Edit tour

Windows Analysis Report
Invitation de proposition - #U00c9b#U00e9nisterie PTM.pdf

Overview

General Information

Sample name:	Invitation de proposition - #U00c9b#U00e9nisterie PTM.pdf renamed because original name is a hash value
Original sample name:	Invitation de proposition - bnisterie PTM.pdf
Analysis ID:	1665735
MD5:	ceca877007b8622fa7d7a17170e409eb
SHA1:	d0e575d67901af25d1014a386581a6fd52e33e33
SHA256:	c8db07cb6bb26d0ac8792e973d3962168ab9675ff98dadee9a8eb37ea146db04
Infos:

Detection

HTMLPhisher

Score:	68
Range:	0 - 100
Confidence:	100%

Signatures

AI detected phishing page

Antivirus detection for URL or domain

Yara detected HtmlPhish54

AI detected landing page (webpage, office document or email)

Detected suspicious crossdomain redirect

HTML body contains low number of good links

HTML body contains password input but no form action

HTML page contains hidden javascript code

HTML page contains obfuscated script src

HTML title does not match URL

Classification

Process Tree

System is w10x64_ra

Acrobat.exe (PID: 6988 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\Invitation de proposition - #U00c9b#U00e9nisterie PTM.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 6148 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 6372 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2236 --field-trial-handle=1576,i,6969129164730021865,5789522965333232760,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

chrome.exe (PID: 7416 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://ptm66534.otsproductions.ca//@ MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 7648 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=1900,i,13975828022003771642,293067518181252376,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version --mojo-platform-channel-handle=2212 /prefetch:3 MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 7564 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://ptm66534.otsproductions.ca//@ MD5: E81F54E6C1129887AEA47E7D092680BF)

cleanup

Yara Signatures

HTML

Source	Rule	Description	Author
1.1..script.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security
2.10..script.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security
1.3.pages.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security
2.4.pages.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security
2.6.pages.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: https://neolect.ca/aadcdn.msftauth.net/~/shared/1.0/content/images/backgrounds/2_bc3d32a696895f78c19df6c717586a5d.svg	Avira URL Cloud: Label: phishing
Source: https://neolect.ca/aadcdn.msftauth.net/~/shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico	Avira URL Cloud: Label: phishing
Source: https://neolect.ca/aadcdn.msftauth.net/~/ests/2.1/content/cdnbundles/converged.v2.login.min_81imvbluez-v5hbzpkxfcg2.css	Avira URL Cloud: Label: phishing
Source: https://neolect.ca/aadcdn.msftauth.net/~/shared/1.0/content/js/oneDs_641b1cf809bdc17b42ab.js	Avira URL Cloud: Label: phishing
Source: https://neolect.ca/aadcdn.msftauth.net/~/shared/1.0/content/js/asyncchunk/convergedlogin_pcustomizationloader_80e93b9a4cb13643afca.js	Avira URL Cloud: Label: phishing
Source: https://neolect.ca/aadcdn.msftauth.net/~/shared/1.0/content/images/microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg	Avira URL Cloud: Label: phishing
Source: https://neolect.ca/?m0nid4uex=aHR0cHM6Ly93d3cub2ZmaWNlLmNvbS9sb2dpbiM=	Avira URL Cloud: Label: phishing
Source: https://neolect.ca/aadcdn.msftauth.net/~/ests/2.1/content/cdnbundles/ux.converged.login.strings-en.min_1d0daql8my9m71a_2aaxzg2.js	Avira URL Cloud: Label: phishing
Source: https://neolect.ca/	Avira URL Cloud: Label: phishing
Source: https://neolect.ca/favicon.ico	Avira URL Cloud: Label: phishing
Source: https://neolect.ca/aadcdn.msftauth.net/~/shared/1.0/content/images/marching_ants_b540a8e518037192e32c4fe58bf2dbab.gif	Avira URL Cloud: Label: phishing
Source: https://neolect.ca/aadcdn.msftauth.net/~/shared/1.0/content/js/ConvergedLogin_PCore_XZWzmNsf-98_A243D7S65Q2.js	Avira URL Cloud: Label: phishing
Source: https://neolect.ca/aadcdn.msftauth.net/~/shared/1.0/content/js/asyncchunk/convergedlogin_pfetchsessionsprogress_ae573f441ee1cf781ec7.js	Avira URL Cloud: Label: phishing
Source: https://neolect.ca/aadcdn.msftauth.net/~/shared/1.0/content/images/marching_ants_white_166de53471265253ab3a456defe6da23.gif	Avira URL Cloud: Label: phishing
Source: https://neolect.ca/?eojocwpo	Avira URL Cloud: Label: phishing
Source: https://neolect.ca/aadcdn.msftauth.net/~/shared/1.0/content/images/signin-options_4e48046ce74f4b89d45037c90576bfac.svg	Avira URL Cloud: Label: phishing

Phishing

AI detected phishing page

Source: https://thedownthe1stg.wpenginepowered.com/bid.html

Joe Sandbox AI: Score: 9 Reasons: The brand 'Microsoft' is a well-known global technology company., The legitimate domain for Microsoft is 'microsoft.com'., The URL 'thedownthe1stg.wpenginepowered.com' does not match the legitimate domain for Microsoft., The URL contains 'wpenginepowered.com', which is a hosting service, not directly associated with Microsoft., The presence of 'thedownthe1stg' as a subdomain is suspicious and not related to Microsoft., The use of a hosting service domain with unrelated subdomains is a common tactic in phishing attempts. DOM: 0.1.pages.csv

Yara detected HtmlPhish54

Source: Yara match	File source: 1.1..script.csv, type: HTML
Source: Yara match	File source: 2.10..script.csv, type: HTML
Source: Yara match	File source: 1.3.pages.csv, type: HTML
Source: Yara match	File source: 2.4.pages.csv, type: HTML
Source: Yara match	File source: 2.6.pages.csv, type: HTML

AI detected landing page (webpage, office document or email)

Source: PDF document	Joe Sandbox AI: Page contains button: 'View Pdf' Source: 'PDF document'
Source: PDF document	Joe Sandbox AI: PDF document contains prominent button: 'view pdf'
Source: https://thedownthe1stg.wpenginepowered.com/bid.html	Joe Sandbox AI: Page contains button: 'View PDF' Source: '0.0.pages.csv'

Source: https://thedownthe1stg.wpenginepowered.com/bid.html	HTTP Parser: Number of links: 0
Source: https://neolect.ca/?m0nid4uex=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvdjIuMC9hdXRob3JpemU/Y2xpZW50X2lkPTQ3NjU0NDViLTMyYzYtNDliMC04M2U2LTFkOTM3NjUyNzZjYSZyZWRpcmVjdF91cmk9aHR0cHMlM0ElMkYlMkZ3d3cub2ZmaWNlLmNvbSUyRmxhbmRpbmd2MiZyZXNwb25zZV90eXBlPWNvZGUlMjBpZF90b2tlbiZzY29wZT1vcGVuaWQlMjBwcm9maWxlJTIwaHR0cHMlM0ElMkYlMkZ3d3cub2ZmaWNlLmNvbSUyRnYyJTJGT2ZmaWNlSG9tZS5BbGwmcmVzcG9uc2VfbW9kZT1mb3JtX3Bvc3Qmbm9uY2U9NjM4ODAzMzU4OTIyNjQyNjk5Lk1tRXhZMlV5WVRFdE1UWXhZaTAwTVRVM0xUaGhPV1l0TVRSbE9ETTVZak13TVRNek4yTTVOVFk1WTJRdFl6WmtZaTAwWm1VekxXRmxZell0WW1Wa01EZGtOMlJpWXpnNCZ1aV9sb2NhbGVzPWVuLVVTJm1rdD1lbi1VUyZjbGllbnQtcmVxdWVzdC1pZD0zNGI0YmNhMS02MDgyLTQ0Y2YtOTVmMC0xYmE1NWJlYzhjYmQmc3RhdGU9Uk82TTN0Yk5VdC15Mk9FSlNMWU5aUTZ0dnZfckhremdmXy00aFZkWmZYU1hGVzBVQ3NITXhMWXhhdy1FajNWTHdDYTdaSlM2Ynp5M2NDWktxNkMzMW8xYndfNlpMNThQTFBfNUc2MVI0dEpSb0hlS21Bbnd0UU5KejNtWWtNYzR3a0Qyd203UXBSXzc4OEw4Y0VHV0c4WV9CQzdvaW1hRktYdnpIYzFkSjFyWkVSS0VKckdMZHg4aHpZLWJtT0otU04xT05OM1h0Y2FoU1dYVzQ1ZkNfTFJxam5NdWJaRWxiQTRsMEFHUjg2VjRHbzkxSD...	HTTP Parser: Number of links: 0

Source: https://thedownthe1stg.wpenginepowered.com/bid.html

HTTP Parser: <input type="password" .../> found but no <form action="...

Source: https://neolect.ca/?m0nid4uex=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvdjIuMC9hdXRob3JpemU/Y2xpZW50X2lkPTQ3NjU0NDViLTMyYzYtNDliMC04M2U2LTFkOTM3NjUyNzZjYSZyZWRpcmVjdF91cmk9aHR0cHMlM0ElMkYlMkZ3d3cub2ZmaWNlLmNvbSUyRmxhbmRpbmd2MiZyZXNwb25zZV90eXBlPWNvZGUlMjBpZF90b2tlbiZzY29wZT1vcGVuaWQlMjBwcm9maWxlJTIwaHR0cHMlM0ElMkYlMkZ3d3cub2ZmaWNlLmNvbSUyRnYyJTJGT2ZmaWNlSG9tZS5BbGwmcmVzcG9uc2VfbW9kZT1mb3JtX3Bvc3Qmbm9uY2U9NjM4ODAzMzU4OTIyNjQyNjk5Lk1tRXhZMlV5WVRFdE1UWXhZaTAwTVRVM0xUaGhPV1l0TVRSbE9ETTVZak13TVRNek4yTTVOVFk1WTJRdFl6WmtZaTAwWm1VekxXRmxZell0WW1Wa01EZGtOMlJpWXpnNCZ1aV9sb2NhbGVzPWVuLVVTJm1rdD1lbi1VUyZjbGllbnQtcmVxdWVzdC1pZD0zNGI0YmNhMS02MDgyLTQ0Y2YtOTVmMC0xYmE1NWJlYzhjYmQmc3RhdGU9Uk82TTN0Yk5VdC15Mk9FSlNMWU5aUTZ0dnZfckhremdmXy00aFZkWmZYU1hGVzBVQ3NITXhMWXhhdy1FajNWTHdDYTdaSlM2Ynp5M2NDWktxNkMzMW8xYndfNlpMNThQTFBfNUc2MVI0dEpSb0hlS21Bbnd0UU5KejNtWWtNYzR3a0Qyd203UXBSXzc4OEw4Y0VHV0c4WV9CQzdvaW1hRktYdnpIYzFkSjFyWkVSS0VKckdMZHg4aHpZLWJtT0otU04xT05OM1h0Y2FoU1dYVzQ1ZkNfTFJxam5NdWJaRWxiQTRsMEFHUjg2VjRHbzkxSD...

HTTP Parser: Base64 decoded: 2a1ce2a1-161b-4157-8a9f-14e839b301337c9569cd-c6db-4fe3-aec6-bed07d7dbc88

Source: https://neolect.ca/?m0nid4uex=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvdjIuMC9hdXRob3JpemU/Y2xpZW50X2lkPTQ3NjU0NDViLTMyYzYtNDliMC04M2U2LTFkOTM3NjUyNzZjYSZyZWRpcmVjdF91cmk9aHR0cHMlM0ElMkYlMkZ3d3cub2ZmaWNlLmNvbSUyRmxhbmRpbmd2MiZy	HTTP Parser: Script src: data:text/javascript;base64,ZnVuY3Rpb24gY3VzdG9tRnVuY3Rpb24oKSB7CiAgICBpZiAoIWRvY3VtZW50LnF1ZXJ5U2VsZWN0b3IoIi5jdXN0b20tY2xhc3MiKSB8fCAhZG9jdW1lbnQucXVlcnlTZWxlY3RvcigiLnJvdGF0ZS1jbGFzcyIpKSB7CiAgICAgICAgdmFyIG5ld0RpdiA9IGRvY3VtZW50LmNyZWF0ZUVsZW1lbn
Source: https://neolect.ca/?m0nid4uex=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvdjIuMC9hdXRob3JpemU/Y2xpZW50X2lkPTQ3NjU0NDViLTMyYzYtNDliMC04M2U2LTFkOTM3NjUyNzZjYSZyZWRpcmVjdF91cmk9aHR0cHMlM0ElMkYlMkZ3d3cub2ZmaWNlLmNvbSUyRmxhbmRpbmd2MiZy	HTTP Parser: Script src: data:text/javascript;base64,ZnVuY3Rpb24gY3VzdG9tRnVuY3Rpb24oKSB7CiAgICBpZiAoIWRvY3VtZW50LnF1ZXJ5U2VsZWN0b3IoIi5jdXN0b20tY2xhc3MiKSB8fCAhZG9jdW1lbnQucXVlcnlTZWxlY3RvcigiLnJvdGF0ZS1jbGFzcyIpKSB7CiAgICAgICAgdmFyIG5ld0RpdiA9IGRvY3VtZW50LmNyZWF0ZUVsZW1lbn
Source: https://neolect.ca/?m0nid4uex=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvdjIuMC9hdXRob3JpemU/Y2xpZW50X2lkPTQ3NjU0NDViLTMyYzYtNDliMC04M2U2LTFkOTM3NjUyNzZjYSZyZWRpcmVjdF91cmk9aHR0cHMlM0ElMkYlMkZ3d3cub2ZmaWNlLmNvbSUyRmxhbmRpbmd2MiZy	HTTP Parser: Script src: data:text/javascript;base64,ZnVuY3Rpb24gY3VzdG9tRnVuY3Rpb24oKSB7CiAgICBpZiAoIWRvY3VtZW50LnF1ZXJ5U2VsZWN0b3IoIi5jdXN0b20tY2xhc3MiKSB8fCAhZG9jdW1lbnQucXVlcnlTZWxlY3RvcigiLnJvdGF0ZS1jbGFzcyIpKSB7CiAgICAgICAgdmFyIG5ld0RpdiA9IGRvY3VtZW50LmNyZWF0ZUVsZW1lbn

Source: https://thedownthe1stg.wpenginepowered.com/bid.html	HTTP Parser: Title: Protected File does not match URL
Source: https://neolect.ca/?m0nid4uex=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvdjIuMC9hdXRob3JpemU/Y2xpZW50X2lkPTQ3NjU0NDViLTMyYzYtNDliMC04M2U2LTFkOTM3NjUyNzZjYSZyZWRpcmVjdF91cmk9aHR0cHMlM0ElMkYlMkZ3d3cub2ZmaWNlLmNvbSUyRmxhbmRpbmd2MiZyZXNwb25zZV90eXBlPWNvZGUlMjBpZF90b2tlbiZzY29wZT1vcGVuaWQlMjBwcm9maWxlJTIwaHR0cHMlM0ElMkYlMkZ3d3cub2ZmaWNlLmNvbSUyRnYyJTJGT2ZmaWNlSG9tZS5BbGwmcmVzcG9uc2VfbW9kZT1mb3JtX3Bvc3Qmbm9uY2U9NjM4ODAzMzU4OTIyNjQyNjk5Lk1tRXhZMlV5WVRFdE1UWXhZaTAwTVRVM0xUaGhPV1l0TVRSbE9ETTVZak13TVRNek4yTTVOVFk1WTJRdFl6WmtZaTAwWm1VekxXRmxZell0WW1Wa01EZGtOMlJpWXpnNCZ1aV9sb2NhbGVzPWVuLVVTJm1rdD1lbi1VUyZjbGllbnQtcmVxdWVzdC1pZD0zNGI0YmNhMS02MDgyLTQ0Y2YtOTVmMC0xYmE1NWJlYzhjYmQmc3RhdGU9Uk82TTN0Yk5VdC15Mk9FSlNMWU5aUTZ0dnZfckhremdmXy00aFZkWmZYU1hGVzBVQ3NITXhMWXhhdy1FajNWTHdDYTdaSlM2Ynp5M2NDWktxNkMzMW8xYndfNlpMNThQTFBfNUc2MVI0dEpSb0hlS21Bbnd0UU5KejNtWWtNYzR3a0Qyd203UXBSXzc4OEw4Y0VHV0c4WV9CQzdvaW1hRktYdnpIYzFkSjFyWkVSS0VKckdMZHg4aHpZLWJtT0otU04xT05OM1h0Y2FoU1dYVzQ1ZkNfTFJxam5NdWJaRWxiQTRsMEFHUjg2VjRHbzkxSD...	HTTP Parser: Title: MOD-oic68x2z does not match URL

HTTP Parser: Iframe src: https://login.live.com/Me.htm?v=3

Source: https://thedownthe1stg.wpenginepowered.com/bid.html

HTTP Parser: <input type="password" .../> found

Source: https://thedownthe1stg.wpenginepowered.com/bid.html	HTTP Parser: No favicon
Source: https://thedownthe1stg.wpenginepowered.com/bid.html	HTTP Parser: No favicon
Source: https://neolect.ca/?m0nid4uex=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvdjIuMC9hdXRob3JpemU/Y2xpZW50X2lkPTQ3NjU0NDViLTMyYzYtNDliMC04M2U2LTFkOTM3NjUyNzZjYSZyZWRpcmVjdF91cmk9aHR0cHMlM0ElMkYlMkZ3d3cub2ZmaWNlLmNvbSUyRmxhbmRpbmd2MiZyZXNwb25zZV90eXBlPWNvZGUlMjBpZF90b2tlbiZzY29wZT1vcGVuaWQlMjBwcm9maWxlJTIwaHR0cHMlM0ElMkYlMkZ3d3cub2ZmaWNlLmNvbSUyRnYyJTJGT2ZmaWNlSG9tZS5BbGwmcmVzcG9uc2VfbW9kZT1mb3JtX3Bvc3Qmbm9uY2U9NjM4ODAzMzU4OTIyNjQyNjk5Lk1tRXhZMlV5WVRFdE1UWXhZaTAwTVRVM0xUaGhPV1l0TVRSbE9ETTVZak13TVRNek4yTTVOVFk1WTJRdFl6WmtZaTAwWm1VekxXRmxZell0WW1Wa01EZGtOMlJpWXpnNCZ1aV9sb2NhbGVzPWVuLVVTJm1rdD1lbi1VUyZjbGllbnQtcmVxdWVzdC1pZD0zNGI0YmNhMS02MDgyLTQ0Y2YtOTVmMC0xYmE1NWJlYzhjYmQmc3RhdGU9Uk82TTN0Yk5VdC15Mk9FSlNMWU5aUTZ0dnZfckhremdmXy00aFZkWmZYU1hGVzBVQ3NITXhMWXhhdy1FajNWTHdDYTdaSlM2Ynp5M2NDWktxNkMzMW8xYndfNlpMNThQTFBfNUc2MVI0dEpSb0hlS21Bbnd0UU5KejNtWWtNYzR3a0Qyd203UXBSXzc4OEw4Y0VHV0c4WV9CQzdvaW1hRktYdnpIYzFkSjFyWkVSS0VKckdMZHg4aHpZLWJtT0otU04xT05OM1h0Y2FoU1dYVzQ1ZkNfTFJxam5NdWJaRWxiQTRsMEFHUjg2VjRHbzkxSD...	HTTP Parser: No favicon

Source: https://thedownthe1stg.wpenginepowered.com/bid.html	HTTP Parser: No <meta name="author".. found
Source: https://thedownthe1stg.wpenginepowered.com/bid.html	HTTP Parser: No <meta name="author".. found
Source: https://neolect.ca/?m0nid4uex=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvdjIuMC9hdXRob3JpemU/Y2xpZW50X2lkPTQ3NjU0NDViLTMyYzYtNDliMC04M2U2LTFkOTM3NjUyNzZjYSZyZWRpcmVjdF91cmk9aHR0cHMlM0ElMkYlMkZ3d3cub2ZmaWNlLmNvbSUyRmxhbmRpbmd2MiZyZXNwb25zZV90eXBlPWNvZGUlMjBpZF90b2tlbiZzY29wZT1vcGVuaWQlMjBwcm9maWxlJTIwaHR0cHMlM0ElMkYlMkZ3d3cub2ZmaWNlLmNvbSUyRnYyJTJGT2ZmaWNlSG9tZS5BbGwmcmVzcG9uc2VfbW9kZT1mb3JtX3Bvc3Qmbm9uY2U9NjM4ODAzMzU4OTIyNjQyNjk5Lk1tRXhZMlV5WVRFdE1UWXhZaTAwTVRVM0xUaGhPV1l0TVRSbE9ETTVZak13TVRNek4yTTVOVFk1WTJRdFl6WmtZaTAwWm1VekxXRmxZell0WW1Wa01EZGtOMlJpWXpnNCZ1aV9sb2NhbGVzPWVuLVVTJm1rdD1lbi1VUyZjbGllbnQtcmVxdWVzdC1pZD0zNGI0YmNhMS02MDgyLTQ0Y2YtOTVmMC0xYmE1NWJlYzhjYmQmc3RhdGU9Uk82TTN0Yk5VdC15Mk9FSlNMWU5aUTZ0dnZfckhremdmXy00aFZkWmZYU1hGVzBVQ3NITXhMWXhhdy1FajNWTHdDYTdaSlM2Ynp5M2NDWktxNkMzMW8xYndfNlpMNThQTFBfNUc2MVI0dEpSb0hlS21Bbnd0UU5KejNtWWtNYzR3a0Qyd203UXBSXzc4OEw4Y0VHV0c4WV9CQzdvaW1hRktYdnpIYzFkSjFyWkVSS0VKckdMZHg4aHpZLWJtT0otU04xT05OM1h0Y2FoU1dYVzQ1ZkNfTFJxam5NdWJaRWxiQTRsMEFHUjg2VjRHbzkxSD	HTTP Parser: No <meta name="author".. found
Source: https://neolect.ca/?m0nid4uex=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvdjIuMC9hdXRob3JpemU/Y2xpZW50X2lkPTQ3NjU0NDViLTMyYzYtNDliMC04M2U2LTFkOTM3NjUyNzZjYSZyZWRpcmVjdF91cmk9aHR0cHMlM0ElMkYlMkZ3d3cub2ZmaWNlLmNvbSUyRmxhbmRpbmd2MiZyZXNwb25zZV90eXBlPWNvZGUlMjBpZF90b2tlbiZzY29wZT1vcGVuaWQlMjBwcm9maWxlJTIwaHR0cHMlM0ElMkYlMkZ3d3cub2ZmaWNlLmNvbSUyRnYyJTJGT2ZmaWNlSG9tZS5BbGwmcmVzcG9uc2VfbW9kZT1mb3JtX3Bvc3Qmbm9uY2U9NjM4ODAzMzU4OTIyNjQyNjk5Lk1tRXhZMlV5WVRFdE1UWXhZaTAwTVRVM0xUaGhPV1l0TVRSbE9ETTVZak13TVRNek4yTTVOVFk1WTJRdFl6WmtZaTAwWm1VekxXRmxZell0WW1Wa01EZGtOMlJpWXpnNCZ1aV9sb2NhbGVzPWVuLVVTJm1rdD1lbi1VUyZjbGllbnQtcmVxdWVzdC1pZD0zNGI0YmNhMS02MDgyLTQ0Y2YtOTVmMC0xYmE1NWJlYzhjYmQmc3RhdGU9Uk82TTN0Yk5VdC15Mk9FSlNMWU5aUTZ0dnZfckhremdmXy00aFZkWmZYU1hGVzBVQ3NITXhMWXhhdy1FajNWTHdDYTdaSlM2Ynp5M2NDWktxNkMzMW8xYndfNlpMNThQTFBfNUc2MVI0dEpSb0hlS21Bbnd0UU5KejNtWWtNYzR3a0Qyd203UXBSXzc4OEw4Y0VHV0c4WV9CQzdvaW1hRktYdnpIYzFkSjFyWkVSS0VKckdMZHg4aHpZLWJtT0otU04xT05OM1h0Y2FoU1dYVzQ1ZkNfTFJxam5NdWJaRWxiQTRsMEFHUjg2VjRHbzkxSD	HTTP Parser: No <meta name="author".. found

Source: https://thedownthe1stg.wpenginepowered.com/bid.html	HTTP Parser: No <meta name="copyright".. found
Source: https://thedownthe1stg.wpenginepowered.com/bid.html	HTTP Parser: No <meta name="copyright".. found
Source: https://neolect.ca/?m0nid4uex=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvdjIuMC9hdXRob3JpemU/Y2xpZW50X2lkPTQ3NjU0NDViLTMyYzYtNDliMC04M2U2LTFkOTM3NjUyNzZjYSZyZWRpcmVjdF91cmk9aHR0cHMlM0ElMkYlMkZ3d3cub2ZmaWNlLmNvbSUyRmxhbmRpbmd2MiZyZXNwb25zZV90eXBlPWNvZGUlMjBpZF90b2tlbiZzY29wZT1vcGVuaWQlMjBwcm9maWxlJTIwaHR0cHMlM0ElMkYlMkZ3d3cub2ZmaWNlLmNvbSUyRnYyJTJGT2ZmaWNlSG9tZS5BbGwmcmVzcG9uc2VfbW9kZT1mb3JtX3Bvc3Qmbm9uY2U9NjM4ODAzMzU4OTIyNjQyNjk5Lk1tRXhZMlV5WVRFdE1UWXhZaTAwTVRVM0xUaGhPV1l0TVRSbE9ETTVZak13TVRNek4yTTVOVFk1WTJRdFl6WmtZaTAwWm1VekxXRmxZell0WW1Wa01EZGtOMlJpWXpnNCZ1aV9sb2NhbGVzPWVuLVVTJm1rdD1lbi1VUyZjbGllbnQtcmVxdWVzdC1pZD0zNGI0YmNhMS02MDgyLTQ0Y2YtOTVmMC0xYmE1NWJlYzhjYmQmc3RhdGU9Uk82TTN0Yk5VdC15Mk9FSlNMWU5aUTZ0dnZfckhremdmXy00aFZkWmZYU1hGVzBVQ3NITXhMWXhhdy1FajNWTHdDYTdaSlM2Ynp5M2NDWktxNkMzMW8xYndfNlpMNThQTFBfNUc2MVI0dEpSb0hlS21Bbnd0UU5KejNtWWtNYzR3a0Qyd203UXBSXzc4OEw4Y0VHV0c4WV9CQzdvaW1hRktYdnpIYzFkSjFyWkVSS0VKckdMZHg4aHpZLWJtT0otU04xT05OM1h0Y2FoU1dYVzQ1ZkNfTFJxam5NdWJaRWxiQTRsMEFHUjg2VjRHbzkxSD...	HTTP Parser: No <meta name="copyright".. found
Source: https://neolect.ca/?m0nid4uex=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvdjIuMC9hdXRob3JpemU/Y2xpZW50X2lkPTQ3NjU0NDViLTMyYzYtNDliMC04M2U2LTFkOTM3NjUyNzZjYSZyZWRpcmVjdF91cmk9aHR0cHMlM0ElMkYlMkZ3d3cub2ZmaWNlLmNvbSUyRmxhbmRpbmd2MiZyZXNwb25zZV90eXBlPWNvZGUlMjBpZF90b2tlbiZzY29wZT1vcGVuaWQlMjBwcm9maWxlJTIwaHR0cHMlM0ElMkYlMkZ3d3cub2ZmaWNlLmNvbSUyRnYyJTJGT2ZmaWNlSG9tZS5BbGwmcmVzcG9uc2VfbW9kZT1mb3JtX3Bvc3Qmbm9uY2U9NjM4ODAzMzU4OTIyNjQyNjk5Lk1tRXhZMlV5WVRFdE1UWXhZaTAwTVRVM0xUaGhPV1l0TVRSbE9ETTVZak13TVRNek4yTTVOVFk1WTJRdFl6WmtZaTAwWm1VekxXRmxZell0WW1Wa01EZGtOMlJpWXpnNCZ1aV9sb2NhbGVzPWVuLVVTJm1rdD1lbi1VUyZjbGllbnQtcmVxdWVzdC1pZD0zNGI0YmNhMS02MDgyLTQ0Y2YtOTVmMC0xYmE1NWJlYzhjYmQmc3RhdGU9Uk82TTN0Yk5VdC15Mk9FSlNMWU5aUTZ0dnZfckhremdmXy00aFZkWmZYU1hGVzBVQ3NITXhMWXhhdy1FajNWTHdDYTdaSlM2Ynp5M2NDWktxNkMzMW8xYndfNlpMNThQTFBfNUc2MVI0dEpSb0hlS21Bbnd0UU5KejNtWWtNYzR3a0Qyd203UXBSXzc4OEw4Y0VHV0c4WV9CQzdvaW1hRktYdnpIYzFkSjFyWkVSS0VKckdMZHg4aHpZLWJtT0otU04xT05OM1h0Y2FoU1dYVzQ1ZkNfTFJxam5NdWJaRWxiQTRsMEFHUjg2VjRHbzkxSD...	HTTP Parser: No <meta name="copyright".. found

Source: unknown	HTTPS traffic detected: 51.222.174.97:443 -> 192.168.2.16:49723 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 51.222.174.97:443 -> 192.168.2.16:49724 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 51.222.174.97:443 -> 192.168.2.16:49725 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 141.193.213.10:443 -> 192.168.2.16:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 141.193.213.11:443 -> 192.168.2.16:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 74.125.138.103:443 -> 192.168.2.16:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 85.208.108.179:443 -> 192.168.2.16:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 85.208.108.179:443 -> 192.168.2.16:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.1.33.12:443 -> 192.168.2.16:49752 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 85.208.108.179:443 -> 192.168.2.16:49764 version: TLS 1.2

Source: chrome.exe

Memory has grown: Private usage: 1MB later: 38MB

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	HTTP traffic: Redirect from: ptm66534.otsproductions.ca to https://thedownthe1stg.wpenginepowered.com/bid.html
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	HTTP traffic: Redirect from: ptm66534.otsproductions.ca to https://thedownthe1stg.wpenginepowered.com/bid.html

