www.google.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: / X-Client-Data: CI62yQEIpLbJAQipncoBCNrwygEIk6HLAQiKo8sBCIWgzQE= Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-04-01 11:26:26 UTC	670	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Content-Type: image/png Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="static-on-bigtable" Report-To: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]} Content-Length: 850 Date: Tue, 01 Apr 2025 11:26:26 GMT Expires: Tue, 01 Apr 2025 11:26:26 GMT Cache-Control: private, max-age=31536000 Last-Modified: Tue, 22 Oct 2019 18:30:00 GMT X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2025-04-01 11:26:26 UTC	550	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 20 00 00 00 20 08 06 00 00 00 73 7a 7a f4 00 00 03 19 49 44 41 54 58 c3 cd 97 dd 6b d3 50 18 c6 83 37 ea ed 10 ff 84 dd 28 c8 c6 50 44 71 fd 48 ba 75 0c 3b 2f 74 75 30 61 e8 86 55 71 8c 31 d0 75 28 36 4d 5a 6d ad ab db 98 ba 2f 86 4c c1 4b 91 81 8c 81 57 fb 0f 44 f6 65 bb 8f 8b b9 2d 5d d6 36 6d d3 26 3d 9e d3 b4 83 b0 b6 49 fa 01 3b f0 a3 17 c9 fb 3c 4f 72 4e 7a de 83 61 27 7d 00 00 ce 76 4f a5 1b 1e ce 88 9a e8 9e 12 1b 50 6d 59 e6 d6 51 b1 cf 40 0b 40 4f 8b 25 22 00 eb 98 38 a0 d9 78 e0 ab 88 3d fd 2c 5e 44 02 46 57 79 20 8d 27 b3 42 5d d7 84 a8 2d 44 8b 57 f8 63 74 a5 40 25 30 7b 84 15 4d e6 1d 63 a9 bb 7a 2a 09 8c 74 65 30 40 2d eb 48 ea 9e a2 31 9f 02 99 5f 93 2b 19 c3 61 61 25 21 5c 49 1e 69 Data Ascii: PNGIHDR szzIDATXkP7(PDqHu;/tu0aUq1u(6MZm/LKWDe-]6m&=I;<OrNza'}vOPmYQ@@O%"8x=,^DFWy 'B]-DWct@%0{Mcz*te0@-H1_+aa%!\Ii
2025-04-01 11:26:26 UTC	300	IN	Data Raw: 7d 18 94 0c d9 02 c0 6b b0 18 89 e8 ec c1 32 08 00 33 cd 6c c9 cc 2d de 30 66 9b 8c 5e 36 92 6c 91 00 12 f8 51 88 d2 b8 31 18 00 f7 47 b6 af d5 f6 32 c7 37 23 8b 87 fd 41 a0 79 52 00 27 19 cd 9f 63 8e 16 47 f0 67 de 9d f0 db 52 02 6e c7 89 1a c9 24 a4 08 4e ee 43 c1 75 cd 01 7c df f7 cf cd 2c 1e 14 69 48 bc 2c ad 26 80 3c 84 3a 5a 9d 41 4f d1 6e 28 29 48 ed 52 13 c5 70 26 27 03 94 20 10 e4 1e 14 5f 03 7a 88 ae 00 e8 9a 61 68 3d 81 b4 63 7c 5a b9 29 ed 1c 65 ad e8 e9 4c 4e 75 10 e4 2e 34 59 cd 18 e5 a3 71 70 15 b4 7b 82 9d 9a 3a e3 56 17 f3 db 84 42 a8 84 70 fc 03 7a 68 94 8f a6 17 6b cb 9a cc 9f cd 85 b1 be 59 f6 02 ee d8 83 e2 ea 91 42 ac c8 68 7c be 02 1e 8f 6f 5e ea 9b d8 d6 7e 34 eb f0 87 7a 09 18 02 77 ec aa e7 d5 0e 34 5d ce a0 83 dc 71 07 fa cb 3d Data Ascii: }k23l-0f^6lQ1G27#AyR'cGgRn$NCu\|,iH,&<:ZAOn()HRp&' _zah=c\|Z)eLNu.4Yqp{:VBpzhkYBh\|o^~4zw4]q=

Timestamp	Bytes transferred	Direction	Data
2025-04-01 11:26:29 UTC	944	OUT	GET /dashboard/?app=c3RlZmZlbi5ldWxpdHpAbmlwcG9uZ2FzZXMuY29t&utm_id=aHR0cHM6Ly9jZG4uYW1wcHJvamVjdC5vcmcvYy9zL3ZyYm8uY29tL2F1dGgvdWkvbG9naW4/NTgyMzU=&ut_adi_h1j6TQ=aHR0cHM6Ly9jZG4uYW1wcHJvamVjdC5vcmcvYy9zL3ZyYm8uY29tL2F1dGgvdWkvbG9naW4/NTgyMzU= HTTP/1.1 Host: session-auth.5436245745.info Connection: keep-alive sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document Referer: https://storage.googleapis.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-04-01 11:26:29 UTC	191	IN	HTTP/1.1 200 OK Date: Tue, 01 Apr 2025 11:26:29 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 939 Connection: close Content-Type: text/html; charset=UTF-8
2025-04-01 11:26:29 UTC	939	IN	Data Raw: 0a 20 0a 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 32 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 33 34 37 34 38 38 39 2e 63 66 64 2f 3f 78 62 79 74 6e 64 67 68 22 3e 0a 20 20 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 20 20 20 20 62 6f 64 79 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 41 72 69 61 6c 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 0a 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: <!DOCTYPE html><html><head> <meta charset="UTF-8"> <meta http-equiv="refresh" content="2;url=https://3474889.cfd/?xbytndgh"> <style> body { font-family: Arial, sans-serif; text-align: center;

Timestamp	Bytes transferred	Direction	Data
2025-04-01 11:26:29 UTC	857	OUT	GET /favicon.ico HTTP/1.1 Host: session-auth.5436245745.info Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://session-auth.5436245745.info/dashboard/?app=c3RlZmZlbi5ldWxpdHpAbmlwcG9uZ2FzZXMuY29t&utm_id=aHR0cHM6Ly9jZG4uYW1wcHJvamVjdC5vcmcvYy9zL3ZyYm8uY29tL2F1dGgvdWkvbG9naW4/NTgyMzU=&ut_adi_h1j6TQ=aHR0cHM6Ly9jZG4uYW1wcHJvamVjdC5vcmcvYy9zL3ZyYm8uY29tL2F1dGgvdWkvbG9naW4/NTgyMzU= Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-04-01 11:26:29 UTC	180	IN	HTTP/1.1 404 Not Found Date: Tue, 01 Apr 2025 11:26:29 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 291 Connection: close Content-Type: text/html; charset=iso-8859-1
2025-04-01 11:26:29 UTC	291	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 35 32 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 73 65 73 73 69 6f 6e 2d 61 75 74 68 2e 35 34 33 36 32 34 35 37 34 35 2e 69 6e 66 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache/2.4.52 (Ubuntu) Server at session-auth.5436245745.inf

