Edit tour

Windows Analysis Report
https://support.microsoft.com/en-us/windows/protect-yourself-from-phishing-0c7ea947-ba98-3bd9-7184-430e1f860a44

Overview

General Information

Sample URL:	https://support.microsoft.com/en-us/windows/protect-yourself-from-phishing-0c7ea947-ba98-3bd9-7184-430e1f860a44
Analysis ID:	1296950
Infos:

Detection

Score:	1
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

HTML body contains low number of good links

Found iframes

HTML title does not match URL

Classification

Process Tree

System is w10x64

chrome.exe (PID: 5180 cmdline: C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank MD5: 8D1C4713ACB7CC2AAAEE4477C58A80BA)

chrome.exe (PID: 2444 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2064 --field-trial-handle=1900,i,7809552101022236451,14928734409077466690,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 8D1C4713ACB7CC2AAAEE4477C58A80BA)

chrome.exe (PID: 6128 cmdline: C:\Program Files\Google\Chrome\Application\chrome.exe" "https://support.microsoft.com/en-us/windows/protect-yourself-from-phishing-0c7ea947-ba98-3bd9-7184-430e1f860a44 MD5: 8D1C4713ACB7CC2AAAEE4477C58A80BA)

cleanup

Joe Sandbox Signatures

• Phishing
• Compliance
• Networking
• System Summary

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=ee272b19-4411-433f-8f28-5c13cb6fd407&redirect_uri=https%3A%2F%2Fsupport.microsoft.com%2Fsignin-oidc&response_type=code%20id_token&scope=openid%20profile%20offline_access&response_mode=form_post&nonce=638285000705610619.YmVlYTYzZmQtMzEwNy00NWY5LWIxMTEtMTM2MDdlNTI1OWI5ZmI1ODkzMTktN2U2YS00NTkxLWI1MjUtYTk3YzRkN2E5ZmVh&prompt=none&nopa=2&state=CfDJ8Kiuy_B5JgFMo7PeP95NLhoLm2Ehph1Je5u01rRx-t_7OBzMQpLmki2k18CUUIKhHBPYsPnR45X6pJrAn3HRDvuKFqAoU9-Dxxyt917-owfpjG0lGY1WyrMKgaimkzbJmphHdn-cq2rGLTPto27ZmjlB_4ShXJ-oOFmO4ypQ_30r-qGeqeRdDSOqbWq4pCOIFy2EsY7fSSSbxDR8bSODE0kSHezWwEOe7J0BsbihVlt0ipkWoQJaYCcuvJBTnfWOK6GOmEVjdu0pSry4wP0td3ZOJpwUtupNwkZTlrv1QgbdY9tGlOz8VpHImk88_nKVIuPzD5UzAfh4YpUlxvVJqJg8CGgkInG76Qu5usgmbhgK&x-client-SKU=ID_NET6_0&x-client-ver=6.30.1.0

HTTP Parser: Number of links: 0

HTTP Parser: Iframe src: https://login.live.com/Me.htm?v=3

HTTP Parser: Title: Redirecting does not match URL

HTTP Parser: No <meta name="author".. found

Source: https://support.microsoft.com/en-us/silentsigninhandler	HTTP Parser: No favicon
Source: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=ee272b19-4411-433f-8f28-5c13cb6fd407&redirect_uri=https%3A%2F%2Fsupport.microsoft.com%2Fsignin-oidc&response_type=code%20id_token&scope=openid%20profile%20offline_access&response_mode=form_post&nonce=638285000705610619.YmVlYTYzZmQtMzEwNy00NWY5LWIxMTEtMTM2MDdlNTI1OWI5ZmI1ODkzMTktN2U2YS00NTkxLWI1MjUtYTk3YzRkN2E5ZmVh&prompt=none&nopa=2&state=CfDJ8Kiuy_B5JgFMo7PeP95NLhoLm2Ehph1Je5u01rRx-t_7OBzMQpLmki2k18CUUIKhHBPYsPnR45X6pJrAn3HRDvuKFqAoU9-Dxxyt917-owfpjG0lGY1WyrMKgaimkzbJmphHdn-cq2rGLTPto27ZmjlB_4ShXJ-oOFmO4ypQ_30r-qGeqeRdDSOqbWq4pCOIFy2EsY7fSSSbxDR8bSODE0kSHezWwEOe7J0BsbihVlt0ipkWoQJaYCcuvJBTnfWOK6GOmEVjdu0pSry4wP0td3ZOJpwUtupNwkZTlrv1QgbdY9tGlOz8VpHImk88_nKVIuPzD5UzAfh4YpUlxvVJqJg8CGgkInG76Qu5usgmbhgK&x-client-SKU=ID_NET6_0&x-client-ver=6.30.1.0	HTTP Parser: No favicon

HTTP Parser: No <meta name="copyright".. found

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_BITS_5180_1335659937	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5180_608054574	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5180_608054574\keys.json	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5180_608054574\manifest.json	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5180_608054574\LICENSE	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5180_608054574\_metadata\	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5180_608054574\_metadata\verified_contents.json	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5180_608054574\manifest.fingerprint	Jump to behavior

Source: unknown

DNS traffic detected: queries for: clients2.google.com

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49980
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49958 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49980 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49933
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 49954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49960 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49855 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49957 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49803
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49920
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49960
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49821 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49918 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49933 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49918
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49917
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49959
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49958
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49957
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49956
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49955
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49954
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49917 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49856 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49959 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49955 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49904
Source: unknown	Network traffic detected: HTTP traffic on port 49920 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49846 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822

Source: global traffic	HTTP traffic detected: GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=115.0.5790.171&lang=en-US&acceptformat=crx3,puff&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1Host: clients2.google.comConnection: keep-aliveX-Goog-Update-Interactivity: fgX-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmiedaX-Goog-Update-Updater: chromecrx-115.0.5790.171Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /scripts/c/ms.analytics-web-3.2.7.min.js HTTP/1.1Host: js.monitor.azure.comConnection: keep-alivesec-ch-ua: "Not/A)Brand";v="99", "Google Chrome";v="115", "Chromium";v="115"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://support.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /mscc/lib/v2/wcp-consent.js HTTP/1.1Host: wcpstatic.microsoft.comConnection: keep-alivesec-ch-ua: "Not/A)Brand";v="99", "Google Chrome";v="115", "Chromium";v="115"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://support.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: MC1=GUID=e5d2dcf1ffc84a8ab1b87cb3a3c46ba0&HASH=e5d2&LV=202308&V=4&LU=1691661666051; ak_bmsc=36CC60E9F96BD75E9935FBEC07542EFF~000000000000000000000000000000~YAAQLiV+aLqjavqJAQAAPDblKBTUNm/CzIqAmz2uyzU0unu7V6TpcXY9td06fndSGv1ZOsrEXEUIm/6IZnQ81VDke8g3xKrdh7czmbsKUDthVwkhQ7TQROxCUjGFYjinOyIT5tOZ7iBn7ZgyZpfapOAFUi5YvKbm4cG/mwPVKURtBzcyCdIcC6hEsJuSwjcw3QOCMeYAAd6WGHzOUgJST6wRizv9ZXlDZqgGKSr5eecMuEEBjRMSqht2gZz/C6VwjUacF68MY1cxXLc0l+ww16FM4weS83df6uZlAxz0JjvQce3pVInsdBc18ba4lPFfoeRzhMQxmPB7NYCbGAPiNNX3egLnROccMhz/Xr8SWRhrEn80mQBIAitS1oPKYlQ=; bm_sv=DB7C6E29E86D2D89F97F2DD06995DBBF~YAAQLiV+aMqjavqJAQAA0DblKBSk809A7QYe5XEJUvwXC3uqdPP2RJv7fbLxfTq86YvT7Ano+3g5XYY7FbqpanWcDaDP0SQStJzFXxtbwEe25wM9TG/oYJBADl+OKlD/twiia6DxCq0LbeqPuWih4l3bP+dFoyUnui928me1rDmd66o1d/3nyUQuQE2Abcjxfqtvv4dOjHyLgX6capOZ27fecW2FEpmKdG2JE/ZSLJU9diDBb0IDE7SB3Jro0PebU0iv~1
Source: global traffic	HTTP traffic detected: GET /meversion?partner=SMCConvergence&market=en-us&uhf=1 HTTP/1.1Host: mem.gfx.msConnection: keep-alivesec-ch-ua: "Not/A)Brand";v="99", "Google Chrome";v="115", "Chromium";v="115"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://support.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /scripts/c/ms.shared.analytics.mectrl-3.2.7.gbl.min.js HTTP/1.1Host: js.monitor.azure.comConnection: keep-alivesec-ch-ua: "Not/A)Brand";v="99", "Google Chrome";v="115", "Chromium";v="115"Origin: https://support.microsoft.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://support.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/BssoInterrupt_Core_nun_Nob0yT2WjCUfgBCTog2.js HTTP/1.1Host: aadcdn.msauth.netConnection: keep-alivesec-ch-ua: "Not/A)Brand";v="99", "Google Chrome";v="115", "Chromium";v="115"Origin: https://login.microsoftonline.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/FetchSessions_Core_MFlyI4bSaXT-d8J13gRcrQ2.js HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-alivesec-ch-ua: "Not/A)Brand";v="99", "Google Chrome";v="115", "Chromium";v="115"Origin: https://login.microsoftonline.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /scripts/me/MeControl/10.23212.1/en-US/meBoot.min.js HTTP/1.1Host: mem.gfx.msConnection: keep-alivesec-ch-ua: "Not/A)Brand";v="99", "Google Chrome";v="115", "Chromium";v="115"Origin: https://support.microsoft.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://support.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /scripts/me/MeControl/10.23212.1/en-US/meCore.min.js HTTP/1.1Host: mem.gfx.msConnection: keep-alivesec-ch-ua: "Not/A)Brand";v="99", "Google Chrome";v="115", "Chromium";v="115"Origin: https://support.microsoft.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://support.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /16.000/content/js/MeControl__BG5I2QV9W9LPv5UB6EkrA2.js HTTP/1.1Host: logincdn.msauth.netConnection: keep-alivesec-ch-ua: "Not/A)Brand";v="99", "Google Chrome";v="115", "Chromium";v="115"Origin: https://login.live.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://login.live.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /me/mecache?partner=smcconvergence&wreply=https%3A%2F%2Fsupport.microsoft.com HTTP/1.1Host: mem.gfx.msConnection: keep-alivesec-ch-ua: "Not/A)Brand";v="99", "Google Chrome";v="115", "Chromium";v="115"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://support.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /3rdpartycookies HTTP/1.1Host: aka.msConnection: keep-alivesec-ch-ua: "Not/A)Brand";v="99", "Google Chrome";v="115", "Chromium";v="115"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /meversion?partner=SMCConvergence&market=en-us&uhf=1 HTTP/1.1Host: mem.gfx.msConnection: keep-alivesec-ch-ua: "Not/A)Brand";v="99", "Google Chrome";v="115", "Chromium";v="115"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://support.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/FetchSessions_Core_pj-6v8iQhdg_XFsfh0-ZIw2.js HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-alivesec-ch-ua: "Not/A)Brand";v="99", "Google Chrome";v="115", "Chromium";v="115"Origin: https://login.microsoftonline.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /me/mecache?partner=smcconvergence&wreply=https%3A%2F%2Fsupport.microsoft.com HTTP/1.1Host: mem.gfx.msConnection: keep-alivesec-ch-ua: "Not/A)Brand";v="99", "Google Chrome";v="115", "Chromium";v="115"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: iframeReferer: https://support.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /meversion?partner=mshomepage&market=de-ch&uhf=1 HTTP/1.1Host: mem.gfx.msConnection: keep-alivesec-ch-ua: "Not/A)Brand";v="99", "Google Chrome";v="115", "Chromium";v="115"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: chromecache_351.1.dr	String found in binary or memory: "sameAs":["https://www.facebook.com/microsoftschweiz","https://twitter.com/microsoft_ch","https://www.linkedin.com/company/1035","https://www.youtube.com/user/MicrosoftCH","https://www.instagram.com/microsoftch/"] equals www.facebook.com (Facebook)
Source: chromecache_351.1.dr	String found in binary or memory: "sameAs":["https://www.facebook.com/microsoftschweiz","https://twitter.com/microsoft_ch","https://www.linkedin.com/company/1035","https://www.youtube.com/user/MicrosoftCH","https://www.instagram.com/microsoftch/"] equals www.linkedin.com (Linkedin)
Source: chromecache_351.1.dr	String found in binary or memory: "sameAs":["https://www.facebook.com/microsoftschweiz","https://twitter.com/microsoft_ch","https://www.linkedin.com/company/1035","https://www.youtube.com/user/MicrosoftCH","https://www.instagram.com/microsoftch/"] equals www.twitter.com (Twitter)
Source: chromecache_351.1.dr	String found in binary or memory: "sameAs":["https://www.facebook.com/microsoftschweiz","https://twitter.com/microsoft_ch","https://www.linkedin.com/company/1035","https://www.youtube.com/user/MicrosoftCH","https://www.instagram.com/microsoftch/"] equals www.youtube.com (Youtube)
Source: chromecache_351.1.dr	String found in binary or memory: <a class="d-inline-block" href="https://www.facebook.com/microsoftschweiz" target="_blank" aria-label="Microsoft auf Facebook folgen ( equals www.facebook.com (Facebook)
Source: chromecache_351.1.dr	String found in binary or memory: <a class="d-inline-block" href="https://www.linkedin.com/company/1035" target="_blank" aria-label="Microsoft auf LinkedIn folgen ( equals www.linkedin.com (Linkedin)
Source: chromecache_351.1.dr	String found in binary or memory: <a class="d-inline-block" href="https://www.youtube.com/user/MicrosoftCH" target="_blank" aria-label="Microsoft auf YouTube folgen ( equals www.youtube.com (Youtube)

Source: chromecache_312.1.dr	String found in binary or memory: http://feross.org
Source: chromecache_284.1.dr	String found in binary or memory: http://github.com/aFarkas/lazysizes
Source: chromecache_346.1.dr	String found in binary or memory: http://github.com/requirejs/almond/LICENSE
Source: chromecache_284.1.dr	String found in binary or memory: http://github.com/requirejs/domReady
Source: chromecache_284.1.dr	String found in binary or memory: http://github.com/requirejs/requirejs/LICENSE
Source: chromecache_337.1.dr	String found in binary or memory: http://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4EIZB?ver=f4a3
Source: chromecache_351.1.dr	String found in binary or memory: http://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RWO4yJ?ver=2ab3"
Source: chromecache_351.1.dr	String found in binary or memory: http://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RWOalS?ver=cc6e"
Source: chromecache_269.1.dr, chromecache_310.1.dr	String found in binary or memory: http://knockoutjs.com/
Source: chromecache_351.1.dr	String found in binary or memory: http://schema.org/Organization
Source: chromecache_297.1.dr	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: chromecache_312.1.dr	String found in binary or memory: http://www.opensource.org/licenses/mit-license.php
Source: chromecache_269.1.dr, chromecache_310.1.dr	String found in binary or memory: http://www.opensource.org/licenses/mit-license.php)
Source: chromecache_351.1.dr	String found in binary or memory: https://accdn.lpsnmedia.net
Source: chromecache_293.1.dr	String found in binary or memory: https://aka.ms/3rdpartycookies
Source: chromecache_351.1.dr	String found in binary or memory: https://aka.ms/yourcaliforniaprivacychoices
Source: chromecache_351.1.dr	String found in binary or memory: https://analytics.tiktok.com
Source: chromecache_284.1.dr	String found in binary or memory: https://assets.onestore.ms
Source: chromecache_351.1.dr	String found in binary or memory: https://cdnssl.clicktale.net
Source: chromecache_351.1.dr	String found in binary or memory: https://cdnssl.clicktale.net/www32/ptc/05d32363-d534-4d93-9b65-cde674775e71.js
Source: chromecache_351.1.dr	String found in binary or memory: https://d.impactradius-event.com
Source: chromecache_337.1.dr	String found in binary or memory: https://eus-streaming-video-rt-microsoft-com.akamaized.net/0f937af8-d731-4ff2-a223-053a9189b20e/91f6
Source: chromecache_313.1.dr, chromecache_337.1.dr	String found in binary or memory: https://eus-streaming-video-rt-microsoft-com.akamaized.net/7070043d-58fb-4f43-b0cf-89f6dbf4bb38/91f6
Source: chromecache_265.1.dr	String found in binary or memory: https://github.com/carhartl/jquery-cookie
Source: chromecache_269.1.dr, chromecache_310.1.dr	String found in binary or memory: https://github.com/douglascrockford/JSON-js
Source: chromecache_351.1.dr	String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net
Source: chromecache_351.1.dr	String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE1Mu3b?ver=5c31
Source: chromecache_356.1.dr	String found in binary or memory: https://jquery.com/
Source: chromecache_356.1.dr	String found in binary or memory: https://jquery.org/license
Source: chromecache_356.1.dr	String found in binary or memory: https://js.foundation/
Source: chromecache_351.1.dr	String found in binary or memory: https://js.monitor.azure.com
Source: chromecache_351.1.dr	String found in binary or memory: https://login.live.com/me.srf?wa=wsignin1.0
Source: chromecache_266.1.dr	String found in binary or memory: https://login.microsoftonline.com
Source: chromecache_266.1.dr	String found in binary or memory: https://login.windows-ppe.net
Source: chromecache_351.1.dr	String found in binary or memory: https://lpcdn.lpsnmedia.net
Source: chromecache_351.1.dr	String found in binary or memory: https://lptag.liveperson.net
Source: chromecache_351.1.dr	String found in binary or memory: https://mem.gfx.ms
Source: chromecache_284.1.dr	String found in binary or memory: https://microsoftwindows.112.2o7.net
Source: chromecache_351.1.dr	String found in binary or memory: https://onedrive.live.com/about/de-ch/
Source: chromecache_351.1.dr	String found in binary or memory: https://outlook.live.com/owa/
Source: keys.json.0.dr	String found in binary or memory: https://polyset.xyz
Source: chromecache_313.1.dr, chromecache_337.1.dr	String found in binary or memory: https://prod-video-cms-rt-microsoft-com.akamaized.net/cms/api/am/videofiledata/RE4EIXC-enus?ver=e63f
Source: chromecache_313.1.dr, chromecache_337.1.dr	String found in binary or memory: https://prod-video-cms-rt-microsoft-com.akamaized.net/cms/api/am/videofiledata/RE4EIXC-tscriptenus?v
Source: keys.json.0.dr	String found in binary or memory: https://pst-issuer.hcaptcha.com
Source: chromecache_351.1.dr	String found in binary or memory: https://publisher.liveperson.net
Source: chromecache_306.1.dr	String found in binary or memory: https://raw.githubusercontent.com/jakearchibald/es6-promise/master/LICENSE
Source: chromecache_351.1.dr	String found in binary or memory: https://schema.org
Source: chromecache_356.1.dr	String found in binary or memory: https://sizzlejs.com/
Source: chromecache_351.1.dr	String found in binary or memory: https://start.microsoftapp.net/start?pc_campaign=UHF_Banner_15mkts&adjust=y9xgnyl_5sblqid"
Source: keys.json.0.dr	String found in binary or memory: https://trusttoken.dev
Source: chromecache_351.1.dr	String found in binary or memory: https://twitter.com/microsoft_ch
Source: chromecache_284.1.dr	String found in binary or memory: https://ussearchprod.trafficmanager.net/services/api/v1.0/store/categories
Source: chromecache_351.1.dr	String found in binary or memory: https://www.clarity.ms
Source: chromecache_351.1.dr	String found in binary or memory: https://www.instagram.com/microsoftch/
Source: chromecache_351.1.dr	String found in binary or memory: https://www.linkedin.com/company/1035
Source: chromecache_351.1.dr	String found in binary or memory: https://www.onenote.com/?omkt=de-CH
Source: chromecache_351.1.dr	String found in binary or memory: https://www.skype.com/de/
Source: chromecache_351.1.dr	String found in binary or memory: https://www.xbox.com/
Source: chromecache_351.1.dr	String found in binary or memory: https://www.youtube.com/user/MicrosoftCH