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 64.233.185.94
Source: unknown	TCP traffic detected without corresponding DNS query: 64.233.185.94
Source: unknown	TCP traffic detected without corresponding DNS query: 51.222.174.97
Source: unknown	TCP traffic detected without corresponding DNS query: 51.222.174.97
Source: unknown	TCP traffic detected without corresponding DNS query: 51.222.174.97
Source: unknown	TCP traffic detected without corresponding DNS query: 51.222.174.97
Source: unknown	TCP traffic detected without corresponding DNS query: 51.222.174.97
Source: unknown	TCP traffic detected without corresponding DNS query: 51.222.174.97
Source: unknown	TCP traffic detected without corresponding DNS query: 51.222.174.97
Source: unknown	TCP traffic detected without corresponding DNS query: 51.222.174.97
Source: unknown	TCP traffic detected without corresponding DNS query: 51.222.174.97
Source: unknown	TCP traffic detected without corresponding DNS query: 51.222.174.97
Source: unknown	TCP traffic detected without corresponding DNS query: 51.222.174.97
Source: unknown	TCP traffic detected without corresponding DNS query: 51.222.174.97
Source: unknown	TCP traffic detected without corresponding DNS query: 51.222.174.97
Source: unknown	TCP traffic detected without corresponding DNS query: 51.222.174.97
Source: unknown	TCP traffic detected without corresponding DNS query: 51.222.174.97
Source: unknown	TCP traffic detected without corresponding DNS query: 51.222.174.97
Source: unknown	TCP traffic detected without corresponding DNS query: 51.222.174.97
Source: unknown	TCP traffic detected without corresponding DNS query: 51.222.174.97
Source: unknown	TCP traffic detected without corresponding DNS query: 51.222.174.97
Source: unknown	TCP traffic detected without corresponding DNS query: 51.222.174.97
Source: unknown	TCP traffic detected without corresponding DNS query: 51.222.174.97
Source: unknown	TCP traffic detected without corresponding DNS query: 51.222.174.97
Source: unknown	TCP traffic detected without corresponding DNS query: 51.222.174.97
Source: unknown	TCP traffic detected without corresponding DNS query: 51.222.174.97
Source: unknown	TCP traffic detected without corresponding DNS query: 51.222.174.97
Source: unknown	TCP traffic detected without corresponding DNS query: 51.222.174.97
Source: unknown	TCP traffic detected without corresponding DNS query: 51.222.174.97
Source: unknown	TCP traffic detected without corresponding DNS query: 51.222.174.97
Source: unknown	TCP traffic detected without corresponding DNS query: 51.222.174.97
Source: unknown	TCP traffic detected without corresponding DNS query: 51.222.174.97
Source: unknown	TCP traffic detected without corresponding DNS query: 51.222.174.97
Source: unknown	TCP traffic detected without corresponding DNS query: 51.222.174.97
Source: unknown	TCP traffic detected without corresponding DNS query: 51.222.174.97
Source: unknown	TCP traffic detected without corresponding DNS query: 51.222.174.97
Source: unknown	TCP traffic detected without corresponding DNS query: 51.222.174.97
Source: unknown	TCP traffic detected without corresponding DNS query: 51.222.174.97
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.28.18
Source: unknown	TCP traffic detected without corresponding DNS query: 23.4.43.62
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.28.18
Source: unknown	TCP traffic detected without corresponding DNS query: 23.4.43.62
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Microsoft-CryptoAPI/10.0Host: x1.i.lencr.org
Source: global traffic	HTTP traffic detected: GET //@ HTTP/1.1Host: ptm66534.otsproductions.caConnection: keep-alivesec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /@ HTTP/1.1Host: ptm66534.otsproductions.caConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /@ HTTP/1.1Host: ptm66534.otsproductions.caConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bid.html HTTP/1.1Host: thedownthe1stg.wpenginepowered.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: thedownthe1stg.wpenginepowered.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://thedownthe1stg.wpenginepowered.com/bid.htmlAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: thedownthe1stg.wpenginepowered.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /?eojocwpo HTTP/1.1Host: neolect.caConnection: keep-alivesec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentReferer: https://thedownthe1stg.wpenginepowered.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: neolect.caConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Referer: https://thedownthe1stg.wpenginepowered.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: qPdM=loKzyZIHgFNa; qPdM.sig=4xg-PpXrk3EZTMxwfoQqDMfUtFM
Source: global traffic	HTTP traffic detected: GET /?m0nid4uex=aHR0cHM6Ly93d3cub2ZmaWNlLmNvbS9sb2dpbiM= HTTP/1.1Host: neolect.caConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Referer: https://thedownthe1stg.wpenginepowered.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: qPdM=loKzyZIHgFNa; qPdM.sig=4xg-PpXrk3EZTMxwfoQqDMfUtFM; fpc=ApRUrsrnLe5AqKy55nDm2T0; esctx=PAQABBwEAAABVrSpeuWamRam2jAF1XRQE6Akd-c485wq4E4QZV6Safd95d7wJQSL--IapwZqAUIt3c11ALHCpzeFkSKiC8Ycvf8Mmg88HzJxfxABo91DVVv4BilkfqlD4hVVl2ysRlC0y9AwK8PNZFsc2eQhwS4AP6KyPPC7xbysg6pPKAhf7swIvSgNQnknxdlOKMOLOo1QgAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd
Source: global traffic	HTTP traffic detected: GET /?m0nid4uex=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvdjIuMC9hdXRob3JpemU/Y2xpZW50X2lkPTQ3NjU0NDViLTMyYzYtNDliMC04M2U2LTFkOTM3NjUyNzZjYSZyZWRpcmVjdF91cmk9aHR0cHMlM0ElMkYlMkZ3d3cub2ZmaWNlLmNvbSUyRmxhbmRpbmd2MiZyZXNwb25zZV90eXBlPWNvZGUlMjBpZF90b2tlbiZzY29wZT1vcGVuaWQlMjBwcm9maWxlJTIwaHR0cHMlM0ElMkYlMkZ3d3cub2ZmaWNlLmNvbSUyRnYyJTJGT2ZmaWNlSG9tZS5BbGwmcmVzcG9uc2VfbW9kZT1mb3JtX3Bvc3Qmbm9uY2U9NjM4ODAzMzU4OTIyNjQyNjk5Lk1tRXhZMlV5WVRFdE1UWXhZaTAwTVRVM0xUaGhPV1l0TVRSbE9ETTVZak13TVRNek4yTTVOVFk1WTJRdFl6WmtZaTAwWm1VekxXRmxZell0WW1Wa01EZGtOMlJpWXpnNCZ1aV9sb2NhbGVzPWVuLVVTJm1rdD1lbi1VUyZjbGllbnQtcmVxdWVzdC1pZD0zNGI0YmNhMS02MDgyLTQ0Y2YtOTVmMC0xYmE1NWJlYzhjYmQmc3RhdGU9Uk82TTN0Yk5VdC15Mk9FSlNMWU5aUTZ0dnZfckhremdmXy00aFZkWmZYU1hGVzBVQ3NITXhMWXhhdy1FajNWTHdDYTdaSlM2Ynp5M2NDWktxNkMzMW8xYndfNlpMNThQTFBfNUc2MVI0dEpSb0hlS21Bbnd0UU5KejNtWWtNYzR3a0Qyd203UXBSXzc4OEw4Y0VHV0c4WV9CQzdvaW1hRktYdnpIYzFkSjFyWkVSS0VKckdMZHg4aHpZLWJtT0otU04xT05OM1h0Y2FoU1dYVzQ1ZkNfTFJxam5NdWJaRWxiQTRsMEFHUjg2VjRHbzkxSDBTNGF5TXhHUFQ1SnlCOVczbk1XUDgySVVKTjVLMUwyd0tOUFEmeC1jbGllbnQtU0tVPUlEX05FVDhfMCZ4LWNsaWVudC12ZXI9OC41LjAuMA== HTTP/1.1Host: neolect.caConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Referer: https://thedownthe1stg.wpenginepowered.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: qPdM=loKzyZIHgFNa; qPdM.sig=4xg-PpXrk3EZTMxwfoQqDMfUtFM; fpc=ApRUrsrnLe5AqKy55nDm2T0; esctx=PAQABBwEAAABVrSpeuWamRam2jAF1XRQE6Akd-c485wq4E4QZV6Safd95d7wJQSL--IapwZqAUIt3c11ALHCpzeFkSKiC8Ycvf8Mmg88HzJxfxABo91DVVv4BilkfqlD4hVVl2ysRlC0y9AwK8PNZFsc2eQhwS4AP6KyPPC7xbysg6pPKAhf7swIvSgNQnknxdlOKMOLOo1QgAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; OH.FLID=f5ff9bcc-2ea3-49aa-99e3-cae22396c400; .AspNetCore.OpenIdConnect.Nonce.yJMPUqQzsW1e_Da5eMLwXhcEOQSJDKhhDZ2UVirgFTe-sGKnMMhATbWRmkwA5BXpct1dAEb14ZvzxWxyLNngLp_yDmM8ckHENZRMZoLUfucu6phX0sQ7fxVLEyEAGHAllftuga1fbe1jHFg-xq7B2304UhWXkbNRmHruOsog-bjTXFOFhdUAFqMNoZPduL_sOrK9udYZGgotzN5dL1UQrSoMuMWZP48ZqZAT5J0LA_cnWVbcFiUljNLD2F5ZHH47=N; .AspNetCore.Correlation.TZACjB_Pi15j9c5LC64w_wuyEgrjBlpTk3meYY-eGj4=N
Source: global traffic	HTTP traffic detected: GET /aadcdn.msauth.net/~/shared/1.0/content/js/BssoInterrupt_Core_9810YxmrLqOR1rQ4anyNMg2.js HTTP/1.1Host: neolect.caConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://neolect.ca/?m0nid4uex=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvdjIuMC9hdXRob3JpemU/Y2xpZW50X2lkPTQ3NjU0NDViLTMyYzYtNDliMC04M2U2LTFkOTM3NjUyNzZjYSZyZWRpcmVjdF91cmk9aHR0cHMlM0ElMkYlMkZ3d3cub2ZmaWNlLmNvbSUyRmxhbmRpbmd2MiZyZXNwb25zZV90eXBlPWNvZGUlMjBpZF90b2tlbiZzY29wZT1vcGVuaWQlMjBwcm9maWxlJTIwaHR0cHMlM0ElMkYlMkZ3d3cub2ZmaWNlLmNvbSUyRnYyJTJGT2ZmaWNlSG9tZS5BbGwmcmVzcG9uc2VfbW9kZT1mb3JtX3Bvc3Qmbm9uY2U9NjM4ODAzMzU4OTIyNjQyNjk5Lk1tRXhZMlV5WVRFdE1UWXhZaTAwTVRVM0xUaGhPV1l0TVRSbE9ETTVZak13TVRNek4yTTVOVFk1WTJRdFl6WmtZaTAwWm1VekxXRmxZell0WW1Wa01EZGtOMlJpWXpnNCZ1aV9sb2NhbGVzPWVuLVVTJm1rdD1lbi1VUyZjbGllbnQtcmVxdWVzdC1pZD0zNGI0YmNhMS02MDgyLTQ0Y2YtOTVmMC0xYmE1NWJlYzhjYmQmc3RhdGU9Uk82TTN0Yk5VdC15Mk9FSlNMWU5aUTZ0dnZfckhremdmXy00aFZkWmZYU1hGVzBVQ3NITXhMWXhhdy1FajNWTHdDYTdaSlM2Ynp5M2NDWktxNkMzMW8xYndfNlpMNThQTFBfNUc2MVI0dEpSb0hlS21Bbnd0UU5KejNtWWtNYzR3a0Qyd203UXBSXzc4OEw4Y0VHV0c4WV9CQzdvaW1hRktYdnpIYzFkSjFyWkVSS0VKckdMZHg4aHpZLWJtT0otU04xT05OM1h0Y2FoU1dYVzQ1ZkNfTFJxam5NdWJaRWxiQTRsMEFHUjg2VjRHbzkxSDBTNGF5TXhHUFQ1SnlCOVczbk1XUDgySVVKTjVLMUwyd0tOUFEmeC1jbGllbnQtU0tVPUlEX05FVDhfMCZ4LWNsaWVudC12ZXI9OC41LjAuMA==Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: qPdM=loKzyZIHgFNa; qPdM.sig=4xg-PpXrk3EZTMxwfoQqDMfUtFM; fpc=ApRUrsrnLe5AqKy55nDm2T0; esctx=PAQABBwEAAABVrSpeuWamRam2jAF1XRQE6Akd-c485wq4E4QZV6Safd95d7wJQSL--IapwZqAUIt3c11ALHCpzeFkSKiC8Ycvf8Mmg88HzJxfxABo91DVVv4BilkfqlD4hVVl2ysRlC0y9AwK8PNZFsc2eQhwS4AP6KyPPC7xbysg6pPKAhf7swIvSgNQnknxdlOKMOLOo1QgAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; OH.FLID=f5ff9bcc-2ea3-49aa-99e3-cae22396c400; .AspNetCore.OpenIdConnect.Nonce.yJMPUqQzsW1e_Da5eMLwXhcEOQSJDKhhDZ2UVirgFTe-sGKnMMhATbWRmkwA5BXpct1dAEb14ZvzxWxyLNngLp_yDmM8ckHENZRMZoLUfucu6phX0sQ7fxVLEyEAGHAllftuga1fbe1jHFg-xq7B2304UhWXkbNRmHruOsog-bjTXFOFhdUAFqMNoZPduL_sOrK9udYZGgotzN5dL1UQrSoMuMWZP48ZqZAT5J0LA_cnWVbcFiUljNLD2F5ZHH47=N; .AspNetCore.Correlation.TZACjB_Pi15j9c5LC64w_wuyEgrjBlpTk3meYY-eGj4=N; esctx-zZcGchvs7j4=AQABCQEAAABVrSpeuWamRam2jAF1XRQEFJ3-2FzLZDd82mXUaIUqeFTbfqlZWBR2zBWAVDbF2SBjsHBUGqj237jAZwe6Kg_HXWEaykonXnJJGx3MpSUeZ30G8KdPqPtDB4YQaFzd5oLj6SASR3MaWNFBpVvs6qgtHKZo-uohu0Pp4XeXulu5SiAA
Source: global traffic	HTTP traffic detected: GET /?m0nid4uex=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvdjIuMC9hdXRob3JpemU/Y2xpZW50X2lkPTQ3NjU0NDViLTMyYzYtNDliMC04M2U2LTFkOTM3NjUyNzZjYSZyZWRpcmVjdF91cmk9aHR0cHMlM0ElMkYlMkZ3d3cub2ZmaWNlLmNvbSUyRmxhbmRpbmd2MiZyZXNwb25zZV90eXBlPWNvZGUlMjBpZF90b2tlbiZzY29wZT1vcGVuaWQlMjBwcm9maWxlJTIwaHR0cHMlM0ElMkYlMkZ3d3cub2ZmaWNlLmNvbSUyRnYyJTJGT2ZmaWNlSG9tZS5BbGwmcmVzcG9uc2VfbW9kZT1mb3JtX3Bvc3Qmbm9uY2U9NjM4ODAzMzU4OTIyNjQyNjk5Lk1tRXhZMlV5WVRFdE1UWXhZaTAwTVRVM0xUaGhPV1l0TVRSbE9ETTVZak13TVRNek4yTTVOVFk1WTJRdFl6WmtZaTAwWm1VekxXRmxZell0WW1Wa01EZGtOMlJpWXpnNCZ1aV9sb2NhbGVzPWVuLVVTJm1rdD1lbi1VUyZjbGllbnQtcmVxdWVzdC1pZD0zNGI0YmNhMS02MDgyLTQ0Y2YtOTVmMC0xYmE1NWJlYzhjYmQmc3RhdGU9Uk82TTN0Yk5VdC15Mk9FSlNMWU5aUTZ0dnZfckhremdmXy00aFZkWmZYU1hGVzBVQ3NITXhMWXhhdy1FajNWTHdDYTdaSlM2Ynp5M2NDWktxNkMzMW8xYndfNlpMNThQTFBfNUc2MVI0dEpSb0hlS21Bbnd0UU5KejNtWWtNYzR3a0Qyd203UXBSXzc4OEw4Y0VHV0c4WV9CQzdvaW1hRktYdnpIYzFkSjFyWkVSS0VKckdMZHg4aHpZLWJtT0otU04xT05OM1h0Y2FoU1dYVzQ1ZkNfTFJxam5NdWJaRWxiQTRsMEFHUjg2VjRHbzkxSDBTNGF5TXhHUFQ1SnlCOVczbk1XUDgySVVKTjVLMUwyd0tOUFEmeC1jbGllbnQtU0tVPUlEX05FVDhfMCZ4LWNsaWVudC12ZXI9OC41LjAuMA==&sso_reload=true HTTP/1.1Host: neolect.caConnection: keep-alivesec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-Dest: documentReferer: https://neolect.ca/?m0nid4uex=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvdjIuMC9hdXRob3JpemU/Y2xpZW50X2lkPTQ3NjU0NDViLTMyYzYtNDliMC04M2U2LTFkOTM3NjUyNzZjYSZyZWRpcmVjdF91cmk9aHR0cHMlM0ElMkYlMkZ3d3cub2ZmaWNlLmNvbSUyRmxhbmRpbmd2MiZyZXNwb25zZV90eXBlPWNvZGUlMjBpZF90b2tlbiZzY29wZT1vcGVuaWQlMjBwcm9maWxlJTIwaHR0cHMlM0ElMkYlMkZ3d3cub2ZmaWNlLmNvbSUyRnYyJTJGT2ZmaWNlSG9tZS5BbGwmcmVzcG9uc2VfbW9kZT1mb3JtX3Bvc3Qmbm9uY2U9NjM4ODAzMzU4OTIyNjQyNjk5Lk1tRXhZMlV5WVRFdE1UWXhZaTAwTVRVM0xUaGhPV1l0TVRSbE9ETTVZak13TVRNek4yTTVOVFk1WTJRdFl6WmtZaTAwWm1VekxXRmxZell0WW1Wa01EZGtOMlJpWXpnNCZ1aV9sb2NhbGVzPWVuLVVTJm1rdD1lbi1VUyZjbGllbnQtcmVxdWVzdC1pZD0zNGI0YmNhMS02MDgyLTQ0Y2YtOTVmMC0xYmE1NWJlYzhjYmQmc3RhdGU9Uk82TTN0Yk5VdC15Mk9FSlNMWU5aUTZ0dnZfckhremdmXy00aFZkWmZYU1hGVzBVQ3NITXhMWXhhdy1FajNWTHdDYTdaSlM2Ynp5M2NDWktxNkMzMW8xYndfNlpMNThQTFBfNUc2MVI0dEpSb0hlS21Bbnd0UU5KejNtWWtNYzR3a0Qyd203UXBSXzc4OEw4Y0VHV0c4WV9CQzdvaW1hRktYdnpIYzFkSjFyWkVSS0VKckdMZHg4aHpZLWJtT0otU04xT05OM1h0Y2FoU1dYVzQ1ZkNfTFJxam5NdWJaRWxiQTRsMEFHUjg2VjRHbzkxSDBTNGF5TXhHUFQ1SnlCOVczbk1XUDgySVVKTjVLMUwyd0tOUFEmeC1jbGllbnQtU0tVPUlEX05FVDhfMCZ4LWNsaWVudC12ZXI9OC41LjAuMA==Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: qPdM=loKzyZIHgFNa; qPdM.sig=4xg-PpXrk3EZTMxwfoQqDMfUtFM; fpc=ApRUrsrnLe
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: neolect.caConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://neolect.ca/?m0nid4uex=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvdjIuMC9hdXRob3JpemU/Y2xpZW50X2lkPTQ3NjU0NDViLTMyYzYtNDliMC04M2U2LTFkOTM3NjUyNzZjYSZyZWRpcmVjdF91cmk9aHR0cHMlM0ElMkYlMkZ3d3cub2ZmaWNlLmNvbSUyRmxhbmRpbmd2MiZyZXNwb25zZV90eXBlPWNvZGUlMjBpZF90b2tlbiZzY29wZT1vcGVuaWQlMjBwcm9maWxlJTIwaHR0cHMlM0ElMkYlMkZ3d3cub2ZmaWNlLmNvbSUyRnYyJTJGT2ZmaWNlSG9tZS5BbGwmcmVzcG9uc2VfbW9kZT1mb3JtX3Bvc3Qmbm9uY2U9NjM4ODAzMzU4OTIyNjQyNjk5Lk1tRXhZMlV5WVRFdE1UWXhZaTAwTVRVM0xUaGhPV1l0TVRSbE9ETTVZak13TVRNek4yTTVOVFk1WTJRdFl6WmtZaTAwWm1VekxXRmxZell0WW1Wa01EZGtOMlJpWXpnNCZ1aV9sb2NhbGVzPWVuLVVTJm1rdD1lbi1VUyZjbGllbnQtcmVxdWVzdC1pZD0zNGI0YmNhMS02MDgyLTQ0Y2YtOTVmMC0xYmE1NWJlYzhjYmQmc3RhdGU9Uk82TTN0Yk5VdC15Mk9FSlNMWU5aUTZ0dnZfckhremdmXy00aFZkWmZYU1hGVzBVQ3NITXhMWXhhdy1FajNWTHdDYTdaSlM2Ynp5M2NDWktxNkMzMW8xYndfNlpMNThQTFBfNUc2MVI0dEpSb0hlS21Bbnd0UU5KejNtWWtNYzR3a0Qyd203UXBSXzc4OEw4Y0VHV0c4WV9CQzdvaW1hRktYdnpIYzFkSjFyWkVSS0VKckdMZHg4aHpZLWJtT0otU04xT05OM1h0Y2FoU1dYVzQ1ZkNfTFJxam5NdWJaRWxiQTRsMEFHUjg2VjRHbzkxSDBTNGF5TXhHUFQ1SnlCOVczbk1XUDgySVVKTjVLMUwyd0tOUFEmeC1jbGllbnQtU0tVPUlEX05FVDhfMCZ4LWNsaWVudC12ZXI9OC41LjAuMA==Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: qPdM=loKzyZIHgFNa; qPdM.sig=4xg-PpXrk3EZTMxwfoQqDMfUtFM; fpc=ApRUrsrnLe5AqKy55nDm2T0; esctx=PAQABBwEAAABVrSpeuWamRam2jAF1XRQE6Akd-c485wq4E4QZV6Safd95d7wJQSL--IapwZqAUIt3c11ALHCpzeFkSKiC8Ycvf8Mmg88HzJxfxABo91DVVv4BilkfqlD4hVVl2ysRlC0y9AwK8PNZFsc2eQhwS4AP6KyPPC7xbysg6pPKAhf7swIvSgNQnknxdlOKMOLOo1QgAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; OH.FLID=f5ff9bcc-2ea3-49aa-99e3-cae22396c400; .AspNetCore.OpenIdConnect.Nonce.yJMPUqQzsW1e_Da5eMLwXhcEOQSJDKhhDZ2UVirgFTe-sGKnMMhATbWRmkwA5BXpct1dAEb14ZvzxWxyLNngLp_yDmM8ckHENZRMZoLUfucu6phX0sQ7fxVLEyEAGHAllftuga1fbe1jHFg-xq7B2304UhWXkbNRmHruOsog-bjTXFOFhdUAFqMNoZPduL_sOrK9udYZGgotzN5dL1UQrSoMuMWZP48ZqZAT5J0LA_cnWVbcFiUljNLD2F5ZHH47=N; .AspNetCore.Correlation.TZACjB_Pi15j9c5LC64w_wuyEgrjBlpTk3meYY-eGj4=N; esctx-zZcGchvs7j4=AQABCQEAAABVrSpeuWamRam2jAF1XRQEFJ3-2FzLZDd82mXUaIUqeFTbfqlZWBR2zBWAVDbF2SBjsHBUGqj237jAZwe6Kg_HXWEaykonXnJJGx3MpSUeZ30G8KdPqPtDB4YQaFzd5oLj6SASR3MaWNFBpVvs6qgtHKZo-uohu0Pp4XeXulu5SiAA; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1
Source: global traffic	HTTP traffic detected: GET /aadcdn.msftauth.net/~/ests/2.1/content/cdnbundles/converged.v2.login.min_81imvbluez-v5hbzpkxfcg2.css HTTP/1.1Host: neolect.caConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://neolect.ca/?m0nid4uex=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvdjIuMC9hdXRob3JpemU/Y2xpZW50X2lkPTQ3NjU0NDViLTMyYzYtNDliMC04M2U2LTFkOTM3NjUyNzZjYSZyZWRpcmVjdF91cmk9aHR0cHMlM0ElMkYlMkZ3d3cub2ZmaWNlLmNvbSUyRmxhbmRpbmd2MiZyZXNwb25zZV90eXBlPWNvZGUlMjBpZF90b2tlbiZzY29wZT1vcGVuaWQlMjBwcm9maWxlJTIwaHR0cHMlM0ElMkYlMkZ3d3cub2ZmaWNlLmNvbSUyRnYyJTJGT2ZmaWNlSG9tZS5BbGwmcmVzcG9uc2VfbW9kZT1mb3JtX3Bvc3Qmbm9uY2U9NjM4ODAzMzU4OTIyNjQyNjk5Lk1tRXhZMlV5WVRFdE1UWXhZaTAwTVRVM0xUaGhPV1l0TVRSbE9ETTVZak13TVRNek4yTTVOVFk1WTJRdFl6WmtZaTAwWm1VekxXRmxZell0WW1Wa01EZGtOMlJpWXpnNCZ1aV9sb2NhbGVzPWVuLVVTJm1rdD1lbi1VUyZjbGllbnQtcmVxdWVzdC1pZD0zNGI0YmNhMS02MDgyLTQ0Y2YtOTVmMC0xYmE1NWJlYzhjYmQmc3RhdGU9Uk82TTN0Yk5VdC15Mk9FSlNMWU5aUTZ0dnZfckhremdmXy00aFZkWmZYU1hGVzBVQ3NITXhMWXhhdy1FajNWTHdDYTdaSlM2Ynp5M2NDWktxNkMzMW8xYndfNlpMNThQTFBfNUc2MVI0dEpSb0hlS21Bbnd0UU5KejNtWWtNYzR3a0Qyd203UXBSXzc4OEw4Y0VHV0c4WV9CQzdvaW1hRktYdnpIYzFkSjFyWkVSS0VKckdMZHg4aHpZLWJtT0otU04xT05OM1h0Y2FoU1dYVzQ1ZkNfTFJxam5NdWJaRWxiQTRsMEFHUjg2VjRHbzkxSDBTNGF5TXhHUFQ1SnlCOVczbk1XUDgySVVKTjVLMUwyd0tOUFEmeC1jbGllbnQtU0tVPUlEX05FVDhfMCZ4LWNsaWVudC12ZXI9OC41LjAuMA==&sso_reload=trueAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: qPdM=loKzyZIHgFNa; qPdM.sig=4xg-PpXrk3EZTMxwfoQqDMfUtFM; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; OH.FLID=f5ff9bcc-2ea3-49aa-99e3-cae22396c400; .AspNetCore.OpenIdConnect.Nonce.yJMPUqQzsW1e_Da5eMLwXhcEOQSJDKhhDZ2UVirgFTe-sGKnMMhATbWRmkwA5BXpct1dAEb14ZvzxWxyLNngLp_yDmM8ckHENZRMZoLUfucu6phX0sQ7fxVLEyEAGHAllftuga1fbe1jHFg-xq7B2304UhWXkbNRmHruOsog-bjTXFOFhdUAFqMNoZPduL_sOrK9udYZGgotzN5dL1UQrSoMuMWZP48ZqZAT5J0LA_cnWVbcFiUljNLD2F5ZHH47=N; .AspNetCore.Correlation.TZACjB_Pi15j9c5LC64w_wuyEgrjBlpTk3meYY-eGj4=N; esctx-zZcGchvs7j4=AQABCQEAAABVrSpeuWamRam2jAF1XRQEFJ3-2FzLZDd82mXUaIUqeFTbfqlZWBR2zBWAVDbF2SBjsHBUGqj237jAZwe6Kg_HXWEaykonXnJJGx3MpSUeZ30G8KdPqPtDB4YQaFzd5oLj6SASR3MaWNFBpVvs6qgtHKZo-uohu0Pp4XeXulu5SiAA; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=1.AQgAMe_N-B6jSkuT5F9XHpElWltEZUfGMrBJg-Ydk3ZSdsoBAAAIAA.AQABGgEAAABVrSpeuWamRam2jAF1XRQE_j6ILJnZR0w-ZLdLWytZiU2MovtejU7rKKbOaAVH6OWaIFpq7IBDyPdbeKhOaKE5OxpVhDxvHsnrC7HrJEJbtmO-3jF0Yeda5BoR_IBQ3UQgAA; esctx=PAQABBwEAAABVrSpeuWamRam2jAF1XRQEUhz-aQHRS3veTs7MTx8am_WylJNIRBA_k6AbCMjoptUvTbxAWNqkKZfDzG7w3Osf4zQWutaalxwBXpnEhVDFbioRNDotWLbHmn4wEV3ejz5HOEnoGxXSDTl_9wNRH5iC6aAzQPF8MIr9KxgsNcuMArbkA-Uvncfotw1xbSsz0UwgAA; esctx-tb3uZcqbplY=AQABCQEAAABVrSpeuWamRam2jAF1XRQE-V
Source: global traffic	HTTP traffic detected: GET /aadcdn.msftauth.net/~/shared/1.0/content/js/ConvergedLogin_PCore_XZWzmNsf-98_A243D7S65Q2.js HTTP/1.1Host: neolect.caConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://neolect.ca/?m0nid4uex=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvdjIuMC9hdXRob3JpemU/Y2xpZW50X2lkPTQ3NjU0NDViLTMyYzYtNDliMC04M2U2LTFkOTM3NjUyNzZjYSZyZWRpcmVjdF91cmk9aHR0cHMlM0ElMkYlMkZ3d3cub2ZmaWNlLmNvbSUyRmxhbmRpbmd2MiZyZXNwb25zZV90eXBlPWNvZGUlMjBpZF90b2tlbiZzY29wZT1vcGVuaWQlMjBwcm9maWxlJTIwaHR0cHMlM0ElMkYlMkZ3d3cub2ZmaWNlLmNvbSUyRnYyJTJGT2ZmaWNlSG9tZS5BbGwmcmVzcG9uc2VfbW9kZT1mb3JtX3Bvc3Qmbm9uY2U9NjM4ODAzMzU4OTIyNjQyNjk5Lk1tRXhZMlV5WVRFdE1UWXhZaTAwTVRVM0xUaGhPV1l0TVRSbE9ETTVZak13TVRNek4yTTVOVFk1WTJRdFl6WmtZaTAwWm1VekxXRmxZell0WW1Wa01EZGtOMlJpWXpnNCZ1aV9sb2NhbGVzPWVuLVVTJm1rdD1lbi1VUyZjbGllbnQtcmVxdWVzdC1pZD0zNGI0YmNhMS02MDgyLTQ0Y2YtOTVmMC0xYmE1NWJlYzhjYmQmc3RhdGU9Uk82TTN0Yk5VdC15Mk9FSlNMWU5aUTZ0dnZfckhremdmXy00aFZkWmZYU1hGVzBVQ3NITXhMWXhhdy1FajNWTHdDYTdaSlM2Ynp5M2NDWktxNkMzMW8xYndfNlpMNThQTFBfNUc2MVI0dEpSb0hlS21Bbnd0UU5KejNtWWtNYzR3a0Qyd203UXBSXzc4OEw4Y0VHV0c4WV9CQzdvaW1hRktYdnpIYzFkSjFyWkVSS0VKckdMZHg4aHpZLWJtT0otU04xT05OM1h0Y2FoU1dYVzQ1ZkNfTFJxam5NdWJaRWxiQTRsMEFHUjg2VjRHbzkxSDBTNGF5TXhHUFQ1SnlCOVczbk1XUDgySVVKTjVLMUwyd0tOUFEmeC1jbGllbnQtU0tVPUlEX05FVDhfMCZ4LWNsaWVudC12ZXI9OC41LjAuMA==&sso_reload=trueAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: qPdM=loKzyZIHgFNa; qPdM.sig=4xg-PpXrk3EZTMxwfoQqDMfUtFM; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; OH.FLID=f5ff9bcc-2ea3-49aa-99e3-cae22396c400; .AspNetCore.OpenIdConnect.Nonce.yJMPUqQzsW1e_Da5eMLwXhcEOQSJDKhhDZ2UVirgFTe-sGKnMMhATbWRmkwA5BXpct1dAEb14ZvzxWxyLNngLp_yDmM8ckHENZRMZoLUfucu6phX0sQ7fxVLEyEAGHAllftuga1fbe1jHFg-xq7B2304UhWXkbNRmHruOsog-bjTXFOFhdUAFqMNoZPduL_sOrK9udYZGgotzN5dL1UQrSoMuMWZP48ZqZAT5J0LA_cnWVbcFiUljNLD2F5ZHH47=N; .AspNetCore.Correlation.TZACjB_Pi15j9c5LC64w_wuyEgrjBlpTk3meYY-eGj4=N; esctx-zZcGchvs7j4=AQABCQEAAABVrSpeuWamRam2jAF1XRQEFJ3-2FzLZDd82mXUaIUqeFTbfqlZWBR2zBWAVDbF2SBjsHBUGqj237jAZwe6Kg_HXWEaykonXnJJGx3MpSUeZ30G8KdPqPtDB4YQaFzd5oLj6SASR3MaWNFBpVvs6qgtHKZo-uohu0Pp4XeXulu5SiAA; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=1.AQgAMe_N-B6jSkuT5F9XHpElWltEZUfGMrBJg-Ydk3ZSdsoBAAAIAA.AQABGgEAAABVrSpeuWamRam2jAF1XRQE_j6ILJnZR0w-ZLdLWytZiU2MovtejU7rKKbOaAVH6OWaIFpq7IBDyPdbeKhOaKE5OxpVhDxvHsnrC7HrJEJbtmO-3jF0Yeda5BoR_IBQ3UQgAA; esctx=PAQABBwEAAABVrSpeuWamRam2jAF1XRQEUhz-aQHRS3veTs7MTx8am_WylJNIRBA_k6AbCMjoptUvTbxAWNqkKZfDzG7w3Osf4zQWutaalxwBXpnEhVDFbioRNDotWLbHmn4wEV3ejz5HOEnoGxXSDTl_9wNRH5iC6aAzQPF8MIr9KxgsNcuMArbkA-Uvncfotw1xbSsz0UwgAA; esctx-tb3uZcqbplY=AQABCQEAAABVrSpeuWamRam2jAF1XRQE-Vt3NsuK3Pkx0ID0oXZU1IUF_
