Windows Analysis Report
https://microsoft-microsoft-microsoft-microsoft-microsoft.glowlaundry.com/?office=bWhhc2Vscm90aEBuZXhwb2ludC5jb20

Overview

General Information

Sample URL:	https://microsoft-microsoft-microsoft-microsoft-microsoft.glowlaundry.com/?office=bWhhc2Vscm90aEBuZXhwb2ludC5jb20
Analysis ID:	1431879
Infos:

Detection

Fake Captcha, HTMLPhisher

Score:	84
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Phishing site detected (based on favicon image match)

Yara detected Fake Captcha

Yara detected HtmlPhish54

Phishing site detected (based on image similarity)

Phishing site detected (based on logo match)

Phishing site detected (based on shot match)

Detected hidden input values containing email addresses (often used in phishing pages)

Found iframes

HTML body contains low number of good links

HTML page contains hidden URLs or javascript code

HTML title does not match URL

Stores files to the Windows start menu directory

Uses insecure TLS / SSL version for HTTPS connection

Classification

Signatures

AV Detection

Antivirus / Scanner detection for submitted sample

Source: https://microsoft-microsoft-microsoft-microsoft-microsoft.glowlaundry.com/?office=bWhhc2Vscm90aEBuZXhwb2ludC5jb20

SlashNext: detection malicious, Label: Credential Stealing type: Phishing & Social Engineering

Phishing

Phishing site detected (based on favicon image match)

Source: https://glowlaundry.com	Matcher: Template: microsoft matched with high similarity
Source: https://microsoft-microsoft-microsoft-microsoft-microsoft.glowlaundry.com/?office=bWhhc2Vscm90aEBuZXhwb2ludC5jb20&sso_reload=true	Matcher: Template: microsoft matched with high similarity

Yara detected Fake Captcha

Source: Yara match	File source: 0.0.pages.csv, type: HTML
Source: Yara match	File source: 0.1.pages.csv, type: HTML

Yara detected HtmlPhish54

Source: Yara match	File source: 0.2.pages.csv, type: HTML
Source: Yara match	File source: 1.3.pages.csv, type: HTML
Source: Yara match	File source: 1.6.pages.csv, type: HTML
Source: Yara match	File source: 1.5.pages.csv, type: HTML

Phishing site detected (based on image similarity)

Source: https://microsoft-microsoft-microsoft-microsoft-microsoft.glowlaundry.com/?office=bWhhc2Vscm90aEBuZXhwb2ludC5jb20&sso_reload=true

Matcher: Found strong image similarity, brand: MICROSOFT

Phishing site detected (based on logo match)

Source: https://microsoft-microsoft-microsoft-microsoft-microsoft.glowlaundry.com/?office=bWhhc2Vscm90aEBuZXhwb2ludC5jb20&sso_reload=true

Matcher: Template: microsoft matched

Phishing site detected (based on shot match)

Source: https://microsoft-microsoft-microsoft-microsoft-microsoft.glowlaundry.com/?office=bWhhc2Vscm90aEBuZXhwb2ludC5jb20	Matcher: Template: captcha matched
Source: https://microsoft-microsoft-microsoft-microsoft-microsoft.glowlaundry.com/?office=bWhhc2Vscm90aEBuZXhwb2ludC5jb20	Matcher: Template: captcha matched

Detected hidden input values containing email addresses (often used in phishing pages)

Source: https://microsoft-microsoft-microsoft-microsoft-microsoft.glowlaundry.com/?office=bWhhc2Vscm90aEBuZXhwb2ludC5jb20&sso_reload=true

HTTP Parser: mhaselroth@nexpoint.com

Found iframes

Source: https://microsoft-microsoft-microsoft-microsoft-microsoft.glowlaundry.com/?office=bWhhc2Vscm90aEBuZXhwb2ludC5jb20&sso_reload=true	HTTP Parser: Iframe src: https://d1e2c22d-d9e75f42.glowlaundry.com/Prefetch/Prefetch.aspx
Source: https://microsoft-microsoft-microsoft-microsoft-microsoft.glowlaundry.com/?office=bWhhc2Vscm90aEBuZXhwb2ludC5jb20&sso_reload=true	HTTP Parser: Iframe src: https://d1e2c22d-d9e75f42.glowlaundry.com/Prefetch/Prefetch.aspx
Source: https://microsoft-microsoft-microsoft-microsoft-microsoft.glowlaundry.com/?office=bWhhc2Vscm90aEBuZXhwb2ludC5jb20&sso_reload=true	HTTP Parser: Iframe src: https://d1e2c22d-d9e75f42.glowlaundry.com/Prefetch/Prefetch.aspx

HTML body contains low number of good links

Source: https://microsoft-microsoft-microsoft-microsoft-microsoft.glowlaundry.com/?office=bWhhc2Vscm90aEBuZXhwb2ludC5jb20&sso_reload=true

HTTP Parser: Number of links: 0

HTML page contains hidden URLs or javascript code

Source: https://microsoft-microsoft-microsoft-microsoft-microsoft.glowlaundry.com/?office=bWhhc2Vscm90aEBuZXhwb2ludC5jb20

HTTP Parser: Base64 decoded: a[href="http://www.salidzini.lv/"][style="display: block; width: 88px; height: 31px; overflow: hidden; position: relative;"]

HTML title does not match URL

Source: https://microsoft-microsoft-microsoft-microsoft-microsoft.glowlaundry.com/?office=bWhhc2Vscm90aEBuZXhwb2ludC5jb20&sso_reload=true

HTTP Parser: Title: Sign in to your account does not match URL

Source: https://microsoft-microsoft-microsoft-microsoft-microsoft.glowlaundry.com/?office=bWhhc2Vscm90aEBuZXhwb2ludC5jb20	HTTP Parser: No favicon
Source: https://d1e2c22d-d9e75f42.glowlaundry.com/Prefetch/Prefetch.aspx	HTTP Parser: No favicon

Source: https://microsoft-microsoft-microsoft-microsoft-microsoft.glowlaundry.com/?office=bWhhc2Vscm90aEBuZXhwb2ludC5jb20&sso_reload=true	HTTP Parser: No <meta name="author".. found
Source: https://microsoft-microsoft-microsoft-microsoft-microsoft.glowlaundry.com/?office=bWhhc2Vscm90aEBuZXhwb2ludC5jb20&sso_reload=true	HTTP Parser: No <meta name="author".. found
Source: https://microsoft-microsoft-microsoft-microsoft-microsoft.glowlaundry.com/?office=bWhhc2Vscm90aEBuZXhwb2ludC5jb20&sso_reload=true	HTTP Parser: No <meta name="author".. found

Source: https://microsoft-microsoft-microsoft-microsoft-microsoft.glowlaundry.com/?office=bWhhc2Vscm90aEBuZXhwb2ludC5jb20&sso_reload=true	HTTP Parser: No <meta name="copyright".. found
Source: https://microsoft-microsoft-microsoft-microsoft-microsoft.glowlaundry.com/?office=bWhhc2Vscm90aEBuZXhwb2ludC5jb20&sso_reload=true	HTTP Parser: No <meta name="copyright".. found
Source: https://microsoft-microsoft-microsoft-microsoft-microsoft.glowlaundry.com/?office=bWhhc2Vscm90aEBuZXhwb2ludC5jb20&sso_reload=true	HTTP Parser: No <meta name="copyright".. found

Uses insecure TLS / SSL version for HTTPS connection

Source: unknown

HTTPS traffic detected: 23.1.237.91:443 -> 192.168.2.5:49721 version: TLS 1.0

Source: unknown	HTTPS traffic detected: 23.44.104.130:443 -> 192.168.2.5:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.44.104.130:443 -> 192.168.2.5:49717 version: TLS 1.2

Uses insecure TLS / SSL version for HTTPS connection

Source: unknown

HTTPS traffic detected: 23.1.237.91:443 -> 192.168.2.5:49721 version: TLS 1.0

Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.44.104.130
Source: unknown	TCP traffic detected without corresponding DNS query: 23.44.104.130
Source: unknown	TCP traffic detected without corresponding DNS query: 23.44.104.130
Source: unknown	TCP traffic detected without corresponding DNS query: 23.44.104.130
Source: unknown	TCP traffic detected without corresponding DNS query: 23.44.104.130
Source: unknown	TCP traffic detected without corresponding DNS query: 23.44.104.130
Source: unknown	TCP traffic detected without corresponding DNS query: 23.44.104.130
Source: unknown	TCP traffic detected without corresponding DNS query: 23.44.104.130
Source: unknown	TCP traffic detected without corresponding DNS query: 23.44.104.130
Source: unknown	TCP traffic detected without corresponding DNS query: 23.44.104.130
Source: unknown	TCP traffic detected without corresponding DNS query: 23.44.104.130
Source: unknown	TCP traffic detected without corresponding DNS query: 23.44.104.130
Source: unknown	TCP traffic detected without corresponding DNS query: 23.44.104.130
Source: unknown	TCP traffic detected without corresponding DNS query: 23.44.104.130
Source: unknown	TCP traffic detected without corresponding DNS query: 23.44.104.130
Source: unknown	TCP traffic detected without corresponding DNS query: 23.44.104.130
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.44.104.130
Source: unknown	TCP traffic detected without corresponding DNS query: 23.44.104.130
Source: unknown	TCP traffic detected without corresponding DNS query: 23.44.104.130
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /?office=bWhhc2Vscm90aEBuZXhwb2ludC5jb20 HTTP/1.1Host: microsoft-microsoft-microsoft-microsoft-microsoft.glowlaundry.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /?office=bWhhc2Vscm90aEBuZXhwb2ludC5jb20 HTTP/1.1Host: microsoft-microsoft-microsoft-microsoft-microsoft.glowlaundry.comConnection: keep-aliveCache-Control: max-age=0Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Referer: https://microsoft-microsoft-microsoft-microsoft-microsoft.glowlaundry.com/?office=bWhhc2Vscm90aEBuZXhwb2ludC5jb20Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: x0MiFw="ZDllNzVmNDItODhlZS00NDZlLWI0M2YtMTViZjdkMTUwOWZjOmU2NmQ0OWFiLTcwZWItNGFjNi05NDMzLWNjMzU2NjU1MWY1Mg=="
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/BssoInterrupt_Core_ChpboAn7HyXj89A22M8mzg2.js HTTP/1.1Host: c19a3e17-d9e75f42.glowlaundry.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://microsoft-microsoft-microsoft-microsoft-microsoft.glowlaundry.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://microsoft-microsoft-microsoft-microsoft-microsoft.glowlaundry.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /?office=bWhhc2Vscm90aEBuZXhwb2ludC5jb20&sso_reload=true HTTP/1.1Host: microsoft-microsoft-microsoft-microsoft-microsoft.glowlaundry.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-Dest: documentReferer: https://microsoft-microsoft-microsoft-microsoft-microsoft.glowlaundry.com/?office=bWhhc2Vscm90aEBuZXhwb2ludC5jb20Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: x0MiFw="ZDllNzVmNDItODhlZS00NDZlLWI0M2YtMTViZjdkMTUwOWZjOmU2NmQ0OWFiLTcwZWItNGFjNi05NDMzLWNjMzU2NjU1MWY1Mg=="; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1
Source: global traffic	HTTP traffic detected: GET /d9e75f4288ee446eb43f15bf7d1509fc/ HTTP/1.1Host: microsoft-microsoft-microsoft-microsoft-microsoft.glowlaundry.comConnection: UpgradePragma: no-cacheCache-Control: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Upgrade: websocketOrigin: https://microsoft-microsoft-microsoft-microsoft-microsoft.glowlaundry.comSec-WebSocket-Version: 13Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: x0MiFw="ZDllNzVmNDItODhlZS00NDZlLWI0M2YtMTViZjdkMTUwOWZjOmU2NmQ0OWFiLTcwZWItNGFjNi05NDMzLWNjMzU2NjU1MWY1Mg=="; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1Sec-WebSocket-Key: tVtPZDxJMQYDOEX/yV42NA==Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: microsoft-microsoft-microsoft-microsoft-microsoft.glowlaundry.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://microsoft-microsoft-microsoft-microsoft-microsoft.glowlaundry.com/?office=bWhhc2Vscm90aEBuZXhwb2ludC5jb20Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: x0MiFw="ZDllNzVmNDItODhlZS00NDZlLWI0M2YtMTViZjdkMTUwOWZjOmU2NmQ0OWFiLTcwZWItNGFjNi05NDMzLWNjMzU2NjU1MWY1Mg=="; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1
Source: global traffic	HTTP traffic detected: GET /ests/2.1/content/cdnbundles/converged.v2.login.min_1ito3russhq-9gioj-zd4w2.css HTTP/1.1Host: c19a3e17-d9e75f42.glowlaundry.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://microsoft-microsoft-microsoft-microsoft-microsoft.glowlaundry.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: styleReferer: https://microsoft-microsoft-microsoft-microsoft-microsoft.glowlaundry.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/ConvergedLogin_PCore_jHSrlUosdD1xxbmcR_lMNA2.js HTTP/1.1Host: c19a3e17-d9e75f42.glowlaundry.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://microsoft-microsoft-microsoft-microsoft-microsoft.glowlaundry.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://microsoft-microsoft-microsoft-microsoft-microsoft.glowlaundry.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ests/2.1/content/cdnbundles/ux.converged.login.strings-en.min_l2bvdjfwt697xziuhxpwsg2.js HTTP/1.1Host: c19a3e17-d9e75f42.glowlaundry.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://microsoft-microsoft-microsoft-microsoft-microsoft.glowlaundry.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://microsoft-microsoft-microsoft-microsoft-microsoft.glowlaundry.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/asyncchunk/convergedlogin_pcustomizationloader_7f0a8c2a247460fad87f.js HTTP/1.1Host: c19a3e17-d9e75f42.glowlaundry.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://microsoft-microsoft-microsoft-microsoft-microsoft.glowlaundry.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: x0MiFw="ZDllNzVmNDItODhlZS00NDZlLWI0M2YtMTViZjdkMTUwOWZjOmU2NmQ0OWFiLTcwZWItNGFjNi05NDMzLWNjMzU2NjU1MWY1Mg=="
Source: global traffic	HTTP traffic detected: GET /d9e75f4288ee446eb43f15bf7d1509fc/ HTTP/1.1Host: microsoft-microsoft-microsoft-microsoft-microsoft.glowlaundry.comConnection: UpgradePragma: no-cacheCache-Control: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Upgrade: websocketOrigin: https://microsoft-microsoft-microsoft-microsoft-microsoft.glowlaundry.comSec-WebSocket-Version: 13Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: x0MiFw="ZDllNzVmNDItODhlZS00NDZlLWI0M2YtMTViZjdkMTUwOWZjOmU2NmQ0OWFiLTcwZWItNGFjNi05NDMzLWNjMzU2NjU1MWY1Mg=="; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1Sec-WebSocket-Key: OsNOAe6w91lrlzIujqu+Ug==Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
Source: global traffic	HTTP traffic detected: GET /Me.htm?v=3 HTTP/1.1Host: l1ve.glowlaundry.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Purpose: prefetchSec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyReferer: https://microsoft-microsoft-microsoft-microsoft-microsoft.glowlaundry.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: x0MiFw="ZDllNzVmNDItODhlZS00NDZlLWI0M2YtMTViZjdkMTUwOWZjOmU2NmQ0OWFiLTcwZWItNGFjNi05NDMzLWNjMzU2NjU1MWY1Mg=="
Source: global traffic	HTTP traffic detected: GET /Prefetch/Prefetch.aspx HTTP/1.1Host: d1e2c22d-d9e75f42.glowlaundry.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://microsoft-microsoft-microsoft-microsoft-microsoft.glowlaundry.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: x0MiFw="ZDllNzVmNDItODhlZS00NDZlLWI0M2YtMTViZjdkMTUwOWZjOmU2NmQ0OWFiLTcwZWItNGFjNi05NDMzLWNjMzU2NjU1MWY1Mg=="
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/asyncchunk/convergedlogin_pfetchsessionsprogress_4d4b76a02ae121e3b20c.js HTTP/1.1Host: c19a3e17-d9e75f42.glowlaundry.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://microsoft-microsoft-microsoft-microsoft-microsoft.glowlaundry.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: x0MiFw="ZDllNzVmNDItODhlZS00NDZlLWI0M2YtMTViZjdkMTUwOWZjOmU2NmQ0OWFiLTcwZWItNGFjNi05NDMzLWNjMzU2NjU1MWY1Mg=="
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/marching_ants_white_8257b0707cbe1d0bd2661b80068676fe.gif HTTP/1.1Host: c19a3e17-d9e75f42.glowlaundry.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://microsoft-microsoft-microsoft-microsoft-microsoft.glowlaundry.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: x0MiFw="ZDllNzVmNDItODhlZS00NDZlLWI0M2YtMTViZjdkMTUwOWZjOmU2NmQ0OWFiLTcwZWItNGFjNi05NDMzLWNjMzU2NjU1MWY1Mg=="
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/marching_ants_986f40b5a9dc7d39ef8396797f61b323.gif HTTP/1.1Host: c19a3e17-d9e75f42.glowlaundry.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://microsoft-microsoft-microsoft-microsoft-microsoft.glowlaundry.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: x0MiFw="ZDllNzVmNDItODhlZS00NDZlLWI0M2YtMTViZjdkMTUwOWZjOmU2NmQ0OWFiLTcwZWItNGFjNi05NDMzLWNjMzU2NjU1MWY1Mg=="
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico HTTP/1.1Host: c19a3e17-d9e75f42.glowlaundry.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://microsoft-microsoft-microsoft-microsoft-microsoft.glowlaundry.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: x0MiFw="ZDllNzVmNDItODhlZS00NDZlLWI0M2YtMTViZjdkMTUwOWZjOmU2NmQ0OWFiLTcwZWItNGFjNi05NDMzLWNjMzU2NjU1MWY1Mg=="
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/backgrounds/2_11d9e3bcdfede9ce5ce5ace2d129f1c4.svg HTTP/1.1Host: c19a3e17-d9e75f42.glowlaundry.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://microsoft-microsoft-microsoft-microsoft-microsoft.glowlaundry.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: x0MiFw="ZDllNzVmNDItODhlZS00NDZlLWI0M2YtMTViZjdkMTUwOWZjOmU2NmQ0OWFiLTcwZWItNGFjNi05NDMzLWNjMzU2NjU1MWY1Mg=="
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/microsoft_logo_564db913a7fa0ca42727161c6d031bef.svg HTTP/1.1Host: c19a3e17-d9e75f42.glowlaundry.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://microsoft-microsoft-microsoft-microsoft-microsoft.glowlaundry.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: x0MiFw="ZDllNzVmNDItODhlZS00NDZlLWI0M2YtMTViZjdkMTUwOWZjOmU2NmQ0OWFiLTcwZWItNGFjNi05NDMzLWNjMzU2NjU1MWY1Mg=="
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/marching_ants_986f40b5a9dc7d39ef8396797f61b323.gif HTTP/1.1Host: c19a3e17-d9e75f42.glowlaundry.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: x0MiFw="ZDllNzVmNDItODhlZS00NDZlLWI0M2YtMTViZjdkMTUwOWZjOmU2NmQ0OWFiLTcwZWItNGFjNi05NDMzLWNjMzU2NjU1MWY1Mg=="
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/marching_ants_white_8257b0707cbe1d0bd2661b80068676fe.gif HTTP/1.1Host: c19a3e17-d9e75f42.glowlaundry.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: x0MiFw="ZDllNzVmNDItODhlZS00NDZlLWI0M2YtMTViZjdkMTUwOWZjOmU2NmQ0OWFiLTcwZWItNGFjNi05NDMzLWNjMzU2NjU1MWY1Mg=="
Source: global traffic	HTTP traffic detected: GET /d9e75f4288ee446eb43f15bf7d1509fc/ HTTP/1.1Host: microsoft-microsoft-microsoft-microsoft-microsoft.glowlaundry.comConnection: UpgradePragma: no-cacheCache-Control: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Upgrade: websocketOrigin: https://microsoft-microsoft-microsoft-microsoft-microsoft.glowlaundry.comSec-WebSocket-Version: 13Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: x0MiFw="ZDllNzVmNDItODhlZS00NDZlLWI0M2YtMTViZjdkMTUwOWZjOmU2NmQ0OWFiLTcwZWItNGFjNi05NDMzLWNjMzU2NjU1MWY1Mg=="; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; brcap=0Sec-WebSocket-Key: sZg0hPSS6Gw+iNB3Ui1pXg==Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico HTTP/1.1Host: c19a3e17-d9e75f42.glowlaundry.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: x0MiFw="ZDllNzVmNDItODhlZS00NDZlLWI0M2YtMTViZjdkMTUwOWZjOmU2NmQ0OWFiLTcwZWItNGFjNi05NDMzLWNjMzU2NjU1MWY1Mg=="
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/backgrounds/2_11d9e3bcdfede9ce5ce5ace2d129f1c4.svg HTTP/1.1Host: c19a3e17-d9e75f42.glowlaundry.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: x0MiFw="ZDllNzVmNDItODhlZS00NDZlLWI0M2YtMTViZjdkMTUwOWZjOmU2NmQ0OWFiLTcwZWItNGFjNi05NDMzLWNjMzU2NjU1MWY1Mg=="
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/microsoft_logo_564db913a7fa0ca42727161c6d031bef.svg HTTP/1.1Host: c19a3e17-d9e75f42.glowlaundry.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: x0MiFw="ZDllNzVmNDItODhlZS00NDZlLWI0M2YtMTViZjdkMTUwOWZjOmU2NmQ0OWFiLTcwZWItNGFjNi05NDMzLWNjMzU2NjU1MWY1Mg=="
Source: global traffic	HTTP traffic detected: GET /nexpoint.com/winauth/ssoprobe?client-request-id=38886153-7e89-40c2-89e6-2784bcbfcf69&_=1714077267060 HTTP/1.1Host: d2dc9372-d9e75f42.glowlaundry.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://microsoft-microsoft-microsoft-microsoft-microsoft.glowlaundry.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: x0MiFw="ZDllNzVmNDItODhlZS00NDZlLWI0M2YtMTViZjdkMTUwOWZjOmU2NmQ0OWFiLTcwZWItNGFjNi05NDMzLWNjMzU2NjU1MWY1Mg=="
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/asyncchunk/convergedlogin_pconfirmsend_22b414d3a544620482c9.js HTTP/1.1Host: c19a3e17-d9e75f42.glowlaundry.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://microsoft-microsoft-microsoft-microsoft-microsoft.glowlaundry.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: x0MiFw="ZDllNzVmNDItODhlZS00NDZlLWI0M2YtMTViZjdkMTUwOWZjOmU2NmQ0OWFiLTcwZWItNGFjNi05NDMzLWNjMzU2NjU1MWY1Mg=="
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/arrow_left_43280e0ba671a1d8b5e34f1931c4fe4b.svg HTTP/1.1Host: c19a3e17-d9e75f42.glowlaundry.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://microsoft-microsoft-microsoft-microsoft-microsoft.glowlaundry.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: x0MiFw="ZDllNzVmNDItODhlZS00NDZlLWI0M2YtMTViZjdkMTUwOWZjOmU2NmQ0OWFiLTcwZWItNGFjNi05NDMzLWNjMzU2NjU1MWY1Mg=="
Source: global traffic	HTTP traffic detected: GET /dbd5a2dd-yg5cjo4ocbf9muh0oi4dnt3g-4x3dhmdnmwxzdgvuy/logintenantbranding/0/illustration?ts=637558172308712716 HTTP/1.1Host: cf595ad9-d9e75f42.glowlaundry.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://microsoft-microsoft-microsoft-microsoft-microsoft.glowlaundry.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: x0MiFw="ZDllNzVmNDItODhlZS00NDZlLWI0M2YtMTViZjdkMTUwOWZjOmU2NmQ0OWFiLTcwZWItNGFjNi05NDMzLWNjMzU2NjU1MWY1Mg=="
Source: global traffic	HTTP traffic detected: GET /dbd5a2dd-yg5cjo4ocbf9muh0oi4dnt3g-4x3dhmdnmwxzdgvuy/logintenantbranding/0/bannerlogo?ts=637558167138285006 HTTP/1.1Host: cf595ad9-d9e75f42.glowlaundry.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://microsoft-microsoft-microsoft-microsoft-microsoft.glowlaundry.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: x0MiFw="ZDllNzVmNDItODhlZS00NDZlLWI0M2YtMTViZjdkMTUwOWZjOmU2NmQ0OWFiLTcwZWItNGFjNi05NDMzLWNjMzU2NjU1MWY1Mg=="
Source: global traffic	HTTP traffic detected: GET /dbd5a2dd-yg5cjo4ocbf9muh0oi4dnt3g-4x3dhmdnmwxzdgvuy/logintenantbranding/0/favicon?ts=638239969935161721 HTTP/1.1Host: cf595ad9-d9e75f42.glowlaundry.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://microsoft-microsoft-microsoft-microsoft-microsoft.glowlaundry.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: x0MiFw="ZDllNzVmNDItODhlZS00NDZlLWI0M2YtMTViZjdkMTUwOWZjOmU2NmQ0OWFiLTcwZWItNGFjNi05NDMzLWNjMzU2NjU1MWY1Mg=="
Source: global traffic	HTTP traffic detected: GET /common/instrumentation/dssostatus HTTP/1.1Host: microsoft-microsoft-microsoft-microsoft-microsoft.glowlaundry.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: x0MiFw="ZDllNzVmNDItODhlZS00NDZlLWI0M2YtMTViZjdkMTUwOWZjOmU2NmQ0OWFiLTcwZWItNGFjNi05NDMzLWNjMzU2NjU1MWY1Mg=="; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; brcap=0
Source: global traffic	HTTP traffic detected: GET /d9e75f4288ee446eb43f15bf7d1509fc/ HTTP/1.1Host: microsoft-microsoft-microsoft-microsoft-microsoft.glowlaundry.comConnection: UpgradePragma: no-cacheCache-Control: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Upgrade: websocketOrigin: https://microsoft-microsoft-microsoft-microsoft-microsoft.glowlaundry.comSec-WebSocket-Version: 13Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: x0MiFw="ZDllNzVmNDItODhlZS00NDZlLWI0M2YtMTViZjdkMTUwOWZjOmU2NmQ0OWFiLTcwZWItNGFjNi05NDMzLWNjMzU2NjU1MWY1Mg=="; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; brcap=0Sec-WebSocket-Key: rHkexvXwmXorLJWjeqCysg==Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/arrow_left_43280e0ba671a1d8b5e34f1931c4fe4b.svg HTTP/1.1Host: c19a3e17-d9e75f42.glowlaundry.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: x0MiFw="ZDllNzVmNDItODhlZS00NDZlLWI0M2YtMTViZjdkMTUwOWZjOmU2NmQ0OWFiLTcwZWItNGFjNi05NDMzLWNjMzU2NjU1MWY1Mg=="
Source: global traffic	HTTP traffic detected: GET /dbd5a2dd-yg5cjo4ocbf9muh0oi4dnt3g-4x3dhmdnmwxzdgvuy/logintenantbranding/0/bannerlogo?ts=637558167138285006 HTTP/1.1Host: cf595ad9-d9e75f42.glowlaundry.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: x0MiFw="ZDllNzVmNDItODhlZS00NDZlLWI0M2YtMTViZjdkMTUwOWZjOmU2NmQ0OWFiLTcwZWItNGFjNi05NDMzLWNjMzU2NjU1MWY1Mg=="
Source: global traffic	HTTP traffic detected: GET /dbd5a2dd-yg5cjo4ocbf9muh0oi4dnt3g-4x3dhmdnmwxzdgvuy/logintenantbranding/0/favicon?ts=638239969935161721 HTTP/1.1Host: cf595ad9-d9e75f42.glowlaundry.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: x0MiFw="ZDllNzVmNDItODhlZS00NDZlLWI0M2YtMTViZjdkMTUwOWZjOmU2NmQ0OWFiLTcwZWItNGFjNi05NDMzLWNjMzU2NjU1MWY1Mg=="
Source: global traffic	HTTP traffic detected: GET /dbd5a2dd-yg5cjo4ocbf9muh0oi4dnt3g-4x3dhmdnmwxzdgvuy/logintenantbranding/0/illustration?ts=637558172308712716 HTTP/1.1Host: cf595ad9-d9e75f42.glowlaundry.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: x0MiFw="ZDllNzVmNDItODhlZS00NDZlLWI0M2YtMTViZjdkMTUwOWZjOmU2NmQ0OWFiLTcwZWItNGFjNi05NDMzLWNjMzU2NjU1MWY1Mg=="
Source: global traffic	HTTP traffic detected: GET /d9e75f4288ee446eb43f15bf7d1509fc/ HTTP/1.1Host: microsoft-microsoft-microsoft-microsoft-microsoft.glowlaundry.comConnection: UpgradePragma: no-cacheCache-Control: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Upgrade: websocketOrigin: https://microsoft-microsoft-microsoft-microsoft-microsoft.glowlaundry.comSec-WebSocket-Version: 13Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: x0MiFw="ZDllNzVmNDItODhlZS00NDZlLWI0M2YtMTViZjdkMTUwOWZjOmU2NmQ0OWFiLTcwZWItNGFjNi05NDMzLWNjMzU2NjU1MWY1Mg=="; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; brcap=0Sec-WebSocket-Key: Q0Oc7UEXv+MIAI5H0jyl+Q==Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
Source: global traffic	HTTP traffic detected: GET /d9e75f4288ee446eb43f15bf7d1509fc/ HTTP/1.1Host: microsoft-microsoft-microsoft-microsoft-microsoft.glowlaundry.comConnection: UpgradePragma: no-cacheCache-Control: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Upgrade: websocketOrigin: https://microsoft-microsoft-microsoft-microsoft-microsoft.glowlaundry.comSec-WebSocket-Version: 13Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: x0MiFw="ZDllNzVmNDItODhlZS00NDZlLWI0M2YtMTViZjdkMTUwOWZjOmU2NmQ0OWFiLTcwZWItNGFjNi05NDMzLWNjMzU2NjU1MWY1Mg=="; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; brcap=0Sec-WebSocket-Key: w/wdXG5V4YLOLnqtIivtlQ==Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
Source: global traffic	HTTP traffic detected: GET /d9e75f4288ee446eb43f15bf7d1509fc/ HTTP/1.1Host: microsoft-microsoft-microsoft-microsoft-microsoft.glowlaundry.comConnection: UpgradePragma: no-cacheCache-Control: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Upgrade: websocketOrigin: https://microsoft-microsoft-microsoft-microsoft-microsoft.glowlaundry.comSec-WebSocket-Version: 13Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: x0MiFw="ZDllNzVmNDItODhlZS00NDZlLWI0M2YtMTViZjdkMTUwOWZjOmU2NmQ0OWFiLTcwZWItNGFjNi05NDMzLWNjMzU2NjU1MWY1Mg=="; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; brcap=0Sec-WebSocket-Key: Dg+6/fb6yN9bsbiUr0316Q==Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
Source: global traffic	HTTP traffic detected: GET /d9e75f4288ee446eb43f15bf7d1509fc/ HTTP/1.1Host: microsoft-microsoft-microsoft-microsoft-microsoft.glowlaundry.comConnection: UpgradePragma: no-cacheCache-Control: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Upgrade: websocketOrigin: https://microsoft-microsoft-microsoft-microsoft-microsoft.glowlaundry.comSec-WebSocket-Version: 13Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: x0MiFw="ZDllNzVmNDItODhlZS00NDZlLWI0M2YtMTViZjdkMTUwOWZjOmU2NmQ0OWFiLTcwZWItNGFjNi05NDMzLWNjMzU2NjU1MWY1Mg=="; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; brcap=0Sec-WebSocket-Key: 4/Tsu3yAwBUYU1W5DH0vdQ==Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
Source: global traffic	HTTP traffic detected: GET /d9e75f4288ee446eb43f15bf7d1509fc/ HTTP/1.1Host: microsoft-microsoft-microsoft-microsoft-microsoft.glowlaundry.comConnection: UpgradePragma: no-cacheCache-Control: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Upgrade: websocketOrigin: https://microsoft-microsoft-microsoft-microsoft-microsoft.glowlaundry.comSec-WebSocket-Version: 13Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: x0MiFw="ZDllNzVmNDItODhlZS00NDZlLWI0M2YtMTViZjdkMTUwOWZjOmU2NmQ0OWFiLTcwZWItNGFjNi05NDMzLWNjMzU2NjU1MWY1Mg=="; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; brcap=0Sec-WebSocket-Key: w748AO/w/Gg0kOYie79p6Q==Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits

Source: global traffic	DNS traffic detected: DNS query: microsoft-microsoft-microsoft-microsoft-microsoft.glowlaundry.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: c19a3e17-d9e75f42.glowlaundry.com
Source: global traffic	DNS traffic detected: DNS query: 5156d9c0-d9e75f42.glowlaundry.com
Source: global traffic	DNS traffic detected: DNS query: 7944007c-d9e75f42.glowlaundry.com
Source: global traffic	DNS traffic detected: DNS query: l1ve.glowlaundry.com
Source: global traffic	DNS traffic detected: DNS query: d1e2c22d-d9e75f42.glowlaundry.com
Source: global traffic	DNS traffic detected: DNS query: d2dc9372-d9e75f42.glowlaundry.com
Source: global traffic	DNS traffic detected: DNS query: cf595ad9-d9e75f42.glowlaundry.com

Source: unknown

HTTP traffic detected: POST /threshold/xls.aspx HTTP/1.1Origin: https://www.bing.comReferer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/InitAccept: */*Accept-Language: en-CHContent-type: text/xmlX-Agent-DeviceId: 01000A410900D492X-BM-CBT: 1696428841X-BM-DateFormat: dd/MM/yyyyX-BM-DeviceDimensions: 784x984X-BM-DeviceDimensionsLogical: 784x984X-BM-DeviceScale: 100X-BM-DTZ: 120X-BM-Market: CHX-BM-Theme: 000000;0078d7X-BM-WindowsFlights: FX:117B9872,FX:119E26AD,FX:11C0E96C,FX:11C6E5C2,FX:11C7EB6A,FX:11C9408A,FX:11C940DB,FX:11CB9A9F,FX:11CB9AC1,FX:11CC111C,FX:11D5BFCD,FX:11DF5B12,FX:11DF5B75,FX:1240931B,FX:124B38D0,FX:127FC878,FX:1283FFE8,FX:12840617,FX:128979F9,FX:128EBD7E,FX:129135BB,FX:129E053F,FX:12A74DB5,FX:12AB734D,FX:12B8450E,FX:12BD6E73,FX:12C3331B,FX:12C7D66EX-Device-ClientSession: DB0AFB19004F47BC80E5208C7478FF22X-Device-isOptin: falseX-Device-MachineId: {92C86F7C-DB2B-4F6A-95AD-98B4A2AE008A}X-Device-OSSKU: 48X-Device-Touch: falseX-DeviceID: 01000A410900D492X-MSEdge-ExternalExp: d-thshld39,d-thshld42,d-thshld77,d-thshld78,staticshX-MSEdge-ExternalExpType: JointCoordX-PositionerType: DesktopX-Search-AppId: Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUIX-Search-CortanaAvailableCapabilities: NoneX-Search-SafeSearch: ModerateX-Search-TimeZone: Bias=-60; DaylightBias=-60; TimeZoneKeyName=W. Europe Standard TimeX-UserAgeClass: UnknownAccept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: www.bing.comContent-Length: 2484Connection: Keep-AliveCache-Control: no-cacheCookie: MUID=2F4E96DB8B7049E59AD4484C3C00F7CF; _SS=SID=1A6DEABB468B65843EB5F91B47916435&CPID=1714077217972&AC=1&CPH=d1a4eb75; _EDGE_S=SID=1A6DEABB468B65843EB5F91B47916435; SRCHUID=V=2&GUID=3D32B8AC657C4AD781A584E283227995&dmnchg=1; SRCHD=AF=NOFORM; SRCHUSR=DOB=20231004; SRCHHPGUSR=SRCHLANG=en&IPMH=986d886c&IPMID=1696428841029&HV=1696428756; CortanaAppUID=5A290E2CC4B523E2D8B5E2E3E4CB7CB7; MUIDB=2F4E96DB8B7049E59AD4484C3C00F7CF

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Apr 2024 20:34:19 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-Encodingcache-control: privatep3p: CP="DSP CUR OTPi IND OTRi ONL FIN"x-ms-request-id: f145dae1-fd07-4f66-bf4b-de6b742f7500x-ms-ests-server: 2.1.17910.10 - SEC ProdSlicesreport-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://5156d9c0-d9e75f42.glowlaundry.com/api/report?catId=GW+estsfd+dub2"}]}nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0}x-ms-srs: 1.Preferrer-policy: strict-origin-when-cross-originaccess-control-allow-origin: access-control-allow-headers:
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Apr 2024 20:34:19 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-Encodingcache-control: privatep3p: CP="DSP CUR OTPi IND OTRi ONL FIN"x-ms-request-id: 1675624b-fad7-4e1f-89bc-19a46dc26400x-ms-ests-server: 2.1.17910.10 - FRC ProdSlicesreport-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://5156d9c0-d9e75f42.glowlaundry.com/api/report?catId=GW+estsfd+dub2"}]}nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0}x-ms-srs: 1.Preferrer-policy: strict-origin-when-cross-originaccess-control-allow-origin: access-control-allow-headers:
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Apr 2024 20:34:26 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-Encodingcache-control: privatep3p: CP="DSP CUR OTPi IND OTRi ONL FIN"x-ms-request-id: 2048724a-7f1f-4e49-a910-4a1db7db2701x-ms-ests-server: 2.1.17846.6 - FRC ProdSlicesreport-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://5156d9c0-d9e75f42.glowlaundry.com/api/report?catId=GW+estsfd+ams2"}]}nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0}x-ms-srs: 1.Preferrer-policy: strict-origin-when-cross-originaccess-control-allow-origin: access-control-allow-headers:
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Apr 2024 20:34:26 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeVary: Accept-Encodingcache-control: no-store, no-cachex-ua-compatible: IE=Edgex-cache: CONFIG_NOCACHEx-msedge-ref: Ref A: 404D2A8BCAE540A4827C75EB44DAB4B0 Ref B: AMS231032606023 Ref C: 2024-04-25T20:34:26Zaccess-control-allow-origin: access-control-allow-headers:
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Apr 2024 20:34:29 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-Encodingcache-control: privatep3p: CP="DSP CUR OTPi IND OTRi ONL FIN"x-ms-request-id: 31e72add-678b-424a-acba-02f2f8e54401x-ms-ests-server: 2.1.17846.6 - NEULR1 ProdSlicesreport-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://5156d9c0-d9e75f42.glowlaundry.com/api/report?catId=GW+estsfd+ams2"}]}nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0}x-ms-srs: 1.Preferrer-policy: strict-origin-when-cross-originaccess-control-allow-origin: access-control-allow-headers:
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Apr 2024 20:34:36 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-Encodingcache-control: privatep3p: CP="DSP CUR OTPi IND OTRi ONL FIN"x-ms-request-id: 802b1315-61ee-4c0d-a0f0-058eb8bd8801x-ms-ests-server: 2.1.17846.6 - WEULR1 ProdSlicesreport-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://5156d9c0-d9e75f42.glowlaundry.com/api/report?catId=GW+estsfd+ams2"}]}nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0}x-ms-srs: 1.Preferrer-policy: strict-origin-when-cross-originaccess-control-allow-origin: access-control-allow-headers:
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Apr 2024 20:34:43 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-Encodingcache-control: privatep3p: CP="DSP CUR OTPi IND OTRi ONL FIN"x-ms-request-id: 1b177b6d-b2bb-4097-8f8f-a04527521e01x-ms-ests-server: 2.1.17846.6 - FRC ProdSlicesreport-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://5156d9c0-d9e75f42.glowlaundry.com/api/report?catId=GW+estsfd+ams2"}]}nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0}x-ms-srs: 1.Preferrer-policy: strict-origin-when-cross-originaccess-control-allow-origin: access-control-allow-headers:
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Apr 2024 20:34:53 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-Encodingcache-control: privatep3p: CP="DSP CUR OTPi IND OTRi ONL FIN"x-ms-request-id: 2f90d348-8ce6-4c87-a87b-bfbfca160001x-ms-ests-server: 2.1.17846.6 - SEC ProdSlicesreport-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://5156d9c0-d9e75f42.glowlaundry.com/api/report?catId=GW+estsfd+ams2"}]}nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0}x-ms-srs: 1.Preferrer-policy: strict-origin-when-cross-originaccess-control-allow-origin: access-control-allow-headers:
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Apr 2024 20:34:57 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-Encodingcache-control: privatep3p: CP="DSP CUR OTPi IND OTRi ONL FIN"x-ms-request-id: 359bfa11-7289-4692-8b0e-c80222909501x-ms-ests-server: 2.1.17846.6 - WEULR1 ProdSlicesreport-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://5156d9c0-d9e75f42.glowlaundry.com/api/report?catId=GW+estsfd+ams2"}]}nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0}x-ms-srs: 1.Preferrer-policy: strict-origin-when-cross-originaccess-control-allow-origin: access-control-allow-headers:
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Apr 2024 20:35:04 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-Encodingcache-control: privatep3p: CP="DSP CUR OTPi IND OTRi ONL FIN"x-ms-request-id: 2584b3c4-fff6-488f-a9cd-e3efa9f1fd00x-ms-ests-server: 2.1.17846.6 - FRC ProdSlicesreport-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://5156d9c0-d9e75f42.glowlaundry.com/api/report?catId=GW+estsfd+ams2"}]}nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0}x-ms-srs: 1.Preferrer-policy: strict-origin-when-cross-originaccess-control-allow-origin: access-control-allow-headers:
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Apr 2024 20:35:18 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-Encodingcache-control: privatep3p: CP="DSP CUR OTPi IND OTRi ONL FIN"x-ms-request-id: 8fab7c16-c39d-4d28-9121-a374e3835401x-ms-ests-server: 2.1.17846.6 - FRC ProdSlicesreport-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://5156d9c0-d9e75f42.glowlaundry.com/api/report?catId=GW+estsfd+ams2"}]}nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0}x-ms-srs: 1.Preferrer-policy: strict-origin-when-cross-originaccess-control-allow-origin: access-control-allow-headers:

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 23.44.104.130:443 -> 192.168.2.5:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.44.104.130:443 -> 192.168.2.5:49717 version: TLS 1.2

Source: classification engine

Classification label: mal84.phis.win@17/49@24/4

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Jump to behavior

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2484 --field-trial-handle=2416,i,3840092173733629535,5917711654094720308,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://microsoft-microsoft-microsoft-microsoft-microsoft.glowlaundry.com/?office=bWhhc2Vscm90aEBuZXhwb2ludC5jb20"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2484 --field-trial-handle=2416,i,3840092173733629535,5917711654094720308,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Google Drive.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Stores files to the Windows start menu directory

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
108.177.122.106	www.google.com	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
46.101.216.85	c19a3e17-d9e75f42.glowlaundry.com	Netherlands	14061	DIGITALOCEAN-ASNUS	false

Private

IP
192.168.2.5

Contacted Domains

Name	IP	Active
c19a3e17-d9e75f42.glowlaundry.com	46.101.216.85	true
bg.microsoft.map.fastly.net	199.232.214.172	true
d1e2c22d-d9e75f42.glowlaundry.com	46.101.216.85	true
microsoft-microsoft-microsoft-microsoft-microsoft.glowlaundry.com	46.101.216.85	true
7944007c-d9e75f42.glowlaundry.com	46.101.216.85	true
www.google.com	108.177.122.106	true
5156d9c0-d9e75f42.glowlaundry.com	46.101.216.85	true
fp2e7a.wpc.phicdn.net	192.229.211.108	true
l1ve.glowlaundry.com	46.101.216.85	true
d2dc9372-d9e75f42.glowlaundry.com	46.101.216.85	true
cf595ad9-d9e75f42.glowlaundry.com	46.101.216.85	true

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://cf595ad9-d9e75f42.glowlaundry.com/dbd5a2dd-yg5cjo4ocbf9muh0oi4dnt3g-4x3dhmdnmwxzdgvuy/logintenantbranding/0/bannerlogo?ts=637558167138285006	false	Avira URL Cloud: safe	unknown
https://c19a3e17-d9e75f42.glowlaundry.com/shared/1.0/content/images/backgrounds/2_11d9e3bcdfede9ce5ce5ace2d129f1c4.svg	false	Avira URL Cloud: safe	unknown
https://microsoft-microsoft-microsoft-microsoft-microsoft.glowlaundry.com/d9e75f4288ee446eb43f15bf7d1509fc/	false	Avira URL Cloud: safe	unknown
https://c19a3e17-d9e75f42.glowlaundry.com/shared/1.0/content/images/arrow_left_43280e0ba671a1d8b5e34f1931c4fe4b.svg	false	Avira URL Cloud: safe	unknown
https://microsoft-microsoft-microsoft-microsoft-microsoft.glowlaundry.com/common/instrumentation/reportbssotelemetry?hpgid=6&hpgact=2101&client-request-id=13c27696-5c04-4541-bac5-a18ec29f9570&hpgrequestid=204b5e03-6f88-49ea-a483-914227c68302	false	Avira URL Cloud: safe	unknown
https://c19a3e17-d9e75f42.glowlaundry.com/ests/2.1/content/cdnbundles/converged.v2.login.min_1ito3russhq-9gioj-zd4w2.css	false	Avira URL Cloud: safe	unknown
https://l1ve.glowlaundry.com/Me.htm?v=3	false	Avira URL Cloud: safe	unknown
https://c19a3e17-d9e75f42.glowlaundry.com/shared/1.0/content/images/microsoft_logo_564db913a7fa0ca42727161c6d031bef.svg	false	Avira URL Cloud: safe	unknown
https://microsoft-microsoft-microsoft-microsoft-microsoft.glowlaundry.com/common/instrumentation/dssostatus	false	Avira URL Cloud: safe	unknown
https://c19a3e17-d9e75f42.glowlaundry.com/shared/1.0/content/js/asyncchunk/convergedlogin_pcustomizationloader_7f0a8c2a247460fad87f.js	false	Avira URL Cloud: safe	unknown
https://c19a3e17-d9e75f42.glowlaundry.com/shared/1.0/content/js/asyncchunk/convergedlogin_pfetchsessionsprogress_4d4b76a02ae121e3b20c.js	false	Avira URL Cloud: safe	unknown
https://c19a3e17-d9e75f42.glowlaundry.com/shared/1.0/content/images/marching_ants_white_8257b0707cbe1d0bd2661b80068676fe.gif	false	Avira URL Cloud: safe	unknown
https://cf595ad9-d9e75f42.glowlaundry.com/dbd5a2dd-yg5cjo4ocbf9muh0oi4dnt3g-4x3dhmdnmwxzdgvuy/logintenantbranding/0/favicon?ts=638239969935161721	false	Avira URL Cloud: safe	unknown
https://d1e2c22d-d9e75f42.glowlaundry.com/Prefetch/Prefetch.aspx	false		unknown
https://5156d9c0-d9e75f42.glowlaundry.com/api/report?catId=GW+estsfd+dub2	false	Avira URL Cloud: safe	unknown
https://microsoft-microsoft-microsoft-microsoft-microsoft.glowlaundry.com/?office=bWhhc2Vscm90aEBuZXhwb2ludC5jb20&sso_reload=true	true		unknown
https://c19a3e17-d9e75f42.glowlaundry.com/shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico	false	Avira URL Cloud: safe	unknown
https://microsoft-microsoft-microsoft-microsoft-microsoft.glowlaundry.com/favicon.ico	false	Avira URL Cloud: safe	unknown
https://c19a3e17-d9e75f42.glowlaundry.com/shared/1.0/content/js/asyncchunk/convergedlogin_pconfirmsend_22b414d3a544620482c9.js	false	Avira URL Cloud: safe	unknown
https://c19a3e17-d9e75f42.glowlaundry.com/shared/1.0/content/js/BssoInterrupt_Core_ChpboAn7HyXj89A22M8mzg2.js	false	Avira URL Cloud: safe	unknown
https://c19a3e17-d9e75f42.glowlaundry.com/shared/1.0/content/images/marching_ants_986f40b5a9dc7d39ef8396797f61b323.gif	false	Avira URL Cloud: safe	unknown
https://microsoft-microsoft-microsoft-microsoft-microsoft.glowlaundry.com/?office=bWhhc2Vscm90aEBuZXhwb2ludC5jb20	true		unknown
https://c19a3e17-d9e75f42.glowlaundry.com/shared/1.0/content/js/ConvergedLogin_PCore_jHSrlUosdD1xxbmcR_lMNA2.js	false	Avira URL Cloud: safe	unknown
https://cf595ad9-d9e75f42.glowlaundry.com/dbd5a2dd-yg5cjo4ocbf9muh0oi4dnt3g-4x3dhmdnmwxzdgvuy/logintenantbranding/0/illustration?ts=637558172308712716	false	Avira URL Cloud: safe	unknown

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Apr 25 19:33:54 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	140AED5E40A9772F27259B5B25741BAA	5059FDDC0D3032A33F652BC233BA175785C36408	CBD36BD329DBEE3C6FAD1D4743F280EC7AD6E21562EE906FE0946F974E05980D
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Apr 25 19:33:53 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	2D65C9FA97C2D4CFB6DB4EF48AC4E765	24B1A6932586ADDA415A4C0DAB936B5D78CDE2AF	F5786658CD6D8CBE46F1052F46EC0771BDAE78B187CDAD05705BDC6942D7AA37
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 4 12:54:07 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	564ABE03B868E34A955D145AC80461D5	3BA9AA48C23B55C32E2E52482BDB546D7019E2EE	1A7BDE79763281FED606ED978DF16577ED2A33ABE1425EDB93E0F88B14F415D8
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Apr 25 19:33:53 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	E20515B53F3524C16259D81BB072B609	B6FECBF59B06158CF525B4A732F0C3095329497E	325FA2463618729C324BF78BDC7F665488C0A27737FBB6C50982E0E6C8C8369E
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Apr 25 19:33:53 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	CF59B78283A43085A61A504E6D7055FE	1F8F0DC264D23ACCA202C6B6FFFDB7D4A001B5B6	AD0F9B99F82B25696B7384363745DC1A353C4905F278C064304D3B45C540E8F6
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Apr 25 19:33:53 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	1E015ABB07D2B0F455287C380364525C	6EAAD61F4F3ED36B8E0E8053F3CBB6F69D8A9D07	6D9C63D54303A62AB0EBB08D3E1678C9BF505AA3048D233DC96983E547631718
Chrome Cache Entry: 71	gzip compressed data, original size modulo 2^32 1864	2D2CBA7D7DC75F3BA9DC756738D41A6E	F87FD26066ED5E52A65DEE0ED2D581D3C3EA15AC	00E21864CF1BC70302EBB5B496C6C471A7DA8CBF600630B478A3E2376ED20EA2
Chrome Cache Entry: 72	MS Windows icon resource - 6 icons, 16x16 with PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced, 32 bits/pixel, 24x24 with PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced, 32 bits/pixel	7E0D59593F3377B72C29435C4B43954A	B4C5C39A6DFB460BBD2EACCEB09EC8079FB6A8E2	62D706019A0D80173113EF70FBBEE12F286E8E221534BE788448AADA4B14C8E8
Chrome Cache Entry: 73	MS Windows icon resource - 6 icons, 16x16 with PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced, 32 bits/pixel, 24x24 with PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced, 32 bits/pixel	7E0D59593F3377B72C29435C4B43954A	B4C5C39A6DFB460BBD2EACCEB09EC8079FB6A8E2	62D706019A0D80173113EF70FBBEE12F286E8E221534BE788448AADA4B14C8E8
Chrome Cache Entry: 74	gzip compressed data, from Unix, original size modulo 2^32 113084	7B082644CE5A069FB55F47B1A6B667F2	6A5FFA5369BF15FA42446C6EDE88E9E40A40E0E9	8E34884C24973C66D83BAFDEC9445F746BEFEE773A384B340CA24C7B7703AF3A
Chrome Cache Entry: 75	gzip compressed data, original size modulo 2^32 513	44D8807C223B5C6DEF6E75A602F314EF	E061C196D771661D6C47336C50EAFE2B3BA14130	BA9816D7AF3E3B0EA5B6B34BAA0C99FE5EDCF4CA9BE30307AAA2956F994A8B1E
Chrome Cache Entry: 76	gzip compressed data, from Unix, original size modulo 2^32 223841	C92C9345F6C2F4D309CCEBD64FC84649	CABF8BF10AE0EF70CA01AD2C3BD9091F8038D204	0F02ECFE1E158237F4354E06117325000D672163DA2B1CF6471727955BE7CC87
Chrome Cache Entry: 77	gzip compressed data, from Unix, original size modulo 2^32 444230	AD03607DC1377EE4E9EA766B71F365BB	BADDF24DDD8518C7FB93BCF00E04484B8EBF908E	D22498DB61BAF0943421019E254DF8A9260C89C29F05F6D67728232AB168AB9E
Chrome Cache Entry: 78	gzip compressed data, original size modulo 2^32 513	44D8807C223B5C6DEF6E75A602F314EF	E061C196D771661D6C47336C50EAFE2B3BA14130	BA9816D7AF3E3B0EA5B6B34BAA0C99FE5EDCF4CA9BE30307AAA2956F994A8B1E
Chrome Cache Entry: 79	gzip compressed data, original size modulo 2^32 3651	DF6A7721C242813411CC6950DF40F9B3	B2068C4A65C183AAD6FC22A44CC1FA449CD355B4	AA53B6DC744357B392FC57C34E516BAE465D4A6837775C137A176D599C8EA948
Chrome Cache Entry: 80	PNG image data, 280 x 60, 8-bit/color RGBA, non-interlaced	9FEB68B3E27D762F34A646D13DCA9975	303E1C49CD5446F372C7A4ADB07A796EC83FDFC4	0D5034DFC1ABD1FC906E3146B2B844DF6200EC7A4E821399823318165DB79A7A
Chrome Cache Entry: 81	gzip compressed data, from Unix, original size modulo 2^32 141333	768F998AFDFD3E4BD0B0C3088F89CE08	54DB510ABEFFB2BA32B8E0654302892142A0E289	42E94ACD22AD75CFE8CADAC297B7B202AEF6F28BA8B4995F7CA71F7EC091D12C
Chrome Cache Entry: 82	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced	84F73218D41D5D1F011661EC2EA06905	4DB76BCBF5733E78F4B8ACF7B088809F30BA0612	5106A3E5D05F4A41E1E07618A786491886EA5A53E734857CD837A13335646B6A
Chrome Cache Entry: 83	GIF image data, version 89a, 352 x 3	166DE53471265253AB3A456DEFE6DA23	17C6DF4D7CCF1FA2C9EFD716FBAE0FC2C71C8D6D	A46201581A7C7C667FD42787CD1E9ADF2F6BF809EFB7596E61A03E8DBA9ADA13
Chrome Cache Entry: 84	JPEG image data, baseline, precision 8, 1980x1080, components 3	97BC5D64F1DDA11A353CD5E0FEC8B22E	3B485BC742521BD79E945B6576375A89DC85A796	613EC181C616DFCB9D854B21B14B3CA27B6557036F15B088C15A59CBEC26D78C
Chrome Cache Entry: 85	GIF image data, version 89a, 352 x 3	166DE53471265253AB3A456DEFE6DA23	17C6DF4D7CCF1FA2C9EFD716FBAE0FC2C71C8D6D	A46201581A7C7C667FD42787CD1E9ADF2F6BF809EFB7596E61A03E8DBA9ADA13
Chrome Cache Entry: 86	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced	84F73218D41D5D1F011661EC2EA06905	4DB76BCBF5733E78F4B8ACF7B088809F30BA0612	5106A3E5D05F4A41E1E07618A786491886EA5A53E734857CD837A13335646B6A
Chrome Cache Entry: 87	JPEG image data, baseline, precision 8, 1980x1080, components 3	97BC5D64F1DDA11A353CD5E0FEC8B22E	3B485BC742521BD79E945B6576375A89DC85A796	613EC181C616DFCB9D854B21B14B3CA27B6557036F15B088C15A59CBEC26D78C
Chrome Cache Entry: 88	gzip compressed data, from Unix, original size modulo 2^32 15720	46B85A026ED67E19BB297899A72FD96D	B17C75D415D639C2685A51066038E21CE15F2830	F9DEDB332176563AC62AC3AE381AB876B3910197BE26A19A45D93CF2C8E721B9
Chrome Cache Entry: 89	GIF image data, version 89a, 352 x 3	B540A8E518037192E32C4FE58BF2DBAB	3047C1DB97B86F6981E0AD2F96AF40CDF43511AF	8737D721808655F37B333F08A90185699E7E8B9BDAAA15CDB63C8448B426F95D
Chrome Cache Entry: 90	GIF image data, version 89a, 352 x 3	B540A8E518037192E32C4FE58BF2DBAB	3047C1DB97B86F6981E0AD2F96AF40CDF43511AF	8737D721808655F37B333F08A90185699E7E8B9BDAAA15CDB63C8448B426F95D
Chrome Cache Entry: 91	PNG image data, 280 x 60, 8-bit/color RGBA, non-interlaced	9FEB68B3E27D762F34A646D13DCA9975	303E1C49CD5446F372C7A4ADB07A796EC83FDFC4	0D5034DFC1ABD1FC906E3146B2B844DF6200EC7A4E821399823318165DB79A7A
Chrome Cache Entry: 92	gzip compressed data, original size modulo 2^32 1864	2D2CBA7D7DC75F3BA9DC756738D41A6E	F87FD26066ED5E52A65DEE0ED2D581D3C3EA15AC	00E21864CF1BC70302EBB5B496C6C471A7DA8CBF600630B478A3E2376ED20EA2
Chrome Cache Entry: 93	gzip compressed data, from Unix, original size modulo 2^32 10706	8E08B1CC6F0D12ED06FF34FD89BD01A8	C695B15618845D970CB9FDD0CFA482A18384DB8C	6ADFE31033E0FE8D8DF093727A242EA5AC7026FDD305F025F91D4DDAAD77AC27
Chrome Cache Entry: 94	gzip compressed data, from Unix, original size modulo 2^32 55071	F4EE642A98C21CF56B3D4E6A248BEC15	97BC88C4C9048E09547D32840AC309250D38E7BF	B7F749990B9F16129FBBD6088E467367676F2183A19FC00A0FFFE9AAE72C6556
Chrome Cache Entry: 95	gzip compressed data, from Unix, original size modulo 2^32 2483	3A5DE79406B43CD7076D62C62DC838D1	19816CB46F8D1F37B1F4D80D2A311798B5F3096B	35568ECE0FF750826DB0FBDA6F06358B42C495A9EBEE2040B5C216C94B59D8FA
Chrome Cache Entry: 96	gzip compressed data, original size modulo 2^32 3651	DF6A7721C242813411CC6950DF40F9B3	B2068C4A65C183AAD6FC22A44CC1FA449CD355B4	AA53B6DC744357B392FC57C34E516BAE465D4A6837775C137A176D599C8EA948

AV Detection

Antivirus / Scanner detection for submitted sample

Source: https://microsoft-microsoft-microsoft-microsoft-microsoft.glowlaundry.com/?office=bWhhc2Vscm90aEBuZXhwb2ludC5jb20

SlashNext: detection malicious, Label: Credential Stealing type: Phishing & Social Engineering

Phishing

Phishing site detected (based on favicon image match)

Source: https://glowlaundry.com	Matcher: Template: microsoft matched with high similarity
Source: https://microsoft-microsoft-microsoft-microsoft-microsoft.glowlaundry.com/?office=bWhhc2Vscm90aEBuZXhwb2ludC5jb20&sso_reload=true	Matcher: Template: microsoft matched with high similarity

Yara detected Fake Captcha

Source: Yara match	File source: 0.0.pages.csv, type: HTML
Source: Yara match	File source: 0.1.pages.csv, type: HTML

Yara detected HtmlPhish54

Source: Yara match	File source: 0.2.pages.csv, type: HTML
Source: Yara match	File source: 1.3.pages.csv, type: HTML
Source: Yara match	File source: 1.6.pages.csv, type: HTML
Source: Yara match	File source: 1.5.pages.csv, type: HTML

Phishing site detected (based on image similarity)

Source: https://microsoft-microsoft-microsoft-microsoft-microsoft.glowlaundry.com/?office=bWhhc2Vscm90aEBuZXhwb2ludC5jb20&sso_reload=true

Matcher: Found strong image similarity, brand: MICROSOFT

Phishing site detected (based on logo match)

Source: https://microsoft-microsoft-microsoft-microsoft-microsoft.glowlaundry.com/?office=bWhhc2Vscm90aEBuZXhwb2ludC5jb20&sso_reload=true

Matcher: Template: microsoft matched

Phishing site detected (based on shot match)

Source: https://microsoft-microsoft-microsoft-microsoft-microsoft.glowlaundry.com/?office=bWhhc2Vscm90aEBuZXhwb2ludC5jb20	Matcher: Template: captcha matched
Source: https://microsoft-microsoft-microsoft-microsoft-microsoft.glowlaundry.com/?office=bWhhc2Vscm90aEBuZXhwb2ludC5jb20	Matcher: Template: captcha matched

Detected hidden input values containing email addresses (often used in phishing pages)

Source: https://microsoft-microsoft-microsoft-microsoft-microsoft.glowlaundry.com/?office=bWhhc2Vscm90aEBuZXhwb2ludC5jb20&sso_reload=true

HTTP Parser: mhaselroth@nexpoint.com

Found iframes

Source: https://microsoft-microsoft-microsoft-microsoft-microsoft.glowlaundry.com/?office=bWhhc2Vscm90aEBuZXhwb2ludC5jb20&sso_reload=true	HTTP Parser: Iframe src: https://d1e2c22d-d9e75f42.glowlaundry.com/Prefetch/Prefetch.aspx
Source: https://microsoft-microsoft-microsoft-microsoft-microsoft.glowlaundry.com/?office=bWhhc2Vscm90aEBuZXhwb2ludC5jb20&sso_reload=true	HTTP Parser: Iframe src: https://d1e2c22d-d9e75f42.glowlaundry.com/Prefetch/Prefetch.aspx
Source: https://microsoft-microsoft-microsoft-microsoft-microsoft.glowlaundry.com/?office=bWhhc2Vscm90aEBuZXhwb2ludC5jb20&sso_reload=true	HTTP Parser: Iframe src: https://d1e2c22d-d9e75f42.glowlaundry.com/Prefetch/Prefetch.aspx

HTML body contains low number of good links

Source: https://microsoft-microsoft-microsoft-microsoft-microsoft.glowlaundry.com/?office=bWhhc2Vscm90aEBuZXhwb2ludC5jb20&sso_reload=true

HTTP Parser: Number of links: 0

HTML page contains hidden URLs or javascript code

Source: https://microsoft-microsoft-microsoft-microsoft-microsoft.glowlaundry.com/?office=bWhhc2Vscm90aEBuZXhwb2ludC5jb20

HTTP Parser: Base64 decoded: a[href="http://www.salidzini.lv/"][style="display: block; width: 88px; height: 31px; overflow: hidden; position: relative;"]

HTML title does not match URL

Source: https://microsoft-microsoft-microsoft-microsoft-microsoft.glowlaundry.com/?office=bWhhc2Vscm90aEBuZXhwb2ludC5jb20&sso_reload=true

HTTP Parser: Title: Sign in to your account does not match URL

Source: https://microsoft-microsoft-microsoft-microsoft-microsoft.glowlaundry.com/?office=bWhhc2Vscm90aEBuZXhwb2ludC5jb20	HTTP Parser: No favicon
Source: https://d1e2c22d-d9e75f42.glowlaundry.com/Prefetch/Prefetch.aspx	HTTP Parser: No favicon

Source: https://microsoft-microsoft-microsoft-microsoft-microsoft.glowlaundry.com/?office=bWhhc2Vscm90aEBuZXhwb2ludC5jb20&sso_reload=true	HTTP Parser: No <meta name="author".. found
Source: https://microsoft-microsoft-microsoft-microsoft-microsoft.glowlaundry.com/?office=bWhhc2Vscm90aEBuZXhwb2ludC5jb20&sso_reload=true	HTTP Parser: No <meta name="author".. found
Source: https://microsoft-microsoft-microsoft-microsoft-microsoft.glowlaundry.com/?office=bWhhc2Vscm90aEBuZXhwb2ludC5jb20&sso_reload=true	HTTP Parser: No <meta name="author".. found

Source: https://microsoft-microsoft-microsoft-microsoft-microsoft.glowlaundry.com/?office=bWhhc2Vscm90aEBuZXhwb2ludC5jb20&sso_reload=true	HTTP Parser: No <meta name="copyright".. found
Source: https://microsoft-microsoft-microsoft-microsoft-microsoft.glowlaundry.com/?office=bWhhc2Vscm90aEBuZXhwb2ludC5jb20&sso_reload=true	HTTP Parser: No <meta name="copyright".. found
Source: https://microsoft-microsoft-microsoft-microsoft-microsoft.glowlaundry.com/?office=bWhhc2Vscm90aEBuZXhwb2ludC5jb20&sso_reload=true	HTTP Parser: No <meta name="copyright".. found

Uses insecure TLS / SSL version for HTTPS connection

Source: unknown

HTTPS traffic detected: 23.1.237.91:443 -> 192.168.2.5:49721 version: TLS 1.0

Source: unknown	HTTPS traffic detected: 23.44.104.130:443 -> 192.168.2.5:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.44.104.130:443 -> 192.168.2.5:49717 version: TLS 1.2

Uses insecure TLS / SSL version for HTTPS connection

Source: unknown

HTTPS traffic detected: 23.1.237.91:443 -> 192.168.2.5:49721 version: TLS 1.0

Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.44.104.130
Source: unknown	TCP traffic detected without corresponding DNS query: 23.44.104.130
Source: unknown	TCP traffic detected without corresponding DNS query: 23.44.104.130
Source: unknown	TCP traffic detected without corresponding DNS query: 23.44.104.130
Source: unknown	TCP traffic detected without corresponding DNS query: 23.44.104.130
Source: unknown	TCP traffic detected without corresponding DNS query: 23.44.104.130
Source: unknown	TCP traffic detected without corresponding DNS query: 23.44.104.130
Source: unknown	TCP traffic detected without corresponding DNS query: 23.44.104.130
Source: unknown	TCP traffic detected without corresponding DNS query: 23.44.104.130
Source: unknown	TCP traffic detected without corresponding DNS query: 23.44.104.130
Source: unknown	TCP traffic detected without corresponding DNS query: 23.44.104.130
Source: unknown	TCP traffic detected without corresponding DNS query: 23.44.104.130
Source: unknown	TCP traffic detected without corresponding DNS query: 23.44.104.130
Source: unknown	TCP traffic detected without corresponding DNS query: 23.44.104.130
Source: unknown	TCP traffic detected without corresponding DNS query: 23.44.104.130
Source: unknown	TCP traffic detected without corresponding DNS query: 23.44.104.130
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.44.104.130
Source: unknown	TCP traffic detected without corresponding DNS query: 23.44.104.130
Source: unknown	TCP traffic detected without corresponding DNS query: 23.44.104.130
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /?office=bWhhc2Vscm90aEBuZXhwb2ludC5jb20 HTTP/1.1Host: microsoft-microsoft-microsoft-microsoft-microsoft.glowlaundry.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /?office=bWhhc2Vscm90aEBuZXhwb2ludC5jb20 HTTP/1.1Host: microsoft-microsoft-microsoft-microsoft-microsoft.glowlaundry.comConnection: keep-aliveCache-Control: max-age=0Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Referer: https://microsoft-microsoft-microsoft-microsoft-microsoft.glowlaundry.com/?office=bWhhc2Vscm90aEBuZXhwb2ludC5jb20Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: x0MiFw="ZDllNzVmNDItODhlZS00NDZlLWI0M2YtMTViZjdkMTUwOWZjOmU2NmQ0OWFiLTcwZWItNGFjNi05NDMzLWNjMzU2NjU1MWY1Mg=="
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/BssoInterrupt_Core_ChpboAn7HyXj89A22M8mzg2.js HTTP/1.1Host: c19a3e17-d9e75f42.glowlaundry.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://microsoft-microsoft-microsoft-microsoft-microsoft.glowlaundry.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://microsoft-microsoft-microsoft-microsoft-microsoft.glowlaundry.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /?office=bWhhc2Vscm90aEBuZXhwb2ludC5jb20&sso_reload=true HTTP/1.1Host: microsoft-microsoft-microsoft-microsoft-microsoft.glowlaundry.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-Dest: documentReferer: https://microsoft-microsoft-microsoft-microsoft-microsoft.glowlaundry.com/?office=bWhhc2Vscm90aEBuZXhwb2ludC5jb20Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: x0MiFw="ZDllNzVmNDItODhlZS00NDZlLWI0M2YtMTViZjdkMTUwOWZjOmU2NmQ0OWFiLTcwZWItNGFjNi05NDMzLWNjMzU2NjU1MWY1Mg=="; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1
Source: global traffic	HTTP traffic detected: GET /d9e75f4288ee446eb43f15bf7d1509fc/ HTTP/1.1Host: microsoft-microsoft-microsoft-microsoft-microsoft.glowlaundry.comConnection: UpgradePragma: no-cacheCache-Control: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Upgrade: websocketOrigin: https://microsoft-microsoft-microsoft-microsoft-microsoft.glowlaundry.comSec-WebSocket-Version: 13Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: x0MiFw="ZDllNzVmNDItODhlZS00NDZlLWI0M2YtMTViZjdkMTUwOWZjOmU2NmQ0OWFiLTcwZWItNGFjNi05NDMzLWNjMzU2NjU1MWY1Mg=="; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1Sec-WebSocket-Key: tVtPZDxJMQYDOEX/yV42NA==Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: microsoft-microsoft-microsoft-microsoft-microsoft.glowlaundry.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://microsoft-microsoft-microsoft-microsoft-microsoft.glowlaundry.com/?office=bWhhc2Vscm90aEBuZXhwb2ludC5jb20Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: x0MiFw="ZDllNzVmNDItODhlZS00NDZlLWI0M2YtMTViZjdkMTUwOWZjOmU2NmQ0OWFiLTcwZWItNGFjNi05NDMzLWNjMzU2NjU1MWY1Mg=="; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1
Source: global traffic	HTTP traffic detected: GET /ests/2.1/content/cdnbundles/converged.v2.login.min_1ito3russhq-9gioj-zd4w2.css HTTP/1.1Host: c19a3e17-d9e75f42.glowlaundry.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://microsoft-microsoft-microsoft-microsoft-microsoft.glowlaundry.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: styleReferer: https://microsoft-microsoft-microsoft-microsoft-microsoft.glowlaundry.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/ConvergedLogin_PCore_jHSrlUosdD1xxbmcR_lMNA2.js HTTP/1.1Host: c19a3e17-d9e75f42.glowlaundry.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://microsoft-microsoft-microsoft-microsoft-microsoft.glowlaundry.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://microsoft-microsoft-microsoft-microsoft-microsoft.glowlaundry.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ests/2.1/content/cdnbundles/ux.converged.login.strings-en.min_l2bvdjfwt697xziuhxpwsg2.js HTTP/1.1Host: c19a3e17-d9e75f42.glowlaundry.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://microsoft-microsoft-microsoft-microsoft-microsoft.glowlaundry.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://microsoft-microsoft-microsoft-microsoft-microsoft.glowlaundry.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/asyncchunk/convergedlogin_pcustomizationloader_7f0a8c2a247460fad87f.js HTTP/1.1Host: c19a3e17-d9e75f42.glowlaundry.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://microsoft-microsoft-microsoft-microsoft-microsoft.glowlaundry.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: x0MiFw="ZDllNzVmNDItODhlZS00NDZlLWI0M2YtMTViZjdkMTUwOWZjOmU2NmQ0OWFiLTcwZWItNGFjNi05NDMzLWNjMzU2NjU1MWY1Mg=="
Source: global traffic	HTTP traffic detected: GET /d9e75f4288ee446eb43f15bf7d1509fc/ HTTP/1.1Host: microsoft-microsoft-microsoft-microsoft-microsoft.glowlaundry.comConnection: UpgradePragma: no-cacheCache-Control: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Upgrade: websocketOrigin: https://microsoft-microsoft-microsoft-microsoft-microsoft.glowlaundry.comSec-WebSocket-Version: 13Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: x0MiFw="ZDllNzVmNDItODhlZS00NDZlLWI0M2YtMTViZjdkMTUwOWZjOmU2NmQ0OWFiLTcwZWItNGFjNi05NDMzLWNjMzU2NjU1MWY1Mg=="; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1Sec-WebSocket-Key: OsNOAe6w91lrlzIujqu+Ug==Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
Source: global traffic	HTTP traffic detected: GET /Me.htm?v=3 HTTP/1.1Host: l1ve.glowlaundry.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Purpose: prefetchSec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyReferer: https://microsoft-microsoft-microsoft-microsoft-microsoft.glowlaundry.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: x0MiFw="ZDllNzVmNDItODhlZS00NDZlLWI0M2YtMTViZjdkMTUwOWZjOmU2NmQ0OWFiLTcwZWItNGFjNi05NDMzLWNjMzU2NjU1MWY1Mg=="
Source: global traffic	HTTP traffic detected: GET /Prefetch/Prefetch.aspx HTTP/1.1Host: d1e2c22d-d9e75f42.glowlaundry.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://microsoft-microsoft-microsoft-microsoft-microsoft.glowlaundry.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: x0MiFw="ZDllNzVmNDItODhlZS00NDZlLWI0M2YtMTViZjdkMTUwOWZjOmU2NmQ0OWFiLTcwZWItNGFjNi05NDMzLWNjMzU2NjU1MWY1Mg=="
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/asyncchunk/convergedlogin_pfetchsessionsprogress_4d4b76a02ae121e3b20c.js HTTP/1.1Host: c19a3e17-d9e75f42.glowlaundry.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://microsoft-microsoft-microsoft-microsoft-microsoft.glowlaundry.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: x0MiFw="ZDllNzVmNDItODhlZS00NDZlLWI0M2YtMTViZjdkMTUwOWZjOmU2NmQ0OWFiLTcwZWItNGFjNi05NDMzLWNjMzU2NjU1MWY1Mg=="
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/marching_ants_white_8257b0707cbe1d0bd2661b80068676fe.gif HTTP/1.1Host: c19a3e17-d9e75f42.glowlaundry.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://microsoft-microsoft-microsoft-microsoft-microsoft.glowlaundry.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: x0MiFw="ZDllNzVmNDItODhlZS00NDZlLWI0M2YtMTViZjdkMTUwOWZjOmU2NmQ0OWFiLTcwZWItNGFjNi05NDMzLWNjMzU2NjU1MWY1Mg=="
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/marching_ants_986f40b5a9dc7d39ef8396797f61b323.gif HTTP/1.1Host: c19a3e17-d9e75f42.glowlaundry.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://microsoft-microsoft-microsoft-microsoft-microsoft.glowlaundry.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: x0MiFw="ZDllNzVmNDItODhlZS00NDZlLWI0M2YtMTViZjdkMTUwOWZjOmU2NmQ0OWFiLTcwZWItNGFjNi05NDMzLWNjMzU2NjU1MWY1Mg=="
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico HTTP/1.1Host: c19a3e17-d9e75f42.glowlaundry.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://microsoft-microsoft-microsoft-microsoft-microsoft.glowlaundry.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: x0MiFw="ZDllNzVmNDItODhlZS00NDZlLWI0M2YtMTViZjdkMTUwOWZjOmU2NmQ0OWFiLTcwZWItNGFjNi05NDMzLWNjMzU2NjU1MWY1Mg=="
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/backgrounds/2_11d9e3bcdfede9ce5ce5ace2d129f1c4.svg HTTP/1.1Host: c19a3e17-d9e75f42.glowlaundry.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://microsoft-microsoft-microsoft-microsoft-microsoft.glowlaundry.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: x0MiFw="ZDllNzVmNDItODhlZS00NDZlLWI0M2YtMTViZjdkMTUwOWZjOmU2NmQ0OWFiLTcwZWItNGFjNi05NDMzLWNjMzU2NjU1MWY1Mg=="
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/microsoft_logo_564db913a7fa0ca42727161c6d031bef.svg HTTP/1.1Host: c19a3e17-d9e75f42.glowlaundry.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://microsoft-microsoft-microsoft-microsoft-microsoft.glowlaundry.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: x0MiFw="ZDllNzVmNDItODhlZS00NDZlLWI0M2YtMTViZjdkMTUwOWZjOmU2NmQ0OWFiLTcwZWItNGFjNi05NDMzLWNjMzU2NjU1MWY1Mg=="
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/marching_ants_986f40b5a9dc7d39ef8396797f61b323.gif HTTP/1.1Host: c19a3e17-d9e75f42.glowlaundry.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: x0MiFw="ZDllNzVmNDItODhlZS00NDZlLWI0M2YtMTViZjdkMTUwOWZjOmU2NmQ0OWFiLTcwZWItNGFjNi05NDMzLWNjMzU2NjU1MWY1Mg=="
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/marching_ants_white_8257b0707cbe1d0bd2661b80068676fe.gif HTTP/1.1Host: c19a3e17-d9e75f42.glowlaundry.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: x0MiFw="ZDllNzVmNDItODhlZS00NDZlLWI0M2YtMTViZjdkMTUwOWZjOmU2NmQ0OWFiLTcwZWItNGFjNi05NDMzLWNjMzU2NjU1MWY1Mg=="
Source: global traffic	HTTP traffic detected: GET /d9e75f4288ee446eb43f15bf7d1509fc/ HTTP/1.1Host: microsoft-microsoft-microsoft-microsoft-microsoft.glowlaundry.comConnection: UpgradePragma: no-cacheCache-Control: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Upgrade: websocketOrigin: https://microsoft-microsoft-microsoft-microsoft-microsoft.glowlaundry.comSec-WebSocket-Version: 13Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: x0MiFw="ZDllNzVmNDItODhlZS00NDZlLWI0M2YtMTViZjdkMTUwOWZjOmU2NmQ0OWFiLTcwZWItNGFjNi05NDMzLWNjMzU2NjU1MWY1Mg=="; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; brcap=0Sec-WebSocket-Key: sZg0hPSS6Gw+iNB3Ui1pXg==Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico HTTP/1.1Host: c19a3e17-d9e75f42.glowlaundry.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: x0MiFw="ZDllNzVmNDItODhlZS00NDZlLWI0M2YtMTViZjdkMTUwOWZjOmU2NmQ0OWFiLTcwZWItNGFjNi05NDMzLWNjMzU2NjU1MWY1Mg=="
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/backgrounds/2_11d9e3bcdfede9ce5ce5ace2d129f1c4.svg HTTP/1.1Host: c19a3e17-d9e75f42.glowlaundry.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: x0MiFw="ZDllNzVmNDItODhlZS00NDZlLWI0M2YtMTViZjdkMTUwOWZjOmU2NmQ0OWFiLTcwZWItNGFjNi05NDMzLWNjMzU2NjU1MWY1Mg=="
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/microsoft_logo_564db913a7fa0ca42727161c6d031bef.svg HTTP/1.1Host: c19a3e17-d9e75f42.glowlaundry.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: x0MiFw="ZDllNzVmNDItODhlZS00NDZlLWI0M2YtMTViZjdkMTUwOWZjOmU2NmQ0OWFiLTcwZWItNGFjNi05NDMzLWNjMzU2NjU1MWY1Mg=="
Source: global traffic	HTTP traffic detected: GET /nexpoint.com/winauth/ssoprobe?client-request-id=38886153-7e89-40c2-89e6-2784bcbfcf69&_=1714077267060 HTTP/1.1Host: d2dc9372-d9e75f42.glowlaundry.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://microsoft-microsoft-microsoft-microsoft-microsoft.glowlaundry.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: x0MiFw="ZDllNzVmNDItODhlZS00NDZlLWI0M2YtMTViZjdkMTUwOWZjOmU2NmQ0OWFiLTcwZWItNGFjNi05NDMzLWNjMzU2NjU1MWY1Mg=="
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/asyncchunk/convergedlogin_pconfirmsend_22b414d3a544620482c9.js HTTP/1.1Host: c19a3e17-d9e75f42.glowlaundry.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://microsoft-microsoft-microsoft-microsoft-microsoft.glowlaundry.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: x0MiFw="ZDllNzVmNDItODhlZS00NDZlLWI0M2YtMTViZjdkMTUwOWZjOmU2NmQ0OWFiLTcwZWItNGFjNi05NDMzLWNjMzU2NjU1MWY1Mg=="
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/arrow_left_43280e0ba671a1d8b5e34f1931c4fe4b.svg HTTP/1.1Host: c19a3e17-d9e75f42.glowlaundry.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://microsoft-microsoft-microsoft-microsoft-microsoft.glowlaundry.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: x0MiFw="ZDllNzVmNDItODhlZS00NDZlLWI0M2YtMTViZjdkMTUwOWZjOmU2NmQ0OWFiLTcwZWItNGFjNi05NDMzLWNjMzU2NjU1MWY1Mg=="
Source: global traffic	HTTP traffic detected: GET /dbd5a2dd-yg5cjo4ocbf9muh0oi4dnt3g-4x3dhmdnmwxzdgvuy/logintenantbranding/0/illustration?ts=637558172308712716 HTTP/1.1Host: cf595ad9-d9e75f42.glowlaundry.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://microsoft-microsoft-microsoft-microsoft-microsoft.glowlaundry.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: x0MiFw="ZDllNzVmNDItODhlZS00NDZlLWI0M2YtMTViZjdkMTUwOWZjOmU2NmQ0OWFiLTcwZWItNGFjNi05NDMzLWNjMzU2NjU1MWY1Mg=="
Source: global traffic	HTTP traffic detected: GET /dbd5a2dd-yg5cjo4ocbf9muh0oi4dnt3g-4x3dhmdnmwxzdgvuy/logintenantbranding/0/bannerlogo?ts=637558167138285006 HTTP/1.1Host: cf595ad9-d9e75f42.glowlaundry.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://microsoft-microsoft-microsoft-microsoft-microsoft.glowlaundry.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: x0MiFw="ZDllNzVmNDItODhlZS00NDZlLWI0M2YtMTViZjdkMTUwOWZjOmU2NmQ0OWFiLTcwZWItNGFjNi05NDMzLWNjMzU2NjU1MWY1Mg=="
Source: global traffic	HTTP traffic detected: GET /dbd5a2dd-yg5cjo4ocbf9muh0oi4dnt3g-4x3dhmdnmwxzdgvuy/logintenantbranding/0/favicon?ts=638239969935161721 HTTP/1.1Host: cf595ad9-d9e75f42.glowlaundry.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://microsoft-microsoft-microsoft-microsoft-microsoft.glowlaundry.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: x0MiFw="ZDllNzVmNDItODhlZS00NDZlLWI0M2YtMTViZjdkMTUwOWZjOmU2NmQ0OWFiLTcwZWItNGFjNi05NDMzLWNjMzU2NjU1MWY1Mg=="
Source: global traffic	HTTP traffic detected: GET /common/instrumentation/dssostatus HTTP/1.1Host: microsoft-microsoft-microsoft-microsoft-microsoft.glowlaundry.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: x0MiFw="ZDllNzVmNDItODhlZS00NDZlLWI0M2YtMTViZjdkMTUwOWZjOmU2NmQ0OWFiLTcwZWItNGFjNi05NDMzLWNjMzU2NjU1MWY1Mg=="; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; brcap=0
Source: global traffic	HTTP traffic detected: GET /d9e75f4288ee446eb43f15bf7d1509fc/ HTTP/1.1Host: microsoft-microsoft-microsoft-microsoft-microsoft.glowlaundry.comConnection: UpgradePragma: no-cacheCache-Control: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Upgrade: websocketOrigin: https://microsoft-microsoft-microsoft-microsoft-microsoft.glowlaundry.comSec-WebSocket-Version: 13Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: x0MiFw="ZDllNzVmNDItODhlZS00NDZlLWI0M2YtMTViZjdkMTUwOWZjOmU2NmQ0OWFiLTcwZWItNGFjNi05NDMzLWNjMzU2NjU1MWY1Mg=="; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; brcap=0Sec-WebSocket-Key: rHkexvXwmXorLJWjeqCysg==Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/arrow_left_43280e0ba671a1d8b5e34f1931c4fe4b.svg HTTP/1.1Host: c19a3e17-d9e75f42.glowlaundry.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: x0MiFw="ZDllNzVmNDItODhlZS00NDZlLWI0M2YtMTViZjdkMTUwOWZjOmU2NmQ0OWFiLTcwZWItNGFjNi05NDMzLWNjMzU2NjU1MWY1Mg=="
Source: global traffic	HTTP traffic detected: GET /dbd5a2dd-yg5cjo4ocbf9muh0oi4dnt3g-4x3dhmdnmwxzdgvuy/logintenantbranding/0/bannerlogo?ts=637558167138285006 HTTP/1.1Host: cf595ad9-d9e75f42.glowlaundry.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: x0MiFw="ZDllNzVmNDItODhlZS00NDZlLWI0M2YtMTViZjdkMTUwOWZjOmU2NmQ0OWFiLTcwZWItNGFjNi05NDMzLWNjMzU2NjU1MWY1Mg=="
Source: global traffic	HTTP traffic detected: GET /dbd5a2dd-yg5cjo4ocbf9muh0oi4dnt3g-4x3dhmdnmwxzdgvuy/logintenantbranding/0/favicon?ts=638239969935161721 HTTP/1.1Host: cf595ad9-d9e75f42.glowlaundry.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: x0MiFw="ZDllNzVmNDItODhlZS00NDZlLWI0M2YtMTViZjdkMTUwOWZjOmU2NmQ0OWFiLTcwZWItNGFjNi05NDMzLWNjMzU2NjU1MWY1Mg=="
Source: global traffic	HTTP traffic detected: GET /dbd5a2dd-yg5cjo4ocbf9muh0oi4dnt3g-4x3dhmdnmwxzdgvuy/logintenantbranding/0/illustration?ts=637558172308712716 HTTP/1.1Host: cf595ad9-d9e75f42.glowlaundry.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: x0MiFw="ZDllNzVmNDItODhlZS00NDZlLWI0M2YtMTViZjdkMTUwOWZjOmU2NmQ0OWFiLTcwZWItNGFjNi05NDMzLWNjMzU2NjU1MWY1Mg=="
Source: global traffic	HTTP traffic detected: GET /d9e75f4288ee446eb43f15bf7d1509fc/ HTTP/1.1Host: microsoft-microsoft-microsoft-microsoft-microsoft.glowlaundry.comConnection: UpgradePragma: no-cacheCache-Control: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Upgrade: websocketOrigin: https://microsoft-microsoft-microsoft-microsoft-microsoft.glowlaundry.comSec-WebSocket-Version: 13Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: x0MiFw="ZDllNzVmNDItODhlZS00NDZlLWI0M2YtMTViZjdkMTUwOWZjOmU2NmQ0OWFiLTcwZWItNGFjNi05NDMzLWNjMzU2NjU1MWY1Mg=="; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; brcap=0Sec-WebSocket-Key: Q0Oc7UEXv+MIAI5H0jyl+Q==Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
Source: global traffic	HTTP traffic detected: GET /d9e75f4288ee446eb43f15bf7d1509fc/ HTTP/1.1Host: microsoft-microsoft-microsoft-microsoft-microsoft.glowlaundry.comConnection: UpgradePragma: no-cacheCache-Control: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Upgrade: websocketOrigin: https://microsoft-microsoft-microsoft-microsoft-microsoft.glowlaundry.comSec-WebSocket-Version: 13Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: x0MiFw="ZDllNzVmNDItODhlZS00NDZlLWI0M2YtMTViZjdkMTUwOWZjOmU2NmQ0OWFiLTcwZWItNGFjNi05NDMzLWNjMzU2NjU1MWY1Mg=="; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; brcap=0Sec-WebSocket-Key: w/wdXG5V4YLOLnqtIivtlQ==Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
Source: global traffic	HTTP traffic detected: GET /d9e75f4288ee446eb43f15bf7d1509fc/ HTTP/1.1Host: microsoft-microsoft-microsoft-microsoft-microsoft.glowlaundry.comConnection: UpgradePragma: no-cacheCache-Control: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Upgrade: websocketOrigin: https://microsoft-microsoft-microsoft-microsoft-microsoft.glowlaundry.comSec-WebSocket-Version: 13Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: x0MiFw="ZDllNzVmNDItODhlZS00NDZlLWI0M2YtMTViZjdkMTUwOWZjOmU2NmQ0OWFiLTcwZWItNGFjNi05NDMzLWNjMzU2NjU1MWY1Mg=="; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; brcap=0Sec-WebSocket-Key: Dg+6/fb6yN9bsbiUr0316Q==Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
Source: global traffic	HTTP traffic detected: GET /d9e75f4288ee446eb43f15bf7d1509fc/ HTTP/1.1Host: microsoft-microsoft-microsoft-microsoft-microsoft.glowlaundry.comConnection: UpgradePragma: no-cacheCache-Control: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Upgrade: websocketOrigin: https://microsoft-microsoft-microsoft-microsoft-microsoft.glowlaundry.comSec-WebSocket-Version: 13Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: x0MiFw="ZDllNzVmNDItODhlZS00NDZlLWI0M2YtMTViZjdkMTUwOWZjOmU2NmQ0OWFiLTcwZWItNGFjNi05NDMzLWNjMzU2NjU1MWY1Mg=="; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; brcap=0Sec-WebSocket-Key: 4/Tsu3yAwBUYU1W5DH0vdQ==Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
Source: global traffic	HTTP traffic detected: GET /d9e75f4288ee446eb43f15bf7d1509fc/ HTTP/1.1Host: microsoft-microsoft-microsoft-microsoft-microsoft.glowlaundry.comConnection: UpgradePragma: no-cacheCache-Control: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Upgrade: websocketOrigin: https://microsoft-microsoft-microsoft-microsoft-microsoft.glowlaundry.comSec-WebSocket-Version: 13Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: x0MiFw="ZDllNzVmNDItODhlZS00NDZlLWI0M2YtMTViZjdkMTUwOWZjOmU2NmQ0OWFiLTcwZWItNGFjNi05NDMzLWNjMzU2NjU1MWY1Mg=="; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; brcap=0Sec-WebSocket-Key: w748AO/w/Gg0kOYie79p6Q==Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits

Source: global traffic	DNS traffic detected: DNS query: microsoft-microsoft-microsoft-microsoft-microsoft.glowlaundry.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: c19a3e17-d9e75f42.glowlaundry.com
Source: global traffic	DNS traffic detected: DNS query: 5156d9c0-d9e75f42.glowlaundry.com
Source: global traffic	DNS traffic detected: DNS query: 7944007c-d9e75f42.glowlaundry.com
Source: global traffic	DNS traffic detected: DNS query: l1ve.glowlaundry.com
Source: global traffic	DNS traffic detected: DNS query: d1e2c22d-d9e75f42.glowlaundry.com
Source: global traffic	DNS traffic detected: DNS query: d2dc9372-d9e75f42.glowlaundry.com
Source: global traffic	DNS traffic detected: DNS query: cf595ad9-d9e75f42.glowlaundry.com

Source: unknown

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Apr 2024 20:34:19 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-Encodingcache-control: privatep3p: CP="DSP CUR OTPi IND OTRi ONL FIN"x-ms-request-id: f145dae1-fd07-4f66-bf4b-de6b742f7500x-ms-ests-server: 2.1.17910.10 - SEC ProdSlicesreport-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://5156d9c0-d9e75f42.glowlaundry.com/api/report?catId=GW+estsfd+dub2"}]}nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0}x-ms-srs: 1.Preferrer-policy: strict-origin-when-cross-originaccess-control-allow-origin: access-control-allow-headers:
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Apr 2024 20:34:19 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-Encodingcache-control: privatep3p: CP="DSP CUR OTPi IND OTRi ONL FIN"x-ms-request-id: 1675624b-fad7-4e1f-89bc-19a46dc26400x-ms-ests-server: 2.1.17910.10 - FRC ProdSlicesreport-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://5156d9c0-d9e75f42.glowlaundry.com/api/report?catId=GW+estsfd+dub2"}]}nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0}x-ms-srs: 1.Preferrer-policy: strict-origin-when-cross-originaccess-control-allow-origin: access-control-allow-headers:
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Apr 2024 20:34:26 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-Encodingcache-control: privatep3p: CP="DSP CUR OTPi IND OTRi ONL FIN"x-ms-request-id: 2048724a-7f1f-4e49-a910-4a1db7db2701x-ms-ests-server: 2.1.17846.6 - FRC ProdSlicesreport-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://5156d9c0-d9e75f42.glowlaundry.com/api/report?catId=GW+estsfd+ams2"}]}nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0}x-ms-srs: 1.Preferrer-policy: strict-origin-when-cross-originaccess-control-allow-origin: access-control-allow-headers:
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Apr 2024 20:34:26 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeVary: Accept-Encodingcache-control: no-store, no-cachex-ua-compatible: IE=Edgex-cache: CONFIG_NOCACHEx-msedge-ref: Ref A: 404D2A8BCAE540A4827C75EB44DAB4B0 Ref B: AMS231032606023 Ref C: 2024-04-25T20:34:26Zaccess-control-allow-origin: access-control-allow-headers:
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Apr 2024 20:34:29 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-Encodingcache-control: privatep3p: CP="DSP CUR OTPi IND OTRi ONL FIN"x-ms-request-id: 31e72add-678b-424a-acba-02f2f8e54401x-ms-ests-server: 2.1.17846.6 - NEULR1 ProdSlicesreport-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://5156d9c0-d9e75f42.glowlaundry.com/api/report?catId=GW+estsfd+ams2"}]}nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0}x-ms-srs: 1.Preferrer-policy: strict-origin-when-cross-originaccess-control-allow-origin: access-control-allow-headers:
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Apr 2024 20:34:36 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-Encodingcache-control: privatep3p: CP="DSP CUR OTPi IND OTRi ONL FIN"x-ms-request-id: 802b1315-61ee-4c0d-a0f0-058eb8bd8801x-ms-ests-server: 2.1.17846.6 - WEULR1 ProdSlicesreport-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://5156d9c0-d9e75f42.glowlaundry.com/api/report?catId=GW+estsfd+ams2"}]}nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0}x-ms-srs: 1.Preferrer-policy: strict-origin-when-cross-originaccess-control-allow-origin: access-control-allow-headers:
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Apr 2024 20:34:43 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-Encodingcache-control: privatep3p: CP="DSP CUR OTPi IND OTRi ONL FIN"x-ms-request-id: 1b177b6d-b2bb-4097-8f8f-a04527521e01x-ms-ests-server: 2.1.17846.6 - FRC ProdSlicesreport-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://5156d9c0-d9e75f42.glowlaundry.com/api/report?catId=GW+estsfd+ams2"}]}nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0}x-ms-srs: 1.Preferrer-policy: strict-origin-when-cross-originaccess-control-allow-origin: access-control-allow-headers:
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Apr 2024 20:34:53 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-Encodingcache-control: privatep3p: CP="DSP CUR OTPi IND OTRi ONL FIN"x-ms-request-id: 2f90d348-8ce6-4c87-a87b-bfbfca160001x-ms-ests-server: 2.1.17846.6 - SEC ProdSlicesreport-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://5156d9c0-d9e75f42.glowlaundry.com/api/report?catId=GW+estsfd+ams2"}]}nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0}x-ms-srs: 1.Preferrer-policy: strict-origin-when-cross-originaccess-control-allow-origin: access-control-allow-headers:
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Apr 2024 20:34:57 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-Encodingcache-control: privatep3p: CP="DSP CUR OTPi IND OTRi ONL FIN"x-ms-request-id: 359bfa11-7289-4692-8b0e-c80222909501x-ms-ests-server: 2.1.17846.6 - WEULR1 ProdSlicesreport-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://5156d9c0-d9e75f42.glowlaundry.com/api/report?catId=GW+estsfd+ams2"}]}nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0}x-ms-srs: 1.Preferrer-policy: strict-origin-when-cross-originaccess-control-allow-origin: access-control-allow-headers:
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Apr 2024 20:35:04 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-Encodingcache-control: privatep3p: CP="DSP CUR OTPi IND OTRi ONL FIN"x-ms-request-id: 2584b3c4-fff6-488f-a9cd-e3efa9f1fd00x-ms-ests-server: 2.1.17846.6 - FRC ProdSlicesreport-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://5156d9c0-d9e75f42.glowlaundry.com/api/report?catId=GW+estsfd+ams2"}]}nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0}x-ms-srs: 1.Preferrer-policy: strict-origin-when-cross-originaccess-control-allow-origin: access-control-allow-headers:
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Apr 2024 20:35:18 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-Encodingcache-control: privatep3p: CP="DSP CUR OTPi IND OTRi ONL FIN"x-ms-request-id: 8fab7c16-c39d-4d28-9121-a374e3835401x-ms-ests-server: 2.1.17846.6 - FRC ProdSlicesreport-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://5156d9c0-d9e75f42.glowlaundry.com/api/report?catId=GW+estsfd+ams2"}]}nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0}x-ms-srs: 1.Preferrer-policy: strict-origin-when-cross-originaccess-control-allow-origin: access-control-allow-headers:

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 23.44.104.130:443 -> 192.168.2.5:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.44.104.130:443 -> 192.168.2.5:49717 version: TLS 1.2

Source: classification engine

Classification label: mal84.phis.win@17/49@24/4

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Jump to behavior

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2484 --field-trial-handle=2416,i,3840092173733629535,5917711654094720308,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://microsoft-microsoft-microsoft-microsoft-microsoft.glowlaundry.com/?office=bWhhc2Vscm90aEBuZXhwb2ludC5jb20"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2484 --field-trial-handle=2416,i,3840092173733629535,5917711654094720308,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Google Drive.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Stores files to the Windows start menu directory

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

ID:	1431879
Product:	CloudBasic
Start time:	22:33:02
Start date:	25.04.2024
Cookbook:	browseurl.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS

Windows Analysis Report
https://microsoft-microsoft-microsoft-microsoft-microsoft.glowlaundry.com/?office=bWhhc2Vscm90aEBuZXhwb2ludC5jb20

Overview

General Information

Detection

Signatures

Classification

Signatures

AV Detection

Phishing

Compliance

Networking

System Summary

Boot Survival

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Private

Contacted Domains

Contacted URLs

Windows Analysis Report https://microsoft-microsoft-microsoft-microsoft-microsoft.glowlaundry.com/?office=bWhhc2Vscm90aEBuZXhwb2ludC5jb20

Overview

General Information

Detection

Signatures

Classification

Signatures

AV Detection

Phishing

Compliance

Networking

System Summary

Boot Survival

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Private

Contacted Domains

Contacted URLs

Windows Analysis Report
https://microsoft-microsoft-microsoft-microsoft-microsoft.glowlaundry.com/?office=bWhhc2Vscm90aEBuZXhwb2ludC5jb20