Timestamp	Bytes transferred	Direction	Data
2025-04-01 11:26:32 UTC	704	OUT	GET /?xbytndgh HTTP/1.1 Host: 3474889.cfd Connection: keep-alive sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document Referer: https://session-auth.5436245745.info/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-04-01 11:26:32 UTC	612	IN	HTTP/1.1 302 Found Set-Cookie: qPdM=ZRd2Aq8R9E7Y; path=/; samesite=none; secure; httponly Set-Cookie: qPdM.sig=1Gz8890DSV4sFKAGLvvfSWi3PBA; path=/; samesite=none; secure; httponly location: /__//eqpuwogtu/qcwvj2/x2.0/cwvjqtkbg?tgurqpug_varg=eqfg&ueqrg=Ugetgvu.TgcfYtkvg.EtgcvgfDaCrr.Ugewtg%20qhhnkpg_ceeguu&enkgpv_kf=229h4f61-07gd-454c-9453-f27ddc7ee95d&tgfktgev_wtk=jvvru%3C%2H%2Hnqikp.oketquqhvqpnkpg.eqo%2Heqooqp%2Hqcwvj2%2Hpcvkxgenkgpv&tgurqpug_oqfg=swgta&uvcvg=%7D%22kf%22%3C%22hkgfdhiengffndeoifkilifheiilekqp%22%7F Date: Tue, 01 Apr 2025 11:26:32 GMT Connection: close Transfer-Encoding: chunked
2025-04-01 11:26:32 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2025-04-01 11:26:32 UTC	1090	OUT	GET /__//eqpuwogtu/qcwvj2/x2.0/cwvjqtkbg?tgurqpug_varg=eqfg&ueqrg=Ugetgvu.TgcfYtkvg.EtgcvgfDaCrr.Ugewtg%20qhhnkpg_ceeguu&enkgpv_kf=229h4f61-07gd-454c-9453-f27ddc7ee95d&tgfktgev_wtk=jvvru%3C%2H%2Hnqikp.oketquqhvqpnkpg.eqo%2Heqooqp%2Hqcwvj2%2Hpcvkxgenkgpv&tgurqpug_oqfg=swgta&uvcvg=%7D%22kf%22%3C%22hkgfdhiengffndeoifkilifheiilekqp%22%7F HTTP/1.1 Host: 3474889.cfd Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://session-auth.5436245745.info/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: qPdM=ZRd2Aq8R9E7Y; qPdM.sig=1Gz8890DSV4sFKAGLvvfSWi3PBA
2025-04-01 11:26:32 UTC	2816	IN	HTTP/1.1 302 Found Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: text/html; charset=utf-8 Expires: -1 Location: https://3474889.cfd/?pzu1ue0fb=aHR0cHM6Ly9sb2dpbi5saXZlLmNvbS9vYXV0aDIwX2F1dGhvcml6ZS5zcmY/Y2xpZW50X2lkPTIyOWY0ZDYxLTA3ZWItNDU0YS05NDUzLWQyN2JiYTdjYzk1YiZzY29wZT1TZWNyZXRzLlJlYWRXcml0ZS5DcmVhdGVkQnlBcHAuU2VjdXJlK29mZmxpbmVfYWNjZXNzJnJlZGlyZWN0X3VyaT1odHRwcyUzYSUyZiUyZmxvZ2luLm1pY3Jvc29mdG9ubGluZS5jb20lMmZjb21tb24lMmZvYXV0aDIlMmZuYXRpdmVjbGllbnQmcmVzcG9uc2VfdHlwZT1jb2RlJnN0YXRlPSU3YiUyMmlkJTIyJTNhJTIyZmllZGJmZ2NsZWRkbGJjbWdkaWdqZ2RmY2dnamNpb24lMjIlN2QmcmVzcG9uc2VfbW9kZT1xdWVyeSZ1YWlkPTdjNDg2NzA3NzFlYzRhMDE5NTQ5OGZkMzY0YjQ3OWFiJm1zcHJveHk9MSZpc3N1ZXI9bXNvJnRlbmFudD1jb25zdW1lcnMmdWlfbG9jYWxlcz1lbi1VUyZlcGN0PVBBUUFCRGdFQUFBQlZyU3BldVdhbVJhbTJqQUYxWFJRRU5PcGlacHdhejlCaEVrajBaVzZnZG9aUHk1M1ljYno1RXRUUHZ5X0lJMWh6eEZ4MTI5UmhWSzVzSllHOHFHdEdCaGZuOUJ3WmRDYkpjMkJJWGZYWFl1VFBBcTQ2bGNFMmVxZW9kRTZUcW42MGhsa091NHpCa2J0c3hzeHNaTk4xU3pBenJNNUxxRHJzWURSczVLV2FPR25CdVVGWU54dDRVRmRGNWJGWWJpNzBFc0k2cWRHbU1rVjBaZXdKWjNaY2Ixc1pKMDg0ZDFFSy1CUy1YOGFsTXlBQSZqc2hzPTAj Strict-Transport-Security: max-age=31536000; includeSubDomains P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" x-ms-request-id: 77643c89-a005-4af8-8235-74d2803cb301 x-ms-ests-server: 2.1.20329.5 - FRC ProdSlices report-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://identity.nel.measure.office.net/api/report?catId=GW+estsfd+ams2"}]} nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0} x-ms-srs: 1.P Referrer-Policy: strict-origin-when-cross-origin Content-Security-Policy-Report-Only: object-src 'none'; base-uri 'self'; script-src 'self' 'nonce-DHoZC0u6AX0UhlRBmAWLiw' 'unsafe-inline' 'unsafe-eval' https://.msauth.net https://.msftauth.net https://.msftauthimages.net https://.msauthimages.net https://.msidentity.com https://.microsoftonline-p.com https://.microsoftazuread-sso.com https://.azureedge.net https://.outlook.com https://.office.com https://.office365.com https://.microsoft.com https://*.bing.com 'report-sample'; report-uri https://csp.microsoft.com/report/ESTS-UX-All Set-Cookie: fpc=AuofijWSgx5NumVd2zxYrUU; expires=Thu, 01-May-2025 11:26:32 GMT; path=/; secure; HttpOnly; SameSite=None Set-Cookie: esctx=PAQABBwEAAABVrSpeuWamRam2jAF1XRQEkjpUyoimXwOLYnVPPygXTiZZrBSMa_-VJyX3Vh9AeBiMqo0h_SnAN9Nx7lFgLFtlMJOXKqCMFsyUkN7BnG1bhHw3x4hx0bdqs_AfN-PyFrPg3X6n_0OFVIRiDkr0W02_4QbHaWFV9BqQO-zkOeY9eRNiuug9c14p9kaVw7frjUIgAA; domain=3474889.cfd; path=/; secure; HttpOnly; SameSite=None Set-Cookie: x-ms-gateway-slice=estsfd; path=/; secure; samesite=none; httponly Set-Cookie: stsservicecookie=estsfd; path=/; secure; samesite=none; httponly Date: Tue, 01 Apr 2025 11:26:32 GMT Connection: close content-length: 858
2025-04-01 11:26:32 UTC	858	IN	Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 4f 62 6a 65 63 74 20 6d 6f 76 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 32 3e 4f 62 6a 65 63 74 20 6d 6f 76 65 64 20 74 6f 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 6c 6f 67 69 6e 2e 6c 69 76 65 2e 63 6f 6d 2f 6f 61 75 74 68 32 30 5f 61 75 74 68 6f 72 69 7a 65 2e 73 72 66 3f 63 6c 69 65 6e 74 5f 69 64 3d 32 32 39 66 34 64 36 31 2d 30 37 65 62 2d 34 35 34 61 2d 39 34 35 33 2d 64 32 37 62 62 61 37 63 63 39 35 62 26 61 6d 70 3b 73 63 6f 70 65 3d 53 65 63 72 65 74 73 2e 52 65 61 64 57 72 69 74 65 2e 43 72 65 61 74 65 64 42 79 41 70 70 2e 53 65 63 75 72 65 2b 6f 66 66 6c 69 6e 65 5f 61 63 63 65 73 73 26 61 6d 70 3b 72 65 64 69 72 65 63 74 5f 75 72 69 3d Data Ascii: <html><head><title>Object moved</title></head><body><h2>Object moved to <a href="https://login.live.com/oauth20_authorize.srf?client_id=229f4d61-07eb-454a-9453-d27bba7cc95b&scope=Secrets.ReadWrite.CreatedByApp.Secure+offline_access&redirect_uri=

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors
Category:	downloaded
Size (bytes):	17174
Entropy (8bit):	2.9129715116732746
Encrypted:	false
SSDEEP:	24:QSNTmTFxg4lyyyyyyyyyyyyyio7eeeeeeeeekzgsLsLsLsLsLsQZp:nfgyyyyyyyyyyyyynzQQQQQO
MD5:	12E3DAC858061D088023B2BD48E2FA96
SHA1:	E08CE1A144ECEAE0C3C2EA7A9D6FBC5658F24CE5
SHA-256:	90CDAF487716184E4034000935C605D1633926D348116D198F355A98B8C6CD21
SHA-512:	C5030C55A855E7A9E20E22F4C70BF1E0F3C558A9B7D501CFAB6992AC2656AE5E41B050CCAC541EFA55F9603E0D349B247EB4912EE169D44044271789C719CD01
Malicious:	false
Reputation:	low
URL:	https://logincdn.msauth.net/16.000.30558.4/images/favicon.ico
Preview:	..............h(..f...HH...........(..00......h....6.. ...........=...............@..........(....A..(....................(....................................."P.........................................."""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333""""""""""""""""""""""""""