Source: global traffic	HTTP traffic detected: GET /aadcdn.msftauth.net/~/ests/2.1/content/cdnbundles/ux.converged.login.strings-en.min_1d0daql8my9m71a_2aaxzg2.js HTTP/1.1Host: neolect.caConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://neolect.ca/?m0nid4uex=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvdjIuMC9hdXRob3JpemU/Y2xpZW50X2lkPTQ3NjU0NDViLTMyYzYtNDliMC04M2U2LTFkOTM3NjUyNzZjYSZyZWRpcmVjdF91cmk9aHR0cHMlM0ElMkYlMkZ3d3cub2ZmaWNlLmNvbSUyRmxhbmRpbmd2MiZyZXNwb25zZV90eXBlPWNvZGUlMjBpZF90b2tlbiZzY29wZT1vcGVuaWQlMjBwcm9maWxlJTIwaHR0cHMlM0ElMkYlMkZ3d3cub2ZmaWNlLmNvbSUyRnYyJTJGT2ZmaWNlSG9tZS5BbGwmcmVzcG9uc2VfbW9kZT1mb3JtX3Bvc3Qmbm9uY2U9NjM4ODAzMzU4OTIyNjQyNjk5Lk1tRXhZMlV5WVRFdE1UWXhZaTAwTVRVM0xUaGhPV1l0TVRSbE9ETTVZak13TVRNek4yTTVOVFk1WTJRdFl6WmtZaTAwWm1VekxXRmxZell0WW1Wa01EZGtOMlJpWXpnNCZ1aV9sb2NhbGVzPWVuLVVTJm1rdD1lbi1VUyZjbGllbnQtcmVxdWVzdC1pZD0zNGI0YmNhMS02MDgyLTQ0Y2YtOTVmMC0xYmE1NWJlYzhjYmQmc3RhdGU9Uk82TTN0Yk5VdC15Mk9FSlNMWU5aUTZ0dnZfckhremdmXy00aFZkWmZYU1hGVzBVQ3NITXhMWXhhdy1FajNWTHdDYTdaSlM2Ynp5M2NDWktxNkMzMW8xYndfNlpMNThQTFBfNUc2MVI0dEpSb0hlS21Bbnd0UU5KejNtWWtNYzR3a0Qyd203UXBSXzc4OEw4Y0VHV0c4WV9CQzdvaW1hRktYdnpIYzFkSjFyWkVSS0VKckdMZHg4aHpZLWJtT0otU04xT05OM1h0Y2FoU1dYVzQ1ZkNfTFJxam5NdWJaRWxiQTRsMEFHUjg2VjRHbzkxSDBTNGF5TXhHUFQ1SnlCOVczbk1XUDgySVVKTjVLMUwyd0tOUFEmeC1jbGllbnQtU0tVPUlEX05FVDhfMCZ4LWNsaWVudC12ZXI9OC41LjAuMA==&sso_reload=trueAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: qPdM=loKzyZIHgFNa; qPdM.sig=4xg-PpXrk3EZTMxwfoQqDMfUtFM; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; OH.FLID=f5ff9bcc-2ea3-49aa-99e3-cae22396c400; .AspNetCore.OpenIdConnect.Nonce.yJMPUqQzsW1e_Da5eMLwXhcEOQSJDKhhDZ2UVirgFTe-sGKnMMhATbWRmkwA5BXpct1dAEb14ZvzxWxyLNngLp_yDmM8ckHENZRMZoLUfucu6phX0sQ7fxVLEyEAGHAllftuga1fbe1jHFg-xq7B2304UhWXkbNRmHruOsog-bjTXFOFhdUAFqMNoZPduL_sOrK9udYZGgotzN5dL1UQrSoMuMWZP48ZqZAT5J0LA_cnWVbcFiUljNLD2F5ZHH47=N; .AspNetCore.Correlation.TZACjB_Pi15j9c5LC64w_wuyEgrjBlpTk3meYY-eGj4=N; esctx-zZcGchvs7j4=AQABCQEAAABVrSpeuWamRam2jAF1XRQEFJ3-2FzLZDd82mXUaIUqeFTbfqlZWBR2zBWAVDbF2SBjsHBUGqj237jAZwe6Kg_HXWEaykonXnJJGx3MpSUeZ30G8KdPqPtDB4YQaFzd5oLj6SASR3MaWNFBpVvs6qgtHKZo-uohu0Pp4XeXulu5SiAA; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=1.AQgAMe_N-B6jSkuT5F9XHpElWltEZUfGMrBJg-Ydk3ZSdsoBAAAIAA.AQABGgEAAABVrSpeuWamRam2jAF1XRQE_j6ILJnZR0w-ZLdLWytZiU2MovtejU7rKKbOaAVH6OWaIFpq7IBDyPdbeKhOaKE5OxpVhDxvHsnrC7HrJEJbtmO-3jF0Yeda5BoR_IBQ3UQgAA; esctx=PAQABBwEAAABVrSpeuWamRam2jAF1XRQEUhz-aQHRS3veTs7MTx8am_WylJNIRBA_k6AbCMjoptUvTbxAWNqkKZfDzG7w3Osf4zQWutaalxwBXpnEhVDFbioRNDotWLbHmn4wEV3ejz5HOEnoGxXSDTl_9wNRH5iC6aAzQPF8MIr9KxgsNcuMArbkA-Uvncfotw1xbSsz0UwgAA; esctx-tb3uZcqbplY=AQABCQEAAABVrSpeuWamRam2jAF1XRQE-Vt3Ns
Source: global traffic	HTTP traffic detected: GET /aadcdn.msftauth.net/~/shared/1.0/content/js/oneDs_641b1cf809bdc17b42ab.js HTTP/1.1Host: neolect.caConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://neolect.ca/?m0nid4uex=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvdjIuMC9hdXRob3JpemU/Y2xpZW50X2lkPTQ3NjU0NDViLTMyYzYtNDliMC04M2U2LTFkOTM3NjUyNzZjYSZyZWRpcmVjdF91cmk9aHR0cHMlM0ElMkYlMkZ3d3cub2ZmaWNlLmNvbSUyRmxhbmRpbmd2MiZyZXNwb25zZV90eXBlPWNvZGUlMjBpZF90b2tlbiZzY29wZT1vcGVuaWQlMjBwcm9maWxlJTIwaHR0cHMlM0ElMkYlMkZ3d3cub2ZmaWNlLmNvbSUyRnYyJTJGT2ZmaWNlSG9tZS5BbGwmcmVzcG9uc2VfbW9kZT1mb3JtX3Bvc3Qmbm9uY2U9NjM4ODAzMzU4OTIyNjQyNjk5Lk1tRXhZMlV5WVRFdE1UWXhZaTAwTVRVM0xUaGhPV1l0TVRSbE9ETTVZak13TVRNek4yTTVOVFk1WTJRdFl6WmtZaTAwWm1VekxXRmxZell0WW1Wa01EZGtOMlJpWXpnNCZ1aV9sb2NhbGVzPWVuLVVTJm1rdD1lbi1VUyZjbGllbnQtcmVxdWVzdC1pZD0zNGI0YmNhMS02MDgyLTQ0Y2YtOTVmMC0xYmE1NWJlYzhjYmQmc3RhdGU9Uk82TTN0Yk5VdC15Mk9FSlNMWU5aUTZ0dnZfckhremdmXy00aFZkWmZYU1hGVzBVQ3NITXhMWXhhdy1FajNWTHdDYTdaSlM2Ynp5M2NDWktxNkMzMW8xYndfNlpMNThQTFBfNUc2MVI0dEpSb0hlS21Bbnd0UU5KejNtWWtNYzR3a0Qyd203UXBSXzc4OEw4Y0VHV0c4WV9CQzdvaW1hRktYdnpIYzFkSjFyWkVSS0VKckdMZHg4aHpZLWJtT0otU04xT05OM1h0Y2FoU1dYVzQ1ZkNfTFJxam5NdWJaRWxiQTRsMEFHUjg2VjRHbzkxSDBTNGF5TXhHUFQ1SnlCOVczbk1XUDgySVVKTjVLMUwyd0tOUFEmeC1jbGllbnQtU0tVPUlEX05FVDhfMCZ4LWNsaWVudC12ZXI9OC41LjAuMA==&sso_reload=trueAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: qPdM=loKzyZIHgFNa; qPdM.sig=4xg-PpXrk3EZTMxwfoQqDMfUtFM; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; OH.FLID=f5ff9bcc-2ea3-49aa-99e3-cae22396c400; .AspNetCore.OpenIdConnect.Nonce.yJMPUqQzsW1e_Da5eMLwXhcEOQSJDKhhDZ2UVirgFTe-sGKnMMhATbWRmkwA5BXpct1dAEb14ZvzxWxyLNngLp_yDmM8ckHENZRMZoLUfucu6phX0sQ7fxVLEyEAGHAllftuga1fbe1jHFg-xq7B2304UhWXkbNRmHruOsog-bjTXFOFhdUAFqMNoZPduL_sOrK9udYZGgotzN5dL1UQrSoMuMWZP48ZqZAT5J0LA_cnWVbcFiUljNLD2F5ZHH47=N; .AspNetCore.Correlation.TZACjB_Pi15j9c5LC64w_wuyEgrjBlpTk3meYY-eGj4=N; esctx-zZcGchvs7j4=AQABCQEAAABVrSpeuWamRam2jAF1XRQEFJ3-2FzLZDd82mXUaIUqeFTbfqlZWBR2zBWAVDbF2SBjsHBUGqj237jAZwe6Kg_HXWEaykonXnJJGx3MpSUeZ30G8KdPqPtDB4YQaFzd5oLj6SASR3MaWNFBpVvs6qgtHKZo-uohu0Pp4XeXulu5SiAA; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=1.AQgAMe_N-B6jSkuT5F9XHpElWltEZUfGMrBJg-Ydk3ZSdsoBAAAIAA.AQABGgEAAABVrSpeuWamRam2jAF1XRQE_j6ILJnZR0w-ZLdLWytZiU2MovtejU7rKKbOaAVH6OWaIFpq7IBDyPdbeKhOaKE5OxpVhDxvHsnrC7HrJEJbtmO-3jF0Yeda5BoR_IBQ3UQgAA; esctx=PAQABBwEAAABVrSpeuWamRam2jAF1XRQEUhz-aQHRS3veTs7MTx8am_WylJNIRBA_k6AbCMjoptUvTbxAWNqkKZfDzG7w3Osf4zQWutaalxwBXpnEhVDFbioRNDotWLbHmn4wEV3ejz5HOEnoGxXSDTl_9wNRH5iC6aAzQPF8MIr9KxgsNcuMArbkA-Uvncfotw1xbSsz0UwgAA; esctx-tb3uZcqbplY=AQABCQEAAABVrSpeuWamRam2jAF1XRQE-Vt3NsuK3Pkx0ID0oXZU1IUF_8XyjOXzGrzk7jmcJ3Q
Source: global traffic	HTTP traffic detected: GET /aadcdn.msftauth.net/~/shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico HTTP/1.1Host: neolect.caConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://neolect.ca/?m0nid4uex=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvdjIuMC9hdXRob3JpemU/Y2xpZW50X2lkPTQ3NjU0NDViLTMyYzYtNDliMC04M2U2LTFkOTM3NjUyNzZjYSZyZWRpcmVjdF91cmk9aHR0cHMlM0ElMkYlMkZ3d3cub2ZmaWNlLmNvbSUyRmxhbmRpbmd2MiZyZXNwb25zZV90eXBlPWNvZGUlMjBpZF90b2tlbiZzY29wZT1vcGVuaWQlMjBwcm9maWxlJTIwaHR0cHMlM0ElMkYlMkZ3d3cub2ZmaWNlLmNvbSUyRnYyJTJGT2ZmaWNlSG9tZS5BbGwmcmVzcG9uc2VfbW9kZT1mb3JtX3Bvc3Qmbm9uY2U9NjM4ODAzMzU4OTIyNjQyNjk5Lk1tRXhZMlV5WVRFdE1UWXhZaTAwTVRVM0xUaGhPV1l0TVRSbE9ETTVZak13TVRNek4yTTVOVFk1WTJRdFl6WmtZaTAwWm1VekxXRmxZell0WW1Wa01EZGtOMlJpWXpnNCZ1aV9sb2NhbGVzPWVuLVVTJm1rdD1lbi1VUyZjbGllbnQtcmVxdWVzdC1pZD0zNGI0YmNhMS02MDgyLTQ0Y2YtOTVmMC0xYmE1NWJlYzhjYmQmc3RhdGU9Uk82TTN0Yk5VdC15Mk9FSlNMWU5aUTZ0dnZfckhremdmXy00aFZkWmZYU1hGVzBVQ3NITXhMWXhhdy1FajNWTHdDYTdaSlM2Ynp5M2NDWktxNkMzMW8xYndfNlpMNThQTFBfNUc2MVI0dEpSb0hlS21Bbnd0UU5KejNtWWtNYzR3a0Qyd203UXBSXzc4OEw4Y0VHV0c4WV9CQzdvaW1hRktYdnpIYzFkSjFyWkVSS0VKckdMZHg4aHpZLWJtT0otU04xT05OM1h0Y2FoU1dYVzQ1ZkNfTFJxam5NdWJaRWxiQTRsMEFHUjg2VjRHbzkxSDBTNGF5TXhHUFQ1SnlCOVczbk1XUDgySVVKTjVLMUwyd0tOUFEmeC1jbGllbnQtU0tVPUlEX05FVDhfMCZ4LWNsaWVudC12ZXI9OC41LjAuMA==&sso_reload=trueAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: qPdM=loKzyZIHgFNa; qPdM.sig=4xg-PpXrk3EZTMxwfoQqDMfUtFM; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; OH.FLID=f5ff9bcc-2ea3-49aa-99e3-cae22396c400; .AspNetCore.OpenIdConnect.Nonce.yJMPUqQzsW1e_Da5eMLwXhcEOQSJDKhhDZ2UVirgFTe-sGKnMMhATbWRmkwA5BXpct1dAEb14ZvzxWxyLNngLp_yDmM8ckHENZRMZoLUfucu6phX0sQ7fxVLEyEAGHAllftuga1fbe1jHFg-xq7B2304UhWXkbNRmHruOsog-bjTXFOFhdUAFqMNoZPduL_sOrK9udYZGgotzN5dL1UQrSoMuMWZP48ZqZAT5J0LA_cnWVbcFiUljNLD2F5ZHH47=N; .AspNetCore.Correlation.TZACjB_Pi15j9c5LC64w_wuyEgrjBlpTk3meYY-eGj4=N; esctx-zZcGchvs7j4=AQABCQEAAABVrSpeuWamRam2jAF1XRQEFJ3-2FzLZDd82mXUaIUqeFTbfqlZWBR2zBWAVDbF2SBjsHBUGqj237jAZwe6Kg_HXWEaykonXnJJGx3MpSUeZ30G8KdPqPtDB4YQaFzd5oLj6SASR3MaWNFBpVvs6qgtHKZo-uohu0Pp4XeXulu5SiAA; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=1.AQgAMe_N-B6jSkuT5F9XHpElWltEZUfGMrBJg-Ydk3ZSdsoBAAAIAA.AQABGgEAAABVrSpeuWamRam2jAF1XRQE_j6ILJnZR0w-ZLdLWytZiU2MovtejU7rKKbOaAVH6OWaIFpq7IBDyPdbeKhOaKE5OxpVhDxvHsnrC7HrJEJbtmO-3jF0Yeda5BoR_IBQ3UQgAA; esctx=PAQABBwEAAABVrSpeuWamRam2jAF1XRQEUhz-aQHRS3veTs7MTx8am_WylJNIRBA_k6AbCMjoptUvTbxAWNqkKZfDzG7w3Osf4zQWutaalxwBXpnEhVDFbioRNDotWLbHmn4wEV3ejz5HOEnoGxXSDTl_9wNRH5iC6aAzQPF8MIr9KxgsNcuMArbkA-Uvncfotw1xbSsz0UwgAA; esctx-tb3uZcqbplY=AQA
Source: global traffic	HTTP traffic detected: GET /aadcdn.msftauth.net/~/shared/1.0/content/js/asyncchunk/convergedlogin_pfetchsessionsprogress_ae573f441ee1cf781ec7.js HTTP/1.1Host: neolect.caConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://neolect.ca/?m0nid4uex=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvdjIuMC9hdXRob3JpemU/Y2xpZW50X2lkPTQ3NjU0NDViLTMyYzYtNDliMC04M2U2LTFkOTM3NjUyNzZjYSZyZWRpcmVjdF91cmk9aHR0cHMlM0ElMkYlMkZ3d3cub2ZmaWNlLmNvbSUyRmxhbmRpbmd2MiZyZXNwb25zZV90eXBlPWNvZGUlMjBpZF90b2tlbiZzY29wZT1vcGVuaWQlMjBwcm9maWxlJTIwaHR0cHMlM0ElMkYlMkZ3d3cub2ZmaWNlLmNvbSUyRnYyJTJGT2ZmaWNlSG9tZS5BbGwmcmVzcG9uc2VfbW9kZT1mb3JtX3Bvc3Qmbm9uY2U9NjM4ODAzMzU4OTIyNjQyNjk5Lk1tRXhZMlV5WVRFdE1UWXhZaTAwTVRVM0xUaGhPV1l0TVRSbE9ETTVZak13TVRNek4yTTVOVFk1WTJRdFl6WmtZaTAwWm1VekxXRmxZell0WW1Wa01EZGtOMlJpWXpnNCZ1aV9sb2NhbGVzPWVuLVVTJm1rdD1lbi1VUyZjbGllbnQtcmVxdWVzdC1pZD0zNGI0YmNhMS02MDgyLTQ0Y2YtOTVmMC0xYmE1NWJlYzhjYmQmc3RhdGU9Uk82TTN0Yk5VdC15Mk9FSlNMWU5aUTZ0dnZfckhremdmXy00aFZkWmZYU1hGVzBVQ3NITXhMWXhhdy1FajNWTHdDYTdaSlM2Ynp5M2NDWktxNkMzMW8xYndfNlpMNThQTFBfNUc2MVI0dEpSb0hlS21Bbnd0UU5KejNtWWtNYzR3a0Qyd203UXBSXzc4OEw4Y0VHV0c4WV9CQzdvaW1hRktYdnpIYzFkSjFyWkVSS0VKckdMZHg4aHpZLWJtT0otU04xT05OM1h0Y2FoU1dYVzQ1ZkNfTFJxam5NdWJaRWxiQTRsMEFHUjg2VjRHbzkxSDBTNGF5TXhHUFQ1SnlCOVczbk1XUDgySVVKTjVLMUwyd0tOUFEmeC1jbGllbnQtU0tVPUlEX05FVDhfMCZ4LWNsaWVudC12ZXI9OC41LjAuMA==&sso_reload=trueAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: qPdM=loKzyZIHgFNa; qPdM.sig=4xg-PpXrk3EZTMxwfoQqDMfUtFM; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; OH.FLID=f5ff9bcc-2ea3-49aa-99e3-cae22396c400; .AspNetCore.OpenIdConnect.Nonce.yJMPUqQzsW1e_Da5eMLwXhcEOQSJDKhhDZ2UVirgFTe-sGKnMMhATbWRmkwA5BXpct1dAEb14ZvzxWxyLNngLp_yDmM8ckHENZRMZoLUfucu6phX0sQ7fxVLEyEAGHAllftuga1fbe1jHFg-xq7B2304UhWXkbNRmHruOsog-bjTXFOFhdUAFqMNoZPduL_sOrK9udYZGgotzN5dL1UQrSoMuMWZP48ZqZAT5J0LA_cnWVbcFiUljNLD2F5ZHH47=N; .AspNetCore.Correlation.TZACjB_Pi15j9c5LC64w_wuyEgrjBlpTk3meYY-eGj4=N; esctx-zZcGchvs7j4=AQABCQEAAABVrSpeuWamRam2jAF1XRQEFJ3-2FzLZDd82mXUaIUqeFTbfqlZWBR2zBWAVDbF2SBjsHBUGqj237jAZwe6Kg_HXWEaykonXnJJGx3MpSUeZ30G8KdPqPtDB4YQaFzd5oLj6SASR3MaWNFBpVvs6qgtHKZo-uohu0Pp4XeXulu5SiAA; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=1.AQgAMe_N-B6jSkuT5F9XHpElWltEZUfGMrBJg-Ydk3ZSdsoBAAAIAA.AQABGgEAAABVrSpeuWamRam2jAF1XRQE_j6ILJnZR0w-ZLdLWytZiU2MovtejU7rKKbOaAVH6OWaIFpq7IBDyPdbeKhOaKE5OxpVhDxvHsnrC7HrJEJbtmO-3jF0Yeda5BoR_IBQ3UQgAA; esctx=PAQABBwEAAABVrSpeuWamRam2jAF1XRQEUhz-aQHRS3veTs7MTx8am_WylJNIRBA_k6AbCMjoptUvTbxAWNqkKZfDzG7w3Osf4zQWutaalxwBXpnEhVDFbioRNDotWLbHmn4wEV3ejz5HOEnoGxXSDTl_9wNRH5iC6aAzQPF8MIr9KxgsNcuMArbkA-Uvncfotw1xbSsz0UwgAA; esctx-tb3uZcqbplY=AQABCQEAAABVrSpeuWamRam2jAF1XRQE
Source: global traffic	HTTP traffic detected: GET /aadcdn.msftauth.net/~/shared/1.0/content/images/marching_ants_white_166de53471265253ab3a456defe6da23.gif HTTP/1.1Host: neolect.caConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://neolect.ca/?m0nid4uex=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvdjIuMC9hdXRob3JpemU/Y2xpZW50X2lkPTQ3NjU0NDViLTMyYzYtNDliMC04M2U2LTFkOTM3NjUyNzZjYSZyZWRpcmVjdF91cmk9aHR0cHMlM0ElMkYlMkZ3d3cub2ZmaWNlLmNvbSUyRmxhbmRpbmd2MiZyZXNwb25zZV90eXBlPWNvZGUlMjBpZF90b2tlbiZzY29wZT1vcGVuaWQlMjBwcm9maWxlJTIwaHR0cHMlM0ElMkYlMkZ3d3cub2ZmaWNlLmNvbSUyRnYyJTJGT2ZmaWNlSG9tZS5BbGwmcmVzcG9uc2VfbW9kZT1mb3JtX3Bvc3Qmbm9uY2U9NjM4ODAzMzU4OTIyNjQyNjk5Lk1tRXhZMlV5WVRFdE1UWXhZaTAwTVRVM0xUaGhPV1l0TVRSbE9ETTVZak13TVRNek4yTTVOVFk1WTJRdFl6WmtZaTAwWm1VekxXRmxZell0WW1Wa01EZGtOMlJpWXpnNCZ1aV9sb2NhbGVzPWVuLVVTJm1rdD1lbi1VUyZjbGllbnQtcmVxdWVzdC1pZD0zNGI0YmNhMS02MDgyLTQ0Y2YtOTVmMC0xYmE1NWJlYzhjYmQmc3RhdGU9Uk82TTN0Yk5VdC15Mk9FSlNMWU5aUTZ0dnZfckhremdmXy00aFZkWmZYU1hGVzBVQ3NITXhMWXhhdy1FajNWTHdDYTdaSlM2Ynp5M2NDWktxNkMzMW8xYndfNlpMNThQTFBfNUc2MVI0dEpSb0hlS21Bbnd0UU5KejNtWWtNYzR3a0Qyd203UXBSXzc4OEw4Y0VHV0c4WV9CQzdvaW1hRktYdnpIYzFkSjFyWkVSS0VKckdMZHg4aHpZLWJtT0otU04xT05OM1h0Y2FoU1dYVzQ1ZkNfTFJxam5NdWJaRWxiQTRsMEFHUjg2VjRHbzkxSDBTNGF5TXhHUFQ1SnlCOVczbk1XUDgySVVKTjVLMUwyd0tOUFEmeC1jbGllbnQtU0tVPUlEX05FVDhfMCZ4LWNsaWVudC12ZXI9OC41LjAuMA==&sso_reload=trueAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: qPdM=loKzyZIHgFNa; qPdM.sig=4xg-PpXrk3EZTMxwfoQqDMfUtFM; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; OH.FLID=f5ff9bcc-2ea3-49aa-99e3-cae22396c400; .AspNetCore.OpenIdConnect.Nonce.yJMPUqQzsW1e_Da5eMLwXhcEOQSJDKhhDZ2UVirgFTe-sGKnMMhATbWRmkwA5BXpct1dAEb14ZvzxWxyLNngLp_yDmM8ckHENZRMZoLUfucu6phX0sQ7fxVLEyEAGHAllftuga1fbe1jHFg-xq7B2304UhWXkbNRmHruOsog-bjTXFOFhdUAFqMNoZPduL_sOrK9udYZGgotzN5dL1UQrSoMuMWZP48ZqZAT5J0LA_cnWVbcFiUljNLD2F5ZHH47=N; .AspNetCore.Correlation.TZACjB_Pi15j9c5LC64w_wuyEgrjBlpTk3meYY-eGj4=N; esctx-zZcGchvs7j4=AQABCQEAAABVrSpeuWamRam2jAF1XRQEFJ3-2FzLZDd82mXUaIUqeFTbfqlZWBR2zBWAVDbF2SBjsHBUGqj237jAZwe6Kg_HXWEaykonXnJJGx3MpSUeZ30G8KdPqPtDB4YQaFzd5oLj6SASR3MaWNFBpVvs6qgtHKZo-uohu0Pp4XeXulu5SiAA; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=1.AQgAMe_N-B6jSkuT5F9XHpElWltEZUfGMrBJg-Ydk3ZSdsoBAAAIAA.AQABGgEAAABVrSpeuWamRam2jAF1XRQE_j6ILJnZR0w-ZLdLWytZiU2MovtejU7rKKbOaAVH6OWaIFpq7IBDyPdbeKhOaKE5OxpVhDxvHsnrC7HrJEJbtmO-3jF0Yeda5BoR_IBQ3UQgAA; esctx=PAQABBwEAAABVrSpeuWamRam2jAF1XRQEUhz-aQHRS3veTs7MTx8am_WylJNIRBA_k6AbCMjoptUvTbxAWNqkKZfDzG7w3Osf4zQWutaalxwBXpnEhVDFbioRNDotWLbHmn4wEV3ejz5HOEnoGxXSDTl_9wNRH5iC6aAzQPF8MIr9KxgsNcuMArbkA-Uvncfotw1xbSsz0UwgAA; es
Source: global traffic	HTTP traffic detected: GET /aadcdn.msftauth.net/~/shared/1.0/content/images/marching_ants_b540a8e518037192e32c4fe58bf2dbab.gif HTTP/1.1Host: neolect.caConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://neolect.ca/?m0nid4uex=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvdjIuMC9hdXRob3JpemU/Y2xpZW50X2lkPTQ3NjU0NDViLTMyYzYtNDliMC04M2U2LTFkOTM3NjUyNzZjYSZyZWRpcmVjdF91cmk9aHR0cHMlM0ElMkYlMkZ3d3cub2ZmaWNlLmNvbSUyRmxhbmRpbmd2MiZyZXNwb25zZV90eXBlPWNvZGUlMjBpZF90b2tlbiZzY29wZT1vcGVuaWQlMjBwcm9maWxlJTIwaHR0cHMlM0ElMkYlMkZ3d3cub2ZmaWNlLmNvbSUyRnYyJTJGT2ZmaWNlSG9tZS5BbGwmcmVzcG9uc2VfbW9kZT1mb3JtX3Bvc3Qmbm9uY2U9NjM4ODAzMzU4OTIyNjQyNjk5Lk1tRXhZMlV5WVRFdE1UWXhZaTAwTVRVM0xUaGhPV1l0TVRSbE9ETTVZak13TVRNek4yTTVOVFk1WTJRdFl6WmtZaTAwWm1VekxXRmxZell0WW1Wa01EZGtOMlJpWXpnNCZ1aV9sb2NhbGVzPWVuLVVTJm1rdD1lbi1VUyZjbGllbnQtcmVxdWVzdC1pZD0zNGI0YmNhMS02MDgyLTQ0Y2YtOTVmMC0xYmE1NWJlYzhjYmQmc3RhdGU9Uk82TTN0Yk5VdC15Mk9FSlNMWU5aUTZ0dnZfckhremdmXy00aFZkWmZYU1hGVzBVQ3NITXhMWXhhdy1FajNWTHdDYTdaSlM2Ynp5M2NDWktxNkMzMW8xYndfNlpMNThQTFBfNUc2MVI0dEpSb0hlS21Bbnd0UU5KejNtWWtNYzR3a0Qyd203UXBSXzc4OEw4Y0VHV0c4WV9CQzdvaW1hRktYdnpIYzFkSjFyWkVSS0VKckdMZHg4aHpZLWJtT0otU04xT05OM1h0Y2FoU1dYVzQ1ZkNfTFJxam5NdWJaRWxiQTRsMEFHUjg2VjRHbzkxSDBTNGF5TXhHUFQ1SnlCOVczbk1XUDgySVVKTjVLMUwyd0tOUFEmeC1jbGllbnQtU0tVPUlEX05FVDhfMCZ4LWNsaWVudC12ZXI9OC41LjAuMA==&sso_reload=trueAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: qPdM=loKzyZIHgFNa; qPdM.sig=4xg-PpXrk3EZTMxwfoQqDMfUtFM; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; OH.FLID=f5ff9bcc-2ea3-49aa-99e3-cae22396c400; .AspNetCore.OpenIdConnect.Nonce.yJMPUqQzsW1e_Da5eMLwXhcEOQSJDKhhDZ2UVirgFTe-sGKnMMhATbWRmkwA5BXpct1dAEb14ZvzxWxyLNngLp_yDmM8ckHENZRMZoLUfucu6phX0sQ7fxVLEyEAGHAllftuga1fbe1jHFg-xq7B2304UhWXkbNRmHruOsog-bjTXFOFhdUAFqMNoZPduL_sOrK9udYZGgotzN5dL1UQrSoMuMWZP48ZqZAT5J0LA_cnWVbcFiUljNLD2F5ZHH47=N; .AspNetCore.Correlation.TZACjB_Pi15j9c5LC64w_wuyEgrjBlpTk3meYY-eGj4=N; esctx-zZcGchvs7j4=AQABCQEAAABVrSpeuWamRam2jAF1XRQEFJ3-2FzLZDd82mXUaIUqeFTbfqlZWBR2zBWAVDbF2SBjsHBUGqj237jAZwe6Kg_HXWEaykonXnJJGx3MpSUeZ30G8KdPqPtDB4YQaFzd5oLj6SASR3MaWNFBpVvs6qgtHKZo-uohu0Pp4XeXulu5SiAA; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=1.AQgAMe_N-B6jSkuT5F9XHpElWltEZUfGMrBJg-Ydk3ZSdsoBAAAIAA.AQABGgEAAABVrSpeuWamRam2jAF1XRQE_j6ILJnZR0w-ZLdLWytZiU2MovtejU7rKKbOaAVH6OWaIFpq7IBDyPdbeKhOaKE5OxpVhDxvHsnrC7HrJEJbtmO-3jF0Yeda5BoR_IBQ3UQgAA; esctx=PAQABBwEAAABVrSpeuWamRam2jAF1XRQEUhz-aQHRS3veTs7MTx8am_WylJNIRBA_k6AbCMjoptUvTbxAWNqkKZfDzG7w3Osf4zQWutaalxwBXpnEhVDFbioRNDotWLbHmn4wEV3ejz5HOEnoGxXSDTl_9wNRH5iC6aAzQPF8MIr9KxgsNcuMArbkA-Uvncfotw1xbSsz0UwgAA; esctx-tb
Source: global traffic	HTTP traffic detected: GET /aadcdn.msauth.net/~/shared/1.0/content/js/asyncchunk/convergedlogin_pfetchsessionsprogress_ae573f441ee1cf781ec7.js HTTP/1.1Host: neolect.caConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://neolect.ca/?m0nid4uex=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvdjIuMC9hdXRob3JpemU/Y2xpZW50X2lkPTQ3NjU0NDViLTMyYzYtNDliMC04M2U2LTFkOTM3NjUyNzZjYSZyZWRpcmVjdF91cmk9aHR0cHMlM0ElMkYlMkZ3d3cub2ZmaWNlLmNvbSUyRmxhbmRpbmd2MiZyZXNwb25zZV90eXBlPWNvZGUlMjBpZF90b2tlbiZzY29wZT1vcGVuaWQlMjBwcm9maWxlJTIwaHR0cHMlM0ElMkYlMkZ3d3cub2ZmaWNlLmNvbSUyRnYyJTJGT2ZmaWNlSG9tZS5BbGwmcmVzcG9uc2VfbW9kZT1mb3JtX3Bvc3Qmbm9uY2U9NjM4ODAzMzU4OTIyNjQyNjk5Lk1tRXhZMlV5WVRFdE1UWXhZaTAwTVRVM0xUaGhPV1l0TVRSbE9ETTVZak13TVRNek4yTTVOVFk1WTJRdFl6WmtZaTAwWm1VekxXRmxZell0WW1Wa01EZGtOMlJpWXpnNCZ1aV9sb2NhbGVzPWVuLVVTJm1rdD1lbi1VUyZjbGllbnQtcmVxdWVzdC1pZD0zNGI0YmNhMS02MDgyLTQ0Y2YtOTVmMC0xYmE1NWJlYzhjYmQmc3RhdGU9Uk82TTN0Yk5VdC15Mk9FSlNMWU5aUTZ0dnZfckhremdmXy00aFZkWmZYU1hGVzBVQ3NITXhMWXhhdy1FajNWTHdDYTdaSlM2Ynp5M2NDWktxNkMzMW8xYndfNlpMNThQTFBfNUc2MVI0dEpSb0hlS21Bbnd0UU5KejNtWWtNYzR3a0Qyd203UXBSXzc4OEw4Y0VHV0c4WV9CQzdvaW1hRktYdnpIYzFkSjFyWkVSS0VKckdMZHg4aHpZLWJtT0otU04xT05OM1h0Y2FoU1dYVzQ1ZkNfTFJxam5NdWJaRWxiQTRsMEFHUjg2VjRHbzkxSDBTNGF5TXhHUFQ1SnlCOVczbk1XUDgySVVKTjVLMUwyd0tOUFEmeC1jbGllbnQtU0tVPUlEX05FVDhfMCZ4LWNsaWVudC12ZXI9OC41LjAuMA==&sso_reload=trueAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: qPdM=loKzyZIHgFNa; qPdM.sig=4xg-PpXrk3EZTMxwfoQqDMfUtFM; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; OH.FLID=f5ff9bcc-2ea3-49aa-99e3-cae22396c400; .AspNetCore.OpenIdConnect.Nonce.yJMPUqQzsW1e_Da5eMLwXhcEOQSJDKhhDZ2UVirgFTe-sGKnMMhATbWRmkwA5BXpct1dAEb14ZvzxWxyLNngLp_yDmM8ckHENZRMZoLUfucu6phX0sQ7fxVLEyEAGHAllftuga1fbe1jHFg-xq7B2304UhWXkbNRmHruOsog-bjTXFOFhdUAFqMNoZPduL_sOrK9udYZGgotzN5dL1UQrSoMuMWZP48ZqZAT5J0LA_cnWVbcFiUljNLD2F5ZHH47=N; .AspNetCore.Correlation.TZACjB_Pi15j9c5LC64w_wuyEgrjBlpTk3meYY-eGj4=N; esctx-zZcGchvs7j4=AQABCQEAAABVrSpeuWamRam2jAF1XRQEFJ3-2FzLZDd82mXUaIUqeFTbfqlZWBR2zBWAVDbF2SBjsHBUGqj237jAZwe6Kg_HXWEaykonXnJJGx3MpSUeZ30G8KdPqPtDB4YQaFzd5oLj6SASR3MaWNFBpVvs6qgtHKZo-uohu0Pp4XeXulu5SiAA; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=1.AQgAMe_N-B6jSkuT5F9XHpElWltEZUfGMrBJg-Ydk3ZSdsoBAAAIAA.AQABGgEAAABVrSpeuWamRam2jAF1XRQE_j6ILJnZR0w-ZLdLWytZiU2MovtejU7rKKbOaAVH6OWaIFpq7IBDyPdbeKhOaKE5OxpVhDxvHsnrC7HrJEJbtmO-3jF0Yeda5BoR_IBQ3UQgAA; esctx=PAQABBwEAAABVrSpeuWamRam2jAF1XRQEUhz-aQHRS3veTs7MTx8am_WylJNIRBA_k6AbCMjoptUvTbxAWNqkKZfDzG7w3Osf4zQWutaalxwBXpnEhVDFbioRNDotWLbHmn4wEV3ejz5HOEnoGxXSDTl_9wNRH5iC6aAzQPF8MIr9KxgsNcuMArbkA-Uvncfotw1xbSsz0UwgAA; esctx-tb3uZcqbplY=AQABCQEAAABVrSpeuWamRam2jAF1XRQE-V
Source: global traffic	HTTP traffic detected: GET /aadcdn.msftauth.net/~/shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico HTTP/1.1Host: neolect.caConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: qPdM=loKzyZIHgFNa; qPdM.sig=4xg-PpXrk3EZTMxwfoQqDMfUtFM; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; OH.FLID=f5ff9bcc-2ea3-49aa-99e3-cae22396c400; .AspNetCore.OpenIdConnect.Nonce.yJMPUqQzsW1e_Da5eMLwXhcEOQSJDKhhDZ2UVirgFTe-sGKnMMhATbWRmkwA5BXpct1dAEb14ZvzxWxyLNngLp_yDmM8ckHENZRMZoLUfucu6phX0sQ7fxVLEyEAGHAllftuga1fbe1jHFg-xq7B2304UhWXkbNRmHruOsog-bjTXFOFhdUAFqMNoZPduL_sOrK9udYZGgotzN5dL1UQrSoMuMWZP48ZqZAT5J0LA_cnWVbcFiUljNLD2F5ZHH47=N; .AspNetCore.Correlation.TZACjB_Pi15j9c5LC64w_wuyEgrjBlpTk3meYY-eGj4=N; esctx-zZcGchvs7j4=AQABCQEAAABVrSpeuWamRam2jAF1XRQEFJ3-2FzLZDd82mXUaIUqeFTbfqlZWBR2zBWAVDbF2SBjsHBUGqj237jAZwe6Kg_HXWEaykonXnJJGx3MpSUeZ30G8KdPqPtDB4YQaFzd5oLj6SASR3MaWNFBpVvs6qgtHKZo-uohu0Pp4XeXulu5SiAA; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=1.AQgAMe_N-B6jSkuT5F9XHpElWltEZUfGMrBJg-Ydk3ZSdsoBAAAIAA.AQABGgEAAABVrSpeuWamRam2jAF1XRQE_j6ILJnZR0w-ZLdLWytZiU2MovtejU7rKKbOaAVH6OWaIFpq7IBDyPdbeKhOaKE5OxpVhDxvHsnrC7HrJEJbtmO-3jF0Yeda5BoR_IBQ3UQgAA; esctx=PAQABBwEAAABVrSpeuWamRam2jAF1XRQEUhz-aQHRS3veTs7MTx8am_WylJNIRBA_k6AbCMjoptUvTbxAWNqkKZfDzG7w3Osf4zQWutaalxwBXpnEhVDFbioRNDotWLbHmn4wEV3ejz5HOEnoGxXSDTl_9wNRH5iC6aAzQPF8MIr9KxgsNcuMArbkA-Uvncfotw1xbSsz0UwgAA; esctx-tb3uZcqbplY=AQABCQEAAABVrSpeuWamRam2jAF1XRQE-Vt3NsuK3Pkx0ID0oXZU1IUF_8XyjOXzGrzk7jmcJ3QF0vt0L8aa04J45O2QE9WdlUP4kViYgCiN8pdCPsnI7pCpB2BJwxKyVi71nCKdMIcF9eODIt-hDjLi7xnTUSe34gX4k1qHROuEcsz5r5_1WyAA; fpc=ApRUrsrnLe5AqKy55nDm2T28Ae7AAQAAABaSkN8OAAAA; ak_bmsc=ED87B0ED8639908A1AB169ECD0739377~000000000000000000000000000000~YAAQ7RghF4w+gSOWAQAABduNOhttp/tP0jyVyBtAde6Ks54NX3JoXhdCHsBfuLhMCXT7dVdSFVIgMMRNFAmtxG07eOC2pARyJ1oVwsGrDW8HW/lG5+Lciq6+0RrWxdNStW+6igroTgz7DUlF7voX9wUX31ozNn8vfi9b5vDFiQc+9m/fnMfbQeXsbeBSdY/aV+FJlQRhnD890K2VFYds9rssedX4CZLDXXpnPnkgrtF13ThQl6zN46KGltC5mdcqj8RVSgSO43jFuPa/Bh8Uq55nAALZiFIoCFw/OZvS061UU2v2wMPviMMQEJvHw0UGUWqVi+O60PBsGv169TK4Xw2zYz3ysS/acuxF7MIe; brcap=0
Source: global traffic	HTTP traffic detected: GET /aadcdn.msftauth.net/~/shared/1.0/content/images/microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg HTTP/1.1Host: neolect.caConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://neolect.ca/?m0nid4uex=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvdjIuMC9hdXRob3JpemU/Y2xpZW50X2lkPTQ3NjU0NDViLTMyYzYtNDliMC04M2U2LTFkOTM3NjUyNzZjYSZyZWRpcmVjdF91cmk9aHR0cHMlM0ElMkYlMkZ3d3cub2ZmaWNlLmNvbSUyRmxhbmRpbmd2MiZyZXNwb25zZV90eXBlPWNvZGUlMjBpZF90b2tlbiZzY29wZT1vcGVuaWQlMjBwcm9maWxlJTIwaHR0cHMlM0ElMkYlMkZ3d3cub2ZmaWNlLmNvbSUyRnYyJTJGT2ZmaWNlSG9tZS5BbGwmcmVzcG9uc2VfbW9kZT1mb3JtX3Bvc3Qmbm9uY2U9NjM4ODAzMzU4OTIyNjQyNjk5Lk1tRXhZMlV5WVRFdE1UWXhZaTAwTVRVM0xUaGhPV1l0TVRSbE9ETTVZak13TVRNek4yTTVOVFk1WTJRdFl6WmtZaTAwWm1VekxXRmxZell0WW1Wa01EZGtOMlJpWXpnNCZ1aV9sb2NhbGVzPWVuLVVTJm1rdD1lbi1VUyZjbGllbnQtcmVxdWVzdC1pZD0zNGI0YmNhMS02MDgyLTQ0Y2YtOTVmMC0xYmE1NWJlYzhjYmQmc3RhdGU9Uk82TTN0Yk5VdC15Mk9FSlNMWU5aUTZ0dnZfckhremdmXy00aFZkWmZYU1hGVzBVQ3NITXhMWXhhdy1FajNWTHdDYTdaSlM2Ynp5M2NDWktxNkMzMW8xYndfNlpMNThQTFBfNUc2MVI0dEpSb0hlS21Bbnd0UU5KejNtWWtNYzR3a0Qyd203UXBSXzc4OEw4Y0VHV0c4WV9CQzdvaW1hRktYdnpIYzFkSjFyWkVSS0VKckdMZHg4aHpZLWJtT0otU04xT05OM1h0Y2FoU1dYVzQ1ZkNfTFJxam5NdWJaRWxiQTRsMEFHUjg2VjRHbzkxSDBTNGF5TXhHUFQ1SnlCOVczbk1XUDgySVVKTjVLMUwyd0tOUFEmeC1jbGllbnQtU0tVPUlEX05FVDhfMCZ4LWNsaWVudC12ZXI9OC41LjAuMA==&sso_reload=trueAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: qPdM=loKzyZIHgFNa; qPdM.sig=4xg-PpXrk3EZTMxwfoQqDMfUtFM; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; OH.FLID=f5ff9bcc-2ea3-49aa-99e3-cae22396c400; .AspNetCore.OpenIdConnect.Nonce.yJMPUqQzsW1e_Da5eMLwXhcEOQSJDKhhDZ2UVirgFTe-sGKnMMhATbWRmkwA5BXpct1dAEb14ZvzxWxyLNngLp_yDmM8ckHENZRMZoLUfucu6phX0sQ7fxVLEyEAGHAllftuga1fbe1jHFg-xq7B2304UhWXkbNRmHruOsog-bjTXFOFhdUAFqMNoZPduL_sOrK9udYZGgotzN5dL1UQrSoMuMWZP48ZqZAT5J0LA_cnWVbcFiUljNLD2F5ZHH47=N; .AspNetCore.Correlation.TZACjB_Pi15j9c5LC64w_wuyEgrjBlpTk3meYY-eGj4=N; esctx-zZcGchvs7j4=AQABCQEAAABVrSpeuWamRam2jAF1XRQEFJ3-2FzLZDd82mXUaIUqeFTbfqlZWBR2zBWAVDbF2SBjsHBUGqj237jAZwe6Kg_HXWEaykonXnJJGx3MpSUeZ30G8KdPqPtDB4YQaFzd5oLj6SASR3MaWNFBpVvs6qgtHKZo-uohu0Pp4XeXulu5SiAA; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=1.AQgAMe_N-B6jSkuT5F9XHpElWltEZUfGMrBJg-Ydk3ZSdsoBAAAIAA.AQABGgEAAABVrSpeuWamRam2jAF1XRQE_j6ILJnZR0w-ZLdLWytZiU2MovtejU7rKKbOaAVH6OWaIFpq7IBDyPdbeKhOaKE5OxpVhDxvHsnrC7HrJEJbtmO-3jF0Yeda5BoR_IBQ3UQgAA; esctx=PAQABBwEAAABVrSpeuWamRam2jAF1XRQEUhz-aQHRS3veTs7MTx8am_WylJNIRBA_k6AbCMjoptUvTbxAWNqkKZfDzG7w3Osf4zQWutaalxwBXpnEhVDFbioRNDotWLbHmn4wEV3ejz5HOEnoGxXSDTl_9wNRH5iC6aAzQPF8MIr9KxgsNcuMArbkA-Uvncfotw1xbSsz0UwgAA; esctx-t
