Edit tour

Windows Analysis Report
Payout Receipt.pptx

Overview

General Information

Sample name:	Payout Receipt.pptx
Analysis ID:	1525814
MD5:	1417101d84f9b072a9d27567e41b12eb
SHA1:	d4ad5741fd589701af1c8270cfedeced334c0956
SHA256:	12dda16106f761f8d7508f450b212e3eefdbef67e97ff74afde7ac94ba704498
Infos:

Detection

HTMLPhisher

Score:	76
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

AI detected phishing page

Antivirus detection for URL or domain

Yara detected HtmlPhish54

Phishing site detected (based on favicon image match)

Phishing site detected (based on image similarity)

Phishing site detected (based on logo match)

Document contains embedded VBA macros

Document misses a certain OLE stream usually present in this Microsoft Office document type

HTML body contains low number of good links

HTML page contains hidden javascript code

HTML page contains string obfuscation

HTML title does not match URL

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

Queries the volume information (name, serial number etc) of a device

Sigma detected: Suspicious Office Outbound Connections

Stores files to the Windows start menu directory

Classification

Process Tree

System is w10x64_ra

POWERPNT.EXE (PID: 6380 cmdline: "C:\Program Files (x86)\Microsoft Office\Root\Office16\POWERPNT.EXE" "C:\Users\user\Desktop\Payout Receipt.pptx" /ou "" MD5: 2A43FE7F9F699F7F53FEBC254F68F46D)

ai.exe (PID: 6856 cmdline: "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "4F1F87A3-2D62-4CDB-ABDF-61BB45105DB2" "40BB7578-B581-41D4-B322-FEC0ED1808AE" "6380" "C:\Program Files (x86)\Microsoft Office\Root\Office16\POWERPNT.EXE" "PowerPointCombinedFloatieLreOnline.onnx" MD5: EC652BEDD90E089D9406AFED89A8A8BD)

chrome.exe (PID: 5336 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://nomicscare.com/fr/gdpr/cookie-consent/all/?next_url=//crewbloom.s3.amazonaws.com/34873.html MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)

chrome.exe (PID: 2980 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 --field-trial-handle=1944,i,8800721303449338163,5848358366860922411,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)

cleanup

Yara Signatures

HTML

Source	Rule	Description	Author
0.10.id.script.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security
0.23.i.script.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security
0.6.pages.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security
0.7.pages.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security
0.8.pages.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security

Sigma Signatures

Sigma detected: Suspicious Office Outbound Connections

Source: Network Connection

Author: X__Junior (Nextron Systems): Data: DestinationIp: 192.168.2.17, DestinationIsIpv6: false, DestinationPort: 49709, EventID: 3, Image: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE, Initiated: true, ProcessId: 6380, Protocol: tcp, SourceIp: 13.107.246.60, SourceIsIpv6: false, SourcePort: 443

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: https://crewbloom.s3.amazonaws.com/34873.html

SlashNext: Label: Credential Stealing type: Phishing & Social Engineering

Phishing

AI detected phishing page

Source: https://l0gin-microso.ftlivedocs.tech/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638636442697330204.NjIwZWJjNjEtNmMyNi00NTY5LWFhMWItYzQ4NTQyOWEzNGQ0MjMxNjBhODctYjRiNy00ZmQ5LWI0MzMtNWU1NmMxYjE0NWMx&ui_locales=en-US&mkt=en-US&client-request-id=37a08538-dff5-407d-be68-819033033a7a&state=KXouNT3DCC4nJGmZ0UPqr43DvOETQcMOHzyW3XKW_GmmSSP1vhdbuw5XASgqJ79HETi6JwhHJ6QWBKwBMy02TUIwHPB3pd6CKYG_YWqx9kPhyBezozkFI1hhf1DwNAMV6i3WbD94ziRYYdhiW7ILPzoTsrP8EPqDjpPTPwsGlE2ddaYguV0DrAR1iKncN8RtOGlb_uoJSY4fDM1dafLvW1gf5IX7c3_kF1zQXY4vcldCPOaUyZ98s32esN_GOxDd6BxYK5bGLDx5Op0mZGALvw&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0&sso_reload=true

LLM: Score: 9 Reasons: The brand 'Microsoft' is a well-known technology company with a legitimate domain of 'microsoft.com'., The URL 'l0gin-microso.ftlivedocs.tech' contains several suspicious elements: 'l0gin' instead of 'login', 'microso' instead of 'microsoft', and an unusual domain extension '.tech'., The domain 'ftlivedocs.tech' does not match the legitimate domain associated with Microsoft., The use of a hyphen and misspellings in the URL are common phishing tactics., The presence of an input field for 'Email' suggests an attempt to collect sensitive information, which is typical in phishing sites. DOM: 0.8.pages.csv

Yara detected HtmlPhish54

Source: Yara match	File source: 0.10.id.script.csv, type: HTML
Source: Yara match	File source: 0.23.i.script.csv, type: HTML
Source: Yara match	File source: 0.6.pages.csv, type: HTML
Source: Yara match	File source: 0.7.pages.csv, type: HTML
Source: Yara match	File source: 0.8.pages.csv, type: HTML

Phishing site detected (based on favicon image match)

Source: https://ftlivedocs.tech	Matcher: Template: microsoft matched with high similarity
Source: https://crewbloom.s3.amazonaws.com/34873.html	Matcher: Template: microsoft matched with high similarity
Source: https://l0gin-microso.ftlivedocs.tech/KUtIdFka	Matcher: Template: microsoft matched with high similarity
Source: https://l0gin-microso.ftlivedocs.tech/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638636442697330204.NjIwZWJjNjEtNmMyNi00NTY5LWFhMWItYzQ4NTQyOWEzNGQ0MjMxNjBhODctYjRiNy00ZmQ5LWI0MzMtNWU1NmMxYjE0NWMx&ui_locales=en-US&mkt=en-US&client-request-id=37a08538-dff5-407d-be68-819033033a7a&state=KXouNT3DCC4nJGmZ0UPqr43DvOETQcMOHzyW3XKW_GmmSSP1vhdbuw5XASgqJ79HETi6JwhHJ6QWBKwBMy02TUIwHPB3pd6CKYG_YWqx9kPhyBezozkFI1hhf1DwNAMV6i3WbD94ziRYYdhiW7ILPzoTsrP8EPqDjpPTPwsGlE2ddaYguV0DrAR1iKncN8RtOGlb_uoJSY4fDM1dafLvW1gf5IX7c3_kF1zQXY4vcldCPOaUyZ98s32esN_GOxDd6BxYK5bGLDx5Op0mZGALvw&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0	Matcher: Template: microsoft matched with high similarity
Source: https://l0gin-microso.ftlivedocs.tech/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638636442697330204.NjIwZWJjNjEtNmMyNi00NTY5LWFhMWItYzQ4NTQyOWEzNGQ0MjMxNjBhODctYjRiNy00ZmQ5LWI0MzMtNWU1NmMxYjE0NWMx&ui_locales=en-US&mkt=en-US&client-request-id=37a08538-dff5-407d-be68-819033033a7a&state=KXouNT3DCC4nJGmZ0UPqr43DvOETQcMOHzyW3XKW_GmmSSP1vhdbuw5XASgqJ79HETi6JwhHJ6QWBKwBMy02TUIwHPB3pd6CKYG_YWqx9kPhyBezozkFI1hhf1DwNAMV6i3WbD94ziRYYdhiW7ILPzoTsrP8EPqDjpPTPwsGlE2ddaYguV0DrAR1iKncN8RtOGlb_uoJSY4fDM1dafLvW1gf5IX7c3_kF1zQXY4vcldCPOaUyZ98s32esN_GOxDd6BxYK5bGLDx5Op0mZGALvw&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0&sso_reload=true	Matcher: Template: microsoft matched with high similarity

Phishing site detected (based on image similarity)

Matcher: Found strong image similarity, brand: MICROSOFT

Phishing site detected (based on logo match)

Matcher: Template: microsoft matched

HTTP Parser: Number of links: 0

Source: https://crewbloom.s3.amazonaws.com/34873.html

HTTP Parser: Base64 decoded: https://l0gi

Source: https://l0gin-microso.ftlivedocs.tech/KUtIdFka

HTTP Parser: Found new string: script . var ip;. function EnterSite() {. window.location.href = 'ht' + 'tps' + ':' + '//' + 'l0g' + 'in' + '-' + 'm' + 'ic' + 'r' + 'os' + 'o' + '.ft' + 'liv' + 'ed' + 'o' + 'cs.' + 't' + 'e' + 'c' + 'h/K' + 'UtI' + 'd' + 'Fka' + '?S' + '=' + 'U' + 'mxu' + 'Hl' + 'o'. }. ..

HTTP Parser: Title: Sign in to your account does not match URL

HTTP Parser: <input type="password" .../> found

Source: https://crewbloom.s3.amazonaws.com/34873.html	HTTP Parser: No favicon
Source: https://crewbloom.s3.amazonaws.com/34873.html	HTTP Parser: No favicon
Source: https://l0gin-microso.ftlivedocs.tech/KUtIdFka	HTTP Parser: No favicon
Source: https://l0gin-microso.ftlivedocs.tech/KUtIdFka	HTTP Parser: No favicon
Source: https://l0gin-microso.ftlivedocs.tech/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638636442697330204.NjIwZWJjNjEtNmMyNi00NTY5LWFhMWItYzQ4NTQyOWEzNGQ0MjMxNjBhODctYjRiNy00ZmQ5LWI0MzMtNWU1NmMxYjE0NWMx&ui_locales=en-US&mkt=en-US&client-request-id=37a08538-dff5-407d-be68-819033033a7a&state=KXouNT3DCC4nJGmZ0UPqr43DvOETQcMOHzyW3XKW_GmmSSP1vhdbuw5XASgqJ79HETi6JwhHJ6QWBKwBMy02TUIwHPB3pd6CKYG_YWqx9kPhyBezozkFI1hhf1DwNAMV6i3WbD94ziRYYdhiW7ILPzoTsrP8EPqDjpPTPwsGlE2ddaYguV0DrAR1iKncN8RtOGlb_uoJSY4fDM1dafLvW1gf5IX7c3_kF1zQXY4vcldCPOaUyZ98s32esN_GOxDd6BxYK5bGLDx5Op0mZGALvw&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0	HTTP Parser: No favicon

Source: https://l0gin-microso.ftlivedocs.tech/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638636442697330204.NjIwZWJjNjEtNmMyNi00NTY5LWFhMWItYzQ4NTQyOWEzNGQ0MjMxNjBhODctYjRiNy00ZmQ5LWI0MzMtNWU1NmMxYjE0NWMx&ui_locales=en-US&mkt=en-US&client-request-id=37a08538-dff5-407d-be68-819033033a7a&state=KXouNT3DCC4nJGmZ0UPqr43DvOETQcMOHzyW3XKW_GmmSSP1vhdbuw5XASgqJ79HETi6JwhHJ6QWBKwBMy02TUIwHPB3pd6CKYG_YWqx9kPhyBezozkFI1hhf1DwNAMV6i3WbD94ziRYYdhiW7ILPzoTsrP8EPqDjpPTPwsGlE2ddaYguV0DrAR1iKncN8RtOGlb_uoJSY4fDM1dafLvW1gf5IX7c3_kF1zQXY4vcldCPOaUyZ98s32esN_GOxDd6BxYK5bGLDx5Op0mZGALvw&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0&sso_reload=true	HTTP Parser: No <meta name="author".. found
Source: https://l0gin-microso.ftlivedocs.tech/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638636442697330204.NjIwZWJjNjEtNmMyNi00NTY5LWFhMWItYzQ4NTQyOWEzNGQ0MjMxNjBhODctYjRiNy00ZmQ5LWI0MzMtNWU1NmMxYjE0NWMx&ui_locales=en-US&mkt=en-US&client-request-id=37a08538-dff5-407d-be68-819033033a7a&state=KXouNT3DCC4nJGmZ0UPqr43DvOETQcMOHzyW3XKW_GmmSSP1vhdbuw5XASgqJ79HETi6JwhHJ6QWBKwBMy02TUIwHPB3pd6CKYG_YWqx9kPhyBezozkFI1hhf1DwNAMV6i3WbD94ziRYYdhiW7ILPzoTsrP8EPqDjpPTPwsGlE2ddaYguV0DrAR1iKncN8RtOGlb_uoJSY4fDM1dafLvW1gf5IX7c3_kF1zQXY4vcldCPOaUyZ98s32esN_GOxDd6BxYK5bGLDx5Op0mZGALvw&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0&sso_reload=true	HTTP Parser: No <meta name="author".. found

Source: https://l0gin-microso.ftlivedocs.tech/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638636442697330204.NjIwZWJjNjEtNmMyNi00NTY5LWFhMWItYzQ4NTQyOWEzNGQ0MjMxNjBhODctYjRiNy00ZmQ5LWI0MzMtNWU1NmMxYjE0NWMx&ui_locales=en-US&mkt=en-US&client-request-id=37a08538-dff5-407d-be68-819033033a7a&state=KXouNT3DCC4nJGmZ0UPqr43DvOETQcMOHzyW3XKW_GmmSSP1vhdbuw5XASgqJ79HETi6JwhHJ6QWBKwBMy02TUIwHPB3pd6CKYG_YWqx9kPhyBezozkFI1hhf1DwNAMV6i3WbD94ziRYYdhiW7ILPzoTsrP8EPqDjpPTPwsGlE2ddaYguV0DrAR1iKncN8RtOGlb_uoJSY4fDM1dafLvW1gf5IX7c3_kF1zQXY4vcldCPOaUyZ98s32esN_GOxDd6BxYK5bGLDx5Op0mZGALvw&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0&sso_reload=true	HTTP Parser: No <meta name="copyright".. found
Source: https://l0gin-microso.ftlivedocs.tech/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638636442697330204.NjIwZWJjNjEtNmMyNi00NTY5LWFhMWItYzQ4NTQyOWEzNGQ0MjMxNjBhODctYjRiNy00ZmQ5LWI0MzMtNWU1NmMxYjE0NWMx&ui_locales=en-US&mkt=en-US&client-request-id=37a08538-dff5-407d-be68-819033033a7a&state=KXouNT3DCC4nJGmZ0UPqr43DvOETQcMOHzyW3XKW_GmmSSP1vhdbuw5XASgqJ79HETi6JwhHJ6QWBKwBMy02TUIwHPB3pd6CKYG_YWqx9kPhyBezozkFI1hhf1DwNAMV6i3WbD94ziRYYdhiW7ILPzoTsrP8EPqDjpPTPwsGlE2ddaYguV0DrAR1iKncN8RtOGlb_uoJSY4fDM1dafLvW1gf5IX7c3_kF1zQXY4vcldCPOaUyZ98s32esN_GOxDd6BxYK5bGLDx5Op0mZGALvw&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0&sso_reload=true	HTTP Parser: No <meta name="copyright".. found

Source: unknown	HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.17:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.60:443 -> 192.168.2.17:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.159.2:443 -> 192.168.2.17:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.159.2:443 -> 192.168.2.17:49717 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.17:49837 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.17:49837 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.5.88:443 -> 192.168.2.17:49846 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.23.209.133:443 -> 192.168.2.17:49847 version: TLS 1.2

Source: powerpnt.exe

Memory has grown: Private usage: 2MB later: 110MB

Source: global traffic

HTTP traffic detected: GET /ab HTTP/1.1Host: evoke-windowsservices-tas.msedge.netCache-Control: no-store, no-cacheX-PHOTOS-CALLERID: 9NMPJ99VJBWVX-EVOKE-RING: X-WINNEXT-RING: PublicX-WINNEXT-TELEMETRYLEVEL: BasicX-WINNEXT-OSVERSION: 10.0.19045.0X-WINNEXT-APPVERSION: 1.23082.131.0X-WINNEXT-PLATFORM: DesktopX-WINNEXT-CANTAILOR: FalseX-MSEDGE-CLIENTID: {c1afbad7-f7da-40f2-92f9-8846a91d69bd}X-WINNEXT-PUBDEVICEID: dbfen2nYS7HW6ON4OdOknKxxv2CCI5LJBTojzDztjwI=If-None-Match: 2056388360_-1434155563Accept-Encoding: gzip, deflate, br

Source: Joe Sandbox View	IP Address: 13.107.246.45 13.107.246.45
Source: Joe Sandbox View	IP Address: 146.75.52.159 146.75.52.159
Source: Joe Sandbox View	IP Address: 13.107.246.60 13.107.246.60
Source: Joe Sandbox View	IP Address: 104.18.95.41 104.18.95.41

Source: Joe Sandbox View	JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4
Source: Joe Sandbox View	JA3 fingerprint: 6271f898ce5be7dd52b0fc260d0662b3
Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
Source: Joe Sandbox View	JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.13
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.13
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.13
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.13
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.13
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.2
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.2
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.2
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.2
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.2
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.2
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.2
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.2
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.2
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.2
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.2
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.2
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.2
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.2
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.2
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.13
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.2
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.2
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.2
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.2
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.2
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.2

Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=6Xtt1sBzydtZp6M&MD=91XKTh55 HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/powerpnt.exe-Production-v19.bundle HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; Microsoft PowerPoint 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /fr/gdpr/cookie-consent/all/?next_url=//crewbloom.s3.amazonaws.com/34873.html HTTP/1.1Host: nomicscare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /34873.html HTTP/1.1Host: crewbloom.s3.amazonaws.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /media/GGrR89_WgAAgrOI?format=jpg&name=large HTTP/1.1Host: pbs.twimg.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://crewbloom.s3.amazonaws.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /media/GGrR89_WgAAgrOI?format=jpg&name=large HTTP/1.1Host: pbs.twimg.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: crewbloom.s3.amazonaws.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://crewbloom.s3.amazonaws.com/34873.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule120603v8s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; Microsoft PowerPoint 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /KUtIdFka HTTP/1.1Host: l0gin-microso.ftlivedocs.techConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: documentReferer: https://crewbloom.s3.amazonaws.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /turnstile/v0/api.js?onload=onloadTurnstileCallback HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://l0gin-microso.ftlivedocs.tech/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/scripts/jsd/main.js HTTP/1.1Host: l0gin-microso.ftlivedocs.techConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: fNYe=896a8296dd752621a31badfb843ea3b9d58cbc46d6504a1582b16c1633cbccb4
Source: global traffic	HTTP traffic detected: GET /turnstile/v0/g/ec4b873d446c/api.js HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://l0gin-microso.ftlivedocs.tech/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/scripts/jsd/ec4b873d446c/main.js? HTTP/1.1Host: l0gin-microso.ftlivedocs.techConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: fNYe=896a8296dd752621a31badfb843ea3b9d58cbc46d6504a1582b16c1633cbccb4
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/scripts/jsd/ec4b873d446c/main.js? HTTP/1.1Host: l0gin-microso.ftlivedocs.techConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: fNYe=896a8296dd752621a31badfb843ea3b9d58cbc46d6504a1582b16c1633cbccb4
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/bth64/0x4AAAAAAAwd9hw5rvoDjM7I/auto/fbE/normal/auto/ HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://l0gin-microso.ftlivedocs.tech/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /turnstile/v0/g/ec4b873d446c/api.js HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/jsd/r/8cd56a496a3b5e6a HTTP/1.1Host: l0gin-microso.ftlivedocs.techConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: fNYe=896a8296dd752621a31badfb843ea3b9d58cbc46d6504a1582b16c1633cbccb4
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/orchestrate/chl_api/v1?ray=8cd56a630cf741e3&lang=auto HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/bth64/0x4AAAAAAAwd9hw5rvoDjM7I/auto/fbE/normal/auto/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/cmg/1/wh0E0SXYnx6pTBdJW%2Fl926I%2BPRUplRdtQz3K9lHXs%2Fs%3D HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/bth64/0x4AAAAAAAwd9hw5rvoDjM7I/auto/fbE/normal/auto/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/cmg/1/wh0E0SXYnx6pTBdJW%2Fl926I%2BPRUplRdtQz3K9lHXs%2Fs%3D HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/orchestrate/chl_api/v1?ray=8cd56a630cf741e3&lang=auto HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: l0gin-microso.ftlivedocs.techConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://l0gin-microso.ftlivedocs.tech/KUtIdFkaAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: fNYe=896a8296dd752621a31badfb843ea3b9d58cbc46d6504a1582b16c1633cbccb4; cf_clearance=PnrrDIdUFnV3xXNKwU7Uk2KkvZUrRmLQ6VsqVSFs7iI-1728047462-1.2.1.1-KgyGMoX2WsyMGE_crV0QHN0PnWPTTT_vkrnfk6OUsXs.ZCFyIMeIhyPM5AaovJKdYX33b6XhxSMauVLxhud15UDF6qe_lUUn4z7DUAUZgquXnur2JBrKraoo31FHgtIWsUITRVzxmgHzvH3L3sRtyyvkXX55rBaE6wwFcRgFWsHKcOzBUkmtg.SYM871TLywvjL.S9lBf6XKCP1RA_4rE_E8nRcZe7.uq6YsjbK5vOgE7JsW9ukyLOepD1wU8T7pQ7FQYb9ZLbSWuiaz05fetoXoB9g1me566IfE.8W3ydmURQRK0le68jWlAR9ChGQtId1KGEdKLtkgMNrP.DUbgel24XyilarY80urzfUxbGWeV87XlXGmDq1MBeocoMX5
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/flow/ov1/147669712:1728044744:0OaiWMyJW7ZPxlqedXMft6P244b4nMflF1Cf4AK8E-k/8cd56a630cf741e3/fc3fc94e9e3547a HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/i/8cd56a630cf741e3/1728047464607/YBBtqSrR-kb7LqJ HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/bth64/0x4AAAAAAAwd9hw5rvoDjM7I/auto/fbE/normal/auto/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/i/8cd56a630cf741e3/1728047464607/YBBtqSrR-kb7LqJ HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/pat/8cd56a630cf741e3/1728047464610/6315a5703f342bce662661e8fa8e5cfbec36c51d90ea70cfa211f89c976d3430/n-8rMprBONH9scU HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveCache-Control: max-age=0sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/bth64/0x4AAAAAAAwd9hw5rvoDjM7I/auto/fbE/normal/auto/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/flow/ov1/147669712:1728044744:0OaiWMyJW7ZPxlqedXMft6P244b4nMflF1Cf4AK8E-k/8cd56a630cf741e3/fc3fc94e9e3547a HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /KUtIdFka?S=UmxuHlo HTTP/1.1Host: l0gin-microso.ftlivedocs.techConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-Dest: documentReferer: https://l0gin-microso.ftlivedocs.tech/KUtIdFkaAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: fNYe=896a8296dd752621a31badfb843ea3b9d58cbc46d6504a1582b16c1633cbccb4; cf_clearance=PnrrDIdUFnV3xXNKwU7Uk2KkvZUrRmLQ6VsqVSFs7iI-1728047462-1.2.1.1-KgyGMoX2WsyMGE_crV0QHN0PnWPTTT_vkrnfk6OUsXs.ZCFyIMeIhyPM5AaovJKdYX33b6XhxSMauVLxhud15UDF6qe_lUUn4z7DUAUZgquXnur2JBrKraoo31FHgtIWsUITRVzxmgHzvH3L3sRtyyvkXX55rBaE6wwFcRgFWsHKcOzBUkmtg.SYM871TLywvjL.S9lBf6XKCP1RA_4rE_E8nRcZe7.uq6YsjbK5vOgE7JsW9ukyLOepD1wU8T7pQ7FQYb9ZLbSWuiaz05fetoXoB9g1me566IfE.8W3ydmURQRK0le68jWlAR9ChGQtId1KGEdKLtkgMNrP.DUbgel24XyilarY80urzfUxbGWeV87XlXGmDq1MBeocoMX5; x-ms-gateway-slice=estsfd
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: l0gin-microso.ftlivedocs.techConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Referer: https://l0gin-microso.ftlivedocs.tech/KUtIdFkaAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: fNYe=896a8296dd752621a31badfb843ea3b9d58cbc46d6504a1582b16c1633cbccb4; cf_clearance=PnrrDIdUFnV3xXNKwU7Uk2KkvZUrRmLQ6VsqVSFs7iI-1728047462-1.2.1.1-KgyGMoX2WsyMGE_crV0QHN0PnWPTTT_vkrnfk6OUsXs.ZCFyIMeIhyPM5AaovJKdYX33b6XhxSMauVLxhud15UDF6qe_lUUn4z7DUAUZgquXnur2JBrKraoo31FHgtIWsUITRVzxmgHzvH3L3sRtyyvkXX55rBaE6wwFcRgFWsHKcOzBUkmtg.SYM871TLywvjL.S9lBf6XKCP1RA_4rE_E8nRcZe7.uq6YsjbK5vOgE7JsW9ukyLOepD1wU8T7pQ7FQYb9ZLbSWuiaz05fetoXoB9g1me566IfE.8W3ydmURQRK0le68jWlAR9ChGQtId1KGEdKLtkgMNrP.DUbgel24XyilarY80urzfUxbGWeV87XlXGmDq1MBeocoMX5; x-ms-gateway-slice=estsfd
Source: global traffic	HTTP traffic detected: GET /login HTTP/1.1Host: www.ftlivedocs.techConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Referer: https://l0gin-microso.ftlivedocs.tech/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: fNYe=896a8296dd752621a31badfb843ea3b9d58cbc46d6504a1582b16c1633cbccb4; cf_clearance=PnrrDIdUFnV3xXNKwU7Uk2KkvZUrRmLQ6VsqVSFs7iI-1728047462-1.2.1.1-KgyGMoX2WsyMGE_crV0QHN0PnWPTTT_vkrnfk6OUsXs.ZCFyIMeIhyPM5AaovJKdYX33b6XhxSMauVLxhud15UDF6qe_lUUn4z7DUAUZgquXnur2JBrKraoo31FHgtIWsUITRVzxmgHzvH3L3sRtyyvkXX55rBaE6wwFcRgFWsHKcOzBUkmtg.SYM871TLywvjL.S9lBf6XKCP1RA_4rE_E8nRcZe7.uq6YsjbK5vOgE7JsW9ukyLOepD1wU8T7pQ7FQYb9ZLbSWuiaz05fetoXoB9g1me566IfE.8W3ydmURQRK0le68jWlAR9ChGQtId1KGEdKLtkgMNrP.DUbgel24XyilarY80urzfUxbGWeV87XlXGmDq1MBeocoMX5
Source: global traffic	HTTP traffic detected: GET /common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638636442697330204.NjIwZWJjNjEtNmMyNi00NTY5LWFhMWItYzQ4NTQyOWEzNGQ0MjMxNjBhODctYjRiNy00ZmQ5LWI0MzMtNWU1NmMxYjE0NWMx&ui_locales=en-US&mkt=en-US&client-request-id=37a08538-dff5-407d-be68-819033033a7a&state=KXouNT3DCC4nJGmZ0UPqr43DvOETQcMOHzyW3XKW_GmmSSP1vhdbuw5XASgqJ79HETi6JwhHJ6QWBKwBMy02TUIwHPB3pd6CKYG_YWqx9kPhyBezozkFI1hhf1DwNAMV6i3WbD94ziRYYdhiW7ILPzoTsrP8EPqDjpPTPwsGlE2ddaYguV0DrAR1iKncN8RtOGlb_uoJSY4fDM1dafLvW1gf5IX7c3_kF1zQXY4vcldCPOaUyZ98s32esN_GOxDd6BxYK5bGLDx5Op0mZGALvw&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0 HTTP/1.1Host: l0gin-microso.ftlivedocs.techConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Referer: https://l0gin-microso.ftlivedocs.tech/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: fNYe=896a8296dd752621a31badfb843ea3b9d58cbc46d6504a1582b16c1633cbccb4; cf_clearance=PnrrDIdUFnV3xXNKwU7Uk2KkvZUrRmLQ6VsqVSFs7iI-1728047462-1.2.1.1-KgyGMoX2WsyMGE_crV0QHN0PnWPTTT_vkrnfk6OUsXs.ZCFyIMeIhyPM5AaovJKdYX33b6XhxSMauVLxhud15UDF6qe_lUUn4z7DUAUZgquXnur2JBrKraoo31FHgtIWsUITRVzxmgHzvH3L3sRtyyvkXX55rBaE6wwFcRgFWsHKcOzBUkmtg.SYM871TLywvjL.S9lBf6XKCP1RA_4rE_E8nRcZe7.uq6YsjbK5vOgE7JsW9ukyLOepD1wU8T7pQ7FQYb9ZLbSWuiaz05fetoXoB9g1me566IfE.8W3ydmURQRK0le68jWlAR9ChGQtId1KGEdKLtkgMNrP.DUbgel24XyilarY80urzfUxbGWeV87XlXGmDq1MBeocoMX5; x-ms-gateway-slice=estsfd; fpc=AiTvsUNzDMhLtivCMH0SOIk; esctx=PAQABBwEAAADW6jl31mB3T7ugrWTT8pFe6JSh8XySIX2JZIyDEcAnTGHJW7xDRybzTrnJSMuljy1faq4uekBlYW6QepUzkeCCVeoETYsf77cKfqUAaCR3HLP0IdxhCl6lLOWFylALBPap_5Jy1OH6KOB0tgqhPeFvx9h3RpcXxRAQOONMX0l8end4UyP-YrFmgiLM0lyRyksgAA; stsservicecookie=estsfd; MUID=0572C4040C3160E33E86D10A0D3661F9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/BssoInterrupt_Core_JQnUxWSvwsd9FrpspQmznw2.js HTTP/1.1Host: aadcdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://l0gin-microso.ftlivedocs.techsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://l0gin-microso.ftlivedocs.tech/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638636442697330204.NjIwZWJjNjEtNmMyNi00NTY5LWFhMWItYzQ4NTQyOWEzNGQ0MjMxNjBhODctYjRiNy00ZmQ5LWI0MzMtNWU1NmMxYjE0NWMx&ui_locales=en-US&mkt=en-US&client-request-id=37a08538-dff5-407d-be68-819033033a7a&state=KXouNT3DCC4nJGmZ0UPqr43DvOETQcMOHzyW3XKW_GmmSSP1vhdbuw5XASgqJ79HETi6JwhHJ6QWBKwBMy02TUIwHPB3pd6CKYG_YWqx9kPhyBezozkFI1hhf1DwNAMV6i3WbD94ziRYYdhiW7ILPzoTsrP8EPqDjpPTPwsGlE2ddaYguV0DrAR1iKncN8RtOGlb_uoJSY4fDM1dafLvW1gf5IX7c3_kF1zQXY4vcldCPOaUyZ98s32esN_GOxDd6BxYK5bGLDx5Op0mZGALvw&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0&sso_reload=true HTTP/1.1Host: l0gin-microso.ftlivedocs.techConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-Dest: documentReferer: https://l0gin-microso.ftlivedocs.tech/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638636442697330204.NjIwZWJjNjEtNmMyNi00NTY5LWFhMWItYzQ4NTQyOWEzNGQ0MjMxNjBhODctYjRiNy00ZmQ5LWI0MzMtNWU1NmMxYjE0NWMx&ui_locales=en-US&mkt=en-US&client-request-id=37a08538-dff5-407d-be68-819033033a7a&state=KXouNT3DCC4nJGmZ0UPqr43DvOETQcMOHzyW3XKW_GmmSSP1vhdbuw5XASgqJ79HETi6JwhHJ6QWBKwBMy02TUIwHPB3pd6CKYG_YWqx9kPhyBezozkFI1hhf1DwNAMV6i3WbD94ziRYYdhiW7ILPzoTsrP8EPqDjpPTPwsGlE2ddaYguV0DrAR1iKncN8RtOGlb_uoJSY4fDM1dafLvW1gf5IX7c3_kF1zQXY4vcldCPOaUyZ98s32esN_GOxDd6BxYK5bGLDx5Op0mZGALvw&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: fNYe=896a8296dd752621a31badfb843ea3b9d58cbc46d6504a1582b16c1633cbccb4; cf_clearance=PnrrDIdUFnV3xXNKwU7Uk2KkvZUrRmLQ6VsqVSFs7iI-1728047462-1.2.1.1-KgyGMoX2WsyMGE_crV0QHN0PnWPTTT_vkrnfk6OUsXs.ZCFyIMeIhyPM5AaovJKdYX33b6XhxSMauVLxhud15UDF6qe_lUUn4z7DUAUZgquXnur2JBrKraoo31FHgtIWsUITRVzxmgHzvH3L3sRtyyvkXX55rBaE6wwFcRgFWsHKcOzBUkmtg.SYM871TLywvjL.S9lBf6XKCP1RA_4rE_E8nRcZe7.uq6YsjbK5vOgE7JsW9ukyLOepD1wU8T7pQ7FQYb9ZLbSWuiaz05fetoXoB9g1me566IfE.8W3ydmURQRK0le68jWlAR9ChGQtId1KGEdKLtkgMNrP.DUbgel24XyilarY80urzfUxbGWeV87XlXGmDq1MBeocoMX5; x-ms-gateway-slice=estsfd; fpc=AiTvsUNzDMhLtivCMH0SOIk; esctx=PAQABBwEAAADW6jl31mB3T7ugrWTT8pFe6JSh8XySIX2JZIyDEcAnTGHJW7xDRybzTrnJSMuljy1faq4uekBlYW6Qep
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/BssoInterrupt_Core_JQnUxWSvwsd9FrpspQmznw2.js HTTP/1.1Host: aadcdn.msauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /Me.htm?v=3 HTTP/1.1Host: ywnjb.ftlivedocs.techConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Purpose: prefetchSec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyReferer: https://l0gin-microso.ftlivedocs.tech/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: fNYe=896a8296dd752621a31badfb843ea3b9d58cbc46d6504a1582b16c1633cbccb4; cf_clearance=PnrrDIdUFnV3xXNKwU7Uk2KkvZUrRmLQ6VsqVSFs7iI-1728047462-1.2.1.1-KgyGMoX2WsyMGE_crV0QHN0PnWPTTT_vkrnfk6OUsXs.ZCFyIMeIhyPM5AaovJKdYX33b6XhxSMauVLxhud15UDF6qe_lUUn4z7DUAUZgquXnur2JBrKraoo31FHgtIWsUITRVzxmgHzvH3L3sRtyyvkXX55rBaE6wwFcRgFWsHKcOzBUkmtg.SYM871TLywvjL.S9lBf6XKCP1RA_4rE_E8nRcZe7.uq6YsjbK5vOgE7JsW9ukyLOepD1wU8T7pQ7FQYb9ZLbSWuiaz05fetoXoB9g1me566IfE.8W3ydmURQRK0le68jWlAR9ChGQtId1KGEdKLtkgMNrP.DUbgel24XyilarY80urzfUxbGWeV87XlXGmDq1MBeocoMX5; MUID=0572C4040C3160E33E86D10A0D3661F9
Source: global traffic	HTTP traffic detected: GET /ests/2.1/content/cdnbundles/converged.v2.login.min_qzvqnltrxpy99ajspyxbgq2.css HTTP/1.1Host: aadcdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://l0gin-microso.ftlivedocs.techsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: styleReferer: https://l0gin-microso.ftlivedocs.tech/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/ConvergedLogin_PCore_ELtAAt2Ya8ISGuc0PJcBKA2.js HTTP/1.1Host: aadcdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://l0gin-microso.ftlivedocs.techsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://l0gin-microso.ftlivedocs.tech/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ests/2.1/content/cdnbundles/ux.converged.login.strings-en.min_1yb3e7oii5t28dgo4xrtow2.js HTTP/1.1Host: aadcdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://l0gin-microso.ftlivedocs.techsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://l0gin-microso.ftlivedocs.tech/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/asyncchunk/convergedlogin_pcustomizationloader_117b650bccea354984d8.js HTTP/1.1Host: aadcdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://l0gin-microso.ftlivedocs.tech/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ests/2.1/content/cdnbundles/ux.converged.login.strings-en.min_1yb3e7oii5t28dgo4xrtow2.js HTTP/1.1Host: aadcdn.msauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/ConvergedLogin_PCore_ELtAAt2Ya8ISGuc0PJcBKA2.js HTTP/1.1Host: aadcdn.msauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico HTTP/1.1Host: aadcdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://l0gin-microso.ftlivedocs.tech/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/asyncchunk/convergedlogin_pfetchsessionsprogress_d0a803279e7397bef834.js HTTP/1.1Host: aadcdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://l0gin-microso.ftlivedocs.tech/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/asyncchunk/convergedlogin_pcustomizationloader_117b650bccea354984d8.js HTTP/1.1Host: aadcdn.msauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/marching_ants_white_8257b0707cbe1d0bd2661b80068676fe.gif HTTP/1.1Host: aadcdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://l0gin-microso.ftlivedocs.tech/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/marching_ants_986f40b5a9dc7d39ef8396797f61b323.gif HTTP/1.1Host: aadcdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://l0gin-microso.ftlivedocs.tech/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico HTTP/1.1Host: aadcdn.msauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /Me.htm?v=3 HTTP/1.1Host: ywnjb.ftlivedocs.techConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://l0gin-microso.ftlivedocs.tech/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: fNYe=896a8296dd752621a31badfb843ea3b9d58cbc46d6504a1582b16c1633cbccb4; cf_clearance=PnrrDIdUFnV3xXNKwU7Uk2KkvZUrRmLQ6VsqVSFs7iI-1728047462-1.2.1.1-KgyGMoX2WsyMGE_crV0QHN0PnWPTTT_vkrnfk6OUsXs.ZCFyIMeIhyPM5AaovJKdYX33b6XhxSMauVLxhud15UDF6qe_lUUn4z7DUAUZgquXnur2JBrKraoo31FHgtIWsUITRVzxmgHzvH3L3sRtyyvkXX55rBaE6wwFcRgFWsHKcOzBUkmtg.SYM871TLywvjL.S9lBf6XKCP1RA_4rE_E8nRcZe7.uq6YsjbK5vOgE7JsW9ukyLOepD1wU8T7pQ7FQYb9ZLbSWuiaz05fetoXoB9g1me566IfE.8W3ydmURQRK0le68jWlAR9ChGQtId1KGEdKLtkgMNrP.DUbgel24XyilarY80urzfUxbGWeV87XlXGmDq1MBeocoMX5; MUID=0572C4040C3160E33E86D10A0D3661F9; uaid=12fc96651938487da1bcb76e2727bac5; MSPRequ=id=N&lt=1728047473&co=1
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/marching_ants_986f40b5a9dc7d39ef8396797f61b323.gif HTTP/1.1Host: aadcdn.msauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/marching_ants_white_8257b0707cbe1d0bd2661b80068676fe.gif HTTP/1.1Host: aadcdn.msauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/asyncchunk/convergedlogin_pfetchsessionsprogress_d0a803279e7397bef834.js HTTP/1.1Host: aadcdn.msauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/backgrounds/2_11d9e3bcdfede9ce5ce5ace2d129f1c4.svg HTTP/1.1Host: aadcdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://l0gin-microso.ftlivedocs.tech/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/microsoft_logo_564db913a7fa0ca42727161c6d031bef.svg HTTP/1.1Host: aadcdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://l0gin-microso.ftlivedocs.tech/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/backgrounds/2_11d9e3bcdfede9ce5ce5ace2d129f1c4.svg HTTP/1.1Host: aadcdn.msauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/microsoft_logo_564db913a7fa0ca42727161c6d031bef.svg HTTP/1.1Host: aadcdn.msauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=6Xtt1sBzydtZp6M&MD=91XKTh55 HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/asyncchunk/convergedlogin_pstringcustomizationhelper_4285088f1dbaf52a876d.js HTTP/1.1Host: aadcdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://l0gin-microso.ftlivedocs.tech/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/signin-options_3e3f6b73c3f310c31d2c4d131a8ab8c6.svg HTTP/1.1Host: aadcdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://l0gin-microso.ftlivedocs.tech/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/signin-options_3e3f6b73c3f310c31d2c4d131a8ab8c6.svg HTTP/1.1Host: aadcdn.msauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/asyncchunk/convergedlogin_pstringcustomizationhelper_4285088f1dbaf52a876d.js HTTP/1.1Host: aadcdn.msauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ab HTTP/1.1Host: evoke-windowsservices-tas.msedge.netCache-Control: no-store, no-cacheX-PHOTOS-CALLERID: 9NMPJ99VJBWVX-EVOKE-RING: X-WINNEXT-RING: PublicX-WINNEXT-TELEMETRYLEVEL: BasicX-WINNEXT-OSVERSION: 10.0.19045.0X-WINNEXT-APPVERSION: 1.23082.131.0X-WINNEXT-PLATFORM: DesktopX-WINNEXT-CANTAILOR: FalseX-MSEDGE-CLIENTID: {c1afbad7-f7da-40f2-92f9-8846a91d69bd}X-WINNEXT-PUBDEVICEID: dbfen2nYS7HW6ON4OdOknKxxv2CCI5LJBTojzDztjwI=If-None-Match: 2056388360_-1434155563Accept-Encoding: gzip, deflate, br
Source: global traffic	HTTP traffic detected: GET /client/config?cc=CH&setlang=en-CH HTTP/1.1X-Search-CortanaAvailableCapabilities: NoneX-Search-SafeSearch: ModerateAccept-Encoding: gzip, deflateX-Device-MachineId: {92C86F7C-DB2B-4F6A-95AD-98B4A2AE008A}X-UserAgeClass: UnknownX-BM-Market: CHX-BM-DateFormat: dd/MM/yyyyX-Device-OSSKU: 48X-BM-DTZ: -240X-DeviceID: 01000A41090080B6X-BM-WindowsFlights: FX:117B9872,FX:119E26AD,FX:11C0E96C,FX:11C6E5C2,FX:11C7EB6A,FX:11C9408A,FX:11C940DB,FX:11CB9A9F,FX:11CB9AC1,FX:11CC111C,FX:11D5BFCD,FX:11DF5B12,FX:11DF5B75,FX:1240931B,FX:124B38D0,FX:127FC878,FX:1283FFE8,FX:12840617,FX:128979F9,FX:128EBD7E,FX:129135BB,FX:129E053F,FX:12A74DB5,FX:12AB734D,FX:12B8450E,FX:12BD6E73,FX:12C3331B,FX:12C7D66EX-Search-TimeZone: Bias=300; DaylightBias=-60; TimeZoneKeyName=Eastern Standard TimeX-BM-Theme: 000000;0078d7X-Search-RPSToken: t%3DEwDoAkR8BAAUcvamItSE/vUHpyZRp3BeyOJPQDsAAbIzB0A4h2D%2BNkHrVkQylh58%2BvwMN/s6obbwPIDvP8RId7%2B52mg6j96NqltBLmSJDZq7dpan/Biy4iI94XRRBsKCwcQnYCkLPOqnjz8HPQwbOUE8Z1jVHWhD5RDayAmqSOaVYKZaqyvHF0Sbv7B6HLy1wh1STiGG8DdEISAuVtusyELKMwv7OLxWUZnZHDsm5ow0olTWYecTmkPOEw9B6plzponbdE%2BWd5JOar5hhsREUVwj6rVk2E2CX6pjwCdqrcUea1pn1cWWQNIc/IR/AZjod6v1bK9MiQXyhpG3or9vWDY62DKBleAo7GizRpXE%2BiCiOffEzOnWGviCSWajBi0QZgAAEM5S7DwxrwApMATd2WxVp%2BOwAZe1pwhoFYCyynam8KnopJ9vBSxTxxklQ1FROTdoEkZKx6JFCTcja4kqEh6US0eitvQbSqciLfwThHUrPrU/lBONghJO0/Os7D4evM374mWxI2PBgVfFuNR/Sm3CEB0Z4m/A%2B1UROyD6JVrVwbg8l1sFgfqSzvoElbGJyDztj9F/ntgpEX5klsqOFmA46%2BGcN%2BR242lQeArgSmStNBHstuGpa3JVd%2BFDN7XviS3AbKyPh/2E7G1m9VvFb5F76R1HUgzEvUyjUfFYL2CqJ32x2v0d3BGK4NNqLVo/tI%2BAaeAe1uLdM0Gcv2%2Bitf5%2BXvpvxojy9x7tTbQWWbomh5%2BgbwkmCye3SpUDCk2olN95yNqlaRBxFR4PxrYUGYITBj8%2BdQPhLChw9I2AIvPuEhO8eR8tqnk9/ROZe%2Bu9Iuxwr665N0M%2B/W6S37jrp%2Bgr0E1kU/dKfZL6dXH8oVdI/m4CXJS%2Bnw/kLEZhrVeU/lULXiX0hZQCYIEIsQ0Phgt/mQSb6yFidBHH1eLCfLOZAqAaH18vzs9mUepvhTOiCZ0s9REPadu7heYRnpsrfxiaFFEHRtcB%26p%3DX-Agent-DeviceId: 01000A41090080B6X-BM-CBT: 1728047494User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045X-Device-isOptin: falseAccept-language: en-GB, en, en-USX-Device-Touch: falseX-Device-ClientSession: 2578F7F661CB4F88B6597755BC50BB4AX-Search-AppId: Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUIHost: www.bing.comConnection: Keep-AliveCookie: SRCHUID=V=2&GUID=C4EAB6C130004333A34B5668AE4E4D10&dmnchg=1; SRCHD=AF=NOFORM; SRCHUSR=DOB=20240207; SRCHHPGUSR=SRCHLANG=en; MUID=4590362BB5CF472B95BBEDB3112D4B7B; MUIDB=4590362BB5CF472B95BBEDB3112D4B7B

Source: global traffic	DNS traffic detected: DNS query: nomicscare.com
Source: global traffic	DNS traffic detected: DNS query: crewbloom.s3.amazonaws.com
Source: global traffic	DNS traffic detected: DNS query: pbs.twimg.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: l0gin-microso.ftlivedocs.tech
Source: global traffic	DNS traffic detected: DNS query: challenges.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: a.nel.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: www.ftlivedocs.tech
Source: global traffic	DNS traffic detected: DNS query: aadcdn.msftauth.net
Source: global traffic	DNS traffic detected: DNS query: ywnjb.ftlivedocs.tech
Source: global traffic	DNS traffic detected: DNS query: identity.nel.measure.office.net

Source: unknown

HTTP traffic detected: POST /RST2.srf HTTP/1.0Connection: Keep-AliveContent-Type: application/soap+xmlAccept: */*User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68})Content-Length: 3592Host: login.live.com

Source: global traffic	HTTP traffic detected: HTTP/1.1 403 Forbiddenx-amz-request-id: M4RGGHMMMNGH1FQ7x-amz-id-2: J5FNCwYXYTAg7fPoukB+g+Tfvb9a72793pOw24cgCZ69wzj/Y5z6lbGwnDL5Rz2FwX/nHDyi7TPkKohyiW2t3Q==Content-Type: application/xmlTransfer-Encoding: chunkedDate: Fri, 04 Oct 2024 13:10:51 GMTServer: AmazonS3Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 04 Oct 2024 13:11:04 GMTTransfer-Encoding: chunkedConnection: closeCache-Control: privateNel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0}P3p: CP="DSP CUR OTPi IND OTRi ONL FIN"Referrer-Policy: strict-origin-when-cross-originReport-To: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://identity.nel.measure.office.net/api/report?catId=GW+estsfd+bno"}]}X-Ms-Ests-Server: 2.1.19005.9 - NCUS ProdSlicesX-Ms-Request-Id: f263b88c-7eca-4adc-9de0-66f6a6630600X-Ms-Srs: 1.PCF-Cache-Status: BYPASSSet-Cookie: x-ms-gateway-slice=estsfd; Path=/; HttpOnly; Secure; SameSite=NoneServer: cloudflareCF-RAY: 8cd56a6d09578c2f-EWR
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 04 Oct 2024 13:11:05 GMTContent-Type: application/jsonContent-Length: 7Connection: closecf-chl-out: PWLXgaJDLE27pSu3T4xa7t6dW6j7j0GRqiE=$Daohbmu9MW1icFpacache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0Server: cloudflareCF-RAY: 8cd56a739e050f3d-EWR
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 04 Oct 2024 13:11:08 GMTContent-Type: application/jsonContent-Length: 7Connection: closecache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0cf-chl-out: OJsGAxN8qj6DrvDaz5peZlZzqVoYom3qgeY=$pQsbHOjbUeTv7CMIServer: cloudflareCF-RAY: 8cd56a87cc940f9c-EWR

Source: chromecache_1178.12.dr	String found in binary or memory: https://ajax.googleapis.com/ajax/libs/jquery/3.2.1/jquery.min.js
Source: chromecache_1178.12.dr	String found in binary or memory: https://challenges.cloudflare.com/turnstile/v0/api.js?onload=onloadTurnstileCallback
Source: chromecache_1172.12.dr	String found in binary or memory: https://l0gin-microso.ftlivedocs.tech
Source: chromecache_1172.12.dr	String found in binary or memory: https://login.windows-ppe.net

Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49690
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 49844 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 49680 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49833 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49810 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 49845 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49811
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49810
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49809
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49808
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49804
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49803
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49802
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49800
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49821 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49690 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49809 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49843 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49832 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49846 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443

Source: rule700351v1.xml.3.dr	OLE indicator, VBA macros: true
Source: rule70036v0.xml.3.dr	OLE indicator, VBA macros: true
Source: rule70037v1.xml.3.dr	OLE indicator, VBA macros: true
Source: rule700400v2.xml.3.dr	OLE indicator, VBA macros: true
Source: rule700401v2.xml.3.dr	OLE indicator, VBA macros: true
Source: rule700450v1.xml.3.dr	OLE indicator, VBA macros: true
Source: rule700451v1.xml.3.dr	OLE indicator, VBA macros: true
Source: rule700500v1.xml.3.dr	OLE indicator, VBA macros: true
Source: rule700501v1.xml.3.dr	OLE indicator, VBA macros: true
Source: rule700550v1.xml.3.dr	OLE indicator, VBA macros: true
Source: rule700551v1.xml.3.dr	OLE indicator, VBA macros: true
Source: rule700600v1.xml.3.dr	OLE indicator, VBA macros: true
Source: rule700601v1.xml.3.dr	OLE indicator, VBA macros: true
Source: rule700650v1.xml.3.dr	OLE indicator, VBA macros: true
Source: rule700651v1.xml.3.dr	OLE indicator, VBA macros: true
Source: rule700700v1.xml.3.dr	OLE indicator, VBA macros: true
Source: rule700701v1.xml.3.dr	OLE indicator, VBA macros: true
Source: rule700750v1.xml.3.dr	OLE indicator, VBA macros: true
Source: rule700751v1.xml.3.dr	OLE indicator, VBA macros: true
Source: rule700850v1.xml.3.dr	OLE indicator, VBA macros: true
Source: rule700851v1.xml.3.dr	OLE indicator, VBA macros: true
Source: rule700900v1.xml.3.dr	OLE indicator, VBA macros: true
Source: rule700901v1.xml.3.dr	OLE indicator, VBA macros: true
Source: rule700950v1.xml.3.dr	OLE indicator, VBA macros: true
Source: rule700951v1.xml.3.dr	OLE indicator, VBA macros: true
Source: rule701050v1.xml.3.dr	OLE indicator, VBA macros: true
Source: rule701051v1.xml.3.dr	OLE indicator, VBA macros: true
Source: rule701100v1.xml.3.dr	OLE indicator, VBA macros: true
Source: rule701101v1.xml.3.dr	OLE indicator, VBA macros: true
Source: rule701150v1.xml.3.dr	OLE indicator, VBA macros: true
Source: rule701151v1.xml.3.dr	OLE indicator, VBA macros: true
Source: rule701200v1.xml.3.dr	OLE indicator, VBA macros: true
Source: rule701201v1.xml.3.dr	OLE indicator, VBA macros: true
Source: rule701250v1.xml.3.dr	OLE indicator, VBA macros: true
Source: rule701251v1.xml.3.dr	OLE indicator, VBA macros: true
Source: rule701300v1.xml.3.dr	OLE indicator, VBA macros: true
Source: rule701301v1.xml.3.dr	OLE indicator, VBA macros: true
Source: rule701350v1.xml.3.dr	OLE indicator, VBA macros: true
Source: rule701351v1.xml.3.dr	OLE indicator, VBA macros: true
Source: rule324004v4.xml.3.dr	OLE indicator, VBA macros: true
Source: rule701400v1.xml.3.dr	OLE indicator, VBA macros: true
Source: rule324005v2.xml.3.dr	OLE indicator, VBA macros: true
Source: rule701401v1.xml.3.dr	OLE indicator, VBA macros: true
Source: rule324005v3.xml.3.dr	OLE indicator, VBA macros: true
Source: rule701500v1.xml.3.dr	OLE indicator, VBA macros: true
Source: rule324006v2.xml.3.dr	OLE indicator, VBA macros: true
Source: rule701501v1.xml.3.dr	OLE indicator, VBA macros: true
Source: rule324006v3.xml.3.dr	OLE indicator, VBA macros: true
Source: rule701550v1.xml.3.dr	OLE indicator, VBA macros: true
Source: rule324007v2.xml.3.dr	OLE indicator, VBA macros: true
Source: rule701551v1.xml.3.dr	OLE indicator, VBA macros: true
Source: rule324007v3.xml.3.dr	OLE indicator, VBA macros: true
Source: rule701650v1.xml.3.dr	OLE indicator, VBA macros: true
Source: rule324008v2.xml.3.dr	OLE indicator, VBA macros: true
Source: rule701651v1.xml.3.dr	OLE indicator, VBA macros: true
Source: rule324008v3.xml.3.dr	OLE indicator, VBA macros: true
Source: rule324009v2.xml.3.dr	OLE indicator, VBA macros: true
Source: rule701700v1.xml.3.dr	OLE indicator, VBA macros: true
Source: rule701701v1.xml.3.dr	OLE indicator, VBA macros: true
Source: rule324009v3.xml.3.dr	OLE indicator, VBA macros: true
Source: rule701750v1.xml.3.dr	OLE indicator, VBA macros: true
Source: rule324010v2.xml.3.dr	OLE indicator, VBA macros: true
Source: rule701751v1.xml.3.dr	OLE indicator, VBA macros: true
Source: rule324010v3.xml.3.dr	OLE indicator, VBA macros: true
Source: rule701800v1.xml.3.dr	OLE indicator, VBA macros: true
Source: rule324011v1.xml.3.dr	OLE indicator, VBA macros: true
Source: rule701801v1.xml.3.dr	OLE indicator, VBA macros: true
Source: rule324012v3.xml.3.dr	OLE indicator, VBA macros: true
Source: rule701850v1.xml.3.dr	OLE indicator, VBA macros: true
Source: rule324013v0.xml.3.dr	OLE indicator, VBA macros: true
Source: rule701851v1.xml.3.dr	OLE indicator, VBA macros: true
Source: rule324014v0.xml.3.dr	OLE indicator, VBA macros: true
Source: rule701900v1.xml.3.dr	OLE indicator, VBA macros: true
Source: rule324015v0.xml.3.dr	OLE indicator, VBA macros: true
Source: rule701901v1.xml.3.dr	OLE indicator, VBA macros: true
Source: rule324016v0.xml.3.dr	OLE indicator, VBA macros: true
Source: rule325000v0.xml.3.dr	OLE indicator, VBA macros: true
Source: rule701950v1.xml.3.dr	OLE indicator, VBA macros: true
Source: rule701951v1.xml.3.dr	OLE indicator, VBA macros: true
Source: rule325001v0.xml.3.dr	OLE indicator, VBA macros: true
Source: rule702000v1.xml.3.dr	OLE indicator, VBA macros: true
Source: rule325002v0.xml.3.dr	OLE indicator, VBA macros: true
Source: rule702001v1.xml.3.dr	OLE indicator, VBA macros: true
Source: rule360000v3.xml.3.dr	OLE indicator, VBA macros: true
Source: rule702050v1.xml.3.dr	OLE indicator, VBA macros: true
Source: rule360001v3.xml.3.dr	OLE indicator, VBA macros: true
Source: rule702051v1.xml.3.dr	OLE indicator, VBA macros: true
Source: rule370000v1.xml.3.dr	OLE indicator, VBA macros: true
Source: rule702100v1.xml.3.dr	OLE indicator, VBA macros: true
Source: rule370001v2.xml.3.dr	OLE indicator, VBA macros: true
Source: rule702101v1.xml.3.dr	OLE indicator, VBA macros: true
Source: rule370002v2.xml.3.dr	OLE indicator, VBA macros: true
Source: rule702150v1.xml.3.dr	OLE indicator, VBA macros: true
Source: rule370005v1.xml.3.dr	OLE indicator, VBA macros: true
Source: rule702151v1.xml.3.dr	OLE indicator, VBA macros: true
Source: rule370006v0.xml.3.dr	OLE indicator, VBA macros: true
Source: rule370007v3.xml.3.dr	OLE indicator, VBA macros: true
Source: rule702200v1.xml.3.dr	OLE indicator, VBA macros: true
Source: rule702201v1.xml.3.dr	OLE indicator, VBA macros: true
Source: rule370009v0.xml.3.dr	OLE indicator, VBA macros: true
Source: rule702250v1.xml.3.dr	OLE indicator, VBA macros: true
Source: rule370011v1.xml.3.dr	OLE indicator, VBA macros: true
Source: rule702251v1.xml.3.dr	OLE indicator, VBA macros: true
Source: rule370012v0.xml.3.dr	OLE indicator, VBA macros: true
Source: rule702300v1.xml.3.dr	OLE indicator, VBA macros: true
Source: rule390004v3.xml.3.dr	OLE indicator, VBA macros: true
Source: rule702301v1.xml.3.dr	OLE indicator, VBA macros: true
Source: rule390005v1.xml.3.dr	OLE indicator, VBA macros: true
Source: rule702350v1.xml.3.dr	OLE indicator, VBA macros: true
Source: rule440000v3.xml.3.dr	OLE indicator, VBA macros: true
Source: rule702351v1.xml.3.dr	OLE indicator, VBA macros: true
Source: rule460008v0.xml.3.dr	OLE indicator, VBA macros: true
Source: rule702400v1.xml.3.dr	OLE indicator, VBA macros: true
Source: rule460009v0.xml.3.dr	OLE indicator, VBA macros: true
Source: rule702401v1.xml.3.dr	OLE indicator, VBA macros: true
Source: rule490002v13.xml.3.dr	OLE indicator, VBA macros: true
Source: rule490003v7.xml.3.dr	OLE indicator, VBA macros: true
Source: rule702450v1.xml.3.dr	OLE indicator, VBA macros: true
Source: rule702451v1.xml.3.dr	OLE indicator, VBA macros: true
Source: rule490004v7.xml.3.dr	OLE indicator, VBA macros: true
Source: rule702500v1.xml.3.dr	OLE indicator, VBA macros: true
Source: rule490005v3.xml.3.dr	OLE indicator, VBA macros: true
Source: rule702501v1.xml.3.dr	OLE indicator, VBA macros: true
Source: rule150246v2.xml.3.dr	OLE indicator, VBA macros: true
Source: rule490009v5.xml.3.dr	OLE indicator, VBA macros: true
Source: rule702550v1.xml.3.dr	OLE indicator, VBA macros: true
Source: rule150249v0.xml.3.dr	OLE indicator, VBA macros: true
Source: rule490010v7.xml.3.dr	OLE indicator, VBA macros: true
Source: rule702551v1.xml.3.dr	OLE indicator, VBA macros: true
Source: rule150259v1.xml.3.dr	OLE indicator, VBA macros: true
Source: rule490011v4.xml.3.dr	OLE indicator, VBA macros: true
Source: rule702600v1.xml.3.dr	OLE indicator, VBA macros: true
Source: rule150262v1.xml.3.dr	OLE indicator, VBA macros: true
Source: rule490014v2.xml.3.dr	OLE indicator, VBA macros: true
Source: rule702601v1.xml.3.dr	OLE indicator, VBA macros: true
Source: rule170000v6.xml.3.dr	OLE indicator, VBA macros: true
Source: rule490015v2.xml.3.dr	OLE indicator, VBA macros: true
Source: rule702650v1.xml.3.dr	OLE indicator, VBA macros: true
Source: rule170002v6.xml.3.dr	OLE indicator, VBA macros: true
Source: rule490015v3.xml.3.dr	OLE indicator, VBA macros: true
Source: rule702651v1.xml.3.dr	OLE indicator, VBA macros: true
Source: rule170003v1.xml.3.dr	OLE indicator, VBA macros: true
Source: rule490015v4.xml.3.dr	OLE indicator, VBA macros: true
Source: rule170005v2.xml.3.dr	OLE indicator, VBA macros: true
Source: rule490015v5.xml.3.dr	OLE indicator, VBA macros: true
Source: rule170007v5.xml.3.dr	OLE indicator, VBA macros: true
Source: rule170009v1.xml.3.dr	OLE indicator, VBA macros: true
Source: rule702700v1.xml.3.dr	OLE indicator, VBA macros: true
Source: rule702701v1.xml.3.dr	OLE indicator, VBA macros: true
Source: rule490016v3.xml.3.dr	OLE indicator, VBA macros: true
Source: rule702750v1.xml.3.dr	OLE indicator, VBA macros: true
Source: rule490018v3.xml.3.dr	OLE indicator, VBA macros: true
Source: rule702751v1.xml.3.dr	OLE indicator, VBA macros: true
Source: rule170011v2.xml.3.dr	OLE indicator, VBA macros: true
Source: rule490020v3.xml.3.dr	OLE indicator, VBA macros: true

Source: rule700351v1.xml.3.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: rule70036v0.xml.3.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: rule70037v1.xml.3.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: rule700400v2.xml.3.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: rule700401v2.xml.3.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: rule700450v1.xml.3.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: rule700451v1.xml.3.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: rule700500v1.xml.3.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: rule700501v1.xml.3.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: rule700550v1.xml.3.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: rule700551v1.xml.3.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: rule700600v1.xml.3.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: rule700601v1.xml.3.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: rule700650v1.xml.3.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: rule700651v1.xml.3.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: rule700700v1.xml.3.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: rule700701v1.xml.3.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: rule700750v1.xml.3.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: rule700751v1.xml.3.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: rule700850v1.xml.3.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: rule700851v1.xml.3.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: rule700900v1.xml.3.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: rule700901v1.xml.3.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: rule700950v1.xml.3.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: rule700951v1.xml.3.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: rule701050v1.xml.3.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: rule701051v1.xml.3.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: rule701100v1.xml.3.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: rule701101v1.xml.3.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: rule701150v1.xml.3.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: rule701151v1.xml.3.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: rule701200v1.xml.3.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: rule701201v1.xml.3.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: rule701250v1.xml.3.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: rule701251v1.xml.3.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: rule701300v1.xml.3.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: rule701301v1.xml.3.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: rule701350v1.xml.3.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: rule701351v1.xml.3.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: rule324004v4.xml.3.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: rule701400v1.xml.3.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: rule324005v2.xml.3.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: rule701401v1.xml.3.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: rule324005v3.xml.3.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: rule701500v1.xml.3.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: rule324006v2.xml.3.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: rule701501v1.xml.3.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: rule324006v3.xml.3.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: rule701550v1.xml.3.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: rule324007v2.xml.3.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: rule701551v1.xml.3.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: rule324007v3.xml.3.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: rule701650v1.xml.3.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: rule324008v2.xml.3.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: rule701651v1.xml.3.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: rule324008v3.xml.3.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: rule324009v2.xml.3.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: rule701700v1.xml.3.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: rule701701v1.xml.3.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: rule324009v3.xml.3.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: rule701750v1.xml.3.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: rule324010v2.xml.3.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: rule701751v1.xml.3.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: rule324010v3.xml.3.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: rule701800v1.xml.3.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: rule324011v1.xml.3.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: rule701801v1.xml.3.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: rule324012v3.xml.3.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: rule701850v1.xml.3.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: rule324013v0.xml.3.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: rule701851v1.xml.3.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: rule324014v0.xml.3.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: rule701900v1.xml.3.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: rule324015v0.xml.3.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: rule701901v1.xml.3.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: rule324016v0.xml.3.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: rule325000v0.xml.3.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: rule701950v1.xml.3.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: rule701951v1.xml.3.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: rule325001v0.xml.3.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: rule702000v1.xml.3.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: rule325002v0.xml.3.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: rule702001v1.xml.3.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: rule360000v3.xml.3.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: rule702050v1.xml.3.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: rule360001v3.xml.3.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: rule702051v1.xml.3.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: rule370000v1.xml.3.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: rule702100v1.xml.3.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: rule370001v2.xml.3.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: rule702101v1.xml.3.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: rule370002v2.xml.3.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: rule702150v1.xml.3.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: rule370005v1.xml.3.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: rule702151v1.xml.3.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: rule370006v0.xml.3.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: rule370007v3.xml.3.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: rule702200v1.xml.3.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: rule702201v1.xml.3.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: rule370009v0.xml.3.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: rule702250v1.xml.3.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: rule370011v1.xml.3.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: rule702251v1.xml.3.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: rule370012v0.xml.3.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: rule702300v1.xml.3.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: rule390004v3.xml.3.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: rule702301v1.xml.3.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: rule390005v1.xml.3.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: rule702350v1.xml.3.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: rule440000v3.xml.3.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: rule702351v1.xml.3.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: rule460008v0.xml.3.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: rule702400v1.xml.3.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: rule460009v0.xml.3.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: rule702401v1.xml.3.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: rule490002v13.xml.3.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: rule490003v7.xml.3.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: rule702450v1.xml.3.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: rule702451v1.xml.3.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: rule490004v7.xml.3.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: rule702500v1.xml.3.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: rule490005v3.xml.3.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: rule702501v1.xml.3.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: rule150246v2.xml.3.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: rule490009v5.xml.3.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: rule702550v1.xml.3.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: rule150249v0.xml.3.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: rule490010v7.xml.3.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: rule702551v1.xml.3.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: rule150259v1.xml.3.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: rule490011v4.xml.3.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: rule702600v1.xml.3.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: rule150262v1.xml.3.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: rule490014v2.xml.3.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: rule702601v1.xml.3.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: rule170000v6.xml.3.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: rule490015v2.xml.3.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: rule702650v1.xml.3.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: rule170002v6.xml.3.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: rule490015v3.xml.3.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: rule702651v1.xml.3.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: rule170003v1.xml.3.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: rule490015v4.xml.3.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: rule170005v2.xml.3.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: rule490015v5.xml.3.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: rule170007v5.xml.3.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: rule170009v1.xml.3.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: rule702700v1.xml.3.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: rule702701v1.xml.3.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: rule490016v3.xml.3.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: rule702750v1.xml.3.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: rule490018v3.xml.3.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: rule702751v1.xml.3.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: rule170011v2.xml.3.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: rule490020v3.xml.3.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false

Source: unknown	Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\POWERPNT.EXE" "C:\Users\user\Desktop\Payout Receipt.pptx" /ou ""
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Process created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "4F1F87A3-2D62-4CDB-ABDF-61BB45105DB2" "40BB7578-B581-41D4-B322-FEC0ED1808AE" "6380" "C:\Program Files (x86)\Microsoft Office\Root\Office16\POWERPNT.EXE" "PowerPointCombinedFloatieLreOnline.onnx"
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://nomicscare.com/fr/gdpr/cookie-consent/all/?next_url=//crewbloom.s3.amazonaws.com/34873.html
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 --field-trial-handle=1944,i,8800721303449338163,5848358366860922411,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Process created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "4F1F87A3-2D62-4CDB-ABDF-61BB45105DB2" "40BB7578-B581-41D4-B322-FEC0ED1808AE" "6380" "C:\Program Files (x86)\Microsoft Office\Root\Office16\POWERPNT.EXE" "PowerPointCombinedFloatieLreOnline.onnx"	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 --field-trial-handle=1944,i,8800721303449338163,5848358366860922411,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: c2r64.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: gpapi.dll	Jump to behavior

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	Windows Management Instrumentation	1 Scripting	1 Process Injection	1 Masquerading	OS Credential Dumping	1 Process Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 DLL Side-Loading	1 DLL Side-Loading	1 Process Injection	LSASS Memory	1 File and Directory Discovery	Remote Desktop Protocol	Data from Removable Media	4 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 Registry Run Keys / Startup Folder	1 Registry Run Keys / Startup Folder	1 DLL Side-Loading	Security Account Manager	12 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	5 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 Extra Window Memory Injection	1 Extra Window Memory Injection	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	3 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Name	IP	Active	Malicious	Reputation
s3-w.us-east-1.amazonaws.com	3.5.1.122	true	false	unknown
nomicscare.com	51.255.64.170	true	false	unknown
a.nel.cloudflare.com	35.190.80.1	true	false	unknown
dualstack.twimg.twitter.map.fastly.net	146.75.52.159	true	false	unknown
l0gin-microso.ftlivedocs.tech	104.26.12.69	true	true	unknown
challenges.cloudflare.com	104.18.95.41	true	false	unknown
s-part-0017.t-0009.t-msedge.net	13.107.246.45	true	false	unknown
sni1gl.wpc.omegacdn.net	152.199.21.175	true	false	unknown
www.google.com	142.250.185.68	true	false	unknown
www.ftlivedocs.tech	172.67.71.124	true	false	unknown
s-part-0032.t-0009.t-msedge.net	13.107.246.60	true	false	unknown
ywnjb.ftlivedocs.tech	172.67.71.124	true	false	unknown
crewbloom.s3.amazonaws.com	unknown	unknown	false	unknown
identity.nel.measure.office.net	unknown	unknown	false	unknown
pbs.twimg.com	unknown	unknown	false	unknown
aadcdn.msftauth.net	unknown	unknown	false	unknown

Name	Malicious	Antivirus Detection	Reputation
https://l0gin-microso.ftlivedocs.tech/favicon.ico	false		unknown
https://challenges.cloudflare.com/turnstile/v0/g/ec4b873d446c/api.js	false		unknown
https://ywnjb.ftlivedocs.tech/Me.htm?v=3	false		unknown
https://l0gin-microso.ftlivedocs.tech/cdn-cgi/challenge-platform/h/g/scripts/jsd/ec4b873d446c/main.js?	false		unknown
https://l0gin-microso.ftlivedocs.tech/cdn-cgi/challenge-platform/scripts/jsd/main.js	false		unknown
https://l0gin-microso.ftlivedocs.tech/KUtIdFka?S=UmxuHlo	true		unknown
https://l0gin-microso.ftlivedocs.tech/KUtIdFka	true		unknown
https://www.ftlivedocs.tech/login	false		unknown
https://l0gin-microso.ftlivedocs.tech/cdn-cgi/challenge-platform/h/g/jsd/r/8cd56a496a3b5e6a	false		unknown
https://challenges.cloudflare.com/turnstile/v0/api.js?onload=onloadTurnstileCallback	false		unknown
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/i/8cd56a630cf741e3/1728047464607/YBBtqSrR-kb7LqJ	false		unknown
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/pat/8cd56a630cf741e3/1728047464610/6315a5703f342bce662661e8fa8e5cfbec36c51d90ea70cfa211f89c976d3430/n-8rMprBONH9scU	false		unknown
https://l0gin-microso.ftlivedocs.tech/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638636442697330204.NjIwZWJjNjEtNmMyNi00NTY5LWFhMWItYzQ4NTQyOWEzNGQ0MjMxNjBhODctYjRiNy00ZmQ5LWI0MzMtNWU1NmMxYjE0NWMx&ui_locales=en-US&mkt=en-US&client-request-id=37a08538-dff5-407d-be68-819033033a7a&state=KXouNT3DCC4nJGmZ0UPqr43DvOETQcMOHzyW3XKW_GmmSSP1vhdbuw5XASgqJ79HETi6JwhHJ6QWBKwBMy02TUIwHPB3pd6CKYG_YWqx9kPhyBezozkFI1hhf1DwNAMV6i3WbD94ziRYYdhiW7ILPzoTsrP8EPqDjpPTPwsGlE2ddaYguV0DrAR1iKncN8RtOGlb_uoJSY4fDM1dafLvW1gf5IX7c3_kF1zQXY4vcldCPOaUyZ98s32esN_GOxDd6BxYK5bGLDx5Op0mZGALvw&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0	true		unknown
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/bth64/0x4AAAAAAAwd9hw5rvoDjM7I/auto/fbE/normal/auto/	false		unknown
https://l0gin-microso.ftlivedocs.tech/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638636442697330204.NjIwZWJjNjEtNmMyNi00NTY5LWFhMWItYzQ4NTQyOWEzNGQ0MjMxNjBhODctYjRiNy00ZmQ5LWI0MzMtNWU1NmMxYjE0NWMx&ui_locales=en-US&mkt=en-US&client-request-id=37a08538-dff5-407d-be68-819033033a7a&state=KXouNT3DCC4nJGmZ0UPqr43DvOETQcMOHzyW3XKW_GmmSSP1vhdbuw5XASgqJ79HETi6JwhHJ6QWBKwBMy02TUIwHPB3pd6CKYG_YWqx9kPhyBezozkFI1hhf1DwNAMV6i3WbD94ziRYYdhiW7ILPzoTsrP8EPqDjpPTPwsGlE2ddaYguV0DrAR1iKncN8RtOGlb_uoJSY4fDM1dafLvW1gf5IX7c3_kF1zQXY4vcldCPOaUyZ98s32esN_GOxDd6BxYK5bGLDx5Op0mZGALvw&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0&sso_reload=true	true		unknown
https://pbs.twimg.com/media/GGrR89_WgAAgrOI?format=jpg&name=large	false		unknown
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/cmg/1/wh0E0SXYnx6pTBdJW%2Fl926I%2BPRUplRdtQz3K9lHXs%2Fs%3D	false		unknown
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/flow/ov1/147669712:1728044744:0OaiWMyJW7ZPxlqedXMft6P244b4nMflF1Cf4AK8E-k/8cd56a630cf741e3/fc3fc94e9e3547a	false		unknown
https://l0gin-microso.ftlivedocs.tech/	false		unknown
https://crewbloom.s3.amazonaws.com/34873.html	true	SlashNext: Credential Stealing type: Phishing & Social Engineering	unknown
https://nomicscare.com/fr/gdpr/cookie-consent/all/?next_url=//crewbloom.s3.amazonaws.com/34873.html	false		unknown
https://crewbloom.s3.amazonaws.com/favicon.ico	false		unknown
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/orchestrate/chl_api/v1?ray=8cd56a630cf741e3&lang=auto	false		unknown

Name	Source	Malicious	Antivirus Detection	Reputation
https://login.windows-ppe.net	chromecache_1172.12.dr	false		unknown
https://l0gin-microso.ftlivedocs.tech	chromecache_1172.12.dr	false		unknown

IP	Domain	Country	ASN	ASN Name	Malicious
13.107.246.45	s-part-0017.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
146.75.52.159	dualstack.twimg.twitter.map.fastly.net	Sweden	30051	SCCGOVUS	false
3.5.1.122	s3-w.us-east-1.amazonaws.com	United States	14618	AMAZON-AESUS	false
13.107.246.60	s-part-0032.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
104.26.13.69	unknown	United States	13335	CLOUDFLARENETUS	false
51.255.64.170	nomicscare.com	France	16276	OVHFR	false
35.190.80.1	a.nel.cloudflare.com	United States	15169	GOOGLEUS	false
142.250.185.68	www.google.com	United States	15169	GOOGLEUS	false
172.67.71.124	www.ftlivedocs.tech	United States	13335	CLOUDFLARENETUS	false
104.18.95.41	challenges.cloudflare.com	United States	13335	CLOUDFLARENETUS	false
104.26.12.69	l0gin-microso.ftlivedocs.tech	United States	13335	CLOUDFLARENETUS	true
239.255.255.250	unknown	Reserved	unknown	unknown	false

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1525814
Start date and time:	2024-10-04 15:09:07 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 3s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	21
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Payout Receipt.pptx
Detection:	MAL
Classification:	mal76.phis.winPPTX@20/1149@30/13
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .pptx

Source	URL
Screenshot	https://nomicscare.com/fr/gdpr/cookie-consent/all/?next_url=//crewbloom.s3.amazonaws.com/34873.html
Screenshot	https://nomicscare.com/fr/gdpr/cookie-consent/all/?next_url=//crewbloom.s3.amazonaws.com/34873.html
Screenshot	https://nomicscare.com/fr/gdpr/cookie-consent/all/?next_url=//crewbloom.s3.amazonaws.com/34873.html

Input	Output
URL: https://crewbloom.s3.amazonaws.com/34873.html Model: jbxai	{ "brand":["Microsoft"], "contains_trigger_text":false, "trigger_text":"", "prominent_button_name":"unknown", "text_input_field_labels":"unknown", "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

URL: https://crewbloom.s3.amazonaws.com/34873.html Model: jbxai	{ "brand":["Microsoft"], "contains_trigger_text":false, "trigger_text":"", "prominent_button_name":"unknown", "text_input_field_labels":"unknown", "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

URL: https://l0gin-microso.ftlivedocs.tech/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv Model: jbxai	{ "brand":["Microsoft"], "contains_trigger_text":true, "trigger_text":"Sign in", "prominent_button_name":"Next", "text_input_field_labels":["Email", "phone", "Skype"], "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

URL: https://l0gin-microso.ftlivedocs.tech/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv Model: jbxai	{ "phishing_score":9, "brands":"Microsoft", "legit_domain":"microsoft.com", "classification":"wellknown", "reasons":["The brand 'Microsoft' is a well-known technology company with a legitimate domain of 'microsoft.com'.", "The URL 'l0gin-microso.ftlivedocs.tech' contains several suspicious elements: 'l0gin' instead of 'login', 'microso' instead of 'microsoft', and an unusual domain extension '.tech'.", "The domain 'ftlivedocs.tech' does not match the legitimate domain associated with Microsoft.", "The use of a hyphen and misspellings in the URL are common phishing tactics.", "The presence of an input field for 'Email' suggests an attempt to collect sensitive information, which is typical in phishing sites."], "brand_matches":[false], "url_match":false, "brand_input":"Microsoft", "input_fields":"Email"}

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
13.107.246.45	https://pcefan.com/diary/index.php?st-manager=1&path=/click/track&id=4973&type=ranking&url=http://nam.dcv.ms/BxPVLH2cz4	Get hash	malicious	HTMLPhisher	Browse	nam.dcv.ms/BxPVLH2cz4
172.67.71.124	where to find rrsp contract number 19034.js	Get hash	malicious	Unknown	Browse
146.75.52.159	https://jhansalazar.weebly.com/	Get hash	malicious	Unknown	Browse
	http://ogp.me/ns#	Get hash	malicious	Unknown	Browse
	ORA _ Morningstar DBRS.html	Get hash	malicious	Unknown	Browse
	http://nursing-theory.org/	Get hash	malicious	Coinimp	Browse
	http://lifelovemama.cloud/?dD1jJmQ9OTYyODEmbD0yMzgzMSZjPTMwNjM0MA==	Get hash	malicious	Phisher	Browse
	https://s.id/1GOxy	Get hash	malicious	Unknown	Browse
104.18.95.41	Hollandco-File-871871493.pdf	Get hash	malicious	Unknown	Browse
	https://www.google.com/url?sa=t&url=https%3A%2F%2F%6d%6f%73%63%76%61%64%75%6d%61%2e%70%72%6f%2F&usg=AOvVaw0d8WU-1rxjmcdGQTa3JxQL&opi=	Get hash	malicious	HTMLPhisher	Browse
	https://app.collabow.io/d/GNgkdZO5gKluqEP3mMdbEwzWbgEyOeRe8sIh64SLMvsN	Get hash	malicious	Unknown	Browse
	https://kakeza.com/aW5mb0BkZXNpZ25lcm91dGxldG5ldW11ZW5zdGVyLmRl&NrPFWwrrioJP&hmr&x-af-vt&02810264	Get hash	malicious	HTMLPhisher	Browse
	https://docsignfile.z13.web.core.windows.net/&redirect_mongo_id=66fea70f62194c155d978939&utm_source=Springbot&utm_medium=Email&utm_campaign=66fea70f62194c155d97893a	Get hash	malicious	HTMLPhisher	Browse
	https://docsignfile.z13.web.core.windows.net/&redirect_mongo_id=66fea70f62194c155d978939&utm_source=Springbot&utm_medium=Email&utm_campaign=66fea70f62194c155d97893a	Get hash	malicious	Unknown	Browse
	faststone-capture_voLss-1.exe	Get hash	malicious	PureLog Stealer	Browse
	http://perweierscotish.online	Get hash	malicious	HtmlDropper	Browse
	https://microsoftonlineworking.pages.dev/#?email=YW5kcmV3X2hvbHRAdGFjLnZpYy5nb3YuYXU=	Get hash	malicious	ReCaptcha Phish	Browse
	https://microsoftonlineworking.pages.dev/#?email=YW5kcmV3X2hvbHRAdGFjLnZpYy5nb3YuYXU=	Get hash	malicious	ReCaptcha Phish	Browse
13.107.246.60	https://protect-us.mimecast.com/s/wFHoCqxrAnt7V914iZaD1v	Get hash	malicious	Unknown	Browse	www.mimecast.com/Customers/Support/Contact-support/
13.107.246.60	http://wellsfargo.dealogic.com/clientportal/Conferences/Registration/Form/368?menuItemId=5	Get hash	malicious	Unknown	Browse	wellsfargo.dealogic.com/clientportal/Conferences/Registration/Form/368?menuItemId=5

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
MICROSOFT-CORP-MSN-AS-BLOCKUS	AHCHICSvjmApRFFQmAQXRyNbw.ps1	Get hash	malicious	Unknown	Browse	150.171.27.10
	https://www.dropbox.com/l/scl/AACFGimR3EJt-RbOzI8FO3hUk-bWh7Zwq_k	Get hash	malicious	Unknown	Browse	13.107.42.14
	https://www.wbtd.com/	Get hash	malicious	Unknown	Browse	20.157.217.65
	https://www.thefirsthbcu.com/	Get hash	malicious	HTMLPhisher	Browse	13.107.246.60
	hJABTqngKoJnTgLh.ps1	Get hash	malicious	Unknown	Browse	150.171.28.10
	CHDLSHtWbSRCfzJMtDO.ps1	Get hash	malicious	Unknown	Browse	150.171.28.10
	http://ogp.me/ns#	Get hash	malicious	Unknown	Browse	150.171.27.10
	PO20241003.xls	Get hash	malicious	Unknown	Browse	13.107.253.72
	https://kakeza.com/aW5mb0BkZXNpZ25lcm91dGxldG5ldW11ZW5zdGVyLmRl&NrPFWwrrioJP&hmr&x-af-vt&02810264	Get hash	malicious	HTMLPhisher	Browse	20.162.120.23
	SWIFT 103 202406111301435660 110624-pdf.vbs	Get hash	malicious	Remcos	Browse	13.107.253.45
SCCGOVUS	https://jhansalazar.weebly.com/	Get hash	malicious	Unknown	Browse	146.75.52.158
	https://www.dropbox.com/l/scl/AACFGimR3EJt-RbOzI8FO3hUk-bWh7Zwq_k	Get hash	malicious	Unknown	Browse	146.75.52.157
	hJABTqngKoJnTgLh.ps1	Get hash	malicious	Unknown	Browse	146.75.52.157
	http://ogp.me/ns#	Get hash	malicious	Unknown	Browse	146.75.52.158
	ORA _ Morningstar DBRS.html	Get hash	malicious	Unknown	Browse	146.75.52.158
	http://reviewnewdocuments.wordpress.com/	Get hash	malicious	Unknown	Browse	146.75.52.157
	https://trello.com/c/2T5XVROV	Get hash	malicious	HTMLPhisher	Browse	146.75.88.157
	1bhYyrjyNk.vbs	Get hash	malicious	Unknown	Browse	146.75.116.223
	WQRNV7bMS5.vbs	Get hash	malicious	Unknown	Browse	146.75.116.223
	6L9vCf48mN.vbs	Get hash	malicious	Unknown	Browse	146.75.116.223
AMAZON-AESUS	https://jhansalazar.weebly.com/	Get hash	malicious	Unknown	Browse	3.82.83.121
	c42oX67S73.ps1	Get hash	malicious	Unknown	Browse	52.23.7.200
	AHCHICSvjmApRFFQmAQXRyNbw.ps1	Get hash	malicious	Unknown	Browse	34.236.124.61
	https://www.dropbox.com/l/scl/AACFGimR3EJt-RbOzI8FO3hUk-bWh7Zwq_k	Get hash	malicious	Unknown	Browse	35.169.41.95
	https://www.wbtd.com/	Get hash	malicious	Unknown	Browse	34.197.42.150
	https://www.thefirsthbcu.com/	Get hash	malicious	HTMLPhisher	Browse	3.233.158.26
	hJABTqngKoJnTgLh.ps1	Get hash	malicious	Unknown	Browse	34.193.113.164
	CHDLSHtWbSRCfzJMtDO.ps1	Get hash	malicious	Unknown	Browse	54.210.189.148
	http://ogp.me/ns#	Get hash	malicious	Unknown	Browse	54.165.87.158
	presupuesto urgente.exe	Get hash	malicious	FormBook, GuLoader	Browse	184.73.212.51
MICROSOFT-CORP-MSN-AS-BLOCKUS	AHCHICSvjmApRFFQmAQXRyNbw.ps1	Get hash	malicious	Unknown	Browse	150.171.27.10
	https://www.dropbox.com/l/scl/AACFGimR3EJt-RbOzI8FO3hUk-bWh7Zwq_k	Get hash	malicious	Unknown	Browse	13.107.42.14
	https://www.wbtd.com/	Get hash	malicious	Unknown	Browse	20.157.217.65
	https://www.thefirsthbcu.com/	Get hash	malicious	HTMLPhisher	Browse	13.107.246.60
	hJABTqngKoJnTgLh.ps1	Get hash	malicious	Unknown	Browse	150.171.28.10
	CHDLSHtWbSRCfzJMtDO.ps1	Get hash	malicious	Unknown	Browse	150.171.28.10
	http://ogp.me/ns#	Get hash	malicious	Unknown	Browse	150.171.27.10
	PO20241003.xls	Get hash	malicious	Unknown	Browse	13.107.253.72
	https://kakeza.com/aW5mb0BkZXNpZ25lcm91dGxldG5ldW11ZW5zdGVyLmRl&NrPFWwrrioJP&hmr&x-af-vt&02810264	Get hash	malicious	HTMLPhisher	Browse	20.162.120.23
	SWIFT 103 202406111301435660 110624-pdf.vbs	Get hash	malicious	Remcos	Browse	13.107.253.45

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	Hollandco-File-871871493.pdf	Get hash	malicious	Unknown	Browse	4.175.87.197 20.190.159.2
	263528293882.html	Get hash	malicious	HTMLPhisher	Browse	4.175.87.197 20.190.159.2
	https://jhansalazar.weebly.com/	Get hash	malicious	Unknown	Browse	4.175.87.197 20.190.159.2
	https://hblitigation-news.com/	Get hash	malicious	Unknown	Browse	4.175.87.197 20.190.159.2
	https://www.google.com/url?sa=t&url=https%3A%2F%2F%6d%6f%73%63%76%61%64%75%6d%61%2e%70%72%6f%2F&usg=AOvVaw0d8WU-1rxjmcdGQTa3JxQL&opi=	Get hash	malicious	HTMLPhisher	Browse	4.175.87.197 20.190.159.2
	https://www.ceolaser.com.mx	Get hash	malicious	Unknown	Browse	4.175.87.197 20.190.159.2
	https://test1web.edukati2.websku.com/	Get hash	malicious	Unknown	Browse	4.175.87.197 20.190.159.2
	http://url5892.equipgreen.com/ls/click?upn=u001.QnVyUTRnA6m7Ys04OcfRK-2BmYDxK-2BPvo2SH4SnTHtM2ahAlVLCP5CpZxqdikPch52bwE-2B6FGVTHUfa6r6g-2FUXtg-3D-3DRRNj_h5tndX3XP82u2CVP7HmVo4t-2FDkgNbuc-2FvPQxBNjqhqQfNFsb7fTdfgoFOkzI-2Bxa5KYPUiZS4W-2FgvgYDkntJEAhmsWMOHAu7qmcDzwEsnQtseb3y8TmhK-2BeBLagbYZa-2Fl5PaNGlzycBP9wt-2Bx-2BIF8M6H7XNSfHFanKHmI0XclVmtDLdFtwBZAykMNol-2B1EVQFYL6mFcaqBDNwcneuaiLfRiDR-2FpEOaIMkXlnRLaWty4mFpZlGkJkD2RATf5aYVpVmITUImq0A03rBAVtkq8oTcm0pf7AnRvvjfggEzQM-2FBDJTgvat7iExDFu-2FC1T1blavXJCuw6WT3ULqe7EEFzwLpISA11fryJZChsjBogHU4mmljbR7myqEHYvHOs-2BwDsboMOlR8BgyLszRlTVGoHnspaKXf-2BkOLcDw7PJIrD7-2FlwFq18AGU-2BMCwieNwipGZ43aaplrmL164T9c9GFx1PNH2NTQ8QQdXqSUL2c6Z6-2B1ninN2347XsTbH1kOcG-2Baj-2BmKRd-2BNrQ8HjKbgibY3if2Dc-2FillftKg-2BOAfAsCUg0buauclIIXkY9pJgbAiU0QED9OnFbExZCCtlYAvJNOed7N4zn56A55lVm-2FpSqvOehGwGBaKqQa4ttNoFB-2BYOeC0wYp71SC66lbF9C6FtGbF3Qpgus3-2BPuAKrmA6O2Su9CLsGxY9NfltTk4RJkxZjzDErPRMi6bSkxScSDRk90tJqNxYpDyXtYZlskKpQ4HdVrTPlGs8-2B-2FHPDDSgN-2BZxT1dhGovf81VbcvTPC13GKhBBaLTvYpomEVB24raM-2Fz7Xk5U-2B8zKTebMlP-2B767ISJjSJ4FsIMohGUw1oYLuomExXvt4SjzjZbOP9qyB9S-2BEqd7x6PZREvV2dm-2BJKbb6DwZmKWxW1lJB4QpPTNqpO9GdNhkZb7A-3D-3D	Get hash	malicious	Unknown	Browse	4.175.87.197 20.190.159.2
	https://indexconectada.net.br/	Get hash	malicious	Unknown	Browse	4.175.87.197 20.190.159.2
	https://app.collabow.io/d/GNgkdZO5gKluqEP3mMdbEwzWbgEyOeRe8sIh64SLMvsN	Get hash	malicious	Unknown	Browse	4.175.87.197 20.190.159.2
6271f898ce5be7dd52b0fc260d0662b3	Hollandco-File-871871493.pdf	Get hash	malicious	Unknown	Browse	2.23.209.133
	c42oX67S73.ps1	Get hash	malicious	Unknown	Browse	2.23.209.133
	PO20241003.xls	Get hash	malicious	Unknown	Browse	2.23.209.133
	https://ahchoadeegu.homes?u=k8pp605&o=c9ewtnr&t=8845	Get hash	malicious	Unknown	Browse	2.23.209.133
	QT2Q1292300924.xla.xlsx	Get hash	malicious	Unknown	Browse	2.23.209.133
	DHL Receipt_AWB 9892671327.xls	Get hash	malicious	Unknown	Browse	2.23.209.133
	Payment proof.xls	Get hash	malicious	Unknown	Browse	2.23.209.133
	MVR-00876 CARRARO ITALIA SPA.xls	Get hash	malicious	Unknown	Browse	2.23.209.133
	4DC70000.xls	Get hash	malicious	Unknown	Browse	2.23.209.133
	http://fpnc.vnvrff.com/	Get hash	malicious	Unknown	Browse	2.23.209.133
3b5074b1b5d032e5620f69f9f700ff0e	QUOTATIONS#08673.exe	Get hash	malicious	AgentTesla	Browse	13.107.5.88
	file.exe	Get hash	malicious	Unknown	Browse	13.107.5.88
	rTCTdVVTSwCdqkFxlFIpU.ps1	Get hash	malicious	Unknown	Browse	13.107.5.88
	WqZxLxZrOrnMWYaBaBKdLenVTu.ps1	Get hash	malicious	Unknown	Browse	13.107.5.88
	SWIFT 103 202406111301435660 110624-pdf.vbs	Get hash	malicious	Remcos	Browse	13.107.5.88
	yvDk2VZluODBu6S.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	13.107.5.88
	TRANSFERENCIAS.vbs	Get hash	malicious	FormBook	Browse	13.107.5.88
	file.exe	Get hash	malicious	Credential Flusher	Browse	13.107.5.88
	QUOTATION_OCTQTRA071244PDF.scr.exe	Get hash	malicious	Unknown	Browse	13.107.5.88
	TRANSFERENCIAS.vbs	Get hash	malicious	FormBook	Browse	13.107.5.88
a0e9f5d64349fb13191bc781f81f42e1	setup.exe	Get hash	malicious	Unknown	Browse	13.107.246.60
	msvcp110.dll	Get hash	malicious	LummaC	Browse	13.107.246.60
	c7v62g0YpB.exe	Get hash	malicious	SmokeLoader	Browse	13.107.246.60
	PO20241003.xls	Get hash	malicious	Unknown	Browse	13.107.246.60
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	13.107.246.60
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	13.107.246.60
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	13.107.246.60
	file.exe	Get hash	malicious	RDPWrap Tool, Amadey, Socks5Systemz, Stealc, Vidar, Xmrig	Browse	13.107.246.60
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	13.107.246.60
	Full-Setup.exe	Get hash	malicious	LummaC	Browse	13.107.246.60

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Payout Receipt.pptx

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

HTML

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Compliance

Software Vulnerabilities

Networking

System Summary

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

QR Codes

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\FontCache\4\CatalogCacheMetaData.xml

C:\Users\user\AppData\Local\Microsoft\FontCache\4\Catalog\ListAll.Json

C:\Users\user\AppData\Local\Microsoft\FontCache\4\PreviewFont\flat_officeFontsPreview_4_40.ttf

C:\Users\user\AppData\Local\Microsoft\Office\16.0\UsageMetricsStore\FileActivityStore\PowerPoint\1380790193167760279.C4

C:\Users\user\AppData\Local\Microsoft\Office\16.0\UsageMetricsStore\FileActivityStore\PowerPoint\ASkwMDAwMDAwMC0wMDAwLTAwMDAtMDAwMC0wMDAwMDAwMDAwMDBfTnVsbAA.S

C:\Users\user\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\FA3FA1C8-8B2F-4EAE-AE8F-9258C28FA679

C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules.xml

C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule100042v2.xml

C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule100043v0.xml

C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule100068v2.xml

C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule100069v1.xml

C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule100070v0.xml

C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule100071v0.xml

C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule100074v0.xml

C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule100075v1.xml

C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule100076v2.xml

C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule100077v2.xml

C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule100078v1.xml

C:\Users\user\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules\rule100079v2.xml

Windows Analysis Report
Payout Receipt.pptx

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
File Type:	XML 1.0 document, ASCII text, with very long lines (1869), with no line terminators
Category:	dropped
Size (bytes):	1869
Entropy (8bit):	5.091142390459905
Encrypted:	false
SSDEEP:	48:cGndypdyrKdnzymrkSyrVinzyGDSyX9JdycTdSy8fASyr1JnzyxAdyrfMnzyO:vEpEGd23bI2cb/EUdboAbX2aEQ2O
MD5:	4D35BC4EF3E92318F5FC93328CBACD80
SHA1:	245DBA831B6A5F2A23CE5CEE33ED1889A9E74F99
SHA-256:	4B767871E5BB03280A9E225358D963C7BF8ED98A68122819E083132BDFB398B0
SHA-512:	A9138499DD1C41ED3C035C145A327234D570ECC75D4A9FD0BC677CCA0F13DA7C8B0D6DE44B1F3B2FF42533CFF77F3204FE4AA7ED4AD34AAC0AC5BB59F83F8459
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?><root><version>1</version><Count>12</Count><Resource><Id>Aptos_26215680</Id><LAT>2024-10-04T13:10:39Z</LAT><key>29939506207.ttf</key><folder>Aptos</folder><type>4</type></Resource><Resource><Id>Aptos_45876480</Id><LAT>2024-10-04T13:10:39Z</LAT><key>27160079615.ttf</key><folder>Aptos</folder><type>4</type></Resource><Resource><Id>Aptos Display_26215680</Id><LAT>2024-10-04T13:10:38Z</LAT><key>23001069669.ttf</key><folder>Aptos Display</folder><type>4</type></Resource><Resource><Id>Aptos Narrow_26215426</Id><LAT>2023-10-06T09:55:52Z</LAT><key>37262344671.ttf</key><folder>Aptos Narrow</folder><type>4</type></Resource><Resource><Id>Aptos Display_26215682</Id><LAT>2023-10-06T09:55:52Z</LAT><key>28367963232.ttf</key><folder>Aptos Display</folder><type>4</type></Resource><Resource><Id>Aptos Narrow_45876224</Id><LAT>2023-10-06T09:55:52Z</LAT><key>24153076628.ttf</key><folder>Aptos Narrow</folder><type>4</type></Resource><Resource><Id>Aptos_

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 4 12:10:47 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.9798962983922577
Encrypted:	false
SSDEEP:	48:8+7deTD7orHAidAKZdA1JehwiZUklqehs5y+3:8+oUujy
MD5:	3D5FBFD406876FC24153241AC5FDF1F1
SHA1:	6F060D53D70B1E3B3AF557D445A29522719D8C1F
SHA-256:	690A7AB9F28D703557B35C45CD7C7AA35A143070FA7FFF52529B1C4FEFD91746
SHA-512:	C90DC87F89BD4AA67A8A88552F1E3E8DEBB9230B39B86B175FE7293385F8B4E37544ED6D70AA7ACDF4030ABFD38374A34C9D8A43C8EDE5F93A8A581E80A00B0E
Malicious:	false
Preview:	L..................F.@.. ...$+.,.....&..^.......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.IDYEi....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VDYWi....L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.VDYWi....M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.VDYWi...........................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.VDYXi...........................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............6N.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

File type:	Microsoft PowerPoint 2007+
Entropy (8bit):	7.978439598376639
TrID:	PowerPoint Microsoft Office Open XML Format document (133004/1) 76.65% Microsoft PowerPoint Macro-enabled Open XML add-in (32504/1) 18.73% ZIP compressed archive (8000/1) 4.61% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	Payout Receipt.pptx
File size:	210'853 bytes
MD5:	1417101d84f9b072a9d27567e41b12eb
SHA1:	d4ad5741fd589701af1c8270cfedeced334c0956
SHA256:	12dda16106f761f8d7508f450b212e3eefdbef67e97ff74afde7ac94ba704498
SHA512:	64ce5f8c224cd8388876ed9027a515f0e5e60dc10efc0c7b730d2e0d2c83119c4a4a0c8aaa34e9c44895b9d5ae46ff1f494131912f9cd46402c9c30faf43256b
SSDEEP:	3072:lEhMf8S02zjwwvQj3MTokJuEulCGZquL2tIueTNXsFmnnPqguXABcuQwtdoB:59Jzjwwv18muS4q/aCtX0QKdW
TLSH:	2C240259FE034211D27356B1D13CE59490B9CDA2A44BF989FAF676C20219C910B8FBEB
File Content Preview:	PK............................[Content_Types].xml...n.:....8. p.X..6M..Y...%@..`....7p.....h.Q..Jj..F.......x.^...k...........J.E...~.]..I8%.wP.. ......v.......[.....\..X....f..........)........#p4.F....a.V...5......`..m...b.6...w.....<...`. E.`.....k..j.

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 4, 2024 15:10:45.645649910 CEST	61874	53	192.168.2.17	1.1.1.1
Oct 4, 2024 15:10:45.645823002 CEST	49159	53	192.168.2.17	1.1.1.1
Oct 4, 2024 15:10:45.660609007 CEST	53	63790	1.1.1.1	192.168.2.17
Oct 4, 2024 15:10:45.678673983 CEST	53	49876	1.1.1.1	192.168.2.17
Oct 4, 2024 15:10:45.694248915 CEST	53	49159	1.1.1.1	192.168.2.17
Oct 4, 2024 15:10:45.835630894 CEST	53	61874	1.1.1.1	192.168.2.17
Oct 4, 2024 15:10:47.037681103 CEST	53	55942	1.1.1.1	192.168.2.17
Oct 4, 2024 15:10:47.216768980 CEST	58959	53	192.168.2.17	1.1.1.1
Oct 4, 2024 15:10:47.216929913 CEST	49611	53	192.168.2.17	1.1.1.1
Oct 4, 2024 15:10:47.251015902 CEST	53	49611	1.1.1.1	192.168.2.17
Oct 4, 2024 15:10:47.251332045 CEST	53	58959	1.1.1.1	192.168.2.17
Oct 4, 2024 15:10:48.219113111 CEST	57427	53	192.168.2.17	1.1.1.1
Oct 4, 2024 15:10:48.219264984 CEST	64017	53	192.168.2.17	1.1.1.1
Oct 4, 2024 15:10:48.231281996 CEST	53	57427	1.1.1.1	192.168.2.17
Oct 4, 2024 15:10:48.231997967 CEST	53	64017	1.1.1.1	192.168.2.17
Oct 4, 2024 15:10:50.149939060 CEST	54378	53	192.168.2.17	1.1.1.1
Oct 4, 2024 15:10:50.150091887 CEST	59443	53	192.168.2.17	1.1.1.1
Oct 4, 2024 15:10:50.156817913 CEST	53	54378	1.1.1.1	192.168.2.17
Oct 4, 2024 15:10:50.157031059 CEST	53	59443	1.1.1.1	192.168.2.17
Oct 4, 2024 15:10:50.251413107 CEST	57852	53	192.168.2.17	1.1.1.1
Oct 4, 2024 15:10:50.251609087 CEST	57534	53	192.168.2.17	1.1.1.1
Oct 4, 2024 15:10:50.259618998 CEST	53	57534	1.1.1.1	192.168.2.17
Oct 4, 2024 15:10:50.259639025 CEST	53	57852	1.1.1.1	192.168.2.17
Oct 4, 2024 15:10:58.141937971 CEST	57351	53	192.168.2.17	1.1.1.1
Oct 4, 2024 15:10:58.142151117 CEST	58263	53	192.168.2.17	1.1.1.1
Oct 4, 2024 15:10:58.156833887 CEST	53	57351	1.1.1.1	192.168.2.17
Oct 4, 2024 15:10:58.159579039 CEST	53	58263	1.1.1.1	192.168.2.17
Oct 4, 2024 15:10:59.134464025 CEST	60672	53	192.168.2.17	1.1.1.1
Oct 4, 2024 15:10:59.134639978 CEST	60142	53	192.168.2.17	1.1.1.1
Oct 4, 2024 15:10:59.142731905 CEST	53	58813	1.1.1.1	192.168.2.17
Oct 4, 2024 15:10:59.146250963 CEST	53	60672	1.1.1.1	192.168.2.17
Oct 4, 2024 15:10:59.147727966 CEST	53	60142	1.1.1.1	192.168.2.17
Oct 4, 2024 15:11:00.912980080 CEST	53	59738	1.1.1.1	192.168.2.17
Oct 4, 2024 15:11:02.127319098 CEST	54889	53	192.168.2.17	1.1.1.1
Oct 4, 2024 15:11:02.127319098 CEST	50826	53	192.168.2.17	1.1.1.1
Oct 4, 2024 15:11:02.150150061 CEST	53	54889	1.1.1.1	192.168.2.17
Oct 4, 2024 15:11:02.150163889 CEST	53	50826	1.1.1.1	192.168.2.17
Oct 4, 2024 15:11:02.244987011 CEST	63505	53	192.168.2.17	1.1.1.1
Oct 4, 2024 15:11:02.245239019 CEST	50446	53	192.168.2.17	1.1.1.1
Oct 4, 2024 15:11:02.248673916 CEST	50001	53	192.168.2.17	1.1.1.1
Oct 4, 2024 15:11:02.248919964 CEST	49389	53	192.168.2.17	1.1.1.1
Oct 4, 2024 15:11:02.252788067 CEST	53	63505	1.1.1.1	192.168.2.17
Oct 4, 2024 15:11:02.253099918 CEST	53	50446	1.1.1.1	192.168.2.17
Oct 4, 2024 15:11:02.256145000 CEST	53	49389	1.1.1.1	192.168.2.17
Oct 4, 2024 15:11:02.256215096 CEST	53	50001	1.1.1.1	192.168.2.17
Oct 4, 2024 15:11:03.583522081 CEST	51723	53	192.168.2.17	1.1.1.1
Oct 4, 2024 15:11:03.583669901 CEST	55030	53	192.168.2.17	1.1.1.1
Oct 4, 2024 15:11:03.590678930 CEST	53	51723	1.1.1.1	192.168.2.17
Oct 4, 2024 15:11:03.590909958 CEST	53	55030	1.1.1.1	192.168.2.17
Oct 4, 2024 15:11:03.993532896 CEST	53	62416	1.1.1.1	192.168.2.17
Oct 4, 2024 15:11:09.090667963 CEST	51138	53	192.168.2.17	1.1.1.1
Oct 4, 2024 15:11:09.090892076 CEST	58567	53	192.168.2.17	1.1.1.1
Oct 4, 2024 15:11:09.107079029 CEST	53	51138	1.1.1.1	192.168.2.17
Oct 4, 2024 15:11:09.123783112 CEST	53	58567	1.1.1.1	192.168.2.17
Oct 4, 2024 15:11:12.435842991 CEST	57867	53	192.168.2.17	1.1.1.1
Oct 4, 2024 15:11:12.439958096 CEST	58613	53	192.168.2.17	1.1.1.1
Oct 4, 2024 15:11:12.442467928 CEST	53	57867	1.1.1.1	192.168.2.17
Oct 4, 2024 15:11:12.447712898 CEST	53	58613	1.1.1.1	192.168.2.17
Oct 4, 2024 15:11:12.500124931 CEST	62587	53	192.168.2.17	1.1.1.1
Oct 4, 2024 15:11:12.500252962 CEST	50657	53	192.168.2.17	1.1.1.1
Oct 4, 2024 15:11:12.510883093 CEST	53	62587	1.1.1.1	192.168.2.17
Oct 4, 2024 15:11:12.526141882 CEST	53	50657	1.1.1.1	192.168.2.17
Oct 4, 2024 15:11:15.999988079 CEST	53	62147	1.1.1.1	192.168.2.17
Oct 4, 2024 15:11:22.939441919 CEST	53	50035	1.1.1.1	192.168.2.17
Oct 4, 2024 15:11:32.927177906 CEST	138	138	192.168.2.17	192.168.2.255
Oct 4, 2024 15:11:45.386974096 CEST	53	58780	1.1.1.1	192.168.2.17
Oct 4, 2024 15:11:45.602827072 CEST	53	65247	1.1.1.1	192.168.2.17
Oct 4, 2024 15:12:03.597132921 CEST	55138	53	192.168.2.17	1.1.1.1
Oct 4, 2024 15:12:03.597265005 CEST	55872	53	192.168.2.17	1.1.1.1
Oct 4, 2024 15:12:13.718616962 CEST	53	54978	1.1.1.1	192.168.2.17

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Oct 4, 2024 15:11:09.123887062 CEST	192.168.2.17	1.1.1.1	c250	(Port unreachable)	Destination Unreachable
Oct 4, 2024 15:11:12.526268959 CEST	192.168.2.17	1.1.1.1	c252	(Port unreachable)	Destination Unreachable

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 4, 2024 15:10:41.966276884 CEST	1.1.1.1	192.168.2.17	0x7c4a	No error (0)	shed.dual-low.s-part-0032.t-0009.t-msedge.net	s-part-0032.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 4, 2024 15:10:41.966276884 CEST	1.1.1.1	192.168.2.17	0x7c4a	No error (0)	s-part-0032.t-0009.t-msedge.net		13.107.246.60	A (IP address)	IN (0x0001)	false
Oct 4, 2024 15:10:45.835630894 CEST	1.1.1.1	192.168.2.17	0x330a	No error (0)	nomicscare.com		51.255.64.170	A (IP address)	IN (0x0001)	false
Oct 4, 2024 15:10:47.251015902 CEST	1.1.1.1	192.168.2.17	0x1208	No error (0)	crewbloom.s3.amazonaws.com	s3-1-w.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 4, 2024 15:10:47.251015902 CEST	1.1.1.1	192.168.2.17	0x1208	No error (0)	s3-1-w.amazonaws.com	s3-w.us-east-1.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 4, 2024 15:10:47.251332045 CEST	1.1.1.1	192.168.2.17	0xfd12	No error (0)	crewbloom.s3.amazonaws.com	s3-1-w.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 4, 2024 15:10:47.251332045 CEST	1.1.1.1	192.168.2.17	0xfd12	No error (0)	s3-1-w.amazonaws.com	s3-w.us-east-1.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 4, 2024 15:10:47.251332045 CEST	1.1.1.1	192.168.2.17	0xfd12	No error (0)	s3-w.us-east-1.amazonaws.com		3.5.1.122	A (IP address)	IN (0x0001)	false
Oct 4, 2024 15:10:47.251332045 CEST	1.1.1.1	192.168.2.17	0xfd12	No error (0)	s3-w.us-east-1.amazonaws.com		52.216.205.43	A (IP address)	IN (0x0001)	false
Oct 4, 2024 15:10:47.251332045 CEST	1.1.1.1	192.168.2.17	0xfd12	No error (0)	s3-w.us-east-1.amazonaws.com		52.216.144.107	A (IP address)	IN (0x0001)	false
Oct 4, 2024 15:10:47.251332045 CEST	1.1.1.1	192.168.2.17	0xfd12	No error (0)	s3-w.us-east-1.amazonaws.com		3.5.28.106	A (IP address)	IN (0x0001)	false
Oct 4, 2024 15:10:47.251332045 CEST	1.1.1.1	192.168.2.17	0xfd12	No error (0)	s3-w.us-east-1.amazonaws.com		3.5.16.62	A (IP address)	IN (0x0001)	false
Oct 4, 2024 15:10:47.251332045 CEST	1.1.1.1	192.168.2.17	0xfd12	No error (0)	s3-w.us-east-1.amazonaws.com		52.217.117.97	A (IP address)	IN (0x0001)	false
Oct 4, 2024 15:10:47.251332045 CEST	1.1.1.1	192.168.2.17	0xfd12	No error (0)	s3-w.us-east-1.amazonaws.com		54.231.135.25	A (IP address)	IN (0x0001)	false
Oct 4, 2024 15:10:47.251332045 CEST	1.1.1.1	192.168.2.17	0xfd12	No error (0)	s3-w.us-east-1.amazonaws.com		52.217.196.145	A (IP address)	IN (0x0001)	false
Oct 4, 2024 15:10:48.231281996 CEST	1.1.1.1	192.168.2.17	0x9bf5	No error (0)	pbs.twimg.com	dualstack.twimg.twitter.map.fastly.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 4, 2024 15:10:48.231281996 CEST	1.1.1.1	192.168.2.17	0x9bf5	No error (0)	dualstack.twimg.twitter.map.fastly.net		146.75.52.159	A (IP address)	IN (0x0001)	false
Oct 4, 2024 15:10:48.231997967 CEST	1.1.1.1	192.168.2.17	0x9699	No error (0)	pbs.twimg.com	dualstack.twimg.twitter.map.fastly.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 4, 2024 15:10:50.156817913 CEST	1.1.1.1	192.168.2.17	0xfe8f	No error (0)	pbs.twimg.com	dualstack.twimg.twitter.map.fastly.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 4, 2024 15:10:50.156817913 CEST	1.1.1.1	192.168.2.17	0xfe8f	No error (0)	dualstack.twimg.twitter.map.fastly.net		146.75.52.159	A (IP address)	IN (0x0001)	false
Oct 4, 2024 15:10:50.157031059 CEST	1.1.1.1	192.168.2.17	0xc522	No error (0)	pbs.twimg.com	dualstack.twimg.twitter.map.fastly.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 4, 2024 15:10:50.259618998 CEST	1.1.1.1	192.168.2.17	0xa707	No error (0)	www.google.com			65	IN (0x0001)	false
Oct 4, 2024 15:10:50.259639025 CEST	1.1.1.1	192.168.2.17	0x18e1	No error (0)	www.google.com		142.250.185.68	A (IP address)	IN (0x0001)	false
Oct 4, 2024 15:10:58.156833887 CEST	1.1.1.1	192.168.2.17	0xa806	No error (0)	l0gin-microso.ftlivedocs.tech		104.26.12.69	A (IP address)	IN (0x0001)	false
Oct 4, 2024 15:10:58.156833887 CEST	1.1.1.1	192.168.2.17	0xa806	No error (0)	l0gin-microso.ftlivedocs.tech		104.26.13.69	A (IP address)	IN (0x0001)	false
Oct 4, 2024 15:10:58.156833887 CEST	1.1.1.1	192.168.2.17	0xa806	No error (0)	l0gin-microso.ftlivedocs.tech		172.67.71.124	A (IP address)	IN (0x0001)	false
Oct 4, 2024 15:10:58.159579039 CEST	1.1.1.1	192.168.2.17	0xd383	No error (0)	l0gin-microso.ftlivedocs.tech			65	IN (0x0001)	false
Oct 4, 2024 15:10:58.555326939 CEST	1.1.1.1	192.168.2.17	0x6cc6	No error (0)	templatesmetadata.office.net	templatesmetadata.office.net.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 4, 2024 15:10:59.146250963 CEST	1.1.1.1	192.168.2.17	0x88d6	No error (0)	challenges.cloudflare.com		104.18.95.41	A (IP address)	IN (0x0001)	false
Oct 4, 2024 15:10:59.146250963 CEST	1.1.1.1	192.168.2.17	0x88d6	No error (0)	challenges.cloudflare.com		104.18.94.41	A (IP address)	IN (0x0001)	false
Oct 4, 2024 15:10:59.147727966 CEST	1.1.1.1	192.168.2.17	0xe4	No error (0)	challenges.cloudflare.com			65	IN (0x0001)	false
Oct 4, 2024 15:11:02.150150061 CEST	1.1.1.1	192.168.2.17	0x6b88	No error (0)	l0gin-microso.ftlivedocs.tech			65	IN (0x0001)	false
Oct 4, 2024 15:11:02.150163889 CEST	1.1.1.1	192.168.2.17	0x347	No error (0)	l0gin-microso.ftlivedocs.tech		104.26.13.69	A (IP address)	IN (0x0001)	false
Oct 4, 2024 15:11:02.150163889 CEST	1.1.1.1	192.168.2.17	0x347	No error (0)	l0gin-microso.ftlivedocs.tech		104.26.12.69	A (IP address)	IN (0x0001)	false
Oct 4, 2024 15:11:02.150163889 CEST	1.1.1.1	192.168.2.17	0x347	No error (0)	l0gin-microso.ftlivedocs.tech		172.67.71.124	A (IP address)	IN (0x0001)	false
Oct 4, 2024 15:11:02.252788067 CEST	1.1.1.1	192.168.2.17	0xc617	No error (0)	challenges.cloudflare.com		104.18.95.41	A (IP address)	IN (0x0001)	false
Oct 4, 2024 15:11:02.252788067 CEST	1.1.1.1	192.168.2.17	0xc617	No error (0)	challenges.cloudflare.com		104.18.94.41	A (IP address)	IN (0x0001)	false
Oct 4, 2024 15:11:02.253099918 CEST	1.1.1.1	192.168.2.17	0x2337	No error (0)	challenges.cloudflare.com			65	IN (0x0001)	false
Oct 4, 2024 15:11:02.256145000 CEST	1.1.1.1	192.168.2.17	0x8c0	No error (0)	challenges.cloudflare.com			65	IN (0x0001)	false
Oct 4, 2024 15:11:02.256215096 CEST	1.1.1.1	192.168.2.17	0x435c	No error (0)	challenges.cloudflare.com		104.18.95.41	A (IP address)	IN (0x0001)	false
Oct 4, 2024 15:11:02.256215096 CEST	1.1.1.1	192.168.2.17	0x435c	No error (0)	challenges.cloudflare.com		104.18.94.41	A (IP address)	IN (0x0001)	false
Oct 4, 2024 15:11:03.590678930 CEST	1.1.1.1	192.168.2.17	0x9ebd	No error (0)	a.nel.cloudflare.com		35.190.80.1	A (IP address)	IN (0x0001)	false
Oct 4, 2024 15:11:09.107079029 CEST	1.1.1.1	192.168.2.17	0x619f	No error (0)	www.ftlivedocs.tech		172.67.71.124	A (IP address)	IN (0x0001)	false
Oct 4, 2024 15:11:09.107079029 CEST	1.1.1.1	192.168.2.17	0x619f	No error (0)	www.ftlivedocs.tech		104.26.12.69	A (IP address)	IN (0x0001)	false
Oct 4, 2024 15:11:09.107079029 CEST	1.1.1.1	192.168.2.17	0x619f	No error (0)	www.ftlivedocs.tech		104.26.13.69	A (IP address)	IN (0x0001)	false
Oct 4, 2024 15:11:09.123783112 CEST	1.1.1.1	192.168.2.17	0xdb1e	No error (0)	www.ftlivedocs.tech			65	IN (0x0001)	false
Oct 4, 2024 15:11:10.744714975 CEST	1.1.1.1	192.168.2.17	0x351d	No error (0)	shed.dual-low.s-part-0017.t-0009.t-msedge.net	s-part-0017.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 4, 2024 15:11:10.744714975 CEST	1.1.1.1	192.168.2.17	0x351d	No error (0)	s-part-0017.t-0009.t-msedge.net		13.107.246.45	A (IP address)	IN (0x0001)	false
Oct 4, 2024 15:11:11.649435997 CEST	1.1.1.1	192.168.2.17	0xaca9	No error (0)	shed.dual-low.s-part-0017.t-0009.t-msedge.net	s-part-0017.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 4, 2024 15:11:11.649435997 CEST	1.1.1.1	192.168.2.17	0xaca9	No error (0)	s-part-0017.t-0009.t-msedge.net		13.107.246.45	A (IP address)	IN (0x0001)	false
Oct 4, 2024 15:11:12.442467928 CEST	1.1.1.1	192.168.2.17	0xbe0	No error (0)	aadcdn.msftauth.net	scdn38e6f.wpc.9be8f.omegacdn.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 4, 2024 15:11:12.442467928 CEST	1.1.1.1	192.168.2.17	0xbe0	No error (0)	scdn38e6f.wpc.9be8f.omegacdn.net	sni1gl.wpc.omegacdn.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 4, 2024 15:11:12.442467928 CEST	1.1.1.1	192.168.2.17	0xbe0	No error (0)	sni1gl.wpc.omegacdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Oct 4, 2024 15:11:12.447712898 CEST	1.1.1.1	192.168.2.17	0x2f20	No error (0)	aadcdn.msftauth.net	scdn38e6f.wpc.9be8f.omegacdn.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 4, 2024 15:11:12.447712898 CEST	1.1.1.1	192.168.2.17	0x2f20	No error (0)	scdn38e6f.wpc.9be8f.omegacdn.net	sni1gl.wpc.omegacdn.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 4, 2024 15:11:12.510883093 CEST	1.1.1.1	192.168.2.17	0x9c8c	No error (0)	ywnjb.ftlivedocs.tech		172.67.71.124	A (IP address)	IN (0x0001)	false
Oct 4, 2024 15:11:12.510883093 CEST	1.1.1.1	192.168.2.17	0x9c8c	No error (0)	ywnjb.ftlivedocs.tech		104.26.12.69	A (IP address)	IN (0x0001)	false
Oct 4, 2024 15:11:12.510883093 CEST	1.1.1.1	192.168.2.17	0x9c8c	No error (0)	ywnjb.ftlivedocs.tech		104.26.13.69	A (IP address)	IN (0x0001)	false
Oct 4, 2024 15:11:12.526141882 CEST	1.1.1.1	192.168.2.17	0xc289	No error (0)	ywnjb.ftlivedocs.tech			65	IN (0x0001)	false
Oct 4, 2024 15:12:03.607804060 CEST	1.1.1.1	192.168.2.17	0x92e9	No error (0)	identity.nel.measure.office.net	nel.measure.office.net.edgesuite.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 4, 2024 15:12:03.621838093 CEST	1.1.1.1	192.168.2.17	0xcb67	No error (0)	identity.nel.measure.office.net	nel.measure.office.net.edgesuite.net		CNAME (Canonical name)	IN (0x0001)	false

Timestamp	Bytes transferred	Direction	Data
2024-10-04 13:10:37 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=6Xtt1sBzydtZp6M&MD=91XKTh55 HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-10-04 13:10:37 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: 6968e628-1d64-40e8-8da4-25890244780d MS-RequestId: 854d2973-bdec-427b-9c16-79addaf893b3 MS-CV: z3IKoM23YU2sHg0u.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Fri, 04 Oct 2024 13:10:37 GMT Connection: close Content-Length: 24490
2024-10-04 13:10:37 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-10-04 13:10:37 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Timestamp	Bytes transferred	Direction	Data
2024-10-04 13:10:42 UTC	227	OUT	GET /rules/powerpnt.exe-Production-v19.bundle HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; Microsoft PowerPoint 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-04 13:10:42 UTC	542	IN	HTTP/1.1 200 OK Date: Fri, 04 Oct 2024 13:10:42 GMT Content-Type: text/plain Content-Length: 1183116 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public Last-Modified: Mon, 30 Sep 2024 13:16:38 GMT ETag: "0x8DCE1521E2C3658" x-ms-request-id: f0b719dc-501e-0016-7a5e-16181b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241004T131042Z-15767c5fc55852fxfeh7csa2dn0000000ck00000000036hm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-10-04 13:10:42 UTC	15842	IN	Data Raw: 31 30 30 30 34 32 76 32 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 30 34 32 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 55 58 2e 44 65 73 6b 74 6f 70 2e 4f 66 66 69 63 65 54 68 65 6d 65 2e 41 70 70 2e 49 6e 69 74 22 20 41 54 54 3d 22 63 34 33 38 38 63 39 37 37 32 39 37 34 31 33 62 62 30 35 34 62 61 64 31 61 63 66 30 61 64 65 31 2d 63 63 35 38 65 35 33 65 2d 66 35 61 34 2d 34 66 33 37 2d 62 30 64 32 2d 39 61 38 30 37 39 65 33 34 34 32 30 2d 36 38 37 39 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 31 22 20 49 64 3d 22 63 6d 39 79 35 Data Ascii: 100042v2+<?xml version="1.0" encoding="utf-8"?><R Id="100042" V="2" DC="SM" EN="Office.UX.Desktop.OfficeTheme.App.Init" ATT="c4388c977297413bb054bad1acf0ade1-cc58e53e-f5a4-4f37-b0d2-9a8079e34420-6879" DCa="PSU" xmlns=""> <S> <UTS T="1" Id="cm9y5
2024-10-04 13:10:42 UTC	16384	IN	Data Raw: 22 20 46 3d 22 41 75 74 68 6f 72 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 54 3e 0d 0a 3c 2f 52 3e 0d 0a 3c 24 21 23 3e 31 30 30 31 31 37 76 30 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 31 31 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 31 22 20 49 64 3d 22 38 79 6c 6c 66 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 Data Ascii: " F="AuthorCount" /> </C> <T> <S T="1" /> </T></R><$!#>100117v0+<?xml version="1.0" encoding="utf-8"?><R Id="100117" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <UTS T="1" Id="8yllf" /> </S> <C T="W" I="0" O="false"
2024-10-04 13:10:42 UTC	16384	IN	Data Raw: 20 20 3c 41 20 54 3d 22 53 55 4d 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 41 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 33 22 20 2f 3e 0d 0a 20 20 3c 2f 54 3e 0d 0a 3c 2f 52 3e 0d 0a 3c 24 21 23 3e 31 30 37 38 31 76 31 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 37 38 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 31 22 20 49 64 3d 22 62 67 6f 34 74 22 20 2f 3e 0d 0a Data Ascii: <A T="SUM"> <S T="1" F="11" /> </A> </C> <T> <S T="2" /> <S T="3" /> </T></R><$!#>10781v1+<?xml version="1.0" encoding="utf-8"?><R Id="10781" V="1" DC="SM" T="Subrule" xmlns=""> <S> <UTS T="1" Id="bgo4t" />
2024-10-04 13:10:42 UTC	16384	IN	Data Raw: 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 36 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 31 30 30 30 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d Data Ascii: </O> </F> <F T="6"> <O T="AND"> <L> <O T="GT"> <L> <S T="1" F="0" /> </L> <R> <V V="1000" T="U32" /> </R> </O> </L>
2024-10-04 13:10:42 UTC	16384	IN	Data Raw: 20 20 20 20 20 3c 53 20 54 3d 22 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 32 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 46 6c 79 6f 75 74 56 69 64 65 6f 43 61 6c 6c 56 69 64 65 6f 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 32 36 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 33 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 46 6c 79 6f 75 74 53 61 53 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 34 22 20 4f Data Ascii: <S T="25" /> </C> </C> <C T="U32" I="22" O="false" N="FlyoutVideoCallVideo"> <C> <S T="26" /> </C> </C> <C T="U32" I="23" O="false" N="FlyoutSaS"> <C> <S T="27" /> </C> </C> <C T="U32" I="24" O
2024-10-04 13:10:42 UTC	16384	IN	Data Raw: 20 20 3c 2f 54 3e 0d 0a 3c 2f 52 3e 0d 0a 3c 24 21 23 3e 31 30 39 30 37 76 30 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 39 30 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 4e 44 42 2e 55 6e 6b 6e 6f 77 6e 2e 43 6f 72 72 75 70 74 69 6f 6e 22 20 41 54 54 3d 22 64 38 30 37 36 30 39 32 37 36 37 34 34 32 34 35 62 61 66 38 31 62 66 37 62 63 38 30 33 33 66 36 2d 32 32 36 38 65 33 37 34 2d 37 37 36 36 2d 34 39 37 36 2d 62 65 34 34 2d 62 36 61 64 35 62 64 64 63 35 62 36 2d 37 38 31 33 22 20 53 3d 22 31 30 30 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d Data Ascii: </T></R><$!#>10907v0+<?xml version="1.0" encoding="utf-8"?><R Id="10907" V="0" DC="SM" EN="Office.Outlook.Desktop.NDB.Unknown.Corruption" ATT="d807609276744245baf81bf7bc8033f6-2268e374-7766-4976-be44-b6ad5bddc5b6-7813" S="100" DCa="PSU" xmlns="">
2024-10-04 13:10:42 UTC	16384	IN	Data Raw: 20 3c 53 3e 0d 0a 20 20 20 20 3c 54 49 20 54 3d 22 31 22 20 49 3d 22 44 61 69 6c 79 22 20 2f 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 32 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 68 75 74 64 6f 77 6e 22 20 2f 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 33 22 20 49 64 3d 22 62 70 66 79 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 34 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 50 68 6f 74 6f 53 69 7a 65 49 6e 42 79 74 65 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 30 22 20 54 3d 22 55 36 34 22 20 2f 3e 0d 0a 20 20 20 20 Data Ascii: <S> <TI T="1" I="Daily" /> <A T="2" E="TelemetryShutdown" /> <UTS T="3" Id="bpfy1" /> <F T="4"> <O T="GT"> <L> <S T="3" F="PhotoSizeInBytes" /> </L> <R> <V V="0" T="U64" />
2024-10-04 13:10:43 UTC	16384	IN	Data Raw: 6b 30 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 36 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 34 22 20 46 3d 22 65 76 65 6e 74 49 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 31 33 35 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 37 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 74 Data Ascii: k0m" /> <F T="6"> <O T="EQ"> <L> <S T="4" F="eventId" /> </L> <R> <V V="135" T="I32" /> </R> </O> </F> <F T="7"> <O T="EQ"> <L> <S T="5" F="t
2024-10-04 13:10:43 UTC	16384	IN	Data Raw: 34 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 31 30 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 46 69 6c 65 50 72 6f 74 65 63 74 69 6f 6e 53 74 61 74 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 35 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 Data Ascii: 4" T="U32" /> </R> </O> </F> <F T="10"> <O T="EQ"> <L> <S T="3" F="FileProtectionState" /> </L> <R> <V V="5" T="U32" /> </R> </O> </F> </S> <C T="
2024-10-04 13:10:43 UTC	16384	IN	Data Raw: 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 72 65 73 75 6c 74 73 5f 49 73 4e 75 6c 6c 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 66 61 6c 73 65 22 20 54 3d 22 42 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 Data Ascii: <O T="EQ"> <L> <S T="5" F="results_IsNull" /> </L> <R> <V V="false" T="B" /> </R> </O> </L> <R>

Timestamp	Bytes transferred	Direction	Data
2024-10-04 13:10:43 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-10-04 13:10:43 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-10-04 13:10:44 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Fri, 04 Oct 2024 13:09:44 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C529_BAY x-ms-request-id: 8ce25486-b549-47fe-8db6-d33f8b4364c1 PPServer: PPV: 30 H: PH1PEPF00011CB0 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Fri, 04 Oct 2024 13:10:43 GMT Connection: close Content-Length: 11389
2024-10-04 13:10:44 UTC	11389	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Timestamp	Bytes transferred	Direction	Data
2024-10-04 13:10:45 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4775 Host: login.live.com
2024-10-04 13:10:45 UTC	4775	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-10-04 13:10:46 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Fri, 04 Oct 2024 13:09:46 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C529_BL2 x-ms-request-id: c47d6065-b5b6-4ef1-8ea4-a21d935d52a2 PPServer: PPV: 30 H: BL02EPF0001D969 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Fri, 04 Oct 2024 13:10:46 GMT Connection: close Content-Length: 11389
2024-10-04 13:10:46 UTC	11389	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200