Source: unknown

HTTP traffic detected: POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1Host: accounts.google.comConnection: keep-aliveContent-Length: 1Origin: https://www.google.comContent-Type: application/x-www-form-urlencodedSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: CONSENT=PENDING+904; SOCS=CAISHAgCEhJnd3NfMjAyMjA4MDgtMF9SQzEaAmVuIAEaBgiAvOuXBg; AEC=Ad49MVGiijyX5dxPFAKxKYso-rIS24Ht-Pxs5fU9hHrAzfASnm-jqdQE1g; NID=511=WyMJovC2uA2AEbHQkGfP-KDdYCeg5Q7Mv6gxYT-qeugtrnXImrhmp1SixwS4ydh_E8Z0hdfCLAXvg2WUqsBSfqpx5SFvCCoeGeevqlEfkoxYi9FTISb8Cu7rr5rf9PyyNbLqf2QbxG7ja7jAB6UJQd5CPvMGcYUasORCRKRL1-arNYzfADAWHJvBLXml-Km_uewDreOyJ-MjxAI-i38Tl6LXI3zB; 1P_JAR=2023-08-10-10

Source: classification engine

Classification label: clean1.win@35/104@62/14

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2064 --field-trial-handle=1900,i,7809552101022236451,14928734409077466690,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe" "https://support.microsoft.com/en-us/windows/protect-yourself-from-phishing-0c7ea947-ba98-3bd9-7184-430e1f860a44
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2064 --field-trial-handle=1900,i,7809552101022236451,14928734409077466690,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Program Files\chrome_BITS_5180_1335659937

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_BITS_5180_1335659937	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5180_608054574	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5180_608054574\keys.json	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5180_608054574\manifest.json	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5180_608054574\LICENSE	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5180_608054574\_metadata\	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5180_608054574\_metadata\verified_contents.json	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5180_608054574\manifest.fingerprint	Jump to behavior

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
1 Drive-by Compromise	Windows Management Instrumentation	Path Interception	1 Process Injection	2 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	Exfiltration Over Other Network Medium	1 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	3 Non-Application Layer Protocol	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	4 Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	1 Ingress Tool Transfer	SIM Card Swap		Carrier Billing Fraud

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
https://support.microsoft.com/en-us/windows/protect-yourself-from-phishing-0c7ea947-ba98-3bd9-7184-430e1f860a44	0%	Virustotal		Browse
https://support.microsoft.com/en-us/windows/protect-yourself-from-phishing-0c7ea947-ba98-3bd9-7184-430e1f860a44	0%	Avira URL Cloud	safe

Source	Detection	Scanner	Label
https://assets.onestore.ms	0%	URL Reputation	safe
https://polyset.xyz	0%	URL Reputation	safe
https://polyset.xyz	0%	URL Reputation	safe
https://analytics.tiktok.com	0%	URL Reputation	safe
https://analytics.tiktok.com	0%	URL Reputation	safe
https://www.clarity.ms	0%	URL Reputation	safe
https://d.impactradius-event.com	0%	URL Reputation	safe
https://d.impactradius-event.com	0%	URL Reputation	safe
https://start.microsoftapp.net/start?pc_campaign=UHF_Banner_15mkts&adjust=y9xgnyl_5sblqid"	0%	URL Reputation	safe
https://raw.githubusercontent.com/jakearchibald/es6-promise/master/LICENSE	0%	URL Reputation	safe
https://consentreceiverfd-prod.azurefd.net/v1/consent	0%	URL Reputation	safe
https://mem.gfx.ms/meversion?partner=SMCConvergence&market=en-us&uhf=1	0%	URL Reputation	safe
https://trusttoken.dev	0%	URL Reputation	safe
https://mem.gfx.ms	0%	URL Reputation	safe
https://pst-issuer.hcaptcha.com	0%	URL Reputation	safe
https://mem.gfx.ms/meversion?partner=mshomepage&market=de-ch&uhf=1	0%	URL Reputation	safe
https://js.foundation/	0%	URL Reputation	safe
https://aadcdn.msftauth.net/shared/1.0/content/js/FetchSessions_Core_MFlyI4bSaXT-d8J13gRcrQ2.js	0%	Avira URL Cloud	safe
https://aadcdn.msftauth.net/shared/1.0/content/js/FetchSessions_Core_pj-6v8iQhdg_XFsfh0-ZIw2.js	0%	Avira URL Cloud	safe
https://mem.gfx.ms/scripts/me/MeControl/10.23212.1/en-US/meCore.min.js	0%	Avira URL Cloud	safe
https://mem.gfx.ms/scripts/me/MeControl/10.23212.1/en-US/meBoot.min.js	0%	Avira URL Cloud	safe

Domains and IPs

Download Network PCAP: filtered – full

Contacted Domains

Name	IP	Active	Malicious	Reputation
cs1100.wpc.omegacdn.net	152.199.23.37	true	false	unknown
accounts.google.com	172.217.168.77	true	false	high
microsoftwindows.112.2o7.net	63.140.62.164	true	false	high
sni1gl.wpc.alphacdn.net	152.199.21.175	true	false	unknown
part-0032.t-0009.t-msedge.net	13.107.246.60	true	false	unknown
www.google.com	172.217.168.68	true	false	high
cs1227.wpc.alphacdn.net	192.229.221.185	true	false	unknown
d.impactradius-event.com	35.186.249.72	true	false	unknown
liveperson.map.fastly.net	151.101.1.192	true	false	unknown
clients.l.google.com	142.250.203.110	true	false	high
aka.ms	23.12.134.45	true	false	high
d1xbuscas8tetl.cloudfront.net	18.173.187.120	true	false	high
js.monitor.azure.com	unknown	unknown	false	high
lpcdn.lpsnmedia.net	unknown	unknown	false	high
assets.onestore.ms	unknown	unknown	false	unknown
ajax.aspnetcdn.com	unknown	unknown	false	high
clients2.google.com	unknown	unknown	false	high
publisher.liveperson.net	unknown	unknown	false	high
cdnssl.clicktale.net	unknown	unknown	false	high
consentreceiverfd-prod.azurefd.net	unknown	unknown	false	unknown
accdn.lpsnmedia.net	unknown	unknown	false	high
www.clarity.ms	unknown	unknown	false	unknown
aadcdn.msftauth.net	unknown	unknown	false	unknown
logincdn.msftauth.net	unknown	unknown	false	unknown
mem.gfx.ms	unknown	unknown	false	unknown
c.s-microsoft.com	unknown	unknown	false	high
support.content.office.net	unknown	unknown	false	high
analytics.tiktok.com	unknown	unknown	false	unknown
login.microsoftonline.com	unknown	unknown	false	high
amp.azure.net	unknown	unknown	false	high
lptag.liveperson.net	unknown	unknown	false	high
acctcdn.msftauth.net	unknown	unknown	false	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://clients2.google.com/service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=115.0.5790.171&lang=en-US&acceptformat=crx3,puff&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1	false		high
https://mem.gfx.ms/scripts/me/MeControl/10.23212.1/en-US/meCore.min.js	false	Avira URL Cloud: safe	unknown
https://aka.ms/3rdpartycookies	false		high
https://mem.gfx.ms/scripts/me/MeControl/10.23212.1/en-US/meBoot.min.js	false	Avira URL Cloud: safe	unknown
https://aadcdn.msftauth.net/shared/1.0/content/js/FetchSessions_Core_MFlyI4bSaXT-d8J13gRcrQ2.js	false	Avira URL Cloud: safe	unknown
about:blank	false		low
https://accounts.google.com/ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard	false		high
https://consentreceiverfd-prod.azurefd.net/v1/consent	false	URL Reputation: safe	unknown
https://mem.gfx.ms/meversion?partner=SMCConvergence&market=en-us&uhf=1	false	URL Reputation: safe	unknown
https://js.monitor.azure.com/scripts/c/ms.shared.analytics.mectrl-3.2.7.gbl.min.js	false		high
https://js.monitor.azure.com/scripts/c/ms.analytics-web-3.2.7.min.js	false		high
https://aadcdn.msftauth.net/shared/1.0/content/js/FetchSessions_Core_pj-6v8iQhdg_XFsfh0-ZIw2.js	false	Avira URL Cloud: safe	unknown
https://mem.gfx.ms/meversion?partner=mshomepage&market=de-ch&uhf=1	false	URL Reputation: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://outlook.live.com/owa/	chromecache_351.1.dr	false		high
https://www.onenote.com/?omkt=de-CH	chromecache_351.1.dr	false		high
https://js.monitor.azure.com	chromecache_351.1.dr	false		high
https://github.com/carhartl/jquery-cookie	chromecache_265.1.dr	false		high
https://assets.onestore.ms	chromecache_284.1.dr	false	URL Reputation: safe	unknown
https://www.skype.com/de/	chromecache_351.1.dr	false		high
https://login.windows-ppe.net	chromecache_266.1.dr	false		high
https://polyset.xyz	keys.json.0.dr	false	URL Reputation: safe URL Reputation: safe	unknown
https://lptag.liveperson.net	chromecache_351.1.dr	false		high
http://www.opensource.org/licenses/mit-license.php	chromecache_312.1.dr	false		high
https://analytics.tiktok.com	chromecache_351.1.dr	false	URL Reputation: safe URL Reputation: safe	unknown
https://login.microsoftonline.com	chromecache_266.1.dr	false		high
https://www.instagram.com/microsoftch/	chromecache_351.1.dr	false		high
https://www.clarity.ms	chromecache_351.1.dr	false	URL Reputation: safe	unknown
https://cdnssl.clicktale.net/www32/ptc/05d32363-d534-4d93-9b65-cde674775e71.js	chromecache_351.1.dr	false		high
https://cdnssl.clicktale.net	chromecache_351.1.dr	false		high
https://publisher.liveperson.net	chromecache_351.1.dr	false		high
http://github.com/requirejs/almond/LICENSE	chromecache_346.1.dr	false		high
https://d.impactradius-event.com	chromecache_351.1.dr	false	URL Reputation: safe URL Reputation: safe	unknown
https://start.microsoftapp.net/start?pc_campaign=UHF_Banner_15mkts&adjust=y9xgnyl_5sblqid"	chromecache_351.1.dr	false	URL Reputation: safe	unknown
http://www.apache.org/licenses/LICENSE-2.0	chromecache_297.1.dr	false		high
https://microsoftwindows.112.2o7.net	chromecache_284.1.dr	false		high
https://onedrive.live.com/about/de-ch/	chromecache_351.1.dr	false		high
https://raw.githubusercontent.com/jakearchibald/es6-promise/master/LICENSE	chromecache_306.1.dr	false	URL Reputation: safe	unknown
http://github.com/requirejs/requirejs/LICENSE	chromecache_284.1.dr	false		high
https://lpcdn.lpsnmedia.net	chromecache_351.1.dr	false		high
https://www.youtube.com/user/MicrosoftCH	chromecache_351.1.dr	false		high
http://knockoutjs.com/	chromecache_269.1.dr, chromecache_310.1.dr	false		high
https://github.com/douglascrockford/JSON-js	chromecache_269.1.dr, chromecache_310.1.dr	false		high
https://schema.org	chromecache_351.1.dr	false		high
https://trusttoken.dev	keys.json.0.dr	false	URL Reputation: safe	unknown
https://mem.gfx.ms	chromecache_351.1.dr	false	URL Reputation: safe	unknown
https://aka.ms/yourcaliforniaprivacychoices	chromecache_351.1.dr	false		high
https://jquery.org/license	chromecache_356.1.dr	false		high
http://github.com/requirejs/domReady	chromecache_284.1.dr	false		high
http://www.opensource.org/licenses/mit-license.php)	chromecache_269.1.dr, chromecache_310.1.dr	false		high
https://twitter.com/microsoft_ch	chromecache_351.1.dr	false		high
https://jquery.com/	chromecache_356.1.dr	false		high
https://pst-issuer.hcaptcha.com	keys.json.0.dr	false	URL Reputation: safe	unknown
https://accdn.lpsnmedia.net	chromecache_351.1.dr	false		high
https://www.linkedin.com/company/1035	chromecache_351.1.dr	false		high
https://www.xbox.com/	chromecache_351.1.dr	false		high
http://github.com/aFarkas/lazysizes	chromecache_284.1.dr	false		high
http://schema.org/Organization	chromecache_351.1.dr	false		high
http://feross.org	chromecache_312.1.dr	false		high
https://sizzlejs.com/	chromecache_356.1.dr	false		high
https://js.foundation/	chromecache_356.1.dr	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
63.140.62.164	microsoftwindows.112.2o7.net	United States	15224	OMNITUREUS	false
142.250.203.110	clients.l.google.com	United States	15169	GOOGLEUS	false
13.107.246.60	part-0032.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
151.101.1.192	liveperson.map.fastly.net	United States	54113	FASTLYUS	false
172.217.168.68	www.google.com	United States	15169	GOOGLEUS	false
18.173.187.120	d1xbuscas8tetl.cloudfront.net	United States	3	MIT-GATEWAYSUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
192.229.221.185	cs1227.wpc.alphacdn.net	United States	15133	EDGECASTUS	false
35.186.249.72	d.impactradius-event.com	United States	15169	GOOGLEUS	false
172.217.168.77	accounts.google.com	United States	15169	GOOGLEUS	false
23.12.134.45	aka.ms	United States	16625	AKAMAI-ASUS	false
152.199.21.175	sni1gl.wpc.alphacdn.net	United States	15133	EDGECASTUS	false
152.199.23.37	cs1100.wpc.omegacdn.net	United States	15133	EDGECASTUS	false

Private

IP
192.168.2.1

General Information

Joe Sandbox Version:	38.0.0 Beryl
Analysis ID:	1296950
Start date and time:	2023-08-24 20:52:52 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 5m 43s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	https://support.microsoft.com/en-us/windows/protect-yourself-from-phishing-0c7ea947-ba98-3bd9-7184-430e1f860a44
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	21
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	CLEAN
Classification:	clean1.win@35/104@62/14
EGA Information:	Failed
HDC Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Browse: https://aka.ms/3rdpartycookies Browse: https://www.microsoft.com/

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, BackgroundTransferHost.exe, WMIADAP.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 172.217.168.67, 34.104.35.123, 23.218.208.112, 52.182.143.208, 23.35.237.160, 23.218.209.163, 20.190.177.23, 20.190.177.19, 20.190.177.82, 20.190.177.20, 20.190.177.83, 20.190.177.85, 20.190.177.22, 20.190.177.148, 20.190.177.149, 20.190.177.146, 20.190.177.84, 152.199.19.160, 80.67.82.211, 80.67.82.235, 2.20.213.152, 20.189.173.11, 40.126.53.19, 20.190.181.3, 40.126.53.17, 20.190.181.6, 20.190.181.4, 40.126.53.18, 20.190.181.5, 40.126.53.16, 142.250.203.106, 216.58.215.234, 172.217.168.42, 172.217.168.74, 2.20.211.31, 80.67.82.234, 80.67.82.217, 20.42.73.27, 104.109.250.149, 104.109.250.156, 52.167.30.171, 178.249.97.23, 178.249.97.99, 178.249.97.98, 204.79.197.200, 13.107.21.200, 23.10.249.99, 23.10.249.91, 23.10.249.112, 2.21.22.8, 23.10.249.81, 2.21.22.24
Excluded domains from analysis (whitelisted): 160C1.wpc.azureedge.net, greenid-prod-pme.eastus2.cloudapp.azure.com, aijscdn2.afd.azureedge.net, lgincdnmsftuswe2.azureedge.net, assets.onestore.ms.edgekey.net, pme-greenid-prod.trafficmanager.net, e13678.dscb.akamaiedge.net, www.tm.lg.prod.aadmsa.akadns.net, clientservices.googleapis.com, browser.events.data.trafficmanager.net, g.bing.com, publisher.livepersonk.akadns.net, ak.privatelink.msidentity.com, www.microsoft.com-c-3.edgekey.net, onedscolprdwus10.westus.cloudapp.azure.com, login.live.com, star-azurefd-prod.trafficmanager.net, update.googleapis.com, acctcdnvzeuno.azureedge.net, acctcdnvzeuno.ec.azureedge.net, www.bing.com, e10583.dspg.akamaiedge.net, san-ion.secure4.scene7.com.edgekey.net, acctcdnmsftuswe2.azureedge.net, content-autofill.googleapis.com, aadcdnoriginwus2.azureedge.net, dual-a-0001.a-msedge.net, analytics.tiktok.com.bytewlb.akadns.net, lgincdnvzeuno.ec.azureedge.net, e12627.g.akamaiedge.net, aadcdn.msauth.net, prodstack.support.microsoft.co
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtSetInformationFile calls found.

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1558
Entropy (8bit):	5.11458514637545
Encrypted:	false
SSDEEP:	48:OBOCrYJ4rYJVwUCLHDy43HV713XEyMmZ3teTHn:LCrYJ4rYJVwUCHZ3Z13XtdUTH
MD5:	EE002CB9E51BB8DFA89640A406A1090A
SHA1:	49EE3AD535947D8821FFDEB67FFC9BC37D1EBBB2
SHA-256:	3DBD2C90050B652D63656481C3E5871C52261575292DB77D4EA63419F187A55B
SHA-512:	D1FDCC436B8CA8C68D4DC7077F84F803A535BF2CE31D9EB5D0C466B62D6567B2C59974995060403ED757E92245DB07E70C6BDDBF1C3519FED300CC5B9BF9177C
Malicious:	false
Reputation:	low
Preview:	// Copyright 2015 The Chromium Authors. All rights reserved..//.// Redistribution and use in source and binary forms, with or without.// modification, are permitted provided that the following conditions are.// met:.//.// * Redistributions of source code must retain the above copyright.// notice, this list of conditions and the following disclaimer..// * Redistributions in binary form must reproduce the above.// copyright notice, this list of conditions and the following disclaimer.// in the documentation and/or other materials provided with the.// distribution..// * Neither the name of Google Inc. nor the names of its.// contributors may be used to endorse or promote products derived from.// this software without specific prior written permission..//.// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS.// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT.// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR.// A PARTICULAR