Source: global traffic	HTTP traffic detected: GET /aadcdn.msftauth.net/~/shared/1.0/content/js/asyncchunk/convergedlogin_pcustomizationloader_80e93b9a4cb13643afca.js HTTP/1.1Host: neolect.caConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://neolect.ca/?m0nid4uex=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvdjIuMC9hdXRob3JpemU/Y2xpZW50X2lkPTQ3NjU0NDViLTMyYzYtNDliMC04M2U2LTFkOTM3NjUyNzZjYSZyZWRpcmVjdF91cmk9aHR0cHMlM0ElMkYlMkZ3d3cub2ZmaWNlLmNvbSUyRmxhbmRpbmd2MiZyZXNwb25zZV90eXBlPWNvZGUlMjBpZF90b2tlbiZzY29wZT1vcGVuaWQlMjBwcm9maWxlJTIwaHR0cHMlM0ElMkYlMkZ3d3cub2ZmaWNlLmNvbSUyRnYyJTJGT2ZmaWNlSG9tZS5BbGwmcmVzcG9uc2VfbW9kZT1mb3JtX3Bvc3Qmbm9uY2U9NjM4ODAzMzU4OTIyNjQyNjk5Lk1tRXhZMlV5WVRFdE1UWXhZaTAwTVRVM0xUaGhPV1l0TVRSbE9ETTVZak13TVRNek4yTTVOVFk1WTJRdFl6WmtZaTAwWm1VekxXRmxZell0WW1Wa01EZGtOMlJpWXpnNCZ1aV9sb2NhbGVzPWVuLVVTJm1rdD1lbi1VUyZjbGllbnQtcmVxdWVzdC1pZD0zNGI0YmNhMS02MDgyLTQ0Y2YtOTVmMC0xYmE1NWJlYzhjYmQmc3RhdGU9Uk82TTN0Yk5VdC15Mk9FSlNMWU5aUTZ0dnZfckhremdmXy00aFZkWmZYU1hGVzBVQ3NITXhMWXhhdy1FajNWTHdDYTdaSlM2Ynp5M2NDWktxNkMzMW8xYndfNlpMNThQTFBfNUc2MVI0dEpSb0hlS21Bbnd0UU5KejNtWWtNYzR3a0Qyd203UXBSXzc4OEw4Y0VHV0c4WV9CQzdvaW1hRktYdnpIYzFkSjFyWkVSS0VKckdMZHg4aHpZLWJtT0otU04xT05OM1h0Y2FoU1dYVzQ1ZkNfTFJxam5NdWJaRWxiQTRsMEFHUjg2VjRHbzkxSDBTNGF5TXhHUFQ1SnlCOVczbk1XUDgySVVKTjVLMUwyd0tOUFEmeC1jbGllbnQtU0tVPUlEX05FVDhfMCZ4LWNsaWVudC12ZXI9OC41LjAuMA==&sso_reload=trueAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: qPdM=loKzyZIHgFNa; qPdM.sig=4xg-PpXrk3EZTMxwfoQqDMfUtFM; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; OH.FLID=f5ff9bcc-2ea3-49aa-99e3-cae22396c400; .AspNetCore.OpenIdConnect.Nonce.yJMPUqQzsW1e_Da5eMLwXhcEOQSJDKhhDZ2UVirgFTe-sGKnMMhATbWRmkwA5BXpct1dAEb14ZvzxWxyLNngLp_yDmM8ckHENZRMZoLUfucu6phX0sQ7fxVLEyEAGHAllftuga1fbe1jHFg-xq7B2304UhWXkbNRmHruOsog-bjTXFOFhdUAFqMNoZPduL_sOrK9udYZGgotzN5dL1UQrSoMuMWZP48ZqZAT5J0LA_cnWVbcFiUljNLD2F5ZHH47=N; .AspNetCore.Correlation.TZACjB_Pi15j9c5LC64w_wuyEgrjBlpTk3meYY-eGj4=N; esctx-zZcGchvs7j4=AQABCQEAAABVrSpeuWamRam2jAF1XRQEFJ3-2FzLZDd82mXUaIUqeFTbfqlZWBR2zBWAVDbF2SBjsHBUGqj237jAZwe6Kg_HXWEaykonXnJJGx3MpSUeZ30G8KdPqPtDB4YQaFzd5oLj6SASR3MaWNFBpVvs6qgtHKZo-uohu0Pp4XeXulu5SiAA; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=1.AQgAMe_N-B6jSkuT5F9XHpElWltEZUfGMrBJg-Ydk3ZSdsoBAAAIAA.AQABGgEAAABVrSpeuWamRam2jAF1XRQE_j6ILJnZR0w-ZLdLWytZiU2MovtejU7rKKbOaAVH6OWaIFpq7IBDyPdbeKhOaKE5OxpVhDxvHsnrC7HrJEJbtmO-3jF0Yeda5BoR_IBQ3UQgAA; esctx=PAQABBwEAAABVrSpeuWamRam2jAF1XRQEUhz-aQHRS3veTs7MTx8am_WylJNIRBA_k6AbCMjoptUvTbxAWNqkKZfDzG7w3Osf4zQWutaalxwBXpnEhVDFbioRNDotWLbHmn4wEV3ejz5HOEnoGxXSDTl_9wNRH5iC6aAzQPF8MIr9KxgsNcuMArbkA-Uvncfotw1xbSsz0UwgAA; esctx-tb3uZcqbplY=AQABCQEAAABVrSpeuWamRam2jAF1XRQE-V
Source: global traffic	HTTP traffic detected: GET /aadcdn.msftauth.net/~/shared/1.0/content/images/backgrounds/2_bc3d32a696895f78c19df6c717586a5d.svg HTTP/1.1Host: neolect.caConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://neolect.ca/?m0nid4uex=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvdjIuMC9hdXRob3JpemU/Y2xpZW50X2lkPTQ3NjU0NDViLTMyYzYtNDliMC04M2U2LTFkOTM3NjUyNzZjYSZyZWRpcmVjdF91cmk9aHR0cHMlM0ElMkYlMkZ3d3cub2ZmaWNlLmNvbSUyRmxhbmRpbmd2MiZyZXNwb25zZV90eXBlPWNvZGUlMjBpZF90b2tlbiZzY29wZT1vcGVuaWQlMjBwcm9maWxlJTIwaHR0cHMlM0ElMkYlMkZ3d3cub2ZmaWNlLmNvbSUyRnYyJTJGT2ZmaWNlSG9tZS5BbGwmcmVzcG9uc2VfbW9kZT1mb3JtX3Bvc3Qmbm9uY2U9NjM4ODAzMzU4OTIyNjQyNjk5Lk1tRXhZMlV5WVRFdE1UWXhZaTAwTVRVM0xUaGhPV1l0TVRSbE9ETTVZak13TVRNek4yTTVOVFk1WTJRdFl6WmtZaTAwWm1VekxXRmxZell0WW1Wa01EZGtOMlJpWXpnNCZ1aV9sb2NhbGVzPWVuLVVTJm1rdD1lbi1VUyZjbGllbnQtcmVxdWVzdC1pZD0zNGI0YmNhMS02MDgyLTQ0Y2YtOTVmMC0xYmE1NWJlYzhjYmQmc3RhdGU9Uk82TTN0Yk5VdC15Mk9FSlNMWU5aUTZ0dnZfckhremdmXy00aFZkWmZYU1hGVzBVQ3NITXhMWXhhdy1FajNWTHdDYTdaSlM2Ynp5M2NDWktxNkMzMW8xYndfNlpMNThQTFBfNUc2MVI0dEpSb0hlS21Bbnd0UU5KejNtWWtNYzR3a0Qyd203UXBSXzc4OEw4Y0VHV0c4WV9CQzdvaW1hRktYdnpIYzFkSjFyWkVSS0VKckdMZHg4aHpZLWJtT0otU04xT05OM1h0Y2FoU1dYVzQ1ZkNfTFJxam5NdWJaRWxiQTRsMEFHUjg2VjRHbzkxSDBTNGF5TXhHUFQ1SnlCOVczbk1XUDgySVVKTjVLMUwyd0tOUFEmeC1jbGllbnQtU0tVPUlEX05FVDhfMCZ4LWNsaWVudC12ZXI9OC41LjAuMA==&sso_reload=trueAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: qPdM=loKzyZIHgFNa; qPdM.sig=4xg-PpXrk3EZTMxwfoQqDMfUtFM; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; OH.FLID=f5ff9bcc-2ea3-49aa-99e3-cae22396c400; .AspNetCore.OpenIdConnect.Nonce.yJMPUqQzsW1e_Da5eMLwXhcEOQSJDKhhDZ2UVirgFTe-sGKnMMhATbWRmkwA5BXpct1dAEb14ZvzxWxyLNngLp_yDmM8ckHENZRMZoLUfucu6phX0sQ7fxVLEyEAGHAllftuga1fbe1jHFg-xq7B2304UhWXkbNRmHruOsog-bjTXFOFhdUAFqMNoZPduL_sOrK9udYZGgotzN5dL1UQrSoMuMWZP48ZqZAT5J0LA_cnWVbcFiUljNLD2F5ZHH47=N; .AspNetCore.Correlation.TZACjB_Pi15j9c5LC64w_wuyEgrjBlpTk3meYY-eGj4=N; esctx-zZcGchvs7j4=AQABCQEAAABVrSpeuWamRam2jAF1XRQEFJ3-2FzLZDd82mXUaIUqeFTbfqlZWBR2zBWAVDbF2SBjsHBUGqj237jAZwe6Kg_HXWEaykonXnJJGx3MpSUeZ30G8KdPqPtDB4YQaFzd5oLj6SASR3MaWNFBpVvs6qgtHKZo-uohu0Pp4XeXulu5SiAA; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=1.AQgAMe_N-B6jSkuT5F9XHpElWltEZUfGMrBJg-Ydk3ZSdsoBAAAIAA.AQABGgEAAABVrSpeuWamRam2jAF1XRQE_j6ILJnZR0w-ZLdLWytZiU2MovtejU7rKKbOaAVH6OWaIFpq7IBDyPdbeKhOaKE5OxpVhDxvHsnrC7HrJEJbtmO-3jF0Yeda5BoR_IBQ3UQgAA; esctx=PAQABBwEAAABVrSpeuWamRam2jAF1XRQEUhz-aQHRS3veTs7MTx8am_WylJNIRBA_k6AbCMjoptUvTbxAWNqkKZfDzG7w3Osf4zQWutaalxwBXpnEhVDFbioRNDotWLbHmn4wEV3ejz5HOEnoGxXSDTl_9wNRH5iC6aAzQPF8MIr9KxgsNcuMArbkA-Uvncfotw1xbSsz0UwgAA; esctx-tb
Source: global traffic	HTTP traffic detected: GET /aadcdn.msftauth.net/~/shared/1.0/content/images/microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg HTTP/1.1Host: neolect.caConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: qPdM=loKzyZIHgFNa; qPdM.sig=4xg-PpXrk3EZTMxwfoQqDMfUtFM; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; OH.FLID=f5ff9bcc-2ea3-49aa-99e3-cae22396c400; .AspNetCore.OpenIdConnect.Nonce.yJMPUqQzsW1e_Da5eMLwXhcEOQSJDKhhDZ2UVirgFTe-sGKnMMhATbWRmkwA5BXpct1dAEb14ZvzxWxyLNngLp_yDmM8ckHENZRMZoLUfucu6phX0sQ7fxVLEyEAGHAllftuga1fbe1jHFg-xq7B2304UhWXkbNRmHruOsog-bjTXFOFhdUAFqMNoZPduL_sOrK9udYZGgotzN5dL1UQrSoMuMWZP48ZqZAT5J0LA_cnWVbcFiUljNLD2F5ZHH47=N; .AspNetCore.Correlation.TZACjB_Pi15j9c5LC64w_wuyEgrjBlpTk3meYY-eGj4=N; esctx-zZcGchvs7j4=AQABCQEAAABVrSpeuWamRam2jAF1XRQEFJ3-2FzLZDd82mXUaIUqeFTbfqlZWBR2zBWAVDbF2SBjsHBUGqj237jAZwe6Kg_HXWEaykonXnJJGx3MpSUeZ30G8KdPqPtDB4YQaFzd5oLj6SASR3MaWNFBpVvs6qgtHKZo-uohu0Pp4XeXulu5SiAA; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=1.AQgAMe_N-B6jSkuT5F9XHpElWltEZUfGMrBJg-Ydk3ZSdsoBAAAIAA.AQABGgEAAABVrSpeuWamRam2jAF1XRQE_j6ILJnZR0w-ZLdLWytZiU2MovtejU7rKKbOaAVH6OWaIFpq7IBDyPdbeKhOaKE5OxpVhDxvHsnrC7HrJEJbtmO-3jF0Yeda5BoR_IBQ3UQgAA; esctx=PAQABBwEAAABVrSpeuWamRam2jAF1XRQEUhz-aQHRS3veTs7MTx8am_WylJNIRBA_k6AbCMjoptUvTbxAWNqkKZfDzG7w3Osf4zQWutaalxwBXpnEhVDFbioRNDotWLbHmn4wEV3ejz5HOEnoGxXSDTl_9wNRH5iC6aAzQPF8MIr9KxgsNcuMArbkA-Uvncfotw1xbSsz0UwgAA; esctx-tb3uZcqbplY=AQABCQEAAABVrSpeuWamRam2jAF1XRQE-Vt3NsuK3Pkx0ID0oXZU1IUF_8XyjOXzGrzk7jmcJ3QF0vt0L8aa04J45O2QE9WdlUP4kViYgCiN8pdCPsnI7pCpB2BJwxKyVi71nCKdMIcF9eODIt-hDjLi7xnTUSe34gX4k1qHROuEcsz5r5_1WyAA; fpc=ApRUrsrnLe5AqKy55nDm2T28Ae7AAQAAABaSkN8OAAAA; ak_bmsc=ED87B0ED8639908A1AB169ECD0739377~000000000000000000000000000000~YAAQ7RghF4w+gSOWAQAABduNOhttp/tP0jyVyBtAde6Ks54NX3JoXhdCHsBfuLhMCXT7dVdSFVIgMMRNFAmtxG07eOC2pARyJ1oVwsGrDW8HW/lG5+Lciq6+0RrWxdNStW+6igroTgz7DUlF7voX9wUX31ozNn8vfi9b5vDFiQc+9m/fnMfbQeXsbeBSdY/aV+FJlQRhnD890K2VFYds9rssedX4CZLDXXpnPnkgrtF13ThQl6zN46KGltC5mdcqj8RVSgSO43jFuPa/Bh8Uq55nAALZiFIoCFw/OZvS061UU2v2wMPviMMQEJvHw0UGUWqVi+O60PBsGv169TK4Xw2zYz3ysS/acuxF7MIe; brcap=0
Source: global traffic	HTTP traffic detected: GET /aadcdn.msftauth.net/~/shared/1.0/content/images/marching_ants_white_166de53471265253ab3a456defe6da23.gif HTTP/1.1Host: neolect.caConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://neolect.ca/?m0nid4uex=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvdjIuMC9hdXRob3JpemU/Y2xpZW50X2lkPTQ3NjU0NDViLTMyYzYtNDliMC04M2U2LTFkOTM3NjUyNzZjYSZyZWRpcmVjdF91cmk9aHR0cHMlM0ElMkYlMkZ3d3cub2ZmaWNlLmNvbSUyRmxhbmRpbmd2MiZyZXNwb25zZV90eXBlPWNvZGUlMjBpZF90b2tlbiZzY29wZT1vcGVuaWQlMjBwcm9maWxlJTIwaHR0cHMlM0ElMkYlMkZ3d3cub2ZmaWNlLmNvbSUyRnYyJTJGT2ZmaWNlSG9tZS5BbGwmcmVzcG9uc2VfbW9kZT1mb3JtX3Bvc3Qmbm9uY2U9NjM4ODAzMzU4OTIyNjQyNjk5Lk1tRXhZMlV5WVRFdE1UWXhZaTAwTVRVM0xUaGhPV1l0TVRSbE9ETTVZak13TVRNek4yTTVOVFk1WTJRdFl6WmtZaTAwWm1VekxXRmxZell0WW1Wa01EZGtOMlJpWXpnNCZ1aV9sb2NhbGVzPWVuLVVTJm1rdD1lbi1VUyZjbGllbnQtcmVxdWVzdC1pZD0zNGI0YmNhMS02MDgyLTQ0Y2YtOTVmMC0xYmE1NWJlYzhjYmQmc3RhdGU9Uk82TTN0Yk5VdC15Mk9FSlNMWU5aUTZ0dnZfckhremdmXy00aFZkWmZYU1hGVzBVQ3NITXhMWXhhdy1FajNWTHdDYTdaSlM2Ynp5M2NDWktxNkMzMW8xYndfNlpMNThQTFBfNUc2MVI0dEpSb0hlS21Bbnd0UU5KejNtWWtNYzR3a0Qyd203UXBSXzc4OEw4Y0VHV0c4WV9CQzdvaW1hRktYdnpIYzFkSjFyWkVSS0VKckdMZHg4aHpZLWJtT0otU04xT05OM1h0Y2FoU1dYVzQ1ZkNfTFJxam5NdWJaRWxiQTRsMEFHUjg2VjRHbzkxSDBTNGF5TXhHUFQ1SnlCOVczbk1XUDgySVVKTjVLMUwyd0tOUFEmeC1jbGllbnQtU0tVPUlEX05FVDhfMCZ4LWNsaWVudC12ZXI9OC41LjAuMA==&sso_reload=trueAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: qPdM=loKzyZIHgFNa; qPdM.sig=4xg-PpXrk3EZTMxwfoQqDMfUtFM; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; OH.FLID=f5ff9bcc-2ea3-49aa-99e3-cae22396c400; .AspNetCore.OpenIdConnect.Nonce.yJMPUqQzsW1e_Da5eMLwXhcEOQSJDKhhDZ2UVirgFTe-sGKnMMhATbWRmkwA5BXpct1dAEb14ZvzxWxyLNngLp_yDmM8ckHENZRMZoLUfucu6phX0sQ7fxVLEyEAGHAllftuga1fbe1jHFg-xq7B2304UhWXkbNRmHruOsog-bjTXFOFhdUAFqMNoZPduL_sOrK9udYZGgotzN5dL1UQrSoMuMWZP48ZqZAT5J0LA_cnWVbcFiUljNLD2F5ZHH47=N; .AspNetCore.Correlation.TZACjB_Pi15j9c5LC64w_wuyEgrjBlpTk3meYY-eGj4=N; esctx-zZcGchvs7j4=AQABCQEAAABVrSpeuWamRam2jAF1XRQEFJ3-2FzLZDd82mXUaIUqeFTbfqlZWBR2zBWAVDbF2SBjsHBUGqj237jAZwe6Kg_HXWEaykonXnJJGx3MpSUeZ30G8KdPqPtDB4YQaFzd5oLj6SASR3MaWNFBpVvs6qgtHKZo-uohu0Pp4XeXulu5SiAA; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=1.AQgAMe_N-B6jSkuT5F9XHpElWltEZUfGMrBJg-Ydk3ZSdsoBAAAIAA.AQABGgEAAABVrSpeuWamRam2jAF1XRQE_j6ILJnZR0w-ZLdLWytZiU2MovtejU7rKKbOaAVH6OWaIFpq7IBDyPdbeKhOaKE5OxpVhDxvHsnrC7HrJEJbtmO-3jF0Yeda5BoR_IBQ3UQgAA; esctx=PAQABBwEAAABVrSpeuWamRam2jAF1XRQEUhz-aQHRS3veTs7MTx8am_WylJNIRBA_k6AbCMjoptUvTbxAWNqkKZfDzG7w3Osf4zQWutaalxwBXpnEhVDFbioRNDotWLbHmn4wEV3ejz5HOEnoGxXSDTl_9wNRH5iC6aAzQPF8MIr9KxgsNcuMArbkA-Uvncfotw1xbSsz0UwgAA; es
Source: global traffic	HTTP traffic detected: GET /aadcdn.msftauth.net/~/shared/1.0/content/images/backgrounds/2_bc3d32a696895f78c19df6c717586a5d.svg HTTP/1.1Host: neolect.caConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: qPdM=loKzyZIHgFNa; qPdM.sig=4xg-PpXrk3EZTMxwfoQqDMfUtFM; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; OH.FLID=f5ff9bcc-2ea3-49aa-99e3-cae22396c400; .AspNetCore.OpenIdConnect.Nonce.yJMPUqQzsW1e_Da5eMLwXhcEOQSJDKhhDZ2UVirgFTe-sGKnMMhATbWRmkwA5BXpct1dAEb14ZvzxWxyLNngLp_yDmM8ckHENZRMZoLUfucu6phX0sQ7fxVLEyEAGHAllftuga1fbe1jHFg-xq7B2304UhWXkbNRmHruOsog-bjTXFOFhdUAFqMNoZPduL_sOrK9udYZGgotzN5dL1UQrSoMuMWZP48ZqZAT5J0LA_cnWVbcFiUljNLD2F5ZHH47=N; .AspNetCore.Correlation.TZACjB_Pi15j9c5LC64w_wuyEgrjBlpTk3meYY-eGj4=N; esctx-zZcGchvs7j4=AQABCQEAAABVrSpeuWamRam2jAF1XRQEFJ3-2FzLZDd82mXUaIUqeFTbfqlZWBR2zBWAVDbF2SBjsHBUGqj237jAZwe6Kg_HXWEaykonXnJJGx3MpSUeZ30G8KdPqPtDB4YQaFzd5oLj6SASR3MaWNFBpVvs6qgtHKZo-uohu0Pp4XeXulu5SiAA; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=1.AQgAMe_N-B6jSkuT5F9XHpElWltEZUfGMrBJg-Ydk3ZSdsoBAAAIAA.AQABGgEAAABVrSpeuWamRam2jAF1XRQE_j6ILJnZR0w-ZLdLWytZiU2MovtejU7rKKbOaAVH6OWaIFpq7IBDyPdbeKhOaKE5OxpVhDxvHsnrC7HrJEJbtmO-3jF0Yeda5BoR_IBQ3UQgAA; esctx=PAQABBwEAAABVrSpeuWamRam2jAF1XRQEUhz-aQHRS3veTs7MTx8am_WylJNIRBA_k6AbCMjoptUvTbxAWNqkKZfDzG7w3Osf4zQWutaalxwBXpnEhVDFbioRNDotWLbHmn4wEV3ejz5HOEnoGxXSDTl_9wNRH5iC6aAzQPF8MIr9KxgsNcuMArbkA-Uvncfotw1xbSsz0UwgAA; esctx-tb3uZcqbplY=AQABCQEAAABVrSpeuWamRam2jAF1XRQE-Vt3NsuK3Pkx0ID0oXZU1IUF_8XyjOXzGrzk7jmcJ3QF0vt0L8aa04J45O2QE9WdlUP4kViYgCiN8pdCPsnI7pCpB2BJwxKyVi71nCKdMIcF9eODIt-hDjLi7xnTUSe34gX4k1qHROuEcsz5r5_1WyAA; fpc=ApRUrsrnLe5AqKy55nDm2T28Ae7AAQAAABaSkN8OAAAA; ak_bmsc=ED87B0ED8639908A1AB169ECD0739377~000000000000000000000000000000~YAAQ7RghF4w+gSOWAQAABduNOhttp/tP0jyVyBtAde6Ks54NX3JoXhdCHsBfuLhMCXT7dVdSFVIgMMRNFAmtxG07eOC2pARyJ1oVwsGrDW8HW/lG5+Lciq6+0RrWxdNStW+6igroTgz7DUlF7voX9wUX31ozNn8vfi9b5vDFiQc+9m/fnMfbQeXsbeBSdY/aV+FJlQRhnD890K2VFYds9rssedX4CZLDXXpnPnkgrtF13ThQl6zN46KGltC5mdcqj8RVSgSO43jFuPa/Bh8Uq55nAALZiFIoCFw/OZvS061UU2v2wMPviMMQEJvHw0UGUWqVi+O60PBsGv169TK4Xw2zYz3ysS/acuxF7MIe; brcap=0
Source: global traffic	HTTP traffic detected: GET /aadcdn.msftauth.net/~/shared/1.0/content/images/marching_ants_b540a8e518037192e32c4fe58bf2dbab.gif HTTP/1.1Host: neolect.caConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://neolect.ca/?m0nid4uex=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvdjIuMC9hdXRob3JpemU/Y2xpZW50X2lkPTQ3NjU0NDViLTMyYzYtNDliMC04M2U2LTFkOTM3NjUyNzZjYSZyZWRpcmVjdF91cmk9aHR0cHMlM0ElMkYlMkZ3d3cub2ZmaWNlLmNvbSUyRmxhbmRpbmd2MiZyZXNwb25zZV90eXBlPWNvZGUlMjBpZF90b2tlbiZzY29wZT1vcGVuaWQlMjBwcm9maWxlJTIwaHR0cHMlM0ElMkYlMkZ3d3cub2ZmaWNlLmNvbSUyRnYyJTJGT2ZmaWNlSG9tZS5BbGwmcmVzcG9uc2VfbW9kZT1mb3JtX3Bvc3Qmbm9uY2U9NjM4ODAzMzU4OTIyNjQyNjk5Lk1tRXhZMlV5WVRFdE1UWXhZaTAwTVRVM0xUaGhPV1l0TVRSbE9ETTVZak13TVRNek4yTTVOVFk1WTJRdFl6WmtZaTAwWm1VekxXRmxZell0WW1Wa01EZGtOMlJpWXpnNCZ1aV9sb2NhbGVzPWVuLVVTJm1rdD1lbi1VUyZjbGllbnQtcmVxdWVzdC1pZD0zNGI0YmNhMS02MDgyLTQ0Y2YtOTVmMC0xYmE1NWJlYzhjYmQmc3RhdGU9Uk82TTN0Yk5VdC15Mk9FSlNMWU5aUTZ0dnZfckhremdmXy00aFZkWmZYU1hGVzBVQ3NITXhMWXhhdy1FajNWTHdDYTdaSlM2Ynp5M2NDWktxNkMzMW8xYndfNlpMNThQTFBfNUc2MVI0dEpSb0hlS21Bbnd0UU5KejNtWWtNYzR3a0Qyd203UXBSXzc4OEw4Y0VHV0c4WV9CQzdvaW1hRktYdnpIYzFkSjFyWkVSS0VKckdMZHg4aHpZLWJtT0otU04xT05OM1h0Y2FoU1dYVzQ1ZkNfTFJxam5NdWJaRWxiQTRsMEFHUjg2VjRHbzkxSDBTNGF5TXhHUFQ1SnlCOVczbk1XUDgySVVKTjVLMUwyd0tOUFEmeC1jbGllbnQtU0tVPUlEX05FVDhfMCZ4LWNsaWVudC12ZXI9OC41LjAuMA==&sso_reload=trueAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: qPdM=loKzyZIHgFNa; qPdM.sig=4xg-PpXrk3EZTMxwfoQqDMfUtFM; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; OH.FLID=f5ff9bcc-2ea3-49aa-99e3-cae22396c400; .AspNetCore.OpenIdConnect.Nonce.yJMPUqQzsW1e_Da5eMLwXhcEOQSJDKhhDZ2UVirgFTe-sGKnMMhATbWRmkwA5BXpct1dAEb14ZvzxWxyLNngLp_yDmM8ckHENZRMZoLUfucu6phX0sQ7fxVLEyEAGHAllftuga1fbe1jHFg-xq7B2304UhWXkbNRmHruOsog-bjTXFOFhdUAFqMNoZPduL_sOrK9udYZGgotzN5dL1UQrSoMuMWZP48ZqZAT5J0LA_cnWVbcFiUljNLD2F5ZHH47=N; .AspNetCore.Correlation.TZACjB_Pi15j9c5LC64w_wuyEgrjBlpTk3meYY-eGj4=N; esctx-zZcGchvs7j4=AQABCQEAAABVrSpeuWamRam2jAF1XRQEFJ3-2FzLZDd82mXUaIUqeFTbfqlZWBR2zBWAVDbF2SBjsHBUGqj237jAZwe6Kg_HXWEaykonXnJJGx3MpSUeZ30G8KdPqPtDB4YQaFzd5oLj6SASR3MaWNFBpVvs6qgtHKZo-uohu0Pp4XeXulu5SiAA; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=1.AQgAMe_N-B6jSkuT5F9XHpElWltEZUfGMrBJg-Ydk3ZSdsoBAAAIAA.AQABGgEAAABVrSpeuWamRam2jAF1XRQE_j6ILJnZR0w-ZLdLWytZiU2MovtejU7rKKbOaAVH6OWaIFpq7IBDyPdbeKhOaKE5OxpVhDxvHsnrC7HrJEJbtmO-3jF0Yeda5BoR_IBQ3UQgAA; esctx=PAQABBwEAAABVrSpeuWamRam2jAF1XRQEUhz-aQHRS3veTs7MTx8am_WylJNIRBA_k6AbCMjoptUvTbxAWNqkKZfDzG7w3Osf4zQWutaalxwBXpnEhVDFbioRNDotWLbHmn4wEV3ejz5HOEnoGxXSDTl_9wNRH5iC6aAzQPF8MIr9KxgsNcuMArbkA-Uvncfotw1xbSsz0UwgAA; esctx-tb
Source: global traffic	HTTP traffic detected: GET /aadcdn.msauth.net/~/shared/1.0/content/js/asyncchunk/convergedlogin_pcustomizationloader_80e93b9a4cb13643afca.js HTTP/1.1Host: neolect.caConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://neolect.ca/?m0nid4uex=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvdjIuMC9hdXRob3JpemU/Y2xpZW50X2lkPTQ3NjU0NDViLTMyYzYtNDliMC04M2U2LTFkOTM3NjUyNzZjYSZyZWRpcmVjdF91cmk9aHR0cHMlM0ElMkYlMkZ3d3cub2ZmaWNlLmNvbSUyRmxhbmRpbmd2MiZyZXNwb25zZV90eXBlPWNvZGUlMjBpZF90b2tlbiZzY29wZT1vcGVuaWQlMjBwcm9maWxlJTIwaHR0cHMlM0ElMkYlMkZ3d3cub2ZmaWNlLmNvbSUyRnYyJTJGT2ZmaWNlSG9tZS5BbGwmcmVzcG9uc2VfbW9kZT1mb3JtX3Bvc3Qmbm9uY2U9NjM4ODAzMzU4OTIyNjQyNjk5Lk1tRXhZMlV5WVRFdE1UWXhZaTAwTVRVM0xUaGhPV1l0TVRSbE9ETTVZak13TVRNek4yTTVOVFk1WTJRdFl6WmtZaTAwWm1VekxXRmxZell0WW1Wa01EZGtOMlJpWXpnNCZ1aV9sb2NhbGVzPWVuLVVTJm1rdD1lbi1VUyZjbGllbnQtcmVxdWVzdC1pZD0zNGI0YmNhMS02MDgyLTQ0Y2YtOTVmMC0xYmE1NWJlYzhjYmQmc3RhdGU9Uk82TTN0Yk5VdC15Mk9FSlNMWU5aUTZ0dnZfckhremdmXy00aFZkWmZYU1hGVzBVQ3NITXhMWXhhdy1FajNWTHdDYTdaSlM2Ynp5M2NDWktxNkMzMW8xYndfNlpMNThQTFBfNUc2MVI0dEpSb0hlS21Bbnd0UU5KejNtWWtNYzR3a0Qyd203UXBSXzc4OEw4Y0VHV0c4WV9CQzdvaW1hRktYdnpIYzFkSjFyWkVSS0VKckdMZHg4aHpZLWJtT0otU04xT05OM1h0Y2FoU1dYVzQ1ZkNfTFJxam5NdWJaRWxiQTRsMEFHUjg2VjRHbzkxSDBTNGF5TXhHUFQ1SnlCOVczbk1XUDgySVVKTjVLMUwyd0tOUFEmeC1jbGllbnQtU0tVPUlEX05FVDhfMCZ4LWNsaWVudC12ZXI9OC41LjAuMA==&sso_reload=trueAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: qPdM=loKzyZIHgFNa; qPdM.sig=4xg-PpXrk3EZTMxwfoQqDMfUtFM; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; OH.FLID=f5ff9bcc-2ea3-49aa-99e3-cae22396c400; .AspNetCore.OpenIdConnect.Nonce.yJMPUqQzsW1e_Da5eMLwXhcEOQSJDKhhDZ2UVirgFTe-sGKnMMhATbWRmkwA5BXpct1dAEb14ZvzxWxyLNngLp_yDmM8ckHENZRMZoLUfucu6phX0sQ7fxVLEyEAGHAllftuga1fbe1jHFg-xq7B2304UhWXkbNRmHruOsog-bjTXFOFhdUAFqMNoZPduL_sOrK9udYZGgotzN5dL1UQrSoMuMWZP48ZqZAT5J0LA_cnWVbcFiUljNLD2F5ZHH47=N; .AspNetCore.Correlation.TZACjB_Pi15j9c5LC64w_wuyEgrjBlpTk3meYY-eGj4=N; esctx-zZcGchvs7j4=AQABCQEAAABVrSpeuWamRam2jAF1XRQEFJ3-2FzLZDd82mXUaIUqeFTbfqlZWBR2zBWAVDbF2SBjsHBUGqj237jAZwe6Kg_HXWEaykonXnJJGx3MpSUeZ30G8KdPqPtDB4YQaFzd5oLj6SASR3MaWNFBpVvs6qgtHKZo-uohu0Pp4XeXulu5SiAA; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=1.AQgAMe_N-B6jSkuT5F9XHpElWltEZUfGMrBJg-Ydk3ZSdsoBAAAIAA.AQABGgEAAABVrSpeuWamRam2jAF1XRQE_j6ILJnZR0w-ZLdLWytZiU2MovtejU7rKKbOaAVH6OWaIFpq7IBDyPdbeKhOaKE5OxpVhDxvHsnrC7HrJEJbtmO-3jF0Yeda5BoR_IBQ3UQgAA; esctx=PAQABBwEAAABVrSpeuWamRam2jAF1XRQEUhz-aQHRS3veTs7MTx8am_WylJNIRBA_k6AbCMjoptUvTbxAWNqkKZfDzG7w3Osf4zQWutaalxwBXpnEhVDFbioRNDotWLbHmn4wEV3ejz5HOEnoGxXSDTl_9wNRH5iC6aAzQPF8MIr9KxgsNcuMArbkA-Uvncfotw1xbSsz0UwgAA; esctx-tb3uZcqbplY=AQABCQEAAABVrSpeuWamRam2jAF1XRQE-Vt3
Source: global traffic	HTTP traffic detected: GET /aadcdn.msftauth.net/~/shared/1.0/content/images/signin-options_4e48046ce74f4b89d45037c90576bfac.svg HTTP/1.1Host: neolect.caConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://neolect.ca/?m0nid4uex=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvdjIuMC9hdXRob3JpemU/Y2xpZW50X2lkPTQ3NjU0NDViLTMyYzYtNDliMC04M2U2LTFkOTM3NjUyNzZjYSZyZWRpcmVjdF91cmk9aHR0cHMlM0ElMkYlMkZ3d3cub2ZmaWNlLmNvbSUyRmxhbmRpbmd2MiZyZXNwb25zZV90eXBlPWNvZGUlMjBpZF90b2tlbiZzY29wZT1vcGVuaWQlMjBwcm9maWxlJTIwaHR0cHMlM0ElMkYlMkZ3d3cub2ZmaWNlLmNvbSUyRnYyJTJGT2ZmaWNlSG9tZS5BbGwmcmVzcG9uc2VfbW9kZT1mb3JtX3Bvc3Qmbm9uY2U9NjM4ODAzMzU4OTIyNjQyNjk5Lk1tRXhZMlV5WVRFdE1UWXhZaTAwTVRVM0xUaGhPV1l0TVRSbE9ETTVZak13TVRNek4yTTVOVFk1WTJRdFl6WmtZaTAwWm1VekxXRmxZell0WW1Wa01EZGtOMlJpWXpnNCZ1aV9sb2NhbGVzPWVuLVVTJm1rdD1lbi1VUyZjbGllbnQtcmVxdWVzdC1pZD0zNGI0YmNhMS02MDgyLTQ0Y2YtOTVmMC0xYmE1NWJlYzhjYmQmc3RhdGU9Uk82TTN0Yk5VdC15Mk9FSlNMWU5aUTZ0dnZfckhremdmXy00aFZkWmZYU1hGVzBVQ3NITXhMWXhhdy1FajNWTHdDYTdaSlM2Ynp5M2NDWktxNkMzMW8xYndfNlpMNThQTFBfNUc2MVI0dEpSb0hlS21Bbnd0UU5KejNtWWtNYzR3a0Qyd203UXBSXzc4OEw4Y0VHV0c4WV9CQzdvaW1hRktYdnpIYzFkSjFyWkVSS0VKckdMZHg4aHpZLWJtT0otU04xT05OM1h0Y2FoU1dYVzQ1ZkNfTFJxam5NdWJaRWxiQTRsMEFHUjg2VjRHbzkxSDBTNGF5TXhHUFQ1SnlCOVczbk1XUDgySVVKTjVLMUwyd0tOUFEmeC1jbGllbnQtU0tVPUlEX05FVDhfMCZ4LWNsaWVudC12ZXI9OC41LjAuMA==&sso_reload=trueAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: qPdM=loKzyZIHgFNa; qPdM.sig=4xg-PpXrk3EZTMxwfoQqDMfUtFM; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; OH.FLID=f5ff9bcc-2ea3-49aa-99e3-cae22396c400; .AspNetCore.OpenIdConnect.Nonce.yJMPUqQzsW1e_Da5eMLwXhcEOQSJDKhhDZ2UVirgFTe-sGKnMMhATbWRmkwA5BXpct1dAEb14ZvzxWxyLNngLp_yDmM8ckHENZRMZoLUfucu6phX0sQ7fxVLEyEAGHAllftuga1fbe1jHFg-xq7B2304UhWXkbNRmHruOsog-bjTXFOFhdUAFqMNoZPduL_sOrK9udYZGgotzN5dL1UQrSoMuMWZP48ZqZAT5J0LA_cnWVbcFiUljNLD2F5ZHH47=N; .AspNetCore.Correlation.TZACjB_Pi15j9c5LC64w_wuyEgrjBlpTk3meYY-eGj4=N; esctx-zZcGchvs7j4=AQABCQEAAABVrSpeuWamRam2jAF1XRQEFJ3-2FzLZDd82mXUaIUqeFTbfqlZWBR2zBWAVDbF2SBjsHBUGqj237jAZwe6Kg_HXWEaykonXnJJGx3MpSUeZ30G8KdPqPtDB4YQaFzd5oLj6SASR3MaWNFBpVvs6qgtHKZo-uohu0Pp4XeXulu5SiAA; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=1.AQgAMe_N-B6jSkuT5F9XHpElWltEZUfGMrBJg-Ydk3ZSdsoBAAAIAA.AQABGgEAAABVrSpeuWamRam2jAF1XRQE_j6ILJnZR0w-ZLdLWytZiU2MovtejU7rKKbOaAVH6OWaIFpq7IBDyPdbeKhOaKE5OxpVhDxvHsnrC7HrJEJbtmO-3jF0Yeda5BoR_IBQ3UQgAA; esctx=PAQABBwEAAABVrSpeuWamRam2jAF1XRQEUhz-aQHRS3veTs7MTx8am_WylJNIRBA_k6AbCMjoptUvTbxAWNqkKZfDzG7w3Osf4zQWutaalxwBXpnEhVDFbioRNDotWLbHmn4wEV3ejz5HOEnoGxXSDTl_9wNRH5iC6aAzQPF8MIr9KxgsNcuMArbkA-Uvncfotw1xbSsz0UwgAA; esctx-t