Timestamp	Bytes transferred	Direction	Data
2025-04-01 11:26:33 UTC	1991	OUT	GET /?pzu1ue0fb=aHR0cHM6Ly9sb2dpbi5saXZlLmNvbS9vYXV0aDIwX2F1dGhvcml6ZS5zcmY/Y2xpZW50X2lkPTIyOWY0ZDYxLTA3ZWItNDU0YS05NDUzLWQyN2JiYTdjYzk1YiZzY29wZT1TZWNyZXRzLlJlYWRXcml0ZS5DcmVhdGVkQnlBcHAuU2VjdXJlK29mZmxpbmVfYWNjZXNzJnJlZGlyZWN0X3VyaT1odHRwcyUzYSUyZiUyZmxvZ2luLm1pY3Jvc29mdG9ubGluZS5jb20lMmZjb21tb24lMmZvYXV0aDIlMmZuYXRpdmVjbGllbnQmcmVzcG9uc2VfdHlwZT1jb2RlJnN0YXRlPSU3YiUyMmlkJTIyJTNhJTIyZmllZGJmZ2NsZWRkbGJjbWdkaWdqZ2RmY2dnamNpb24lMjIlN2QmcmVzcG9uc2VfbW9kZT1xdWVyeSZ1YWlkPTdjNDg2NzA3NzFlYzRhMDE5NTQ5OGZkMzY0YjQ3OWFiJm1zcHJveHk9MSZpc3N1ZXI9bXNvJnRlbmFudD1jb25zdW1lcnMmdWlfbG9jYWxlcz1lbi1VUyZlcGN0PVBBUUFCRGdFQUFBQlZyU3BldVdhbVJhbTJqQUYxWFJRRU5PcGlacHdhejlCaEVrajBaVzZnZG9aUHk1M1ljYno1RXRUUHZ5X0lJMWh6eEZ4MTI5UmhWSzVzSllHOHFHdEdCaGZuOUJ3WmRDYkpjMkJJWGZYWFl1VFBBcTQ2bGNFMmVxZW9kRTZUcW42MGhsa091NHpCa2J0c3hzeHNaTk4xU3pBenJNNUxxRHJzWURSczVLV2FPR25CdVVGWU54dDRVRmRGNWJGWWJpNzBFc0k2cWRHbU1rVjBaZXdKWjNaY2Ixc1pKMDg0ZDFFSy1CUy1YOGFsTXlBQSZqc2hzPTAj HTTP/1.1 Host: 3474889.cfd Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://session-auth.5436245745.info/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: qPdM=ZRd2Aq8R9E7Y; qPdM.sig=1Gz8890DSV4sFKAGLvvfSWi3PBA; fpc=AuofijWSgx5NumVd2zxYrUU; esctx=PAQABBwEAAABVrSpeuWamRam2jAF1XRQEkjpUyoimXwOLYnVPPygXTiZZrBSMa_-VJyX3Vh9AeBiMqo0h_SnAN9Nx7lFgLFtlMJOXKqCMFsyUkN7BnG1bhHw3x4hx0bdqs_AfN-PyFrPg3X6n_0OFVIRiDkr0W02_4QbHaWFV9BqQO-zkOeY9eRNiuug9c14p9kaVw7frjUIgAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd
2025-04-01 11:26:33 UTC	3018	IN	HTTP/1.1 200 OK Referer: https://login.live.com/oauth20_authorize.srf?client_id=229f4d61-07eb-454a-9453-d27bba7cc95b&scope=Secrets.ReadWrite.CreatedByApp.Secure+offline_access&redirect_uri=https%3a%2f%2flogin.microsoftonline.com%2fcommon%2foauth2%2fnativeclient&response_type=code&state=%7b%22id%22%3a%22fiedbfgcleddlbcmgdigjgdfcggjcion%22%7d&response_mode=query&uaid=7c48670771ec4a0195498fd364b479ab&msproxy=1&issuer=mso&tenant=consumers&ui_locales=en-US&epct=PAQABDgEAAABVrSpeuWamRam2jAF1XRQENOpiZpwaz9BhEkj0ZW6gdoZPy53Ycbz5EtTPvy_II1hzxFx129RhVK5sJYG8qGtGBhfn9BwZdCbJc2BIXfXXYuTPAq46lcE2eqeodE6Tqn60hlkOu4zBkbtsxsxsZNN1SzAzrM5LqDrsYDRs5KWaOGnBuUFYNxt4UFdF5bFYbi70EsI6qdGmMkV0ZewJZ3Zcb1sZJ084d1EK-BS-X8alMyAA&jshs=0# Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: text/html; charset=utf-8 Expires: Tue, 01 Apr 2025 11:25:33 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" X-DNS-Prefetch-Control: on Link: <https://logincdn.msauth.net>; rel=preconnect; crossorigin, <https://acctcdn.msauth.net>; rel=preconnect; crossorigin, <https://acctcdn.msftauth.net>; rel=preconnect; crossorigin, <https://acctcdn.msauth.net/>; rel=dns-prefetch, <https://acctcdn.msftauth.net/>; rel=dns-prefetch, <https://acctcdnmsftuswe2.azureedge.net/>; rel=dns-prefetch, <https://logincdn.msauth.net/>; rel=dns-prefetch, <https://logincdn.msftauth.net/>; rel=dns-prefetch, <https://lgincdnmsftuswe2.azureedge.net/>; rel=dns-prefetch Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C515_SN1 x-ms-request-id: cbaaa472-0aba-4450-9692-a7dc7c3150b9 PPServer: PPV: 30 H: SN1PEPF0002F0DF V: 0 Strict-Transport-Security: max-age=31536000 Set-Cookie: MSPRequ=id=N&lt=1743506793&co=1; domain=3474889.cfd; Secure; path=/; SameSite=None; HttpOnly Set-Cookie: uaid=7c48670771ec4a0195498fd364b479ab; domain=3474889.cfd; Secure; path=/; SameSite=None; HttpOnly Set-Cookie: MSPOK=$uuid-5e85ee6d-c02f-49fb-bd00-7b43719bd627; domain=3474889.cfd; Secure; path=/; SameSite=None; HttpOnly Set-Cookie: OParams=11O.DlMeEeSvIIp4Z48xfcF!KVpmIdEXZ85qCxhtH6vm6Ak707OaMVc7mm8AazVLvCGs!lt7k7DymYaWmBs6sASCOS4JpVLqmtrpU8Z7BhfF3AMBzNKepp8QXHk8SSlGbANjAtNiXdPWufIHxncu46LS5cuJhbuezzqEn06G4m443dTAAF4iP15wqIgwZxg5pEFJTpH4qMG8xCyNz5bUChWLVgsyd1P2Y0oEXoo0yKPgWmeqd!NjOQufXmsAtKLhEz1cYDsBJ7EnrMazwkKTuOBIOmc3ZaiPxq6l6RuejerTUoTfq!X!L2uLSZVeglCIR6gFk67yL64XE8lyjJ71VhQ9Xn7cYahyyOgf5nK8gRCjA6BtYGfXYgHwAT6nI5UvnyCX37r8XpXQ9DQt78FHUEpC2uO9AOg39mi!rHyjmYfuJsTrNwWumuxrpbrESoCeGUhOTfvzVc!yG9WoFbAn3W0SRmvwnsO8D!ev1WFkaFgUrQnupe0nbMT3rfX35TeyP!KGhrUCEeb2mm9RXEP0y4v!5t6aBcsutg5ysFRcZvhzo9jy9qAkZCP6f0PfZk7k2QMuJ1iu2w51d21h45WH!YEOHAJK9u5rShoz9FGQjdkIdgnx1mlHXqjA8HpJ8Z8KwBTXnLzRajoh3gtzkLUBv7UXo5zVwzrPOsKnMOpDedLJYMjCsVqHpwtrHFQ7bWScRE1XyCtzIrs3!lqqKv8MwoyfJsLlJny66kg!57r5G9HDFMVSG93uiCsoEGCcHCqnzBUaTdUU32W8wkXmPqMSLUsygJPMUrmfP!NsTK1hNP3kuLOU!IfP07vyYDAufomQqnzE1XI4IgtZuZc$; domain=3474889.cfd; Secure; path=/; SameSite=None; HttpOnly Date: Tue, 01 Apr 2025 11:26:33 GMT Connection: close content-length: 25633
2025-04-01 11:26:33 UTC	13366	IN	Data Raw: 3c 21 2d 2d 20 43 6f 70 79 72 69 67 68 74 20 28 43 29 20 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 2e 20 41 6c 6c 20 72 69 67 68 74 73 20 72 65 73 65 72 76 65 64 2e 20 2d 2d 3e 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 21 2d 2d 20 53 65 72 76 65 72 49 6e 66 6f 3a 20 53 4e 31 50 45 50 46 30 30 30 32 46 30 44 46 20 31 36 2e 30 2e 33 30 35 35 38 2e 34 20 4c 6f 63 56 65 72 3a 30 20 2d 2d 3e 3c 21 2d 2d 20 50 72 65 70 72 6f 63 65 73 73 49 6e 66 6f 3a 20 43 42 41 2d 30 33 32 30 5f 31 35 33 35 30 37 3a 30 63 63 35 34 37 36 31 63 30 30 30 30 30 4e 2c 20 32 30 32 35 2d 30 33 2d 32 30 54 31 36 3a 30 35 3a 32 33 2e 30 31 33 39 39 33 34 2d 30 37 3a 30 30 20 2d 20 56 65 72 73 69 6f 6e 3a 20 31 36 2c 30 2c 33 30 35 35 38 2c 34 20 2d 2d 3e 3c Data Ascii: ... Copyright (C) Microsoft Corporation. All rights reserved. --><!DOCTYPE html>... ServerInfo: SN1PEPF0002F0DF 16.0.30558.4 LocVer:0 -->... PreprocessInfo: CBA-0320_153507:0cc54761c00000N, 2025-03-20T16:05:23.0139934-07:00 - Version: 16,0,30558,4 --><
2025-04-01 11:26:33 UTC	12267	IN	Data Raw: 6d 62 61 62 77 65 7e 32 36 33 27 2c 66 45 6e 61 62 6c 65 41 72 69 61 4c 69 76 65 55 70 64 61 74 65 73 3a 74 72 75 65 2c 75 72 6c 48 6f 73 74 65 64 50 72 69 76 61 63 79 4c 69 6e 6b 3a 27 68 74 74 70 73 3a 2f 2f 6c 6f 67 69 6e 63 64 6e 2e 6d 73 61 75 74 68 2e 6e 65 74 2f 31 36 2e 30 30 30 2e 33 30 35 35 38 2e 34 2f 61 67 72 65 65 6d 65 6e 74 73 2f 70 72 69 76 61 63 79 2f 65 6e 2d 75 73 2f 70 72 69 76 61 63 79 2e 74 78 74 3f 78 3d 31 36 2e 30 30 30 2e 33 30 35 35 38 2e 34 27 2c 73 48 6f 73 74 42 75 69 6c 64 4e 75 6d 62 65 72 3a 27 31 36 2e 30 2e 33 30 35 35 38 2e 34 27 2c 66 49 73 48 6f 73 74 65 64 3a 74 72 75 65 2c 61 72 72 46 65 64 4e 61 6d 65 73 3a 5b 5d 2c 66 41 6c 6c 6f 77 53 6b 79 70 65 4e 61 6d 65 4c 6f 67 69 6e 3a 74 72 75 65 2c 75 72 6c 46 6f 72 67 Data Ascii: mbabwe~263',fEnableAriaLiveUpdates:true,urlHostedPrivacyLink:'https://logincdn.msauth.net/16.000.30558.4/agreements/privacy/en-us/privacy.txt?x=16.000.30558.4',sHostBuildNumber:'16.0.30558.4',fIsHosted:true,arrFedNames:[],fAllowSkypeNameLogin:true,urlForg