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 24, 2023 20:53:43.633593082 CEST	51739	53	192.168.2.3	8.8.8.8
Aug 24, 2023 20:53:43.633896112 CEST	63604	53	192.168.2.3	8.8.8.8
Aug 24, 2023 20:53:43.634315968 CEST	60000	53	192.168.2.3	8.8.8.8
Aug 24, 2023 20:53:43.634664059 CEST	54193	53	192.168.2.3	8.8.8.8
Aug 24, 2023 20:53:43.661406994 CEST	53	51739	8.8.8.8	192.168.2.3
Aug 24, 2023 20:53:43.666403055 CEST	53	63604	8.8.8.8	192.168.2.3
Aug 24, 2023 20:53:43.667463064 CEST	53	60000	8.8.8.8	192.168.2.3
Aug 24, 2023 20:53:43.675138950 CEST	53	54193	8.8.8.8	192.168.2.3
Aug 24, 2023 20:53:43.675498009 CEST	53	59489	8.8.8.8	192.168.2.3
Aug 24, 2023 20:53:43.943253040 CEST	53	64088	8.8.8.8	192.168.2.3
Aug 24, 2023 20:53:45.106045008 CEST	63719	53	192.168.2.3	8.8.8.8
Aug 24, 2023 20:53:45.106853962 CEST	52097	53	192.168.2.3	8.8.8.8
Aug 24, 2023 20:53:45.112724066 CEST	61084	53	192.168.2.3	8.8.8.8
Aug 24, 2023 20:53:45.113405943 CEST	61769	53	192.168.2.3	8.8.8.8
Aug 24, 2023 20:53:45.158677101 CEST	55108	53	192.168.2.3	8.8.8.8
Aug 24, 2023 20:53:45.159187078 CEST	62364	53	192.168.2.3	8.8.8.8
Aug 24, 2023 20:53:45.169329882 CEST	49809	53	192.168.2.3	8.8.8.8
Aug 24, 2023 20:53:45.169682980 CEST	52108	53	192.168.2.3	8.8.8.8
Aug 24, 2023 20:53:45.753106117 CEST	50791	53	192.168.2.3	8.8.8.8
Aug 24, 2023 20:53:45.753915071 CEST	54156	53	192.168.2.3	8.8.8.8
Aug 24, 2023 20:53:47.439822912 CEST	65220	53	192.168.2.3	8.8.8.8
Aug 24, 2023 20:53:47.440695047 CEST	57453	53	192.168.2.3	8.8.8.8
Aug 24, 2023 20:53:47.460558891 CEST	53	65220	8.8.8.8	192.168.2.3
Aug 24, 2023 20:53:47.464061022 CEST	53	57453	8.8.8.8	192.168.2.3
Aug 24, 2023 20:53:59.616189003 CEST	64019	53	192.168.2.3	8.8.8.8
Aug 24, 2023 20:53:59.616600990 CEST	50442	53	192.168.2.3	8.8.8.8
Aug 24, 2023 20:54:00.563894033 CEST	61166	53	192.168.2.3	8.8.8.8
Aug 24, 2023 20:54:00.564440012 CEST	61026	53	192.168.2.3	8.8.8.8
Aug 24, 2023 20:54:00.652868032 CEST	62200	53	192.168.2.3	8.8.8.8
Aug 24, 2023 20:54:00.653320074 CEST	59789	53	192.168.2.3	8.8.8.8
Aug 24, 2023 20:54:01.797553062 CEST	56948	53	192.168.2.3	8.8.8.8
Aug 24, 2023 20:54:01.797853947 CEST	57788	53	192.168.2.3	8.8.8.8
Aug 24, 2023 20:54:01.818137884 CEST	53	57788	8.8.8.8	192.168.2.3
Aug 24, 2023 20:54:01.823911905 CEST	53	56948	8.8.8.8	192.168.2.3
Aug 24, 2023 20:54:05.009946108 CEST	53	51904	8.8.8.8	192.168.2.3
Aug 24, 2023 20:54:06.117132902 CEST	55573	53	192.168.2.3	8.8.8.8
Aug 24, 2023 20:54:06.117479086 CEST	54227	53	192.168.2.3	8.8.8.8
Aug 24, 2023 20:54:06.157416105 CEST	65326	53	192.168.2.3	8.8.8.8
Aug 24, 2023 20:54:06.157763958 CEST	49673	53	192.168.2.3	8.8.8.8
Aug 24, 2023 20:54:06.587450027 CEST	56938	53	192.168.2.3	8.8.8.8
Aug 24, 2023 20:54:06.587884903 CEST	63200	53	192.168.2.3	8.8.8.8
Aug 24, 2023 20:54:14.474426031 CEST	59440	53	192.168.2.3	8.8.8.8
Aug 24, 2023 20:54:14.474874020 CEST	62143	53	192.168.2.3	8.8.8.8
Aug 24, 2023 20:54:14.491729021 CEST	60737	53	192.168.2.3	8.8.8.8
Aug 24, 2023 20:54:14.492155075 CEST	59687	53	192.168.2.3	8.8.8.8
Aug 24, 2023 20:54:14.499871969 CEST	53	51105	8.8.8.8	192.168.2.3
Aug 24, 2023 20:54:14.511235952 CEST	53	52375	8.8.8.8	192.168.2.3
Aug 24, 2023 20:54:14.527260065 CEST	53	59687	8.8.8.8	192.168.2.3
Aug 24, 2023 20:54:14.539870024 CEST	53	53845	8.8.8.8	192.168.2.3
Aug 24, 2023 20:54:14.548783064 CEST	53	60737	8.8.8.8	192.168.2.3
Aug 24, 2023 20:54:14.576303959 CEST	53	64749	8.8.8.8	192.168.2.3
Aug 24, 2023 20:54:14.581722975 CEST	53	63168	8.8.8.8	192.168.2.3
Aug 24, 2023 20:54:14.608277082 CEST	53	52337	8.8.8.8	192.168.2.3
Aug 24, 2023 20:54:26.192317963 CEST	51841	53	192.168.2.3	8.8.8.8
Aug 24, 2023 20:54:26.192877054 CEST	64143	53	192.168.2.3	8.8.8.8
Aug 24, 2023 20:54:26.215809107 CEST	53	51841	8.8.8.8	192.168.2.3
Aug 24, 2023 20:54:26.216312885 CEST	53	64143	8.8.8.8	192.168.2.3
Aug 24, 2023 20:54:35.656851053 CEST	55011	53	192.168.2.3	8.8.8.8
Aug 24, 2023 20:54:35.839406967 CEST	52225	53	192.168.2.3	8.8.8.8
Aug 24, 2023 20:54:36.007793903 CEST	65440	53	192.168.2.3	8.8.8.8
Aug 24, 2023 20:54:36.008294106 CEST	60002	53	192.168.2.3	8.8.8.8
Aug 24, 2023 20:54:42.691199064 CEST	53	62556	8.8.8.8	192.168.2.3
Aug 24, 2023 20:55:00.234005928 CEST	53	64138	8.8.8.8	192.168.2.3
Aug 24, 2023 20:55:00.234360933 CEST	53	49973	8.8.8.8	192.168.2.3
Aug 24, 2023 20:55:00.246954918 CEST	56663	53	192.168.2.3	8.8.8.8
Aug 24, 2023 20:55:00.247714996 CEST	63061	53	192.168.2.3	8.8.8.8
Aug 24, 2023 20:55:00.286027908 CEST	55449	53	192.168.2.3	8.8.8.8
Aug 24, 2023 20:55:00.286406040 CEST	54113	53	192.168.2.3	8.8.8.8
Aug 24, 2023 20:55:00.310169935 CEST	53	51848	8.8.8.8	192.168.2.3
Aug 24, 2023 20:55:00.312545061 CEST	62087	53	192.168.2.3	8.8.8.8
Aug 24, 2023 20:55:00.312925100 CEST	64867	53	192.168.2.3	8.8.8.8
Aug 24, 2023 20:55:00.323661089 CEST	53	54113	8.8.8.8	192.168.2.3
Aug 24, 2023 20:55:00.323951960 CEST	54354	53	192.168.2.3	8.8.8.8
Aug 24, 2023 20:55:00.324383974 CEST	54415	53	192.168.2.3	8.8.8.8
Aug 24, 2023 20:55:00.361696959 CEST	53	54415	8.8.8.8	192.168.2.3
Aug 24, 2023 20:55:00.374191999 CEST	52244	53	192.168.2.3	8.8.8.8
Aug 24, 2023 20:55:00.374747992 CEST	59176	53	192.168.2.3	8.8.8.8
Aug 24, 2023 20:55:00.382898092 CEST	57405	53	192.168.2.3	8.8.8.8
Aug 24, 2023 20:55:00.383332014 CEST	53472	53	192.168.2.3	8.8.8.8
Aug 24, 2023 20:55:00.433485985 CEST	55736	53	192.168.2.3	8.8.8.8
Aug 24, 2023 20:55:00.433959007 CEST	56183	53	192.168.2.3	8.8.8.8
Aug 24, 2023 20:55:00.447499037 CEST	60318	53	192.168.2.3	8.8.8.8
Aug 24, 2023 20:55:00.447936058 CEST	59876	53	192.168.2.3	8.8.8.8
Aug 24, 2023 20:55:00.469592094 CEST	53428	53	192.168.2.3	8.8.8.8
Aug 24, 2023 20:55:00.469990015 CEST	63186	53	192.168.2.3	8.8.8.8
Aug 24, 2023 20:55:00.482986927 CEST	63504	53	192.168.2.3	8.8.8.8
Aug 24, 2023 20:55:00.483438015 CEST	53443	53	192.168.2.3	8.8.8.8
Aug 24, 2023 20:55:00.484544992 CEST	53	53428	8.8.8.8	192.168.2.3
Aug 24, 2023 20:55:00.493475914 CEST	53	63186	8.8.8.8	192.168.2.3
Aug 24, 2023 20:55:00.513844013 CEST	53	63504	8.8.8.8	192.168.2.3
Aug 24, 2023 20:55:00.515523911 CEST	53	53443	8.8.8.8	192.168.2.3
Aug 24, 2023 20:55:00.519357920 CEST	56649	53	192.168.2.3	8.8.8.8
Aug 24, 2023 20:55:00.519792080 CEST	50033	53	192.168.2.3	8.8.8.8
Aug 24, 2023 20:55:00.565660954 CEST	53	61886	8.8.8.8	192.168.2.3
Aug 24, 2023 20:55:00.567228079 CEST	53	64753	8.8.8.8	192.168.2.3
Aug 24, 2023 20:55:00.643980026 CEST	53	60399	8.8.8.8	192.168.2.3

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Aug 24, 2023 20:54:00.596926928 CEST	192.168.2.3	8.8.8.8	d0a9	(Port unreachable)	Destination Unreachable
Aug 24, 2023 20:54:02.070797920 CEST	192.168.2.3	8.8.8.8	d0c8	(Port unreachable)	Destination Unreachable
Aug 24, 2023 20:54:05.010077953 CEST	192.168.2.3	8.8.8.8	d03b	(Port unreachable)	Destination Unreachable
Aug 24, 2023 20:54:06.227844000 CEST	192.168.2.3	8.8.8.8	d0c2	(Port unreachable)	Destination Unreachable
Aug 24, 2023 20:54:14.511352062 CEST	192.168.2.3	8.8.8.8	d049	(Port unreachable)	Destination Unreachable
Aug 24, 2023 20:54:24.417115927 CEST	192.168.2.3	8.8.8.8	d06c	(Port unreachable)	Destination Unreachable
Aug 24, 2023 20:55:00.291656017 CEST	192.168.2.3	8.8.8.8	d0a3	(Port unreachable)	Destination Unreachable

Timestamp	kBytes transferred	Direction	Data
2023-08-24 18:53:43 UTC	0	OUT	GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=115.0.5790.171&lang=en-US&acceptformat=crx3,puff&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1 Host: clients2.google.com Connection: keep-alive X-Goog-Update-Interactivity: fg X-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmieda X-Goog-Update-Updater: chromecrx-115.0.5790.171 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-08-24 18:53:43 UTC	1	IN	HTTP/1.1 200 OK Content-Security-Policy: script-src 'report-sample' 'nonce-jgbCmzIqt4wfBkhUt0gUKQ' 'unsafe-inline' 'strict-dynamic' https: http:;object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/clientupdate-aus/1 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 24 Aug 2023 18:53:43 GMT Content-Type: text/xml; charset=UTF-8 X-Daynum: 6079 X-Daystart: 42823 X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block Server: GSE Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2023-08-24 18:53:43 UTC	2	IN	Data Raw: 32 63 39 0d 0a 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 67 75 70 64 61 74 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 75 70 64 61 74 65 32 2f 72 65 73 70 6f 6e 73 65 22 20 70 72 6f 74 6f 63 6f 6c 3d 22 32 2e 30 22 20 73 65 72 76 65 72 3d 22 70 72 6f 64 22 3e 3c 64 61 79 73 74 61 72 74 20 65 6c 61 70 73 65 64 5f 64 61 79 73 3d 22 36 30 37 39 22 20 65 6c 61 70 73 65 64 5f 73 65 63 6f 6e 64 73 3d 22 34 32 38 32 33 22 2f 3e 3c 61 70 70 20 61 70 70 69 64 3d 22 6e 6d 6d 68 6b 6b 65 67 63 63 61 67 64 6c 64 67 69 69 6d 65 64 70 69 63 63 6d 67 6d 69 65 64 61 22 20 63 6f 68 6f 72 74 3d 22 31 3a 3a 22 20 63 6f 68 6f 72 74 6e 61 6d 65 3d 22 22 Data Ascii: 2c9<?xml version="1.0" encoding="UTF-8"?><gupdate xmlns="http://www.google.com/update2/response" protocol="2.0" server="prod"><daystart elapsed_days="6079" elapsed_seconds="42823"/><app appid="nmmhkkegccagdldgiimedpiccmgmieda" cohort="1::" cohortname=""
2023-08-24 18:53:43 UTC	2	IN	Data Raw: 37 32 33 66 35 36 62 38 37 31 37 31 37 35 63 35 33 36 36 38 35 63 35 34 35 30 31 32 32 62 33 30 37 38 39 34 36 34 61 64 38 32 22 20 68 61 73 68 5f 73 68 61 32 35 36 3d 22 38 31 65 33 61 34 64 34 33 61 37 33 36 39 39 65 31 62 37 37 38 31 37 32 33 66 35 36 62 38 37 31 37 31 37 35 63 35 33 36 36 38 35 63 35 34 35 30 31 32 32 62 33 30 37 38 39 34 36 34 61 64 38 32 22 20 70 72 6f 74 65 63 74 65 64 3d 22 30 22 20 73 69 7a 65 3d 22 32 34 38 35 33 31 22 20 73 74 61 74 75 73 3d 22 6f 6b 22 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 2e 30 2e 36 22 2f 3e 3c 2f 61 70 70 3e 3c 2f 67 75 70 64 61 74 65 3e 0d 0a Data Ascii: 723f56b8717175c536685c5450122b30789464ad82" hash_sha256="81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82" protected="0" size="248531" status="ok" version="1.0.0.6"/></app></gupdate>
2023-08-24 18:53:43 UTC	3	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	kBytes transferred	Direction	Data
2023-08-24 18:53:43 UTC	0	OUT	POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1 Host: accounts.google.com Connection: keep-alive Content-Length: 1 Origin: https://www.google.com Content-Type: application/x-www-form-urlencoded Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: CONSENT=PENDING+904; SOCS=CAISHAgCEhJnd3NfMjAyMjA4MDgtMF9SQzEaAmVuIAEaBgiAvOuXBg; AEC=Ad49MVGiijyX5dxPFAKxKYso-rIS24Ht-Pxs5fU9hHrAzfASnm-jqdQE1g; NID=511=WyMJovC2uA2AEbHQkGfP-KDdYCeg5Q7Mv6gxYT-qeugtrnXImrhmp1SixwS4ydh_E8Z0hdfCLAXvg2WUqsBSfqpx5SFvCCoeGeevqlEfkoxYi9FTISb8Cu7rr5rf9PyyNbLqf2QbxG7ja7jAB6UJQd5CPvMGcYUasORCRKRL1-arNYzfADAWHJvBLXml-Km_uewDreOyJ-MjxAI-i38Tl6LXI3zB; 1P_JAR=2023-08-10-10
2023-08-24 18:53:43 UTC	1	OUT	Data Raw: 20 Data Ascii:
2023-08-24 18:53:43 UTC	3	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=utf-8 Access-Control-Allow-Origin: https://www.google.com Access-Control-Allow-Credentials: true X-Content-Type-Options: nosniff Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 24 Aug 2023 18:53:43 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/IdentityListAccountsHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-4sGxrFqeJoonanjML5zePA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/IdentityListAccountsHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/IdentityListAccountsHttp/cspreport/allowlist Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factor=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2023-08-24 18:53:43 UTC	4	IN	Data Raw: 31 31 0d 0a 5b 22 67 61 69 61 2e 6c 2e 61 2e 72 22 2c 5b 5d 5d 0d 0a Data Ascii: 11["gaia.l.a.r",[]]
2023-08-24 18:53:43 UTC	4	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	kBytes transferred	Direction	Data
2023-08-24 18:54:06 UTC	1007	OUT	GET /16.000/content/js/MeControl__BG5I2QV9W9LPv5UB6EkrA2.js HTTP/1.1 Host: logincdn.msauth.net Connection: keep-alive sec-ch-ua: "Not/A)Brand";v="99", "Google Chrome";v="115", "Chromium";v="115" Origin: https://login.live.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://login.live.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-08-24 18:54:06 UTC	1008	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Age: 5613000 Cache-Control: public, max-age=31536000 Content-MD5: uWhC4QH9JQC8csIB9DtqNw== Content-Type: application/x-javascript Date: Thu, 24 Aug 2023 18:54:06 GMT Etag: 0x8DB697267CD0EBF Last-Modified: Sat, 10 Jun 2023 05:20:29 GMT Server: ECAcc (muc/3366) Vary: Accept-Encoding X-Cache: HIT x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: f15c02c3-f01e-0035-3eaf-a30a5d000000 x-ms-version: 2009-09-19 Content-Length: 17287 Connection: close
2023-08-24 18:54:06 UTC	1008	IN	Data Raw: 66 75 6e 63 74 69 6f 6e 20 5f 68 78 28 61 29 7b 72 65 74 75 72 6e 20 61 3f 74 72 75 65 3a 61 3d 3d 30 7c 7c 61 3d 3d 66 61 6c 73 65 7c 7c 61 3d 3d 22 22 7d 66 75 6e 63 74 69 6f 6e 20 5f 44 75 28 61 2c 62 29 7b 72 65 74 75 72 6e 20 5f 68 78 28 61 29 3f 61 3a 62 7d 66 75 6e 63 74 69 6f 6e 20 5f 4a 28 61 29 7b 72 65 74 75 72 6e 20 61 20 69 6e 73 74 61 6e 63 65 6f 66 20 41 72 72 61 79 7d 66 75 6e 63 74 69 6f 6e 20 5f 42 44 28 61 29 7b 72 65 74 75 72 6e 20 22 66 75 6e 63 74 69 6f 6e 22 2e 5f 66 5a 28 74 79 70 65 6f 66 20 61 2c 74 72 75 65 29 7d 66 75 6e 63 74 69 6f 6e 20 5f 46 28 61 29 7b 72 65 74 75 72 6e 20 74 79 70 65 6f 66 20 61 3d 3d 22 73 74 72 69 6e 67 22 7d 66 75 6e 63 74 69 6f 6e 20 5f 42 45 28 61 29 7b 72 65 74 75 72 6e 20 5f 68 78 28 61 29 26 26 5f Data Ascii: function _hx(a){return a?true:a==0\|\|a==false\|\|a==""}function _Du(a,b){return _hx(a)?a:b}function _J(a){return a instanceof Array}function _BD(a){return "function"._fZ(typeof a,true)}function _F(a){return typeof a=="string"}function _BE(a){return _hx(a)&&_
2023-08-24 18:54:06 UTC	1024	IN	Data Raw: 64 69 72 65 63 74 55 72 69 56 61 6c 69 64 3d 53 65 72 76 65 72 44 61 74 61 2e 63 63 3b 69 66 28 64 29 62 2e 70 65 72 66 6f 72 6d 61 6e 63 65 3d 64 7d 72 65 74 75 72 6e 20 4a 53 4f 4e 2e 73 74 72 69 6e 67 69 66 79 28 62 29 7d 2c 5f 64 76 3a 66 75 6e 63 74 69 6f 6e 28 64 2c 63 2c 61 29 7b 76 61 72 20 62 3d 7b 65 72 72 6f 72 3a 64 2c 75 73 65 72 4c 69 73 74 3a 5b 5d 2c 70 6f 73 74 4c 6f 67 6f 75 74 52 65 64 69 72 65 63 74 55 72 69 56 61 6c 69 64 3a 63 7d 3b 69 66 28 61 29 62 2e 70 65 72 66 6f 72 6d 61 6e 63 65 3d 61 3b 72 65 74 75 72 6e 20 4a 53 4f 4e 2e 73 74 72 69 6e 67 69 66 79 28 62 29 7d 2c 5f 66 32 3a 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 4d 65 43 6f 6e 74 72 6f 6c 2e 5f 6a 71 28 61 2e 6f 72 69 67 69 6e 29 21 3d 3d 4d 65 43 6f 6e 74 72 6f 6c 2e Data Ascii: directUriValid=ServerData.cc;if(d)b.performance=d}return JSON.stringify(b)},_dv:function(d,c,a){var b={error:d,userList:[],postLogoutRedirectUriValid:c};if(a)b.performance=a;return JSON.stringify(b)},_f2:function(a){if(MeControl._jq(a.origin)!==MeControl.