Source: global traffic	DNS traffic detected: DNS query: x1.i.lencr.org
Source: global traffic	DNS traffic detected: DNS query: thedownthe1stg.wpenginepowered.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: neolect.ca
Source: global traffic	DNS traffic detected: DNS query: aadcdn.msftauth.net

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundCache-Control: privateSet-Cookie: x-ms-gateway-slice=estsfd; path=/; secure; samesite=none; httponlyStrict-Transport-Security: max-age=31536000; includeSubDomainsP3P: CP="DSP CUR OTPi IND OTRi ONL FIN"x-ms-request-id: e4fcfd72-5590-4e31-8888-b1315efa0900x-ms-ests-server: 2.1.20465.4 - NCUS ProdSlicesnel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0}x-ms-srs: 1.PReferrer-Policy: strict-origin-when-cross-originContent-Security-Policy-Report-Only: object-src 'none'; base-uri 'self'; script-src 'self' 'nonce-Dc3XA1iTsUigYThA4BdhGg' 'unsafe-inline' 'unsafe-eval' https://.msauth.net https://.msftauth.net https://.msftauthimages.net https://.msauthimages.net https://.msidentity.com https://.microsoftonline-p.com https://.microsoftazuread-sso.com https://.azureedge.net https://.outlook.com https://.office.com https://.office365.com https://.microsoft.com https://.bing.com 'report-sample'; report-uri https://csp.microsoft.com/report/ESTS-UX-AllDate: Tue, 15 Apr 2025 17:44:54 GMTConnection: closeContent-Length: 0Content-Security-Policy: default-src data: blob: filesystem: about: ws: wss: 'unsafe-inline' 'unsafe-eval'; form-action * data: blob: 'unsafe-inline' 'unsafe-eval'; script-src * data: blob: 'unsafe-inline' 'unsafe-eval'; connect-src * data: blob: 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src * data: blob: filesystem: ; frame-ancestors 'self' * http://* https://* file://* about: javascript: data: blob: filesystem: ; object-src * data: blob: filesystem: 'unsafe-inline' 'unsafe-eval'; style-src * data: blob: 'unsafe-inline'; font-src * data: blob: 'unsafe-inline';
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not Foundcontent-length: 1125Content-Type: text/htmlx-ms-error-code: WebContentNotFoundx-ms-request-id: 09659e89-901e-005f-142c-aee0f2000000x-ms-version: 2018-03-28Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,x-ms-error-code,x-ms-request-id,x-ms-versionAccess-Control-Allow-Origin: Date: Tue, 15 Apr 2025 17:44:57 GMTConnection: closeAkamai-GRN: 0.ed182117.1744739097.a7e65f5cSet-Cookie: ak_bmsc=ED87B0ED8639908A1AB169ECD0739377~000000000000000000000000000000~YAAQ7RghF4w+gSOWAQAABduNOhttp/tP0jyVyBtAde6Ks54NX3JoXhdCHsBfuLhMCXT7dVdSFVIgMMRNFAmtxG07eOC2pARyJ1oVwsGrDW8HW/lG5+Lciq6+0RrWxdNStW+6igroTgz7DUlF7voX9wUX31ozNn8vfi9b5vDFiQc+9m/fnMfbQeXsbeBSdY/aV+FJlQRhnD890K2VFYds9rssedX4CZLDXXpnPnkgrtF13ThQl6zN46KGltC5mdcqj8RVSgSO43jFuPa/Bh8Uq55nAALZiFIoCFw/OZvS061UU2v2wMPviMMQEJvHw0UGUWqVi+O60PBsGv169TK4Xw2zYz3ysS/acuxF7MIe; Domain=neolect.ca; Path=/; Expires=Tue, 15 Apr 2025 19:44:57 GMT; Max-Age=7200; SameSite=None; SecureContent-Security-Policy: default-src data: blob: filesystem: about: ws: wss: 'unsafe-inline' 'unsafe-eval'; form-action * data: blob: 'unsafe-inline' 'unsafe-eval'; script-src * data: blob: 'unsafe-inline' 'unsafe-eval'; connect-src * data: blob: 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src * data: blob: filesystem: ; frame-ancestors 'self' * http://* https://* file://* about: javascript: data: blob: filesystem: ; object-src * data: blob: filesystem: 'unsafe-inline' 'unsafe-eval'; style-src * data: blob: 'unsafe-inline'; font-src * data: blob: 'unsafe-inline';
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not Foundcontent-length: 1125Content-Type: text/htmlx-ms-error-code: WebContentNotFoundx-ms-request-id: 57126ed2-d01e-00f9-502d-ae8245000000x-ms-version: 2018-03-28Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,x-ms-error-code,x-ms-request-id,x-ms-versionAccess-Control-Allow-Origin: Date: Tue, 15 Apr 2025 17:44:58 GMTConnection: closeAkamai-GRN: 0.ed182117.1744739098.a7e678c7Content-Security-Policy: default-src data: blob: filesystem: about: ws: wss: 'unsafe-inline' 'unsafe-eval'; form-action * data: blob: 'unsafe-inline' 'unsafe-eval'; script-src * data: blob: 'unsafe-inline' 'unsafe-eval'; connect-src * data: blob: 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src * data: blob: filesystem: ; frame-ancestors 'self' * http://* https://* file://* about: javascript: data: blob: filesystem: ; object-src * data: blob: filesystem: 'unsafe-inline' 'unsafe-eval'; style-src * data: blob: 'unsafe-inline'; font-src * data: blob: 'unsafe-inline';
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not Foundcontent-length: 1125Content-Type: text/htmlx-ms-error-code: WebContentNotFoundx-ms-request-id: b7fa503f-b01e-003a-7a2c-ae4eb6000000x-ms-version: 2018-03-28Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,x-ms-error-code,x-ms-request-id,x-ms-versionAccess-Control-Allow-Origin: Date: Tue, 15 Apr 2025 17:44:58 GMTConnection: closeAkamai-GRN: 0.ed182117.1744739098.a7e679a6Content-Security-Policy: default-src data: blob: filesystem: about: ws: wss: 'unsafe-inline' 'unsafe-eval'; form-action * data: blob: 'unsafe-inline' 'unsafe-eval'; script-src * data: blob: 'unsafe-inline' 'unsafe-eval'; connect-src * data: blob: 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src * data: blob: filesystem: ; frame-ancestors 'self' * http://* https://* file://* about: javascript: data: blob: filesystem: ; object-src * data: blob: filesystem: 'unsafe-inline' 'unsafe-eval'; style-src * data: blob: 'unsafe-inline'; font-src * data: blob: 'unsafe-inline';
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not Foundcontent-length: 1125Content-Type: text/htmlx-ms-error-code: WebContentNotFoundx-ms-request-id: 1a70f327-801e-0088-2f2d-aeb1c7000000x-ms-version: 2018-03-28Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,x-ms-error-code,x-ms-request-id,x-ms-versionAccess-Control-Allow-Origin: Date: Tue, 15 Apr 2025 17:44:58 GMTConnection: closeAkamai-GRN: 0.ed182117.1744739098.a7e6931fContent-Security-Policy: default-src data: blob: filesystem: about: ws: wss: 'unsafe-inline' 'unsafe-eval'; form-action * data: blob: 'unsafe-inline' 'unsafe-eval'; script-src * data: blob: 'unsafe-inline' 'unsafe-eval'; connect-src * data: blob: 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src * data: blob: filesystem: ; frame-ancestors 'self' * http://* https://* file://* about: javascript: data: blob: filesystem: ; object-src * data: blob: filesystem: 'unsafe-inline' 'unsafe-eval'; style-src * data: blob: 'unsafe-inline'; font-src * data: blob: 'unsafe-inline';
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not Foundcontent-length: 1125Content-Type: text/htmlx-ms-error-code: WebContentNotFoundx-ms-request-id: c13d8a12-d01e-0061-122d-ae778d000000x-ms-version: 2018-03-28Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,x-ms-error-code,x-ms-request-id,x-ms-versionAccess-Control-Allow-Origin: Date: Tue, 15 Apr 2025 17:44:59 GMTConnection: closeAkamai-GRN: 0.ed182117.1744739099.a7e6aaeaContent-Security-Policy: default-src data: blob: filesystem: about: ws: wss: 'unsafe-inline' 'unsafe-eval'; form-action * data: blob: 'unsafe-inline' 'unsafe-eval'; script-src * data: blob: 'unsafe-inline' 'unsafe-eval'; connect-src * data: blob: 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src * data: blob: filesystem: ; frame-ancestors 'self' * http://* https://* file://* about: javascript: data: blob: filesystem: ; object-src * data: blob: filesystem: 'unsafe-inline' 'unsafe-eval'; style-src * data: blob: 'unsafe-inline'; font-src * data: blob: 'unsafe-inline';
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not Foundcontent-length: 1125Content-Type: text/htmlx-ms-error-code: WebContentNotFoundx-ms-request-id: b7fa503f-b01e-003a-7a2c-ae4eb6000000x-ms-version: 2018-03-28Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,x-ms-error-code,x-ms-request-id,x-ms-versionAccess-Control-Allow-Origin: Date: Tue, 15 Apr 2025 17:45:00 GMTConnection: closeAkamai-GRN: 0.e4182117.1744739100.7900ad08Content-Security-Policy: default-src data: blob: filesystem: about: ws: wss: 'unsafe-inline' 'unsafe-eval'; form-action * data: blob: 'unsafe-inline' 'unsafe-eval'; script-src * data: blob: 'unsafe-inline' 'unsafe-eval'; connect-src * data: blob: 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src * data: blob: filesystem: ; frame-ancestors 'self' * http://* https://* file://* about: javascript: data: blob: filesystem: ; object-src * data: blob: filesystem: 'unsafe-inline' 'unsafe-eval'; style-src * data: blob: 'unsafe-inline'; font-src * data: blob: 'unsafe-inline';
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not Foundcontent-length: 1125Content-Type: text/htmlx-ms-error-code: WebContentNotFoundx-ms-request-id: abf44113-601e-0061-5e2d-aee96f000000x-ms-version: 2018-03-28Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,x-ms-error-code,x-ms-request-id,x-ms-versionAccess-Control-Allow-Origin: Date: Tue, 15 Apr 2025 17:45:00 GMTConnection: closeAkamai-GRN: 0.e4182117.1744739100.7900af5eContent-Security-Policy: default-src data: blob: filesystem: about: ws: wss: 'unsafe-inline' 'unsafe-eval'; form-action * data: blob: 'unsafe-inline' 'unsafe-eval'; script-src * data: blob: 'unsafe-inline' 'unsafe-eval'; connect-src * data: blob: 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src * data: blob: filesystem: ; frame-ancestors 'self' * http://* https://* file://* about: javascript: data: blob: filesystem: ; object-src * data: blob: filesystem: 'unsafe-inline' 'unsafe-eval'; style-src * data: blob: 'unsafe-inline'; font-src * data: blob: 'unsafe-inline';
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not Foundcontent-length: 1125Content-Type: text/htmlx-ms-error-code: WebContentNotFoundx-ms-request-id: 5abba74a-101e-00d2-562d-ae49c2000000x-ms-version: 2018-03-28Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,x-ms-error-code,x-ms-request-id,x-ms-versionAccess-Control-Allow-Origin: Date: Tue, 15 Apr 2025 17:45:09 GMTConnection: closeAkamai-GRN: 0.ed182117.1744739109.a7e81b3bSet-Cookie: bm_sv=0B5DC67F6F95DBD1186D6B5F51F2BC1D~YAAQ7RghF31DgSOWAQAAUwuOOhsRWuM9BFR8lO1rZGBzmPMEH0saKG4hRf5p4yb+sqSsNoBFLO7a/GkDhI45UiLFIDAUoedvyqHF7hKwNFoEK1aZlEEa4vpBqL2XXg3Q6IteGU+FRj8Us/qT21IvJwF0OzNHO1vRcoiSADyzN544kz/nhQgnAXRMbAxbTMK7IAY0henJohChqvXl2fNYL6b21OZa+1HoVZY/+8qRN9V6N0Knq62iu9LxY9qTlSOq5Cs=~1; Domain=neolect.ca; Path=/; Expires=Tue, 15 Apr 2025 19:45:09 GMT; Max-Age=7200; SameSite=None; SecureContent-Security-Policy: default-src data: blob: filesystem: about: ws: wss: 'unsafe-inline' 'unsafe-eval'; form-action * data: blob: 'unsafe-inline' 'unsafe-eval'; script-src * data: blob: 'unsafe-inline' 'unsafe-eval'; connect-src * data: blob: 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src * data: blob: filesystem: ; frame-ancestors 'self' * http://* https://* file://* about: javascript: data: blob: filesystem: ; object-src * data: blob: filesystem: 'unsafe-inline' 'unsafe-eval'; style-src * data: blob: 'unsafe-inline'; font-src * data: blob: 'unsafe-inline';

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49695 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49695
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443

Source: unknown	HTTPS traffic detected: 51.222.174.97:443 -> 192.168.2.16:49723 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 51.222.174.97:443 -> 192.168.2.16:49724 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 51.222.174.97:443 -> 192.168.2.16:49725 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 141.193.213.10:443 -> 192.168.2.16:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 141.193.213.11:443 -> 192.168.2.16:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 74.125.138.103:443 -> 192.168.2.16:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 85.208.108.179:443 -> 192.168.2.16:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 85.208.108.179:443 -> 192.168.2.16:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.1.33.12:443 -> 192.168.2.16:49752 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 85.208.108.179:443 -> 192.168.2.16:49764 version: TLS 1.2

Source: classification engine

Classification label: mal68.phis.winPDF@44/56@13/154

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-04-15 13-43-20-017.log

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Source: unknown	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\Invitation de proposition - #U00c9b#U00e9nisterie PTM.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2236 --field-trial-handle=1576,i,6969129164730021865,5789522965333232760,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: unknown	Process created: C:\Windows\System32\msiexec.exe C:\Windows\system32\msiexec.exe /V
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\System32\msiexec.exe C:\Windows\System32\MsiExec.exe -Embedding C7EC34385020458A65EB4F10036795DD
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2236 --field-trial-handle=1576,i,6969129164730021865,5789522965333232760,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://ptm66534.otsproductions.ca//@
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://ptm66534.otsproductions.ca//@
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=1900,i,13975828022003771642,293067518181252376,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version --mojo-platform-channel-handle=2212 /prefetch:3
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://ptm66534.otsproductions.ca//@
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://ptm66534.otsproductions.ca//@
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=1900,i,13975828022003771642,293067518181252376,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version --mojo-platform-channel-handle=2212 /prefetch:3
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: Invitation de proposition - #U00c9b#U00e9nisterie PTM.pdf	Initial sample: PDF keyword /JS count = 0
Source: Invitation de proposition - #U00c9b#U00e9nisterie PTM.pdf	Initial sample: PDF keyword /JavaScript count = 0

Source: Invitation de proposition - #U00c9b#U00e9nisterie PTM.pdf

Initial sample: PDF keyword /EmbeddedFile count = 0

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe

Process information queried: ProcessInformation

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Drive-by Compromise	Windows Management Instrumentation	1 Browser Extensions	1 Process Injection	1 Masquerading	OS Credential Dumping	1 Process Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Extra Window Memory Injection	1 Process Injection	LSASS Memory	1 System Information Discovery	Remote Desktop Protocol	Data from Removable Media	3 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Extra Window Memory Injection	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	4 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	3 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Source	Detection	Scanner	Label
https://ptm66534.otsproductions.ca//@	0%	Avira URL Cloud	safe
https://ptm66534.otsproductions.ca/@	0%	Avira URL Cloud	safe
https://thedownthe1stg.wpenginepowered.com/favicon.ico	0%	Avira URL Cloud	safe
https://neolect.ca/aadcdn.msftauth.net/~/shared/1.0/content/images/backgrounds/2_bc3d32a696895f78c19df6c717586a5d.svg	100%	Avira URL Cloud	phishing
https://neolect.ca/aadcdn.msftauth.net/~/shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico	100%	Avira URL Cloud	phishing
https://neolect.ca/aadcdn.msftauth.net/~/ests/2.1/content/cdnbundles/converged.v2.login.min_81imvbluez-v5hbzpkxfcg2.css	100%	Avira URL Cloud	phishing
https://neolect.ca/aadcdn.msftauth.net/~/shared/1.0/content/js/oneDs_641b1cf809bdc17b42ab.js	100%	Avira URL Cloud	phishing
https://neolect.ca/aadcdn.msftauth.net/~/shared/1.0/content/js/asyncchunk/convergedlogin_pcustomizationloader_80e93b9a4cb13643afca.js	100%	Avira URL Cloud	phishing
https://neolect.ca/aadcdn.msftauth.net/~/shared/1.0/content/images/microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg	100%	Avira URL Cloud	phishing
https://neolect.ca/?m0nid4uex=aHR0cHM6Ly93d3cub2ZmaWNlLmNvbS9sb2dpbiM=	100%	Avira URL Cloud	phishing
https://neolect.ca/aadcdn.msftauth.net/~/ests/2.1/content/cdnbundles/ux.converged.login.strings-en.min_1d0daql8my9m71a_2aaxzg2.js	100%	Avira URL Cloud	phishing
https://neolect.ca/	100%	Avira URL Cloud	phishing
https://neolect.ca/favicon.ico	100%	Avira URL Cloud	phishing
https://neolect.ca/aadcdn.msftauth.net/~/shared/1.0/content/images/marching_ants_b540a8e518037192e32c4fe58bf2dbab.gif	100%	Avira URL Cloud	phishing
https://neolect.ca/aadcdn.msftauth.net/~/shared/1.0/content/js/ConvergedLogin_PCore_XZWzmNsf-98_A243D7S65Q2.js	100%	Avira URL Cloud	phishing
https://neolect.ca/aadcdn.msftauth.net/~/shared/1.0/content/js/asyncchunk/convergedlogin_pfetchsessionsprogress_ae573f441ee1cf781ec7.js	100%	Avira URL Cloud	phishing
https://neolect.ca/aadcdn.msftauth.net/~/shared/1.0/content/images/marching_ants_white_166de53471265253ab3a456defe6da23.gif	100%	Avira URL Cloud	phishing
https://neolect.ca/?eojocwpo	100%	Avira URL Cloud	phishing
https://neolect.ca/aadcdn.msftauth.net/~/shared/1.0/content/images/signin-options_4e48046ce74f4b89d45037c90576bfac.svg	100%	Avira URL Cloud	phishing

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
s-part-0012.t-0009.t-msedge.net	13.107.246.40	true	false	high
bg.microsoft.map.fastly.net	199.232.214.172	true	false	high
e329293.dscd.akamaiedge.net	23.1.33.12	true	false	high
e8652.dscx.akamaiedge.net	23.55.253.31	true	false	high
thedownthe1stg.wpenginepowered.com	141.193.213.10	true	true	unknown
s-part-0013.t-0009.t-msedge.net	13.107.246.41	true	false	high
www.google.com	74.125.138.103	true	false	high
neolect.ca	85.208.108.179	true	false	unknown
x1.i.lencr.org	unknown	unknown	false	high
aadcdn.msftauth.net	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://neolect.ca/aadcdn.msftauth.net/~/shared/1.0/content/images/backgrounds/2_bc3d32a696895f78c19df6c717586a5d.svg	true	Avira URL Cloud: phishing	unknown
http://x1.i.lencr.org/	false		high
https://neolect.ca/aadcdn.msftauth.net/~/shared/1.0/content/images/microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg	true	Avira URL Cloud: phishing	unknown
https://neolect.ca/aadcdn.msftauth.net/~/shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico	true	Avira URL Cloud: phishing	unknown
https://neolect.ca/aadcdn.msftauth.net/~/ests/2.1/content/cdnbundles/converged.v2.login.min_81imvbluez-v5hbzpkxfcg2.css	true	Avira URL Cloud: phishing	unknown
https://neolect.ca/	true	Avira URL Cloud: phishing	unknown
https://neolect.ca/aadcdn.msftauth.net/~/shared/1.0/content/js/oneDs_641b1cf809bdc17b42ab.js	true	Avira URL Cloud: phishing	unknown
https://neolect.ca/aadcdn.msftauth.net/~/shared/1.0/content/js/asyncchunk/convergedlogin_pcustomizationloader_80e93b9a4cb13643afca.js	true	Avira URL Cloud: phishing	unknown
https://neolect.ca/?m0nid4uex=aHR0cHM6Ly93d3cub2ZmaWNlLmNvbS9sb2dpbiM=	true	Avira URL Cloud: phishing	unknown
https://neolect.ca/aadcdn.msftauth.net/~/ests/2.1/content/cdnbundles/ux.converged.login.strings-en.min_1d0daql8my9m71a_2aaxzg2.js	true	Avira URL Cloud: phishing	unknown
https://thedownthe1stg.wpenginepowered.com/favicon.ico	false	Avira URL Cloud: safe	unknown
https://neolect.ca/favicon.ico	true	Avira URL Cloud: phishing	unknown
https://neolect.ca/aadcdn.msftauth.net/~/shared/1.0/content/images/marching_ants_b540a8e518037192e32c4fe58bf2dbab.gif	true	Avira URL Cloud: phishing	unknown
https://neolect.ca/aadcdn.msftauth.net/~/shared/1.0/content/images/signin-options_4e48046ce74f4b89d45037c90576bfac.svg	true	Avira URL Cloud: phishing	unknown
https://neolect.ca/aadcdn.msftauth.net/~/shared/1.0/content/js/ConvergedLogin_PCore_XZWzmNsf-98_A243D7S65Q2.js	true	Avira URL Cloud: phishing	unknown
https://thedownthe1stg.wpenginepowered.com/bid.html	true		unknown
https://neolect.ca/aadcdn.msftauth.net/~/shared/1.0/content/js/asyncchunk/convergedlogin_pfetchsessionsprogress_ae573f441ee1cf781ec7.js	true	Avira URL Cloud: phishing	unknown
https://ptm66534.otsproductions.ca/@	false	Avira URL Cloud: safe	unknown
https://neolect.ca/aadcdn.msftauth.net/~/shared/1.0/content/images/marching_ants_white_166de53471265253ab3a456defe6da23.gif	true	Avira URL Cloud: phishing	unknown
https://neolect.ca/?eojocwpo	true	Avira URL Cloud: phishing	unknown
https://ptm66534.otsproductions.ca//@	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
172.217.215.100	unknown	United States	15169	GOOGLEUS	false
13.107.246.40	s-part-0012.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
51.222.174.97	unknown	France	16276	OVHFR	false
184.31.48.185	unknown	United States	16625	AKAMAI-ASUS	false
173.194.219.94	unknown	United States	15169	GOOGLEUS	false
173.194.219.95	unknown	United States	15169	GOOGLEUS	false
50.16.47.176	unknown	United States	14618	AMAZON-AESUS	false
162.159.61.3	unknown	United States	13335	CLOUDFLARENETUS	false
184.31.60.185	unknown	United States	16625	AKAMAI-ASUS	false
199.232.214.172	bg.microsoft.map.fastly.net	United States	54113	FASTLYUS	false
20.190.135.19	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
74.125.138.103	www.google.com	United States	15169	GOOGLEUS	false
23.1.33.12	e329293.dscd.akamaiedge.net	United States	20940	AKAMAI-ASN1EU	false
1.1.1.1	unknown	Australia	13335	CLOUDFLARENETUS	false
74.125.136.95	unknown	United States	15169	GOOGLEUS	false
142.250.9.138	unknown	United States	15169	GOOGLEUS	false
64.233.176.84	unknown	United States	15169	GOOGLEUS	false
85.208.108.179	neolect.ca	Netherlands	18978	ENZUINC-US	false
23.55.253.31	e8652.dscx.akamaiedge.net	United States	20940	AKAMAI-ASN1EU	false
172.253.124.94	unknown	United States	15169	GOOGLEUS	false
141.193.213.10	thedownthe1stg.wpenginepowered.com	United States	396845	DV-PRIMARY-ASN1US	true
141.193.213.11	unknown	United States	396845	DV-PRIMARY-ASN1US	false
20.190.157.3	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
64.233.185.94	unknown	United States	15169	GOOGLEUS	false
64.233.185.95	unknown	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.16

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1665735
Start date and time:	2025-04-15 19:42:41 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 134, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled
Analysis Mode:	stream
Analysis stop reason:	Timeout
Sample name:	Invitation de proposition - #U00c9b#U00e9nisterie PTM.pdf renamed because original name is a hash value
Original Sample Name:	Invitation de proposition - bnisterie PTM.pdf
Detection:	MAL
Classification:	mal68.phis.winPDF@44/56@13/154
Cookbook Comments:	Found application associated with file extension: .pdf

Warnings

Exclude process from analysis (whitelisted): SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 184.31.60.185, 50.16.47.176, 34.237.241.83, 18.213.11.84, 54.224.241.105, 162.159.61.3, 172.64.41.3, 20.109.210.53
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, slscr.update.microsoft.com, ssl-delivery.adobe.com.edgekey.net, p13n.adobe.io, geo2.adobe.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenFile calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: thedownthe1stg.wpenginepowered.com

Created / dropped Files

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.189975612033405
Encrypted:	false
SSDEEP:
MD5:	DF2EECDC67F8FE5F3DC1D90BE92CF5B3
SHA1:	58059B42F148A032151CD26D88AEE628997F299D
SHA-256:	ED05EFFA386F209161A58F25B0814651D5C5BB4F596394EE2E60776D63118358
SHA-512:	F7C8D9464849D8FF91B717D2FE44BEDB597A2CB1C8D84DF826593DCA3D762EEA1D5A0FBD391E58CC4FF30C6586F155676107CD9F0DC4B62B174AC8D394E6CFC1
Malicious:	false
Reputation:	unknown
Preview:	2025/04/15-13:43:18.524 ac0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/04/15-13:43:18.527 ac0 Recovering log #3.2025/04/15-13:43:18.527 ac0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.192038259328501
Encrypted:	false
SSDEEP:
MD5:	FDA0A9429DF808394CD1D5670BF33D86
SHA1:	B03BCC5EB2B6018936840016A017E7BC0A72AB65
SHA-256:	8A3D2F2C4BEF9DD953D34C8CEE0DF7328FC1FE5BB5FEBBEE9299B7F62CA6FDFC
SHA-512:	5FF976E4F5EAF1AC8CF42A8AE9E3F717FEAC672D35D2D01D1D165ABCC148E3DE00343382ED0157E6E252806326F24A6A806EFB5732B79B9DDAD0003F86A99579
Malicious:	false
Reputation:	unknown
Preview:	2025/04/15-13:43:18.426 191c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/04/15-13:43:18.429 191c Recovering log #3.2025/04/15-13:43:18.430 191c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\4284faa1-5676-4bed-991f-b4481a80a1c5.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	403
Entropy (8bit):	4.987445451587814
Encrypted:	false
SSDEEP:
MD5:	32F223571B4EAFC43ACE1C590537F62D
SHA1:	2211D7CEB462B07B424C1AA52B4F373D188AB6AD
SHA-256:	425E2978A4ACF9835FE38AEBC7D313DD1ECB0C123CCBCE1A990713EEA1A01B63
SHA-512:	964A8D41074CBFE806125DEF54593DD01ABD7D8C1CA81E27855927C7E44B51414754C6400B1B487C25F8EC4337939362A3229C4AF9661BB9D18AEC57BE40EBC7
Malicious:	false
Reputation:	unknown
Preview:	{"net":{"http_server_properties":{"servers":[{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13389299010287963","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":108592},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.16","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	0
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:
MD5:	32F223571B4EAFC43ACE1C590537F62D
SHA1:	2211D7CEB462B07B424C1AA52B4F373D188AB6AD
SHA-256:	425E2978A4ACF9835FE38AEBC7D313DD1ECB0C123CCBCE1A990713EEA1A01B63
SHA-512:	964A8D41074CBFE806125DEF54593DD01ABD7D8C1CA81E27855927C7E44B51414754C6400B1B487C25F8EC4337939362A3229C4AF9661BB9D18AEC57BE40EBC7
Malicious:	false
Reputation:	unknown
Preview:	{"net":{"http_server_properties":{"servers":[{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13389299010287963","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":108592},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.16","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4099
Entropy (8bit):	5.230796981015326
Encrypted:	false
SSDEEP:
MD5:	CDFC7FE499CEDA8CA33DEB22EC7F1C4A
SHA1:	2BF1F4201D2B5B04A9A46E06F5B19D15AD24FC43
SHA-256:	39B8C9CBAAABB6EE8AD707DF96FDC0C6B40051A022E043D29DEF56CB546CA567
SHA-512:	BB4BF64A24F6F15463D3430381EB0811886CC8A3ACEA35A7DF04A6C86042D28978E7CD19C109FAFB44C9B61062CC304BEB325C36270B99825F64599CD6FE08C1
Malicious:	false
Reputation:	unknown
Preview:	*...#................version.1..namespace-e...o................next-map-id.1.Pnamespace-1d95df23_a38f_44a8_b732_4e62dd896a16-https://rna-resource.acrobat.com/.0y.S_r................next-map-id.2.Snamespace-2a884c18_b39c_4e3d_942f_252e530ca4bd-https://rna-v2-resource.acrobat.com/.16.X:r................next-map-id.3.Snamespace-2e78bfda_7188_4688_a4aa_1ff81b6e5eaa-https://rna-v2-resource.acrobat.com/.2.P.@o................next-map-id.4.Pnamespace-09c119c2_97bc_4467_8f67_f92472c9e5dc-https://rna-resource.acrobat.com/.346.+^...............Pnamespace-1d95df23_a38f_44a8_b732_4e62dd896a16-https://rna-resource.acrobat.com/....^...............Pnamespace-09c119c2_97bc_4467_8f67_f92472c9e5dc-https://rna-resource.acrobat.com/..?&a...............Snamespace-2a884c18_b39c_4e3d_942f_252e530ca4bd-https://rna-v2-resource.acrobat.com/_...a...............Snamespace-2e78bfda_7188_4688_a4aa_1ff81b6e5eaa-https://rna-v2-resource.acrobat.com/...o................next-map-id.5.Pnamespace-07af9ee9_2076_4f12_94b5_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	322
Entropy (8bit):	5.202071361623334
Encrypted:	false
SSDEEP:
MD5:	38CD41CC3D26ACD6F6DDF30308F0E4CB
SHA1:	90ACAC002757163A72EDEFE9D28AE52D48249FFD
SHA-256:	A5816F0FB5502D6E838DDBEB008CBCF257119E2E5B516F370E4390D7E1F52ED7
SHA-512:	60FB5FE99A55AEE843B0C963E810C5E700A9BD53733711830A9B7CA483B971D858C6D68FB29B7853B769A4E017531A06F362B9C3C5254638DF3F98746DAC626B
Malicious:	false
Reputation:	unknown
Preview:	2025/04/15-13:43:18.553 191c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/04/15-13:43:18.554 191c Recovering log #3.2025/04/15-13:43:18.556 191c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-250415174322Z-177.bmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PC bitmap, Windows 3.x format, 117 x -152 x 32, cbSize 71190, bits offset 54
Category:	dropped
Size (bytes):	71190
Entropy (8bit):	0.3441977211165531
Encrypted:	false
SSDEEP:
MD5:	7113C79ADF446A7D74292B985A949C88
SHA1:	360F8CD25403C2E9831D2773B95470F4814D44F2
SHA-256:	A9AAC20BCA9C5069F597BAD14E3EB812E7449AC05FC129CA3A5885D964D7FBDD
SHA-512:	1B67AD9A8AD984900F3D52CDB42A20DB2A0EDDBFAF782F6FA8642129388DBE5395678C771A9A4D3AABBF157893CFFB730E4CF2AB59618A3CDC2A6D8D48341739
Malicious:	false
Reputation:	unknown
Preview:	BM........6...(...u...h..... ...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 2, database pages 14, cookie 0x5, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	57344
Entropy (8bit):	3.291927920232006
Encrypted:	false
SSDEEP:
MD5:	A4D5FECEFE05F21D6F81ACF4D9A788CF
SHA1:	1A9AC236C80F2A2809F7DE374072E2FCCA5A775C
SHA-256:	83BE4623D80FFB402FBDEC4125671DF532845A3828A1B378D99BD243A4FD8FF2
SHA-512:	FF106C6B9E1EA4B1F3E3AB01FAEA21BA24A885E63DDF0C36EB0A8C3C89A9430FE676039C076C50D7C46DC4E809F6A7E35A4BFED64D9033FEBD6121AC547AA5E9
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	16928
Entropy (8bit):	1.2156079807138478
Encrypted:	false
SSDEEP:
MD5:	958748CA2C7884595566048ECEB33FE5
SHA1:	45C4B1A1C21DC0397438B55D3A33FEC86A990A30
SHA-256:	B20A2D2EF3421729CAEC67C2C7125B0F791191E17F958FAE617227D7E4EDDD15
SHA-512:	1059458D424489080DBE24214DE8AFC494BFEEB80BFE0986E9BD9597862923A05BBFEABC9B49E565A3ABE5E01A16A5440D9B7F9B604FDCE8E9933E2D1E3EDF75
Malicious:	false
Reputation:	unknown
Preview:	.... .c................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Reputation:	unknown
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 73305 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	73305
Entropy (8bit):	7.996028107841645
Encrypted:	true
SSDEEP:
MD5:	83142242E97B8953C386F988AA694E4A
SHA1:	833ED12FC15B356136DCDD27C61A50F59C5C7D50
SHA-256:	D72761E1A334A754CE8250E3AF7EA4BF25301040929FD88CF9E50B4A9197D755
SHA-512:	BB6DA177BD16D163F377D9B4C63F6D535804137887684C113CC2F643CEAB4F34338C06B5A29213C23D375E95D22EF417EAC928822DFB3688CE9E2DE9D5242D10
Malicious:	false
Reputation:	unknown
Preview:	MSCF....Y.......,...................I.................;Za. .authroot.stl.98.?.6..CK..<Tk......4..c... .Ec...U.d.d.E&I.DH..M.KB."..rK.RQ..}f..f...}..1....9...........$.8q..fa...7.o.1.0...bfsM4.........u..l..0..4.a.t....0.....6#....n. :... ....%.,CQ5uU..(.3.<7#.0..JN.$...=j\|w...#.oU..Eq[..P..^..~.V...;..m...I\|...l..@-W..=.QQ.._./.M.nZ..(.........`.$Z.9wW:W.]..8E.......I.D{..n...K:.m..^.(.S.......c..s.y..<...2.%o.o.....H.B.R.....11.\|!.(...........h.SZ........<...^....Z>.Pp?... .pT@p.#.&..........#VEV=.....p........y..."T=l.n..egf.w..X.Y..-G...........KQ.]...pM..[m..-6.wd:........T...:.P5Zs....c.oT`..F1#......EuD.......7....V ..-....!.N..%S...k...S. ...@.J..../..b!B.(=\../.l......`.\...q9..>4!b..8EH.....zdy.....#...X>%0w...i.,>c.z.g"p.S..2W.+mMs.....5Def.....#._D.4....>}...i...\.&`D.......z;..ZY.3.+t.`....z_.q'w.z.)..j3.+.co.s..:.........qK...{...E....uPO...#vs.XxH.B!..(t. 8k+.....G\..?..GF8....'..w.>.ms..\ve.nFN..W)....xi..u..5.f.l....

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.732136534099206
Encrypted:	false
SSDEEP:
MD5:	4ACBE736CF7645C48C93FA14596DA303
SHA1:	A9FF7630A778B58F54F06C3C594597086BB12527
SHA-256:	151CB7045EF783272E4DD5B753AAC993725DAFE307DA9843DEDE731B79B0DBF7
SHA-512:	BFAFA35E0684E8DBACE9D47DA7FDC273B2475E85E1C91B63B2D270F9E573FB12E2C28E4B6BC3DB6447F8EC089018A93D4F5F9685C3DA0FA43AE241D31E4A3043
Malicious:	false
Reputation:	unknown
Preview:	p...... .........4e.-...(....................................................... ..........W...................o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	330
Entropy (8bit):	3.281075686694808
Encrypted:	false
SSDEEP:
MD5:	8FD5DDDA8AE6D0AA967B3277263F89F0
SHA1:	78F2A4AF9EEFFAEA15237FE67512D524A9A7247F
SHA-256:	9F386D61F08B9D327C3F821D01B3A6A9B2EAEB5A3C484905E75D8B37E06D9B4E
SHA-512:	3839E9C1B3A2F8A010D4915390A044BEC0C9EF5B1BB66DA987FC33A5C2A695033B215D7A576AD816935656CF2DE1615FAD064014A909907BA57C1F407420184A
Malicious:	false
Reputation:	unknown
Preview:	p...... ............-...(....................................................... ..................(....c*.....Y...h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".6.4.2.7.f.6.c.2.b.7.8.7.d.b.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.382893152695252
Encrypted:	false
SSDEEP:
MD5:	AC3DDC78CC84E41AC97BC0D90CAFAF93
SHA1:	8906867F770359463133A8098C76310A1B4A4905
SHA-256:	1C11DC18308CDF377FB2937799E6F07B7CB4DE4AF6721AFEEF17AE5BDD88C085
SHA-512:	7B54672115B66BA80D86D4ACCD920F703CF201065FCD6BEA08ED48B7A9D54839035AD000A7CD8711C0BE77E62A89677444507EF139AC22AE71C5E152DD3AF334
Malicious:	false
Reputation:	unknown
Preview:	{"analyticsData":{"responseGUID":"5cb134b4-19f8-4ef7-8e0f-48491d389f26","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1744916768218,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.330044367982024
Encrypted:	false
SSDEEP:
MD5:	1A3DC797FCADACE8314E8F6BE5573007
SHA1:	019AE7E1E72B056C5C982C57F81BDBA9786025D0
SHA-256:	662FD2D38298ABCF32DFB26AAFE121710D734DE8290A1986DC3F46928BFC50C7
SHA-512:	EFE0BA6ACC534DF929E356F592A07474B44D446817C45D99A121149D117194C147F7F2A2E9FEEA57C3EE58A151B03C0E44B645467885C8AD2EA1D7C9AD64A0F4
Malicious:	false
Reputation:	unknown
Preview:	{"analyticsData":{"responseGUID":"5cb134b4-19f8-4ef7-8e0f-48491d389f26","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1744916768218,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.3090394033771
Encrypted:	false
SSDEEP:
MD5:	518546DD5E4D04CF11F09816E188F944
SHA1:	0F8950BC2940528B01CF777FEE2CCE4D63B50808
SHA-256:	3CB3709EEC833D17859C57060C4535F9ADE20F772D5757AD93CBD91CD84B41D2
SHA-512:	7F9D263F4F617BA2D3DC41D4D175913ABD4F773AAECC38655F6DCDEB9AFCD859CB1486A34C0475B6AB19D94B0AC9CB66E7633033A2F25269ECD4990D213D7A2B
Malicious:	false
Reputation:	unknown
Preview:	{"analyticsData":{"responseGUID":"5cb134b4-19f8-4ef7-8e0f-48491d389f26","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1744916768218,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.3719585963968814
Encrypted:	false
SSDEEP:
MD5:	4B01AD6693B40BB1B76117EF4CB8BD08
SHA1:	AD40F9BD192E0F73560D6C060B918B1B367CED3C
SHA-256:	949829D18E53E21D61F32836170C1A121E5C164591AB9E90E1A00879798AC96F
SHA-512:	98224764C75339706474DCD6C56FB15AC639B886DA99D1503B94274E2A95697E2B6043B694EC0DBBDC9560767FBAC905BA973B27A01FBAC8EFA9E55FBFEAD4A2
Malicious:	false
Reputation:	unknown
Preview:	{"analyticsData":{"responseGUID":"5cb134b4-19f8-4ef7-8e0f-48491d389f26","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1744916768218,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2213
Entropy (8bit):	5.852037805493284
Encrypted:	false
SSDEEP:
MD5:	F4B5F81C3E3A434B84AB61C1FCF0E19C
SHA1:	83B2E696354AD51D8721B379FA220082B724E5F1
SHA-256:	0850A25DA624EA10D47F8A40511B75B11A3E79841704FA2186DFB7CDA9202F4A
SHA-512:	5455120569345D547CE27F11F30CEA581691A4B0830B089B1765AE7F0A1279321A5665709B65D6997C83B12D948B5E0FDC8136B37864183D178CFA92C108CB11
Malicious:	false
Reputation:	unknown
Preview:	{"analyticsData":{"responseGUID":"5cb134b4-19f8-4ef7-8e0f-48491d389f26","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1744916768218,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"102656_316349ActionBlock_1","campaignId":102656,"containerId":"1","controlGroupId":"","treatmentId":"5a9d1955-ab74-4b89-837a-074b702313c0","variationId":"316349"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJkYXRhIjp7ImxocFYyQnlQYXRoIjp7Iml0ZW0iOnsiX3BhdGgiOiIvY29udGVudC9kYW0vYWNyb2JhdGRlc2t0b3AvZ3Jvd3RoL3JlYWRlci9lbi11cy9saHAtYmFubmVyL3YyL2NvbnZlcnQiLCJfaWQiOiJlYjYyOWYwOC00YmZiLTRkYmEtYjQzNC01MzUyZTg1MGU4NWYiLCJfdmFyaWF0aW9uIjoicmdzMDM2MS0wIiwidGl0bGUiOm51bGwsImRlc2NyaXB0aW9uIjoiRXhwb3J0IFBERnMgdG8gTWljcm9zb2Z0IFdvcmQgYW5kIEV4Y2VsLiIsImN0YUxhYmVsIjpudWxsLCJjdGFCZW

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.321765121959661
Encrypted:	false
SSDEEP:
MD5:	A442CC485E2A4D1567B98D1287767766
SHA1:	DC0FE663243D978F7C76B5185686520AEA84CF53
SHA-256:	0BB9758378FC3CA592DBCD184AA8FFB73C4CEA63508E5DC37794992CB1A46C4A
SHA-512:	3CAE9237119AA919104055B63A12B9C2514B2DE8751307221DE70AE17E4584AFDEC55AA3793BDFE2792BA4B99020B06815914FFA03BCEE01313FF6661FC5A50F
Malicious:	false
Reputation:	unknown
Preview:	{"analyticsData":{"responseGUID":"5cb134b4-19f8-4ef7-8e0f-48491d389f26","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1744916768218,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.323555135603128
Encrypted:	false
SSDEEP:
MD5:	8C3BF3C00D10EAF15FA5F24BECF25D2B
SHA1:	E84D2B61C809BABCE0D08B427A36E72C38ED6C6C
SHA-256:	3A3C0AF85B22E619AD88AF17EC3095224CD4DFB619953C68ADF157F2F28FE370
SHA-512:	D586B74C3F917B9BEE1FE0B97A44F61FA35A1E46B10468BF29F124EBB647B874182038A2D42A46CB7F050BBE56F1B47CF903C8360940AF3AFF70367A945F38A6
Malicious:	false
Reputation:	unknown
Preview:	{"analyticsData":{"responseGUID":"5cb134b4-19f8-4ef7-8e0f-48491d389f26","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1744916768218,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2160
Entropy (8bit):	5.837581697277453
Encrypted:	false
SSDEEP:
MD5:	405F1CDBECEB721ECF1DEA9F5AE84DCF
SHA1:	FC69211FCE09AE0525009FEF850E2766107B30F4
SHA-256:	B9099380706F6ABBE49FA7589F30D3F9025FD02D29C0802E8EDA90B7ADC1A3E1
SHA-512:	572C5D0CE7EB006438EB28A83BEDD43673002FD3E6EDE66E336E50FB90827E74B9F11C312DE7E8EA4027720AB89DE4E6D1CA86B04F7EA93DF12117CD11B8D1C5
Malicious:	false
Reputation:	unknown
Preview:	{"analyticsData":{"responseGUID":"5cb134b4-19f8-4ef7-8e0f-48491d389f26","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1744916768218,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Edit_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"102656_316349ActionBlock_2","campaignId":102656,"containerId":"1","controlGroupId":"","treatmentId":"164bf29d-ee04-491c-adf2-c0bfeedb2d1b","variationId":"316349"},"containerId":1,"containerLabel":"JSON for DC_Reader_Edit_LHP_Banner","content":{"data":"eyJkYXRhIjp7ImxocFYyQnlQYXRoIjp7Iml0ZW0iOnsiX3BhdGgiOiIvY29udGVudC9kYW0vYWNyb2JhdGRlc2t0b3AvZ3Jvd3RoL3JlYWRlci9lbi11cy9saHAtYmFubmVyL3YyL2VkaXQiLCJfaWQiOiIzNzkzMGExNC1kOGMwLTRlZDYtYjI0Yi0zZGUzY2FlZjZlNjAiLCJfdmFyaWF0aW9uIjoicmdzMDM2MS0wIiwidGl0bGUiOm51bGwsImRlc2NyaXB0aW9uIjpudWxsLCJjdGFMYWJlbCI6bnVsbCwiY3RhQmVoYXZpb3IiOm51bGwsImN0YVVybCI6bnVsbCwiY3RhVXJsVHlwZSI6bnVsbCwidHJ

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.346945412953883
Encrypted:	false
SSDEEP:
MD5:	A36E84E06E5265197348A33B44401359
SHA1:	63D584A7C829E604B5F04A1ABDBEBF20B1CA5548
SHA-256:	72B34B01C06A82247BD0850CD944083DCA7235F4624F32888724EA717B6FF86F
SHA-512:	0A5CBD8CA866F74225C226D0782263F58D49A53945F11BE6C8170D482FFE406C9D11C14B88DFED45DCE1C98302B0B3F782EC496768ED305FE8AAE818F2EE03CD
Malicious:	false
Reputation:	unknown
Preview:	{"analyticsData":{"responseGUID":"5cb134b4-19f8-4ef7-8e0f-48491d389f26","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1744916768218,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.32755576504722
Encrypted:	false
SSDEEP:
MD5:	18A94C339B4E38E07D225A9DF4DA7066
SHA1:	2C88A7BFE044DC0F0D4CDD1F42AE6C8AE90BD6C6
SHA-256:	A394DAE95F52FF4B94787828E150EA14ED6ED1243D4ADBA502ECC1A95086CD76
SHA-512:	C461B2C608A689D5E4CB357CB4FFF3A76C98D2AA62284270B6D0754BC03B3A018D5A519DFFA3327F55B052F88ECACFF7CAEF47B23A1DA3F81D9C903D517F5300
Malicious:	false
Reputation:	unknown
Preview:	{"analyticsData":{"responseGUID":"5cb134b4-19f8-4ef7-8e0f-48491d389f26","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1744916768218,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.314390265506311
Encrypted:	false
SSDEEP:
MD5:	D253681EFD73F6D94CBAFF9BCD035D6A
SHA1:	BE1B2E112BC2FAA44E9363DE26F8BAC7EF16AAD1
SHA-256:	AB837291DB3FFB7A289874B388084BC15DF2CB96E1B09D2A4B3F67AF0581E4AD
SHA-512:	5062D5FB377609421DA6C34D115F837F40D2017BBC33D4ED615980A50413D05063CD37561A708857AB4F64BC212BB6C47C034219BA32E8693CADCB72C94AE153
Malicious:	false
Reputation:	unknown
Preview:	{"analyticsData":{"responseGUID":"5cb134b4-19f8-4ef7-8e0f-48491d389f26","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1744916768218,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.310913476019727
Encrypted:	false
SSDEEP:
MD5:	FE15E11FAAB692B7A276CDB8A1E84431
SHA1:	8A184BA88E28EEDA76CC01BCE42F442938216CEC
SHA-256:	416CBD3BFB6F438E0DCE6BD822C6B717A3F68703643FAE50636649FE1C1D0A6E
SHA-512:	0F06E031C92245732CF07A8322A3C576C0EEE94071530202FC295B392CD63B625549FDAFEF82770CACFC6DBDD6E0A986D5562DE108AB5C85F78ACA9DE9E62844
Malicious:	false
Reputation:	unknown
Preview:	{"analyticsData":{"responseGUID":"5cb134b4-19f8-4ef7-8e0f-48491d389f26","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1744916768218,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.314026459181557
Encrypted:	false
SSDEEP:
MD5:	12D8111DC049937462D3FA33418EEDCE
SHA1:	1DDF550CAD1798E84806243D4C153A74E1F94C71
SHA-256:	7ECEF4A02F252E91378F2C72DECC95170963B2042F14AEB86DBB2F6064EE0980
SHA-512:	3EF377CF250952093E50BBBD94C79FF7C2228949312869F43DFE28C01D91FAECC291F37E638D210A7DC44E79BA888FBA993A36F64697CCFF7B0DF564ADB05423
Malicious:	false
Reputation:	unknown
Preview:	{"analyticsData":{"responseGUID":"5cb134b4-19f8-4ef7-8e0f-48491d389f26","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1744916768218,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2112
Entropy (8bit):	5.855124358347705
Encrypted:	false
SSDEEP:
MD5:	97343F292F2A9F789B946DA76073E415
SHA1:	242104DF97505ACF0C29244EA8AA92E213E3F631
SHA-256:	920F3ECBB448087B45AD0F339D6FF297E391D9388C7D0E325040FF452DF563B3
SHA-512:	F0E766E83B252873707482E4C0CE68292E8F291F326251159F89B254004FAD8E99BDF43FAE7C6606516980E42A1173426EA37FD74A0EA787EA9DF5D74030264E
Malicious:	false
Reputation:	unknown
Preview:	{"analyticsData":{"responseGUID":"5cb134b4-19f8-4ef7-8e0f-48491d389f26","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1744916768218,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"102656_316349ActionBlock_0","campaignId":102656,"containerId":"1","controlGroupId":"","treatmentId":"339c0ba6-2e61-4622-82f6-f07787d206b8","variationId":"316349"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJkYXRhIjp7ImxocFYyQnlQYXRoIjp7Iml0ZW0iOnsiX3BhdGgiOiIvY29udGVudC9kYW0vYWNyb2JhdGRlc2t0b3AvZ3Jvd3RoL3JlYWRlci9lbi11cy9saHAtYmFubmVyL3YyL3NpZ24iLCJfaWQiOiJkMDQzMmY0Yy1hNTM2LTRlMzktOGNkNS1jYThiYjRhZTY2YzIiLCJfdmFyaWF0aW9uIjoicmdzMDM2MS0wIiwidGl0bGUiOm51bGwsImRlc2NyaXB0aW9uIjoiRWFzaWx5IGZpbGwgYW5kIHNpZ24gUERGcy4iLCJjdGFMYWJlbCI6bnVsbCwiY3RhQmVoYXZpb3IiOm51bGwsImN0YVVybCI6bnV

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.291425847960191
Encrypted:	false
SSDEEP:
MD5:	6F426C8D227E69AD405FC446A475A927
SHA1:	ADF672B8817398F37818AB0697FC9DD0ADA1FF04
SHA-256:	45FC2C25ED37A131EE433BE073FC8DE63A3C0E6EC54B45FF2A5B05E8E047F369
SHA-512:	4C6A4F9C694CF4F96F03B1239B051DD3AF089C2CD6F1D33F63820C75BA442BEECAA8015B43AF97EEE1A873AB05173457842FD63B11991FED3789C3B4AA8F786C
Malicious:	false
Reputation:	unknown
Preview:	{"analyticsData":{"responseGUID":"5cb134b4-19f8-4ef7-8e0f-48491d389f26","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1744916768218,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.302343312911469
Encrypted:	false
SSDEEP:
MD5:	EAAE1E230DD7F95DB9BD8A90E0F7A401
SHA1:	182940CE12BC97041834ECDEB0D79B37E93DFB2E
SHA-256:	5102517D716E44CCF26ACD766CAB6285D6261ECA8DFA069A5F33138AF26DB68D
SHA-512:	A5DB03ED80A34248842E8563F39EB924B54B57B540C7FA08C767248FE81FACBDB184863D77ED65DA244127FEB8252A87038008AB86E21C700E74E528B535B348
Malicious:	false
Reputation:	unknown
Preview:	{"analyticsData":{"responseGUID":"5cb134b4-19f8-4ef7-8e0f-48491d389f26","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1744916768218,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Reputation:	unknown
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2815
Entropy (8bit):	5.121857806099921
Encrypted:	false
SSDEEP:
MD5:	E87E24A697CBACDEFFAA8A6125EE56A8
SHA1:	D56ECC3D0C2A403B9A35CB4786F62339B53C16F5
SHA-256:	9BDCCA9C3AEA94A733A5C58C2360CC917AC75B28C6F02622D188E5FB39BDFC9B
SHA-512:	6D37555E998B4F0BCCB4937D3B2671B1383DD419C5EED4D55A91B1D6E8BB6CDD1BD6AC614054C26C706104D81DFDA10C9CF91241BA65B91B4D9FA2DEC496A84A
Malicious:	false
Reputation:	unknown
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"05c65db252a1ebb9c1500b0a6c11669b","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1744739002000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"5cee46efcede9f6b37735bdd23f75aa3","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":2112,"ts":1744739002000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"807f80a591976e2ed4f73d842ea23588","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":2213,"ts":1744739002000},{"id":"DC_Reader_Edit_LHP_Banner","info":{"dg":"2511ba686664a86db879181f33c1a890","sid":"DC_Reader_Edit_LHP_Banner"},"mimeType":"file","size":2160,"ts":1744739002000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"f8afb8572781cc41e14638ebee72a2c2","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1744739002000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"48f49181d911d05a490d5a321db3ed66","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file",

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 19, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 19
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	0.9893328330597573
Encrypted:	false
SSDEEP:
MD5:	F91486519A6E792889DC482C56B04626
SHA1:	A26C926F5FCD8BC899A4CDB9E10347E034DFDBA5
SHA-256:	EC27BEA617F995FA15FB24E1CF24E331751D65DC1296822C8B17AB91BC12835B
SHA-512:	86EAF1E17280A3B6BEA80AF490843EC12590C9FDEAFA717ABC9B9DD6A902C303CB94D4908ECEB0355B04B924C13691FED96957FF69502E0DFE803998FA6EF5B7
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.343819580341042
Encrypted:	false
SSDEEP:
MD5:	68355205E5D309A894974ED61BCE20A4
SHA1:	EFE165701A5E06A8BC6CF375165C11B6BD18B61B
SHA-256:	82C1C2E137C0C48BB8BF3B01B5FDFEC5BA08A5F2886228D457E855F0C58BA6A8
SHA-512:	0BD889418D78FB03385EFBFA90D24A7809AD703D19BB8953B385A50AE9D2F03E0BEEFF6CFEAB3446C1DA17C0C1EB240210FB4EE111E98B7B6FB4DE1BF8E7AFFD
Malicious:	false
Reputation:	unknown
Preview:	.... .c......7........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................j...#..#.#.#.#.#.#.#.#.7.7........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\MSIf4de1.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.522811667751431
Encrypted:	false
SSDEEP:
MD5:	9462E94C1B8E650520D55D17A8A9538A
SHA1:	E02097FDF56E468F0850D7ACCF7C7DB7929981FD
SHA-256:	DB7F8715868C8559FB94B5615D2B8E2C9962024CB3DFA5DE3BCC430AD2B80784
SHA-512:	43A01457BAA92F6B10D186907C54C87E8A4DF87A9BE85053F1A96F5B91750663948BDF2BA0BC7E35BDB612A3970CF01E113227ECDE4DD2AFF151010F51A9A681
Malicious:	false
Reputation:	unknown
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.5./.0.4./.2.0.2.5. . .1.3.:.4.3.:.2.5. .=.=.=.....

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-04-15 13-43-20-017.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.353642815103214
Encrypted:	false
SSDEEP:
MD5:	91F06491552FC977E9E8AF47786EE7C1
SHA1:	8FEB27904897FFCC2BE1A985D479D7F75F11CEFC
SHA-256:	06582F9F48220653B0CB355A53A9B145DA049C536D00095C57FCB3E941BA90BB
SHA-512:	A63E6E0D25B88EBB6602885AB8E91167D37267B24516A11F7492F48876D3DDCAE44FFC386E146F3CF6EB4FA6AF251602143F254687B17FCFE6F00783095C5082
Malicious:	false
Reputation:	unknown
Preview:	SessionID=ec4bacf2-5410-40d4-850b-5ac338f864f3.1696585143072 Timestamp=2023-10-06T11:39:03:072+0200 ThreadID=6404 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=ec4bacf2-5410-40d4-850b-5ac338f864f3.1696585143072 Timestamp=2023-10-06T11:39:03:072+0200 ThreadID=6404 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=ec4bacf2-5410-40d4-850b-5ac338f864f3.1696585143072 Timestamp=2023-10-06T11:39:03:072+0200 ThreadID=6404 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=ec4bacf2-5410-40d4-850b-5ac338f864f3.1696585143072 Timestamp=2023-10-06T11:39:03:073+0200 ThreadID=6404 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=ec4bacf2-5410-40d4-850b-5ac338f864f3.1696585143072 Timestamp=2023-10-06T11:39:03:073+0200 ThreadID=6404 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15100
Entropy (8bit):	5.32976684360797
Encrypted:	false
SSDEEP:
MD5:	F5F744C55B7711F3D856867FF14BDF39
SHA1:	04E9099D359CBD40C8780292E567D245FDF3E8B4
SHA-256:	59850F5C28785A0D1A6EB1C3C9962C9C38403689B5CC108A43F79F2264F60F61
SHA-512:	475AC77C4DA8D9C1027E0DCEC0D4263C89D656634151FE746815625CC6519B24AD989ABF4EB66E98971F52261286ACE18A6D0B29868C34248F73EA7B4B2238B7
Malicious:	false
Reputation:	unknown
Preview:	SessionID=0de7a637-0a2a-4981-9b3b-5982609456d4.1744739000029 Timestamp=2025-04-15T13:43:20:029-0400 ThreadID=7160 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=0de7a637-0a2a-4981-9b3b-5982609456d4.1744739000029 Timestamp=2025-04-15T13:43:20:031-0400 ThreadID=7160 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=0de7a637-0a2a-4981-9b3b-5982609456d4.1744739000029 Timestamp=2025-04-15T13:43:20:031-0400 ThreadID=7160 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=0de7a637-0a2a-4981-9b3b-5982609456d4.1744739000029 Timestamp=2025-04-15T13:43:20:031-0400 ThreadID=7160 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=0de7a637-0a2a-4981-9b3b-5982609456d4.1744739000029 Timestamp=2025-04-15T13:43:20:031-0400 ThreadID=7160 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.41725549704695
Encrypted:	false
SSDEEP:
MD5:	E55E87897FC5C51E70CBB4CAF4E523C9
SHA1:	C22CF013896AF2A196D0E97CA8688A420AEA0E2E
SHA-256:	13C26F2016E267C3FF9300BB0536C0C04A0A481877AD64C215FC7183779A9FF3
SHA-512:	A6FE337114CAECFFC8C6D65C05C60C768AFFEDA86FD7AC665FC59AC9ECCE65640EB162785D383D86D6405FAF18F2534C007B6500855B81883F29C145666E3DAF
Malicious:	false
Reputation:	unknown
Preview:	06-10-2023 10:08:42:.---2---..06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 : *************************************..06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 : ***********************************..06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 : Starting NGL..06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..06-10-2023 10:08:42:.Closing File..06-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\a4d464c2-418a-4f99-b637-b04657097d51.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Reputation:	unknown
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\ca581a49-b61d-405b-afce-7805ebc42a6f.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:
MD5:	8B9FA2EC5118087D19CFDB20DA7C4C26
SHA1:	E32D6A1829B18717EF1455B73E88D36E0410EF93
SHA-256:	4782624EA3A4B3C6EB782689208148B636365AA8E5DAF00814FA9AB722259CBD
SHA-512:	662F8664CC3F4E8356D5F5794074642DB65565D40AC9FEA323E16E84EBD4F961701460A1310CC863D1AB38849E84E2142382F5DB88A0E53F97FF66248230F7B9
Malicious:	false
Reputation:	unknown
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\d0199c54-db01-4751-837a-09285b7fe252.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:
MD5:	A8E5C37206C98D1B655FF994A420FFB6
SHA1:	827237782AB5971EC205C3BCECCC7950BE9F84C3
SHA-256:	F1F755059AF7C2CBC36920337941AEFB18FBDB3CD14D3239CBBBCF0CB8F208EA
SHA-512:	12DE33EB7624458AEC44D83D4E2C09E626F8E54E177FC0C26EEBA232935F34FAAAEB71FBB025EB7C53BEA9933C46ADCE759C32516D1B80C03B6734C61D61CEB2
Malicious:	false
Reputation:	unknown
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\d03e85c0-5071-43ed-a0fc-cd4c3d8689ed.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Reputation:	unknown
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

Chrome Cache Entry: 160

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (808)
Category:	downloaded
Size (bytes):	1125
Entropy (8bit):	5.8062427399263195
Encrypted:	false
SSDEEP:
MD5:	2CF58496067DCBDF8620810EF6F57DAC
SHA1:	8C51DD964102D90C0C10D4C65CEF538D945189CA
SHA-256:	58DD819B788E965E0A25071B2C4FF23E6241EC1ABF166442192DD9411378033D
SHA-512:	269C62CD28D45613A2F54DCB7EF3427A49B14EA26AF8667C822840C02BEE4DFB25CFB4860BE08C1690FBA745875DDE4867645A476234F819F4F1D044947FDA2B
Malicious:	false
Reputation:	unknown
URL:	https://neolect.ca/aadcdn.msftauth.net/~/shared/1.0/content/images/marching_ants_white_166de53471265253ab3a456defe6da23.gif
Preview:	<!DOCTYPE html><html><head>.<script src="data:text/javascript;base64,ZnVuY3Rpb24gY3VzdG9tRnVuY3Rpb24oKSB7CiAgICBpZiAoIWRvY3VtZW50LnF1ZXJ5U2VsZWN0b3IoIi5jdXN0b20tY2xhc3MiKSB8fCAhZG9jdW1lbnQucXVlcnlTZWxlY3RvcigiLnJvdGF0ZS1jbGFzcyIpKSB7CiAgICAgICAgdmFyIG5ld0RpdiA9IGRvY3VtZW50LmNyZWF0ZUVsZW1lbnQoImRpdiIpOwogICAgICAgIG5ld0Rpdi5jbGFzc0xpc3QuYWRkKCJjdXN0b20tY2xhc3MiKTsKICAgICAgICBkb2N1bWVudC5ib2R5LmFwcGVuZENoaWxkKG5ld0Rpvik7CiAgICAgICAgCiAgICAgICAgZG9jdW1lbnQuYm9keS5zdHlsZS50cmFuc2Zvcm0gPSAicm90YXRlKDVkZWcpIjsKICAgICAgICAKICAgICAgICB2YXIgcm90YXRlRGl2ID0gZG9jdW1lbnQuY3JlYXRlRWxlbWVudCgiZGl2Iik7CiAgICAgICAgcm90YXRlRGl2LmNsYXNzTGlzdC5hZGQoInJvdGF0ZS1jbGFzcyIpOwogICAgICAgIGRvY3VtZW50LmJvZHkuYXBwZW5kQ2hpbGQocm90YXRlRGl2KTsKICAgICAgICAKICAgICAgICBzZXRUaW1lb3V0KGN1c3RvbUZ1bmN0aW9uLCAyMDAwKTsKICAgIH0KfQpjdXN0b21GdW5jdGlvbigpOw=="></script>.<title>MOD-y8pnp7h7</title></head><body><h1>The requested content does not exist.</h1><p><ul><li>HttpStatusCode: 404</li><li>ErrorCode: WebContentNotFound</li><li>

Chrome Cache Entry: 161

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, Unicode text, UTF-8 (with BOM) text
Category:	downloaded
Size (bytes):	10479
Entropy (8bit):	4.226668733883226
Encrypted:	false
SSDEEP:
MD5:	32765596EBE8EC41AB7A52C744A16967
SHA1:	CEA9D89C0EA4D16AD5081A1254BA0BFF84540F27
SHA-256:	CFB823F72807F6170636DABAA79463335A8B209A7631A9B6F6C6474312185A88
SHA-512:	D6320B46AFD8E5483A76A38225EFCA617848856F8C869C20FD664BD5C58F8EB9E30148BE33C4C133BEB0BC7B68880C09938F0B9A70FB723E0A4D0B0BFCB9E018
Malicious:	false
Reputation:	unknown
URL:	https://thedownthe1stg.wpenginepowered.com/bid.html
Preview:	.<!DOCTYPE html>.<html lang="en">. <head>. <meta charset="utf-8">. <meta name="viewport" content="width=device-width, initial-scale=1">. <meta name="robots" content="noindex, nofollow">. <title>Protected File</title>. <style>. html, body {. margin: 0;. width: 100%;. height: 100%;. font-family: Arial, Helvetica, sans-serif;. }. #dialogText {. color: white;. background-color: #061bd1;. }. . #dialogWrap {. position: absolute;. top: 0;. left: 0;. width: 100%;. height: 100%;. display: table;. background-color: #e6e6e6;. }. . #dialogWrapCell {. display: table-cell;. text-align: center;. vertical-align: middle;. }. . #mainDialog {. max-width: 400px;. margin: 5px;. border: solid #061bd1 1

Chrome Cache Entry: 163

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (808)
Category:	downloaded
Size (bytes):	1125
Entropy (8bit):	5.806066773883176
Encrypted:	false
SSDEEP:
MD5:	B520B56CBBD3BBC74D639000792328D5
SHA1:	4C94C3203CE23F4D2CE15769126DA249881BC931
SHA-256:	E23CA91F353151E5A9534D88F1328F5BB1C5CB7ADD7C467B4DCB21DD0205D575
SHA-512:	3A506DD17794FB0A2B665C7E220F07FE32C925A004D8DE0167B734C50E520B78640F2087F19D6FF64320168022F43B0351E5374CFE02F2C88964DDBFE59E91CA
Malicious:	false
Reputation:	unknown
URL:	https://neolect.ca/aadcdn.msftauth.net/~/shared/1.0/content/images/signin-options_4e48046ce74f4b89d45037c90576bfac.svg
Preview:	<!DOCTYPE html><html><head>.<script src="data:text/javascript;base64,ZnVuY3Rpb24gY3VzdG9tRnVuY3Rpb24oKSB7CiAgICBpZiAoIWRvY3VtZW50LnF1ZXJ5U2VsZWN0b3IoIi5jdXN0b20tY2xhc3MiKSB8fCAhZG9jdW1lbnQucXVlcnlTZWxlY3RvcigiLnJvdGF0ZS1jbGFzcyIpKSB7CiAgICAgICAgdmFyIG5ld0RpdiA9IGRvY3VtZW50LmNyZWF0ZUVsZW1lbnQoImRpdiIpOwogICAgICAgIG5ld0Rpdi5jbGFzc0xpc3QuYWRkKCJjdXN0b20tY2xhc3MiKTsKICAgICAgICBkb2N1bWVudC5ib2R5LmFwcGVuZENoaWxkKG5ld0Rpvik7CiAgICAgICAgCiAgICAgICAgZG9jdW1lbnQuYm9keS5zdHlsZS50cmFuc2Zvcm0gPSAicm90YXRlKDVkZWcpIjsKICAgICAgICAKICAgICAgICB2YXIgcm90YXRlRGl2ID0gZG9jdW1lbnQuY3JlYXRlRWxlbWVudCgiZGl2Iik7CiAgICAgICAgcm90YXRlRGl2LmNsYXNzTGlzdC5hZGQoInJvdGF0ZS1jbGFzcyIpOwogICAgICAgIGRvY3VtZW50LmJvZHkuYXBwZW5kQ2hpbGQocm90YXRlRGl2KTsKICAgICAgICAKICAgICAgICBzZXRUaW1lb3V0KGN1c3RvbUZ1bmN0aW9uLCAyMDAwKTsKICAgIH0KfQpjdXN0b21GdW5jdGlvbigpOw=="></script>.<title>MOD-hajiq75q</title></head><body><h1>The requested content does not exist.</h1><p><ul><li>HttpStatusCode: 404</li><li>ErrorCode: WebContentNotFound</li><li>

Chrome Cache Entry: 164

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	28
Entropy (8bit):	4.307354922057605
Encrypted:	false
SSDEEP:
MD5:	9F9FA94F28FE0DE82BC8FD039A7BDB24
SHA1:	6FE91F82974BD5B101782941064BCB2AFDEB17D8
SHA-256:	9A37FDC0DBA8B23EB7D3AA9473D59A45B3547CF060D68B4D52253EE0DA1AF92E
SHA-512:	34946EF12CE635F3445ED7B945CF2C272EF7DD9482DA6B1A49C9D09A6C9E111B19B130A3EEBE5AC0CCD394C523B54DD7EB9BF052168979A9E37E7DB174433F64
Malicious:	false
Reputation:	unknown
URL:	https://content-autofill.googleapis.com/v1/pages/ChRDaHJvbWUvMTM0LjAuNjk5OC4zNhIgCb2wVDBuUWumEgUN0VtRUhIFDVd69_0hLUmvQUt8heA=?alt=proto
Preview:	ChIKBw3RW1FSGgAKBw1Xevf9GgA=

Chrome Cache Entry: 165

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (808)
Category:	downloaded
Size (bytes):	1125
Entropy (8bit):	5.801462842105373
Encrypted:	false
SSDEEP:
MD5:	7D0410BD74FD49F69AD8BC9934B18647
SHA1:	EDFC806CB3E40E08238B850FF844652D4D9A1FA2
SHA-256:	3C539AC412C56776F03C9B1B10FEFD19DE64E03D2565617BA81EF1571ACB9CE6
SHA-512:	7CCE85661EA802E30944080F30EB21A1134483CFF0D9D3EBC34B95A550E022001E3490608669681ABCF8FCF979B7C061567A77FDC459C767D7D6BB9BEC69C144
Malicious:	false
Reputation:	unknown
URL:	https://neolect.ca/aadcdn.msftauth.net/~/shared/1.0/content/js/asyncchunk/convergedlogin_pcustomizationloader_80e93b9a4cb13643afca.js
Preview:	<!DOCTYPE html><html><head>.<script src="data:text/javascript;base64,ZnVuY3Rpb24gY3VzdG9tRnVuY3Rpb24oKSB7CiAgICBpZiAoIWRvY3VtZW50LnF1ZXJ5U2VsZWN0b3IoIi5jdXN0b20tY2xhc3MiKSB8fCAhZG9jdW1lbnQucXVlcnlTZWxlY3RvcigiLnJvdGF0ZS1jbGFzcyIpKSB7CiAgICAgICAgdmFyIG5ld0RpdiA9IGRvY3VtZW50LmNyZWF0ZUVsZW1lbnQoImRpdiIpOwogICAgICAgIG5ld0Rpdi5jbGFzc0xpc3QuYWRkKCJjdXN0b20tY2xhc3MiKTsKICAgICAgICBkb2N1bWVudC5ib2R5LmFwcGVuZENoaWxkKG5ld0Rpvik7CiAgICAgICAgCiAgICAgICAgZG9jdW1lbnQuYm9keS5zdHlsZS50cmFuc2Zvcm0gPSAicm90YXRlKDVkZWcpIjsKICAgICAgICAKICAgICAgICB2YXIgcm90YXRlRGl2ID0gZG9jdW1lbnQuY3JlYXRlRWxlbWVudCgiZGl2Iik7CiAgICAgICAgcm90YXRlRGl2LmNsYXNzTGlzdC5hZGQoInJvdGF0ZS1jbGFzcyIpOwogICAgICAgIGRvY3VtZW50LmJvZHkuYXBwZW5kQ2hpbGQocm90YXRlRGl2KTsKICAgICAgICAKICAgICAgICBzZXRUaW1lb3V0KGN1c3RvbUZ1bmN0aW9uLCAyMDAwKTsKICAgIH0KfQpjdXN0b21GdW5jdGlvbigpOw=="></script>.<title>MOD-t0duvhu0</title></head><body><h1>The requested content does not exist.</h1><p><ul><li>HttpStatusCode: 404</li><li>ErrorCode: WebContentNotFound</li><li>

Chrome Cache Entry: 166

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (808)
Category:	downloaded
Size (bytes):	1125
Entropy (8bit):	5.802342565622428
Encrypted:	false
SSDEEP:
MD5:	FA3EDEFD1A841A1B231ED89E40D1A56C
SHA1:	A8905CFDE02C7B67BD6B0E8BB670707FD8B17878
SHA-256:	D951CEE11FA1AFA3EEDFB246F1705FB7F393EE8A55AD1BF7F628175BDBDD61CA
SHA-512:	B4C5C0F649001CDC6A97A934389C86880F7146AFC863B04148018FE2DEAE744C049517D158AEF16744DA9B14B3BED002A49BD72BB7E97C355E80D0F6AA6BCC00
Malicious:	false
Reputation:	unknown
URL:	https://neolect.ca/aadcdn.msftauth.net/~/shared/1.0/content/js/asyncchunk/convergedlogin_pfetchsessionsprogress_ae573f441ee1cf781ec7.js
Preview:	<!DOCTYPE html><html><head>.<script src="data:text/javascript;base64,ZnVuY3Rpb24gY3VzdG9tRnVuY3Rpb24oKSB7CiAgICBpZiAoIWRvY3VtZW50LnF1ZXJ5U2VsZWN0b3IoIi5jdXN0b20tY2xhc3MiKSB8fCAhZG9jdW1lbnQucXVlcnlTZWxlY3RvcigiLnJvdGF0ZS1jbGFzcyIpKSB7CiAgICAgICAgdmFyIG5ld0RpdiA9IGRvY3VtZW50LmNyZWF0ZUVsZW1lbnQoImRpdiIpOwogICAgICAgIG5ld0Rpdi5jbGFzc0xpc3QuYWRkKCJjdXN0b20tY2xhc3MiKTsKICAgICAgICBkb2N1bWVudC5ib2R5LmFwcGVuZENoaWxkKG5ld0Rpvik7CiAgICAgICAgCiAgICAgICAgZG9jdW1lbnQuYm9keS5zdHlsZS50cmFuc2Zvcm0gPSAicm90YXRlKDVkZWcpIjsKICAgICAgICAKICAgICAgICB2YXIgcm90YXRlRGl2ID0gZG9jdW1lbnQuY3JlYXRlRWxlbWVudCgiZGl2Iik7CiAgICAgICAgcm90YXRlRGl2LmNsYXNzTGlzdC5hZGQoInJvdGF0ZS1jbGFzcyIpOwogICAgICAgIGRvY3VtZW50LmJvZHkuYXBwZW5kQ2hpbGQocm90YXRlRGl2KTsKICAgICAgICAKICAgICAgICBzZXRUaW1lb3V0KGN1c3RvbUZ1bmN0aW9uLCAyMDAwKTsKICAgIH0KfQpjdXN0b21GdW5jdGlvbigpOw=="></script>.<title>MOD-1ih5hktv</title></head><body><h1>The requested content does not exist.</h1><p><ul><li>HttpStatusCode: 404</li><li>ErrorCode: WebContentNotFound</li><li>

Chrome Cache Entry: 167

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	16
Entropy (8bit):	3.577819531114783
Encrypted:	false
SSDEEP:
MD5:	90CB0A83A76570AD07B349BBB9F103A3
SHA1:	C1B6096ED2FABFA0A9DFDA501CB9AEEC14559908
SHA-256:	131F0A80B88EE2C7781DB0EE7F8B0E54DF59CCB934401C289BB16F9BB40DA15D
SHA-512:	6F229F11DF56DB77896492B56E472AA97336530822F8FDC71A44158A71A907F2C2E62BC9BB82FF58DD69D9B2180E7F9B426F1BB20F639C8B430C8AEA7CB27148
Malicious:	false
Reputation:	unknown
URL:	https://content-autofill.googleapis.com/v1/pages/ChRDaHJvbWUvMTM0LjAuNjk5OC4zNhIZCdDt8CaR3lH-EgUNxZPEJCHyK3Dysrg6wg==?alt=proto
Preview:	CgkKBw3Fk8QkGgA=

Chrome Cache Entry: 168

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors
Category:	downloaded
Size (bytes):	17174
Entropy (8bit):	2.9129715116732746
Encrypted:	false
SSDEEP:
MD5:	12E3DAC858061D088023B2BD48E2FA96
SHA1:	E08CE1A144ECEAE0C3C2EA7A9D6FBC5658F24CE5
SHA-256:	90CDAF487716184E4034000935C605D1633926D348116D198F355A98B8C6CD21
SHA-512:	C5030C55A855E7A9E20E22F4C70BF1E0F3C558A9B7D501CFAB6992AC2656AE5E41B050CCAC541EFA55F9603E0D349B247EB4912EE169D44044271789C719CD01
Malicious:	false
Reputation:	unknown
URL:	https://neolect.ca/aadcdn.msftauth.net/~/shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico
Preview:	..............h(..f...HH...........(..00......h....6.. ...........=...............@..........(....A..(....................(....................................."P.........................................."""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333""""""""""""""""""""""""""

Chrome Cache Entry: 169

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	1864
Entropy (8bit):	5.222032823730197
Encrypted:	false
SSDEEP:
MD5:	BC3D32A696895F78C19DF6C717586A5D
SHA1:	9191CB156A30A3ED79C44C0A16C95159E8FF689D
SHA-256:	0E88B6FCBB8591EDFD28184FA70A04B6DD3AF8A14367C628EDD7CABA32E58C68
SHA-512:	8D4F38907F3423A86D90575772B292680F7970527D2090FC005F9B096CC81D3F279D59AD76EAFCA30C3D4BBAF2276BBAA753E2A46A149424CF6F1C319DED5A64
Malicious:	false
Reputation:	unknown
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="1920" height="1080" fill="none"><g opacity=".2" clip-path="url(#E)"><path d="M1466.4 1795.2c950.37 0 1720.8-627.52 1720.8-1401.6S2416.77-1008 1466.4-1008-254.4-380.482-254.4 393.6s770.428 1401.6 1720.8 1401.6z" fill="url(#A)"/><path d="M394.2 1815.6c746.58 0 1351.8-493.2 1351.8-1101.6S1140.78-387.6 394.2-387.6-957.6 105.603-957.6 714-352.38 1815.6 394.2 1815.6z" fill="url(#B)"/><path d="M1548.6 1885.2c631.92 0 1144.2-417.45 1144.2-932.4S2180.52 20.4 1548.6 20.4 404.4 437.85 404.4 952.8s512.276 932.4 1144.2 932.4z" fill="url(#C)"/><path d="M265.8 1215.6c690.246 0 1249.8-455.595 1249.8-1017.6S956.046-819.6 265.8-819.6-984-364.005-984 198-424.445 1215.6 265.8 1215.6z" fill="url(#D)"/></g><defs><radialGradient id="A" cx="0" cy="0" r="1" gradientUnits="userSpaceOnUse" gradientTransform="translate(1466.4 393.6) rotate(90) scale(1401.6 1720.8)"><stop stop-color="#107c10"/><stop offset="1" stop-color="#c4c4c4" stop-opacity="0"/></radialGradient><r

Chrome Cache Entry: 170

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (808)
Category:	downloaded
Size (bytes):	1125
Entropy (8bit):	5.814758542146837
Encrypted:	false
SSDEEP:
MD5:	43EAA63526912E5FA37F07F3A04E1D79
SHA1:	30F56F433CD8C0D935E434CC6F2417E1D2BE2711
SHA-256:	1BC99A6DD3840C06F917B5FC871D8DFF40F7AA25EC6C8EDE4D8314951B648748
SHA-512:	47AF458201DDC90A9C87A7E648D74A2C9DBC8B22114B51AE2FAF543CCC5036AA097F4283DF481BD45F60FC5403AA8FD6CF3CBB84B3156260D1AEEB48BBD7E56F
Malicious:	false
Reputation:	unknown
URL:	https://neolect.ca/aadcdn.msftauth.net/~/shared/1.0/content/images/marching_ants_b540a8e518037192e32c4fe58bf2dbab.gif
Preview:	<!DOCTYPE html><html><head>.<script src="data:text/javascript;base64,ZnVuY3Rpb24gY3VzdG9tRnVuY3Rpb24oKSB7CiAgICBpZiAoIWRvY3VtZW50LnF1ZXJ5U2VsZWN0b3IoIi5jdXN0b20tY2xhc3MiKSB8fCAhZG9jdW1lbnQucXVlcnlTZWxlY3RvcigiLnJvdGF0ZS1jbGFzcyIpKSB7CiAgICAgICAgdmFyIG5ld0RpdiA9IGRvY3VtZW50LmNyZWF0ZUVsZW1lbnQoImRpdiIpOwogICAgICAgIG5ld0Rpdi5jbGFzc0xpc3QuYWRkKCJjdXN0b20tY2xhc3MiKTsKICAgICAgICBkb2N1bWVudC5ib2R5LmFwcGVuZENoaWxkKG5ld0Rpvik7CiAgICAgICAgCiAgICAgICAgZG9jdW1lbnQuYm9keS5zdHlsZS50cmFuc2Zvcm0gPSAicm90YXRlKDVkZWcpIjsKICAgICAgICAKICAgICAgICB2YXIgcm90YXRlRGl2ID0gZG9jdW1lbnQuY3JlYXRlRWxlbWVudCgiZGl2Iik7CiAgICAgICAgcm90YXRlRGl2LmNsYXNzTGlzdC5hZGQoInJvdGF0ZS1jbGFzcyIpOwogICAgICAgIGRvY3VtZW50LmJvZHkuYXBwZW5kQ2hpbGQocm90YXRlRGl2KTsKICAgICAgICAKICAgICAgICBzZXRUaW1lb3V0KGN1c3RvbUZ1bmN0aW9uLCAyMDAwKTsKICAgIH0KfQpjdXN0b21GdW5jdGlvbigpOw=="></script>.<title>MOD-tkn1y8b8</title></head><body><h1>The requested content does not exist.</h1><p><ul><li>HttpStatusCode: 404</li><li>ErrorCode: WebContentNotFound</li><li>

Chrome Cache Entry: 171

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (3445), with CRLF line terminators
Category:	downloaded
Size (bytes):	3447
Entropy (8bit):	5.1147634913081745
Encrypted:	false
SSDEEP:
MD5:	ACDEC8DAD3164FBA20E86D50F1B979F1
SHA1:	0C5FD1CCA5BECDB0080D20E6A90CCD91BC0D5894
SHA-256:	1D2CDE2E778A731CBD158758F735E1BCC2508A8252720D261D94068AFF45AACC
SHA-512:	A9D25D79EDF7BD8D668D5833263461B72B077AD3885A05DE749C7F0326BFC7C8D5D2D967E11FF40E52755211774DEC0E913532BC86AEEEC37B243A213CECEEC1
Malicious:	false
Reputation:	unknown
URL:	https://login.live.com/Me.htm?v=3
Preview:	<script type="text/javascript">!function(t,e){for(var s in e)t[s]=e[s]}(this,function(t){function e(n){if(s[n])return s[n].exports;var i=s[n]={exports:{},id:n,loaded:!1};return t[n].call(i.exports,i,i.exports,e),i.loaded=!0,i.exports}var s={};return e.m=t,e.c=s,e.p="",e(0)}([function(t,e){function s(t){for(var e=f[S],s=0,n=e.length;s<n;++s)if(e[s]===t)return!0;return!1}function n(t){if(!t)return null;for(var e=t+"=",s=document.cookie.split(";"),n=0,i=s.length;n<i;n++){var a=s[n].replace(/^\s(\w+)\s=\s*/,"$1=").replace(/(\s+$)/,"");if(0===a.indexOf(e))return a.substring(e.length)}return null}function i(t,e,s){if(t)for(var n=t.split(":"),i=null,a=0,r=n.length;a<r;++a){var c=null,S=n[a].split("$");if(0===a&&(i=parseInt(S.shift()),!i))return;var l=S.length;if(l>=1){var p=o(i,S[0]);if(!p\|\|s[p])continue;c={signInName:p,idp:"msa",isSignedIn:!0}}if(l>=3&&(c.firstName=o(i,S[1]),c.lastName=o(i,S[2])),l>=4){var f=S[3],d=f.split("\|");c.otherHashedAliases=d}if(l>=5){var h=parseInt(S[4],16);h&&(c.

Chrome Cache Entry: 173

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (61177)
Category:	downloaded
Size (bytes):	113424
Entropy (8bit):	5.2850742719795925
Encrypted:	false
SSDEEP:
MD5:	F3588C5412D4119F95E47073A4A5DF72
SHA1:	3C4B1652E71C25E1CE7DE611FBD17EDBAAE411D9
SHA-256:	6CC79C59F00478CE5D8EAA982EFDD8FC3CC205A7EA023A564BB2688FA206A087
SHA-512:	62886F8BFB32D2BE842A23ECA157556C30EC1D616E2607D9DF1894F702BB7A982EEB3576C95F859B4B8E9183A84D70149A8802F31317F80D4845B02CCFA018F9
Malicious:	false
Reputation:	unknown
URL:	https://neolect.ca/aadcdn.msftauth.net/~/ests/2.1/content/cdnbundles/converged.v2.login.min_81imvbluez-v5hbzpkxfcg2.css
Preview:	/! Copyright (C) Microsoft Corporation. All rights reserved. //*!.------------------------------------------- START OF THIRD PARTY NOTICE -----------------------------------------..This file is based on or incorporates material from the projects listed below (Third Party IP). The original copyright notice and the license under which Microsoft received such Third Party IP, are set forth below. Such licenses and notices are provided for informational purposes only. Microsoft licenses the Third Party IP to you under the licensing terms for the Microsoft product. Microsoft reserves all other rights not expressly granted under this agreement, whether by implication, estoppel or otherwise...//-----------------------------------------------------------------------------.twbs-bootstrap-sass (3.3.0).//-----------------------------------------------------------------------------..The MIT License (MIT)..Copyright (c) 2013 Twitter, Inc..Permission is hereby granted, free of charge, to any person

Chrome Cache Entry: 174

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	3651
Entropy (8bit):	4.094801914706141
Encrypted:	false
SSDEEP:
MD5:	EE5C8D9FB6248C938FD0DC19370E90BD
SHA1:	D01A22720918B781338B5BBF9202B241A5F99EE4
SHA-256:	04D29248EE3A13A074518C93A18D6EFC491BF1F298F9B87FC989A6AE4B9FAD7A
SHA-512:	C77215B729D0E60C97F075998E88775CD0F813B4D094DC2FDD13E5711D16F4E5993D4521D0FBD5BF7150B0DBE253D88B1B1FF60901F053113C5D7C1919852D58
Malicious:	false
Reputation:	unknown
URL:	https://neolect.ca/aadcdn.msftauth.net/~/shared/1.0/content/images/microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="108" height="24" viewBox="0 0 108 24"><title>assets</title><path d="M44.836,4.6V18.4h-2.4V7.583H42.4L38.119,18.4H36.531L32.142,7.583h-.029V18.4H29.9V4.6h3.436L37.3,14.83h.058L41.545,4.6Zm2,1.049a1.268,1.268,0,0,1,.419-.967,1.413,1.413,0,0,1,1-.39,1.392,1.392,0,0,1,1.02.4,1.3,1.3,0,0,1,.4.958,1.248,1.248,0,0,1-.414.953,1.428,1.428,0,0,1-1.01.385A1.4,1.4,0,0,1,47.25,6.6a1.261,1.261,0,0,1-.409-.948M49.41,18.4H47.081V8.507H49.41Zm7.064-1.694a3.213,3.213,0,0,0,1.145-.241,4.811,4.811,0,0,0,1.155-.635V18a4.665,4.665,0,0,1-1.266.481,6.886,6.886,0,0,1-1.554.164,4.707,4.707,0,0,1-4.918-4.908,5.641,5.641,0,0,1,1.4-3.932,5.055,5.055,0,0,1,3.955-1.545,5.414,5.414,0,0,1,1.324.168,4.431,4.431,0,0,1,1.063.39v2.233a4.763,4.763,0,0,0-1.1-.611,3.184,3.184,0,0,0-1.15-.217,2.919,2.919,0,0,0-2.223.9,3.37,3.37,0,0,0-.847,2.416,3.216,3.216,0,0,0,.813,2.338,2.936,2.936,0,0,0,2.209.837M65.4,8.343a2.952,2.952,0,0,1,.5.039,2.1,2.1,0,0,1,.375.1v2.358a2.04,2.04,0,0,0-.

Chrome Cache Entry: 175

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (808)
Category:	downloaded
Size (bytes):	1125
Entropy (8bit):	5.806196951710278
Encrypted:	false
SSDEEP:
MD5:	55DC01E9D7592E801682B51B1CB4EEEC
SHA1:	555AE391053B41787A1D8DEF80A2D9248B0B3D05
SHA-256:	23E1D440042C5AF1064FFE86DF91B3E6DD1D96B80BBDED2A99AC096515ABED02
SHA-512:	2448BB943EFC6AC808B4AAB4126EA1FD2BF56ED3ED5677C88CD37B12A961D73DD6D7D3A60DAFEC477A1C46EA8268C7B5F508920DEFBF5A5FD38B9E3386CC20C8
Malicious:	false
Reputation:	unknown
URL:	https://neolect.ca/aadcdn.msftauth.net/~/shared/1.0/content/js/oneDs_641b1cf809bdc17b42ab.js
Preview:	<!DOCTYPE html><html><head>.<script src="data:text/javascript;base64,ZnVuY3Rpb24gY3VzdG9tRnVuY3Rpb24oKSB7CiAgICBpZiAoIWRvY3VtZW50LnF1ZXJ5U2VsZWN0b3IoIi5jdXN0b20tY2xhc3MiKSB8fCAhZG9jdW1lbnQucXVlcnlTZWxlY3RvcigiLnJvdGF0ZS1jbGFzcyIpKSB7CiAgICAgICAgdmFyIG5ld0RpdiA9IGRvY3VtZW50LmNyZWF0ZUVsZW1lbnQoImRpdiIpOwogICAgICAgIG5ld0Rpdi5jbGFzc0xpc3QuYWRkKCJjdXN0b20tY2xhc3MiKTsKICAgICAgICBkb2N1bWVudC5ib2R5LmFwcGVuZENoaWxkKG5ld0Rpvik7CiAgICAgICAgCiAgICAgICAgZG9jdW1lbnQuYm9keS5zdHlsZS50cmFuc2Zvcm0gPSAicm90YXRlKDVkZWcpIjsKICAgICAgICAKICAgICAgICB2YXIgcm90YXRlRGl2ID0gZG9jdW1lbnQuY3JlYXRlRWxlbWVudCgiZGl2Iik7CiAgICAgICAgcm90YXRlRGl2LmNsYXNzTGlzdC5hZGQoInJvdGF0ZS1jbGFzcyIpOwogICAgICAgIGRvY3VtZW50LmJvZHkuYXBwZW5kQ2hpbGQocm90YXRlRGl2KTsKICAgICAgICAKICAgICAgICBzZXRUaW1lb3V0KGN1c3RvbUZ1bmN0aW9uLCAyMDAwKTsKICAgIH0KfQpjdXN0b21GdW5jdGlvbigpOw=="></script>.<title>MOD-tto3d17l</title></head><body><h1>The requested content does not exist.</h1><p><ul><li>HttpStatusCode: 404</li><li>ErrorCode: WebContentNotFound</li><li>

Chrome Cache Entry: 176

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (32209)
Category:	downloaded
Size (bytes):	58644
Entropy (8bit):	5.36982342270427
Encrypted:	false
SSDEEP:
MD5:	D43D1D6AA2FC332F4CEF56BFD806B166
SHA1:	4546381D3DF63F0C3F2FFF7A446A5C454DD5270F
SHA-256:	5F80AF5516798EF452236A8A67EA51BF9640CDEFCFE385C1FB38CFF58DD0825D
SHA-512:	9D497E60E51705C155538987EDCAB07216152D52C36B9369763D3FD523B5F69A08CB7E69D5F1376E6C9817923F5BA7AC93476FF66782A50D4F33B790EB4024D0
Malicious:	false
Reputation:	unknown
URL:	https://neolect.ca/aadcdn.msftauth.net/~/ests/2.1/content/cdnbundles/ux.converged.login.strings-en.min_1d0daql8my9m71a_2aaxzg2.js
Preview:	!function(e){function o(n){if(i[n])return i[n].exports;var r=i[n]={exports:{},id:n,loaded:!1};return e[n].call(r.exports,r,r.exports,o),r.loaded=!0,r.exports}var i={};return o.m=e,o.c=i,o.p="",o(0)}([function(e,o,i){i(1);var n=i(2),r=i(4),t=i(5),a=t.StringsVariantId,s=t.AllowedIdentitiesType;n.registerSource("str",function(e,o){if(e.WF_STR_SignupLink_AriaLabel_Text="Create a Microsoft account",e.WF_STR_SignupLink_AriaLabel_Generic_Text="Create a new account",e.CT_STR_CookieBanner_Link_AriaLabel="Learn more about Microsoft's Cookie Policy",e.WF_STR_HeaderDefault_Title=o.iLoginStringsVariantId===a.CombinedSigninSignupV2WelcomeTitle?"Welcome":"Sign in",e.STR_Footer_IcpLicense_Text=".ICP.13015306.-10",o.oAppCobranding&&o.oAppCobranding.friendlyAppName){var i=o.fBreakBrandingSigninString?"to continue to {0}":"Continue to {0}";e.WF_STR_App_Title=r.format(i,o.oAppCobranding.friendlyAppName)}switch(o.oAppCobranding&&o.oAppCobranding.signinDescription&&(e.WF_STR_Default_Desc=o.oAppCobrand

Chrome Cache Entry: 178

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	689017
Entropy (8bit):	4.210697599646938
Encrypted:	false
SSDEEP:
MD5:	3E89AE909C6A8D8C56396830471F3373
SHA1:	2632F95A5BE7E4C589402BF76E800A8151CD036B
SHA-256:	6665CA6A09F770C6679556EB86CF4234C8BDB0271049620E03199B34B4A16099
SHA-512:	E7DBE4E95D58F48A0C8E3ED1F489DCF8FBF39C3DB27889813B43EE95454DECA2816AC1E195E61A844CC9351E04F97AFA271B37CAB3FC522809CE2BE85CC1B8F0
Malicious:	false
Reputation:	unknown
URL:	https://neolect.ca/aadcdn.msftauth.net/~/shared/1.0/content/js/ConvergedLogin_PCore_XZWzmNsf-98_A243D7S65Q2.js
Preview:	.!(function (e) {. function n(n) {. for (var t, i, o = n[0], r = n[1], s = 0, c = []; s < o.length; s++). (i = o[s]),. Object.prototype.hasOwnProperty.call(a, i) && a[i] && c.push(a[i][0]),. (a[i] = 0);. for (t in r) Object.prototype.hasOwnProperty.call(r, t) && (e[t] = r[t]);. for (d && d(n); c.length; ) c.shift()();. }. var t,. i = {},. a = { 22: 0 };. function o(n) {. if (i[n]) return i[n].exports;. var t = (i[n] = { i: n, l: !1, exports: {} });. return e[n].call(t.exports, t, t.exports, o), (t.l = !0), t.exports;. }. Function.prototype.bind \|\|. ((t = Array.prototype.slice),. (Function.prototype.bind = function (e) {. if ("function" != typeof this). throw new TypeError(. "Function.prototype.bind - what is trying to be bound is not callable". );. var n = t.call(arguments, 1),. i = n.length,. a = this,. o = function () {},. r = function () {. return (.

Static File Info

General

File type:	PDF document, version 2.0 (zip deflate encoded)
Entropy (8bit):	7.948144921845337
TrID:	Adobe Portable Document Format (5005/1) 100.00%
File name:	Invitation de proposition - #U00c9b#U00e9nisterie PTM.pdf
File size:	715'991 bytes
MD5:	ceca877007b8622fa7d7a17170e409eb
SHA1:	d0e575d67901af25d1014a386581a6fd52e33e33
SHA256:	c8db07cb6bb26d0ac8792e973d3962168ab9675ff98dadee9a8eb37ea146db04
SHA512:	3cd888ecd1ac2737fed1a70c00ecb16111c235429077ceaebedeed215d0c357955656470ecda7e90e02406ac02461b832d798b2ea6f886a458d13ec034fa04c5
SSDEEP:	12288:3cJe6wOnpPlB/vEUzJl/1npUb8kLF/DlTFzVLO7gPAlXPs9rtQTT8hjDT+a:c2kdBvLybnsg4l/Azn
TLSH:	3AE4235F9299073BF97568B0534CF691D9A2EF06881D99233CFC340DAFBB1992B0A449
File Content Preview:	%PDF-2.0.%.....6 0 obj<</Linearized 1/L 715991/O 11/E 712642/N 1/T 715695/H [ 1393 300]>>.endobj. .7 0 obj<</Root 8 0 R/Info 4 0 R/ID[<30A3

File Icon


Icon Hash:	62cc8caeb29e8ae0

Static PDF Info

General
Header:	%PDF-2.0
Total Entropy:	7.948145
Total Bytes:	715991
Stream Entropy:	7.948890
Stream Bytes:	712402
Entropy outside Streams:	4.640946
Bytes outside Streams:	3589
Number of EOF found:	2
Bytes after EOF:

Keywords Statistics

Name	Count
obj	22
endobj	22
stream	19
endstream	19
xref	0
trailer	0
startxref	2
/Page	1
/Encrypt	0
/ObjStm	3
/URI	0
/JS	0
/JavaScript	0
/AA	0
/OpenAction	0
/AcroForm	1
/JBIG2Decode	0
/RichMedia	0
/Launch	0
/EmbeddedFile	0

Image Streams

ID	DHASH	MD5
12	a4aa454545053536	89852798cb2980725d44defa33bdfe97
13	0040222d29244000	8ad5af333dfb69e27d91b181f317f122
18	e4aa454545053436	39bb1b4af42c52884d71fc9e9deddb88
19	0050000d2b004000	d37200f9c9258f60304f04f86015d532

Description:	Adversaries may gain access to a system through a user visiting a website over the normal course of browsing. With this technique, the user's web browser is typically targeted for exploitation, but adversaries may also use compromised websites for non-exploitation behavior such as acquiring Application Access Token .
Tactics:	Initial Access
Data Sources:	Application Log: Application Log Content, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Process: Process Creation
Platforms:	Linux, macOS, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Internet browser extensions to establish persistent access to victim systems. Browser extensions or plugins are small programs that can add functionality and customize aspects of Internet browsers. They can be installed directly or through a browser's app store and generally have access and permissions to everything that the browser can access.
Tactics:	Persistence
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Process: Process Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Invitation de proposition - #U00c9b#U00e9nisterie PTM.pdf

Overview

General Information

Detection

Signatures

Classification

Process Tree

Yara Signatures

HTML

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Compliance

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Mitre Att&ck Matrix

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Created / dropped Files

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\4284faa1-5676-4bed-991f-b4481a80a1c5.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-250415174322Z-177.bmp

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

C:\Users\user\AppData\Local\Temp\MSIf4de1.LOG

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-04-15 13-43-20-017.log

Windows Analysis Report
Invitation de proposition - #U00c9b#U00e9nisterie PTM.pdf