Timestamp	Bytes transferred	Direction	Data
2025-04-01 11:26:37 UTC	3061	OUT	POST /GetExperimentAssignments.srf HTTP/1.1 Host: 3474889.cfd Connection: keep-alive Content-Length: 870 correlationId: 7c48670771ec4a0195498fd364b479ab sec-ch-ua-platform: "Windows" hpgid: 37 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" hpgact: 0 sec-ch-ua-mobile: ?0 client-request-id: 7c48670771ec4a0195498fd364b479ab User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: application/json Content-Type: application/json; charset=utf-8 Origin: https://3474889.cfd Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://3474889.cfd/?pzu1ue0fb=aHR0cHM6Ly9sb2dpbi5saXZlLmNvbS9vYXV0aDIwX2F1dGhvcml6ZS5zcmY/Y2xpZW50X2lkPTIyOWY0ZDYxLTA3ZWItNDU0YS05NDUzLWQyN2JiYTdjYzk1YiZzY29wZT1TZWNyZXRzLlJlYWRXcml0ZS5DcmVhdGVkQnlBcHAuU2VjdXJlK29mZmxpbmVfYWNjZXNzJnJlZGlyZWN0X3VyaT1odHRwcyUzYSUyZiUyZmxvZ2luLm1pY3Jvc29mdG9ubGluZS5jb20lMmZjb21tb24lMmZvYXV0aDIlMmZuYXRpdmVjbGllbnQmcmVzcG9uc2VfdHlwZT1jb2RlJnN0YXRlPSU3YiUyMmlkJTIyJTNhJTIyZmllZGJmZ2NsZWRkbGJjbWdkaWdqZ2RmY2dnamNpb24lMjIlN2QmcmVzcG9uc2VfbW9kZT1xdWVyeSZ1YWlkPTdjNDg2NzA3NzFlYzRhMDE5NTQ5OGZkMzY0YjQ3OWFiJm1zcHJveHk9MSZpc3N1ZXI9bXNvJnRlbmFudD1jb25zdW1lcnMmdWlfbG9jYWxlcz1lbi1VUyZlcGN0PVBBUUFCRGdFQUFBQlZyU3BldVdhbVJhbTJqQUYxWFJRRU5PcGlacHdhejlCaEVrajBaVzZnZG9aUHk1M1ljYno1RXRUUHZ5X0lJMWh6eEZ4MTI5UmhWSzVzSllHOHFHdEdCaGZuOUJ3WmRDYkpjMkJJWGZYWFl1VFBBcTQ2bGNFMmVxZW9kRTZUcW42MGhsa091NHpCa2J0c3hzeHNaTk4xU3pBenJNNUxxRHJzWURSczVLV2FPR25CdVVGWU54dDRVRmRGNWJGWWJpNzBFc0k2cWRHbU1rVjBaZXdKWjNaY2Ixc1pKMDg0ZDFFSy1CUy1YOGFsTXlBQSZqc2hzPTAj Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: qPdM=ZRd2Aq8R9E7Y; qPdM.sig=1Gz8890DSV4sFKAGLvvfSWi3PBA; fpc=AuofijWSgx5NumVd2zxYrUU; esctx=PAQABBwEAAABVrSpeuWamRam2jAF1XRQEkjpUyoimXwOLYnVPPygXTiZZrBSMa_-VJyX3Vh9AeBiMqo0h_SnAN9Nx7lFgLFtlMJOXKqCMFsyUkN7BnG1bhHw3x4hx0bdqs_AfN-PyFrPg3X6n_0OFVIRiDkr0W02_4QbHaWFV9BqQO-zkOeY9eRNiuug9c14p9kaVw7frjUIgAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; MSPRequ=id=N&lt=1743506793&co=1; uaid=7c48670771ec4a0195498fd364b479ab; MSPOK=$uuid-5e85ee6d-c02f-49fb-bd00-7b43719bd627; OParams=11O.DlMeEeSvIIp4Z48xfcF!KVpmIdEXZ85qCxhtH6vm6Ak707OaMVc7mm8AazVLvCGs!lt7k7DymYaWmBs6sASCOS4JpVLqmtrpU8Z7BhfF3AMBzNKepp8QXHk8SSlGbANjAtNiXdPWufIHxncu46LS5cuJhbuezzqEn06G4m443dTAAF4iP15wqIgwZxg5pEFJTpH4qMG8xCyNz5bUChWLVgsyd1P2Y0oEXoo0yKPgWmeqd!NjOQufXmsAtKLhEz1cYDsBJ7EnrMazwkKTuOBIOmc3ZaiPxq6l6RuejerTUoTfq!X!L2uLSZVeglCIR6gFk67yL64XE8lyjJ71VhQ9Xn7cYahyyOgf5nK8gRCjA6BtYGfXYgHwAT6nI5UvnyCX37r*8XpXQ9DQt78FHUEpC2uO9AOg39mi!rHyjmYfuJsTrNwWumuxrpbrESoCeGUhOTfvzVc!yG9WoFbAn3W0SRmvwnsO8D!ev1WFkaFgUrQnupe0nbMT3rfX35TeyP!KGhrUCEe [TRUNCATED]
2025-04-01 11:26:37 UTC	870	OUT	Data Raw: 7b 22 63 6c 69 65 6e 74 45 78 70 65 72 69 6d 65 6e 74 73 22 3a 5b 7b 22 70 61 72 61 6c 6c 61 78 22 3a 22 65 6e 61 62 6c 65 69 64 65 6e 74 69 74 79 62 61 6e 6e 65 72 72 65 73 70 6f 6e 73 69 76 65 65 78 70 65 72 69 6d 65 6e 74 22 2c 22 63 6f 6e 74 72 6f 6c 22 3a 22 65 6e 61 62 6c 65 69 64 65 6e 74 69 74 79 62 61 6e 6e 65 72 72 65 73 70 6f 6e 73 69 76 65 65 78 70 65 72 69 6d 65 6e 74 5f 63 6f 6e 74 72 6f 6c 22 2c 22 74 72 65 61 74 6d 65 6e 74 73 22 3a 5b 22 65 6e 61 62 6c 65 69 64 65 6e 74 69 74 79 62 61 6e 6e 65 72 72 65 73 70 6f 6e 73 69 76 65 65 78 70 65 72 69 6d 65 6e 74 5f 74 72 65 61 74 6d 65 6e 74 22 5d 7d 2c 7b 22 70 61 72 61 6c 6c 61 78 22 3a 22 62 75 6d 70 6c 6f 74 74 69 65 76 65 72 73 69 6f 6e 66 72 6f 6d 63 6c 69 65 6e 74 22 2c 22 63 6f 6e 74 72 Data Ascii: {"clientExperiments":[{"parallax":"enableidentitybannerresponsiveexperiment","control":"enableidentitybannerresponsiveexperiment_control","treatments":["enableidentitybannerresponsiveexperiment_treatment"]},{"parallax":"bumplottieversionfromclient","contr
2025-04-01 11:26:37 UTC	482	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/json Expires: Tue, 01 Apr 2025 11:25:37 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C511_SN1 x-ms-request-id: b5b87e8d-db1f-4109-a0ac-0db62fd09123 PPServer: PPV: 30 H: SN1PEPF0002F09F V: 0 Strict-Transport-Security: max-age=31536000 Date: Tue, 01 Apr 2025 11:26:36 GMT Connection: close content-length: 214
2025-04-01 11:26:37 UTC	214	IN	Data Raw: 7b 22 46 6c 69 67 68 74 41 73 73 69 67 6e 6d 65 6e 74 73 22 3a 5b 20 22 65 6e 61 62 6c 65 69 64 65 6e 74 69 74 79 62 61 6e 6e 65 72 72 65 73 70 6f 6e 73 69 76 65 65 78 70 65 72 69 6d 65 6e 74 5f 74 72 65 61 74 6d 65 6e 74 22 2c 20 22 62 75 6d 70 6c 6f 74 74 69 65 76 65 72 73 69 6f 6e 66 72 6f 6d 63 6c 69 65 6e 74 5f 74 72 65 61 74 6d 65 6e 74 22 2c 20 22 61 64 64 70 72 69 76 61 74 65 62 72 6f 77 73 69 6e 67 74 65 78 74 74 6f 66 61 62 72 69 63 66 6f 6f 74 65 72 5f 74 72 65 61 74 6d 65 6e 74 22 2c 20 22 75 70 64 61 74 65 75 73 65 66 6f 72 6d 73 75 62 6d 69 73 73 69 6f 6e 66 6f 63 75 73 6c 6f 67 69 63 5f 63 6f 6e 74 72 6f 6c 22 20 5d 7d Data Ascii: {"FlightAssignments":[ "enableidentitybannerresponsiveexperiment_treatment", "bumplottieversionfromclient_treatment", "addprivatebrowsingtexttofabricfooter_treatment", "updateuseformsubmissionfocuslogic_control" ]}

Timestamp	Bytes transferred	Direction	Data
2025-04-01 11:26:38 UTC	813	OUT	GET /?session_id=7c48670771ec4a0195498fd364b479ab&CustomerId=33e01921-4d64-4f8c-a055-5bdaffd5e33d&PageId=SI HTTP/1.1 Host: fpt.live.com Connection: keep-alive sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Sec-Fetch-Storage-Access: active Referer: https://3474889.cfd/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-04-01 11:26:38 UTC	751	IN	HTTP/1.1 200 OK Transfer-Encoding: chunked Content-Type: text/html Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Set-Cookie: fptctx2=taBcrIH61PuCVH7eNCyH0Iitb%252bEMfwlgK%252fM8w%252f28EbfGPmY0ttgyKs3tFFnStJsqv5iEblhq%252fLd6XCbqsWQhiKGNMcErI6Acq9cr%252fiys%252bd8MtjSTt0EPDWrfHf3PokvIY4Xr3%252ftK422Xpa%252b3TlLIl7TBMhPd28q0e5CnuFW1zj2vxGoHkgasOtUi0pCDG5dPzL7New5OItMzdCjH43RaUfdO%252fMGE0ZaxDAaOrjRQlFiVXfTY%252bQlKZRvl3EtBSGgfrxM2YG%252bu%252fAMXV9ezwHIiGl%252fIKG71V%252fwoiqKSnnYhRyg%253d; domain=.live.com; path=/; secure; httponly Set-Cookie: MUID=f9efcf86c2b343cc92e4ad9d576a3cf6; expires=Wed, 01 Apr 2026 11:26:38 GMT; domain=.live.com; path=/; secure; httponly Date: Tue, 01 Apr 2025 11:26:38 GMT Connection: close
2025-04-01 11:26:38 UTC	4104	IN	Data Raw: 31 30 30 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 20 20 20 20 3c 74 69 74 6c 65 3e 3c 2f 74 69 74 6c 65 3e 0d 0a 20 20 20 20 3c 73 63 72 69 70 74 3e 76 61 72 20 6c 6f 63 61 6c 54 61 72 67 65 74 3d 27 68 74 74 70 73 3a 2f 2f 66 70 74 2e 6c 69 76 65 2e 63 6f 6d 2f 27 2c 74 61 72 67 65 74 3d 27 68 74 74 70 73 3a 2f 2f 64 66 2e 63 66 70 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 43 6c 65 61 72 2e 48 54 4d 4c 3f 63 74 78 3d 4c 73 31 2e 30 26 77 6c 3d 46 61 6c 73 65 26 27 2c 74 78 6e 49 64 3d 27 37 63 34 38 36 37 30 37 37 31 65 63 34 61 30 31 39 35 34 39 38 66 64 33 36 34 62 34 37 39 Data Ascii: 1000<!DOCTYPE html><html xmlns="http://www.w3.org/1999/xhtml"><head> <title></title> <script>var localTarget='https://fpt.live.com/',target='https://df.cfp.microsoft.com/Clear.HTML?ctx=Ls1.0&wl=False&',txnId='7c48670771ec4a0195498fd364b479
2025-04-01 11:26:38 UTC	4104	IN	Data Raw: 31 30 30 30 0d 0a 42 6f 6c 64 3b 43 65 6e 74 75 72 79 20 53 63 68 6f 6f 6c 62 6f 6f 6b 3b 47 6c 6f 75 63 65 73 74 65 72 20 4d 54 20 45 78 74 72 61 20 43 6f 6e 64 65 6e 73 65 64 3b 50 65 72 70 65 74 75 61 3b 46 72 61 6e 6b 6c 69 6e 20 47 6f 74 68 69 63 20 42 6f 6f 6b 3b 42 72 75 73 68 20 53 63 72 69 70 74 20 4d 54 3b 4d 69 63 72 6f 73 6f 66 74 20 54 61 69 20 4c 65 3b 47 69 6c 6c 20 53 61 6e 73 20 4d 54 3b 54 77 20 43 65 6e 20 4d 54 3b 4c 75 63 69 64 61 20 48 61 6e 64 77 72 69 74 69 6e 67 3b 4c 75 63 69 64 61 20 53 61 6e 73 3b 53 65 67 6f 65 20 55 49 3b 4c 75 63 69 64 61 20 46 61 78 3b 4d 56 20 42 6f 6c 69 3b 53 79 6c 66 61 65 6e 3b 45 73 74 72 61 6e 67 65 6c 6f 20 45 64 65 73 73 61 3b 4d 61 6e 67 61 6c 3b 47 61 75 74 61 6d 69 3b 54 75 6e 67 61 3b 53 68 72 Data Ascii: 1000Bold;Century Schoolbook;Gloucester MT Extra Condensed;Perpetua;Franklin Gothic Book;Brush Script MT;Microsoft Tai Le;Gill Sans MT;Tw Cen MT;Lucida Handwriting;Lucida Sans;Segoe UI;Lucida Fax;MV Boli;Sylfaen;Estrangelo Edessa;Mangal;Gautami;Tunga;Shr
2025-04-01 11:26:38 UTC	4104	IN	Data Raw: 31 30 30 30 0d 0a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 21 30 7d 3b 72 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 22 73 72 63 22 2c 6e 29 3b 66 3d 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 64 69 76 22 29 3b 66 2e 69 64 3d 22 44 65 6c 61 79 65 64 53 65 6e 64 44 69 76 22 2b 69 3b 64 6f 63 75 6d 65 6e 74 2e 62 6f 64 79 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 66 29 3b 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 66 2e 69 64 29 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 72 29 7d 7d 66 75 6e 63 74 69 6f 6e 20 67 28 29 7b 76 61 72 20 6e 3d 7b 7d 3b 74 68 69 73 2e 62 72 6f 77 73 65 72 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 6e 3d 22 22 2c 74 2c 69 3b 74 72 79 7b 74 79 70 65 6f 66 20 6e 61 76 Data Ascii: 1000function(){return!0};r.setAttribute("src",n);f=document.createElement("div");f.id="DelayedSendDiv"+i;document.body.appendChild(f);document.getElementById(f.id).appendChild(r)}}function g(){var n={};this.browser=function(){var n="",t,i;try{typeof nav
2025-04-01 11:26:38 UTC	4104	IN	Data Raw: 31 30 30 30 0d 0a 74 69 6f 6e 28 74 2c 69 29 7b 74 72 79 7b 22 6a 73 2d 65 72 72 6f 72 73 22 69 6e 20 6e 7c 7c 28 6e 5b 22 6a 73 2d 65 72 72 6f 72 73 22 5d 3d 5b 5d 29 3b 6e 5b 22 6a 73 2d 65 72 72 6f 72 73 22 5d 2e 70 75 73 68 28 74 2b 22 3a 22 2b 69 2e 74 6f 53 74 72 69 6e 67 28 29 29 7d 63 61 74 63 68 28 72 29 7b 7d 7d 3b 74 68 69 73 2e 70 69 6c 6f 74 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 66 2c 6e 2c 74 2c 72 2c 65 3b 69 66 28 76 28 29 26 26 55 43 48 26 26 6f 2e 70 75 73 68 28 74 74 28 29 29 2c 69 70 76 36 55 72 6c 29 7b 66 3d 68 28 29 3b 74 72 79 7b 66 2e 6f 70 65 6e 28 22 47 45 54 22 2c 69 70 76 36 55 72 6c 2c 21 30 29 3b 66 2e 73 65 6e 64 28 29 7d 63 61 74 63 68 28 73 29 7b 7d 7d 6e 3d 74 68 69 73 2e 62 72 6f 77 73 65 72 28 29 3b 6e 2b 3d Data Ascii: 1000tion(t,i){try{"js-errors"in n\|\|(n["js-errors"]=[]);n["js-errors"].push(t+":"+i.toString())}catch(r){}};this.pilot=function(){var f,n,t,r,e;if(v()&&UCH&&o.push(tt()),ipv6Url){f=h();try{f.open("GET",ipv6Url,!0);f.send()}catch(s){}}n=this.browser();n+=
2025-04-01 11:26:39 UTC	4104	IN	Data Raw: 31 30 30 30 0d 0a 6c 73 65 22 2c 75 3d 6e 28 5b 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 64 69 72 65 63 74 6f 72 22 5d 29 2c 69 3d 75 5b 30 5d 2c 66 3d 75 5b 31 5d 2c 72 3b 72 65 74 75 72 6e 20 69 21 3d 22 66 61 6c 73 65 22 26 26 69 21 3d 22 74 72 75 65 22 26 26 2f 53 68 6f 63 6b 77 61 76 65 20 66 6f 72 20 44 69 72 65 63 74 6f 72 2f 69 2e 74 65 73 74 28 69 29 26 26 28 74 3d 22 74 72 75 65 22 29 2c 74 3d 3d 22 74 72 75 65 22 26 26 66 26 26 28 72 3d 2f 5b 5c 64 5d 5b 5c 64 5c 2e 5c 5f 2c 2d 5d 2a 2f 2e 65 78 65 63 28 66 29 2c 72 26 26 28 74 3d 72 5b 30 5d 29 29 2c 74 7d 66 75 6e 63 74 69 6f 6e 20 73 74 28 29 7b 76 61 72 20 74 3d 22 66 61 6c 73 65 22 2c 75 3d 6e 28 5b 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 76 6e 64 2e 72 6e 2d 72 65 61 6c 70 6c 61 79 65 Data Ascii: 1000lse",u=n(["application/x-director"]),i=u[0],f=u[1],r;return i!="false"&&i!="true"&&/Shockwave for Director/i.test(i)&&(t="true"),t=="true"&&f&&(r=/[\d][\d\.\_,-]*/.exec(f),r&&(t=r[0])),t}function st(){var t="false",u=n(["application/vnd.rn-realplaye
2025-04-01 11:26:39 UTC	3179	IN	Data Raw: 43 36 34 0d 0a 63 2c 6f 2c 73 2c 6e 5b 6c 2b 31 35 5d 2c 31 34 2c 2d 36 36 30 34 37 38 33 33 35 29 2c 73 3d 69 28 73 2c 68 2c 63 2c 6f 2c 6e 5b 6c 2b 34 5d 2c 32 30 2c 2d 34 30 35 35 33 37 38 34 38 29 2c 6f 3d 69 28 6f 2c 73 2c 68 2c 63 2c 6e 5b 6c 2b 39 5d 2c 35 2c 35 36 38 34 34 36 34 33 38 29 2c 63 3d 69 28 63 2c 6f 2c 73 2c 68 2c 6e 5b 6c 2b 31 34 5d 2c 39 2c 2d 31 30 31 39 38 30 33 36 39 30 29 2c 68 3d 69 28 68 2c 63 2c 6f 2c 73 2c 6e 5b 6c 2b 33 5d 2c 31 34 2c 2d 31 38 37 33 36 33 39 36 31 29 2c 73 3d 69 28 73 2c 68 2c 63 2c 6f 2c 6e 5b 6c 2b 38 5d 2c 32 30 2c 31 31 36 33 35 33 31 35 30 31 29 2c 6f 3d 69 28 6f 2c 73 2c 68 2c 63 2c 6e 5b 6c 2b 31 33 5d 2c 35 2c 2d 31 34 34 34 36 38 31 34 36 37 29 2c 63 3d 69 28 63 2c 6f 2c 73 2c 68 2c 6e 5b 6c 2b 32 Data Ascii: C64c,o,s,n[l+15],14,-660478335),s=i(s,h,c,o,n[l+4],20,-405537848),o=i(o,s,h,c,n[l+9],5,568446438),c=i(c,o,s,h,n[l+14],9,-1019803690),h=i(h,c,o,s,n[l+3],14,-187363961),s=i(s,h,c,o,n[l+8],20,1163531501),o=i(o,s,h,c,n[l+13],5,-1444681467),c=i(c,o,s,h,n[l+2
2025-04-01 11:26:39 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2025-04-01 11:26:38 UTC	1896	OUT	GET /GetExperimentAssignments.srf HTTP/1.1 Host: 3474889.cfd Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: qPdM=ZRd2Aq8R9E7Y; qPdM.sig=1Gz8890DSV4sFKAGLvvfSWi3PBA; fpc=AuofijWSgx5NumVd2zxYrUU; esctx=PAQABBwEAAABVrSpeuWamRam2jAF1XRQEkjpUyoimXwOLYnVPPygXTiZZrBSMa_-VJyX3Vh9AeBiMqo0h_SnAN9Nx7lFgLFtlMJOXKqCMFsyUkN7BnG1bhHw3x4hx0bdqs_AfN-PyFrPg3X6n_0OFVIRiDkr0W02_4QbHaWFV9BqQO-zkOeY9eRNiuug9c14p9kaVw7frjUIgAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; MSPRequ=id=N&lt=1743506793&co=1; uaid=7c48670771ec4a0195498fd364b479ab; MSPOK=$uuid-5e85ee6d-c02f-49fb-bd00-7b43719bd627; OParams=11O.DlMeEeSvIIp4Z48xfcF!KVpmIdEXZ85qCxhtH6vm6Ak707OaMVc7mm8AazVLvCGs!lt7k7DymYaWmBs6sASCOS4JpVLqmtrpU8Z7BhfF3AMBzNKepp8QXHk8SSlGbANjAtNiXdPWufIHxncu46LS5cuJhbuezzqEn06G4m443dTAAF4iP15wqIgwZxg5pEFJTpH4qMG8xCyNz5bUChWLVgsyd1P2Y0oEXoo0yKPgWmeqd!NjOQufXmsAtKLhEz1cYDsBJ7EnrMazwkKTuOBIOmc3ZaiPxq6l6RuejerTUoTfq!X!L2uLSZVeglCIR6gFk67yL64XE8lyjJ71VhQ9Xn7cYahyyOgf5nK8gRCjA6BtYGfXYgHwAT6nI5UvnyCX37r*8XpXQ9DQt78FHUEpC2uO9AOg39mi!rHyjmYfuJsTrNwWumuxrpbrESoCeGUhOTfvzVc!yG9WoFbAn3W0SRmvwnsO8D!ev1WFkaFgUrQnupe0nbMT3rfX35TeyP!KGhrUCEe [TRUNCATED]
2025-04-01 11:26:39 UTC	581	IN	HTTP/1.1 400 Bad Request Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/json Expires: Tue, 01 Apr 2025 11:25:39 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" X-WLID-Error: 0x80043449 Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C502_BL2 x-ms-request-id: 4432adc2-2077-4781-a1fd-1609ff793bb8 PPServer: PPV: 30 H: BL02EPF0001D6EC V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Tue, 01 Apr 2025 11:26:38 GMT Connection: close Content-Length: 0

Timestamp	Bytes transferred	Direction	Data
2025-04-01 11:26:41 UTC	2654	OUT	GET /Images/Clear.PNG?ctx=jscb1.0&session_id=7c48670771ec4a0195498fd364b479ab&CustomerId=33e01921-4d64-4f8c-a055-5bdaffd5e33d&esi=YnVhPU1vemlsbGEvNS4wIChXaW5kb3dzIE5UIDEwLjA7IFdpbjY0OyB4NjQpIEFwcGxlV2ViS2l0LzUzNy4zNiAoS0hUTUwsIGxpa2UgR2Vja28pIENocm9tZS8xMzQuMC4wLjAgU2FmYXJpLzUzNy4zNiZvcz1XaW4zMiZscHJvYz00Jm9sPXRydWUmcnR0PTI1MCZjaHJtPXRydWUmcHJvc3ViPTIwMDMwMTA3JmV2YWw9MzMmYXBwdj01LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7IHg2NCkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzEzNC4wLjAuMCBTYWZhcmkvNTM3LjM2JmxzPXRydWUmZG09OCZtdHA9MCZuYz04MiZwcj0xJnNyPTEyODB4MTAyNCZzY2Q9MjQmYXNyPTEyODB4OTg0JnR6PS0zMDAmZHN0PTYwJnR6bz0tMjQwJmJsPWVuLVVTJm10aD0yN2Y1MWQzMTQ5ZTZiZjIwOWI2NmJkMzg3YjBhZjNjNCZtdG49MiZwbj01JnBoPWYzYWMyMmFjNTljNmRjYjg3NDEwOWQwOTNjNTI1NWU4JnA9cGx1Z2luX2ZsYXNoJTNEZmFsc2UlMjZwbHVnaW5fd2luZG93c19tZWRpYV9wbGF5ZXIlM0RmYWxzZSUyNnBsdWdpbl9hZG9iZV9hY3JvYmF0JTNEZmFsc2UlMjZwbHVnaW5fc2lsdmVybGlnaHQlM0RmYWxzZSUyNnBsdWdpbl9xdWlja3RpbWUlM0RmYWxzZSUyNnBsdWdpbl9zaG9ja3dhdmUlM0RmYWxzZSUyNnBsdWdpbl9yZWFscGxheWVyJTNEZm [TRUNCATED] Host: fpt.live.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active Referer: https://fpt.live.com/?session_id=7c48670771ec4a0195498fd364b479ab&CustomerId=33e01921-4d64-4f8c-a055-5bdaffd5e33d&PageId=SI Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-04-01 11:26:42 UTC	723	IN	HTTP/1.1 200 OK Transfer-Encoding: chunked Content-Type: text/html Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Set-Cookie: fptctx2=J2lVSzXLZLjGnFoFngsBvEJ0tT0UwoZY70CyB4R0UxQSz%252fd7UDvdLDnvFOj6CgWvLXl0HNMNAvo1yZzQOiZkEsg2fCEx81B9Wd5k68vs9%252fWUxDUu5HGC9isJ%252bYJdBhV0RZ8WS%252f1d71csXM1vSEwV64FAYEMiE1fmRq0a7oUwIodYirXguk%252fX3QKXoD34WHILXMfuEGUCZcfsN1zkv6frNba1ObO2%252bsjbvBuwqSBTwz3zgEhJWarDYQScEVrHxRZKPMH9OQ3fXcxEP89vNNoL6qFOUeA7hWArtHKeg%252b4hGgc%253d; domain=.live.com; path=/; secure; httponly Set-Cookie: MUID=f978cb99bf09d437bcb72bbf4e5d1c3f; expires=Wed, 01 Apr 2026 11:26:42 GMT; domain=.live.com; path=/; secure; httponly Date: Tue, 01 Apr 2025 11:26:41 GMT Connection: close
2025-04-01 11:26:42 UTC	11	IN	Data Raw: 36 0d 0a 64 66 70 3a 4f 4b 0d 0a Data Ascii: 6dfp:OK
2025-04-01 11:26:42 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2025-04-01 11:26:58 UTC	3442	OUT	POST /GetCredentialType.srf?opid=B9D4FAAB0E60CB96&id=294521&client_id=000000004C372D0D&client_id=229f4d61-07eb-454a-9453-d27bba7cc95b&mkt=EN-US&lc=1033&uaid=7c48670771ec4a0195498fd364b479ab HTTP/1.1 Host: 3474889.cfd Connection: keep-alive Content-Length: 697 correlationId: 7c48670771ec4a0195498fd364b479ab sec-ch-ua-platform: "Windows" hpgid: 37 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" hpgact: 0 sec-ch-ua-mobile: ?0 client-request-id: 7c48670771ec4a0195498fd364b479ab User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: application/json Content-Type: application/json; charset=utf-8 Origin: https://3474889.cfd Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://3474889.cfd/?pzu1ue0fb=aHR0cHM6Ly9sb2dpbi5saXZlLmNvbS9vYXV0aDIwX2F1dGhvcml6ZS5zcmY/Y2xpZW50X2lkPTIyOWY0ZDYxLTA3ZWItNDU0YS05NDUzLWQyN2JiYTdjYzk1YiZzY29wZT1TZWNyZXRzLlJlYWRXcml0ZS5DcmVhdGVkQnlBcHAuU2VjdXJlK29mZmxpbmVfYWNjZXNzJnJlZGlyZWN0X3VyaT1odHRwcyUzYSUyZiUyZmxvZ2luLm1pY3Jvc29mdG9ubGluZS5jb20lMmZjb21tb24lMmZvYXV0aDIlMmZuYXRpdmVjbGllbnQmcmVzcG9uc2VfdHlwZT1jb2RlJnN0YXRlPSU3YiUyMmlkJTIyJTNhJTIyZmllZGJmZ2NsZWRkbGJjbWdkaWdqZ2RmY2dnamNpb24lMjIlN2QmcmVzcG9uc2VfbW9kZT1xdWVyeSZ1YWlkPTdjNDg2NzA3NzFlYzRhMDE5NTQ5OGZkMzY0YjQ3OWFiJm1zcHJveHk9MSZpc3N1ZXI9bXNvJnRlbmFudD1jb25zdW1lcnMmdWlfbG9jYWxlcz1lbi1VUyZlcGN0PVBBUUFCRGdFQUFBQlZyU3BldVdhbVJhbTJqQUYxWFJRRU5PcGlacHdhejlCaEVrajBaVzZnZG9aUHk1M1ljYno1RXRUUHZ5X0lJMWh6eEZ4MTI5UmhWSzVzSllHOHFHdEdCaGZuOUJ3WmRDYkpjMkJJWGZYWFl1VFBBcTQ2bGNFMmVxZW9kRTZUcW42MGhsa091NHpCa2J0c3hzeHNaTk4xU3pBenJNNUxxRHJzWURSczVLV2FPR25CdVVGWU54dDRVRmRGNWJGWWJpNzBFc0k2cWRHbU1rVjBaZXdKWjNaY2Ixc1pKMDg0ZDFFSy1CUy1YOGFsTXlBQSZqc2hzPTAj Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: qPdM=ZRd2Aq8R9E7Y; qPdM.sig=1Gz8890DSV4sFKAGLvvfSWi3PBA; fpc=AuofijWSgx5NumVd2zxYrUU; esctx=PAQABBwEAAABVrSpeuWamRam2jAF1XRQEkjpUyoimXwOLYnVPPygXTiZZrBSMa_-VJyX3Vh9AeBiMqo0h_SnAN9Nx7lFgLFtlMJOXKqCMFsyUkN7BnG1bhHw3x4hx0bdqs_AfN-PyFrPg3X6n_0OFVIRiDkr0W02_4QbHaWFV9BqQO-zkOeY9eRNiuug9c14p9kaVw7frjUIgAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; MSPRequ=id=N&lt=1743506793&co=1; uaid=7c48670771ec4a0195498fd364b479ab; MSPOK=$uuid-5e85ee6d-c02f-49fb-bd00-7b43719bd627; OParams=11O.DlMeEeSvIIp4Z48xfcF!KVpmIdEXZ85qCxhtH6vm6Ak707OaMVc7mm8AazVLvCGs!lt7k7DymYaWmBs6sASCOS4JpVLqmtrpU8Z7BhfF3AMBzNKepp8QXHk8SSlGbANjAtNiXdPWufIHxncu46LS5cuJhbuezzqEn06G4m443dTAAF4iP15wqIgwZxg5pEFJTpH4qMG8xCyNz5bUChWLVgsyd1P2Y0oEXoo0yKPgWmeqd!NjOQufXmsAtKLhEz1cYDsBJ7EnrMazwkKTuOBIOmc3ZaiPxq6l6RuejerTUoTfq!X!L2uLSZVeglCIR6gFk67yL64XE8lyjJ71VhQ9Xn7cYahyyOgf5nK8gRCjA6BtYGfXYgHwAT6nI5UvnyCX37r*8XpXQ9DQt78FHUEpC2uO9AOg39mi!rHyjmYfuJsTrNwWumuxrpbrESoCeGUhOTfvzVc!yG9WoFbAn3W0SRmvwnsO8D!ev1WFkaFgUrQnupe0nbMT3rfX35TeyP!KGhrUCEe [TRUNCATED]
2025-04-01 11:26:58 UTC	697	OUT	Data Raw: 7b 22 63 68 65 63 6b 50 68 6f 6e 65 73 22 3a 66 61 6c 73 65 2c 22 63 6f 75 6e 74 72 79 22 3a 22 22 2c 22 66 65 64 65 72 61 74 69 6f 6e 46 6c 61 67 73 22 3a 31 31 2c 22 66 6c 6f 77 54 6f 6b 65 6e 22 3a 22 2d 44 72 54 76 75 4c 51 4b 43 36 54 65 47 6d 76 47 35 56 69 77 34 48 4e 74 37 68 44 74 32 4e 44 72 21 4e 42 4f 61 6d 21 4c 6f 51 63 48 61 52 7a 75 4b 4b 66 48 4d 34 70 4d 50 55 6f 31 43 64 6c 57 45 4a 55 63 79 77 67 70 4c 43 6c 57 45 67 57 45 70 49 78 6e 4f 38 32 62 5a 75 5a 5a 54 79 44 32 72 62 69 6e 58 67 4e 38 4b 61 64 42 53 7a 35 38 73 4b 6b 76 66 45 55 21 63 62 42 4f 68 36 56 66 5a 36 36 69 4c 62 44 5a 66 31 36 76 6e 74 79 48 33 7a 34 52 2a 62 67 65 62 79 39 6f 6e 2a 48 39 50 41 52 2a 42 41 69 4e 64 21 42 75 41 4d 6e 6b 35 36 66 78 62 72 6c 41 64 39 Data Ascii: {"checkPhones":false,"country":"","federationFlags":11,"flowToken":"-DrTvuLQKC6TeGmvG5Viw4HNt7hDt2NDr!NBOam!LoQcHaRzuKKfHM4pMPUo1CdlWEJUcywgpLClWEgWEpIxnO82bZuZZTyD2rbinXgN8KadBSz58sKkvfEU!cbBOh6VfZ66iLbDZf16vntyH3z4Rbgeby9onH9PAR*BAiNd!BuAMnk56fxbrlAd9
2025-04-01 11:26:59 UTC	768	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/json Expires: Tue, 01 Apr 2025 11:25:59 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C535_SN1 x-ms-request-id: f806b02f-4ffd-4865-b51c-2183ab858cea PPServer: PPV: 30 H: SN1PEPF0002F925 V: 0 Strict-Transport-Security: max-age=31536000 Set-Cookie: MSPOK= ; expires=Thu, 30-Oct-1980 16:00:00 GMT; domain=3474889.cfd; Secure; path=/; SameSite=None; HttpOnly Set-Cookie: MSPOK=$uuid-5e85ee6d-c02f-49fb-bd00-7b43719bd627$uuid-0e3ab224-45e8-41f3-bf9c-abeee5c91680; domain=3474889.cfd; Secure; path=/; SameSite=None; HttpOnly Date: Tue, 01 Apr 2025 11:26:58 GMT Connection: close content-length: 121
2025-04-01 11:26:59 UTC	121	IN	Data Raw: 7b 22 55 73 65 72 6e 61 6d 65 22 3a 22 73 70 6f 7a 67 61 40 72 66 64 73 75 2e 69 6f 22 2c 22 44 69 73 70 6c 61 79 22 3a 22 73 70 6f 7a 67 61 40 72 66 64 73 75 2e 69 6f 22 2c 22 4c 6f 63 61 74 69 6f 6e 22 3a 22 22 2c 22 49 66 45 78 69 73 74 73 52 65 73 75 6c 74 22 3a 31 2c 22 41 6c 69 61 73 44 69 73 61 62 6c 65 64 46 6f 72 4c 6f 67 69 6e 22 3a 66 61 6c 73 65 7d Data Ascii: {"Username":"spozga@rfdsu.io","Display":"spozga@rfdsu.io","Location":"","IfExistsResult":1,"AliasDisabledForLogin":false}

Timestamp	Bytes transferred	Direction	Data
2025-04-01 11:26:59 UTC	2179	OUT	GET /GetCredentialType.srf?opid=B9D4FAAB0E60CB96&id=294521&client_id=000000004C372D0D&client_id=229f4d61-07eb-454a-9453-d27bba7cc95b&mkt=EN-US&lc=1033&uaid=7c48670771ec4a0195498fd364b479ab HTTP/1.1 Host: 3474889.cfd Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: qPdM=ZRd2Aq8R9E7Y; qPdM.sig=1Gz8890DSV4sFKAGLvvfSWi3PBA; fpc=AuofijWSgx5NumVd2zxYrUU; esctx=PAQABBwEAAABVrSpeuWamRam2jAF1XRQEkjpUyoimXwOLYnVPPygXTiZZrBSMa_-VJyX3Vh9AeBiMqo0h_SnAN9Nx7lFgLFtlMJOXKqCMFsyUkN7BnG1bhHw3x4hx0bdqs_AfN-PyFrPg3X6n_0OFVIRiDkr0W02_4QbHaWFV9BqQO-zkOeY9eRNiuug9c14p9kaVw7frjUIgAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; MSPRequ=id=N&lt=1743506793&co=1; uaid=7c48670771ec4a0195498fd364b479ab; OParams=11O.DlMeEeSvIIp4Z48xfcF!KVpmIdEXZ85qCxhtH6vm6Ak707OaMVc7mm8AazVLvCGs!lt7k7DymYaWmBs6sASCOS4JpVLqmtrpU8Z7BhfF3AMBzNKepp8QXHk8SSlGbANjAtNiXdPWufIHxncu46LS5cuJhbuezzqEn06G4m443dTAAF4iP15wqIgwZxg5pEFJTpH4qMG8xCyNz5bUChWLVgsyd1P2Y0oEXoo0yKPgWmeqd!NjOQufXmsAtKLhEz1cYDsBJ7EnrMazwkKTuOBIOmc3ZaiPxq6l6RuejerTUoTfq!X!L2uLSZVeglCIR6gFk67yL64XE8lyjJ71VhQ9Xn7cYahyyOgf5nK8gRCjA6BtYGfXYgHwAT6nI5UvnyCX37r*8XpXQ9DQt78FHUEpC2uO9AOg39mi!rHyjmYfuJsTrNwWumuxrpbrESoCeGUhOTfvzVc!yG9WoFbAn3W0SRmvwnsO8D!ev1WFkaFgUrQnupe0nbMT3rfX35TeyP!KGhrUCEeb2mm9RXEP0y4v!5t6aBcsutg5ysFRcZvhzo9jy9qAkZCP6f0Pf [TRUNCATED]
2025-04-01 11:27:00 UTC	481	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/json Expires: Tue, 01 Apr 2025 11:26:00 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C560_SN1 x-ms-request-id: 9a6292f1-9c46-4bfe-8c60-601235019418 PPServer: PPV: 30 H: SN1PEPF0002FA92 V: 0 Strict-Transport-Security: max-age=31536000 Date: Tue, 01 Apr 2025 11:26:59 GMT Connection: close content-length: 22
2025-04-01 11:27:00 UTC	22	IN	Data Raw: 7b 22 45 72 72 6f 72 48 52 22 3a 22 38 30 30 34 33 34 34 39 22 7d Data Ascii: {"ErrorHR":"80043449"}

Target ID:	0
Start time:	07:26:14
Start date:	01/04/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Imagebase:	0x7ff778810000
File size:	3'388'000 bytes
MD5 hash:	E81F54E6C1129887AEA47E7D092680BF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Target ID:	1
Start time:	07:26:15
Start date:	01/04/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2028,i,7632261494517681474,106541947582837358,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2096 /prefetch:3
Imagebase:	0x7ff778810000
File size:	3'388'000 bytes
MD5 hash:	E81F54E6C1129887AEA47E7D092680BF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Target ID:	4
Start time:	07:26:21
Start date:	01/04/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://cdn.ampproject.org/c/s/storage.googleapis.com/64537346863/pdpeulwim8hmijrsur818_q3ijp1j8y4ml6p47_0j2my8bsc.html?lt=t_s_jan_293241770520623800_stage&target=293241770520623800_1&utm_rid=293241770520623800_2"
Imagebase:	0x7ff778810000
File size:	3'388'000 bytes
MD5 hash:	E81F54E6C1129887AEA47E7D092680BF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://cdn.ampproject.org/c/s/storage.googleapis.com/64537346863/pdpeulwim8hmijrsur818_q3ijp1j8y4ml6p47_0j2my8bsc.html?lt=t_s_jan_293241770520623800_stage&target=293241770520623800_1&utm_rid=293241770520623800_2

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Phishing

Compliance

Networking

System Summary

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Chrome Cache Entry: 58

Chrome Cache Entry: 59

Chrome Cache Entry: 60

Chrome Cache Entry: 61

Chrome Cache Entry: 62

Chrome Cache Entry: 63

Chrome Cache Entry: 64

Chrome Cache Entry: 65

Chrome Cache Entry: 66

Chrome Cache Entry: 67

Chrome Cache Entry: 68

Chrome Cache Entry: 69

Chrome Cache Entry: 70

Chrome Cache Entry: 71

Chrome Cache Entry: 72

Chrome Cache Entry: 73

Chrome Cache Entry: 74

Chrome Cache Entry: 75

Chrome Cache Entry: 76

Chrome Cache Entry: 77

Chrome Cache Entry: 78

Chrome Cache Entry: 79

Chrome Cache Entry: 80

Chrome Cache Entry: 81

Static File Info

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

Windows Analysis Report
https://cdn.ampproject.org/c/s/storage.googleapis.com/64537346863/pdpeulwim8hmijrsur818_q3ijp1j8y4ml6p47_0j2my8bsc.html?lt=t_s_jan_293241770520623800_stage&target=293241770520623800_1&utm_rid=293241770520623800_2

Description:	Adversaries may gain access to a system through a user visiting a website over the normal course of browsing. With this technique, the user's web browser is typically targeted for exploitation, but adversaries may also use compromised websites for non-exploitation behavior such as acquiring Application Access Token .
Tactics:	Initial Access
Data Sources:	Application Log: Application Log Content, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Process: Process Creation
Platforms:	Linux, macOS, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Internet browser extensions to establish persistent access to victim systems. Browser extensions or plugins are small programs that can add functionality and customize aspects of Internet browsers. They can be installed directly or through a browser's app store and generally have access and permissions to everything that the browser can access.
Tactics:	Persistence
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Process: Process Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre