Edit tour

Windows Analysis Report
https://1drv.ms/w/c/ce0aa4089a0cf823/IQQ-p_-u_0bbTp7ALMPgaKOzAZ_aMu35BXGkFN3emxCDEwQ

Overview

General Information

Sample URL:	https://1drv.ms/w/c/ce0aa4089a0cf823/IQQ-p_-u_0bbTp7ALMPgaKOzAZ_aMu35BXGkFN3emxCDEwQ
Analysis ID:	1620164
Infos:

Detection

HTMLPhisher

Score:	84
Range:	0 - 100
Confidence:	100%

Signatures

AI detected phishing page

Antivirus detection for URL or domain

Suricata IDS alerts for network traffic

Yara detected HtmlPhish10

Yara detected HtmlPhish7

Found HTTP page in a blob

Detected non-DNS traffic on DNS port

HTML body contains password input but no form action

HTML page contains hidden javascript code

HTML title does not match URL

Classification

Process Tree

System is w10x64

chrome.exe (PID: 4932 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 5272 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2404 --field-trial-handle=2364,i,1527513384130028705,13607475018593567481,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 4132 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://1drv.ms/w/c/ce0aa4089a0cf823/IQQ-p_-u_0bbTp7ALMPgaKOzAZ_aMu35BXGkFN3emxCDEwQ" MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

cleanup

Yara Signatures

HTML

Source	Rule	Description	Author
3.13.pages.csv	JoeSecurity_HtmlPhish_7	Yara detected HtmlPhish_7	Joe Security
3.13.pages.csv	JoeSecurity_HtmlPhish_10	Yara detected HtmlPhish_10	Joe Security
3.17.pages.csv	JoeSecurity_HtmlPhish_7	Yara detected HtmlPhish_7	Joe Security
3.17.pages.csv	JoeSecurity_HtmlPhish_10	Yara detected HtmlPhish_10	Joe Security
3.14.pages.csv	JoeSecurity_HtmlPhish_7	Yara detected HtmlPhish_7	Joe Security
3.14.pages.csv	JoeSecurity_HtmlPhish_10	Yara detected HtmlPhish_10	Joe Security
Click to see the 1 entries

Suricata Signatures

ETPRO PHISHING Successful Generic Phish 2021-03-25

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-20T18:28:13.490145+0100	2847819	1	Successful Credential Theft Detected	192.168.2.6	60073	162.0.235.245	443	TCP
2025-02-20T18:28:25.158104+0100	2847819	1	Successful Credential Theft Detected	192.168.2.6	60078	162.0.235.245	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: https://bafkreicxrgcgc4jkmoordg67rc3riwiz3tejk3d2e4os4sqqqszj5lthqu.ipfs.nftstorage.link/	Avira URL Cloud: Label: malware
Source: https://bafkreihyvdhu6gjisoghs3rpgx4megynkegu4pyw4alo5a6r6idpr266cq.ipfs.nftstorage.link/	Avira URL Cloud: Label: malware
Source: https://britishcounsel.org.in/cgi/cgi/e-hfjbsndsjdkb.html	Avira URL Cloud: Label: phishing
Source: https://bafkreidltp6ockde5z54hk3a46lifxrkoapwjzmrsxszgdv3tiogpirej4.ipfs.nftstorage.link/	Avira URL Cloud: Label: malware
Source: https://bafkreibo6bopl3uphffghgihpwi6ckxd5v7xemrtmmelzqcr73fhfuwxxa.ipfs.nftstorage.link/	Avira URL Cloud: Label: malware
Source: https://bafkreidr44uzhhqxl5fotu74yzc5nnzyt3budjd2qskq4bdrs4zr7xbc6e.ipfs.nftstorage.link/	Avira URL Cloud: Label: malware

Phishing

AI detected phishing page

Source: blob:https://britishcounsel.org.in/5e842727-4cb4-4a01-a6b1-7ec5b9ea9a70	Joe Sandbox AI: Score: 9 Reasons: The brand 'Microsoft' is well-known and typically associated with the domain 'microsoft.com'., The URL provided is 'blob:https://britishcounsel.org.in/5e842727-4cb4-4a01-a6b1-7ec5b9ea9a70', which does not match the legitimate domain for Microsoft., The domain 'britishcounsel.org.in' is unrelated to Microsoft and suggests a potential phishing attempt., The use of 'blob:' in the URL is unusual for a legitimate Microsoft login page., The presence of input fields for 'Email address' and 'Password' on an unrelated domain increases the suspicion of phishing. DOM: 3.14.pages.csv
Source: blob:https://britishcounsel.org.in/5e842727-4cb4-4a01-a6b1-7ec5b9ea9a70	Joe Sandbox AI: Score: 9 Reasons: The brand 'Microsoft' is well-known and typically associated with the domain 'microsoft.com'., The URL provided is 'blob:https://britishcounsel.org.in/5e842727-4cb4-4a01-a6b1-7ec5b9ea9a70', which does not match the legitimate domain for Microsoft., The domain 'britishcounsel.org.in' is unrelated to Microsoft and suggests a potential phishing attempt., The use of 'blob:' in the URL is unusual for legitimate login pages and can be used to obscure the true destination of the link., The presence of input fields for 'Email address' and 'Password' on a non-Microsoft domain is suspicious and indicative of phishing. DOM: 3.17.pages.csv

Yara detected HtmlPhish10

Source: Yara match	File source: 3.13.pages.csv, type: HTML
Source: Yara match	File source: 3.17.pages.csv, type: HTML
Source: Yara match	File source: 3.14.pages.csv, type: HTML

Yara detected HtmlPhish7

Source: Yara match	File source: 3.13.pages.csv, type: HTML
Source: Yara match	File source: 3.17.pages.csv, type: HTML
Source: Yara match	File source: 3.14.pages.csv, type: HTML

Found HTTP page in a blob

Source: blob:https://britishcounsel.org.in/5e842727-4cb4-4a01-a6b1-7ec5b9ea9a70

DOM page: Blob-based

Source: blob:https://britishcounsel.org.in/5e842727-4cb4-4a01-a6b1-7ec5b9ea9a70

HTTP Parser: <input type="password" .../> found but no <form action="...

Source: https://onedrive.live.com/edit?id=CE0AA4089A0CF823!saeffa73e46ff4edb9ec02cc3e068a3b3&resid=CE0AA4089A0CF823!saeffa73e46ff4edb9ec02cc3e068a3b3&cid=ce0aa4089a0cf823&ithint=file%2cdocx&redeem=aHR0cHM6Ly8xZHJ2Lm1zL3cvYy9jZTBhYTQwODlhMGNmODIzL0lRUS1wXy11XzBiYlRwN0FMTVBnYUtPekFaX2FNdTM1QlhHa0ZOM2VteENERXdR&migratedtospo=true&embed=1&wdo=2

HTTP Parser: Base64 decoded: https://1drv.ms/w/c/ce0aa4089a0cf823/IQQ-p_-u_0bbTp7ALMPgaKOzAZ_aMu35BXGkFN3emxCDEwQ

Source: blob:https://britishcounsel.org.in/5e842727-4cb4-4a01-a6b1-7ec5b9ea9a70

HTTP Parser: Title: OneDrive does not match URL

Source: blob:https://britishcounsel.org.in/5e842727-4cb4-4a01-a6b1-7ec5b9ea9a70

HTTP Parser: <input type="password" .../> found

Source: https://onedrive.live.com/edit?id=CE0AA4089A0CF823!saeffa73e46ff4edb9ec02cc3e068a3b3&resid=CE0AA4089A0CF823!saeffa73e46ff4edb9ec02cc3e068a3b3&cid=ce0aa4089a0cf823&ithint=file%2Cdocx&redeem=aHR0cHM6Ly8xZHJ2Lm1zL3cvYy9jZTBhYTQwODlhMGNmODIzL0lRUS1wXy11XzBiYlRwN0FMTVBnYUtPekFaX2FNdTM1QlhHa0ZOM2VteENERXdR&migratedtospo=true&embed=1&wdo=2	HTTP Parser: No favicon
Source: blob:https://britishcounsel.org.in/5e842727-4cb4-4a01-a6b1-7ec5b9ea9a70	HTTP Parser: No favicon
Source: blob:https://britishcounsel.org.in/5e842727-4cb4-4a01-a6b1-7ec5b9ea9a70	HTTP Parser: No favicon
Source: blob:https://britishcounsel.org.in/5e842727-4cb4-4a01-a6b1-7ec5b9ea9a70	HTTP Parser: No favicon
Source: https://www.zillow.com/homedetails/1122-Fieldstone-Dr-Canton-GA-30114/54836019_zpid/	HTTP Parser: No favicon
Source: https://www.zillow.com/homedetails/1122-Fieldstone-Dr-Canton-GA-30114/54836019_zpid/	HTTP Parser: No favicon

Source: blob:https://britishcounsel.org.in/5e842727-4cb4-4a01-a6b1-7ec5b9ea9a70	HTTP Parser: No <meta name="author".. found
Source: blob:https://britishcounsel.org.in/5e842727-4cb4-4a01-a6b1-7ec5b9ea9a70	HTTP Parser: No <meta name="author".. found
Source: blob:https://britishcounsel.org.in/5e842727-4cb4-4a01-a6b1-7ec5b9ea9a70	HTTP Parser: No <meta name="author".. found

Source: blob:https://britishcounsel.org.in/5e842727-4cb4-4a01-a6b1-7ec5b9ea9a70	HTTP Parser: No <meta name="copyright".. found
Source: blob:https://britishcounsel.org.in/5e842727-4cb4-4a01-a6b1-7ec5b9ea9a70	HTTP Parser: No <meta name="copyright".. found
Source: blob:https://britishcounsel.org.in/5e842727-4cb4-4a01-a6b1-7ec5b9ea9a70	HTTP Parser: No <meta name="copyright".. found

Source: unknown	HTTPS traffic detected: 40.113.103.199:443 -> 192.168.2.6:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:49717 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:54595 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.103.199:443 -> 192.168.2.6:59904 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.103.199:443 -> 192.168.2.6:60059 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.103.199:443 -> 192.168.2.6:60101 version: TLS 1.2

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2847819 - Severity 1 - ETPRO PHISHING Successful Generic Phish 2021-03-25 : 192.168.2.6:60073 -> 162.0.235.245:443
Source: Network traffic	Suricata IDS: 2847819 - Severity 1 - ETPRO PHISHING Successful Generic Phish 2021-03-25 : 192.168.2.6:60078 -> 162.0.235.245:443

Source: global traffic	TCP traffic: 192.168.2.6:54556 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.6:59855 -> 162.159.36.2:53

Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199

Source: global traffic	HTTP traffic detected: GET /w/c/ce0aa4089a0cf823/IQQ-p_-u_0bbTp7ALMPgaKOzAZ_aMu35BXGkFN3emxCDEwQ HTTP/1.1Host: 1drv.msConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /redir?cid=ce0aa4089a0cf823&resid=CE0AA4089A0CF823!saeffa73e46ff4edb9ec02cc3e068a3b3&ithint=file%2cdocx&embed=1&migratedtospo=true&redeem=aHR0cHM6Ly8xZHJ2Lm1zL3cvYy9jZTBhYTQwODlhMGNmODIzL0lRUS1wXy11XzBiYlRwN0FMTVBnYUtPekFaX2FNdTM1QlhHa0ZOM2VteENERXdR HTTP/1.1Host: onedrive.live.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /edit?id=CE0AA4089A0CF823!saeffa73e46ff4edb9ec02cc3e068a3b3&resid=CE0AA4089A0CF823!saeffa73e46ff4edb9ec02cc3e068a3b3&cid=ce0aa4089a0cf823&ithint=file%2cdocx&redeem=aHR0cHM6Ly8xZHJ2Lm1zL3cvYy9jZTBhYTQwODlhMGNmODIzL0lRUS1wXy11XzBiYlRwN0FMTVBnYUtPekFaX2FNdTM1QlhHa0ZOM2VteENERXdR&migratedtospo=true&embed=1&wdo=2 HTTP/1.1Host: onedrive.live.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: E=P:EwLMztNR3Yg=:Jv2MswpQfsOawAQ5KU7YJZ66T1z3UYpan7o0UDVAZDY=:F; xid=e027a3f3-7979-48d1-a19c-2af1de4a19aa&&ODSP-ODWEB-ODCF&84; xidseq=1
Source: global traffic	HTTP traffic detected: GET /v1.0/token HTTP/1.1Host: api-badgerp.svc.msConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_api/v2.0/shares/u!aHR0cHM6Ly8xZHJ2Lm1zL3cvYy9jZTBhYTQwODlhMGNmODIzL0lRUS1wXy11XzBiYlRwN0FMTVBnYUtPekFaX2FNdTM1QlhHa0ZOM2VteENERXdR/driveItem?action=EmbedView&$select=id,openWith,officebundle,currentUserRole,eTag,name,size,content.downloadUrl,file,sharepointIds,sensitivityLabel,webUrl,webDavUrl,parentReference,vault HTTP/1.1Host: my.microsoftpersonalcontent.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /v5.0/wl.ms.js HTTP/1.1Host: js.live.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://usc-word-view.officeapps.live.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://usc-word-view.officeapps.live.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /v5.0/wl.ms.js HTTP/1.1Host: js.live.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /consumers/oauth2/v2.0/authorize?client_id=243c63a3-247d-41c5-9d83-7788c43f1c43&scope=e03a13ee-9730-4cae-8525-47559c8cf18a%2F.default%20openid%20profile%20offline_access&redirect_uri=https%3A%2F%2Foauth.officeapps.live.com%2Foa%2FOAuth.html&client-request-id=c225c757-eeef-4146-ac60-5225311e5818&response_mode=fragment&response_type=code&x-client-SKU=msal.js.browser&x-client-VER=4.2.0&x-app-name=OfficeOnline&x-app-ver=PRODUCTION.50:%2020250214.5%20V3&client_info=1&code_challenge=_7HhEK59seUECLP2h0wDjihbEMGYWt74QIY4Gc1Z6y4&code_challenge_method=S256&prompt=none&domain_hint=9188040d-6c67-4c5b-b112-36a304b66dad&login_hint=urn%3Aspo%3Atenantanon%239188040d-6c67-4c5b-b112-36a304b66dad&X-AnchorMailbox=UPN%3Aurn%3Aspo%3Atenantanon%239188040d-6c67-4c5b-b112-36a304b66dad&nonce=01952466-806c-7281-8261-66b0bc81b3ed&state=eyJpZCI6IjAxOTUyNDY2LTgwNmItN2Q4Ny1hYmQzLWYwMDYzZDYxYjFjYSIsIm1ldGEiOnsiaW50ZXJhY3Rpb25UeXBlIjoic2lsZW50In19&claims=%7B%22access_token%22%3A%7B%22xms_cc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D HTTP/1.1Host: login.microsoftonline.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://oauth.officeapps.live.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /campaignmetadataaggregator?country=US&locale=en-US&app=2155&platform=Web&version=16.0.18613.41008&campaignParams=pageWidth%3D1280%26pageHeight%3D907%26screenWidth%3D1280%26screenHeight%3D1024%26colorDepth%3D24%26more%3Dtrue%26OFC_Audience%3DProduction%26Datacenter%3DPUS1%26TenantId%3D9188040d-6c67-4c5b-b112-36a304b66dad%26SelfTriggerActivity%3D%3Bfloodgateflight101a%3Bfloodgateflight103cf%3Bfloodgateflight37a%3Bfloodgateflight58a%3Bfloodgateflight68b%26&contentType=CampaignContent%3BDynamicSettings&puid=&OFC_FLIGHTS=floodgateflight101a%3Bfloodgateflight103cf%3Bfloodgateflight37a%3Bfloodgateflight58a%3Bfloodgateflight68b%3B&ageGroup=0&sessionUserType=2 HTTP/1.1Host: messaging.engagement.office.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"x-correlationid: 67c21c41-edbd-4195-1085-fd33d0e06fcbsec-ch-ua-mobile: ?0x-clientsessionid: 5e0848ae-de3d-4e70-a6c0-5b8e927946bdUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Origin: https://usc-word-view.officeapps.live.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://usc-word-view.officeapps.live.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /campaignmetadataaggregator?country=US&locale=en-US&app=2155&platform=Web&version=16.0.18613.41008&campaignParams=pageWidth%3D1280%26pageHeight%3D907%26screenWidth%3D1280%26screenHeight%3D1024%26colorDepth%3D24%26more%3Dtrue%26OFC_Audience%3DProduction%26Datacenter%3DPUS1%26TenantId%3D9188040d-6c67-4c5b-b112-36a304b66dad%26SelfTriggerActivity%3D%3Bfloodgateflight101a%3Bfloodgateflight103cf%3Bfloodgateflight37a%3Bfloodgateflight58a%3Bfloodgateflight68b%26&contentType=CampaignContent%3BDynamicSettings&puid=&OFC_FLIGHTS=floodgateflight101a%3Bfloodgateflight103cf%3Bfloodgateflight37a%3Bfloodgateflight58a%3Bfloodgateflight68b%3B&ageGroup=0&sessionUserType=2 HTTP/1.1Host: messaging.engagement.office.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cgi/cgi/e-hfjbsndsjdkb.html HTTP/1.1Host: britishcounsel.org.inConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /consumers/oauth2/v2.0/authorize?client_id=243c63a3-247d-41c5-9d83-7788c43f1c43&scope=e03a13ee-9730-4cae-8525-47559c8cf18a%2F.default%20openid%20profile%20offline_access&redirect_uri=https%3A%2F%2Foauth.officeapps.live.com%2Foa%2FOAuth.html&client-request-id=76d0ee44-9256-495a-bff3-309e5b92d1a3&response_mode=fragment&response_type=code&x-client-SKU=msal.js.browser&x-client-VER=4.2.0&x-app-name=OfficeOnline&x-app-ver=PRODUCTION.50:%2020250214.5%20V3&client_info=1&code_challenge=Iz54QTAwRd22HK3Vr-Q7o8i_-YqGgtX8xXzRcnCBtU4&code_challenge_method=S256&prompt=none&domain_hint=9188040d-6c67-4c5b-b112-36a304b66dad&login_hint=urn%3Aspo%3Atenantanon%239188040d-6c67-4c5b-b112-36a304b66dad&X-AnchorMailbox=UPN%3Aurn%3Aspo%3Atenantanon%239188040d-6c67-4c5b-b112-36a304b66dad&nonce=01952466-9484-7b8e-8635-e3fe2a0fcd15&state=eyJpZCI6IjAxOTUyNDY2LTk0ODEtN2E4Zi04YWMwLTE1NjA4ZTgyMTNkZSIsIm1ldGEiOnsiaW50ZXJhY3Rpb25UeXBlIjoic2lsZW50In19&claims=%7B%22access_token%22%3A%7B%22xms_cc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D HTTP/1.1Host: login.microsoftonline.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://oauth.officeapps.live.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: fpc=AgLcLk9hFDZPvZX1IYQG4lw; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd
Source: global traffic	HTTP traffic detected: GET /cgi/cgi/jquery.js HTTP/1.1Host: britishcounsel.org.inConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://britishcounsel.org.in/cgi/cgi/e-hfjbsndsjdkb.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /consumers/oauth2/v2.0/authorize?client_id=243c63a3-247d-41c5-9d83-7788c43f1c43&scope=e03a13ee-9730-4cae-8525-47559c8cf18a%2F.default%20openid%20profile%20offline_access&redirect_uri=https%3A%2F%2Foauth.officeapps.live.com%2Foa%2FOAuth.html&client-request-id=c06e65a1-d262-4bd6-ba7d-42813a9af45a&response_mode=fragment&response_type=code&x-client-SKU=msal.js.browser&x-client-VER=4.2.0&x-app-name=OfficeOnline&x-app-ver=PRODUCTION.50:%2020250214.5%20V3&client_info=1&code_challenge=ZL6Ub8-uk1cc-BQ2ifG7NLhWly4bSdHdpJaa0hiAP6I&code_challenge_method=S256&prompt=none&domain_hint=9188040d-6c67-4c5b-b112-36a304b66dad&login_hint=urn%3Aspo%3Atenantanon%239188040d-6c67-4c5b-b112-36a304b66dad&X-AnchorMailbox=UPN%3Aurn%3Aspo%3Atenantanon%239188040d-6c67-4c5b-b112-36a304b66dad&nonce=01952466-9807-7722-8d57-480deebcd7fa&state=eyJpZCI6IjAxOTUyNDY2LTk4MDYtN2E4YS04YzNjLTYzOTZlODI1OWVkNyIsIm1ldGEiOnsiaW50ZXJhY3Rpb25UeXBlIjoic2lsZW50In19&claims=%7B%22access_token%22%3A%7B%22xms_cc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D HTTP/1.1Host: login.microsoftonline.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://oauth.officeapps.live.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: fpc=AgLcLk9hFDZPvZX1IYQG4lw; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd
Source: global traffic	HTTP traffic detected: GET /cgi/cgi/basic.js HTTP/1.1Host: britishcounsel.org.inConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://britishcounsel.org.in/cgi/cgi/e-hfjbsndsjdkb.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cgi/cgi/jquery.js HTTP/1.1Host: britishcounsel.org.inConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cgi/jquery.js HTTP/1.1Host: britishcounsel.org.inConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cgi/cgi/basic.js HTTP/1.1Host: britishcounsel.org.inConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /consumers/oauth2/v2.0/authorize?client_id=243c63a3-247d-41c5-9d83-7788c43f1c43&scope=e03a13ee-9730-4cae-8525-47559c8cf18a%2F.default%20openid%20profile%20offline_access&redirect_uri=https%3A%2F%2Foauth.officeapps.live.com%2Foa%2FOAuth.html&client-request-id=4db62330-9293-4454-8b70-24762e1671cf&response_mode=fragment&response_type=code&x-client-SKU=msal.js.browser&x-client-VER=4.2.0&x-app-name=OfficeOnline&x-app-ver=PRODUCTION.50:%2020250214.5%20V3&client_info=1&code_challenge=-ScH9Ix3k3ugxA8jhtHYMyUR4vvES4hpEwK8MxGxoQk&code_challenge_method=S256&prompt=none&domain_hint=9188040d-6c67-4c5b-b112-36a304b66dad&login_hint=urn%3Aspo%3Atenantanon%239188040d-6c67-4c5b-b112-36a304b66dad&X-AnchorMailbox=UPN%3Aurn%3Aspo%3Atenantanon%239188040d-6c67-4c5b-b112-36a304b66dad&nonce=01952466-a806-71c8-8162-999c951eb0de&state=eyJpZCI6IjAxOTUyNDY2LWE4MDYtN2MyZS1iNzY3LTA1MDliZGE5ZmJlMyIsIm1ldGEiOnsiaW50ZXJhY3Rpb25UeXBlIjoic2lsZW50In19&claims=%7B%22access_token%22%3A%7B%22xms_cc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D HTTP/1.1Host: login.microsoftonline.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://oauth.officeapps.live.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: fpc=AgLcLk9hFDZPvZX1IYQG4lw; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd
Source: global traffic	HTTP traffic detected: GET /jquery-3.1.1.min.js HTTP/1.1Host: code.jquery.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bootstrap/4.0.0/css/bootstrap.min.css HTTP/1.1Host: maxcdn.bootstrapcdn.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://britishcounsel.org.insec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: styleAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /jquery-3.2.1.slim.min.js HTTP/1.1Host: code.jquery.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://britishcounsel.org.insec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bootstrap/4.0.0/js/bootstrap.min.js HTTP/1.1Host: maxcdn.bootstrapcdn.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://britishcounsel.org.insec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /585b051251.js HTTP/1.1Host: kit.fontawesome.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://britishcounsel.org.insec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ajax/libs/popper.js/1.12.9/umd/popper.min.js HTTP/1.1Host: cdnjs.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://britishcounsel.org.insec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cgi/jquery.js HTTP/1.1Host: britishcounsel.org.inConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ajax/libs/popper.js/1.12.9/umd/popper.min.js HTTP/1.1Host: cdnjs.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /jquery-3.1.1.min.js HTTP/1.1Host: code.jquery.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bootstrap/4.0.0/js/bootstrap.min.js HTTP/1.1Host: maxcdn.bootstrapcdn.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /jquery-3.2.1.slim.min.js HTTP/1.1Host: code.jquery.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /images/one-drive-icon/one-drive-icon-28.jpg HTTP/1.1Host: icon-library.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: bafkreicxrgcgc4jkmoordg67rc3riwiz3tejk3d2e4os4sqqqszj5lthqu.ipfs.nftstorage.linkConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: bafkreifk2jhnl43decleyuk3tce4wkkdxp4dbnahaomzvu4xn7hic5xfkq.ipfs.nftstorage.linkConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: bafkreihyvdhu6gjisoghs3rpgx4megynkegu4pyw4alo5a6r6idpr266cq.ipfs.nftstorage.linkConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: bafkreibo6bopl3uphffghgihpwi6ckxd5v7xemrtmmelzqcr73fhfuwxxa.ipfs.nftstorage.linkConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: bafkreidr44uzhhqxl5fotu74yzc5nnzyt3budjd2qskq4bdrs4zr7xbc6e.ipfs.nftstorage.linkConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: bafkreidltp6ockde5z54hk3a46lifxrkoapwjzmrsxszgdv3tiogpirej4.ipfs.nftstorage.linkConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /5sLeYjL.png HTTP/1.1Host: i.imgur.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /removed.png HTTP/1.1Host: i.imgur.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: bafkreicxrgcgc4jkmoordg67rc3riwiz3tejk3d2e4os4sqqqszj5lthqu.ipfs.nftstorage.linkConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: bafkreidr44uzhhqxl5fotu74yzc5nnzyt3budjd2qskq4bdrs4zr7xbc6e.ipfs.nftstorage.linkConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /images/one-drive-icon/one-drive-icon-28.jpg HTTP/1.1Host: icon-library.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: bafkreidltp6ockde5z54hk3a46lifxrkoapwjzmrsxszgdv3tiogpirej4.ipfs.nftstorage.linkConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: bafkreibo6bopl3uphffghgihpwi6ckxd5v7xemrtmmelzqcr73fhfuwxxa.ipfs.nftstorage.linkConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /removed.png HTTP/1.1Host: i.imgur.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: bafkreifk2jhnl43decleyuk3tce4wkkdxp4dbnahaomzvu4xn7hic5xfkq.ipfs.nftstorage.linkConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: bafkreihyvdhu6gjisoghs3rpgx4megynkegu4pyw4alo5a6r6idpr266cq.ipfs.nftstorage.linkConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /mdromNs.png HTTP/1.1Host: i.imgur.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /mdromNs.png HTTP/1.1Host: i.imgur.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /consumers/oauth2/v2.0/authorize?client_id=243c63a3-247d-41c5-9d83-7788c43f1c43&scope=e03a13ee-9730-4cae-8525-47559c8cf18a%2F.default%20openid%20profile%20offline_access&redirect_uri=https%3A%2F%2Foauth.officeapps.live.com%2Foa%2FOAuth.html&client-request-id=53957254-ab96-49a2-a318-727aa68a0311&response_mode=fragment&response_type=code&x-client-SKU=msal.js.browser&x-client-VER=4.2.0&x-app-name=OfficeOnline&x-app-ver=PRODUCTION.50:%2020250214.5%20V3&client_info=1&code_challenge=0jYPctT-fPQuJW0BOwYwNF6zBGYXGkVdGyM61NpIxHE&code_challenge_method=S256&prompt=none&domain_hint=9188040d-6c67-4c5b-b112-36a304b66dad&login_hint=urn%3Aspo%3Atenantanon%239188040d-6c67-4c5b-b112-36a304b66dad&X-AnchorMailbox=UPN%3Aurn%3Aspo%3Atenantanon%239188040d-6c67-4c5b-b112-36a304b66dad&nonce=01952466-f62a-73cc-919d-d423eb1d06da&state=eyJpZCI6IjAxOTUyNDY2LWY2MmEtNzlmZC1hNTFiLTVjM2UwZjJkMDY0NyIsIm1ldGEiOnsiaW50ZXJhY3Rpb25UeXBlIjoic2lsZW50In19&claims=%7B%22access_token%22%3A%7B%22xms_cc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D HTTP/1.1Host: login.microsoftonline.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://oauth.officeapps.live.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: fpc=AgLcLk9hFDZPvZX1IYQG4lw; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd
Source: global traffic	HTTP traffic detected: GET /consumers/oauth2/v2.0/authorize?client_id=243c63a3-247d-41c5-9d83-7788c43f1c43&scope=e03a13ee-9730-4cae-8525-47559c8cf18a%2F.default%20openid%20profile%20offline_access&redirect_uri=https%3A%2F%2Foauth.officeapps.live.com%2Foa%2FOAuth.html&client-request-id=fb71280b-b14c-4a29-9beb-fe753ffd1c9c&response_mode=fragment&response_type=code&x-client-SKU=msal.js.browser&x-client-VER=4.2.0&x-app-name=OfficeOnline&x-app-ver=PRODUCTION.50:%2020250214.5%20V3&client_info=1&code_challenge=9rw7hNfVy2XThylZP5IqX5T2CILECfxF_C0GQgEmowg&code_challenge_method=S256&prompt=none&domain_hint=9188040d-6c67-4c5b-b112-36a304b66dad&login_hint=urn%3Aspo%3Atenantanon%239188040d-6c67-4c5b-b112-36a304b66dad&X-AnchorMailbox=UPN%3Aurn%3Aspo%3Atenantanon%239188040d-6c67-4c5b-b112-36a304b66dad&nonce=01952466-f689-7d5d-b990-7384dceb65ed&state=eyJpZCI6IjAxOTUyNDY2LWY2ODktNzE0YS04YTljLWY5ZDZhMTkyMDZkNCIsIm1ldGEiOnsiaW50ZXJhY3Rpb25UeXBlIjoic2lsZW50In19&claims=%7B%22access_token%22%3A%7B%22xms_cc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D HTTP/1.1Host: login.microsoftonline.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://oauth.officeapps.live.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: fpc=AgLcLk9hFDZPvZX1IYQG4lw; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd
Source: global traffic	HTTP traffic detected: GET /homedetails/1122-Fieldstone-Dr-Canton-GA-30114/54836019_zpid/ HTTP/1.1Host: www.zillow.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /HYx10rg3/captcha/captcha.js?a=c&u=1798e132-efb0-11ef-8df9-d9cc1af15524&v=&m=0 HTTP/1.1Host: www.zillow.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.zillow.com/homedetails/1122-Fieldstone-Dr-Canton-GA-30114/54836019_zpid/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /HYx10rg3/captcha/captcha.js?a=c&u=1798e132-efb0-11ef-8df9-d9cc1af15524&v=&m=0 HTTP/1.1Host: www.zillow.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /PXHYx10rg3/main.min.js HTTP/1.1Host: client.px-cloud.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.zillow.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /s3/pfs/static/z-logo-default.svg HTTP/1.1Host: www.zillowstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.zillow.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /PXHYx10rg3/main.min.js HTTP/1.1Host: client.px-cloud.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bd/h.php HTTP/1.1Host: crcldu.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Origin: https://www.zillow.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.zillow.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ns?c=1798e132-efb0-11ef-8df9-d9cc1af15524 HTTP/1.1Host: stk.px-cloud.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Origin: https://www.zillow.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.zillow.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /s3/pfs/static/z-logo-default.svg HTTP/1.1Host: www.zillowstatic.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: www.zillow.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.zillow.com/homedetails/1122-Fieldstone-Dr-Canton-GA-30114/54836019_zpid/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bd/h.php HTTP/1.1Host: crcldu.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/js/bundle HTTP/1.1Host: collector-pxhyx10rg3.px-cloud.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ns?c=1798e132-efb0-11ef-8df9-d9cc1af15524 HTTP/1.1Host: stk.px-cloud.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: www.zillow.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _px3=23239197f1df295b6d8a130a7fd8295857f90ba79e789a99d333c98014d6b4cd:ldp4MUTO4/ePsBVpFba8QLoIByVBWuvlDbkEHQ2qdb2xZFcGi8YauYSVX5quyVPnt2UNzACjasdfY7TsbsmBzw==:1000:UX2mXT08BR1jkdWk96SLoWNRNrlvRP7syGKbguqVFjl5MSwVBoeAldlT71DVKQA5ntX3a+0HYS+MiL0gbGfq/nrMo44smId3rgsPVXnDDeKjP9SRcmeg3hdg3klFG6PvZWq7QyEyOJ8cRfsk8S814qvmIRTBnNUfpY+mheFy8ZKsNMxo9JTcVIUtaDsROTeKl4FVNkvL2Pgec44+z3jRO9V6sHcXNDUYFuW2iypNGO8=; pxcts=1989c812-efb0-11ef-82ff-8babb5cf3d31; _pxvid=1989bbf0-efb0-11ef-82ff-3d011261c939
Source: global traffic	HTTP traffic detected: GET /b/g?payload=aUkQRhAIEHh2WmR9X3hRZEVVDxAeEFYQCEkQV0t8eWtmA3xhA10PEAhUU15BVx4QaHpVZFdbd2V3AgoPEAgQYmoDAwUGBxAeEHlkAmtqAAoAdXVnDxAIEEJKWlEQHhBzd2NKGcFlnQ39IRQ8^QCFRTXkFiXHhB:nZmGNKdV9VkpWV3tZGcw8QCB`_BaRkZCQQgdHUVFRRxIW15eXUUcUV}1fEH^VpdX1dWVG0ZTW15BHQMDAA9AfdFtXXlZBRl1cVDx92QK7B9xU1xGXVwfdXMfAQIDAwYdBwY7KAQQCAwttSEJbVh0QT09v&appId=PXHYx10rg3&tag=v9.2.7&uuid=1798e132-efb0-11ef-8df9-d9cc1af15524&ft=340&seq=1&en=NTA&cs=5cba142bc4965f8c60161dc44708de4319e48c6e638a2f20d831c8c4b6789257&pc=7768172299512718&sid=1989c5fe-efb0-11ef-82ff-8babb5cf3d31%F3%A0%84%B1%F3%A0%84%B7%F3%A0%84%B4%F3%A0%84%B0%F3%A0%84%B0%F3%A0%84%B7%F3%A0%84%B2%F3%A0%84%B5%F3%A0%84%B0%F3%A0%84%B9%F3%A0%84%B3%F3%A0%84%B7%F3%A0%84%B4&vid=1989bbf0-efb0-11ef-82ff-3d011261c939&ci=198d54f0-efb0-11ef-826d-f3e3460eeff0&cts=1989c812-efb0-11ef-82ff-8babb5cf3d31 HTTP/1.1Host: collector-pxhyx10rg3.px-client.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Origin: https://www.zillow.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.zillow.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: 1drv.ms
Source: global traffic	DNS traffic detected: DNS query: onedrive.live.com
Source: global traffic	DNS traffic detected: DNS query: api-badgerp.svc.ms
Source: global traffic	DNS traffic detected: DNS query: my.microsoftpersonalcontent.com
Source: global traffic	DNS traffic detected: DNS query: spo.nel.measure.office.net
Source: global traffic	DNS traffic detected: DNS query: js.live.net
Source: global traffic	DNS traffic detected: DNS query: 15.164.165.52.in-addr.arpa
Source: global traffic	DNS traffic detected: DNS query: messaging.engagement.office.com
Source: global traffic	DNS traffic detected: DNS query: login.microsoftonline.com
Source: global traffic	DNS traffic detected: DNS query: britishcounsel.org.in
Source: global traffic	DNS traffic detected: DNS query: code.jquery.com
Source: global traffic	DNS traffic detected: DNS query: maxcdn.bootstrapcdn.com
Source: global traffic	DNS traffic detected: DNS query: cdnjs.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: kit.fontawesome.com
Source: global traffic	DNS traffic detected: DNS query: icon-library.com
Source: global traffic	DNS traffic detected: DNS query: bafkreicxrgcgc4jkmoordg67rc3riwiz3tejk3d2e4os4sqqqszj5lthqu.ipfs.nftstorage.link
Source: global traffic	DNS traffic detected: DNS query: bafkreidr44uzhhqxl5fotu74yzc5nnzyt3budjd2qskq4bdrs4zr7xbc6e.ipfs.nftstorage.link
Source: global traffic	DNS traffic detected: DNS query: bafkreihyvdhu6gjisoghs3rpgx4megynkegu4pyw4alo5a6r6idpr266cq.ipfs.nftstorage.link
Source: global traffic	DNS traffic detected: DNS query: bafkreifk2jhnl43decleyuk3tce4wkkdxp4dbnahaomzvu4xn7hic5xfkq.ipfs.nftstorage.link
Source: global traffic	DNS traffic detected: DNS query: bafkreibo6bopl3uphffghgihpwi6ckxd5v7xemrtmmelzqcr73fhfuwxxa.ipfs.nftstorage.link
Source: global traffic	DNS traffic detected: DNS query: i.imgur.com
Source: global traffic	DNS traffic detected: DNS query: bafkreidltp6ockde5z54hk3a46lifxrkoapwjzmrsxszgdv3tiogpirej4.ipfs.nftstorage.link
Source: global traffic	DNS traffic detected: DNS query: organizationforrecoveryllc.com
Source: global traffic	DNS traffic detected: DNS query: wordonline.nel.measure.office.net
Source: global traffic	DNS traffic detected: DNS query: m365cdn.nel.measure.office.net
Source: global traffic	DNS traffic detected: DNS query: www.zillow.com
Source: global traffic	DNS traffic detected: DNS query: client.px-cloud.net
Source: global traffic	DNS traffic detected: DNS query: www.zillowstatic.com
Source: global traffic	DNS traffic detected: DNS query: stk.px-cloud.net
Source: global traffic	DNS traffic detected: DNS query: crcldu.com
Source: global traffic	DNS traffic detected: DNS query: collector-pxhyx10rg3.px-cloud.net
Source: global traffic	DNS traffic detected: DNS query: collector-pxhyx10rg3.px-client.net

Source: unknown

HTTP traffic detected: POST /v1.0/token HTTP/1.1Host: api-badgerp.svc.msConnection: keep-aliveContent-Length: 48sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Type: application/jsonAccept: */*Origin: https://onedrive.live.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://onedrive.live.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Thu, 20 Feb 2025 17:27:46 GMTContent-Length: 9Connection: closeaccess-control-allow-headers: accept, accept-langauge, content-language, content-type, fa-kit-tokenaccess-control-allow-methods: GET, OPTIONSaccess-control-allow-origin: *access-control-max-age: 3000Cache-Control: max-age=0, private, must-revalidatex-request-id: GCX6sE7BGc2hz5G3N0kBCF-Cache-Status: MISSServer: cloudflareCF-RAY: 915035917c6218c0-EWR
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: CloudFrontContent-Type: text/htmlContent-Length: 4672Connection: closeDate: Thu, 20 Feb 2025 17:28:26 GMTCache-Control: no-cacheX-Cache: LambdaGeneratedResponse from cloudfrontVia: 1.1 13140684c599ca32163cf7ec1871cebc.cloudfront.net (CloudFront)X-Amz-Cf-Pop: FRA56-C2X-Amz-Cf-Id: nk_Q3VLhnAJGZrfZCH3KRfAqGPLQ6uN9q1aEwS4eoV43PMvnFSoBpA==X-XSS-Protection: 1Referrer-Policy: strict-origin-when-cross-originX-Content-Type-Options: nosniffStrict-Transport-Security: max-age=63072000; includeSubDomains; preloadX-DNS-Prefetch-Control: off

Source: chromecache_256.3.dr, chromecache_247.3.dr	String found in binary or memory: http://opensource.org/licenses/MIT).
Source: chromecache_154.3.dr, chromecache_195.3.dr	String found in binary or memory: http://projects.nikhilk.net
Source: chromecache_274.3.dr	String found in binary or memory: https://ajax.aspnetcdn.com/ajax/jQuery/jquery-1.11.3.min.js
Source: chromecache_275.3.dr	String found in binary or memory: https://arc.msn.com/v3/Delivery/Events/Impression?PID=426105004&TID=1&CID=128000000005273409&BID=121
Source: chromecache_203.3.dr	String found in binary or memory: https://arc.msn.com/v3/Delivery/Events/Impression?PID=426105004&TID=1&CID=128000000005273409&BID=371
Source: chromecache_220.3.dr, chromecache_254.3.dr	String found in binary or memory: https://artifacts.dev.azure.com/office/_apis/symbol/symsrv/WordViewerDS.dll1.js.map/dd0117b5233accbd
Source: chromecache_200.3.dr, chromecache_166.3.dr	String found in binary or memory: https://artifacts.dev.azure.com/office/_apis/symbol/symsrv/WordViewerDS.js.map/2e18e1aca6ca88be7e7a6
Source: chromecache_199.3.dr, chromecache_183.3.dr	String found in binary or memory: https://artifacts.dev.azure.com/office/_apis/symbol/symsrv/appResourceLoader.min.js.map/5ad2f740332b
Source: chromecache_274.3.dr	String found in binary or memory: https://augloop.office.com/v2;394866fc-eedb-4f01-8536-3ff84b16be2a;liveprofilecard.access;https://gr
Source: chromecache_152.3.dr	String found in binary or memory: https://britishcounsel.org.in/cgi/cgi/basic.js
Source: chromecache_276.3.dr	String found in binary or memory: https://britishcounsel.org.in/cgi/cgi/e-hfjbsndsjdkb.html
Source: chromecache_152.3.dr	String found in binary or memory: https://britishcounsel.org.in/cgi/cgi/jquery.js
Source: chromecache_176.3.dr, chromecache_146.3.dr	String found in binary or memory: https://bugs.chromium.org/p/chromium/issues/detail?id=378607
Source: chromecache_176.3.dr, chromecache_146.3.dr	String found in binary or memory: https://bugs.chromium.org/p/chromium/issues/detail?id=449857
Source: chromecache_176.3.dr, chromecache_146.3.dr	String found in binary or memory: https://bugs.chromium.org/p/chromium/issues/detail?id=470258
Source: chromecache_176.3.dr, chromecache_146.3.dr	String found in binary or memory: https://bugs.chromium.org/p/chromium/issues/detail?id=589347
Source: chromecache_176.3.dr, chromecache_146.3.dr	String found in binary or memory: https://bugs.jquery.com/ticket/12359
Source: chromecache_176.3.dr, chromecache_146.3.dr	String found in binary or memory: https://bugs.jquery.com/ticket/13378
Source: chromecache_176.3.dr, chromecache_146.3.dr	String found in binary or memory: https://bugs.jquery.com/ticket/13393
Source: chromecache_176.3.dr, chromecache_146.3.dr	String found in binary or memory: https://bugs.jquery.com/ticket/4833
Source: chromecache_176.3.dr, chromecache_146.3.dr	String found in binary or memory: https://bugs.webkit.org/show_bug.cgi?id=136851
Source: chromecache_176.3.dr, chromecache_146.3.dr	String found in binary or memory: https://bugs.webkit.org/show_bug.cgi?id=137337
Source: chromecache_176.3.dr, chromecache_146.3.dr	String found in binary or memory: https://bugs.webkit.org/show_bug.cgi?id=29084
Source: chromecache_176.3.dr, chromecache_146.3.dr	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=687787
Source: chromecache_250.3.dr	String found in binary or memory: https://captcha.px-cloud.net/PXHYx10rg3/captcha.js?a=c&u=1798e132-efb0-11ef-8df9-d9cc1af15524&am
Source: chromecache_176.3.dr, chromecache_146.3.dr	String found in binary or memory: https://developer.mozilla.org/en-US/docs/CSS/display
Source: chromecache_176.3.dr, chromecache_146.3.dr	String found in binary or memory: https://drafts.csswg.org/cssom/#common-serializing-idioms
Source: chromecache_176.3.dr, chromecache_146.3.dr	String found in binary or memory: https://drafts.csswg.org/cssom/#resolved-values
Source: chromecache_197.3.dr, chromecache_200.3.dr, chromecache_166.3.dr, chromecache_177.3.dr	String found in binary or memory: https://feross.org
Source: chromecache_197.3.dr, chromecache_177.3.dr	String found in binary or memory: https://feross.org/opensource
Source: chromecache_250.3.dr	String found in binary or memory: https://fonts.googleapis.com/css2?family=Roboto:ital
Source: chromecache_270.3.dr, chromecache_219.3.dr, chromecache_265.3.dr	String found in binary or memory: https://getbootstrap.com)
Source: chromecache_176.3.dr, chromecache_146.3.dr	String found in binary or memory: https://github.com/eslint/eslint/issues/3229
Source: chromecache_176.3.dr, chromecache_146.3.dr	String found in binary or memory: https://github.com/jquery/jquery/pull/557)
Source: chromecache_176.3.dr, chromecache_146.3.dr	String found in binary or memory: https://github.com/jquery/sizzle/pull/225
Source: chromecache_176.3.dr, chromecache_146.3.dr	String found in binary or memory: https://github.com/jrburke/requirejs/wiki/Updating-existing-libraries#wiki-anon
Source: chromecache_270.3.dr, chromecache_219.3.dr, chromecache_265.3.dr	String found in binary or memory: https://github.com/twbs/bootstrap/blob/master/LICENSE)
Source: chromecache_219.3.dr, chromecache_265.3.dr	String found in binary or memory: https://github.com/twbs/bootstrap/graphs/contributors)
Source: chromecache_176.3.dr, chromecache_146.3.dr	String found in binary or memory: https://github.com/whatwg/html/issues/2369
Source: chromecache_176.3.dr, chromecache_146.3.dr	String found in binary or memory: https://html.spec.whatwg.org/#nonce-attributes
Source: chromecache_176.3.dr, chromecache_146.3.dr	String found in binary or memory: https://html.spec.whatwg.org/#strip-and-collapse-whitespace
Source: chromecache_176.3.dr, chromecache_146.3.dr	String found in binary or memory: https://html.spec.whatwg.org/multipage/forms.html#category-listed
Source: chromecache_176.3.dr, chromecache_146.3.dr	String found in binary or memory: https://html.spec.whatwg.org/multipage/forms.html#concept-fe-disabled
Source: chromecache_176.3.dr, chromecache_146.3.dr	String found in binary or memory: https://html.spec.whatwg.org/multipage/forms.html#concept-option-disabled
Source: chromecache_176.3.dr, chromecache_146.3.dr	String found in binary or memory: https://html.spec.whatwg.org/multipage/scripting.html#selector-disabled
Source: chromecache_176.3.dr, chromecache_146.3.dr	String found in binary or memory: https://html.spec.whatwg.org/multipage/scripting.html#selector-enabled
Source: chromecache_176.3.dr, chromecache_146.3.dr	String found in binary or memory: https://html.spec.whatwg.org/multipage/syntax.html#attributes-2
Source: chromecache_176.3.dr, chromecache_146.3.dr	String found in binary or memory: https://infra.spec.whatwg.org/#strip-and-collapse-ascii-whitespace
Source: chromecache_176.3.dr, chromecache_146.3.dr	String found in binary or memory: https://jquery.com/
Source: chromecache_176.3.dr, chromecache_146.3.dr	String found in binary or memory: https://jquery.org/license
Source: chromecache_176.3.dr, chromecache_146.3.dr	String found in binary or memory: https://js.foundation/
Source: chromecache_176.3.dr, chromecache_146.3.dr	String found in binary or memory: https://jsperf.com/getall-vs-sizzle/2
Source: chromecache_176.3.dr, chromecache_146.3.dr	String found in binary or memory: https://jsperf.com/thor-indexof-vs-for/5
Source: chromecache_197.3.dr, chromecache_177.3.dr	String found in binary or memory: https://localcdn.centro-dev.com:5555/floodgate.bundle.js.map
Source: chromecache_150.3.dr, chromecache_232.3.dr	String found in binary or memory: https://my.microsoftpersonalcontent.com
Source: chromecache_176.3.dr, chromecache_146.3.dr	String found in binary or memory: https://promisesaplus.com/#point-48
Source: chromecache_176.3.dr, chromecache_146.3.dr	String found in binary or memory: https://promisesaplus.com/#point-54
Source: chromecache_176.3.dr, chromecache_146.3.dr	String found in binary or memory: https://promisesaplus.com/#point-57
Source: chromecache_176.3.dr, chromecache_146.3.dr	String found in binary or memory: https://promisesaplus.com/#point-59
Source: chromecache_176.3.dr, chromecache_146.3.dr	String found in binary or memory: https://promisesaplus.com/#point-61
Source: chromecache_176.3.dr, chromecache_146.3.dr	String found in binary or memory: https://promisesaplus.com/#point-64
Source: chromecache_176.3.dr, chromecache_146.3.dr	String found in binary or memory: https://promisesaplus.com/#point-75
Source: chromecache_232.3.dr	String found in binary or memory: https://reactjs.org/link/react-polyfills
Source: chromecache_149.3.dr	String found in binary or memory: https://res.cdn.office.net/admincenter/admin-main/2025.2.13.3/
Source: chromecache_149.3.dr	String found in binary or memory: https://res.cdn.office.net/admincenter/admin-main/2025.2.13.3/floodgate.en.bundle.js
Source: chromecache_275.3.dr, chromecache_203.3.dr	String found in binary or memory: https://res.public.onecdn.static.microsoft/creativeservice/771b615f-7bfd-5632-88e3-7c6c0a9c95d7_1299
Source: chromecache_275.3.dr, chromecache_203.3.dr	String found in binary or memory: https://res.public.onecdn.static.microsoft/creativeservice/a233183c-56a2-8d77-21fa-cd9bc65cec2b_1299
Source: chromecache_176.3.dr, chromecache_146.3.dr	String found in binary or memory: https://sizzlejs.com/
Source: chromecache_274.3.dr	String found in binary or memory: https://usc-word-view.officeapps.live.com
Source: chromecache_176.3.dr, chromecache_146.3.dr	String found in binary or memory: https://web.archive.org/web/20100324014747/http://blindsignals.com/index.php/2009/07/jquery-delay/
Source: chromecache_176.3.dr, chromecache_146.3.dr	String found in binary or memory: https://web.archive.org/web/20141116233347/http://fluidproject.org/blog/2008/01/09/getting-setting-a
Source: chromecache_274.3.dr	String found in binary or memory: https://wise-m-backup.public.onecdn.static.microsoft/wise/owl/sharedauthclientmsal.0bc2a2ab48c870862
Source: chromecache_274.3.dr	String found in binary or memory: https://wise.public.cdn.office.net/wise/owl/sharedauthclientmsal.0bc2a2ab48c8708625e2.js
Source: chromecache_278.3.dr	String found in binary or memory: https://www.zillow.com/homedetails/1122-Fieldstone-Dr-Canton-GA-30114/54836019_zpid/
Source: chromecache_250.3.dr	String found in binary or memory: https://www.zillowstatic.com/s3/pfs/static/z-logo-default.svg

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60036 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60059 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59993 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60013 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59947
Source: unknown	Network traffic detected: HTTP traffic on port 54783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59878 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60094 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59944
Source: unknown	Network traffic detected: HTTP traffic on port 60097 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60015
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60013
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60012
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60011
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60098
Source: unknown	Network traffic detected: HTTP traffic on port 60022 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60097
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60096
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60019
Source: unknown	Network traffic detected: HTTP traffic on port 54568 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60018
Source: unknown	Network traffic detected: HTTP traffic on port 60068 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60017
Source: unknown	Network traffic detected: HTTP traffic on port 60062 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60083 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60054 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54783
Source: unknown	Network traffic detected: HTTP traffic on port 60079 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54605 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60023
Source: unknown	Network traffic detected: HTTP traffic on port 60002 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60022
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60021
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60020
Source: unknown	Network traffic detected: HTTP traffic on port 59938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60030 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54582 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59920 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59867 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60029
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60028
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60038 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60063 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60009 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59947 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60015 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59968
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59967
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59966
Source: unknown	Network traffic detected: HTTP traffic on port 60096 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60037
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60036
Source: unknown	Network traffic detected: HTTP traffic on port 60001 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54573 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60031
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60030
Source: unknown	Network traffic detected: HTTP traffic on port 60066 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59927 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 59998 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60039
Source: unknown	Network traffic detected: HTTP traffic on port 54589 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59887 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60038
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54605
Source: unknown	Network traffic detected: HTTP traffic on port 59967 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60091 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60004 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60018 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60077 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54568
Source: unknown	Network traffic detected: HTTP traffic on port 54595 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59978
Source: unknown	Network traffic detected: HTTP traffic on port 60074 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54573
Source: unknown	Network traffic detected: HTTP traffic on port 60021 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 60029 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60080 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 60088 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54617
Source: unknown	Network traffic detected: HTTP traffic on port 60084 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59968 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60017 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60062
Source: unknown	Network traffic detected: HTTP traffic on port 60078 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59902
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59904
Source: unknown	Network traffic detected: HTTP traffic on port 60090 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59867
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60059
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59993
Source: unknown	Network traffic detected: HTTP traffic on port 60106 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54635 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60054
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54582
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54581
Source: unknown	Network traffic detected: HTTP traffic on port 54581 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60081 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59902 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60012 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60037 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60073
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60072
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59998
Source: unknown	Network traffic detected: HTTP traffic on port 60075 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60093 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54589
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59878
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59999
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59886
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60068
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60101
Source: unknown	Network traffic detected: HTTP traffic on port 60072 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54595
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60066
Source: unknown	Network traffic detected: HTTP traffic on port 60023 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60063
Source: unknown	Network traffic detected: HTTP traffic on port 59928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60101 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60106
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60104
Source: unknown	Network traffic detected: HTTP traffic on port 60011 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59928
Source: unknown	Network traffic detected: HTTP traffic on port 59966 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60084
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60083
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59927
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60081
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60080
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54635
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59887
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59920
Source: unknown	Network traffic detected: HTTP traffic on port 60076 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60079
Source: unknown	Network traffic detected: HTTP traffic on port 60073 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60078
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60077
Source: unknown	Network traffic detected: HTTP traffic on port 60020 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60076
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60075
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60074
Source: unknown	Network traffic detected: HTTP traffic on port 59904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60028 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60104 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 60089 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54617 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 60031 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60095
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60094
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59938
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60093
Source: unknown	Network traffic detected: HTTP traffic on port 60039 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60091
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60090
Source: unknown	Network traffic detected: HTTP traffic on port 60095 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60098 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60004
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60002
Source: unknown	Network traffic detected: HTTP traffic on port 60000 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60089
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60000
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60088
Source: unknown	Network traffic detected: HTTP traffic on port 60019 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60009
Source: unknown	Network traffic detected: HTTP traffic on port 59999 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 59886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2404 --field-trial-handle=2364,i,1527513384130028705,13607475018593567481,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://1drv.ms/w/c/ce0aa4089a0cf823/IQQ-p_-u_0bbTp7ALMPgaKOzAZ_aMu35BXGkFN3emxCDEwQ"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2404 --field-trial-handle=2364,i,1527513384130028705,13607475018593567481,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: chromecache_197.3.dr, chromecache_177.3.dr	Binary or memory string: ",ConnectVirtualMachine:"
Source: chromecache_197.3.dr, chromecache_177.3.dr	Binary or memory string: ",DisconnectVirtualMachine:"

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	1 Process Injection	1 Process Injection	OS Credential Dumping	1 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	4 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	5 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	3 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Source	Detection	Scanner	Label
https://britishcounsel.org.in/cgi/jquery.js	0%	Avira URL Cloud	safe
https://bafkreicxrgcgc4jkmoordg67rc3riwiz3tejk3d2e4os4sqqqszj5lthqu.ipfs.nftstorage.link/	100%	Avira URL Cloud	malware
https://britishcounsel.org.in/cgi/cgi/basic.js	0%	Avira URL Cloud	safe
https://wise-m-backup.public.onecdn.static.microsoft/wise/owl/sharedauthclientmsal.0bc2a2ab48c870862	0%	Avira URL Cloud	safe
https://organizationforrecoveryllc.com/B3N/OCT4/reform/def.php	0%	Avira URL Cloud	safe
blob:https://britishcounsel.org.in/5e842727-4cb4-4a01-a6b1-7ec5b9ea9a70	0%	Avira URL Cloud	safe
http://projects.nikhilk.net	0%	Avira URL Cloud	safe
https://britishcounsel.org.in/cgi/cgi/jquery.js	0%	Avira URL Cloud	safe
https://bafkreihyvdhu6gjisoghs3rpgx4megynkegu4pyw4alo5a6r6idpr266cq.ipfs.nftstorage.link/	100%	Avira URL Cloud	malware
https://britishcounsel.org.in/cgi/cgi/e-hfjbsndsjdkb.html	100%	Avira URL Cloud	phishing
https://bafkreidltp6ockde5z54hk3a46lifxrkoapwjzmrsxszgdv3tiogpirej4.ipfs.nftstorage.link/	100%	Avira URL Cloud	malware
https://bafkreibo6bopl3uphffghgihpwi6ckxd5v7xemrtmmelzqcr73fhfuwxxa.ipfs.nftstorage.link/	100%	Avira URL Cloud	malware
https://bafkreidr44uzhhqxl5fotu74yzc5nnzyt3budjd2qskq4bdrs4zr7xbc6e.ipfs.nftstorage.link/	100%	Avira URL Cloud	malware

Name	IP	Active	Malicious	Reputation
www.zillowstatic.com	18.245.86.90	true	false	high
dual-spo-0005.spo-msedge.net	13.107.136.10	true	false	high
bafkreibo6bopl3uphffghgihpwi6ckxd5v7xemrtmmelzqcr73fhfuwxxa.ipfs.nftstorage.link	104.18.41.40	true	false	unknown
www.zillow.com	13.32.27.81	true	false	high
a1894.dscb.akamai.net	95.101.54.121	true	false	high
icon-library.com	78.46.106.103	true	false	high
bafkreicxrgcgc4jkmoordg67rc3riwiz3tejk3d2e4os4sqqqszj5lthqu.ipfs.nftstorage.link	104.18.41.40	true	false	unknown
wac-0003.wac-msedge.net	52.108.8.12	true	false	high
organizationforrecoveryllc.com	162.0.235.245	true	true	unknown
bafkreidltp6ockde5z54hk3a46lifxrkoapwjzmrsxszgdv3tiogpirej4.ipfs.nftstorage.link	104.18.41.40	true	false	unknown
prod-campaignaggregator.omexexternallfb.office.net.akadns.net	52.111.240.11	true	false	high
code.jquery.com	151.101.66.137	true	false	high
a726.dscd.akamai.net	104.124.11.65	true	false	high
cdnjs.cloudflare.com	104.17.25.14	true	false	high
www.google.com	172.217.18.4	true	false	high
cosmic-westeurope-ns-ceb6f0ee85ee.trafficmanager.net	20.101.246.164	true	false	high
cosmic-westeurope-ns-cbf6e4cb41a8.trafficmanager.net	51.105.104.217	true	false	high
britishcounsel.org.in	45.142.237.175	true	true	unknown
ipv4.imgur.map.fastly.net	199.232.196.193	true	false	high
kit.fontawesome.com.cdn.cloudflare.net	172.64.147.188	true	false	high
www.tm.ak.prd.aadg.trafficmanager.net	40.126.32.68	true	false	high
bafkreidr44uzhhqxl5fotu74yzc5nnzyt3budjd2qskq4bdrs4zr7xbc6e.ipfs.nftstorage.link	104.18.41.40	true	false	unknown
b-0004.b-msedge.net	13.107.6.156	true	false	high
maxcdn.bootstrapcdn.com	104.18.10.207	true	false	high
bafkreihyvdhu6gjisoghs3rpgx4megynkegu4pyw4alo5a6r6idpr266cq.ipfs.nftstorage.link	104.18.41.40	true	false	unknown
stk.px-cloud.net	34.107.199.61	true	false	high
1drv.ms	13.107.42.12	true	false	high
collector-pxhyx10rg3.px-client.net	35.190.10.96	true	false	high
dual-spov-0006.spov-msedge.net	13.107.137.11	true	false	high
collector-pxhyx10rg3.px-cloud.net	35.190.10.96	true	false	high
bafkreifk2jhnl43decleyuk3tce4wkkdxp4dbnahaomzvu4xn7hic5xfkq.ipfs.nftstorage.link	104.18.41.40	true	false	unknown
s-0005.dual-s-msedge.net	52.123.129.14	true	false	high
crcldu.com	104.18.38.117	true	false	high
perimeterx2.map.fastly.net	151.101.1.40	true	false	high
my.microsoftpersonalcontent.com	unknown	unknown	false	high
api-badgerp.svc.ms	unknown	unknown	false	high
js.live.net	unknown	unknown	false	high
m365cdn.nel.measure.office.net	unknown	unknown	false	high
spo.nel.measure.office.net	unknown	unknown	false	high
onedrive.live.com	unknown	unknown	false	high
messaging.engagement.office.com	unknown	unknown	false	high
15.164.165.52.in-addr.arpa	unknown	unknown	false	high
kit.fontawesome.com	unknown	unknown	false	high
wordonline.nel.measure.office.net	unknown	unknown	false	high
client.px-cloud.net	unknown	unknown	false	high
i.imgur.com	unknown	unknown	false	high
login.microsoftonline.com	unknown	unknown	false	high

Name	Malicious	Antivirus Detection	Reputation
https://organizationforrecoveryllc.com/B3N/OCT4/reform/def.php	true	Avira URL Cloud: safe	unknown
https://code.jquery.com/jquery-3.2.1.slim.min.js	false		high
https://onedrive.live.com/edit?id=CE0AA4089A0CF823!saeffa73e46ff4edb9ec02cc3e068a3b3&resid=CE0AA4089A0CF823!saeffa73e46ff4edb9ec02cc3e068a3b3&cid=ce0aa4089a0cf823&ithint=file%2cdocx&redeem=aHR0cHM6Ly8xZHJ2Lm1zL3cvYy9jZTBhYTQwODlhMGNmODIzL0lRUS1wXy11XzBiYlRwN0FMTVBnYUtPekFaX2FNdTM1QlhHa0ZOM2VteENERXdR&migratedtospo=true&embed=1&wdo=2	false		high
blob:https://britishcounsel.org.in/5e842727-4cb4-4a01-a6b1-7ec5b9ea9a70	true	Avira URL Cloud: safe	unknown
https://spo.nel.measure.office.net/api/report?tenantId=9188040d-6c67-4c5b-b112-36a304b66dad&destinationEndpoint=Edge-Prod-BL2r8d&frontEnd=AFD&RemoteIP=8.46.123.0	false		high
https://collector-pxhyx10rg3.px-client.net/b/g?payload=aUkQRhAIEHh2WmR9X3hRZEVVDxAeEFYQCEkQV0t8eWtmA3xhA10PEAhUU15BVx4QaHpVZFdbd2V3AgoPEAgQYmoDAwUGBxAeEHlkAmtqAAoAdXVnDxAIEEJKWlEQHhBzd2NKGcFlnQ39IRQ8^QCFRTXkFiXHhB:nZmGNKdV9VkpWV3tZGcw8QCB`_BaRkZCQQgdHUVFRRxIW15eXUUcUV}1fEH^VpdX1dWVG0ZTW15BHQMDAA9AfdFtXXlZBRl1cVDx92QK7B9xU1xGXVwfdXMfAQIDAwYdBwY7KAQQCAwttSEJbVh0QT09v&appId=PXHYx10rg3&tag=v9.2.7&uuid=1798e132-efb0-11ef-8df9-d9cc1af15524&ft=340&seq=1&en=NTA&cs=5cba142bc4965f8c60161dc44708de4319e48c6e638a2f20d831c8c4b6789257&pc=7768172299512718&sid=1989c5fe-efb0-11ef-82ff-8babb5cf3d31%F3%A0%84%B1%F3%A0%84%B7%F3%A0%84%B4%F3%A0%84%B0%F3%A0%84%B0%F3%A0%84%B7%F3%A0%84%B2%F3%A0%84%B5%F3%A0%84%B0%F3%A0%84%B9%F3%A0%84%B3%F3%A0%84%B7%F3%A0%84%B4&vid=1989bbf0-efb0-11ef-82ff-3d011261c939&ci=198d54f0-efb0-11ef-826d-f3e3460eeff0&cts=1989c812-efb0-11ef-82ff-8babb5cf3d31	false		high
https://bafkreicxrgcgc4jkmoordg67rc3riwiz3tejk3d2e4os4sqqqszj5lthqu.ipfs.nftstorage.link/	false	Avira URL Cloud: malware	unknown
https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0/js/bootstrap.min.js	false		high
https://kit.fontawesome.com/585b051251.js	false		high
https://i.imgur.com/removed.png	false		high
https://my.microsoftpersonalcontent.com/_api/v2.0/shares/u!aHR0cHM6Ly8xZHJ2Lm1zL3cvYy9jZTBhYTQwODlhMGNmODIzL0lRUS1wXy11XzBiYlRwN0FMTVBnYUtPekFaX2FNdTM1QlhHa0ZOM2VteENERXdR/driveItem?action=EmbedView&$select=id,openWith,officebundle,currentUserRole,eTag,name,size,content.downloadUrl,file,sharepointIds,sensitivityLabel,webUrl,webDavUrl,parentReference,vault	false		high
https://britishcounsel.org.in/cgi/cgi/basic.js	false	Avira URL Cloud: safe	unknown
https://messaging.engagement.office.com/campaignmetadataaggregator?country=US&locale=en-US&app=2155&platform=Web&version=16.0.18613.41008&campaignParams=pageWidth%3D1280%26pageHeight%3D907%26screenWidth%3D1280%26screenHeight%3D1024%26colorDepth%3D24%26more%3Dtrue%26OFC_Audience%3DProduction%26Datacenter%3DPUS1%26TenantId%3D9188040d-6c67-4c5b-b112-36a304b66dad%26SelfTriggerActivity%3D%3Bfloodgateflight101a%3Bfloodgateflight103cf%3Bfloodgateflight37a%3Bfloodgateflight58a%3Bfloodgateflight68b%26&contentType=CampaignContent%3BDynamicSettings&puid=&OFC_FLIGHTS=floodgateflight101a%3Bfloodgateflight103cf%3Bfloodgateflight37a%3Bfloodgateflight58a%3Bfloodgateflight68b%3B&ageGroup=0&sessionUserType=2	false		high
https://crcldu.com/bd/h.php	false		high
https://britishcounsel.org.in/cgi/jquery.js	false	Avira URL Cloud: safe	unknown
https://m365cdn.nel.measure.office.net/api/report?FrontEnd=AkamaiCDNWorldWide&DestinationEndpoint=DUSSELDORF&ASN=20940&Country=DE&Region=NW&RequestIdentifier=0.e90d7b5c.1740072458.1b3a0c24&TotalRTCDNTime=86&CompressionType=gzip&FileSize=167	false		high
https://wordonline.nel.measure.office.net/api/report?FrontEnd=NoAFD&DestinationEndpoint=None&DC=PUS1&FileSource=	false		high
https://collector-pxhyx10rg3.px-cloud.net/assets/js/bundle	false		high
https://client.px-cloud.net/PXHYx10rg3/main.min.js	false		high
https://onedrive.live.com/edit?id=CE0AA4089A0CF823!saeffa73e46ff4edb9ec02cc3e068a3b3&resid=CE0AA4089A0CF823!saeffa73e46ff4edb9ec02cc3e068a3b3&cid=ce0aa4089a0cf823&ithint=file%2Cdocx&redeem=aHR0cHM6Ly8xZHJ2Lm1zL3cvYy9jZTBhYTQwODlhMGNmODIzL0lRUS1wXy11XzBiYlRwN0FMTVBnYUtPekFaX2FNdTM1QlhHa0ZOM2VteENERXdR&migratedtospo=true&embed=1&wdo=2	false		high
https://britishcounsel.org.in/cgi/cgi/jquery.js	false	Avira URL Cloud: safe	unknown
https://britishcounsel.org.in/cgi/cgi/e-hfjbsndsjdkb.html	false	Avira URL Cloud: phishing	unknown
https://bafkreihyvdhu6gjisoghs3rpgx4megynkegu4pyw4alo5a6r6idpr266cq.ipfs.nftstorage.link/	false	Avira URL Cloud: malware	unknown
https://bafkreidltp6ockde5z54hk3a46lifxrkoapwjzmrsxszgdv3tiogpirej4.ipfs.nftstorage.link/	false	Avira URL Cloud: malware	unknown
https://1drv.ms/w/c/ce0aa4089a0cf823/IQQ-p_-u_0bbTp7ALMPgaKOzAZ_aMu35BXGkFN3emxCDEwQ	false		high
https://icon-library.com/images/one-drive-icon/one-drive-icon-28.jpg	false		high
https://i.imgur.com/5sLeYjL.png	false		high
https://stk.px-cloud.net/ns?c=1798e132-efb0-11ef-8df9-d9cc1af15524	false		high
https://onedrive.live.com/redir?cid=ce0aa4089a0cf823&resid=CE0AA4089A0CF823!saeffa73e46ff4edb9ec02cc3e068a3b3&ithint=file%2cdocx&embed=1&migratedtospo=true&redeem=aHR0cHM6Ly8xZHJ2Lm1zL3cvYy9jZTBhYTQwODlhMGNmODIzL0lRUS1wXy11XzBiYlRwN0FMTVBnYUtPekFaX2FNdTM1QlhHa0ZOM2VteENERXdR	false		high
https://www.zillow.com/HYx10rg3/captcha/captcha.js?a=c&u=1798e132-efb0-11ef-8df9-d9cc1af15524&v=&m=0	false		high
https://www.zillow.com/homedetails/1122-Fieldstone-Dr-Canton-GA-30114/54836019_zpid/	false		high
https://www.zillowstatic.com/s3/pfs/static/z-logo-default.svg	false		high
https://js.live.net/v5.0/wl.ms.js	false		high
https://code.jquery.com/jquery-3.1.1.min.js	false		high
https://www.zillow.com/favicon.ico	false		high
https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0/css/bootstrap.min.css	false		high
https://bafkreibo6bopl3uphffghgihpwi6ckxd5v7xemrtmmelzqcr73fhfuwxxa.ipfs.nftstorage.link/	false	Avira URL Cloud: malware	unknown
https://bafkreidr44uzhhqxl5fotu74yzc5nnzyt3budjd2qskq4bdrs4zr7xbc6e.ipfs.nftstorage.link/	false	Avira URL Cloud: malware	unknown
https://cdnjs.cloudflare.com/ajax/libs/popper.js/1.12.9/umd/popper.min.js	false		high
https://i.imgur.com/mdromNs.png	false		high

Name	Source	Malicious	Antivirus Detection	Reputation
https://artifacts.dev.azure.com/office/_apis/symbol/symsrv/WordViewerDS.js.map/2e18e1aca6ca88be7e7a6	chromecache_200.3.dr, chromecache_166.3.dr	false		high
https://web.archive.org/web/20100324014747/http://blindsignals.com/index.php/2009/07/jquery-delay/	chromecache_176.3.dr, chromecache_146.3.dr	false		high
https://promisesaplus.com/#point-75	chromecache_176.3.dr, chromecache_146.3.dr	false		high
https://html.spec.whatwg.org/multipage/forms.html#concept-fe-disabled	chromecache_176.3.dr, chromecache_146.3.dr	false		high
https://bugs.webkit.org/show_bug.cgi?id=29084	chromecache_176.3.dr, chromecache_146.3.dr	false		high
https://infra.spec.whatwg.org/#strip-and-collapse-ascii-whitespace	chromecache_176.3.dr, chromecache_146.3.dr	false		high
https://html.spec.whatwg.org/multipage/forms.html#concept-option-disabled	chromecache_176.3.dr, chromecache_146.3.dr	false		high
https://res.public.onecdn.static.microsoft/creativeservice/a233183c-56a2-8d77-21fa-cd9bc65cec2b_1299	chromecache_275.3.dr, chromecache_203.3.dr	false		high
https://github.com/twbs/bootstrap/graphs/contributors)	chromecache_219.3.dr, chromecache_265.3.dr	false		high
https://wise-m-backup.public.onecdn.static.microsoft/wise/owl/sharedauthclientmsal.0bc2a2ab48c870862	chromecache_274.3.dr	false	Avira URL Cloud: safe	unknown
https://github.com/jrburke/requirejs/wiki/Updating-existing-libraries#wiki-anon	chromecache_176.3.dr, chromecache_146.3.dr	false		high
https://bugzilla.mozilla.org/show_bug.cgi?id=687787	chromecache_176.3.dr, chromecache_146.3.dr	false		high
https://captcha.px-cloud.net/PXHYx10rg3/captcha.js?a=c&u=1798e132-efb0-11ef-8df9-d9cc1af15524&am	chromecache_250.3.dr	false		high
https://bugs.chromium.org/p/chromium/issues/detail?id=470258	chromecache_176.3.dr, chromecache_146.3.dr	false		high
http://opensource.org/licenses/MIT).	chromecache_256.3.dr, chromecache_247.3.dr	false		high
https://bugs.jquery.com/ticket/13378	chromecache_176.3.dr, chromecache_146.3.dr	false		high
https://promisesaplus.com/#point-64	chromecache_176.3.dr, chromecache_146.3.dr	false		high
https://promisesaplus.com/#point-61	chromecache_176.3.dr, chromecache_146.3.dr	false		high
https://my.microsoftpersonalcontent.com	chromecache_150.3.dr, chromecache_232.3.dr	false		high
https://html.spec.whatwg.org/#nonce-attributes	chromecache_176.3.dr, chromecache_146.3.dr	false		high
https://jsperf.com/getall-vs-sizzle/2	chromecache_176.3.dr, chromecache_146.3.dr	false		high
https://ajax.aspnetcdn.com/ajax/jQuery/jquery-1.11.3.min.js	chromecache_274.3.dr	false		high
https://developer.mozilla.org/en-US/docs/CSS/display	chromecache_176.3.dr, chromecache_146.3.dr	false		high
https://jquery.com/	chromecache_176.3.dr, chromecache_146.3.dr	false		high
https://res.public.onecdn.static.microsoft/creativeservice/771b615f-7bfd-5632-88e3-7c6c0a9c95d7_1299	chromecache_275.3.dr, chromecache_203.3.dr	false		high
http://projects.nikhilk.net	chromecache_154.3.dr, chromecache_195.3.dr	false	Avira URL Cloud: safe	unknown
https://github.com/twbs/bootstrap/blob/master/LICENSE)	chromecache_270.3.dr, chromecache_219.3.dr, chromecache_265.3.dr	false		high
https://github.com/jquery/sizzle/pull/225	chromecache_176.3.dr, chromecache_146.3.dr	false		high
https://bugs.jquery.com/ticket/4833	chromecache_176.3.dr, chromecache_146.3.dr	false		high
https://sizzlejs.com/	chromecache_176.3.dr, chromecache_146.3.dr	false		high
https://bugs.chromium.org/p/chromium/issues/detail?id=449857	chromecache_176.3.dr, chromecache_146.3.dr	false		high
https://js.foundation/	chromecache_176.3.dr, chromecache_146.3.dr	false		high
https://bugs.jquery.com/ticket/13393	chromecache_176.3.dr, chromecache_146.3.dr	false		high
https://bugs.webkit.org/show_bug.cgi?id=136851	chromecache_176.3.dr, chromecache_146.3.dr	false		high
https://jsperf.com/thor-indexof-vs-for/5	chromecache_176.3.dr, chromecache_146.3.dr	false		high
https://bugs.jquery.com/ticket/12359	chromecache_176.3.dr, chromecache_146.3.dr	false		high
https://augloop.office.com/v2;394866fc-eedb-4f01-8536-3ff84b16be2a;liveprofilecard.access;https://gr	chromecache_274.3.dr	false		high
https://html.spec.whatwg.org/#strip-and-collapse-whitespace	chromecache_176.3.dr, chromecache_146.3.dr	false		high
https://web.archive.org/web/20141116233347/http://fluidproject.org/blog/2008/01/09/getting-setting-a	chromecache_176.3.dr, chromecache_146.3.dr	false		high
https://drafts.csswg.org/cssom/#common-serializing-idioms	chromecache_176.3.dr, chromecache_146.3.dr	false		high
https://reactjs.org/link/react-polyfills	chromecache_232.3.dr	false		high
https://github.com/jquery/jquery/pull/557)	chromecache_176.3.dr, chromecache_146.3.dr	false		high
https://bugs.chromium.org/p/chromium/issues/detail?id=378607	chromecache_176.3.dr, chromecache_146.3.dr	false		high
https://artifacts.dev.azure.com/office/_apis/symbol/symsrv/appResourceLoader.min.js.map/5ad2f740332b	chromecache_199.3.dr, chromecache_183.3.dr	false		high
https://drafts.csswg.org/cssom/#resolved-values	chromecache_176.3.dr, chromecache_146.3.dr	false		high
https://bugs.chromium.org/p/chromium/issues/detail?id=589347	chromecache_176.3.dr, chromecache_146.3.dr	false		high
https://localcdn.centro-dev.com:5555/floodgate.bundle.js.map	chromecache_197.3.dr, chromecache_177.3.dr	false		high
https://html.spec.whatwg.org/multipage/syntax.html#attributes-2	chromecache_176.3.dr, chromecache_146.3.dr	false		high
https://promisesaplus.com/#point-59	chromecache_176.3.dr, chromecache_146.3.dr	false		high
https://promisesaplus.com/#point-57	chromecache_176.3.dr, chromecache_146.3.dr	false		high
https://github.com/eslint/eslint/issues/3229	chromecache_176.3.dr, chromecache_146.3.dr	false		high
https://promisesaplus.com/#point-54	chromecache_176.3.dr, chromecache_146.3.dr	false		high
https://html.spec.whatwg.org/multipage/forms.html#category-listed	chromecache_176.3.dr, chromecache_146.3.dr	false		high
https://html.spec.whatwg.org/multipage/scripting.html#selector-disabled	chromecache_176.3.dr, chromecache_146.3.dr	false		high
https://feross.org	chromecache_197.3.dr, chromecache_200.3.dr, chromecache_166.3.dr, chromecache_177.3.dr	false		high
https://jquery.org/license	chromecache_176.3.dr, chromecache_146.3.dr	false		high
https://feross.org/opensource	chromecache_197.3.dr, chromecache_177.3.dr	false		high
https://getbootstrap.com)	chromecache_270.3.dr, chromecache_219.3.dr, chromecache_265.3.dr	false		high
https://bugs.webkit.org/show_bug.cgi?id=137337	chromecache_176.3.dr, chromecache_146.3.dr	false		high
https://html.spec.whatwg.org/multipage/scripting.html#selector-enabled	chromecache_176.3.dr, chromecache_146.3.dr	false		high

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.186.68	unknown	United States	15169	GOOGLEUS	false
172.64.147.188	kit.fontawesome.com.cdn.cloudflare.net	United States	13335	CLOUDFLARENETUS	false
104.18.38.117	crcldu.com	United States	13335	CLOUDFLARENETUS	false
199.232.196.193	ipv4.imgur.map.fastly.net	United States	54113	FASTLYUS	false
2.22.61.153	unknown	European Union	20940	AKAMAI-ASN1EU	false
51.105.104.217	cosmic-westeurope-ns-cbf6e4cb41a8.trafficmanager.net	United Kingdom	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
151.101.66.137	code.jquery.com	United States	54113	FASTLYUS	false
52.111.240.11	prod-campaignaggregator.omexexternallfb.office.net.akadns.net	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
13.107.139.11	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
151.101.1.40	perimeterx2.map.fastly.net	United States	54113	FASTLYUS	false
95.101.54.121	a1894.dscb.akamai.net	European Union	34164	AKAMAI-LONGB	false
172.217.18.4	www.google.com	United States	15169	GOOGLEUS	false
18.245.86.90	www.zillowstatic.com	United States	16509	AMAZON-02US	false
162.0.235.245	organizationforrecoveryllc.com	Canada	22612	NAMECHEAP-NETUS	true
13.107.42.12	1drv.ms	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
45.142.237.175	britishcounsel.org.in	Lithuania	9009	M247GB	true
40.126.31.73	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
104.17.25.14	cdnjs.cloudflare.com	United States	13335	CLOUDFLARENETUS	false
13.107.136.10	dual-spo-0005.spo-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
104.18.10.207	maxcdn.bootstrapcdn.com	United States	13335	CLOUDFLARENETUS	false
35.190.10.96	collector-pxhyx10rg3.px-client.net	United States	15169	GOOGLEUS	false
78.46.106.103	icon-library.com	Germany	24940	HETZNER-ASDE	false
104.18.41.40	bafkreibo6bopl3uphffghgihpwi6ckxd5v7xemrtmmelzqcr73fhfuwxxa.ipfs.nftstorage.link	United States	13335	CLOUDFLARENETUS	false
34.107.199.61	stk.px-cloud.net	United States	15169	GOOGLEUS	false
13.32.27.81	www.zillow.com	United States	7018	ATT-INTERNET4US	false
20.101.246.164	cosmic-westeurope-ns-ceb6f0ee85ee.trafficmanager.net	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
13.107.137.11	dual-spov-0006.spov-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
40.126.32.68	www.tm.ak.prd.aadg.trafficmanager.net	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
20.190.159.2	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
2.16.164.19	unknown	European Union	20940	AKAMAI-ASN1EU	false

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1620164
Start date and time:	2025-02-20 18:25:59 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 20s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	https://1drv.ms/w/c/ce0aa4089a0cf823/IQQ-p_-u_0bbTp7ALMPgaKOzAZ_aMu35BXGkFN3emxCDEwQ
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal84.phis.win@25/197@53/33
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (24542), with no line terminators
Category:	downloaded
Size (bytes):	24542
Entropy (8bit):	5.852618421915967
Encrypted:	false
SSDEEP:	384:MQzWYMUXoVBmPBNQHENjEa++NJrVsNZoyaaFtNrjEJdL7a7W1yg38m:MQydVYTQH2JJrUSyaaF8JVaA8m
MD5:	75C2894122887CE9BCAD4080EDA6D25A
SHA1:	7F991C0D395706CC05867CC80403F59DEB459C6D
SHA-256:	D9F10BEF18FF9F706B2B89B7149EF1B9EA614EF832793B4B249BBDBAB38DA73C
SHA-512:	74AAB0E1226798164BE6F08CF66E6FF5438358B0A82EC72DD1C4B39C4CEC449321D2770F283695172FDEDF8BD0DAC6C9E0746B0C48B169B73A6757C06573AC81
Malicious:	false
Reputation:	low
URL:	https://usc-word-view.officeapps.live.com/wv/ResReader.ashx?n=p1.img&v=00000000-0000-0000-0000-000000000802&usid=8f5413d4-3ebd-4261-8921-b9740fa87395&build=20250218.5&DataUrlEnabled=true&WOPIsrc=https%3A%2F%2Fmy%2Emicrosoftpersonalcontent%2Ecom%2Fpersonal%2Fce0aa4089a0cf823%2F%5Fvti%5Fbin%2Fwopi%2Eashx%2Ffiles%2Faeffa73e46ff4edb9ec02cc3e068a3b3&&&z=%2522%257BAEFFA73E%252D46FF%252D4EDB%252D9EC0%252D2CC3E068A3B3%257D%252C5%2522&waccluster=PUS1
Preview:	data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAzAAAAQgCAIAAAC2Gy5ZAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAEdqSURBVHhe7d37ux1XeSd4/qf85v9gnmdmnul0kibuTmAgET1JJz3tZ3rIkw4IAwlJuzNR0rfcZATIF2wwBmwREDcDcXAMCAQmCEc65+jodnS/2LJ1O5667aq1alfts48s6T376PN53gdXrVq11qo6W6ove29J73jHQy8qpZRSSqnI6u8rpZRSSql7XP19pZRSSil1j6u/r5RSSiml7nH195VSSiml1D2u/r5SSimllLrH1d9XSimllFL3uPr7SimllFLqHld/XymllFJK3ePq7yullFJKqXtc/X2llFJKKXWPq7+vlFJKKaXucfX3lVJKKaXUPa7+vlJKKaWUusfV399WdWjfW1d3PdJrVEoppZTaYtXfn7eKrJO6N7lnswFrrH+1+IOHptpffMfec/fqWpRSSimlJtXfn7dC3ny6g4Hs6qtr04cO7FobbFdKKaWUupvV35+3BrNO1bh39dXqTbN9e7tDOw5WTW+99er+A1m3tdVdB+vGqufec0XLA/k4b711bkdx6JF2t31zq8hP9X62kmSu1aFFFlWOv+/g1d6bZA/sv5qfMjR++RZarVrVBi1jN2GjWZRSSil1X1V/f94aC2Rlxnqg2C5DSRNQiqDTND50YMfeOpBNutU9J8GoiCyTxNZ1SE7PJi3zTX1ikdUGOlfbwymnHicbbbpxaPzi6CR1NTXdcmDXwWYBIzchW9jgVSillFLq/qr+/rxVBJFUHTu6NJNsp429Q+1uffqBXWvT46S7aXu6XX7UONVheretpr0MRpMsONluT5ln/MGWtAZHG2tvZ1FKKaXUfVb9/XlrMIikjWnm6L2H1D93x8Hqo71HVl9t4lGvw2AeKrZTg3P1J5

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://1drv.ms/w/c/ce0aa4089a0cf823/IQQ-p_-u_0bbTp7ALMPgaKOzAZ_aMu35BXGkFN3emxCDEwQ

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

HTML

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Compliance

Networking

System Summary

Malware Analysis System Evasion

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Chrome Cache Entry: 145

Chrome Cache Entry: 146

Chrome Cache Entry: 147

Chrome Cache Entry: 148

Chrome Cache Entry: 149

Chrome Cache Entry: 150

Chrome Cache Entry: 151

Chrome Cache Entry: 152

Chrome Cache Entry: 153

Chrome Cache Entry: 154

Chrome Cache Entry: 155

Chrome Cache Entry: 156

Chrome Cache Entry: 157

Chrome Cache Entry: 158

Chrome Cache Entry: 159

Chrome Cache Entry: 160

Chrome Cache Entry: 161

Chrome Cache Entry: 162

Chrome Cache Entry: 163

Chrome Cache Entry: 164

Chrome Cache Entry: 165

Chrome Cache Entry: 166

Chrome Cache Entry: 167

Chrome Cache Entry: 169

Chrome Cache Entry: 170

Chrome Cache Entry: 171

Windows Analysis Report
https://1drv.ms/w/c/ce0aa4089a0cf823/IQQ-p_-u_0bbTp7ALMPgaKOzAZ_aMu35BXGkFN3emxCDEwQ