Timestamp	kBytes transferred	Direction	Data
2023-08-24 18:54:06 UTC	1025	OUT	GET /me/mecache?partner=smcconvergence&wreply=https%3A%2F%2Fsupport.microsoft.com HTTP/1.1 Host: mem.gfx.ms Connection: keep-alive sec-ch-ua: "Not/A)Brand";v="99", "Google Chrome";v="115", "Chromium";v="115" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://support.microsoft.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-08-24 18:54:06 UTC	1026	IN	HTTP/1.1 200 OK Date: Thu, 24 Aug 2023 18:54:06 GMT Content-Type: text/html; charset=utf-8 Content-Length: 3392 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, no-transform, max-age=7200 Expires: Thu, 24 Aug 2023 18:59:15 GMT X-Content-Type-Options: nosniff Content-Security-Policy: frame-ancestors https://support.microsoft.com; X-UA-Compatible: IE=edge Strict-Transport-Security: max-age=31536000; includeSubDomains x-azure-ref: 20230824T185406Z-9qpxpsnq3p5hx45fff464wuq5n00000001m000000000g1gg X-Cache: TCP_HIT Accept-Ranges: bytes
2023-08-24 18:54:06 UTC	1027	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 20 2f 3e 0d 0a 20 20 20 20 0d 0a 20 20 20 20 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 20 20 20 20 3c 64 69 76 20 69 64 3d 22 62 6f 64 79 22 20 72 6f 6c 65 3d 22 6d 61 69 6e 22 3e 0d Data Ascii: <!DOCTYPE html><html lang="en" ><head> <meta charset="utf-8" /> <meta http-equiv="X-UA-Compatible" content="IE=edge" /> <meta name="viewport" content="width=device-width" /> </head><body> <div id="body" role="main">

Timestamp	kBytes transferred	Direction	Data
2023-08-24 18:54:26 UTC	1030	OUT	GET /3rdpartycookies HTTP/1.1 Host: aka.ms Connection: keep-alive sec-ch-ua: "Not/A)Brand";v="99", "Google Chrome";v="115", "Chromium";v="115" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-08-24 18:54:26 UTC	1031	IN	HTTP/1.1 301 Moved Permanently Content-Length: 0 Server: Kestrel Location: https://support.microsoft.com/topic/third-party-cookie-inventory-81ca0c3d-c122-415c-874c-55610e017a6a Request-Context: appId=cid-v1:26ef1154-5995-4d24-ad78-ef0b04f11587 X-Response-Cache-Status: True Expires: Thu, 24 Aug 2023 18:54:26 GMT Cache-Control: max-age=0, no-cache, no-store Pragma: no-cache Date: Thu, 24 Aug 2023 18:54:26 GMT Connection: close Strict-Transport-Security: max-age=31536000 ; includeSubDomains

Timestamp	kBytes transferred	Direction	Data
2023-08-24 18:54:28 UTC	1031	OUT	GET /meversion?partner=SMCConvergence&market=en-us&uhf=1 HTTP/1.1 Host: mem.gfx.ms Connection: keep-alive sec-ch-ua: "Not/A)Brand";v="99", "Google Chrome";v="115", "Chromium";v="115" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://support.microsoft.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-08-24 18:54:28 UTC	1032	IN	HTTP/1.1 200 OK Date: Thu, 24 Aug 2023 18:54:28 GMT Content-Type: application/javascript Content-Length: 29755 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, no-transform, max-age=7200 Expires: Thu, 24 Aug 2023 19:13:32 GMT X-Content-Type-Options: nosniff Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, OPTIONS X-UA-Compatible: IE=edge Strict-Transport-Security: max-age=31536000; includeSubDomains x-azure-ref: 20230824T185428Z-zq1rcrtzkt5mp3wk4az12c41aw00000001ag00000000rgm5 X-Cache: TCP_HIT Accept-Ranges: bytes
2023-08-24 18:54:28 UTC	1032	IN	Data Raw: 77 69 6e 64 6f 77 2e 4d 53 41 3d 77 69 6e 64 6f 77 2e 4d 53 41 7c 7c 7b 7d 3b 77 69 6e 64 6f 77 2e 4d 53 41 2e 4d 65 43 6f 6e 74 72 6f 6c 3d 77 69 6e 64 6f 77 2e 4d 53 41 2e 4d 65 43 6f 6e 74 72 6f 6c 7c 7c 7b 7d 3b 77 69 6e 64 6f 77 2e 4d 53 41 2e 4d 65 43 6f 6e 74 72 6f 6c 2e 43 6f 6e 66 69 67 3d 7b 22 76 65 72 22 3a 22 31 30 2e 32 33 32 31 32 2e 31 22 2c 22 6d 6b 74 22 3a 22 65 6e 2d 55 53 22 2c 22 70 74 6e 22 3a 22 73 6d 63 63 6f 6e 76 65 72 67 65 6e 63 65 22 2c 22 67 66 78 22 3a 22 68 74 74 70 73 3a 2f 2f 61 6d 63 64 6e 2e 6d 73 66 74 61 75 74 68 2e 6e 65 74 22 2c 22 64 62 67 22 3a 66 61 6c 73 65 2c 22 61 61 64 22 3a 74 72 75 65 2c 22 69 6e 74 22 3a 66 61 6c 73 65 2c 22 70 78 79 22 3a 74 72 75 65 2c 22 6d 73 54 78 74 22 3a 66 61 6c 73 65 2c 22 72 77 Data Ascii: window.MSA=window.MSA\|\|{};window.MSA.MeControl=window.MSA.MeControl\|\|{};window.MSA.MeControl.Config={"ver":"10.23212.1","mkt":"en-US","ptn":"smcconvergence","gfx":"https://amcdn.msftauth.net","dbg":false,"aad":true,"int":false,"pxy":true,"msTxt":false,"rw
2023-08-24 18:54:28 UTC	1048	IN	Data Raw: 72 6f 6c 2f 77 65 62 2d 69 6e 6c 69 6e 65 22 3a 22 6d 65 49 6e 6c 69 6e 65 22 2c 22 40 6d 65 63 6f 6e 74 72 6f 6c 2f 77 65 62 2d 62 6f 6f 74 22 3a 22 6d 65 42 6f 6f 74 22 2c 22 40 6d 65 63 6f 6e 74 72 6f 6c 2f 77 65 62 2d 63 6f 72 65 22 3a 22 6d 65 43 6f 72 65 22 7d 3b 66 75 6e 63 74 69 6f 6e 20 58 65 28 65 29 7b 74 72 79 7b 65 20 69 6e 20 48 65 26 26 28 65 3d 48 65 5b 65 5d 29 2c 7a 65 28 29 3b 76 61 72 20 6e 3d 71 65 28 65 29 3b 69 66 28 6e 29 72 65 74 75 72 6e 20 6e 2e 62 75 6e 64 6c 65 50 72 6f 6d 69 73 65 3b 76 61 72 20 74 3d 66 75 6e 63 74 69 6f 6e 28 75 29 7b 72 65 74 75 72 6e 20 6e 65 77 20 62 65 28 66 75 6e 63 74 69 6f 6e 28 69 2c 61 29 7b 76 61 72 20 65 3d 67 28 29 2c 63 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 6e 3d 6d 2e 43 6f 6e 66 Data Ascii: rol/web-inline":"meInline","@mecontrol/web-boot":"meBoot","@mecontrol/web-core":"meCore"};function Xe(e){try{e in He&&(e=He[e]),ze();var n=qe(e);if(n)return n.bundlePromise;var t=function(u){return new be(function(i,a){var e=g(),c=function(e){var n=m.Conf

Timestamp	kBytes transferred	Direction	Data
2023-08-24 18:54:31 UTC	1061	OUT	GET /shared/1.0/content/js/FetchSessions_Core_pj-6v8iQhdg_XFsfh0-ZIw2.js HTTP/1.1 Host: aadcdn.msftauth.net Connection: keep-alive sec-ch-ua: "Not/A)Brand";v="99", "Google Chrome";v="115", "Chromium";v="115" Origin: https://login.microsoftonline.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://login.microsoftonline.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-08-24 18:54:31 UTC	1062	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Age: 3325028 Cache-Control: public, max-age=31536000 Content-MD5: O7cGtKLycouTtriRmyinig== Content-Type: application/x-javascript Date: Thu, 24 Aug 2023 18:54:31 GMT Etag: 0x8DB82C4B9BB8048 Last-Modified: Wed, 12 Jul 2023 10:42:44 GMT Server: ECAcc (muc/333F) Vary: Accept-Encoding X-Cache: HIT x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: 163c732e-a01e-001a-477e-b84bef000000 x-ms-version: 2009-09-19 Content-Length: 146233 Connection: close
2023-08-24 18:54:31 UTC	1063	IN	Data Raw: 2f 2a 21 0a 20 2a 20 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 20 53 54 41 52 54 20 4f 46 20 54 48 49 52 44 20 50 41 52 54 59 20 4e 4f 54 49 43 45 20 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 0a 20 2a 20 0a 20 2a 20 54 68 69 73 20 66 69 6c 65 20 69 73 20 62 61 73 65 64 20 6f 6e 20 6f 72 20 69 6e 63 6f 72 70 6f 72 61 74 65 73 20 6d 61 74 65 72 69 61 6c 20 66 72 6f 6d 20 74 68 65 20 70 72 6f 6a 65 63 74 73 20 6c 69 73 74 65 64 20 62 65 6c 6f 77 20 28 54 68 69 72 64 20 50 61 72 74 79 20 49 50 29 2e 20 54 68 65 20 6f 72 69 67 69 6e 61 6c 20 63 6f 70 79 72 69 67 68 74 20 6e 6f 74 69 63 65 20 61 Data Ascii: /! ------------------------------------------- START OF THIRD PARTY NOTICE ----------------------------------------- * * This file is based on or incorporates material from the projects listed below (Third Party IP). The original copyright notice a
2023-08-24 18:54:31 UTC	1079	IN	Data Raw: 4f Data Ascii: O
2023-08-24 18:54:31 UTC	1079	IN	Data Raw: 43 45 53 53 5f 41 4c 54 45 4d 41 49 4c 53 41 4d 45 41 53 4d 41 49 4c 42 4f 58 3a 22 38 30 30 34 39 43 32 44 22 2c 50 50 5f 45 5f 45 4d 41 49 4c 5f 52 49 47 48 54 5f 54 4f 4f 5f 4c 4f 4e 47 3a 22 38 30 30 34 31 31 30 43 22 2c 50 50 5f 45 5f 4e 41 4d 45 5f 54 4f 4f 5f 4c 4f 4e 47 3a 22 38 30 30 34 31 31 30 32 22 2c 50 50 5f 45 5f 41 4c 49 41 53 5f 41 55 54 48 5f 4e 4f 54 50 45 52 4d 49 54 54 45 44 3a 22 38 30 30 34 37 38 38 42 22 2c 50 50 5f 45 5f 54 4f 54 50 5f 49 4e 56 41 4c 49 44 3a 22 38 30 30 34 39 43 33 34 22 2c 50 50 5f 45 5f 4f 4c 44 5f 53 4b 59 50 45 5f 50 41 53 53 57 4f 52 44 3a 22 38 30 30 34 33 35 35 37 22 2c 50 50 5f 45 5f 4f 54 54 5f 44 41 54 41 5f 49 4e 56 41 4c 49 44 3a 22 38 30 30 34 33 34 38 46 22 2c 50 50 5f 45 5f 4f 54 54 5f 41 4c 52 45 Data Ascii: CESS_ALTEMAILSAMEASMAILBOX:"80049C2D",PP_E_EMAIL_RIGHT_TOO_LONG:"8004110C",PP_E_NAME_TOO_LONG:"80041102",PP_E_ALIAS_AUTH_NOTPERMITTED:"8004788B",PP_E_TOTP_INVALID:"80049C34",PP_E_OLD_SKYPE_PASSWORD:"80043557",PP_E_OTT_DATA_INVALID:"8004348F",PP_E_OTT_ALRE
2023-08-24 18:54:31 UTC	1095	IN	Data Raw: 28 65 2e 73 75 62 73 74 72 69 6e 67 28 6f 2b 31 2c 69 29 2c 22 26 22 2c 22 3d 22 29 2c 72 3d 75 2e 64 6f 75 62 6c 65 53 70 6c 69 74 28 65 2e 73 75 62 73 74 72 69 6e 67 28 69 2b 31 29 2c 22 26 22 2c 22 3d 22 29 29 7d 72 65 74 75 72 6e 7b 6f 72 69 67 69 6e 41 6e 64 50 61 74 68 3a 6e 2c 71 75 65 72 79 3a 74 2c 66 72 61 67 6d 65 6e 74 3a 72 7d 7d 2c 6a 6f 69 6e 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 6e 3d 65 2e 6f 72 69 67 69 6e 41 6e 64 50 61 74 68 7c 7c 22 22 3b 72 65 74 75 72 6e 20 65 2e 71 75 65 72 79 26 26 28 6e 2b 3d 22 3f 22 2b 73 2e 6a 6f 69 6e 28 65 2e 71 75 65 72 79 2c 22 26 22 2c 22 3d 22 29 29 2c 65 2e 66 72 61 67 6d 65 6e 74 26 26 28 6e 2b 3d 22 23 22 2b 73 2e 6a 6f 69 6e 28 65 2e 66 72 61 67 6d 65 6e 74 2c 22 26 22 2c 22 3d 22 29 29 Data Ascii: (e.substring(o+1,i),"&","="),r=u.doubleSplit(e.substring(i+1),"&","="))}return{originAndPath:n,query:t,fragment:r}},join:function(e){var n=e.originAndPath\|\|"";return e.query&&(n+="?"+s.join(e.query,"&","=")),e.fragment&&(n+="#"+s.join(e.fragment,"&","="))
2023-08-24 18:54:31 UTC	1111	IN	Data Raw: 7c 28 69 5b 65 5d 3d 7b 7d 29 2c 69 5b 65 5d 29 3a 61 3d 61 7c 7c 7b 7d 7d 3b 6e 2e 67 65 74 54 72 61 63 69 6e 67 43 6f 6e 74 65 78 74 4f 62 6a 65 63 74 73 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 65 3d 5b 5d 3b 72 65 74 75 72 6e 20 72 2e 4f 62 6a 65 63 74 2e 66 6f 72 45 61 63 68 28 69 2c 28 66 75 6e 63 74 69 6f 6e 28 6e 2c 74 29 7b 74 26 26 65 2e 70 75 73 68 28 7b 76 69 65 77 4d 6f 64 65 6c 3a 6e 2c 63 6f 6e 74 65 78 74 3a 74 7d 29 7d 29 29 2c 61 26 26 65 2e 70 75 73 68 28 61 29 2c 65 7d 2c 6e 2e 72 65 67 69 73 74 65 72 54 72 61 63 69 6e 67 4f 62 73 65 72 76 61 62 6c 65 73 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 6e 2c 74 29 7b 76 61 72 20 72 3d 73 28 65 29 3b 72 2e 74 72 61 63 69 6e 67 4f 62 73 65 72 76 61 62 6c 65 73 3d 72 2e 74 72 61 63 69 6e 67 4f Data Ascii: \|(i[e]={}),i[e]):a=a\|\|{}};n.getTracingContextObjects=function(){var e=[];return r.Object.forEach(i,(function(n,t){t&&e.push({viewModel:n,context:t})})),a&&e.push(a),e},n.registerTracingObservables=function(e,n,t){var r=s(e);r.tracingObservables=r.tracingO
2023-08-24 18:54:31 UTC	1127	IN	Data Raw: 66 69 6e 65 64 3a 31 2c 62 6f 6f 6c 65 61 6e 3a 31 2c 6e 75 6d 62 65 72 3a 31 2c 73 74 72 69 6e 67 3a 31 7d 3b 53 2e 62 28 22 65 78 74 65 6e 64 65 72 73 22 2c 53 2e 54 61 29 2c 53 2e 69 63 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 6e 2c 74 29 7b 74 68 69 73 2e 64 61 3d 65 2c 74 68 69 73 2e 6c 63 3d 6e 2c 74 68 69 73 2e 6d 63 3d 74 2c 74 68 69 73 2e 49 62 3d 21 31 2c 74 68 69 73 2e 66 62 3d 74 68 69 73 2e 4a 62 3d 6e 75 6c 6c 2c 53 2e 4c 28 74 68 69 73 2c 22 64 69 73 70 6f 73 65 22 2c 74 68 69 73 2e 73 29 2c 53 2e 4c 28 74 68 69 73 2c 22 64 69 73 70 6f 73 65 57 68 65 6e 4e 6f 64 65 49 73 52 65 6d 6f 76 65 64 22 2c 74 68 69 73 2e 6c 29 7d 2c 53 2e 69 63 2e 70 72 6f 74 6f 74 79 70 65 2e 73 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 69 73 2e 49 62 7c 7c 28 74 68 69 Data Ascii: fined:1,boolean:1,number:1,string:1};S.b("extenders",S.Ta),S.ic=function(e,n,t){this.da=e,this.lc=n,this.mc=t,this.Ib=!1,this.fb=this.Jb=null,S.L(this,"dispose",this.s),S.L(this,"disposeWhenNodeIsRemoved",this.l)},S.ic.prototype.s=function(){this.Ib\|\|(thi
2023-08-24 18:54:31 UTC	1143	IN	Data Raw: 2f 5e 5c 73 2a 6b 6f 28 3f 3a 5c 73 2b 28 5b 5c 73 5c 53 5d 2b 29 29 3f 5c 73 2a 24 2f 2c 61 3d 6f 3f 2f 5e 5c 78 33 63 21 2d 2d 5c 73 2a 5c 2f 6b 6f 5c 73 2a 2d 2d 5c 78 33 65 24 2f 3a 2f 5e 5c 73 2a 5c 2f 6b 6f 5c 73 2a 24 2f 2c 73 3d 7b 75 6c 3a 21 30 2c 6f 6c 3a 21 30 7d 2c 63 3d 22 5f 5f 6b 6f 5f 6d 61 74 63 68 65 64 45 6e 64 43 6f 6d 6d 65 6e 74 5f 5f 22 3b 53 2e 68 3d 7b 65 61 3a 7b 7d 2c 63 68 69 6c 64 4e 6f 64 65 73 3a 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 72 65 74 75 72 6e 20 65 28 6e 29 3f 74 28 6e 29 3a 6e 2e 63 68 69 6c 64 4e 6f 64 65 73 7d 2c 45 61 3a 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 69 66 28 65 28 6e 29 29 66 6f 72 28 76 61 72 20 74 3d 30 2c 72 3d 28 6e 3d 53 2e 68 2e 63 68 69 6c 64 4e 6f 64 65 73 28 6e 29 29 2e 6c 65 6e 67 74 68 3b 74 3c Data Ascii: /^\sko(?:\s+([\s\S]+))?\s$/,a=o?/^\x3c!--\s\/ko\s--\x3e$/:/^\s\/ko\s$/,s={ul:!0,ol:!0},c="__ko_matchedEndComment__";S.h={ea:{},childNodes:function(n){return e(n)?t(n):n.childNodes},Ea:function(n){if(e(n))for(var t=0,r=(n=S.h.childNodes(n)).length;t<
2023-08-24 18:54:31 UTC	1159	IN	Data Raw: 3a 74 2e 61 66 74 65 72 41 64 64 2c 62 65 66 6f 72 65 52 65 6d 6f 76 65 3a 74 2e 62 65 66 6f 72 65 52 65 6d 6f 76 65 2c 61 66 74 65 72 52 65 6e 64 65 72 3a 74 2e 61 66 74 65 72 52 65 6e 64 65 72 2c 62 65 66 6f 72 65 4d 6f 76 65 3a 74 2e 62 65 66 6f 72 65 4d 6f 76 65 2c 61 66 74 65 72 4d 6f 76 65 3a 74 2e 61 66 74 65 72 4d 6f 76 65 2c 74 65 6d 70 6c 61 74 65 45 6e 67 69 6e 65 3a 53 2e 62 61 2e 4d 61 7d 29 3a 7b 66 6f 72 65 61 63 68 3a 6e 2c 74 65 6d 70 6c 61 74 65 45 6e 67 69 6e 65 3a 53 2e 62 61 2e 4d 61 7d 7d 7d 2c 69 6e 69 74 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 6e 29 7b 72 65 74 75 72 6e 20 53 2e 63 2e 74 65 6d 70 6c 61 74 65 2e 69 6e 69 74 28 65 2c 53 2e 63 2e 66 6f 72 65 61 63 68 2e 52 63 28 6e 29 29 7d 2c 75 70 64 61 74 65 3a 66 75 6e 63 74 69 6f 6e Data Ascii: :t.afterAdd,beforeRemove:t.beforeRemove,afterRender:t.afterRender,beforeMove:t.beforeMove,afterMove:t.afterMove,templateEngine:S.ba.Ma}):{foreach:n,templateEngine:S.ba.Ma}}},init:function(e,n){return S.c.template.init(e,S.c.foreach.Rc(n))},update:function
2023-08-24 18:54:31 UTC	1175	IN	Data Raw: 22 64 65 6c 65 74 65 64 22 2c 72 29 3a 65 28 74 2c 6e 2c 22 64 65 6c 65 74 65 64 22 2c 22 61 64 64 65 64 22 2c 72 29 7d 7d 28 29 2c 53 2e 62 28 22 75 74 69 6c 73 2e 63 6f 6d 70 61 72 65 41 72 72 61 79 73 22 2c 53 2e 61 2e 50 62 29 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 65 28 65 2c 6e 2c 74 2c 72 2c 6f 29 7b 76 61 72 20 69 3d 5b 5d 2c 73 3d 53 2e 24 28 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 61 3d 6e 28 74 2c 6f 2c 53 2e 61 2e 55 61 28 69 2c 65 29 29 7c 7c 5b 5d 3b 30 3c 69 2e 6c 65 6e 67 74 68 26 26 28 53 2e 61 2e 58 63 28 69 2c 61 29 2c 72 26 26 53 2e 75 2e 47 28 72 2c 6e 75 6c 6c 2c 5b 74 2c 61 2c 6f 5d 29 29 2c 69 2e 6c 65 6e 67 74 68 3d 30 2c 53 2e 61 2e 4e 62 28 69 2c 61 29 7d 29 2c 6e 75 6c 6c 2c 7b 6c 3a 65 2c 53 61 Data Ascii: "deleted",r):e(t,n,"deleted","added",r)}}(),S.b("utils.compareArrays",S.a.Pb),function(){function e(e,n,t,r,o){var i=[],s=S.$((function(){var a=n(t,o,S.a.Ua(i,e))\|\|[];0<i.length&&(S.a.Xc(i,a),r&&S.u.G(r,null,[t,a,o])),i.length=0,S.a.Nb(i,a)}),null,{l:e,Sa
2023-08-24 18:54:31 UTC	1191	IN	Data Raw: 69 26 26 22 6d 73 61 Data Ascii: i&&"msa
2023-08-24 18:54:31 UTC	1191	IN	Data Raw: 4d 65 43 61 63 68 65 64 22 3d 3d 3d 6f 2e 6d 65 73 73 61 67 65 54 79 70 65 26 26 28 21 66 75 6e 63 74 69 6f 6e 28 65 2c 6e 29 7b 69 66 28 65 3d 65 7c 7c 5b 5d 2c 6e 3d 6e 7c 7c 5b 5d 2c 54 3d 72 2e 75 74 69 6c 73 2e 61 72 72 61 79 46 69 6c 74 65 72 28 6e 2c 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 28 65 2e 69 73 53 69 67 6e 65 64 49 6e 7c 7c 65 2e 69 73 57 69 6e 64 6f 77 73 53 73 6f 29 26 26 21 65 2e 69 73 4d 65 43 6f 6e 74 72 6f 6c 53 65 73 73 69 6f 6e 26 26 65 2e 69 64 7d 29 29 2c 77 3d 54 2e 6c 65 6e 67 74 68 2c 41 3d 72 2e 75 74 69 6c 73 2e 61 72 72 61 79 46 69 6c 74 65 72 28 65 2c 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 65 2e 69 73 53 69 67 6e 65 64 49 6e 7c 7c 65 2e 69 73 57 69 6e 64 6f 77 73 53 73 6f 7d 29 29 2c Data Ascii: MeCached"===o.messageType&&(!function(e,n){if(e=e\|\|[],n=n\|\|[],T=r.utils.arrayFilter(n,(function(e){return(e.isSignedIn\|\|e.isWindowsSso)&&!e.isMeControlSession&&e.id})),w=T.length,A=r.utils.arrayFilter(e,(function(e){return e.isSignedIn\|\|e.isWindowsSso})),

Timestamp	kBytes transferred	Direction	Data
2023-08-24 18:54:36 UTC	1205	OUT	POST /v1/consent HTTP/1.1 Host: consentreceiverfd-prod.azurefd.net Connection: keep-alive Content-Length: 107 sec-ch-ua: "Not/A)Brand";v="99", "Google Chrome";v="115", "Chromium";v="115" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://support.microsoft.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://support.microsoft.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-08-24 18:54:36 UTC	1206	OUT	Data Raw: 7b 22 63 6f 6e 73 65 6e 74 49 64 22 3a 22 65 72 68 71 62 61 65 77 6f 79 37 30 6e 6f 6f 68 38 30 37 79 70 6a 63 6c 22 2c 22 63 6f 6e 73 65 6e 74 53 74 61 74 75 73 22 3a 22 41 6e 61 6c 79 74 69 63 73 3d 74 72 75 65 2d 53 6f 63 69 61 6c 4d 65 64 69 61 3d 74 72 75 65 2d 41 64 76 65 72 74 69 73 69 6e 67 3d 74 72 75 65 22 7d Data Ascii: {"consentId":"erhqbaewoy70nooh807ypjcl","consentStatus":"Analytics=true-SocialMedia=true-Advertising=true"}
2023-08-24 18:54:36 UTC	1206	IN	HTTP/1.1 202 Accepted Date: Thu, 24 Aug 2023 18:54:36 GMT Content-Length: 0 Connection: close Access-Control-Allow-Origin: * Set-Cookie: TiPMix=33.62589199899507; path=/; HttpOnly; Domain=consentreceiver-germanywestcentral-app-prod.azurewebsites.net; Max-Age=3600; Secure; SameSite=None Set-Cookie: x-ms-routing-name=self; path=/; HttpOnly; Domain=consentreceiver-germanywestcentral-app-prod.azurewebsites.net; Max-Age=3600; Secure; SameSite=None Set-Cookie: ARRAffinity=4d15f0b5460abef6d6561d83d1e5b6b625c7a74db47e42f260da70917a5ef2aa;Path=/;HttpOnly;Secure;Domain=consentreceiver-germanywestcentral-app-prod.azurewebsites.net Set-Cookie: ARRAffinitySameSite=4d15f0b5460abef6d6561d83d1e5b6b625c7a74db47e42f260da70917a5ef2aa;Path=/;HttpOnly;SameSite=None;Secure;Domain=consentreceiver-germanywestcentral-app-prod.azurewebsites.net Request-Context: appId=cid-v1:95580940-68a9-46df-8c0b-4179ce2244d3 x-azure-ref: 20230824T185436Z-3d2g37psqp77ddh3f4dg34b33w00000001mg00000001cvue X-Cache: CONFIG_NOCACHE

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 216 x 46, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4054
Entropy (8bit):	7.797012573497454
Encrypted:	false
SSDEEP:	48:zICvnyRHJ3BRZPcSPQ72N2xoiR4fTJX/rj4sFNMkk5/p1k2lPUmbm39o4aL7V9XH:10nvE724xoiRQJPrjpLKSFl9oX31Z1d
MD5:	9F14C20150A003D7CE4DE57C298F0FBA
SHA1:	DAA53CF17CC45878A1B153F3C3BF47DC9669D78F
SHA-256:	112FEC798B78AA02E102A724B5CB1990C0F909BC1D8B7B1FA256EAB41BBC0960
SHA-512:	D4F6E49C854E15FE48D6A1F1A03FDA93218AB8FCDB2C443668E7DF478830831ACC2B41DAEFC25ED38FCC8D96C4401377374FED35C36A5017A11E63C8DAE5C487
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR.............J.......tEXtSoftware.Adobe ImageReadyq.e<...(iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c132 79.159284, 2016/04/19-13:13:40 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:DocumentID="xmp.did:A00BC639840A11E68CBEB97C2156C7FD" xmpMM:InstanceID="xmp.iid:A00BC638840A11E68CBEB97C2156C7FD" xmp:CreatorTool="Adobe Photoshop CC 2015.5 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:A2C931A470A111E6AEDFA14578553B7B" stRef:documentID="xmp.did:A2C931A570A111E6AEDFA14578553B7B"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.......DIDATx..\..UU.>.7..3....h.L..& j2...h.@..".........`U.......R"..Dq.&.BJR 1.4`$.200...l........wg.y.[k/

Timestamp	kBytes transferred	Direction	Data
2023-08-24 18:54:37 UTC	1207	OUT	GET /me/mecache?partner=smcconvergence&wreply=https%3A%2F%2Fsupport.microsoft.com HTTP/1.1 Host: mem.gfx.ms Connection: keep-alive sec-ch-ua: "Not/A)Brand";v="99", "Google Chrome";v="115", "Chromium";v="115" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: iframe Referer: https://support.microsoft.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-08-24 18:54:37 UTC	1208	IN	HTTP/1.1 200 OK Date: Thu, 24 Aug 2023 18:54:37 GMT Content-Type: text/html; charset=utf-8 Content-Length: 3392 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, no-transform, max-age=7200 Expires: Thu, 24 Aug 2023 18:59:15 GMT X-Content-Type-Options: nosniff Content-Security-Policy: frame-ancestors https://support.microsoft.com; X-UA-Compatible: IE=edge Strict-Transport-Security: max-age=31536000; includeSubDomains x-azure-ref: 20230824T185437Z-yag1pe76p94kh49m1qh3h7d11800000001mg000000000221 X-Cache: TCP_HIT Accept-Ranges: bytes
2023-08-24 18:54:37 UTC	1209	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 20 2f 3e 0d 0a 20 20 20 20 0d 0a 20 20 20 20 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 20 20 20 20 3c 64 69 76 20 69 64 3d 22 62 6f 64 79 22 20 72 6f 6c 65 3d 22 6d 61 69 6e 22 3e 0d Data Ascii: <!DOCTYPE html><html lang="en" ><head> <meta charset="utf-8" /> <meta http-equiv="X-UA-Compatible" content="IE=edge" /> <meta name="viewport" content="width=device-width" /> </head><body> <div id="body" role="main">

Timestamp	kBytes transferred	Direction	Data
2023-08-24 18:55:19 UTC	1212	OUT	GET /meversion?partner=mshomepage&market=de-ch&uhf=1 HTTP/1.1 Host: mem.gfx.ms Connection: keep-alive sec-ch-ua: "Not/A)Brand";v="99", "Google Chrome";v="115", "Chromium";v="115" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.microsoft.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-08-24 18:55:19 UTC	1212	IN	HTTP/1.1 200 OK Date: Thu, 24 Aug 2023 18:55:19 GMT Content-Type: application/javascript Content-Length: 29747 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, no-transform, max-age=7200 Expires: Thu, 24 Aug 2023 20:55:19 GMT X-Content-Type-Options: nosniff Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, OPTIONS X-UA-Compatible: IE=edge Strict-Transport-Security: max-age=31536000; includeSubDomains x-azure-ref: 20230824T185519Z-9qpxpsnq3p5hx45fff464wuq5n00000001kg00000000nc6s X-Cache: TCP_MISS Accept-Ranges: bytes
2023-08-24 18:55:19 UTC	1213	IN	Data Raw: 77 69 6e 64 6f 77 2e 4d 53 41 3d 77 69 6e 64 6f 77 2e 4d 53 41 7c 7c 7b 7d 3b 77 69 6e 64 6f 77 2e 4d 53 41 2e 4d 65 43 6f 6e 74 72 6f 6c 3d 77 69 6e 64 6f 77 2e 4d 53 41 2e 4d 65 43 6f 6e 74 72 6f 6c 7c 7c 7b 7d 3b 77 69 6e 64 6f 77 2e 4d 53 41 2e 4d 65 43 6f 6e 74 72 6f 6c 2e 43 6f 6e 66 69 67 3d 7b 22 76 65 72 22 3a 22 31 30 2e 32 33 32 31 32 2e 31 22 2c 22 6d 6b 74 22 3a 22 64 65 2d 44 45 22 2c 22 70 74 6e 22 3a 22 6d 73 68 6f 6d 65 70 61 67 65 22 2c 22 67 66 78 22 3a 22 68 74 74 70 73 3a 2f 2f 61 6d 63 64 6e 2e 6d 73 66 74 61 75 74 68 2e 6e 65 74 22 2c 22 64 62 67 22 3a 66 61 6c 73 65 2c 22 61 61 64 22 3a 74 72 75 65 2c 22 69 6e 74 22 3a 66 61 6c 73 65 2c 22 70 78 79 22 3a 74 72 75 65 2c 22 6d 73 54 78 74 22 3a 66 61 6c 73 65 2c 22 72 77 64 22 3a 74 Data Ascii: window.MSA=window.MSA\|\|{};window.MSA.MeControl=window.MSA.MeControl\|\|{};window.MSA.MeControl.Config={"ver":"10.23212.1","mkt":"de-DE","ptn":"mshomepage","gfx":"https://amcdn.msftauth.net","dbg":false,"aad":true,"int":false,"pxy":true,"msTxt":false,"rwd":t
2023-08-24 18:55:19 UTC	1228	IN	Data Raw: 2d 69 6e 6c 69 6e 65 22 3a 22 6d 65 49 6e 6c 69 6e 65 22 2c 22 40 6d 65 63 6f 6e 74 72 6f 6c 2f 77 65 62 2d 62 6f 6f 74 22 3a 22 6d 65 42 6f 6f 74 22 2c 22 40 6d 65 63 6f 6e 74 72 6f 6c 2f 77 65 62 2d 63 6f 72 65 22 3a 22 6d 65 43 6f 72 65 22 7d 3b 66 75 6e 63 74 69 6f 6e 20 58 65 28 65 29 7b 74 72 79 7b 65 20 69 6e 20 48 65 26 26 28 65 3d 48 65 5b 65 5d 29 2c 7a 65 28 29 3b 76 61 72 20 6e 3d 71 65 28 65 29 3b 69 66 28 6e 29 72 65 74 75 72 6e 20 6e 2e 62 75 6e 64 6c 65 50 72 6f 6d 69 73 65 3b 76 61 72 20 74 3d 66 75 6e 63 74 69 6f 6e 28 75 29 7b 72 65 74 75 72 6e 20 6e 65 77 20 62 65 28 66 75 6e 63 74 69 6f 6e 28 69 2c 61 29 7b 76 61 72 20 65 3d 67 28 29 2c 63 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 6e 3d 6d 2e 43 6f 6e 66 69 67 3b 72 65 74 75 Data Ascii: -inline":"meInline","@mecontrol/web-boot":"meBoot","@mecontrol/web-core":"meCore"};function Xe(e){try{e in He&&(e=He[e]),ze();var n=qe(e);if(n)return n.bundlePromise;var t=function(u){return new be(function(i,a){var e=g(),c=function(e){var n=m.Config;retu

Timestamp	kBytes transferred	Direction	Data
2023-08-24 18:53:46 UTC	4	OUT	GET /scripts/c/ms.analytics-web-3.2.7.min.js HTTP/1.1 Host: js.monitor.azure.com Connection: keep-alive sec-ch-ua: "Not/A)Brand";v="99", "Google Chrome";v="115", "Chromium";v="115" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://support.microsoft.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-08-24 18:53:46 UTC	5	IN	HTTP/1.1 200 OK Date: Thu, 24 Aug 2023 18:53:46 GMT Content-Type: text/javascript; charset=utf-8 Content-Length: 139129 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=31536000, immutable, no-transform Last-Modified: Wed, 05 Oct 2022 16:53:02 GMT ETag: 0x8DAA6F2110CCD22 x-ms-request-id: f77f6841-b01e-00f1-79a7-d416dc000000 x-ms-version: 2009-09-19 x-ms-meta-jssdkver: 3.2.7 Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,x-ms-meta-jssdkver,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20230824T185346Z-yag1pe76p94kh49m1qh3h7d11800000001eg000000006u2c X-Cache: TCP_HIT Accept-Ranges: bytes
2023-08-24 18:53:46 UTC	6	IN	Data Raw: 2f 2a 21 0a 20 2a 20 31 44 53 20 4a 53 20 53 44 4b 20 41 6e 61 6c 79 74 69 63 73 20 57 65 62 2c 20 33 2e 32 2e 37 0a 20 2a 20 43 6f 70 79 72 69 67 68 74 20 28 63 29 20 4d 69 63 72 6f 73 6f 66 74 20 61 6e 64 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 2e 20 41 6c 6c 20 72 69 67 68 74 73 20 72 65 73 65 72 76 65 64 2e 0a 20 2a 20 28 4d 69 63 72 6f 73 6f 66 74 20 49 6e 74 65 72 6e 61 6c 20 4f 6e 6c 79 29 0a 20 2a 2f 0a 76 61 72 20 65 3d 74 68 69 73 2c 74 3d 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 75 3d 22 66 75 6e 63 74 69 6f 6e 22 2c 73 3d 22 6f 62 6a 65 63 74 22 2c 6c 65 3d 22 75 6e 64 65 66 69 6e 65 64 22 2c 66 3d 22 70 72 6f 74 6f 74 79 70 65 22 2c 6c 3d 22 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 22 2c 67 3d 4f Data Ascii: /! 1DS JS SDK Analytics Web, 3.2.7 * Copyright (c) Microsoft and contributors. All rights reserved. * (Microsoft Internal Only) */var e=this,t=function(n){"use strict";var u="function",s="object",le="undefined",f="prototype",l="hasOwnProperty",g=O
2023-08-24 18:53:46 UTC	21	IN	Data Raw: 7b 64 65 6c 65 74 65 20 65 5b 74 5d 7d 63 61 74 63 68 28 6e 29 7b 7d 7d 7d 3b 72 65 74 75 72 6e 20 61 7d 76 61 72 20 65 72 3d 22 74 6f 47 4d 54 53 74 72 69 6e 67 22 2c 74 72 3d 22 74 6f 55 54 43 53 74 72 69 6e 67 22 2c 6e 72 3d 22 63 6f 6f 6b 69 65 22 2c 69 72 3d 22 65 78 70 69 72 65 73 22 2c 72 72 3d 22 65 6e 61 62 6c 65 64 22 2c 61 72 3d 22 69 73 43 6f 6f 6b 69 65 55 73 65 44 69 73 61 62 6c 65 64 22 2c 6f 72 3d 22 64 69 73 61 62 6c 65 43 6f 6f 6b 69 65 73 55 73 61 67 65 22 2c 63 72 3d 22 5f 63 6b 4d 67 72 22 2c 75 72 3d 6e 75 6c 6c 2c 73 72 3d 6e 75 6c 6c 2c 6c 72 3d 6e 75 6c 6c 2c 66 72 3d 6f 65 28 29 2c 64 72 3d 7b 7d 2c 70 72 3d 7b 7d 3b 66 75 6e 63 74 69 6f 6e 20 67 72 28 65 29 7b 72 65 74 75 72 6e 21 65 7c 7c 65 2e 69 73 45 6e 61 62 6c 65 64 28 29 Data Ascii: {delete e[t]}catch(n){}}};return a}var er="toGMTString",tr="toUTCString",nr="cookie",ir="expires",rr="enabled",ar="isCookieUseDisabled",or="disableCookiesUsage",cr="_ckMgr",ur=null,sr=null,lr=null,fr=oe(),dr={},pr={};function gr(e){return!e\|\|e.isEnabled()
2023-08-24 18:53:46 UTC	37	IN	Data Raw: 3d 6e 2c 6e 3d 5b 5d 2c 74 65 28 65 2c 66 75 6e 63 74 69 6f 6e 28 65 29 7b 68 28 29 5b 6b 5d 28 65 29 7d 29 29 7d 2c 76 2e 70 6f 6c 6c 49 6e 74 65 72 6e 61 6c 4c 6f 67 73 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 77 3d 65 7c 7c 6e 75 6c 6c 3b 65 3d 24 74 28 79 2e 64 69 61 67 6e 6f 73 74 69 63 4c 6f 67 49 6e 74 65 72 76 61 6c 29 3b 72 65 74 75 72 6e 20 65 26 26 30 3c 65 7c 7c 28 65 3d 31 65 34 29 2c 5f 26 26 63 6c 65 61 72 49 6e 74 65 72 76 61 6c 28 5f 29 2c 5f 3d 73 65 74 49 6e 74 65 72 76 61 6c 28 66 75 6e 63 74 69 6f 6e 28 29 7b 74 28 29 7d 2c 65 29 7d 2c 76 5b 76 65 5d 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 5f 26 26 28 63 6c 65 61 72 49 6e 74 65 72 76 61 6c 28 5f 29 2c 5f 3d 30 2c 74 28 29 29 7d 2c 6e 6e 28 76 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 Data Ascii: =n,n=[],te(e,function(e){h()[k](e)}))},v.pollInternalLogs=function(e){w=e\|\|null;e=$t(y.diagnosticLogInterval);return e&&0<e\|\|(e=1e4),_&&clearInterval(_),_=setInterval(function(){t()},e)},v[ve]=function(){_&&(clearInterval(_),_=0,t())},nn(v,function(){retu
2023-08-24 18:53:46 UTC	53	IN	Data Raw: 74 65 6d 70 74 22 2c 6c 63 3d 22 26 4e 6f 52 65 73 70 6f 6e 73 65 42 6f 64 79 3d 74 72 75 65 22 2c 66 63 3d 28 28 6f 3d 7b 7d 29 5b 31 5d 3d 74 2c 6f 5b 31 30 30 5d 3d 74 2c 6f 5b 32 30 30 5d 3d 22 73 65 6e 74 22 2c 6f 5b 38 30 30 34 5d 3d 5f 6f 2c 6f 5b 38 30 30 33 5d 3d 5f 6f 2c 6f 29 2c 64 63 3d 7b 7d 2c 70 63 3d 7b 7d 3b 66 75 6e 63 74 69 6f 6e 20 67 63 28 65 2c 74 2c 6e 29 7b 64 63 5b 65 5d 3d 74 2c 21 31 21 3d 3d 6e 26 26 28 70 63 5b 74 5d 3d 65 29 7d 66 75 6e 63 74 69 6f 6e 20 76 63 28 65 29 7b 74 72 79 7b 72 65 74 75 72 6e 20 65 2e 72 65 73 70 6f 6e 73 65 54 65 78 74 7d 63 61 74 63 68 28 74 29 7b 7d 72 65 74 75 72 6e 22 22 7d 66 75 6e 63 74 69 6f 6e 20 68 63 28 65 2c 74 29 7b 76 61 72 20 6e 3d 21 31 3b 69 66 28 65 26 26 74 29 7b 76 61 72 20 69 3d Data Ascii: tempt",lc="&NoResponseBody=true",fc=((o={})[1]=t,o[100]=t,o[200]="sent",o[8004]=_o,o[8003]=_o,o),dc={},pc={};function gc(e,t,n){dc[e]=t,!1!==n&&(pc[t]=e)}function vc(e){try{return e.responseText}catch(t){}return""}function hc(e,t){var n=!1;if(e&&t){var i=
2023-08-24 18:53:46 UTC	69	IN	Data Raw: 61 28 6e 75 6c 6c 2c 78 29 2c 6e 3d 6a 72 28 4c 72 2c 78 29 2c 24 72 28 5b 78 72 5d 2c 6e 75 6c 6c 2c 6e 29 2c 24 72 28 5b 5f 72 5d 2c 6e 75 6c 6c 2c 6e 29 2c 69 28 29 7d 2c 6c 2e 73 65 74 45 76 65 6e 74 51 75 65 75 65 4c 69 6d 69 74 73 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 48 3d 30 3c 65 3f 65 3a 31 65 34 2c 44 3d 30 3c 74 3f 74 3a 30 2c 4e 28 29 3b 76 61 72 20 6e 3d 65 3c 46 3b 69 66 28 21 6e 26 26 30 3c 5f 29 66 6f 72 28 76 61 72 20 69 3d 31 3b 21 6e 26 26 69 3c 3d 33 3b 69 2b 2b 29 7b 76 61 72 20 72 3d 58 5b 69 5d 3b 72 26 26 72 2e 62 61 74 63 68 65 73 26 26 74 65 28 72 2e 62 61 74 63 68 65 73 2c 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 26 26 65 2e 63 6f 75 6e 74 28 29 3e 3d 5f 26 26 28 6e 3d 21 30 29 7d 29 7d 76 28 21 30 2c 6e 29 7d 2c 6c 2e 70 Data Ascii: a(null,x),n=jr(Lr,x),$r([xr],null,n),$r([_r],null,n),i()},l.setEventQueueLimits=function(e,t){H=0<e?e:1e4,D=0<t?t:0,N();var n=e<F;if(!n&&0<_)for(var i=1;!n&&i<=3;i++){var r=X[i];r&&r.batches&&te(r.batches,function(e){e&&e.count()>=_&&(n=!0)})}v(!0,n)},l.p
2023-08-24 18:53:46 UTC	85	IN	Data Raw: 74 29 7b 69 5b 65 5d 7c 7c 28 69 5b 65 5d 3d 74 29 7d 29 2c 61 2e 70 72 6f 63 65 73 73 4e 65 78 74 28 65 2c 74 29 7d 2c 61 2e 67 65 74 50 72 6f 70 65 72 74 69 65 73 43 6f 6e 74 65 78 74 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 6f 7d 2c 61 2e 73 65 74 50 72 6f 70 65 72 74 79 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 63 5b 65 5d 3d 74 7d 2c 61 2e 5f 64 6f 54 65 61 72 64 6f 77 6e 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 76 61 72 20 6e 2c 65 3d 28 65 7c 7c 7b 7d 29 2e 63 6f 72 65 28 29 3b 65 26 26 65 2e 67 65 74 54 72 61 63 65 43 74 78 26 26 6f 26 26 28 6e 3d 65 2e 67 65 74 54 72 61 63 65 43 74 78 28 21 31 29 29 26 26 6e 3d 3d 3d 6f 2e 67 65 74 54 72 61 63 65 43 74 78 28 29 26 26 65 2e 73 65 74 54 72 61 63 65 43 74 78 28 6e 75 6c 6c 29 Data Ascii: t){i[e]\|\|(i[e]=t)}),a.processNext(e,t)},a.getPropertiesContext=function(){return o},a.setProperty=function(e,t){c[e]=t},a._doTeardown=function(e,t){var n,e=(e\|\|{}).core();e&&e.getTraceCtx&&o&&(n=e.getTraceCtx(!1))&&n===o.getTraceCtx()&&e.setTraceCtx(null)
2023-08-24 18:53:46 UTC	101	IN	Data Raw: 6f 3d 30 3b 28 74 7c 7c 6e 29 26 26 28 74 3d 74 3f 28 69 3d 74 5b 6e 66 5d 2c 72 3d 30 3d 3d 3d 74 2e 73 74 61 72 74 54 69 6d 65 3f 74 5b 67 66 5d 3a 7a 73 28 74 2e 73 74 61 72 74 54 69 6d 65 2c 74 5b 67 66 5d 29 2c 61 3d 7a 73 28 74 2e 72 65 71 75 65 73 74 53 74 61 72 74 2c 74 5b 6c 66 5d 29 2c 6f 3d 7a 73 28 74 5b 6c 66 5d 2c 74 5b 70 66 5d 29 2c 7a 73 28 74 2e 72 65 73 70 6f 6e 73 65 45 6e 64 2c 74 5b 64 66 5d 29 29 3a 28 69 3d 7a 73 28 6e 5b 63 66 5d 2c 6e 5b 64 66 5d 29 2c 72 3d 7a 73 28 6e 5b 63 66 5d 2c 6e 5b 67 66 5d 29 2c 61 3d 7a 73 28 6e 2e 72 65 71 75 65 73 74 53 74 61 72 74 2c 6e 5b 6c 66 5d 29 2c 6f 3d 7a 73 28 6e 5b 6c 66 5d 2c 6e 5b 70 66 5d 29 2c 7a 73 28 6e 2e 72 65 73 70 6f 6e 73 65 45 6e 64 2c 6e 5b 64 66 5d 29 29 2c 30 3d 3d 3d 69 3f Data Ascii: o=0;(t\|\|n)&&(t=t?(i=t[nf],r=0===t.startTime?t[gf]:zs(t.startTime,t[gf]),a=zs(t.requestStart,t[lf]),o=zs(t[lf],t[pf]),zs(t.responseEnd,t[df])):(i=zs(n[cf],n[df]),r=zs(n[cf],n[gf]),a=zs(n.requestStart,n[lf]),o=zs(n[lf],n[pf]),zs(n.responseEnd,n[df])),0===i?
2023-08-24 18:53:46 UTC	117	IN	Data Raw: 69 2e 5f 63 6f 6e 66 69 67 2e 63 6f 72 65 44 61 74 61 2c 22 6d 61 72 6b 65 74 22 29 2c 69 2e 5f 62 65 68 61 76 69 6f 72 4d 65 74 61 54 61 67 3d 4a 66 28 69 2e 6d 65 74 61 54 61 67 73 2c 69 2e 5f 63 6f 6e 66 69 67 2e 63 6f 72 65 44 61 74 61 2c 22 62 65 68 61 76 69 6f 72 22 29 2c 75 65 28 6e 2e 70 61 67 65 54 79 70 65 29 26 26 28 65 2e 70 61 67 65 54 79 70 65 3d 6e 2e 70 61 67 65 54 79 70 65 29 2c 75 65 28 69 2e 5f 70 61 67 65 54 79 70 65 4d 65 74 61 54 61 67 29 26 26 21 75 65 28 65 2e 70 61 67 65 54 79 70 65 29 26 26 28 65 2e 70 61 67 65 54 79 70 65 3d 69 2e 5f 70 61 67 65 54 79 70 65 4d 65 74 61 54 61 67 29 2c 75 65 28 69 2e 5f 6d 61 72 6b 65 74 4d 65 74 61 54 61 67 29 26 26 28 65 2e 6d 61 72 6b 65 74 3d 69 2e 5f 6d 61 72 6b 65 74 4d 65 74 61 54 61 67 29 Data Ascii: i._config.coreData,"market"),i._behaviorMetaTag=Jf(i.metaTags,i._config.coreData,"behavior"),ue(n.pageType)&&(e.pageType=n.pageType),ue(i._pageTypeMetaTag)&&!ue(e.pageType)&&(e.pageType=i._pageTypeMetaTag),ue(i._marketMetaTag)&&(e.market=i._marketMetaTag)
2023-08-24 18:53:46 UTC	133	IN	Data Raw: 65 2e 5f 69 73 54 72 61 63 6b 65 64 57 69 74 68 44 61 74 61 42 69 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 66 6f 72 28 76 61 72 20 74 3d 65 2e 61 74 74 72 69 62 75 74 65 73 2c 6e 3d 30 3b 6e 3c 74 2e 6c 65 6e 67 74 68 3b 6e 2b 2b 29 69 66 28 7e 74 5b 6e 5d 2e 6e 61 6d 65 2e 69 6e 64 65 78 4f 66 28 22 64 61 74 61 2d 62 69 2d 22 29 29 72 65 74 75 72 6e 21 30 3b 72 65 74 75 72 6e 21 31 7d 2c 62 64 2e 70 72 6f 74 6f 74 79 70 65 2e 5f 69 73 54 72 61 63 6b 65 64 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 66 6f 72 28 76 61 72 20 74 3d 65 2e 61 74 74 72 69 62 75 74 65 73 2c 6e 3d 30 3b 6e 3c 74 2e 6c 65 6e 67 74 68 3b 6e 2b 2b 29 69 66 28 22 64 61 74 61 2d 6d 22 3d 3d 3d 74 5b 6e 5d 2e 6e 61 6d 65 7c 7c 7e 74 5b 6e 5d 2e 6e 61 6d 65 2e 69 6e 64 65 78 4f 66 28 22 64 61 Data Ascii: e._isTrackedWithDataBi=function(e){for(var t=e.attributes,n=0;n<t.length;n++)if(~t[n].name.indexOf("data-bi-"))return!0;return!1},bd.prototype._isTracked=function(e){for(var t=e.attributes,n=0;n<t.length;n++)if("data-m"===t[n].name\|\|~t[n].name.indexOf("da

Timestamp	kBytes transferred	Direction	Data
2023-08-24 18:53:56 UTC	416	OUT	GET /meversion?partner=SMCConvergence&market=en-us&uhf=1 HTTP/1.1 Host: mem.gfx.ms Connection: keep-alive sec-ch-ua: "Not/A)Brand";v="99", "Google Chrome";v="115", "Chromium";v="115" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://support.microsoft.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-08-24 18:53:56 UTC	417	IN	HTTP/1.1 200 OK Date: Thu, 24 Aug 2023 18:53:56 GMT Content-Type: application/javascript Content-Length: 29755 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, no-transform, max-age=7200 Expires: Thu, 24 Aug 2023 19:13:32 GMT X-Content-Type-Options: nosniff Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, OPTIONS X-UA-Compatible: IE=edge Strict-Transport-Security: max-age=31536000; includeSubDomains x-azure-ref: 20230824T185356Z-b1m8r5yy7p0zf6knfcf1sdx06s00000000k000000000d5md X-Cache: TCP_HIT Accept-Ranges: bytes
2023-08-24 18:53:56 UTC	417	IN	Data Raw: 77 69 6e 64 6f 77 2e 4d 53 41 3d 77 69 6e 64 6f 77 2e 4d 53 41 7c 7c 7b 7d 3b 77 69 6e 64 6f 77 2e 4d 53 41 2e 4d 65 43 6f 6e 74 72 6f 6c 3d 77 69 6e 64 6f 77 2e 4d 53 41 2e 4d 65 43 6f 6e 74 72 6f 6c 7c 7c 7b 7d 3b 77 69 6e 64 6f 77 2e 4d 53 41 2e 4d 65 43 6f 6e 74 72 6f 6c 2e 43 6f 6e 66 69 67 3d 7b 22 76 65 72 22 3a 22 31 30 2e 32 33 32 31 32 2e 31 22 2c 22 6d 6b 74 22 3a 22 65 6e 2d 55 53 22 2c 22 70 74 6e 22 3a 22 73 6d 63 63 6f 6e 76 65 72 67 65 6e 63 65 22 2c 22 67 66 78 22 3a 22 68 74 74 70 73 3a 2f 2f 61 6d 63 64 6e 2e 6d 73 66 74 61 75 74 68 2e 6e 65 74 22 2c 22 64 62 67 22 3a 66 61 6c 73 65 2c 22 61 61 64 22 3a 74 72 75 65 2c 22 69 6e 74 22 3a 66 61 6c 73 65 2c 22 70 78 79 22 3a 74 72 75 65 2c 22 6d 73 54 78 74 22 3a 66 61 6c 73 65 2c 22 72 77 Data Ascii: window.MSA=window.MSA\|\|{};window.MSA.MeControl=window.MSA.MeControl\|\|{};window.MSA.MeControl.Config={"ver":"10.23212.1","mkt":"en-US","ptn":"smcconvergence","gfx":"https://amcdn.msftauth.net","dbg":false,"aad":true,"int":false,"pxy":true,"msTxt":false,"rw
2023-08-24 18:53:56 UTC	433	IN	Data Raw: 72 6f 6c 2f 77 65 62 2d 69 6e 6c 69 6e 65 22 3a 22 6d 65 49 6e 6c 69 6e 65 22 2c 22 40 6d 65 63 6f 6e 74 72 6f 6c 2f 77 65 62 2d 62 6f 6f 74 22 3a 22 6d 65 42 6f 6f 74 22 2c 22 40 6d 65 63 6f 6e 74 72 6f 6c 2f 77 65 62 2d 63 6f 72 65 22 3a 22 6d 65 43 6f 72 65 22 7d 3b 66 75 6e 63 74 69 6f 6e 20 58 65 28 65 29 7b 74 72 79 7b 65 20 69 6e 20 48 65 26 26 28 65 3d 48 65 5b 65 5d 29 2c 7a 65 28 29 3b 76 61 72 20 6e 3d 71 65 28 65 29 3b 69 66 28 6e 29 72 65 74 75 72 6e 20 6e 2e 62 75 6e 64 6c 65 50 72 6f 6d 69 73 65 3b 76 61 72 20 74 3d 66 75 6e 63 74 69 6f 6e 28 75 29 7b 72 65 74 75 72 6e 20 6e 65 77 20 62 65 28 66 75 6e 63 74 69 6f 6e 28 69 2c 61 29 7b 76 61 72 20 65 3d 67 28 29 2c 63 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 6e 3d 6d 2e 43 6f 6e 66 Data Ascii: rol/web-inline":"meInline","@mecontrol/web-boot":"meBoot","@mecontrol/web-core":"meCore"};function Xe(e){try{e in He&&(e=He[e]),ze();var n=qe(e);if(n)return n.bundlePromise;var t=function(u){return new be(function(i,a){var e=g(),c=function(e){var n=m.Conf

Timestamp	kBytes transferred	Direction	Data
2023-08-24 18:54:01 UTC	446	OUT	GET /scripts/c/ms.shared.analytics.mectrl-3.2.7.gbl.min.js HTTP/1.1 Host: js.monitor.azure.com Connection: keep-alive sec-ch-ua: "Not/A)Brand";v="99", "Google Chrome";v="115", "Chromium";v="115" Origin: https://support.microsoft.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://support.microsoft.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-08-24 18:54:01 UTC	447	IN	HTTP/1.1 200 OK Date: Thu, 24 Aug 2023 18:54:01 GMT Content-Type: text/javascript; charset=utf-8 Content-Length: 90648 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=31536000, immutable, no-transform Last-Modified: Wed, 05 Oct 2022 16:53:03 GMT ETag: 0x8DAA6F2118B127C x-ms-request-id: 00a38605-601e-00c8-6ac3-d444de000000 x-ms-version: 2009-09-19 x-ms-meta-jssdkver: 3.2.7 Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,x-ms-meta-jssdkver,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20230824T185401Z-f230v5eghp2v9f87ncwa344hxg000000019g00000001adnr X-Cache: TCP_HIT Accept-Ranges: bytes
2023-08-24 18:54:01 UTC	448	IN	Data Raw: 2f 2a 21 0a 20 2a 20 31 44 53 20 4a 53 20 53 44 4b 20 53 68 61 72 65 64 20 41 6e 61 6c 79 74 69 63 73 2c 20 33 2e 32 2e 37 0a 20 2a 20 43 6f 70 79 72 69 67 68 74 20 28 63 29 20 4d 69 63 72 6f 73 6f 66 74 20 61 6e 64 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 2e 20 41 6c 6c 20 72 69 67 68 74 73 20 72 65 73 65 72 76 65 64 2e 0a 20 2a 20 28 4d 69 63 72 6f 73 6f 66 74 20 49 6e 74 65 72 6e 61 6c 20 4f 6e 6c 79 29 0a 20 2a 2f 0a 21 66 75 6e 63 74 69 6f 6e 28 65 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 66 3d 22 66 75 6e 63 74 69 6f 6e 22 2c 6d 3d 22 6f 62 6a 65 63 74 22 2c 63 65 3d 22 75 6e 64 65 66 69 6e 65 64 22 2c 61 3d 22 70 72 6f 74 6f 74 79 70 65 22 2c 43 3d 22 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 22 2c 49 3d 4f 62 6a 65 63 74 2c 53 3d 49 Data Ascii: /! 1DS JS SDK Shared Analytics, 3.2.7 * Copyright (c) Microsoft and contributors. All rights reserved. * (Microsoft Internal Only) */!function(e){"use strict";var f="function",m="object",ce="undefined",a="prototype",C="hasOwnProperty",I=Object,S=I
2023-08-24 18:54:01 UTC	463	IN	Data Raw: 29 26 26 61 26 26 72 65 28 61 2e 62 6c 6f 63 6b 65 64 43 6f 6f 6b 69 65 73 29 26 26 2d 31 21 3d 3d 61 2e 62 6c 6f 63 6b 65 64 43 6f 6f 6b 69 65 73 5b 74 6e 5d 28 75 29 7c 7c 6f 69 28 61 2c 75 29 29 7c 7c 28 61 3d 7b 7d 2c 2d 31 21 3d 3d 28 6f 3d 28 75 3d 5a 28 6e 7c 7c 76 29 29 5b 74 6e 5d 28 22 3b 22 29 29 26 26 28 75 3d 5a 28 6e 5b 72 6e 5d 28 30 2c 6f 29 29 2c 61 3d 63 69 28 6e 5b 72 6e 5d 28 6f 2b 31 29 29 29 2c 53 74 28 61 2c 22 64 6f 6d 61 69 6e 22 2c 72 7c 7c 66 2c 77 74 2c 47 29 2c 4a 28 74 29 7c 7c 28 6f 3d 69 72 28 29 2c 47 28 61 5b 58 72 5d 29 26 26 30 3c 28 6e 3d 43 74 28 29 2b 31 65 33 2a 74 29 26 26 28 28 72 3d 6e 65 77 20 44 61 74 65 29 2e 73 65 74 54 69 6d 65 28 6e 29 2c 53 74 28 61 2c 58 72 2c 6c 69 28 72 2c 6f 3f 48 72 3a 57 72 29 7c 7c Data Ascii: )&&a&&re(a.blockedCookies)&&-1!==a.blockedCookies[tn](u)\|\|oi(a,u))\|\|(a={},-1!==(o=(u=Z(n\|\|v))[tn](";"))&&(u=Z(n[rn](0,o)),a=ci(n[rn](o+1))),St(a,"domain",r\|\|f,wt,G),J(t)\|\|(o=ir(),G(a[Xr])&&0<(n=Ct()+1e3*t)&&((r=new Date).setTime(n),St(a,Xr,li(r,o?Hr:Wr)\|\|
2023-08-24 18:54:01 UTC	479	IN	Data Raw: 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 6e 5b 45 65 5d 7d 2c 73 65 74 4e 61 6d 65 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 6e 5b 45 65 5d 3d 65 7d 2c 67 65 74 54 72 61 63 65 49 64 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 6e 5b 53 6e 5d 7d 2c 73 65 74 54 72 61 63 65 49 64 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 58 69 28 65 29 26 26 28 6e 5b 53 6e 5d 3d 65 29 7d 2c 67 65 74 53 70 61 6e 49 64 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 6e 2e 73 70 61 6e 49 64 7d 2c 73 65 74 53 70 61 6e 49 64 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 51 69 28 65 29 26 26 28 6e 2e 73 70 61 6e 49 64 3d 65 29 7d 2c 67 65 74 54 72 61 63 65 46 6c 61 67 73 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 6e 5b 78 6e 5d 7d 2c 73 65 74 Data Ascii: :function(){return n[Ee]},setName:function(e){n[Ee]=e},getTraceId:function(){return n[Sn]},setTraceId:function(e){Xi(e)&&(n[Sn]=e)},getSpanId:function(){return n.spanId},setSpanId:function(e){Qi(e)&&(n.spanId=e)},getTraceFlags:function(){return n[xn]},set
2023-08-24 18:54:01 UTC	495	IN	Data Raw: 72 6d 29 29 7d 2c 71 61 3d 22 4d 69 63 72 6f 73 6f 66 74 41 70 70 6c 69 63 61 74 69 6f 6e 73 54 65 6c 65 6d 65 74 72 79 44 65 76 69 63 65 49 64 22 2c 56 61 3d 28 48 61 2e 5f 5f 69 65 44 79 6e 3d 31 2c 48 61 29 3b 66 75 6e 63 74 69 6f 6e 20 48 61 28 75 2c 73 29 7b 76 61 72 20 63 3d 30 3b 65 65 28 48 61 2c 74 68 69 73 2c 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 6e 2c 74 2c 72 2c 69 2c 6f 3d 75 2e 70 72 6f 70 65 72 74 79 53 74 6f 72 61 67 65 4f 76 65 72 72 69 64 65 2c 61 3d 28 65 2e 73 65 71 3d 63 2c 65 2e 65 70 6f 63 68 3d 4e 72 28 21 31 29 2e 74 6f 53 74 72 69 6e 67 28 29 2c 61 69 28 73 2c 75 29 29 3b 61 2e 69 73 45 6e 61 62 6c 65 64 28 29 7c 7c 6f 3f 28 72 3d 61 2c 69 3d 71 61 2c 72 3d 28 6f 3f 6f 2e 67 65 74 50 72 6f 70 65 72 74 79 28 69 29 7c 7c Data Ascii: rm))},qa="MicrosoftApplicationsTelemetryDeviceId",Va=(Ha.__ieDyn=1,Ha);function Ha(u,s){var c=0;ee(Ha,this,function(e){var n,t,r,i,o=u.propertyStorageOverride,a=(e.seq=c,e.epoch=Nr(!1).toString(),ai(s,u));a.isEnabled()\|\|o?(r=a,i=qa,r=(o?o.getProperty(i)\|\|
2023-08-24 18:54:01 UTC	511	IN	Data Raw: 6f 62 28 66 29 3b 69 66 28 64 26 26 64 2e 6c 65 6e 67 74 68 3c 3d 73 29 7b 76 61 72 20 76 3d 64 2e 6c 65 6e 67 74 68 3b 69 66 28 75 3c 6e 2e 6c 65 6e 67 74 68 2b 76 29 7b 67 2e 6f 76 65 72 66 6c 6f 77 3d 70 2e 73 70 6c 69 74 28 63 29 3b 62 72 65 61 6b 7d 6e 26 26 28 6e 2b 3d 22 5c 6e 22 29 2c 6e 2b 3d 64 2c 32 30 3c 2b 2b 6c 26 26 28 6e 2e 73 75 62 73 74 72 28 30 2c 31 29 2c 6c 3d 30 29 2c 72 3d 21 30 2c 74 2b 2b 7d 65 6c 73 65 28 64 3f 69 3a 6f 29 2e 70 75 73 68 28 66 29 2c 65 2e 73 70 6c 69 63 65 28 63 2c 31 29 2c 63 2d 2d 7d 63 2b 2b 7d 69 26 26 30 3c 69 2e 6c 65 6e 67 74 68 26 26 67 2e 73 69 7a 65 45 78 63 65 65 64 2e 70 75 73 68 28 72 73 2e 63 72 65 61 74 65 28 70 2e 69 4b 65 79 28 29 2c 69 29 29 2c 6f 26 26 30 3c 6f 2e 6c 65 6e 67 74 68 26 26 67 2e Data Ascii: ob(f);if(d&&d.length<=s){var v=d.length;if(u<n.length+v){g.overflow=p.split(c);break}n&&(n+="\n"),n+=d,20<++l&&(n.substr(0,1),l=0),r=!0,t++}else(d?i:o).push(f),e.splice(c,1),c--}c++}i&&0<i.length&&g.sizeExceed.push(rs.create(p.iKey(),i)),o&&0<o.length&&g.
2023-08-24 18:54:01 UTC	527	IN	Data Raw: 67 5b 70 2e 69 64 65 6e 74 69 66 69 65 72 5d 7c 7c 7b 7d 2c 54 3d 72 2e 67 65 74 45 78 74 43 66 67 28 70 2e 69 64 65 6e 74 69 66 69 65 72 29 2c 41 3d 52 73 28 54 2e 73 65 74 54 69 6d 65 6f 75 74 4f 76 65 72 72 69 64 65 2c 54 2e 63 6c 65 61 72 54 69 6d 65 6f 75 74 4f 76 65 72 72 69 64 65 29 2c 4a 3d 21 54 2e 64 69 73 61 62 6c 65 4f 70 74 69 6d 69 7a 65 4f 62 6a 26 26 21 21 61 65 28 22 63 68 72 6f 6d 65 22 29 2c 6e 3d 65 2e 67 65 74 57 50 61 72 61 6d 2c 65 2e 67 65 74 57 50 61 72 61 6d 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 65 3d 30 3b 72 65 74 75 72 6e 20 54 2e 69 67 6e 6f 72 65 4d 63 31 4d 73 30 43 6f 6f 6b 69 65 50 72 6f 63 65 73 73 69 6e 67 26 26 28 65 7c 3d 32 29 2c 65 7c 6e 28 29 7d 2c 30 3c 54 2e 65 76 65 6e 74 73 4c 69 6d 69 74 49 6e 4d 65 Data Ascii: g[p.identifier]\|\|{},T=r.getExtCfg(p.identifier),A=Rs(T.setTimeoutOverride,T.clearTimeoutOverride),J=!T.disableOptimizeObj&&!!ae("chrome"),n=e.getWParam,e.getWParam=function(){var e=0;return T.ignoreMc1Ms0CookieProcessing&&(e\|=2),e\|n()},0<T.eventsLimitInMe

Timestamp	kBytes transferred	Direction	Data
2023-08-24 18:54:01 UTC	536	OUT	GET /shared/1.0/content/js/BssoInterrupt_Core_nun_Nob0yT2WjCUfgBCTog2.js HTTP/1.1 Host: aadcdn.msauth.net Connection: keep-alive sec-ch-ua: "Not/A)Brand";v="99", "Google Chrome";v="115", "Chromium";v="115" Origin: https://login.microsoftonline.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://login.microsoftonline.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-08-24 18:54:01 UTC	537	IN	HTTP/1.1 200 OK Date: Thu, 24 Aug 2023 18:54:01 GMT Content-Type: application/x-javascript Content-Length: 48719 Connection: close Cache-Control: public, max-age=31536000 Content-Encoding: gzip Last-Modified: Wed, 12 Jul 2023 10:42:33 GMT ETag: 0x8DB82C4B32A50A1 x-ms-request-id: e6985c1f-d01e-0052-57f4-d50244000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20230824T185401Z-ehzgss1dcd4mh9vdx8meag9stg00000001p000000000534e X-Cache: TCP_HIT Accept-Ranges: bytes
2023-08-24 18:54:01 UTC	538	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 bc bd 7b 5f e3 38 d2 30 fa ff f3 29 82 77 0f 63 4f 4c c8 05 68 70 70 e7 4d 03 dd cd 0c b7 21 61 7a 66 69 96 9f 93 08 70 77 62 67 6d 07 9a 09 79 3f fb a9 8b 64 cb 8e 43 f7 ec 73 7e 67 2e c1 96 4a b2 54 aa 2a 55 95 4a d2 e6 cf 6b ff 53 f9 b9 b2 f1 e3 ff 54 7a fd ee 65 bf 72 fe be d2 ff 78 7c 79 58 b9 80 b7 3f 2b 67 e7 fd e3 83 a3 1f af 07 3f 8a ff f7 1f fc b8 72 e7 8f 45 05 fe 0e bc 58 8c 2a 61 50 09 a3 8a 1f 0c c3 68 1a 46 5e 22 e2 ca 04 7e 23 df 1b 57 ee a2 70 52 49 1e 44 65 1a 85 5f c4 30 89 2b 63 3f 4e a0 d0 40 8c c3 a7 8a 09 d5 45 a3 ca 85 17 25 cf 95 e3 0b ab 06 f5 0b a8 cd bf f7 03 28 3d 0c a7 cf f0 fc 90 54 82 30 f1 87 a2 e2 05 23 aa 6d 0c 2f 41 2c 2a b3 60 24 a2 ca d3 83 3f 7c a8 9c fa c3 28 8c c3 bb a4 12 89 a1 f0 1f Data Ascii: {_80)wcOLhppM!azfipwbgmy?dCs~g.JTUJkSTzerx\|yX?+g?rEXaPhF^"~#WpRIDe_0+c?N@E%(=T0#m/A,*`$?\|(
2023-08-24 18:54:01 UTC	553	IN	Data Raw: 15 6d 4f c9 ed 14 16 cf cc 5b 4a a3 8b 78 4a d2 81 6a dd 79 28 c5 73 68 3f e6 4f 7b cf 4e b2 5e 2c f8 6e 17 3c 5c 0b af 0c e1 7a c8 19 f0 4d de ac 51 86 31 98 8a 43 50 51 40 28 e3 1f 3a 84 1c 1f 2c c7 73 3d 6c d2 a2 bd b2 ba d8 2d e8 1a c2 bd be 49 cf db ac c9 93 05 d5 cd 42 61 f1 82 28 ba 54 8d 0e 91 d5 26 a4 c0 1e f2 27 9c 64 41 57 45 79 29 94 47 f7 46 c1 d4 40 cb 0a 22 52 6c 3f 00 26 7c 44 05 6e 59 74 c9 bb 6e e8 3a 24 85 59 1d be 2c f1 e5 e5 fa c6 2e cb 90 6d 55 43 91 c8 a1 00 e5 19 5b c5 67 8e 7e 17 eb a2 83 d8 4d 6f 01 c2 17 87 a9 0f 2b f9 01 21 98 9f 23 b0 6b b5 c7 d7 e0 83 ef 9c 9c 4f 7c b0 c5 2a 75 63 8b 75 ea c6 ae d5 0e 59 54 a6 01 49 31 08 52 db af cd 12 7f 1c a7 43 40 84 fe 91 6c 0f 3c 18 18 44 83 37 32 6c 5d 05 5d 7d 8b e7 ab 77 27 5b da 85 Data Ascii: mO[JxJjy(sh?O{N^,n<\zMQ1CPQ@(:,s=l-IBa(T&'dAWEy)GF@"Rl?&\|DnYtn:$Y,.mUC[g~Mo+!#kO\|*ucuYTI1RC@l<D72l]]}w'[
2023-08-24 18:54:01 UTC	569	IN	Data Raw: a9 01 c2 91 37 a9 08 85 20 70 b8 05 ce c0 41 51 bb d9 d3 07 b7 7d c2 6b 4b 36 62 33 04 1e c8 dc 1a b9 1b c8 43 41 7b a9 40 64 37 04 27 32 2f 97 50 3f 2a b4 a0 5e 3c 18 d6 be 62 33 95 9e 3f bf 7f 7f ce 00 16 eb b0 0c e7 a1 89 f4 29 49 0e 42 18 b7 62 0a ba e1 2a b5 0f 88 8a 34 f1 2d e7 41 d6 38 e5 1d 4f 01 b4 39 56 66 50 00 1b 4e fa 8e fa 78 5a 84 71 a0 e8 d9 c2 8d c7 58 58 9e 31 9f c6 63 59 61 44 be da 41 54 af f3 7a 5d 0e f0 d6 c0 80 4b 28 b0 de 85 76 9f c9 00 b8 b3 0a d7 e1 68 94 4c d4 be 6a a2 8e f1 4e 5a d3 3e 5c f1 2f c0 61 0d 93 76 48 b3 1c 80 73 9b c3 2e 88 c3 a6 af 0d db fc 80 52 f3 66 46 4a dc ca 1d 2b 36 9d 95 b9 24 0a 18 d9 8b 8e f7 50 c9 50 3c da 70 22 67 27 ae 0d 87 d0 66 3a 59 40 fb cb 72 c8 68 9b a7 39 7d eb 88 b0 c2 60 a4 e3 64 cf 90 be 3d Data Ascii: 7 pAQ}kK6b3CA{@d7'2/P?^<b3?)IBb4-A8O9VfPNxZqXX1cYaDATz]K(vhLjNZ>\/avHs.RfFJ+6$PP<p"g'f:Y@rh9}`d=
2023-08-24 18:54:01 UTC	585	IN	Data Raw: bb 52 b8 37 da 07 3d 88 93 0e c5 a2 af d6 0e 70 23 38 c0 0d 78 56 02 7a 4f 7c 7c 25 75 2e 2d f1 47 df ef 7a 93 2d 1b f5 4b c3 e1 bc 7f 6a 16 ba 56 2d df d9 fb 46 d7 b1 d1 f0 52 3c c0 6b 98 9f 26 5d 98 cb 3a a2 55 a4 4c 77 5f 1b be 54 b3 29 9c 52 77 5e 07 ca 38 0c d0 e3 ff b1 08 3a ae 44 15 1c ac 39 36 00 af 3a 48 5a dd c5 46 a8 49 f4 83 c7 50 fd 0f 2c 8c aa 50 c2 4d 39 83 40 e8 2c f6 9c 01 80 d0 e7 5a a3 e3 e4 8b 85 a3 78 d8 50 2c 4f 03 b0 6f 3b 80 d4 08 9d 8f d9 80 fe 57 43 a7 07 03 2b 8e dc 57 4f ab aa 40 3a 02 41 06 0f 06 2a b0 79 b0 71 7e fa 98 49 91 8f 9f bf 9d 0f 77 76 06 e7 f9 40 e5 6f 96 62 12 25 3e d8 d9 a1 02 89 14 7d cc e0 db 92 df 48 23 6d db 2d d2 5f 93 8c 08 8c c1 34 b6 e2 cb 07 1b 7f 20 91 e4 cd 67 82 c0 3d 78 f8 53 b3 41 0f a9 45 fa eb 8f Data Ascii: R7=p#8xVzO\|\|%u.-Gz-KjV-FR<k&]:ULw_T)Rw^8:D96:HZFIP,PM9@,ZxP,Oo;WC+WO@:A*yq~Iwv@ob%>}H#m-_4 g=xSAE

Timestamp	kBytes transferred	Direction	Data
2023-08-24 18:54:05 UTC	729	OUT	GET /scripts/me/MeControl/10.23212.1/en-US/meBoot.min.js HTTP/1.1 Host: mem.gfx.ms Connection: keep-alive sec-ch-ua: "Not/A)Brand";v="99", "Google Chrome";v="115", "Chromium";v="115" Origin: https://support.microsoft.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://support.microsoft.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-08-24 18:54:05 UTC	730	IN	HTTP/1.1 200 OK Date: Thu, 24 Aug 2023 18:54:05 GMT Content-Type: application/javascript Content-Length: 181223 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Last-Modified: Fri, 04 Aug 2023 17:23:30 GMT ETag: "1d9c7330f6b2ee7" X-Content-Type-Options: nosniff Access-Control-Allow-Origin: * X-UA-Compatible: IE=edge Strict-Transport-Security: max-age=31536000; includeSubDomains x-azure-ref: 20230824T185405Z-een70huwm95fd4218txaekp7a000000001cg00000000mkz4 X-Cache: TCP_HIT Accept-Ranges: bytes
2023-08-24 18:54:05 UTC	731	IN	Data Raw: 4d 65 43 6f 6e 74 72 6f 6c 44 65 66 69 6e 65 28 22 6d 65 42 6f 6f 74 22 2c 5b 22 65 78 70 6f 72 74 73 22 2c 22 40 6d 65 63 6f 6e 74 72 6f 6c 2f 77 65 62 2d 69 6e 6c 69 6e 65 22 5d 2c 66 75 6e 63 74 69 6f 6e 28 74 2c 53 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 63 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 7d 2c 69 3d 7b 7d 2c 75 3d 5b 5d 2c 70 3d 5b 5d 3b 66 75 6e 63 74 69 6f 6e 20 4f 28 74 2c 65 29 7b 76 61 72 20 72 2c 6e 2c 6f 2c 69 2c 61 3d 70 3b 66 6f 72 28 69 3d 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3b 32 3c 69 2d 2d 3b 29 75 2e 70 75 73 68 28 61 72 67 75 6d 65 6e 74 73 5b 69 5d 29 3b 66 6f 72 28 65 26 26 6e 75 6c 6c 21 3d 65 2e 63 68 69 6c 64 72 65 6e 26 26 28 75 2e 6c 65 6e 67 74 68 7c 7c 75 2e 70 75 73 68 28 65 2e 63 68 69 6c 64 Data Ascii: MeControlDefine("meBoot",["exports","@mecontrol/web-inline"],function(t,S){"use strict";var c=function(){},i={},u=[],p=[];function O(t,e){var r,n,o,i,a=p;for(i=arguments.length;2<i--;)u.push(arguments[i]);for(e&&null!=e.children&&(u.length\|\|u.push(e.child
2023-08-24 18:54:05 UTC	746	IN	Data Raw: 3f 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 20 74 7d 3a 31 3d 3d 3d 65 2e 6c 65 6e 67 74 68 3f 65 5b 30 5d 3a 65 2e 72 65 64 75 63 65 28 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 74 28 65 2e 61 70 70 6c 79 28 76 6f 69 64 20 30 2c 61 72 67 75 6d 65 6e 74 73 29 29 7d 7d 29 7d 76 61 72 20 74 74 3d 41 72 72 61 79 2e 69 73 41 72 72 61 79 3b 66 75 6e 63 74 69 6f 6e 20 65 74 28 74 29 7b 76 61 72 20 65 2c 72 2c 6e 2c 6f 3d 22 22 2c 69 3d 74 79 70 65 6f 66 20 74 3b 69 66 28 22 73 74 72 69 6e 67 22 3d 3d 69 7c 7c 22 6e 75 6d 62 65 72 22 3d 3d 69 29 72 65 74 75 72 6e 20 74 7c 7c 22 22 3b 69 66 28 74 74 28 74 29 26 26 30 3c 74 2e 6c 65 6e 67 74 68 29 66 6f 72 28 65 3d 30 2c 72 3d Data Ascii: ?function(t){return t}:1===e.length?e[0]:e.reduce(function(t,e){return function(){return t(e.apply(void 0,arguments))}})}var tt=Array.isArray;function et(t){var e,r,n,o="",i=typeof t;if("string"==i\|\|"number"==i)return t\|\|"";if(tt(t)&&0<t.length)for(e=0,r=
2023-08-24 18:54:05 UTC	762	IN	Data Raw: 75 6e 63 74 69 6f 6e 20 4f 65 28 74 29 7b 66 6f 72 28 76 61 72 20 65 3d 5b 5d 2c 72 3d 31 3b 72 3c 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3b 72 2b 2b 29 65 5b 72 2d 31 5d 3d 61 72 67 75 6d 65 6e 74 73 5b 72 5d 3b 66 6f 72 28 76 61 72 20 6e 3d 30 2c 6f 3d 65 3b 6e 3c 6f 2e 6c 65 6e 67 74 68 3b 6e 2b 2b 29 7b 76 61 72 20 69 3d 6f 5b 6e 5d 3b 66 6f 72 28 76 61 72 20 61 20 69 6e 20 69 29 69 66 28 53 2e 68 61 73 4f 77 6e 28 69 2c 61 29 29 7b 76 61 72 20 73 3d 69 5b 61 5d 3b 6e 75 6c 6c 3d 3d 73 7c 7c 53 65 28 73 29 7c 7c 28 74 5b 61 5d 3d 73 29 7d 7d 72 65 74 75 72 6e 20 74 7d 66 75 6e 63 74 69 6f 6e 20 62 65 28 74 2c 65 2c 72 29 7b 76 61 72 20 6e 3d 53 2e 67 65 74 4f 70 74 69 6f 6e 73 28 29 3b 69 66 28 6e 29 7b 76 61 72 20 6f 3d 6e 65 77 20 53 2e 53 Data Ascii: unction Oe(t){for(var e=[],r=1;r<arguments.length;r++)e[r-1]=arguments[r];for(var n=0,o=e;n<o.length;n++){var i=o[n];for(var a in i)if(S.hasOwn(i,a)){var s=i[a];null==s\|\|Se(s)\|\|(t[a]=s)}}return t}function be(t,e,r){var n=S.getOptions();if(n){var o=new S.S
2023-08-24 18:54:05 UTC	778	IN	Data Raw: 61 74 65 64 3b 72 65 74 75 72 6e 20 4f 28 22 64 69 76 22 2c 7b 63 6c 61 73 73 3a 65 74 28 5b 72 2c 28 74 3d 7b 7d 2c 74 2e 6d 65 63 74 72 6c 5f 66 6f 63 75 73 5f 76 69 73 69 62 6c 65 3d 6f 2c 74 29 5d 29 7d 2c 6e 29 7d 2c 66 72 29 3b 66 75 6e 63 74 69 6f 6e 20 66 72 28 74 29 7b 76 61 72 20 65 3d 75 72 2e 63 61 6c 6c 28 74 68 69 73 2c 74 29 7c 7c 74 68 69 73 3b 72 65 74 75 72 6e 20 65 2e 73 74 61 74 65 3d 7b 61 63 74 69 76 61 74 65 64 3a 21 21 74 2e 76 69 73 69 62 6c 65 4f 6e 53 74 61 72 74 7d 2c 65 2e 68 61 73 52 65 63 65 6e 74 4b 65 79 62 6f 61 72 64 41 63 74 69 6f 6e 3d 21 31 2c 65 2e 6b 65 79 64 6f 77 6e 48 61 6e 64 6c 65 72 3d 65 2e 6b 65 79 64 6f 77 6e 48 61 6e 64 6c 65 72 2e 62 69 6e 64 28 65 29 2c 65 2e 63 6c 69 63 6b 48 61 6e 64 6c 65 72 3d 65 2e Data Ascii: ated;return O("div",{class:et([r,(t={},t.mectrl_focus_visible=o,t)])},n)},fr);function fr(t){var e=ur.call(this,t)\|\|this;return e.state={activated:!!t.visibleOnStart},e.hasRecentKeyboardAction=!1,e.keydownHandler=e.keydownHandler.bind(e),e.clickHandler=e.
2023-08-24 18:54:05 UTC	794	IN	Data Raw: 65 74 46 72 6f 6d 49 64 70 22 3a 72 65 74 75 72 6e 20 78 74 28 6e 75 6c 6c 3d 3d 3d 28 72 3d 74 68 69 73 2e 63 6f 6e 66 69 67 2e 6d 73 61 29 7c 7c 76 6f 69 64 20 30 3d 3d 3d 72 3f 76 6f 69 64 20 30 3a 72 2e 73 69 67 6e 4f 75 74 41 6e 64 46 6f 72 67 65 74 55 72 6c 29 3b 63 61 73 65 22 73 77 69 74 63 68 22 3a 72 65 74 75 72 6e 20 78 74 28 74 68 69 73 2e 63 6f 6e 66 69 67 2e 61 70 70 53 77 69 74 63 68 55 72 6c 29 3b 63 61 73 65 22 73 77 69 74 63 68 54 6f 22 3a 72 65 74 75 72 6e 20 78 74 28 74 68 69 73 2e 63 6f 6e 66 69 67 2e 61 70 70 53 77 69 74 63 68 54 6f 55 72 6c 29 3b 63 61 73 65 22 67 65 74 52 65 6d 65 6d 62 65 72 65 64 41 63 63 6f 75 6e 74 73 22 3a 72 65 74 75 72 6e 20 53 2e 4d 45 2e 43 6f 6e 66 69 67 2e 72 65 6d 41 63 63 26 26 4b 72 28 74 68 69 73 2c Data Ascii: etFromIdp":return xt(null===(r=this.config.msa)\|\|void 0===r?void 0:r.signOutAndForgetUrl);case"switch":return xt(this.config.appSwitchUrl);case"switchTo":return xt(this.config.appSwitchToUrl);case"getRememberedAccounts":return S.ME.Config.remAcc&&Kr(this,
2023-08-24 18:54:05 UTC	810	IN	Data Raw: 69 6e 2e 6c 69 76 65 2e 63 6f 6d 22 29 7d 66 75 6e 63 74 69 6f 6e 20 6d 6e 28 74 29 7b 72 65 74 75 72 6e 20 6e 65 77 20 79 6e 28 74 29 7d 76 61 72 20 79 6e 3d 28 76 6e 2e 70 72 6f 74 6f 74 79 70 65 2e 73 75 70 70 6f 72 74 73 4d 73 61 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 22 6d 73 61 6c 4a 73 57 69 74 68 4d 73 61 22 3d 3d 3d 74 68 69 73 2e 63 6f 6e 66 69 67 2e 74 79 70 65 7d 2c 76 6e 2e 70 72 6f 74 6f 74 79 70 65 2e 69 73 4f 70 65 72 61 74 69 6f 6e 53 75 70 70 6f 72 74 65 64 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 76 61 72 20 72 2c 6e 2c 6f 3b 73 77 69 74 63 68 28 74 29 7b 63 61 73 65 22 73 69 67 6e 4f 75 74 46 72 6f 6d 49 64 70 22 3a 72 65 74 75 72 6e 20 78 74 28 6e 75 6c 6c 3d 3d 3d 28 72 3d 74 68 69 73 2e 63 6f 6e 66 69 67 2e 61 61 Data Ascii: in.live.com")}function mn(t){return new yn(t)}var yn=(vn.prototype.supportsMsa=function(){return"msalJsWithMsa"===this.config.type},vn.prototype.isOperationSupported=function(t,e){var r,n,o;switch(t){case"signOutFromIdp":return xt(null===(r=this.config.aa
2023-08-24 18:54:05 UTC	826	IN	Data Raw: 64 5b 66 5d 2e 61 63 63 6f 75 6e 74 49 64 29 3f 6f 3a 64 5b 66 5d 2e 70 61 79 6c 6f 61 64 2e 6b 65 79 5d 29 7b 76 61 72 20 68 3d 64 5b 66 5d 2e 70 61 79 6c 6f 61 64 3b 79 2e 70 69 63 74 75 72 65 55 72 6c 3d 6e 75 6c 6c 21 3d 28 69 3d 79 2e 70 69 63 74 75 72 65 55 72 6c 29 3f 69 3a 68 2e 72 65 73 6f 75 72 63 65 2c 79 2e 63 61 63 68 65 4d 65 74 61 3f 79 2e 63 61 63 68 65 4d 65 74 61 2e 70 69 63 74 75 72 65 55 72 6c 3d 68 2e 72 65 73 6f 75 72 63 65 45 54 61 67 3a 79 2e 63 61 63 68 65 4d 65 74 61 3d 28 28 72 3d 7b 7d 29 2e 70 69 63 74 75 72 65 55 72 6c 3d 68 2e 72 65 73 6f 75 72 63 65 45 54 61 67 2c 72 29 7d 7d 72 65 74 75 72 6e 20 48 28 7b 7d 2c 6c 29 3b 63 61 73 65 22 47 45 54 5f 43 41 43 48 45 44 5f 53 48 4f 57 5f 41 55 54 48 5f 41 50 50 22 3a 76 61 72 20 Data Ascii: d[f].accountId)?o:d[f].payload.key]){var h=d[f].payload;y.pictureUrl=null!=(i=y.pictureUrl)?i:h.resource,y.cacheMeta?y.cacheMeta.pictureUrl=h.resourceETag:y.cacheMeta=((r={}).pictureUrl=h.resourceETag,r)}}return H({},l);case"GET_CACHED_SHOW_AUTH_APP":var
2023-08-24 18:54:05 UTC	842	IN	Data Raw: 73 65 74 5c 78 33 61 2d 32 70 78 5c 78 32 31 69 6d 70 6f 72 74 61 6e 74 5c 78 37 64 2e 6d 65 63 74 72 6c 5f 67 6c 79 70 68 5c 78 37 62 6f 76 65 72 66 6c 6f 77 5c 78 33 61 68 69 64 64 65 6e 5c 78 33 62 62 61 63 6b 67 72 6f 75 6e 64 2d 73 69 7a 65 5c 78 33 61 63 6f 76 65 72 5c 78 33 62 62 61 63 6b 67 72 6f 75 6e 64 2d 70 6f 73 69 74 69 6f 6e 5c 78 33 61 63 65 6e 74 65 72 20 63 65 6e 74 65 72 5c 78 33 62 62 61 63 6b 67 72 6f 75 6e 64 2d 72 65 70 65 61 74 5c 78 33 61 6e 6f 2d 72 65 70 65 61 74 5c 78 37 64 2e 67 6c 79 70 68 5f 6d 6f 72 65 5c 78 37 62 77 69 64 74 68 5c 78 33 61 32 34 70 78 5c 78 33 62 68 65 69 67 68 74 5c 78 33 61 32 34 70 78 5c 78 37 64 2e 67 6c 79 70 68 5f 74 65 78 74 5c 78 37 62 63 6c 69 70 5c 78 33 61 72 65 63 74 5c 78 32 38 31 70 78 2c 31 Data Ascii: set\x3a-2px\x21important\x7d.mectrl_glyph\x7boverflow\x3ahidden\x3bbackground-size\x3acover\x3bbackground-position\x3acenter center\x3bbackground-repeat\x3ano-repeat\x7d.glyph_more\x7bwidth\x3a24px\x3bheight\x3a24px\x7d.glyph_text\x7bclip\x3arect\x281px,1
2023-08-24 18:54:05 UTC	858	IN	Data Raw: 32 37 5c 78 32 66 5c 78 32 35 33 45 5c 78 32 35 33 43 67 20 74 72 61 6e 73 66 6f 72 6d 5c 78 33 64 5c 78 32 37 6d 61 74 72 69 78 5c 78 32 38 2e 39 20 30 20 30 20 2e 39 20 31 30 2e 34 33 31 20 31 30 2e 34 33 31 5c 78 32 39 5c 78 32 37 20 73 74 72 6f 6b 65 2d 77 69 64 74 68 5c 78 33 64 5c 78 32 37 32 5c 78 32 37 5c 78 32 35 33 45 5c 78 32 35 33 43 63 69 72 63 6c 65 20 63 78 5c 78 33 64 5c 78 32 37 32 34 2e 32 35 5c 78 32 37 20 63 79 5c 78 33 64 5c 78 32 37 31 38 5c 78 32 37 20 72 5c 78 33 64 5c 78 32 37 39 5c 78 32 37 5c 78 32 66 5c 78 32 35 33 45 5c 78 32 35 33 43 70 61 74 68 20 64 5c 78 33 64 5c 78 32 37 4d 31 31 2e 32 20 34 30 61 31 20 31 20 30 20 31 31 32 36 2e 31 20 30 5c 78 32 37 5c 78 32 66 5c 78 32 35 33 45 5c 78 32 35 33 43 5c 78 32 66 67 5c 78 32 Data Ascii: 27\x2f\x253E\x253Cg transform\x3d\x27matrix\x28.9 0 0 .9 10.431 10.431\x29\x27 stroke-width\x3d\x272\x27\x253E\x253Ccircle cx\x3d\x2724.25\x27 cy\x3d\x2718\x27 r\x3d\x279\x27\x2f\x253E\x253Cpath d\x3d\x27M11.2 40a1 1 0 1126.1 0\x27\x2f\x253E\x253C\x2fg\x2
2023-08-24 18:54:05 UTC	874	IN	Data Raw: 33 2e 38 38 37 20 35 2e 31 20 35 2e 31 20 30 20 30 31 33 2e 38 35 2d 31 2e 34 33 34 20 34 2e 37 34 31 20 34 2e 37 34 31 20 30 20 30 31 33 2e 36 32 33 20 31 2e 33 38 31 20 35 2e 32 30 38 20 35 2e 32 30 38 20 30 20 30 31 31 2e 33 20 33 2e 37 32 39 20 35 2e 32 35 39 20 35 2e 32 35 39 20 30 20 30 31 2d 31 2e 33 38 35 20 33 2e 38 33 20 35 2e 30 32 20 35 2e 30 32 20 30 20 30 31 2d 33 2e 37 37 33 20 31 2e 34 32 34 20 34 2e 39 33 31 20 34 2e 39 33 31 20 30 20 30 31 2d 33 2e 36 35 32 2d 31 2e 33 35 32 20 34 2e 39 38 34 20 34 2e 39 38 34 20 30 20 30 31 2d 31 2e 33 34 39 2d 33 2e 36 38 38 6d 32 2e 34 32 36 2d 2e 30 37 36 61 33 2e 35 33 20 33 2e 35 33 20 30 20 30 30 2e 37 20 32 2e 33 36 37 20 32 2e 35 20 32 2e 35 20 30 20 30 30 32 2e 30 31 31 2e 38 31 38 20 32 2e 33 Data Ascii: 3.887 5.1 5.1 0 013.85-1.434 4.741 4.741 0 013.623 1.381 5.208 5.208 0 011.3 3.729 5.259 5.259 0 01-1.385 3.83 5.02 5.02 0 01-3.773 1.424 4.931 4.931 0 01-3.652-1.352 4.984 4.984 0 01-1.349-3.688m2.426-.076a3.53 3.53 0 00.7 2.367 2.5 2.5 0 002.011.818 2.3
2023-08-24 18:54:05 UTC	890	IN	Data Raw: 2e 31 32 2e 31 36 37 2d 2e 32 31 2e 33 34 39 2d 2e 32 37 33 2e 35 34 37 41 32 2e 32 31 39 20 32 2e 32 31 39 20 30 20 30 30 34 20 31 31 2e 37 35 56 31 32 68 34 7a 4d 36 20 31 2e 35 63 2d 2e 33 34 34 20 30 2d 2e 36 36 37 2e 30 36 35 2d 2e 39 36 39 2e 31 39 35 2d 2e 33 30 32 2e 31 33 2d 2e 35 36 37 2e 33 30 38 2d 2e 37 39 37 2e 35 33 32 41 32 2e 34 37 37 20 32 2e 34 37 37 20 30 20 30 30 33 2e 35 20 34 4c 32 20 34 2e 32 35 56 34 61 33 2e 39 34 38 20 33 2e 39 34 38 20 30 20 30 31 31 2e 31 37 32 2d 32 2e 38 32 43 33 2e 35 33 37 2e 38 32 20 33 2e 39 36 2e 35 33 34 20 34 2e 34 34 35 2e 33 32 41 33 2e 38 31 20 33 2e 38 31 20 30 20 30 31 36 20 30 61 33 2e 39 34 38 20 33 2e 39 34 38 20 30 20 30 31 32 2e 38 32 20 31 2e 31 37 32 63 2e 33 36 2e 33 36 34 2e 36 34 36 2e Data Ascii: .12.167-.21.349-.273.547A2.219 2.219 0 004 11.75V12h4zM6 1.5c-.344 0-.667.065-.969.195-.302.13-.567.308-.797.532A2.477 2.477 0 003.5 4L2 4.25V4a3.948 3.948 0 011.172-2.82C3.537.82 3.96.534 4.445.32A3.81 3.81 0 016 0a3.948 3.948 0 012.82 1.172c.36.364.646.
2023-08-24 18:54:05 UTC	906	IN	Data Raw: 2e 63 2d 6d 65 20 2e 6d 65 63 74 72 6c 5f 61 75 74 68 41 70 70 5f 63 6c 6f 73 65 5c 78 33 61 61 63 74 69 76 65 2c 2e 6d 65 63 74 72 6c 5f 74 68 65 6d 65 5f 64 61 72 6b 20 2e 6d 65 63 74 72 6c 5f 61 75 74 68 41 70 70 5f 62 61 6e 6e 65 72 5c 78 33 61 61 63 74 69 76 65 2c 2e 6d 65 63 74 72 6c 5f 74 68 65 6d 65 5f 64 61 72 6b 20 2e 6d 65 63 74 72 6c 5f 61 75 74 68 41 70 70 5f 62 61 6e 6e 65 72 5f 70 61 72 65 6e 74 5c 78 33 61 61 63 74 69 76 65 2c 2e 6d 65 63 74 72 6c 5f 74 68 65 6d 65 5f 64 61 72 6b 20 2e 6d 65 63 74 72 6c 5f 61 75 74 68 41 70 70 5f 63 6c 6f 73 65 5c 78 33 61 61 63 74 69 76 65 5c 78 37 62 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 5c 78 33 61 5c 78 32 33 30 30 36 63 62 65 5c 78 37 64 2e 6d 65 63 74 72 6c 5f 74 68 65 6d 65 5f 61 7a 75 72 Data Ascii: .c-me .mectrl_authApp_close\x3aactive,.mectrl_theme_dark .mectrl_authApp_banner\x3aactive,.mectrl_theme_dark .mectrl_authApp_banner_parent\x3aactive,.mectrl_theme_dark .mectrl_authApp_close\x3aactive\x7bbackground-color\x3a\x23006cbe\x7d.mectrl_theme_azur

Target ID:	0
Start time:	20:53:41
Start date:	24/08/2023
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank
Imagebase:	0x7ff67bb30000
File size:	3'219'224 bytes
MD5 hash:	8D1C4713ACB7CC2AAAEE4477C58A80BA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Target ID:	1
Start time:	20:53:42
Start date:	24/08/2023
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2064 --field-trial-handle=1900,i,7809552101022236451,14928734409077466690,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff67bb30000
File size:	3'219'224 bytes
MD5 hash:	8D1C4713ACB7CC2AAAEE4477C58A80BA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Target ID:	2
Start time:	20:53:44
Start date:	24/08/2023
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	C:\Program Files\Google\Chrome\Application\chrome.exe" "https://support.microsoft.com/en-us/windows/protect-yourself-from-phishing-0c7ea947-ba98-3bd9-7184-430e1f860a44
Imagebase:	0x7ff67bb30000
File size:	3'219'224 bytes
MD5 hash:	8D1C4713ACB7CC2AAAEE4477C58A80BA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://support.microsoft.com/en-us/windows/protect-yourself-from-phishing-0c7ea947-ba98-3bd9-7184-430e1f860a44

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

Phishing

Compliance

Networking

System Summary

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5180_608054574\LICENSE

C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5180_608054574\_metadata\verified_contents.json

C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5180_608054574\keys.json

C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5180_608054574\manifest.fingerprint

C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5180_608054574\manifest.json

Chrome Cache Entry: 261

Chrome Cache Entry: 262

Chrome Cache Entry: 263

Chrome Cache Entry: 264

Chrome Cache Entry: 265

Chrome Cache Entry: 266

Chrome Cache Entry: 267

Chrome Cache Entry: 268

Chrome Cache Entry: 269

Chrome Cache Entry: 270

Chrome Cache Entry: 271

Chrome Cache Entry: 272

Chrome Cache Entry: 273

Chrome Cache Entry: 274

Chrome Cache Entry: 275

Chrome Cache Entry: 276

Chrome Cache Entry: 277

Chrome Cache Entry: 278

Chrome Cache Entry: 279

Chrome Cache Entry: 280

Chrome Cache Entry: 281

Chrome Cache Entry: 282

Chrome Cache Entry: 283

Chrome Cache Entry: 284

Windows Analysis Report
https://support.microsoft.com/en-us/windows/protect-yourself-from-phishing-0c7ea947-ba98-3bd9-7184-430e1f860a44

Description:	Adversaries may gain access to a system through a user visiting a website over the normal course of browsing. With this technique, the user's web browser is typically targeted for exploitation, but adversaries may also use compromised websites for non-exploitation behavior such as acquiring Application Access Token .
Tactics:	Initial Access
Data Sources:	Network device logs, Network intrusion detection system, Packet capture, Process use of network, SSL/TLS inspection, Web proxy
Platforms:	Linux, macOS, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre