Edit tour

Windows Analysis Report
https://aka.ms/LearnAboutSenderIdentification

Overview

General Information

Sample URL:	https://aka.ms/LearnAboutSenderIdentification
Analysis ID:	1328856
Infos:

Detection

Score:	2
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

HTML body contains low number of good links

Found iframes

HTML title does not match URL

Creates files inside the system directory

Classification

Process Tree

System is w10x64

chrome.exe (PID: 2848 cmdline: C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 6756 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2044 --field-trial-handle=1996,i,15038716698156192417,8028089534391016875,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 5492 cmdline: C:\Program Files\Google\Chrome\Application\chrome.exe" "https://aka.ms/LearnAboutSenderIdentification MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

cleanup

Joe Sandbox Signatures

• Phishing
• Compliance
• Networking
• System Summary

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=ee272b19-4411-433f-8f28-5c13cb6fd407&redirect_uri=https%3A%2F%2Fsupport.microsoft.com%2Fsignin-oidc&response_type=code%20id_token&scope=openid%20profile%20offline_access&response_mode=form_post&nonce=638333327576454117.NDM4MjlmMDItNDRkNy00ZDBkLWFjMGQtOTI3ZmJjYWZlNmZjNjgxMTQ3MTYtNWQ0NC00MzE1LWFmYzMtOTk4M2JiYTRhZmFm&prompt=none&nopa=2&state=CfDJ8F8PsHU2gDRJgFWCeQukOexVEWliDKafoMPXFRCkGO02cdhk70pm17aZD65tsWBFnAdOCx21bW5rtc8RiqyviwRBZ0n8W2O4P_QvNPSh8RxclBTOsUTOeZ5R-yoqysYRWHopdhv02lBaAVbkxq_iESGz2GPqWYMiKbgHcVusvgS93z__INJJfPBKiZ9Lr88su9W6y4l2UPbTM5ZaT5UgFR7EYYhi5nObRUB7gRos_RvhZTuy3WSFz9jTK1pBVAyphtq584jq1tsQsi1Ie2qBpvc1E-PfqwarOfVZ1yHLLoefamBPKFaZktFwmjVpTmpg119fbpcWUKZeXFDrxBF2J-Srrd3cu0aWKvM5UNi0oW71&x-client-SKU=ID_NET6_0&x-client-ver=6.30.1.0	HTTP Parser: Number of links: 0
Source: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=ee272b19-4411-433f-8f28-5c13cb6fd407&redirect_uri=https%3A%2F%2Fsupport.microsoft.com%2Fsignin-oidc&response_type=code%20id_token&scope=openid%20profile%20offline_access&response_mode=form_post&nonce=638333327576454117.NDM4MjlmMDItNDRkNy00ZDBkLWFjMGQtOTI3ZmJjYWZlNmZjNjgxMTQ3MTYtNWQ0NC00MzE1LWFmYzMtOTk4M2JiYTRhZmFm&prompt=none&nopa=2&state=CfDJ8F8PsHU2gDRJgFWCeQukOexVEWliDKafoMPXFRCkGO02cdhk70pm17aZD65tsWBFnAdOCx21bW5rtc8RiqyviwRBZ0n8W2O4P_QvNPSh8RxclBTOsUTOeZ5R-yoqysYRWHopdhv02lBaAVbkxq_iESGz2GPqWYMiKbgHcVusvgS93z__INJJfPBKiZ9Lr88su9W6y4l2UPbTM5ZaT5UgFR7EYYhi5nObRUB7gRos_RvhZTuy3WSFz9jTK1pBVAyphtq584jq1tsQsi1Ie2qBpvc1E-PfqwarOfVZ1yHLLoefamBPKFaZktFwmjVpTmpg119fbpcWUKZeXFDrxBF2J-Srrd3cu0aWKvM5UNi0oW71&x-client-SKU=ID_NET6_0&x-client-ver=6.30.1.0&sso_reload=true	HTTP Parser: Number of links: 0

Source: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=ee272b19-4411-433f-8f28-5c13cb6fd407&redirect_uri=https%3A%2F%2Fsupport.microsoft.com%2Fsignin-oidc&response_type=code%20id_token&scope=openid%20profile%20offline_access&response_mode=form_post&nonce=638333327576454117.NDM4MjlmMDItNDRkNy00ZDBkLWFjMGQtOTI3ZmJjYWZlNmZjNjgxMTQ3MTYtNWQ0NC00MzE1LWFmYzMtOTk4M2JiYTRhZmFm&prompt=none&nopa=2&state=CfDJ8F8PsHU2gDRJgFWCeQukOexVEWliDKafoMPXFRCkGO02cdhk70pm17aZD65tsWBFnAdOCx21bW5rtc8RiqyviwRBZ0n8W2O4P_QvNPSh8RxclBTOsUTOeZ5R-yoqysYRWHopdhv02lBaAVbkxq_iESGz2GPqWYMiKbgHcVusvgS93z__INJJfPBKiZ9Lr88su9W6y4l2UPbTM5ZaT5UgFR7EYYhi5nObRUB7gRos_RvhZTuy3WSFz9jTK1pBVAyphtq584jq1tsQsi1Ie2qBpvc1E-PfqwarOfVZ1yHLLoefamBPKFaZktFwmjVpTmpg119fbpcWUKZeXFDrxBF2J-Srrd3cu0aWKvM5UNi0oW71&x-client-SKU=ID_NET6_0&x-client-ver=6.30.1.0&sso_reload=true

HTTP Parser: Iframe src: https://login.live.com/Me.htm?v=3

Source: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=ee272b19-4411-433f-8f28-5c13cb6fd407&redirect_uri=https%3A%2F%2Fsupport.microsoft.com%2Fsignin-oidc&response_type=code%20id_token&scope=openid%20profile%20offline_access&response_mode=form_post&nonce=638333327576454117.NDM4MjlmMDItNDRkNy00ZDBkLWFjMGQtOTI3ZmJjYWZlNmZjNjgxMTQ3MTYtNWQ0NC00MzE1LWFmYzMtOTk4M2JiYTRhZmFm&prompt=none&nopa=2&state=CfDJ8F8PsHU2gDRJgFWCeQukOexVEWliDKafoMPXFRCkGO02cdhk70pm17aZD65tsWBFnAdOCx21bW5rtc8RiqyviwRBZ0n8W2O4P_QvNPSh8RxclBTOsUTOeZ5R-yoqysYRWHopdhv02lBaAVbkxq_iESGz2GPqWYMiKbgHcVusvgS93z__INJJfPBKiZ9Lr88su9W6y4l2UPbTM5ZaT5UgFR7EYYhi5nObRUB7gRos_RvhZTuy3WSFz9jTK1pBVAyphtq584jq1tsQsi1Ie2qBpvc1E-PfqwarOfVZ1yHLLoefamBPKFaZktFwmjVpTmpg119fbpcWUKZeXFDrxBF2J-Srrd3cu0aWKvM5UNi0oW71&x-client-SKU=ID_NET6_0&x-client-ver=6.30.1.0	HTTP Parser: Title: Redirecting does not match URL
Source: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=ee272b19-4411-433f-8f28-5c13cb6fd407&redirect_uri=https%3A%2F%2Fsupport.microsoft.com%2Fsignin-oidc&response_type=code%20id_token&scope=openid%20profile%20offline_access&response_mode=form_post&nonce=638333327576454117.NDM4MjlmMDItNDRkNy00ZDBkLWFjMGQtOTI3ZmJjYWZlNmZjNjgxMTQ3MTYtNWQ0NC00MzE1LWFmYzMtOTk4M2JiYTRhZmFm&prompt=none&nopa=2&state=CfDJ8F8PsHU2gDRJgFWCeQukOexVEWliDKafoMPXFRCkGO02cdhk70pm17aZD65tsWBFnAdOCx21bW5rtc8RiqyviwRBZ0n8W2O4P_QvNPSh8RxclBTOsUTOeZ5R-yoqysYRWHopdhv02lBaAVbkxq_iESGz2GPqWYMiKbgHcVusvgS93z__INJJfPBKiZ9Lr88su9W6y4l2UPbTM5ZaT5UgFR7EYYhi5nObRUB7gRos_RvhZTuy3WSFz9jTK1pBVAyphtq584jq1tsQsi1Ie2qBpvc1E-PfqwarOfVZ1yHLLoefamBPKFaZktFwmjVpTmpg119fbpcWUKZeXFDrxBF2J-Srrd3cu0aWKvM5UNi0oW71&x-client-SKU=ID_NET6_0&x-client-ver=6.30.1.0&sso_reload=true	HTTP Parser: Title: Redirecting does not match URL

Source: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=ee272b19-4411-433f-8f28-5c13cb6fd407&redirect_uri=https%3A%2F%2Fsupport.microsoft.com%2Fsignin-oidc&response_type=code%20id_token&scope=openid%20profile%20offline_access&response_mode=form_post&nonce=638333327576454117.NDM4MjlmMDItNDRkNy00ZDBkLWFjMGQtOTI3ZmJjYWZlNmZjNjgxMTQ3MTYtNWQ0NC00MzE1LWFmYzMtOTk4M2JiYTRhZmFm&prompt=none&nopa=2&state=CfDJ8F8PsHU2gDRJgFWCeQukOexVEWliDKafoMPXFRCkGO02cdhk70pm17aZD65tsWBFnAdOCx21bW5rtc8RiqyviwRBZ0n8W2O4P_QvNPSh8RxclBTOsUTOeZ5R-yoqysYRWHopdhv02lBaAVbkxq_iESGz2GPqWYMiKbgHcVusvgS93z__INJJfPBKiZ9Lr88su9W6y4l2UPbTM5ZaT5UgFR7EYYhi5nObRUB7gRos_RvhZTuy3WSFz9jTK1pBVAyphtq584jq1tsQsi1Ie2qBpvc1E-PfqwarOfVZ1yHLLoefamBPKFaZktFwmjVpTmpg119fbpcWUKZeXFDrxBF2J-Srrd3cu0aWKvM5UNi0oW71&x-client-SKU=ID_NET6_0&x-client-ver=6.30.1.0	HTTP Parser: No <meta name="author".. found
Source: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=ee272b19-4411-433f-8f28-5c13cb6fd407&redirect_uri=https%3A%2F%2Fsupport.microsoft.com%2Fsignin-oidc&response_type=code%20id_token&scope=openid%20profile%20offline_access&response_mode=form_post&nonce=638333327576454117.NDM4MjlmMDItNDRkNy00ZDBkLWFjMGQtOTI3ZmJjYWZlNmZjNjgxMTQ3MTYtNWQ0NC00MzE1LWFmYzMtOTk4M2JiYTRhZmFm&prompt=none&nopa=2&state=CfDJ8F8PsHU2gDRJgFWCeQukOexVEWliDKafoMPXFRCkGO02cdhk70pm17aZD65tsWBFnAdOCx21bW5rtc8RiqyviwRBZ0n8W2O4P_QvNPSh8RxclBTOsUTOeZ5R-yoqysYRWHopdhv02lBaAVbkxq_iESGz2GPqWYMiKbgHcVusvgS93z__INJJfPBKiZ9Lr88su9W6y4l2UPbTM5ZaT5UgFR7EYYhi5nObRUB7gRos_RvhZTuy3WSFz9jTK1pBVAyphtq584jq1tsQsi1Ie2qBpvc1E-PfqwarOfVZ1yHLLoefamBPKFaZktFwmjVpTmpg119fbpcWUKZeXFDrxBF2J-Srrd3cu0aWKvM5UNi0oW71&x-client-SKU=ID_NET6_0&x-client-ver=6.30.1.0&sso_reload=true	HTTP Parser: No <meta name="author".. found

Source: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=ee272b19-4411-433f-8f28-5c13cb6fd407&redirect_uri=https%3A%2F%2Fsupport.microsoft.com%2Fsignin-oidc&response_type=code%20id_token&scope=openid%20profile%20offline_access&response_mode=form_post&nonce=638333327576454117.NDM4MjlmMDItNDRkNy00ZDBkLWFjMGQtOTI3ZmJjYWZlNmZjNjgxMTQ3MTYtNWQ0NC00MzE1LWFmYzMtOTk4M2JiYTRhZmFm&prompt=none&nopa=2&state=CfDJ8F8PsHU2gDRJgFWCeQukOexVEWliDKafoMPXFRCkGO02cdhk70pm17aZD65tsWBFnAdOCx21bW5rtc8RiqyviwRBZ0n8W2O4P_QvNPSh8RxclBTOsUTOeZ5R-yoqysYRWHopdhv02lBaAVbkxq_iESGz2GPqWYMiKbgHcVusvgS93z__INJJfPBKiZ9Lr88su9W6y4l2UPbTM5ZaT5UgFR7EYYhi5nObRUB7gRos_RvhZTuy3WSFz9jTK1pBVAyphtq584jq1tsQsi1Ie2qBpvc1E-PfqwarOfVZ1yHLLoefamBPKFaZktFwmjVpTmpg119fbpcWUKZeXFDrxBF2J-Srrd3cu0aWKvM5UNi0oW71&x-client-SKU=ID_NET6_0&x-client-ver=6.30.1.0	HTTP Parser: No favicon
Source: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=ee272b19-4411-433f-8f28-5c13cb6fd407&redirect_uri=https%3A%2F%2Fsupport.microsoft.com%2Fsignin-oidc&response_type=code%20id_token&scope=openid%20profile%20offline_access&response_mode=form_post&nonce=638333327576454117.NDM4MjlmMDItNDRkNy00ZDBkLWFjMGQtOTI3ZmJjYWZlNmZjNjgxMTQ3MTYtNWQ0NC00MzE1LWFmYzMtOTk4M2JiYTRhZmFm&prompt=none&nopa=2&state=CfDJ8F8PsHU2gDRJgFWCeQukOexVEWliDKafoMPXFRCkGO02cdhk70pm17aZD65tsWBFnAdOCx21bW5rtc8RiqyviwRBZ0n8W2O4P_QvNPSh8RxclBTOsUTOeZ5R-yoqysYRWHopdhv02lBaAVbkxq_iESGz2GPqWYMiKbgHcVusvgS93z__INJJfPBKiZ9Lr88su9W6y4l2UPbTM5ZaT5UgFR7EYYhi5nObRUB7gRos_RvhZTuy3WSFz9jTK1pBVAyphtq584jq1tsQsi1Ie2qBpvc1E-PfqwarOfVZ1yHLLoefamBPKFaZktFwmjVpTmpg119fbpcWUKZeXFDrxBF2J-Srrd3cu0aWKvM5UNi0oW71&x-client-SKU=ID_NET6_0&x-client-ver=6.30.1.0&sso_reload=true	HTTP Parser: No favicon
Source: https://support.microsoft.com/en-us/silentsigninhandler	HTTP Parser: No favicon

Source: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=ee272b19-4411-433f-8f28-5c13cb6fd407&redirect_uri=https%3A%2F%2Fsupport.microsoft.com%2Fsignin-oidc&response_type=code%20id_token&scope=openid%20profile%20offline_access&response_mode=form_post&nonce=638333327576454117.NDM4MjlmMDItNDRkNy00ZDBkLWFjMGQtOTI3ZmJjYWZlNmZjNjgxMTQ3MTYtNWQ0NC00MzE1LWFmYzMtOTk4M2JiYTRhZmFm&prompt=none&nopa=2&state=CfDJ8F8PsHU2gDRJgFWCeQukOexVEWliDKafoMPXFRCkGO02cdhk70pm17aZD65tsWBFnAdOCx21bW5rtc8RiqyviwRBZ0n8W2O4P_QvNPSh8RxclBTOsUTOeZ5R-yoqysYRWHopdhv02lBaAVbkxq_iESGz2GPqWYMiKbgHcVusvgS93z__INJJfPBKiZ9Lr88su9W6y4l2UPbTM5ZaT5UgFR7EYYhi5nObRUB7gRos_RvhZTuy3WSFz9jTK1pBVAyphtq584jq1tsQsi1Ie2qBpvc1E-PfqwarOfVZ1yHLLoefamBPKFaZktFwmjVpTmpg119fbpcWUKZeXFDrxBF2J-Srrd3cu0aWKvM5UNi0oW71&x-client-SKU=ID_NET6_0&x-client-ver=6.30.1.0	HTTP Parser: No <meta name="copyright".. found
Source: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=ee272b19-4411-433f-8f28-5c13cb6fd407&redirect_uri=https%3A%2F%2Fsupport.microsoft.com%2Fsignin-oidc&response_type=code%20id_token&scope=openid%20profile%20offline_access&response_mode=form_post&nonce=638333327576454117.NDM4MjlmMDItNDRkNy00ZDBkLWFjMGQtOTI3ZmJjYWZlNmZjNjgxMTQ3MTYtNWQ0NC00MzE1LWFmYzMtOTk4M2JiYTRhZmFm&prompt=none&nopa=2&state=CfDJ8F8PsHU2gDRJgFWCeQukOexVEWliDKafoMPXFRCkGO02cdhk70pm17aZD65tsWBFnAdOCx21bW5rtc8RiqyviwRBZ0n8W2O4P_QvNPSh8RxclBTOsUTOeZ5R-yoqysYRWHopdhv02lBaAVbkxq_iESGz2GPqWYMiKbgHcVusvgS93z__INJJfPBKiZ9Lr88su9W6y4l2UPbTM5ZaT5UgFR7EYYhi5nObRUB7gRos_RvhZTuy3WSFz9jTK1pBVAyphtq584jq1tsQsi1Ie2qBpvc1E-PfqwarOfVZ1yHLLoefamBPKFaZktFwmjVpTmpg119fbpcWUKZeXFDrxBF2J-Srrd3cu0aWKvM5UNi0oW71&x-client-SKU=ID_NET6_0&x-client-ver=6.30.1.0&sso_reload=true	HTTP Parser: No <meta name="copyright".. found

Source: unknown	HTTPS traffic detected: 20.7.1.246:443 -> 192.168.2.6:49722 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.202.57.177:443 -> 192.168.2.6:49725 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.202.57.177:443 -> 192.168.2.6:49726 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.7.1.246:443 -> 192.168.2.6:49751 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 173.222.162.64:443 -> 192.168.2.6:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.127.169.103:443 -> 192.168.2.6:49758 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.7.1.246:443 -> 192.168.2.6:49788 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.7.1.246:443 -> 192.168.2.6:49811 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.127.169.103:443 -> 192.168.2.6:49859 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.7.1.246:443 -> 192.168.2.6:49863 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.7.1.246:443 -> 192.168.2.6:49866 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.7.1.246:443 -> 192.168.2.6:49922 version: TLS 1.2

Source: unknown

DNS traffic detected: queries for: accounts.google.com

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49700
Source: unknown	Network traffic detected: HTTP traffic on port 49865 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 49890 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 49902 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49811
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49898
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49866 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49892
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49890
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49855 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49700 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49922
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49921
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49904
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49903
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49902
Source: unknown	Network traffic detected: HTTP traffic on port 49903 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49900
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49866

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 20.7.1.246
Source: unknown	TCP traffic detected without corresponding DNS query: 20.7.1.246
Source: unknown	TCP traffic detected without corresponding DNS query: 20.7.1.246
Source: unknown	TCP traffic detected without corresponding DNS query: 20.7.1.246
Source: unknown	TCP traffic detected without corresponding DNS query: 20.7.1.246
Source: unknown	TCP traffic detected without corresponding DNS query: 20.7.1.246
Source: unknown	TCP traffic detected without corresponding DNS query: 20.7.1.246
Source: unknown	TCP traffic detected without corresponding DNS query: 20.7.1.246
Source: unknown	TCP traffic detected without corresponding DNS query: 20.7.1.246
Source: unknown	TCP traffic detected without corresponding DNS query: 20.7.1.246
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 23.202.57.177
Source: unknown	TCP traffic detected without corresponding DNS query: 23.202.57.177
Source: unknown	TCP traffic detected without corresponding DNS query: 23.202.57.177
Source: unknown	TCP traffic detected without corresponding DNS query: 23.202.57.177
Source: unknown	TCP traffic detected without corresponding DNS query: 23.202.57.177
Source: unknown	TCP traffic detected without corresponding DNS query: 23.202.57.177
Source: unknown	TCP traffic detected without corresponding DNS query: 23.202.57.177
Source: unknown	TCP traffic detected without corresponding DNS query: 23.202.57.177
Source: unknown	TCP traffic detected without corresponding DNS query: 23.202.57.177
Source: unknown	TCP traffic detected without corresponding DNS query: 23.202.57.177
Source: unknown	TCP traffic detected without corresponding DNS query: 23.202.57.177
Source: unknown	TCP traffic detected without corresponding DNS query: 23.202.57.177
Source: unknown	TCP traffic detected without corresponding DNS query: 23.202.57.177
Source: unknown	TCP traffic detected without corresponding DNS query: 23.202.57.177
Source: unknown	TCP traffic detected without corresponding DNS query: 23.202.57.177
Source: unknown	TCP traffic detected without corresponding DNS query: 23.202.57.177
Source: unknown	TCP traffic detected without corresponding DNS query: 23.202.57.177
Source: unknown	TCP traffic detected without corresponding DNS query: 23.202.57.177
Source: unknown	TCP traffic detected without corresponding DNS query: 23.202.57.177
Source: unknown	TCP traffic detected without corresponding DNS query: 23.202.57.177
Source: unknown	TCP traffic detected without corresponding DNS query: 20.7.1.246
Source: unknown	TCP traffic detected without corresponding DNS query: 20.7.1.246
Source: unknown	TCP traffic detected without corresponding DNS query: 20.7.1.246
Source: unknown	TCP traffic detected without corresponding DNS query: 20.7.1.246
Source: unknown	TCP traffic detected without corresponding DNS query: 20.7.1.246
Source: unknown	TCP traffic detected without corresponding DNS query: 20.7.1.246
Source: unknown	TCP traffic detected without corresponding DNS query: 20.7.1.246
Source: unknown	TCP traffic detected without corresponding DNS query: 20.7.1.246
Source: unknown	TCP traffic detected without corresponding DNS query: 20.7.1.246
Source: unknown	TCP traffic detected without corresponding DNS query: 20.7.1.246
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103

Source: global traffic	HTTP traffic detected: GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=117.0.5938.134&lang=en-US&acceptformat=crx3,puff&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26brand%3DONGR%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1Host: clients2.google.comConnection: keep-aliveX-Goog-Update-Interactivity: fgX-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmiedaX-Goog-Update-Updater: chromecrx-117.0.5938.134Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /LearnAboutSenderIdentification HTTP/1.1Host: aka.msConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /LearnAboutSenderIdentification HTTP/1.1Host: aka.msConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /scripts/c/ms.analytics-web-4.0.1.min.js HTTP/1.1Host: js.monitor.azure.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://support.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /mscc/lib/v2/wcp-consent.js HTTP/1.1Host: wcpstatic.microsoft.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://support.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: ak_bmsc=58124458F225D9CC8F2C10C80E2D5196~000000000000000000000000000000~YAAQiLvOFyxtnTiLAQAAEZrySBVnlC/boRZsRKSdOsrLIjniMDDO48ZKdWxz9XWUamC+k2Wmd9/mCCrKKqCR5qbDOAG15rEAcKcQKji9zCrgFDNPc8pXhGkElMmKTpzlJPPs6de1Q4KjaVJDpyE0f5n4km2uU4+Sj9dc9n/X0E+p3eV/Zh26JbOep8LCBO5pDmY/NCg1iBletW8LTKSNCgkffB2wXqQDNaTPiC9TG9VVm3968R8b711ER8B6ELuISNB+IGBttio7ZB9B4D6p/3gErArVmosJrYf9EybtvaNKJmWBguvc8rBO/Ma/sGXw0WlpX1tnp5Ios4woa0oAzl82nLTqiOXezNqGWnFh8PuZCTfSKtzDLBk0gJT8hA==
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=o6fWca8PpRg8zp9&MD=a3lpZKhl HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /meversion?partner=SMCConvergence&market=en-us&uhf=1 HTTP/1.1Host: mem.gfx.msConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://support.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /scripts/c/ms.shared.analytics.mectrl-3.2.7.gbl.min.js HTTP/1.1Host: js.monitor.azure.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://support.microsoft.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://support.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/BssoInterrupt_Core_pOO34JFwD1EVcxt413xLZg2.js HTTP/1.1Host: aadcdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://login.microsoftonline.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /scripts/me/MeControl/10.23271.5/en-US/meBoot.min.js HTTP/1.1Host: mem.gfx.msConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://support.microsoft.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://support.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/FetchSessions_Core_qgny_idlYt-gigeMOmoqNg2.js HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://login.microsoftonline.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /scripts/me/MeControl/10.23271.5/en-US/meCore.min.js HTTP/1.1Host: mem.gfx.msConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://support.microsoft.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://support.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /16.000/content/js/MeControl_k_NAzO2R_MfjWkq9R3m_Mw2.js HTTP/1.1Host: logincdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://login.live.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://login.live.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=o6fWca8PpRg8zp9&MD=a3lpZKhl HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /tools/pso/ping?as=chrome&brand=ONGR&pid=&hl=en&events=C1I,C2I,C7I,C1S,C7S&rep=2&rlz=C1:,C2:,C7:&id=0000000000000000000000000000000000000000488F0CA0A7 HTTP/1.1Host: clients1.google.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, br

Source: chromecache_116.2.dr	String found in binary or memory: "sameAs":["https://www.facebook.com/Microsoft","https://twitter.com/microsoft","https://www.linkedin.com/company/microsoft"] equals www.facebook.com (Facebook)
Source: chromecache_116.2.dr	String found in binary or memory: "sameAs":["https://www.facebook.com/Microsoft","https://twitter.com/microsoft","https://www.linkedin.com/company/microsoft"] equals www.linkedin.com (Linkedin)
Source: chromecache_116.2.dr	String found in binary or memory: "sameAs":["https://www.facebook.com/Microsoft","https://twitter.com/microsoft","https://www.linkedin.com/company/microsoft"] equals www.twitter.com (Twitter)
Source: chromecache_116.2.dr	String found in binary or memory: <a class="d-inline-block" href="https://www.facebook.com/Microsoft" target="_blank" aria-label="Follow Microsoft on Facebook, opens in a new tab" data-bi-ecn="Facebook" data-bi-bhvr="126" data-bi-cn="Facebook" data-bi-socchn="Facebook" data-bi-ct="Social Button" data-bi-pa="body" data-bi-compnm="Social Follow - horizontal"> equals www.facebook.com (Facebook)
Source: chromecache_116.2.dr	String found in binary or memory: <a class="d-inline-block" href="https://www.linkedin.com/company/microsoft" target="_blank" aria-label="Follow Microsoft on Linkedin, opens in a new tab" data-bi-ecn="LinkedIn" data-bi-bhvr="126" data-bi-cn="LinkedIn" data-bi-socchn="LinkedIn" data-bi-ct="Social Button" data-bi-pa="body" data-bi-compnm="Social Follow - horizontal"> equals www.linkedin.com (Linkedin)

Source: chromecache_157.2.dr	String found in binary or memory: http://feross.org
Source: chromecache_134.2.dr	String found in binary or memory: http://github.com/aFarkas/lazysizes
Source: chromecache_163.2.dr	String found in binary or memory: http://github.com/requirejs/almond/LICENSE
Source: chromecache_134.2.dr	String found in binary or memory: http://github.com/requirejs/domReady
Source: chromecache_134.2.dr	String found in binary or memory: http://github.com/requirejs/requirejs/LICENSE
Source: chromecache_158.2.dr	String found in binary or memory: http://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4EIZB?ver=f4a3
Source: chromecache_137.2.dr	String found in binary or memory: http://knockoutjs.com/
Source: chromecache_116.2.dr	String found in binary or memory: http://schema.org/Organization
Source: chromecache_149.2.dr	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: chromecache_157.2.dr	String found in binary or memory: http://www.opensource.org/licenses/mit-license.php
Source: chromecache_137.2.dr	String found in binary or memory: http://www.opensource.org/licenses/mit-license.php)
Source: chromecache_116.2.dr	String found in binary or memory: https://accdn.lpsnmedia.net
Source: chromecache_116.2.dr	String found in binary or memory: https://aka.ms/yourcaliforniaprivacychoices
Source: chromecache_116.2.dr	String found in binary or memory: https://analytics.tiktok.com
Source: chromecache_134.2.dr	String found in binary or memory: https://assets.onestore.ms
Source: chromecache_116.2.dr	String found in binary or memory: https://cdnssl.clicktale.net
Source: chromecache_116.2.dr	String found in binary or memory: https://cdnssl.clicktale.net/www32/ptc/05d32363-d534-4d93-9b65-cde674775e71.js
Source: chromecache_116.2.dr	String found in binary or memory: https://d.impactradius-event.com
Source: chromecache_158.2.dr	String found in binary or memory: https://eus-streaming-video-rt-microsoft-com.akamaized.net/0f937af8-d731-4ff2-a223-053a9189b20e/91f6
Source: chromecache_181.2.dr, chromecache_158.2.dr	String found in binary or memory: https://eus-streaming-video-rt-microsoft-com.akamaized.net/7070043d-58fb-4f43-b0cf-89f6dbf4bb38/91f6
Source: chromecache_114.2.dr	String found in binary or memory: https://github.com/carhartl/jquery-cookie
Source: chromecache_137.2.dr	String found in binary or memory: https://github.com/douglascrockford/JSON-js
Source: chromecache_116.2.dr	String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net
Source: chromecache_116.2.dr	String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE1Mu3b?ver=5c31
Source: chromecache_203.2.dr	String found in binary or memory: https://jquery.com/
Source: chromecache_203.2.dr	String found in binary or memory: https://jquery.org/license
Source: chromecache_203.2.dr	String found in binary or memory: https://js.foundation/
Source: chromecache_116.2.dr	String found in binary or memory: https://js.monitor.azure.com
Source: chromecache_116.2.dr	String found in binary or memory: https://login.live.com/me.srf?wa=wsignin1.0
Source: chromecache_115.2.dr	String found in binary or memory: https://login.microsoftonline.com
Source: chromecache_115.2.dr	String found in binary or memory: https://login.windows-ppe.net
Source: chromecache_116.2.dr	String found in binary or memory: https://lpcdn.lpsnmedia.net
Source: chromecache_116.2.dr	String found in binary or memory: https://lptag.liveperson.net
Source: chromecache_116.2.dr	String found in binary or memory: https://mem.gfx.ms
Source: chromecache_116.2.dr	String found in binary or memory: https://microsoft.teladvance.com/online/home/index.rails?icid=mscom_marcom_H2b_SurfaceLaptopStudio2T
Source: chromecache_134.2.dr	String found in binary or memory: https://microsoftwindows.112.2o7.net
Source: chromecache_116.2.dr	String found in binary or memory: https://onedrive.live.com/about/en-us/
Source: chromecache_116.2.dr	String found in binary or memory: https://outlook.live.com/owa/
Source: chromecache_181.2.dr, chromecache_158.2.dr	String found in binary or memory: https://prod-video-cms-rt-microsoft-com.akamaized.net/cms/api/am/videofiledata/RE4EIXC-enus?ver=e63f
Source: chromecache_181.2.dr, chromecache_158.2.dr	String found in binary or memory: https://prod-video-cms-rt-microsoft-com.akamaized.net/cms/api/am/videofiledata/RE4EIXC-tscriptenus?v
Source: chromecache_116.2.dr	String found in binary or memory: https://publisher.liveperson.net
Source: chromecache_153.2.dr	String found in binary or memory: https://raw.githubusercontent.com/jakearchibald/es6-promise/master/LICENSE
Source: chromecache_116.2.dr	String found in binary or memory: https://schema.org
Source: chromecache_203.2.dr	String found in binary or memory: https://sizzlejs.com/
Source: chromecache_116.2.dr	String found in binary or memory: https://twitter.com/microsoft
Source: chromecache_134.2.dr	String found in binary or memory: https://ussearchprod.trafficmanager.net/services/api/v1.0/store/categories
Source: chromecache_116.2.dr	String found in binary or memory: https://www.clarity.ms
Source: chromecache_116.2.dr	String found in binary or memory: https://www.linkedin.com/company/microsoft
Source: chromecache_116.2.dr	String found in binary or memory: https://www.onenote.com/
Source: chromecache_116.2.dr	String found in binary or memory: https://www.skype.com/en/
Source: chromecache_116.2.dr	String found in binary or memory: https://www.xbox.com/
Source: chromecache_116.2.dr	String found in binary or memory: https://www.xbox.com/en-us/games/store/pc-game-pass/cfq7ttc0kgq8?icid=CNavAllPCGamePass
Source: chromecache_116.2.dr	String found in binary or memory: https://www.xbox.com/en-us/games/store/xbox-game-pass-ultimate/cfq7ttc0khs0?icid=CNavAllXboxGamePass

Source: unknown

HTTP traffic detected: POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1Host: accounts.google.comConnection: keep-aliveContent-Length: 1Origin: https://www.google.comContent-Type: application/x-www-form-urlencodedSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 1P_JAR=2023-10-05-06; NID=511=UBeNCkZ3L8yXcx8qh4JFUXkwkNC9IrdiRdbjSTjqSiFh8WrRcbKr_rOJbgHY6TA4RT-6ps0bhemfwCPBsLMgPT7-gTcWqHvZvZbafOpkqRy0dLyYG9AjP2vbUBomarnc9pcZVlhHkUeUaWMurD0GGXyW05_B_1IyUNYEELmyqRg

Source: unknown	HTTPS traffic detected: 20.7.1.246:443 -> 192.168.2.6:49722 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.202.57.177:443 -> 192.168.2.6:49725 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.202.57.177:443 -> 192.168.2.6:49726 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.7.1.246:443 -> 192.168.2.6:49751 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 173.222.162.64:443 -> 192.168.2.6:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.127.169.103:443 -> 192.168.2.6:49758 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.7.1.246:443 -> 192.168.2.6:49788 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.7.1.246:443 -> 192.168.2.6:49811 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.127.169.103:443 -> 192.168.2.6:49859 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.7.1.246:443 -> 192.168.2.6:49863 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.7.1.246:443 -> 192.168.2.6:49866 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.7.1.246:443 -> 192.168.2.6:49922 version: TLS 1.2

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Windows\SystemTemp\chrome_BITS_2848_2031258794

Jump to behavior

Source: classification engine

Classification label: clean2.win@20/104@60/18

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2044 --field-trial-handle=1996,i,15038716698156192417,8028089534391016875,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe" "https://aka.ms/LearnAboutSenderIdentification
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2044 --field-trial-handle=1996,i,15038716698156192417,8028089534391016875,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
1 Drive-by Compromise	Windows Management Instrumentation	Path Interception	1 Process Injection	1 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	Exfiltration Over Other Network Medium	1 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	3 Non-Application Layer Protocol	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	4 Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	1 Ingress Tool Transfer	SIM Card Swap		Carrier Billing Fraud

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
https://aka.ms/LearnAboutSenderIdentification	0%	Avira URL Cloud	safe

Source	Detection	Scanner	Label
https://js.foundation/	0%	URL Reputation	safe
https://raw.githubusercontent.com/jakearchibald/es6-promise/master/LICENSE	0%	Avira URL Cloud	safe
https://microsoft.teladvance.com/online/home/index.rails?icid=mscom_marcom_H2b_SurfaceLaptopStudio2T	0%	Avira URL Cloud	safe
https://mem.gfx.ms/meversion?partner=SMCConvergence&market=en-us&uhf=1	0%	Avira URL Cloud	safe
https://www.clarity.ms	0%	Avira URL Cloud	safe
https://mem.gfx.ms	0%	Avira URL Cloud	safe
https://analytics.tiktok.com	0%	Avira URL Cloud	safe
https://d.impactradius-event.com	0%	Avira URL Cloud	safe
https://mem.gfx.ms/scripts/me/MeControl/10.23271.5/en-US/meBoot.min.js	0%	Avira URL Cloud	safe
https://assets.onestore.ms	0%	Avira URL Cloud	safe
https://aadcdn.msftauth.net/shared/1.0/content/js/FetchSessions_Core_qgny_idlYt-gigeMOmoqNg2.js	0%	Avira URL Cloud	safe
https://mem.gfx.ms/scripts/me/MeControl/10.23271.5/en-US/meCore.min.js	0%	Avira URL Cloud	safe

Domains and IPs

Download Network PCAP: filtered – full

Contacted Domains

Name	IP	Active	Malicious	Reputation
lpcdn.lpsnmedia.net	34.120.154.120	true	false	high
livepersonaccdn.teridion.systems	43.251.41.5	true	false	unknown
cs1100.wpc.omegacdn.net	152.199.4.44	true	false	unknown
accounts.google.com	142.251.2.84	true	false	high
microsoftwindows.112.2o7.net	63.140.36.119	true	false	high
sni1gl.wpc.alphacdn.net	152.195.19.97	true	false	unknown
aka.ms	96.16.70.151	true	false	high
livepersontag.teridion.systems	43.251.41.15	true	false	unknown
part-0041.t-0009.t-msedge.net	13.107.246.69	true	false	unknown
www.google.com	142.251.2.103	true	false	high
cs1227.wpc.alphacdn.net	192.229.211.199	true	false	unknown
d.impactradius-event.com	35.186.249.72	true	false	unknown
liveperson.map.fastly.net	151.101.1.192	true	false	unknown
clients.l.google.com	142.251.2.100	true	false	high
d1xbuscas8tetl.cloudfront.net	18.173.121.64	true	false	high
js.monitor.azure.com	unknown	unknown	false	high
assets.onestore.ms	unknown	unknown	false	unknown
ajax.aspnetcdn.com	unknown	unknown	false	high
clients2.google.com	unknown	unknown	false	high
publisher.liveperson.net	unknown	unknown	false	high
cdnssl.clicktale.net	unknown	unknown	false	high
clients1.google.com	unknown	unknown	false	high
accdn.lpsnmedia.net	unknown	unknown	false	high
www.clarity.ms	unknown	unknown	false	unknown
aadcdn.msftauth.net	unknown	unknown	false	unknown
logincdn.msftauth.net	unknown	unknown	false	unknown
mem.gfx.ms	unknown	unknown	false	unknown
c.s-microsoft.com	unknown	unknown	false	high
support.content.office.net	unknown	unknown	false	high
analytics.tiktok.com	unknown	unknown	false	unknown
login.microsoftonline.com	unknown	unknown	false	high
amp.azure.net	unknown	unknown	false	high
lptag.liveperson.net	unknown	unknown	false	high
acctcdn.msftauth.net	unknown	unknown	false	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://clients2.google.com/service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=117.0.5938.134&lang=en-US&acceptformat=crx3,puff&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26brand%3DONGR%26ping%3Dr%253D-1%2526e%253D1	false		high
https://mem.gfx.ms/scripts/me/MeControl/10.23271.5/en-US/meBoot.min.js	false	Avira URL Cloud: safe	unknown
https://js.monitor.azure.com/scripts/c/ms.analytics-web-4.0.1.min.js	false		high
https://aadcdn.msftauth.net/shared/1.0/content/js/FetchSessions_Core_qgny_idlYt-gigeMOmoqNg2.js	false	Avira URL Cloud: safe	unknown
https://accounts.google.com/ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard	false		high
https://mem.gfx.ms/meversion?partner=SMCConvergence&market=en-us&uhf=1	false	Avira URL Cloud: safe	unknown
https://js.monitor.azure.com/scripts/c/ms.shared.analytics.mectrl-3.2.7.gbl.min.js	false		high
https://clients1.google.com/tools/pso/ping?as=chrome&brand=ONGR&pid=&hl=en&events=C1I,C2I,C7I,C1S,C7S&rep=2&rlz=C1:,C2:,C7:&id=0000000000000000000000000000000000000000488F0CA0A7	false		high
https://aka.ms/LearnAboutSenderIdentification	false		high
https://mem.gfx.ms/scripts/me/MeControl/10.23271.5/en-US/meCore.min.js	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://outlook.live.com/owa/	chromecache_116.2.dr	false		high
https://www.xbox.com/en-us/games/store/xbox-game-pass-ultimate/cfq7ttc0khs0?icid=CNavAllXboxGamePass	chromecache_116.2.dr	false		high
https://js.monitor.azure.com	chromecache_116.2.dr	false		high
https://github.com/carhartl/jquery-cookie	chromecache_114.2.dr	false		high
https://twitter.com/microsoft	chromecache_116.2.dr	false		high
https://www.xbox.com/en-us/games/store/pc-game-pass/cfq7ttc0kgq8?icid=CNavAllPCGamePass	chromecache_116.2.dr	false		high
https://assets.onestore.ms	chromecache_134.2.dr	false	Avira URL Cloud: safe	unknown
https://login.windows-ppe.net	chromecache_115.2.dr	false		high
https://lptag.liveperson.net	chromecache_116.2.dr	false		high
http://www.opensource.org/licenses/mit-license.php	chromecache_157.2.dr	false		high
https://analytics.tiktok.com	chromecache_116.2.dr	false	Avira URL Cloud: safe	unknown
https://login.microsoftonline.com	chromecache_115.2.dr	false		high
https://www.clarity.ms	chromecache_116.2.dr	false	Avira URL Cloud: safe	unknown
https://cdnssl.clicktale.net/www32/ptc/05d32363-d534-4d93-9b65-cde674775e71.js	chromecache_116.2.dr	false		high
https://microsoft.teladvance.com/online/home/index.rails?icid=mscom_marcom_H2b_SurfaceLaptopStudio2T	chromecache_116.2.dr	false	Avira URL Cloud: safe	unknown
https://cdnssl.clicktale.net	chromecache_116.2.dr	false		high
https://publisher.liveperson.net	chromecache_116.2.dr	false		high
http://github.com/requirejs/almond/LICENSE	chromecache_163.2.dr	false		high
https://d.impactradius-event.com	chromecache_116.2.dr	false	Avira URL Cloud: safe	unknown
http://www.apache.org/licenses/LICENSE-2.0	chromecache_149.2.dr	false		high
https://microsoftwindows.112.2o7.net	chromecache_134.2.dr	false		high
https://raw.githubusercontent.com/jakearchibald/es6-promise/master/LICENSE	chromecache_153.2.dr	false	Avira URL Cloud: safe	unknown
http://github.com/requirejs/requirejs/LICENSE	chromecache_134.2.dr	false		high
https://lpcdn.lpsnmedia.net	chromecache_116.2.dr	false		high
https://www.skype.com/en/	chromecache_116.2.dr	false		high
https://www.linkedin.com/company/microsoft	chromecache_116.2.dr	false		high
http://knockoutjs.com/	chromecache_137.2.dr	false		high
https://github.com/douglascrockford/JSON-js	chromecache_137.2.dr	false		high
https://schema.org	chromecache_116.2.dr	false		high
https://mem.gfx.ms	chromecache_116.2.dr	false	Avira URL Cloud: safe	unknown
https://aka.ms/yourcaliforniaprivacychoices	chromecache_116.2.dr	false		high
https://onedrive.live.com/about/en-us/	chromecache_116.2.dr	false		high
https://jquery.org/license	chromecache_203.2.dr	false		high
https://www.onenote.com/	chromecache_116.2.dr	false		high
http://github.com/requirejs/domReady	chromecache_134.2.dr	false		high
http://www.opensource.org/licenses/mit-license.php)	chromecache_137.2.dr	false		high
https://jquery.com/	chromecache_203.2.dr	false		high
https://accdn.lpsnmedia.net	chromecache_116.2.dr	false		high
https://www.xbox.com/	chromecache_116.2.dr	false		high
http://github.com/aFarkas/lazysizes	chromecache_134.2.dr	false		high
http://schema.org/Organization	chromecache_116.2.dr	false		high
http://feross.org	chromecache_157.2.dr	false		high
https://sizzlejs.com/	chromecache_203.2.dr	false		high
https://js.foundation/	chromecache_203.2.dr	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
63.140.36.119	microsoftwindows.112.2o7.net	United States	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
13.107.246.69	part-0041.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
142.251.2.84	accounts.google.com	United States	15169	GOOGLEUS	false
151.101.1.192	liveperson.map.fastly.net	United States	54113	FASTLYUS	false
13.107.213.69	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
34.120.154.120	lpcdn.lpsnmedia.net	United States	15169	GOOGLEUS	false
96.16.70.151	aka.ms	United States	16625	AKAMAI-ASUS	false
18.173.121.64	d1xbuscas8tetl.cloudfront.net	United States	3	MIT-GATEWAYSUS	false
152.199.4.44	cs1100.wpc.omegacdn.net	United States	15133	EDGECASTUS	false
142.251.2.103	www.google.com	United States	15169	GOOGLEUS	false
43.251.41.15	livepersontag.teridion.systems	Australia	11054	LIVEPERSONUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
35.186.249.72	d.impactradius-event.com	United States	15169	GOOGLEUS	false
43.251.41.5	livepersonaccdn.teridion.systems	Australia	11054	LIVEPERSONUS	false
142.251.2.101	unknown	United States	15169	GOOGLEUS	false
142.251.2.100	clients.l.google.com	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.16
192.168.2.6

General Information

Joe Sandbox Version:	38.0.0 Ammolite
Analysis ID:	1328856
Start date and time:	2023-10-19 19:17:59 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 3m 36s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	https://aka.ms/LearnAboutSenderIdentification
Analysis system description:	Windows 10 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	6
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	CLEAN
Classification:	clean2.win@20/104@60/18
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Browse: https://www.microsoft.com/

Warnings

Exclude process from analysis (whitelisted): WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 142.251.2.94, 34.104.35.123, 23.36.116.143, 23.36.118.31, 20.42.73.24, 23.202.57.137, 20.190.151.134, 20.190.151.131, 20.190.151.133, 20.190.151.7, 20.190.151.70, 20.190.151.132, 20.190.151.68, 20.190.151.9, 20.190.151.8, 20.190.151.6, 20.190.151.67, 23.48.32.27, 23.48.32.57, 152.199.4.33, 184.30.188.202, 184.50.44.166, 104.46.162.226, 142.251.2.95, 20.125.62.241, 13.107.21.200, 204.79.197.200, 20.99.186.246, 184.50.37.195, 192.229.211.108, 23.217.118.149, 23.217.118.140, 52.182.143.210, 23.217.118.134, 23.217.118.148, 23.206.229.204, 23.206.229.231, 20.72.243.62, 23.220.75.184, 23.220.75.182, 23.220.75.171
Excluded domains from analysis (whitelisted): 160C1.wpc.azureedge.net, aijscdn2.afd.azureedge.net, lgincdnmsftuswe2.azureedge.net, assets.onestore.ms.edgekey.net, pme-greenid-prod.trafficmanager.net, slscr.update.microsoft.com, e13678.dscb.akamaiedge.net, onedscolprdeus03.eastus.cloudapp.azure.com, www.tm.lg.prod.aadmsa.akadns.net, clientservices.googleapis.com, browser.events.data.trafficmanager.net, publisher.livepersonk.akadns.net, ak.privatelink.msidentity.com, www.microsoft.com-c-3.edgekey.net, ocsp.digicert.com, onedscolprdaus02.australiasoutheast.cloudapp.azure.com, login.live.com, star-azurefd-prod.trafficmanager.net, update.googleapis.com, acctcdnvzeuno.azureedge.net, onedscolprdcus10.centralus.cloudapp.azure.com, acctcdnvzeuno.ec.azureedge.net, e10583.dspg.akamaiedge.net, san-ion.secure4.scene7.com.edgekey.net, fs.microsoft.com, acctcdnmsftuswe2.azureedge.net, content-autofill.googleapis.com, aadcdnoriginwus2.azureedge.net, dual-a-0001.a-msedge.net, analytics.tiktok.com.bytewlb.akadns.net, lgincdnvz
Not all processes where analyzed, report is missing behavior information
VT rate limit hit for: https://aka.ms/LearnAboutSenderIdentification

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 216 x 46, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4054
Entropy (8bit):	7.797012573497454
Encrypted:	false
SSDEEP:	48:zICvnyRHJ3BRZPcSPQ72N2xoiR4fTJX/rj4sFNMkk5/p1k2lPUmbm39o4aL7V9XH:10nvE724xoiRQJPrjpLKSFl9oX31Z1d
MD5:	9F14C20150A003D7CE4DE57C298F0FBA
SHA1:	DAA53CF17CC45878A1B153F3C3BF47DC9669D78F
SHA-256:	112FEC798B78AA02E102A724B5CB1990C0F909BC1D8B7B1FA256EAB41BBC0960
SHA-512:	D4F6E49C854E15FE48D6A1F1A03FDA93218AB8FCDB2C443668E7DF478830831ACC2B41DAEFC25ED38FCC8D96C4401377374FED35C36A5017A11E63C8DAE5C487
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR.............J.......tEXtSoftware.Adobe ImageReadyq.e<...(iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c132 79.159284, 2016/04/19-13:13:40 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:DocumentID="xmp.did:A00BC639840A11E68CBEB97C2156C7FD" xmpMM:InstanceID="xmp.iid:A00BC638840A11E68CBEB97C2156C7FD" xmp:CreatorTool="Adobe Photoshop CC 2015.5 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:A2C931A470A111E6AEDFA14578553B7B" stRef:documentID="xmp.did:A2C931A570A111E6AEDFA14578553B7B"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.......DIDATx..\..UU.>.7..3....h.L..& j2...h.@..".........`U.......R"..Dq.&.BJR 1.4`$.200...l........wg.y.[k/

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 19, 2023 19:18:53.933311939 CEST	53250	53	192.168.2.6	1.1.1.1
Oct 19, 2023 19:18:53.933578014 CEST	53312	53	192.168.2.6	1.1.1.1
Oct 19, 2023 19:18:53.934736967 CEST	50727	53	192.168.2.6	1.1.1.1
Oct 19, 2023 19:18:53.935425043 CEST	58072	53	192.168.2.6	1.1.1.1
Oct 19, 2023 19:18:54.075112104 CEST	53	64126	1.1.1.1	192.168.2.6
Oct 19, 2023 19:18:54.087349892 CEST	53	53250	1.1.1.1	192.168.2.6
Oct 19, 2023 19:18:54.087757111 CEST	53	53312	1.1.1.1	192.168.2.6
Oct 19, 2023 19:18:54.088232994 CEST	53	50727	1.1.1.1	192.168.2.6
Oct 19, 2023 19:18:54.088751078 CEST	53	58072	1.1.1.1	192.168.2.6
Oct 19, 2023 19:18:55.083533049 CEST	53	56574	1.1.1.1	192.168.2.6
Oct 19, 2023 19:18:56.084041119 CEST	64928	53	192.168.2.6	1.1.1.1
Oct 19, 2023 19:18:56.084162951 CEST	53893	53	192.168.2.6	1.1.1.1
Oct 19, 2023 19:18:56.238086939 CEST	53	64928	1.1.1.1	192.168.2.6
Oct 19, 2023 19:18:56.238248110 CEST	53	53893	1.1.1.1	192.168.2.6
Oct 19, 2023 19:18:56.465400934 CEST	64628	53	192.168.2.6	1.1.1.1
Oct 19, 2023 19:18:56.465657949 CEST	50459	53	192.168.2.6	1.1.1.1
Oct 19, 2023 19:18:56.619466066 CEST	53	64628	1.1.1.1	192.168.2.6
Oct 19, 2023 19:18:56.619714975 CEST	53	50459	1.1.1.1	192.168.2.6
Oct 19, 2023 19:19:00.941176891 CEST	60742	53	192.168.2.6	1.1.1.1
Oct 19, 2023 19:19:00.941646099 CEST	55468	53	192.168.2.6	1.1.1.1
Oct 19, 2023 19:19:00.942462921 CEST	65019	53	192.168.2.6	1.1.1.1
Oct 19, 2023 19:19:00.942984104 CEST	56150	53	192.168.2.6	1.1.1.1
Oct 19, 2023 19:19:01.096561909 CEST	53393	53	192.168.2.6	1.1.1.1
Oct 19, 2023 19:19:01.097028017 CEST	50736	53	192.168.2.6	1.1.1.1
Oct 19, 2023 19:19:01.100219011 CEST	64202	53	192.168.2.6	1.1.1.1
Oct 19, 2023 19:19:01.100483894 CEST	53016	53	192.168.2.6	1.1.1.1
Oct 19, 2023 19:19:04.165812016 CEST	65323	53	192.168.2.6	1.1.1.1
Oct 19, 2023 19:19:04.166028976 CEST	51313	53	192.168.2.6	1.1.1.1
Oct 19, 2023 19:19:11.924782991 CEST	49732	53	192.168.2.6	1.1.1.1
Oct 19, 2023 19:19:11.925225973 CEST	63945	53	192.168.2.6	1.1.1.1
Oct 19, 2023 19:19:12.096185923 CEST	53	50835	1.1.1.1	192.168.2.6
Oct 19, 2023 19:19:13.126121998 CEST	54155	53	192.168.2.6	1.1.1.1
Oct 19, 2023 19:19:13.126501083 CEST	63735	53	192.168.2.6	1.1.1.1
Oct 19, 2023 19:19:18.015661955 CEST	63244	53	192.168.2.6	1.1.1.1
Oct 19, 2023 19:19:18.016170025 CEST	61539	53	192.168.2.6	1.1.1.1
Oct 19, 2023 19:19:21.876463890 CEST	53	60978	1.1.1.1	192.168.2.6
Oct 19, 2023 19:19:22.411295891 CEST	54487	53	192.168.2.6	1.1.1.1
Oct 19, 2023 19:19:22.411540985 CEST	63406	53	192.168.2.6	1.1.1.1
Oct 19, 2023 19:19:22.565490961 CEST	53	54487	1.1.1.1	192.168.2.6
Oct 19, 2023 19:19:22.565553904 CEST	53	63406	1.1.1.1	192.168.2.6
Oct 19, 2023 19:19:27.299429893 CEST	61468	53	192.168.2.6	1.1.1.1
Oct 19, 2023 19:19:27.299721956 CEST	59108	53	192.168.2.6	1.1.1.1
Oct 19, 2023 19:19:27.750081062 CEST	54479	53	192.168.2.6	1.1.1.1
Oct 19, 2023 19:19:27.750654936 CEST	63509	53	192.168.2.6	1.1.1.1
Oct 19, 2023 19:19:31.102212906 CEST	53	61608	1.1.1.1	192.168.2.6
Oct 19, 2023 19:19:36.379360914 CEST	53241	53	192.168.2.6	1.1.1.1
Oct 19, 2023 19:19:36.379688025 CEST	63034	53	192.168.2.6	1.1.1.1
Oct 19, 2023 19:19:36.697576046 CEST	50655	53	192.168.2.6	1.1.1.1
Oct 19, 2023 19:19:36.697930098 CEST	54252	53	192.168.2.6	1.1.1.1
Oct 19, 2023 19:19:36.852128029 CEST	53	50655	1.1.1.1	192.168.2.6
Oct 19, 2023 19:19:36.869707108 CEST	53	54252	1.1.1.1	192.168.2.6
Oct 19, 2023 19:19:36.875269890 CEST	53	60054	1.1.1.1	192.168.2.6
Oct 19, 2023 19:19:36.875293016 CEST	53	62667	1.1.1.1	192.168.2.6
Oct 19, 2023 19:19:37.032399893 CEST	53	56687	1.1.1.1	192.168.2.6
Oct 19, 2023 19:19:53.443391085 CEST	53	61281	1.1.1.1	192.168.2.6
Oct 19, 2023 19:19:53.808198929 CEST	53	61700	1.1.1.1	192.168.2.6
Oct 19, 2023 19:20:09.941484928 CEST	55555	53	192.168.2.6	1.1.1.1
Oct 19, 2023 19:20:09.941801071 CEST	50172	53	192.168.2.6	1.1.1.1
Oct 19, 2023 19:20:10.183357000 CEST	55995	53	192.168.2.6	1.1.1.1
Oct 19, 2023 19:20:10.183727026 CEST	56005	53	192.168.2.6	1.1.1.1
Oct 19, 2023 19:20:10.187987089 CEST	52182	53	192.168.2.6	1.1.1.1
Oct 19, 2023 19:20:10.188350916 CEST	65080	53	192.168.2.6	1.1.1.1
Oct 19, 2023 19:20:10.333961964 CEST	53	57050	1.1.1.1	192.168.2.6
Oct 19, 2023 19:20:10.334523916 CEST	53	57353	1.1.1.1	192.168.2.6
Oct 19, 2023 19:20:10.343211889 CEST	50040	53	192.168.2.6	1.1.1.1
Oct 19, 2023 19:20:10.343683004 CEST	60894	53	192.168.2.6	1.1.1.1
Oct 19, 2023 19:20:10.496309042 CEST	53	50040	1.1.1.1	192.168.2.6
Oct 19, 2023 19:20:10.497160912 CEST	53	60894	1.1.1.1	192.168.2.6
Oct 19, 2023 19:20:10.501403093 CEST	55923	53	192.168.2.6	1.1.1.1
Oct 19, 2023 19:20:10.502049923 CEST	55989	53	192.168.2.6	1.1.1.1
Oct 19, 2023 19:20:10.508183002 CEST	53	51553	1.1.1.1	192.168.2.6
Oct 19, 2023 19:20:10.511800051 CEST	64789	53	192.168.2.6	1.1.1.1
Oct 19, 2023 19:20:10.512566090 CEST	57723	53	192.168.2.6	1.1.1.1
Oct 19, 2023 19:20:10.677556038 CEST	59724	53	192.168.2.6	1.1.1.1
Oct 19, 2023 19:20:10.678106070 CEST	60633	53	192.168.2.6	1.1.1.1
Oct 19, 2023 19:20:10.909643888 CEST	51656	53	192.168.2.6	1.1.1.1
Oct 19, 2023 19:20:10.909987926 CEST	50238	53	192.168.2.6	1.1.1.1
Oct 19, 2023 19:20:11.066834927 CEST	57016	53	192.168.2.6	1.1.1.1
Oct 19, 2023 19:20:11.067229986 CEST	49579	53	192.168.2.6	1.1.1.1
Oct 19, 2023 19:20:11.070187092 CEST	51271	53	192.168.2.6	1.1.1.1
Oct 19, 2023 19:20:11.071190119 CEST	55489	53	192.168.2.6	1.1.1.1
Oct 19, 2023 19:20:11.223567009 CEST	53	51271	1.1.1.1	192.168.2.6
Oct 19, 2023 19:20:11.224931002 CEST	53	55489	1.1.1.1	192.168.2.6
Oct 19, 2023 19:20:11.642004967 CEST	53826	53	192.168.2.6	1.1.1.1
Oct 19, 2023 19:20:11.642851114 CEST	60214	53	192.168.2.6	1.1.1.1
Oct 19, 2023 19:20:11.796098948 CEST	53	53826	1.1.1.1	192.168.2.6
Oct 19, 2023 19:20:11.796911001 CEST	53	60214	1.1.1.1	192.168.2.6
Oct 19, 2023 19:20:11.800523996 CEST	58752	53	192.168.2.6	1.1.1.1
Oct 19, 2023 19:20:11.800936937 CEST	51217	53	192.168.2.6	1.1.1.1
Oct 19, 2023 19:20:11.979304075 CEST	53	58998	1.1.1.1	192.168.2.6
Oct 19, 2023 19:20:11.979614019 CEST	53	60111	1.1.1.1	192.168.2.6
Oct 19, 2023 19:20:21.925781012 CEST	49262	53	192.168.2.6	1.1.1.1
Oct 19, 2023 19:20:21.926131010 CEST	50340	53	192.168.2.6	1.1.1.1
Oct 19, 2023 19:20:22.079608917 CEST	53	49262	1.1.1.1	192.168.2.6
Oct 19, 2023 19:20:22.079637051 CEST	53	50340	1.1.1.1	192.168.2.6
Oct 19, 2023 19:20:22.329081059 CEST	53	60593	1.1.1.1	192.168.2.6

Timestamp	Source IP	Source Port	Dest IP	Dest Port	Subject	Issuer	Not Before	Not After	JA3 SSL Client Fingerprint	JA3 SSL Client Digest
Oct 19, 2023 19:19:09.267550945 CEST	173.222.162.64	443	192.168.2.6	49705	CN=r.bing.com, O=Microsoft Corporation, L=Redmond, ST=WA, C=US CN=Microsoft Azure ECC TLS Issuing CA 05, O=Microsoft Corporation, C=US	CN=Microsoft Azure ECC TLS Issuing CA 05, O=Microsoft Corporation, C=US CN=DigiCert Global Root G3, OU=www.digicert.com, O=DigiCert Inc, C=US	Wed Oct 18 22:32:40 CEST 2023 Wed Aug 12 02:00:00 CEST 2020	Fri Jun 28 01:59:59 CEST 2024 Fri Jun 28 01:59:59 CEST 2024	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-5-10-11-13-35-16-23-65281,29-23-24,0	28a2c9bd18a11de089ef85a160da29e4
Oct 19, 2023 19:19:09.267550945 CEST	173.222.162.64	443	192.168.2.6	49705	CN=Microsoft Azure ECC TLS Issuing CA 05, O=Microsoft Corporation, C=US	CN=DigiCert Global Root G3, OU=www.digicert.com, O=DigiCert Inc, C=US	Wed Aug 12 02:00:00 CEST 2020	Fri Jun 28 01:59:59 CEST 2024		28a2c9bd18a11de089ef85a160da29e4

Timestamp	kBytes transferred	Direction	Data
2023-10-19 17:18:54 UTC	0	OUT	POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1 Host: accounts.google.com Connection: keep-alive Content-Length: 1 Origin: https://www.google.com Content-Type: application/x-www-form-urlencoded Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: 1P_JAR=2023-10-05-06; NID=511=UBeNCkZ3L8yXcx8qh4JFUXkwkNC9IrdiRdbjSTjqSiFh8WrRcbKr_rOJbgHY6TA4RT-6ps0bhemfwCPBsLMgPT7-gTcWqHvZvZbafOpkqRy0dLyYG9AjP2vbUBomarnc9pcZVlhHkUeUaWMurD0GGXyW05_B_1IyUNYEELmyqRg
2023-10-19 17:18:54 UTC	0	OUT	Data Raw: 20 Data Ascii:

Timestamp	kBytes transferred	Direction	Data
2023-10-19 17:18:59 UTC	8	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2023-10-19 17:19:00 UTC	9	IN	HTTP/1.1 200 OK Last-Modified: Tue, 16 May 2017 22:58:00 GMT ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json X-CID: 7 X-CCC: US X-Azure-Ref-OriginShield: Ref A: 35C99E6D169B4F63A1B2514125DB0961 Ref B: CH1AA2040901054 Ref C: 2023-08-05T07:25:37Z X-MSEdge-Ref: Ref A: 90E5741CD36646A4B6D502122F515FB1 Ref B: BY3EDGE0413 Ref C: 2023-08-05T07:25:37Z Content-Type: application/octet-stream Cache-Control: public, max-age=71952 Date: Thu, 19 Oct 2023 17:19:00 GMT Content-Length: 55 Connection: close X-CID: 2
2023-10-19 17:19:00 UTC	9	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Timestamp	kBytes transferred	Direction	Data
2023-10-19 17:19:05 UTC	10	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=31536000, immutable, no-transform Content-Length: 150021 Content-Type: text/javascript; charset=utf-8 Content-MD5: GXNNdcdwO1UiqmkT0WvhzQ== Last-Modified: Wed, 07 Jun 2023 20:33:47 GMT ETag: 0x8DB67967EA471A0 X-Cache: TCP_HIT x-ms-request-id: 4d43535b-701e-00d1-805f-0087ef000000 x-ms-version: 2009-09-19 x-ms-meta-jssdkver: 4.0.1 Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,x-ms-meta-jssdkver,Content-Type,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * X-Azure-Ref-OriginShield: 06FcwZQAAAADGdQZzhMV2QLmW0tXPWeIVU0pDMjExMDUxMjA4MDM3AGYxY2E3M2Q0LTg4ODMtNGNhZi1hYmRjLWZlMmQ1NjdhZmI5Ng== X-Azure-Ref: 0CWUxZQAAAACkb+hsRzTxQogld17xuT2nTEFYRURHRTIyMTYAZjFjYTczZDQtODg4My00Y2FmLWFiZGMtZmUyZDU2N2FmYjk2 Date: Thu, 19 Oct 2023 17:19:04 GMT Connection: close
2023-10-19 17:19:05 UTC	11	IN	Data Raw: 2f 2a 21 0a 20 2a 20 31 44 53 20 4a 53 20 53 44 4b 20 41 6e 61 6c 79 74 69 63 73 20 57 65 62 2c 20 34 2e 30 2e 31 0a 20 2a 20 43 6f 70 79 72 69 67 68 74 20 28 63 29 20 4d 69 63 72 6f 73 6f 66 74 20 61 6e 64 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 2e 20 41 6c 6c 20 72 69 67 68 74 73 20 72 65 73 65 72 76 65 64 2e 0a 20 2a 20 28 4d 69 63 72 6f 73 6f 66 74 20 49 6e 74 65 72 6e 61 6c 20 4f 6e 6c 79 29 0a 20 2a 2f 0a 76 61 72 20 65 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 24 3d 75 6e 64 65 66 69 6e 65 64 2c 79 3d 6e 75 6c 6c 2c 63 3d 22 22 2c 75 3d 22 62 6f 6f 6c 65 61 6e 22 2c 73 3d 22 66 75 6e 63 74 69 6f 6e 22 2c 6c 3d 22 6e 75 6d 62 65 72 22 2c 64 3d 22 6f 62 6a 65 63 74 22 2c 6d 3d 22 70 72 6f 74 6f 74 79 70 Data Ascii: /! 1DS JS SDK Analytics Web, 4.0.1 * Copyright (c) Microsoft and contributors. All rights reserved. * (Microsoft Internal Only) */var e=function(t){"use strict";var $=undefined,y=null,c="",u="boolean",s="function",l="number",d="object",m="prototyp
2023-10-19 17:19:05 UTC	26	IN	Data Raw: 3d 22 65 76 65 6e 74 73 53 65 6e 64 52 65 71 75 65 73 74 22 2c 6c 69 3d 22 70 65 72 66 45 76 65 6e 74 22 2c 66 69 3d 22 67 65 74 50 65 72 66 4d 67 72 22 2c 64 69 3d 22 64 6f 6d 61 69 6e 22 2c 67 69 3d 22 70 61 74 68 22 2c 70 69 3d 22 4e 6f 74 20 64 79 6e 61 6d 69 63 20 2d 20 22 2c 76 69 3d 2f 2d 28 5b 61 2d 7a 5d 29 2f 67 2c 68 69 3d 2f 28 5b 5e 5c 77 5c 64 5f 24 5d 29 2f 67 2c 6d 69 3d 2f 5e 28 5c 64 2b 5b 5c 77 5c 64 5f 24 5d 29 2f 2c 79 69 3d 4f 62 6a 65 63 74 2e 67 65 74 50 72 6f 74 6f 74 79 70 65 4f 66 3b 66 75 6e 63 74 69 6f 6e 20 54 69 28 65 29 7b 72 65 74 75 72 6e 21 74 65 28 65 29 7d 66 75 6e 63 74 69 6f 6e 20 62 69 28 65 29 7b 72 65 74 75 72 6e 20 65 26 26 72 65 28 65 29 3f 28 65 3d 28 65 3d 65 5b 71 74 5d 28 76 69 2c 66 75 6e 63 74 69 6f 6e 28 Data Ascii: ="eventsSendRequest",li="perfEvent",fi="getPerfMgr",di="domain",gi="path",pi="Not dynamic - ",vi=/-([a-z])/g,hi=/([^\w\d_$])/g,mi=/^(\d+[\w\d_$])/,yi=Object.getPrototypeOf;function Ti(e){return!te(e)}function bi(e){return e&&re(e)?(e=(e=e[qt](vi,function(
2023-10-19 17:19:05 UTC	42	IN	Data Raw: 28 65 2c 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 6e 3d 74 5b 51 5d 28 29 3b 65 5b 70 74 5d 28 74 2e 67 65 74 43 66 67 28 29 2c 6e 2c 72 2c 74 5b 46 74 5d 28 29 29 2c 61 3d 58 6f 28 65 29 2c 65 5b 51 5d 7c 7c 61 5b 51 5d 7c 7c 28 61 5b 51 5d 3d 6e 29 2c 61 5b 68 74 5d 3d 21 30 2c 64 65 6c 65 74 65 20 61 5b 78 74 5d 7d 29 7d 66 75 6e 63 74 69 6f 6e 20 4a 6f 28 65 29 7b 72 65 74 75 72 6e 20 65 2e 73 6f 72 74 28 66 75 6e 63 74 69 6f 6e 28 65 2c 6e 29 7b 76 61 72 20 74 2c 72 3d 30 3b 72 65 74 75 72 6e 20 6e 3f 28 74 3d 6e 5b 61 69 5d 2c 65 5b 61 69 5d 3f 72 3d 74 3f 65 5b 6f 69 5d 2d 6e 5b 6f 69 5d 3a 31 3a 74 26 26 28 72 3d 2d 31 29 29 3a 72 3d 65 3f 31 3a 2d 31 2c 72 7d 29 7d 76 61 72 20 51 6f 3d 22 54 65 6c 65 6d 65 74 72 79 50 6c 75 67 69 6e 43 68 Data Ascii: (e,function(e){var n=t[Q]();e[pt](t.getCfg(),n,r,t[Ft]()),a=Xo(e),e[Q]\|\|a[Q]\|\|(a[Q]=n),a[ht]=!0,delete a[xt]})}function Jo(e){return e.sort(function(e,n){var t,r=0;return n?(t=n[ai],e[ai]?r=t?e[oi]-n[oi]:1:t&&(r=-1)):r=e?1:-1,r})}var Qo="TelemetryPluginCh
2023-10-19 17:19:05 UTC	58	IN	Data Raw: 72 65 74 75 72 6e 20 69 75 28 65 2c 72 2c 69 2c 6e 2c 31 29 2c 72 2e 72 73 6c 74 7d 7d 66 75 6e 63 74 69 6f 6e 20 6f 75 28 65 2c 6e 2c 74 2c 72 2c 69 29 7b 69 66 28 65 26 26 6e 26 26 74 29 7b 72 3d 66 75 6e 63 74 69 6f 6e 20 6f 28 65 2c 6e 2c 74 2c 72 29 7b 76 61 72 20 69 3d 6e 75 6c 6c 3b 72 65 74 75 72 6e 20 65 26 26 28 49 65 28 65 2c 6e 29 3f 69 3d 65 3a 74 26 26 28 69 3d 6f 28 79 69 28 65 29 2c 6e 2c 72 2c 21 31 29 29 29 2c 69 7d 28 65 2c 6e 2c 72 2c 69 29 7c 7c 65 3b 69 66 28 72 29 72 65 74 75 72 6e 20 72 3d 28 69 3d 72 29 5b 65 3d 6e 5d 2c 6e 3d 74 2c 28 61 3d 72 26 26 72 5b 6e 75 5d 29 7c 7c 28 28 74 3d 61 75 28 61 3d 7b 69 3a 30 2c 6e 3a 65 2c 66 3a 72 2c 68 3a 5b 5d 7d 29 29 5b 6e 75 5d 3d 61 2c 69 5b 65 5d 3d 74 29 2c 72 3d 7b 69 64 3a 61 2e 69 Data Ascii: return iu(e,r,i,n,1),r.rslt}}function ou(e,n,t,r,i){if(e&&n&&t){r=function o(e,n,t,r){var i=null;return e&&(Ie(e,n)?i=e:t&&(i=o(yi(e),n,r,!1))),i}(e,n,r,i)\|\|e;if(r)return r=(i=r)[e=n],n=t,(a=r&&r[nu])\|\|((t=au(a={i:0,n:e,f:r,h:[]}))[nu]=a,i[e]=t),r={id:a.i
2023-10-19 17:19:05 UTC	74	IN	Data Raw: 6f 6e 43 6f 6d 70 6c 65 74 65 64 3a 75 2c 73 65 6e 64 52 65 61 73 6f 6e 3a 70 7d 7d 2c 67 2e 69 73 53 79 6e 63 29 29 2c 67 2e 73 69 7a 65 45 78 63 65 65 64 26 26 30 3c 67 2e 73 69 7a 65 45 78 63 65 65 64 2e 6c 65 6e 67 74 68 26 26 45 28 67 2e 73 69 7a 65 45 78 63 65 65 64 2c 38 30 30 33 2c 67 2e 73 65 6e 64 54 79 70 65 29 2c 67 2e 66 61 69 6c 65 64 45 76 74 73 26 26 30 3c 67 2e 66 61 69 6c 65 64 45 76 74 73 2e 6c 65 6e 67 74 68 26 26 45 28 67 2e 66 61 69 6c 65 64 45 76 74 73 2c 38 30 30 32 2c 67 2e 73 65 6e 64 54 79 70 65 29 7d 66 75 6e 63 74 69 6f 6e 20 49 28 65 2c 6e 2c 74 29 7b 6e 3f 65 28 29 3a 42 2e 73 65 74 28 65 2c 74 29 7d 66 75 6e 63 74 69 6f 6e 20 43 28 65 29 7b 76 61 72 20 6e 3d 65 65 3b 74 72 79 7b 66 6f 72 28 76 61 72 20 74 2c 72 3d 30 3b 72 Data Ascii: onCompleted:u,sendReason:p}},g.isSync)),g.sizeExceed&&0<g.sizeExceed.length&&E(g.sizeExceed,8003,g.sendType),g.failedEvts&&0<g.failedEvts.length&&E(g.failedEvts,8002,g.sendType)}function I(e,n,t){n?e():B.set(e,t)}function C(e){var n=ee;try{for(var t,r=0;r
2023-10-19 17:19:05 UTC	90	IN	Data Raw: 22 31 30 2e 30 22 3a 22 31 30 22 7d 2c 69 6c 3d 22 28 5b 5c 5c 64 2c 2e 5d 2b 29 22 2c 61 6c 3d 22 28 5b 5c 5c 64 2c 5f 2c 2e 5d 2b 29 22 2c 6f 6c 3d 22 55 6e 6b 6e 6f 77 6e 22 2c 63 6c 3d 5b 7b 72 3a 65 2e 57 49 4e 50 48 4f 4e 45 2c 6f 73 3a 22 57 69 6e 64 6f 77 73 20 50 68 6f 6e 65 22 7d 2c 7b 72 3a 65 2e 57 49 4e 52 54 2c 6f 73 3a 22 57 69 6e 64 6f 77 73 20 52 54 22 7d 2c 7b 72 3a 65 2e 57 49 4e 2c 6f 73 3a 22 57 69 6e 64 6f 77 73 22 7d 2c 7b 72 3a 65 2e 49 4f 53 2c 6f 73 3a 22 69 4f 53 22 7d 2c 7b 72 3a 65 2e 41 4e 44 52 4f 49 44 2c 6f 73 3a 22 41 6e 64 72 6f 69 64 22 7d 2c 7b 72 3a 65 2e 4c 49 4e 55 58 2c 6f 73 3a 22 4c 69 6e 75 78 22 7d 2c 7b 72 3a 65 2e 43 52 4f 53 2c 6f 73 3a 22 43 68 72 6f 6d 65 20 4f 53 22 7d 2c 7b 73 3a 22 78 31 31 22 2c 6f 73 Data Ascii: "10.0":"10"},il="([\\d,.]+)",al="([\\d,_,.]+)",ol="Unknown",cl=[{r:e.WINPHONE,os:"Windows Phone"},{r:e.WINRT,os:"Windows RT"},{r:e.WIN,os:"Windows"},{r:e.IOS,os:"iOS"},{r:e.ANDROID,os:"Android"},{r:e.LINUX,os:"Linux"},{r:e.CROS,os:"Chrome OS"},{s:"x11",os
2023-10-19 17:19:05 UTC	106	IN	Data Raw: 64 2c 74 79 70 65 4e 61 6d 65 3a 74 68 69 73 5b 4a 6c 5d 2c 6d 65 73 73 61 67 65 3a 74 68 69 73 5b 4b 6c 5d 2c 68 61 73 46 75 6c 6c 53 74 61 63 6b 3a 74 68 69 73 5b 74 66 5d 2c 73 74 61 63 6b 3a 74 68 69 73 5b 6b 66 5d 7d 29 5b 47 6c 5d 3d 6e 7c 7c 75 6e 64 65 66 69 6e 65 64 2c 65 7d 2c 6a 66 2e 43 72 65 61 74 65 46 72 6f 6d 49 6e 74 65 72 66 61 63 65 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 6e 29 7b 76 61 72 20 74 3d 6e 5b 47 6c 5d 69 6e 73 74 61 6e 63 65 6f 66 20 41 72 72 61 79 26 26 53 6e 28 6e 5b 47 6c 5d 2c 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 58 66 5b 65 66 5d 28 65 29 7d 29 7c 7c 6e 5b 47 6c 5d 3b 72 65 74 75 72 6e 20 6e 65 77 20 6a 66 28 65 2c 6f 72 28 6f 72 28 7b 7d 2c 6e 29 2c 7b 70 61 72 73 65 64 53 74 61 63 6b 3a 74 7d 29 29 7d Data Ascii: d,typeName:this[Jl],message:this[Kl],hasFullStack:this[tf],stack:this[kf]})[Gl]=n\|\|undefined,e},jf.CreateFromInterface=function(e,n){var t=n[Gl]instanceof Array&&Sn(n[Gl],function(e){return Xf[ef](e)})\|\|n[Gl];return new jf(e,or(or({},n),{parsedStack:t}))}
2023-10-19 17:19:05 UTC	122	IN	Data Raw: 75 6e 63 74 69 6f 6e 28 29 7b 28 50 3d 4f 2e 64 69 73 61 62 6c 65 45 78 63 65 70 74 69 6f 6e 54 72 61 63 6b 69 6e 67 29 7c 7c 41 7c 7c 4f 2e 61 75 74 6f 45 78 63 65 70 74 69 6f 6e 49 6e 73 74 72 75 6d 65 6e 74 65 64 7c 7c 28 68 28 6f 75 28 75 2c 22 6f 6e 65 72 72 6f 72 22 2c 7b 6e 73 3a 4d 2c 72 73 70 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 6e 2c 74 2c 72 2c 69 2c 61 29 7b 50 7c 7c 21 30 3d 3d 3d 65 2e 72 73 6c 74 7c 7c 70 5b 50 64 5d 28 57 66 5b 6b 64 5d 28 6e 2c 74 2c 72 2c 69 2c 61 2c 65 2e 65 76 74 29 29 7d 7d 2c 21 31 29 29 2c 41 3d 21 30 29 7d 29 29 2c 69 3d 75 2c 61 3d 73 2c 70 5b 67 64 5d 28 67 65 28 4f 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 5f 3d 21 30 3d 3d 3d 4f 5b 42 64 5d 2c 41 3d 41 7c 7c 4f 5b 46 64 5d 2c 5f 26 26 21 44 26 26 28 68 28 6f 75 28 69 Data Ascii: unction(){(P=O.disableExceptionTracking)\|\|A\|\|O.autoExceptionInstrumented\|\|(h(ou(u,"onerror",{ns:M,rsp:function(e,n,t,r,i,a){P\|\|!0===e.rslt\|\|p[Pd](Wf[kd](n,t,r,i,a,e.evt))}},!1)),A=!0)})),i=u,a=s,p[gd](ge(O,function(){_=!0===O[Bd],A=A\|\|O[Fd],_&&!D&&(h(ou(i
2023-10-19 17:19:05 UTC	137	IN	Data Raw: 65 2e 61 74 74 72 69 62 75 74 65 73 5b 72 5d 2e 6e 61 6d 65 29 26 26 21 6e 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 2e 69 6e 64 65 78 4f 66 28 22 6d 73 2e 22 29 26 26 28 74 5b 6e 5d 3d 65 2e 61 74 74 72 69 62 75 74 65 73 5b 72 5d 2e 76 61 6c 75 65 29 3b 65 3d 65 2e 70 61 72 65 6e 74 45 6c 65 6d 65 6e 74 7c 7c 65 2e 70 61 72 65 6e 74 4e 6f 64 65 7d 72 65 74 75 72 6e 20 74 7d 2c 47 67 2e 70 72 6f 74 6f 74 79 70 65 2e 5f 67 65 74 54 69 6d 65 54 6f 43 6c 69 63 6b 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 65 3d 47 6e 28 29 3b 69 66 28 65 26 26 65 2e 74 69 6d 69 6e 67 29 7b 65 3d 65 2e 74 69 6d 69 6e 67 2e 6e 61 76 69 67 61 74 69 6f 6e 53 74 61 72 74 3b 69 66 28 65 26 26 30 21 3d 3d 65 29 72 65 74 75 72 6e 28 6e 65 77 20 44 61 74 65 29 2e 67 65 74 54 69 Data Ascii: e.attributes[r].name)&&!n.toLowerCase().indexOf("ms.")&&(t[n]=e.attributes[r].value);e=e.parentElement\|\|e.parentNode}return t},Gg.prototype._getTimeToClick=function(){var e=Gn();if(e&&e.timing){e=e.timing.navigationStart;if(e&&0!==e)return(new Date).getTi
2023-10-19 17:19:05 UTC	153	IN	Data Raw: 69 65 77 50 65 72 66 6f 72 6d 61 6e 63 65 45 76 65 6e 74 28 65 29 7d 2c 73 2e 73 65 74 43 6f 6e 74 65 6e 74 48 61 6e 64 6c 65 72 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 54 3d 4e 3d 65 7d 2c 73 2e 73 65 74 41 75 74 6f 43 61 70 74 75 72 65 48 61 6e 64 6c 65 72 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 62 21 3d 3d 65 26 26 28 62 26 26 62 2e 74 65 61 72 64 6f 77 6e 28 29 2c 62 3d 65 2c 69 28 21 31 29 29 7d 2c 73 2e 5f 64 6f 54 65 61 72 64 6f 77 6e 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 6e 29 7b 62 26 26 62 2e 74 65 61 72 64 6f 77 6e 28 65 2c 6e 29 2c 72 2e 5f 64 6f 54 65 61 72 64 6f 77 6e 28 65 2c 6e 29 2c 74 28 29 7d 2c 73 2e 5f 67 65 74 44 62 67 50 6c 67 54 61 72 67 65 74 73 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 5b 68 5d 7d 7d 29 2c 65 7d 76 61 72 Data Ascii: iewPerformanceEvent(e)},s.setContentHandler=function(e){T=N=e},s.setAutoCaptureHandler=function(e){b!==e&&(b&&b.teardown(),b=e,i(!1))},s._doTeardown=function(e,n){b&&b.teardown(e,n),r._doTeardown(e,n),t()},s._getDbgPlgTargets=function(){return[h]}}),e}var

Timestamp	kBytes transferred	Direction	Data
2023-10-19 17:19:06 UTC	157	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 35 7a 6e 30 44 33 48 2b 6f 45 32 38 56 78 50 59 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 66 62 35 31 63 32 62 34 39 65 34 31 38 38 64 61 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: 5zn0D3H+oE28VxPY.1Context: fb51c2b49e4188da
2023-10-19 17:19:06 UTC	157	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2023-10-19 17:19:06 UTC	158	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 34 31 0d 0a 4d 53 2d 43 56 3a 20 35 7a 6e 30 44 33 48 2b 6f 45 32 38 56 78 50 59 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 66 62 35 31 63 32 62 34 39 65 34 31 38 38 64 61 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 6f 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 56 38 62 41 64 32 4c 4f 37 69 74 76 56 6e 47 43 54 79 58 52 31 55 4f 70 51 52 35 34 32 57 72 63 4e 42 6e 72 34 56 31 4d 73 4a 4d 46 69 33 4d 62 4d 6b 70 72 4a 5a 43 4e 75 70 7a 39 63 44 47 53 64 2b 4a 4b 4a 46 59 56 77 78 6d 72 4e 76 72 47 56 4a 68 31 67 32 65 48 6c 53 51 5a 74 38 4f 38 4e 68 6e 47 72 41 70 63 35 64 49 57 4e Data Ascii: ATH 2 CON\DEVICE 1041MS-CV: 5zn0D3H+oE28VxPY.2Context: fb51c2b49e4188da<device><compact-ticket>t=EwCoAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAV8bAd2LO7itvVnGCTyXR1UOpQR542WrcNBnr4V1MsJMFi3MbMkprJZCNupz9cDGSd+JKJFYVwxmrNvrGVJh1g2eHlSQZt8O8NhnGrApc5dIWN
2023-10-19 17:19:06 UTC	159	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 35 7a 6e 30 44 33 48 2b 6f 45 32 38 56 78 50 59 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 66 62 35 31 63 32 62 34 39 65 34 31 38 38 64 61 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: 5zn0D3H+oE28VxPY.3Context: fb51c2b49e4188da<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2023-10-19 17:19:06 UTC	159	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2023-10-19 17:19:06 UTC	159	IN	Data Raw: 4d 53 2d 43 56 3a 20 49 46 77 53 4c 30 6b 43 56 45 79 44 59 65 69 61 75 66 48 69 49 67 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: IFwSL0kCVEyDYeiaufHiIg.0Payload parsing failed.

Timestamp	kBytes transferred	Direction	Data
2023-10-19 17:19:07 UTC	160	IN	HTTP/1.1 200 OK Cache-Control: max-age=43200 Content-Length: 52717 Content-Type: application/javascript Content-MD5: QT/MdZzBmCG2G2lBgIsptQ== Last-Modified: Wed, 24 Aug 2022 17:34:58 GMT Accept-Ranges: bytes Age: 14111 ETag: 0x8DA85F6F74C6D08 Vary: Accept-Encoding Access-Control-Allow-Origin: * Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding X-Cache: CONFIG_NOCACHE x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: 3391caf4-901e-0056-278f-02ae4c000000 x-ms-version: 2009-09-19 X-Azure-Ref: 0C2UxZQAAAAAYnGX6sKL1QoFL+4vxJHNhTEFYRURHRTIyMTkAMzliNDYxNTctY2I5ZS00OWI3LWE2NWEtODcyMmEzZjgyNGU0 Date: Thu, 19 Oct 2023 17:19:07 GMT Connection: close
2023-10-19 17:19:07 UTC	161	IN	Data Raw: 76 61 72 20 57 63 70 43 6f 6e 73 65 6e 74 3b 21 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 65 3d 7b 32 32 39 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 77 69 6e 64 6f 77 2c 65 2e 65 78 70 6f 72 74 73 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 7b 7d 3b 66 75 6e 63 74 69 6f 6e 20 6f 28 6e 29 7b 69 66 28 74 5b 6e 5d 29 72 65 74 75 72 6e 20 74 5b 6e 5d 2e 65 78 70 6f 72 74 73 3b 76 61 72 20 72 3d 74 5b 6e 5d 3d 7b 69 3a 6e 2c 6c 3a 21 31 2c 65 78 70 6f 72 74 73 3a 7b 7d 7d 3b 72 65 74 75 72 6e 20 65 5b 6e 5d 2e 63 61 6c 6c 28 72 2e 65 78 70 6f 72 74 73 2c 72 2c 72 2e 65 78 70 6f 72 74 73 2c 6f 29 2c 72 2e 6c 3d 21 30 2c 72 2e 65 78 70 6f 72 74 73 7d 72 65 74 75 72 6e 20 6f 2e 6d 3d 65 2c 6f 2e 63 3d 74 2c 6f 2e 64 3d 66 75 6e 63 74 69 6f 6e 28 65 Data Ascii: var WcpConsent;!function(){var e={229:function(e){window,e.exports=function(e){var t={};function o(n){if(t[n])return t[n].exports;var r=t[n]={i:n,l:!1,exports:{}};return e[n].call(r.exports,r,r.exports,o),r.l=!0,r.exports}return o.m=e,o.c=t,o.d=function(e
2023-10-19 17:19:07 UTC	169	IN	Data Raw: 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 3b 77 69 64 74 68 3a 38 30 25 3b 77 69 64 74 68 3a 63 61 6c 63 28 31 30 30 25 20 2d 20 31 39 70 78 29 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 53 65 67 6f 65 20 55 49 2c 20 53 65 67 6f 65 55 49 2c 20 41 72 69 61 6c 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 66 6f 6e 74 2d 73 74 79 6c 65 3a 6e 6f 72 6d 61 6c 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 6e 6f 72 6d 61 6c 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 35 70 78 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 32 30 70 78 3b 74 65 78 74 2d 74 72 61 6e 73 66 6f 72 6d 3a 6e 6f 6e 65 3b 63 75 72 73 6f 72 3a 70 6f 69 6e 74 65 72 3b 62 6f 78 2d 73 69 7a 69 6e 67 3a 62 6f 72 64 65 72 2d 62 6f 78 7d 64 69 76 5b 64 69 72 3d 22 72 74 6c 22 5d 20 2e 5f 33 52 4a 7a 65 4c 33 6c 39 52 6c 5f 6c 41 51 Data Ascii: dding-right:0;width:80%;width:calc(100% - 19px);font-family:Segoe UI, SegoeUI, Arial, sans-serif;font-style:normal;font-weight:normal;font-size:15px;line-height:20px;text-transform:none;cursor:pointer;box-sizing:border-box}div[dir="rtl"] ._3RJzeL3l9Rl_lAQ
2023-10-19 17:19:07 UTC	177	IN	Data Raw: 61 2d 6c 61 62 65 6c 3d 22 27 2b 69 2e 65 73 63 61 70 65 48 74 6d 6c 28 74 68 69 73 2e 74 65 78 74 52 65 73 6f 75 72 63 65 73 2e 70 72 65 66 65 72 65 6e 63 65 73 44 69 61 6c 6f 67 43 6c 6f 73 65 4c 61 62 65 6c 29 2b 27 22 20 63 6c 61 73 73 3d 22 27 2b 61 2e 63 6c 6f 73 65 4d 6f 64 61 6c 49 63 6f 6e 2b 27 22 20 74 61 62 69 6e 64 65 78 3d 22 30 22 3e 26 23 78 32 37 31 35 3b 3c 2f 62 75 74 74 6f 6e 3e 5c 6e 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 72 6f 6c 65 3d 22 64 6f 63 75 6d 65 6e 74 22 20 63 6c 61 73 73 3d 22 27 2b 61 2e 6d 6f 64 61 6c 42 6f 64 79 2b 27 22 3e 5c 6e 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 3e 5c 6e 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 68 31 20 63 6c 61 73 73 3d 22 27 2b 61 2e 6d 6f Data Ascii: a-label="'+i.escapeHtml(this.textResources.preferencesDialogCloseLabel)+'" class="'+a.closeModalIcon+'" tabindex="0">✕</button>\n <div role="document" class="'+a.modalBody+'">\n <div>\n <h1 class="'+a.mo
2023-10-19 17:19:07 UTC	185	IN	Data Raw: 65 2b 2b 29 7d 7d 7d 2c 65 7d 28 29 2c 63 3d 6e 2e 6c 6f 63 61 6c 73 2c 73 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 65 28 29 7b 7d 72 65 74 75 72 6e 20 65 2e 63 72 65 61 74 65 54 68 65 6d 65 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 69 66 28 21 74 5b 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 2d 62 65 74 77 65 65 6e 2d 70 61 67 65 2d 61 6e 64 2d 64 69 61 6c 6f 67 22 5d 29 7b 76 61 72 20 6f 3d 74 5b 22 64 69 61 6c 6f 67 2d 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 22 5d 3b 74 68 69 73 2e 73 65 74 4d 69 73 73 69 6e 67 43 6f 6c 6f 72 46 72 6f 6d 41 6e 6f 74 68 65 72 50 72 6f 70 65 72 74 79 28 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 2d 62 65 74 77 65 65 6e 2d 70 61 67 65 2d 61 6e 64 2d 64 69 61 6c 6f 67 22 2c Data Ascii: e++)}}},e}(),c=n.locals,s=function(){function e(){}return e.createTheme=function(e,t){if(!t["background-color-between-page-and-dialog"]){var o=t["dialog-background-color"];this.setMissingColorFromAnotherProperty("background-color-between-page-and-dialog",
2023-10-19 17:19:07 UTC	193	IN	Data Raw: 20 20 Data Ascii:
2023-10-19 17:19:07 UTC	193	IN	Data Raw: 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 22 2b 65 5b 22 72 61 64 69 6f 2d 62 75 74 74 6f 6e 2d 64 69 73 61 62 6c 65 64 2d 63 6f 6c 6f 72 22 5d 2b 22 20 21 69 6d 70 6f 72 74 61 6e 74 3b 5c 6e 20 20 20 20 20 20 20 20 7d 22 7d 2c 65 7d 28 29 2c 64 3d 5b 22 61 72 22 2c 22 68 65 22 2c 22 70 73 22 2c 22 75 72 22 2c 22 66 61 22 2c 22 70 61 22 2c 22 73 64 22 2c 22 74 6b 22 2c 22 75 67 22 2c 22 79 69 22 2c 22 73 79 72 22 2c 22 6b 73 2d 61 72 61 62 22 5d 2c 75 3d 7b 22 63 6c 6f 73 65 2d 62 75 74 74 6f 6e 2d 63 6f 6c 6f 72 22 3a 22 23 36 36 36 36 36 36 22 2c 22 73 65 63 6f 6e 64 61 72 79 2d 62 75 74 74 6f 6e 2d 64 69 73 61 62 6c 65 64 2d 6f 70 61 63 69 74 79 22 3a 22 31 22 2c 22 73 65 63 6f 6e 64 61 72 79 2d 62 75 74 74 6f 6e 2d Data Ascii: background-color: "+e["radio-button-disabled-color"]+" !important;\n }"},e}(),d=["ar","he","ps","ur","fa","pa","sd","tk","ug","yi","syr","ks-arab"],u={"close-button-color":"#666666","secondary-button-disabled-opacity":"1","secondary-button-
2023-10-19 17:19:07 UTC	201	IN	Data Raw: 65 70 74 41 6c 6c 4c 61 62 65 6c 29 2b 27 3c 2f 62 75 74 74 6f 6e 3e 5c 6e 20 20 20 20 20 20 20 20 20 20 20 20 3c 62 75 74 74 6f 6e 20 74 79 70 65 3d 22 62 75 74 74 6f 6e 22 20 63 6c 61 73 73 3d 22 27 2b 68 2e 62 61 6e 6e 65 72 42 75 74 74 6f 6e 2b 22 20 22 2b 68 2e 73 65 63 6f 6e 64 61 72 79 42 75 74 74 6f 6e 54 68 65 6d 65 2b 27 22 3e 27 2b 69 2e 65 73 63 61 70 65 48 74 6d 6c 28 74 68 69 73 2e 74 65 78 74 52 65 73 6f 75 72 63 65 73 2e 72 65 6a 65 63 74 41 6c 6c 4c 61 62 65 6c 29 2b 27 3c 2f 62 75 74 74 6f 6e 3e 5c 6e 20 20 20 20 20 20 20 20 20 20 20 20 3c 62 75 74 74 6f 6e 20 74 79 70 65 3d 22 62 75 74 74 6f 6e 22 20 63 6c 61 73 73 3d 22 27 2b 68 2e 62 61 6e 6e 65 72 42 75 74 74 6f 6e 2b 22 20 22 2b 68 2e 73 65 63 6f 6e 64 61 72 79 42 75 74 74 6f 6e 54 Data Ascii: eptAllLabel)+'</button>\n <button type="button" class="'+h.bannerButton+" "+h.secondaryButtonTheme+'">'+i.escapeHtml(this.textResources.rejectAllLabel)+'</button>\n <button type="button" class="'+h.bannerButton+" "+h.secondaryButtonT
2023-10-19 17:19:07 UTC	209	IN	Data Raw: 22 2d 22 29 5b 30 5d 3b 6f 3d 65 2e 73 70 6c 69 74 28 22 2d 22 29 5b 30 5d 3d 3d 3d 6e 7d 72 65 74 75 72 6e 20 6f 7d 28 65 2c 63 29 7d 29 29 3b 73 26 26 30 3d 3d 3d 73 2e 6c 65 6e 67 74 68 26 26 28 65 3d 22 65 6e 2d 55 53 22 29 2c 6f 2e 70 6c 61 63 65 68 6f 6c 64 65 72 45 6c 65 6d 65 6e 74 3d 6c 2c 72 26 26 6f 2e 63 6f 6e 73 65 6e 74 43 68 61 6e 67 65 64 43 61 6c 6c 62 61 63 6b 73 2e 72 65 67 69 73 74 65 72 43 61 6c 6c 62 61 63 6b 28 72 29 2c 6f 2e 73 61 76 65 43 6f 6f 6b 69 65 28 29 2c 6f 2e 73 69 74 65 43 6f 6e 73 65 6e 74 3d 6e 65 77 20 66 28 21 31 29 2c 6e 75 6c 6c 3d 3d 6e 7c 7c 6e 28 76 6f 69 64 20 30 2c 6f 2e 73 69 74 65 43 6f 6e 73 65 6e 74 29 2c 6f 2e 69 73 49 6e 69 74 52 65 61 64 79 3d 21 30 2c 74 68 69 73 2e 63 6f 6e 73 65 6e 74 43 68 61 6e 67 Data Ascii: "-")[0];o=e.split("-")[0]===n}return o}(e,c)}));s&&0===s.length&&(e="en-US"),o.placeholderElement=l,r&&o.consentChangedCallbacks.registerCallback(r),o.saveCookie(),o.siteConsent=new f(!1),null==n\|\|n(void 0,o.siteConsent),o.isInitReady=!0,this.consentChang

Timestamp	kBytes transferred	Direction	Data
2023-10-19 17:19:09 UTC	212	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=o6fWca8PpRg8zp9&MD=a3lpZKhl HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2023-10-19 17:19:10 UTC	213	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: 1a835f1d-0dea-4880-a881-4b112bb4b8a4 MS-RequestId: bd21f2d6-b7e8-467b-8b12-bb00f60d67bd MS-CV: UvmvAU2ezUKrA9pN.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Thu, 19 Oct 2023 17:19:09 GMT Connection: close Content-Length: 24490
2023-10-19 17:19:10 UTC	213	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2023-10-19 17:19:10 UTC	229	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Timestamp	kBytes transferred	Direction	Data
2023-10-19 17:19:10 UTC	238	IN	HTTP/1.1 200 OK Cache-Control: public, no-transform, max-age=7200 Content-Length: 29799 Content-Type: application/javascript Expires: Thu, 19 Oct 2023 17:07:53 GMT X-Cache: TCP_HIT X-Content-Type-Options: nosniff Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, OPTIONS X-UA-Compatible: IE=edge Strict-Transport-Security: max-age=31536000; includeSubDomains X-Azure-Ref-OriginShield: 0rE4xZQAAAACMEUhMhbPdQY0fYXaxqQdMU0pDMjExMDUxMjA4MDUxAGVhYzVmNDlmLWUwMmQtNGY0MS1iMGE2LTJkNTBmOWZjZjg0YQ== X-Azure-Ref: 0DmUxZQAAAAAJ1ZGCJZcwRr/PllsMfEsgTEFYRURHRTIxMjEAZWFjNWY0OWYtZTAyZC00ZjQxLWIwYTYtMmQ1MGY5ZmNmODRh Date: Thu, 19 Oct 2023 17:19:10 GMT Connection: close
2023-10-19 17:19:10 UTC	238	IN	Data Raw: 77 69 6e 64 6f 77 2e 4d 53 41 3d 77 69 6e 64 6f 77 2e 4d 53 41 7c 7c 7b 7d 3b 77 69 6e 64 6f 77 2e 4d 53 41 2e 4d 65 43 6f 6e 74 72 6f 6c 3d 77 69 6e 64 6f 77 2e 4d 53 41 2e 4d 65 43 6f 6e 74 72 6f 6c 7c 7c 7b 7d 3b 77 69 6e 64 6f 77 2e 4d 53 41 2e 4d 65 43 6f 6e 74 72 6f 6c 2e 43 6f 6e 66 69 67 3d 7b 22 76 65 72 22 3a 22 31 30 2e 32 33 32 37 31 2e 35 22 2c 22 6d 6b 74 22 3a 22 65 6e 2d 55 53 22 2c 22 70 74 6e 22 3a 22 73 6d 63 63 6f 6e 76 65 72 67 65 6e 63 65 22 2c 22 67 66 78 22 3a 22 68 74 74 70 73 3a 2f 2f 61 6d 63 64 6e 2e 6d 73 66 74 61 75 74 68 2e 6e 65 74 22 2c 22 64 62 67 22 3a 66 61 6c 73 65 2c 22 61 61 64 22 3a 74 72 75 65 2c 22 69 6e 74 22 3a 66 61 6c 73 65 2c 22 70 78 79 22 3a 74 72 75 65 2c 22 6d 73 54 78 74 22 3a 66 61 6c 73 65 2c 22 72 77 Data Ascii: window.MSA=window.MSA\|\|{};window.MSA.MeControl=window.MSA.MeControl\|\|{};window.MSA.MeControl.Config={"ver":"10.23271.5","mkt":"en-US","ptn":"smcconvergence","gfx":"https://amcdn.msftauth.net","dbg":false,"aad":true,"int":false,"pxy":true,"msTxt":false,"rw
2023-10-19 17:19:10 UTC	254	IN	Data Raw: 6f 66 20 6e 3f 28 72 3d 5b 5d 2c 6e 29 3a 28 72 3d 6e 2c 74 29 2c 66 75 6e 63 74 69 6f 6e 28 65 2c 6e 2c 74 29 7b 71 65 2e 70 75 73 68 28 7b 69 64 3a 65 2c 64 65 70 73 3a 6e 2c 66 61 63 74 6f 72 79 3a 74 7d 29 7d 28 65 2c 72 2c 6f 29 7d 76 61 72 20 7a 65 3d 7b 22 40 6d 65 63 6f 6e 74 72 6f 6c 2f 77 65 62 2d 69 6e 6c 69 6e 65 22 3a 22 6d 65 49 6e 6c 69 6e 65 22 2c 22 40 6d 65 63 6f 6e 74 72 6f 6c 2f 77 65 62 2d 62 6f 6f 74 22 3a 22 6d 65 42 6f 6f 74 22 2c 22 40 6d 65 63 6f 6e 74 72 6f 6c 2f 77 65 62 2d 63 6f 72 65 22 3a 22 6d 65 43 6f 72 65 22 7d 3b 66 75 6e 63 74 69 6f 6e 20 4b 65 28 65 29 7b 74 72 79 7b 65 20 69 6e 20 7a 65 26 26 28 65 3d 7a 65 5b 65 5d 29 2c 51 65 28 29 3b 76 61 72 20 6e 3d 57 65 28 65 29 3b 69 66 28 6e 29 72 65 74 75 72 6e 20 6e 2e 62 Data Ascii: of n?(r=[],n):(r=n,t),function(e,n,t){qe.push({id:e,deps:n,factory:t})}(e,r,o)}var ze={"@mecontrol/web-inline":"meInline","@mecontrol/web-boot":"meBoot","@mecontrol/web-core":"meCore"};function Ke(e){try{e in ze&&(e=ze[e]),Qe();var n=We(e);if(n)return n.b

Timestamp	kBytes transferred	Direction	Data
2023-10-19 17:18:54 UTC	1	IN	HTTP/1.1 200 OK Content-Security-Policy: script-src 'report-sample' 'nonce-HXdYe_76lcg2LRHbPv1m9g' 'unsafe-inline' 'strict-dynamic' https: http:;object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/clientupdate-aus/1 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 19 Oct 2023 17:18:54 GMT Content-Type: text/xml; charset=UTF-8 X-Daynum: 6135 X-Daystart: 37134 X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block Server: GSE Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2023-10-19 17:18:54 UTC	2	IN	Data Raw: 32 63 39 0d 0a 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 67 75 70 64 61 74 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 75 70 64 61 74 65 32 2f 72 65 73 70 6f 6e 73 65 22 20 70 72 6f 74 6f 63 6f 6c 3d 22 32 2e 30 22 20 73 65 72 76 65 72 3d 22 70 72 6f 64 22 3e 3c 64 61 79 73 74 61 72 74 20 65 6c 61 70 73 65 64 5f 64 61 79 73 3d 22 36 31 33 35 22 20 65 6c 61 70 73 65 64 5f 73 65 63 6f 6e 64 73 3d 22 33 37 31 33 34 22 2f 3e 3c 61 70 70 20 61 70 70 69 64 3d 22 6e 6d 6d 68 6b 6b 65 67 63 63 61 67 64 6c 64 67 69 69 6d 65 64 70 69 63 63 6d 67 6d 69 65 64 61 22 20 63 6f 68 6f 72 74 3d 22 31 3a 3a 22 20 63 6f 68 6f 72 74 6e 61 6d 65 3d 22 22 Data Ascii: 2c9<?xml version="1.0" encoding="UTF-8"?><gupdate xmlns="http://www.google.com/update2/response" protocol="2.0" server="prod"><daystart elapsed_days="6135" elapsed_seconds="37134"/><app appid="nmmhkkegccagdldgiimedpiccmgmieda" cohort="1::" cohortname=""
2023-10-19 17:18:54 UTC	2	IN	Data Raw: 37 32 33 66 35 36 62 38 37 31 37 31 37 35 63 35 33 36 36 38 35 63 35 34 35 30 31 32 32 62 33 30 37 38 39 34 36 34 61 64 38 32 22 20 68 61 73 68 5f 73 68 61 32 35 36 3d 22 38 31 65 33 61 34 64 34 33 61 37 33 36 39 39 65 31 62 37 37 38 31 37 32 33 66 35 36 62 38 37 31 37 31 37 35 63 35 33 36 36 38 35 63 35 34 35 30 31 32 32 62 33 30 37 38 39 34 36 34 61 64 38 32 22 20 70 72 6f 74 65 63 74 65 64 3d 22 30 22 20 73 69 7a 65 3d 22 32 34 38 35 33 31 22 20 73 74 61 74 75 73 3d 22 6f 6b 22 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 2e 30 2e 36 22 2f 3e 3c 2f 61 70 70 3e 3c 2f 67 75 70 64 61 74 65 3e 0d 0a Data Ascii: 723f56b8717175c536685c5450122b30789464ad82" hash_sha256="81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82" protected="0" size="248531" status="ok" version="1.0.0.6"/></app></gupdate>
2023-10-19 17:18:54 UTC	2	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 1260x600, components 3
Category:	dropped
Size (bytes):	52360
Entropy (8bit):	7.732706335796517
Encrypted:	false
SSDEEP:	768:BWyvXNBvAmyGpjD54hMfRFSbIratwql5tcdLH5lBr3AhIDCvvoW8q2wcBEP9xcQ2:j9NhvZt4Mpzat3uPzPgoW8oTlxcuRE
MD5:	5C951E03DA63200B8106E5B62DEB9483
SHA1:	86800A3000CB94F52DAC5D12C5ED7AAFAEC2BB5B
SHA-256:	4996C6083BA606B2D705821C26442B597979F423B76E2C97EDEB6DD54547488A
SHA-512:	E2DFEAFD62F6A14FD938BD97A03BA1E666179C63E83C08CD75EB1F6D181C9261EDD28A04DDE7CDE79D67F9340F17D283A1ADADF8140BB727792E9043611B6211
Malicious:	false
Reputation:	low
Preview:	......JFIF.....H.H....................................................!........."$".$...........................................................................X.................................................................!1..A"Qa..q2..#B..$R..4b3...cr.%Cs................................................!1..2A".Q#............?..E2...........................................s.z.....\.t......0...X....\|..{0.\.O..V.......3k.Fz....Q..N.x/R.xa.S....?..b......k.g".r.Q..xT.E.j...M..l.s.5.<..99I............K[g...}wF....&..g/r.q..."...F.Y..Z.TWj.Y.Ws$.i'....cJ1QZD...O.\.]:o).....Nrq[.i............S..'..^..Q.p.`./....1...%/...@..l.!6..9...F....mc.;eF{.p..I)K..X...jj...r.:u!...O....).U........u..[.~...b...}..O]...ZT.Z.....o8_%.....Q..X._d../...)9..5.......I...m.........89^.eS..UrnM..I.h'....om.b.Z...9<a.i..i/...6.K.f.^1.....`O.........b...".Oa.3[.aQh......7.d..s/ FB.KE:..a+....%.^...0..'..#..E.E..\.2.Y ..r.3XkG..b.ea....C.:E.`..FkD...G.-+ ............................

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65398)
Category:	downloaded
Size (bytes):	150021
Entropy (8bit):	5.417083214630491
Encrypted:	false
SSDEEP:	3072:zhZrJ9gM0sb2qYMN62T/RZVyu5S3inOTWF9xvToQ:zhRJ3b21OyJ3ZTW9xvcQ
MD5:	19734D75C7703B5522AA6913D16BE1CD
SHA1:	65D833E1A0AAD8CB474CD1979FA2FF4B2C1F0F64
SHA-256:	8B2159099640C9B93F5CA397673175D2EF2CFB80D4852B80E330887F45354C23
SHA-512:	561AB747109934B83851A1636559023911D6C02024FE471B7B20433439820946A23C6AA230BB248CC5E0DD05352F3E0FEB7A5D8EAD6AD90657BBF3F5F3714AF1
Malicious:	false
Reputation:	low
URL:	https://js.monitor.azure.com/scripts/c/ms.analytics-web-4.0.1.min.js
Preview:	/!. 1DS JS SDK Analytics Web, 4.0.1. * Copyright (c) Microsoft and contributors. All rights reserved.. * (Microsoft Internal Only). */.var e=function(t){"use strict";var $=undefined,y=null,c="",u="boolean",s="function",l="number",d="object",m="prototype",f="__proto__",g="string",v="undefined",T="constructor",b="Symbol",I="_polyfill",C="indexOf",N="length",S="done",w="value",P="name",A="slice",_=Object,D=_[m],O=String,k=O[m],e=Math,n=Array,x=n[m];function R(e,n){try{n=e()}catch(t){}return n}var M=[g,l,u,v,"symbol","bigint"];function V(n){return function(e){return typeof e===n}}function B(e){var n="[object "+e+"]";return function(e){return!(!e\|\|F(e)!==n)}}function F(e){return D.toString.call(e)}function ne(e){return typeof e===v\|\|e===v}function te(e){return e===y\|\|ne(e)}function H(e){return!!e\|\|e!==$}var K=function(e){return e!==d&&!!~M.indexOf(e)},re=V(g),W=V(s);function z(e){return(e\|\|!te(e))&&e&&typeof e===d}var E=n.isArray,Z=B("Date"),ee=V(l),he=V(u),me=B("Error");function ye(e){r

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (5375)
Category:	downloaded
Size (bytes):	5425
Entropy (8bit):	5.238577583054965
Encrypted:	false
SSDEEP:	96:u3tL9SknZFlxAnWOZv0f68WhmVK0ee2mm+2mI3e212Z:u3tkkla2WhBrfB/bu2QZ
MD5:	8AF97D16F6C61F20EC0644774F924872
SHA1:	6C731B95B643890A7C1A873DB3A17D24A3AE9869
SHA-256:	CDE32190D84B7942A749FB007B64BF283BE5231448FC21AF31DC1AA3F812A86E
SHA-512:	9976741680E1B835099BB8AC327109E589AA3A6C59F8A6670D49BB9D24AC357832962C65BFA2E9511EECE8DB057E378EC2C8F0E765804E321787CADE2DDA3840
Malicious:	false
Reputation:	low
URL:	https://support.microsoft.com/js/SilentSignIn.Main.min.js?v=zeMhkNhLeUKnSfsAe2S_KDvlIxRI_CGvMdwao_gSqG4
Preview:	!function(){"use strict";var e,n,t,o={26010:function(e,n,t){n.__esModule=!0,n.parseAdminPolicies=void 0;var o=t(17897);n.parseAdminPolicies=function(e){return function(e){var n=null==e?void 0:e.dataset.settings;return n?JSON.parse(n):null}(null!=e?e:document.getElementById(o.TenantAdminPoliciesElementId))}},79993:function(e,n){var t,o;n.__esModule=!0,n.UserAgeGroup=n.DataBoundary=void 0,(o=n.DataBoundary\|\|(n.DataBoundary={})).None="None",o.EU="EU",(t=n.UserAgeGroup\|\|(n.UserAgeGroup={}))[t.Undefined=0]="Undefined",t[t.MinorWithoutParentalConsent=1]="MinorWithoutParentalConsent",t[t.MinorWithParentalConsent=2]="MinorWithParentalConsent",t[t.Adult=3]="Adult",t[t.NotAdult=4]="NotAdult",t[t.MinorNoParentalConsentRequired=5]="MinorNoParentalConsentRequired"},79094:function(e,n,t){n.__esModule=!0,n.SetMeControlAccount=n.createPopUpWindow=n.parseDataBoundary=n.closeWindow=n.isAadUser=n.getCurrUser=n.isUserAuthenticated=void 0;var o=t(79993);n.isUserAuthenticated=function(e){return!(!e\|\|""==e)&

Timestamp	kBytes transferred	Direction	Data
2023-10-19 17:19:17 UTC	268	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=31536000, immutable, no-transform Content-Length: 90648 Content-Type: text/javascript; charset=utf-8 Content-MD5: bG4aPNgugaurnXq8OXoQfQ== Last-Modified: Wed, 05 Oct 2022 16:53:03 GMT ETag: 0x8DAA6F2118B127C X-Cache: TCP_HIT x-ms-request-id: 2b2dc224-c01e-00aa-267e-0150f8000000 x-ms-version: 2009-09-19 x-ms-meta-jssdkver: 3.2.7 Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,x-ms-meta-jssdkver,Content-Type,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * X-Azure-Ref-OriginShield: 0nxwwZQAAAACNYlmoHY69RI+ysSrHacrLU0pDMjExMDUxMjA4MDM3AGYxY2E3M2Q0LTg4ODMtNGNhZi1hYmRjLWZlMmQ1NjdhZmI5Ng== X-Azure-Ref: 0FWUxZQAAAAA2rEH0NTwnRp4vBmVAGODWTEFYRURHRTIyMTEAZjFjYTczZDQtODg4My00Y2FmLWFiZGMtZmUyZDU2N2FmYjk2 Date: Thu, 19 Oct 2023 17:19:16 GMT Connection: close
2023-10-19 17:19:17 UTC	269	IN	Data Raw: 2f 2a 21 0a 20 2a 20 31 44 53 20 4a 53 20 53 44 4b 20 53 68 61 72 65 64 20 41 6e 61 6c 79 74 69 63 73 2c 20 33 2e 32 2e 37 0a 20 2a 20 43 6f 70 79 72 69 67 68 74 20 28 63 29 20 4d 69 63 72 6f 73 6f 66 74 20 61 6e 64 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 2e 20 41 6c 6c 20 72 69 67 68 74 73 20 72 65 73 65 72 76 65 64 2e 0a 20 2a 20 28 4d 69 63 72 6f 73 6f 66 74 20 49 6e 74 65 72 6e 61 6c 20 4f 6e 6c 79 29 0a 20 2a 2f 0a 21 66 75 6e 63 74 69 6f 6e 28 65 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 66 3d 22 66 75 6e 63 74 69 6f 6e 22 2c 6d 3d 22 6f 62 6a 65 63 74 22 2c 63 65 3d 22 75 6e 64 65 66 69 6e 65 64 22 2c 61 3d 22 70 72 6f 74 6f 74 79 70 65 22 2c 43 3d 22 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 22 2c 49 3d 4f 62 6a 65 63 74 2c 53 3d 49 Data Ascii: /! 1DS JS SDK Shared Analytics, 3.2.7 * Copyright (c) Microsoft and contributors. All rights reserved. * (Microsoft Internal Only) */!function(e){"use strict";var f="function",m="object",ce="undefined",a="prototype",C="hasOwnProperty",I=Object,S=I
2023-10-19 17:19:17 UTC	284	IN	Data Raw: 3f 69 69 28 6e 29 3a 65 7d 7d 29 5b 75 6e 5d 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 3d 21 31 21 3d 3d 65 7d 2c 65 2e 73 65 74 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 6e 2c 74 2c 72 2c 69 29 7b 76 61 72 20 6f 2c 61 2c 75 2c 73 3d 21 31 3b 72 65 74 75 72 6e 21 69 69 28 64 29 7c 7c 28 61 3d 63 2c 28 75 3d 65 29 26 26 61 26 26 72 65 28 61 2e 62 6c 6f 63 6b 65 64 43 6f 6f 6b 69 65 73 29 26 26 2d 31 21 3d 3d 61 2e 62 6c 6f 63 6b 65 64 43 6f 6f 6b 69 65 73 5b 74 6e 5d 28 75 29 7c 7c 6f 69 28 61 2c 75 29 29 7c 7c 28 61 3d 7b 7d 2c 2d 31 21 3d 3d 28 6f 3d 28 75 3d 5a 28 6e 7c 7c 76 29 29 5b 74 6e 5d 28 22 3b 22 29 29 26 26 28 75 3d 5a 28 6e 5b 72 6e 5d 28 30 2c 6f 29 29 2c 61 3d 63 69 28 6e 5b 72 6e 5d 28 6f 2b 31 29 29 29 2c 53 74 28 61 2c 22 64 6f 6d 61 69 6e 22 Data Ascii: ?ii(n):e}})[un]=function(e){r=!1!==e},e.set=function(e,n,t,r,i){var o,a,u,s=!1;return!ii(d)\|\|(a=c,(u=e)&&a&&re(a.blockedCookies)&&-1!==a.blockedCookies[tn](u)\|\|oi(a,u))\|\|(a={},-1!==(o=(u=Z(n\|\|v))[tn](";"))&&(u=Z(n[rn](0,o)),a=ci(n[rn](o+1))),St(a,"domain"
2023-10-19 17:19:17 UTC	300	IN	Data Raw: 70 2e 65 76 74 4e 61 6d 65 73 70 61 63 65 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 50 7d 2c 70 5b 71 65 5d 3d 66 2c 70 2e 67 65 74 54 72 61 63 65 43 74 78 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 6e 3b 72 65 74 75 72 6e 20 4d 7c 7c 28 6e 3d 7b 7d 2c 4d 3d 7b 67 65 74 4e 61 6d 65 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 6e 5b 45 65 5d 7d 2c 73 65 74 4e 61 6d 65 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 6e 5b 45 65 5d 3d 65 7d 2c 67 65 74 54 72 61 63 65 49 64 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 6e 5b 53 6e 5d 7d 2c 73 65 74 54 72 61 63 65 49 64 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 58 69 28 65 29 26 26 28 6e 5b 53 6e 5d 3d 65 29 7d 2c 67 65 74 53 70 61 6e 49 64 3a 66 75 6e 63 74 69 6f 6e 28 29 7b Data Ascii: p.evtNamespace=function(){return P},p[qe]=f,p.getTraceCtx=function(e){var n;return M\|\|(n={},M={getName:function(){return n[Ee]},setName:function(e){n[Ee]=e},getTraceId:function(){return n[Sn]},setTraceId:function(e){Xi(e)&&(n[Sn]=e)},getSpanId:function(){
2023-10-19 17:19:17 UTC	316	IN	Data Raw: 65 74 75 72 6e 28 6e 3d 4b 61 28 74 29 29 3f 74 2e 73 70 6c 69 74 28 6e 29 5b 30 5d 3a 74 7d 7d 72 65 74 75 72 6e 20 55 61 7d 28 74 2c 72 29 29 2c 6e 2e 6e 61 6d 65 26 26 6e 2e 6e 61 6d 65 21 3d 3d 55 61 7c 7c 21 24 28 65 2e 70 6c 61 74 66 6f 72 6d 29 7c 7c 28 6e 2e 6e 61 6d 65 3d 65 2e 70 6c 61 74 66 6f 72 6d 29 29 7d 2c 71 61 3d 22 4d 69 63 72 6f 73 6f 66 74 41 70 70 6c 69 63 61 74 69 6f 6e 73 54 65 6c 65 6d 65 74 72 79 44 65 76 69 63 65 49 64 22 2c 56 61 3d 28 48 61 2e 5f 5f 69 65 44 79 6e 3d 31 2c 48 61 29 3b 66 75 6e 63 74 69 6f 6e 20 48 61 28 75 2c 73 29 7b 76 61 72 20 63 3d 30 3b 65 65 28 48 61 2c 74 68 69 73 2c 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 6e 2c 74 2c 72 2c 69 2c 6f 3d 75 2e 70 72 6f 70 65 72 74 79 53 74 6f 72 61 67 65 4f 76 65 Data Ascii: eturn(n=Ka(t))?t.split(n)[0]:t}}return Ua}(t,r)),n.name&&n.name!==Ua\|\|!$(e.platform)\|\|(n.name=e.platform))},qa="MicrosoftApplicationsTelemetryDeviceId",Va=(Ha.__ieDyn=1,Ha);function Ha(u,s){var c=0;ee(Ha,this,function(e){var n,t,r,i,o=u.propertyStorageOve
2023-10-19 17:19:17 UTC	332	IN	Data Raw: 36 35 65 33 3a 32 65 36 2c 63 3d 30 2c 6c 3d 30 3b 63 3c 65 2e 6c 65 6e 67 74 68 3b 29 7b 76 61 72 20 66 3d 65 5b 63 5d 3b 69 66 28 66 29 7b 69 66 28 68 3c 3d 74 29 7b 67 2e 6f 76 65 72 66 6c 6f 77 3d 70 2e 73 70 6c 69 74 28 63 29 3b 62 72 65 61 6b 7d 76 61 72 20 64 3d 79 2e 67 65 74 45 76 65 6e 74 42 6c 6f 62 28 66 29 3b 69 66 28 64 26 26 64 2e 6c 65 6e 67 74 68 3c 3d 73 29 7b 76 61 72 20 76 3d 64 2e 6c 65 6e 67 74 68 3b 69 66 28 75 3c 6e 2e 6c 65 6e 67 74 68 2b 76 29 7b 67 2e 6f 76 65 72 66 6c 6f 77 3d 70 2e 73 70 6c 69 74 28 63 29 3b 62 72 65 61 6b 7d 6e 26 26 28 6e 2b 3d 22 5c 6e 22 29 2c 6e 2b 3d 64 2c 32 30 3c 2b 2b 6c 26 26 28 6e 2e 73 75 62 73 74 72 28 30 2c 31 29 2c 6c 3d 30 29 2c 72 3d 21 30 2c 74 2b 2b 7d 65 6c 73 65 28 64 3f 69 3a 6f 29 2e 70 Data Ascii: 65e3:2e6,c=0,l=0;c<e.length;){var f=e[c];if(f){if(h<=t){g.overflow=p.split(c);break}var d=y.getEventBlob(f);if(d&&d.length<=s){var v=d.length;if(u<n.length+v){g.overflow=p.split(c);break}n&&(n+="\n"),n+=d,20<++l&&(n.substr(0,1),l=0),r=!0,t++}else(d?i:o).p
2023-10-19 17:19:17 UTC	348	IN	Data Raw: 61 6d 65 73 70 61 63 65 26 26 76 2e 65 76 74 4e 61 6d 65 73 70 61 63 65 28 29 29 3b 76 61 72 20 74 2c 72 3d 70 2e 5f 67 65 74 54 65 6c 43 74 78 28 29 2c 69 3d 28 64 2e 65 78 74 65 6e 73 69 6f 6e 43 6f 6e 66 69 67 5b 70 2e 69 64 65 6e 74 69 66 69 65 72 5d 3d 64 2e 65 78 74 65 6e 73 69 6f 6e 43 6f 6e 66 69 67 5b 70 2e 69 64 65 6e 74 69 66 69 65 72 5d 7c 7c 7b 7d 2c 54 3d 72 2e 67 65 74 45 78 74 43 66 67 28 70 2e 69 64 65 6e 74 69 66 69 65 72 29 2c 41 3d 52 73 28 54 2e 73 65 74 54 69 6d 65 6f 75 74 4f 76 65 72 72 69 64 65 2c 54 2e 63 6c 65 61 72 54 69 6d 65 6f 75 74 4f 76 65 72 72 69 64 65 29 2c 4a 3d 21 54 2e 64 69 73 61 62 6c 65 4f 70 74 69 6d 69 7a 65 4f 62 6a 26 26 21 21 61 65 28 22 63 68 72 6f 6d 65 22 29 2c 6e 3d 65 2e 67 65 74 57 50 61 72 61 6d 2c 65 Data Ascii: amespace&&v.evtNamespace());var t,r=p._getTelCtx(),i=(d.extensionConfig[p.identifier]=d.extensionConfig[p.identifier]\|\|{},T=r.getExtCfg(p.identifier),A=Rs(T.setTimeoutOverride,T.clearTimeoutOverride),J=!T.disableOptimizeObj&&!!ae("chrome"),n=e.getWParam,e

Timestamp	kBytes transferred	Direction	Data
2023-10-19 17:19:18 UTC	357	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 70 6e 68 42 69 56 33 4d 6f 55 47 4c 53 41 43 69 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 62 62 66 63 32 61 31 32 34 66 62 61 30 61 36 65 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: pnhBiV3MoUGLSACi.1Context: bbfc2a124fba0a6e
2023-10-19 17:19:18 UTC	357	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2023-10-19 17:19:18 UTC	358	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 34 31 0d 0a 4d 53 2d 43 56 3a 20 70 6e 68 42 69 56 33 4d 6f 55 47 4c 53 41 43 69 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 62 62 66 63 32 61 31 32 34 66 62 61 30 61 36 65 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 6f 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 56 38 62 41 64 32 4c 4f 37 69 74 76 56 6e 47 43 54 79 58 52 31 55 4f 70 51 52 35 34 32 57 72 63 4e 42 6e 72 34 56 31 4d 73 4a 4d 46 69 33 4d 62 4d 6b 70 72 4a 5a 43 4e 75 70 7a 39 63 44 47 53 64 2b 4a 4b 4a 46 59 56 77 78 6d 72 4e 76 72 47 56 4a 68 31 67 32 65 48 6c 53 51 5a 74 38 4f 38 4e 68 6e 47 72 41 70 63 35 64 49 57 4e Data Ascii: ATH 2 CON\DEVICE 1041MS-CV: pnhBiV3MoUGLSACi.2Context: bbfc2a124fba0a6e<device><compact-ticket>t=EwCoAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAV8bAd2LO7itvVnGCTyXR1UOpQR542WrcNBnr4V1MsJMFi3MbMkprJZCNupz9cDGSd+JKJFYVwxmrNvrGVJh1g2eHlSQZt8O8NhnGrApc5dIWN
2023-10-19 17:19:18 UTC	359	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 70 6e 68 42 69 56 33 4d 6f 55 47 4c 53 41 43 69 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 62 62 66 63 32 61 31 32 34 66 62 61 30 61 36 65 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: pnhBiV3MoUGLSACi.3Context: bbfc2a124fba0a6e<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2023-10-19 17:19:19 UTC	359	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2023-10-19 17:19:19 UTC	359	IN	Data Raw: 4d 53 2d 43 56 3a 20 6d 2b 4c 68 34 4e 79 55 53 30 69 30 59 33 33 33 4a 76 62 61 35 41 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: m+Lh4NyUS0i0Y333Jvba5A.0Payload parsing failed.

Timestamp	kBytes transferred	Direction	Data
2023-10-19 17:19:20 UTC	360	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=31536000 Content-Length: 48732 Content-Type: application/x-javascript Content-Encoding: gzip Content-MD5: ZMFy5HcA9P2mV6uiFqhObw== Last-Modified: Thu, 31 Aug 2023 16:32:16 GMT ETag: 0x8DBAA3FD69230F5 X-Cache: TCP_HIT x-ms-request-id: 9f41cdcb-901e-0002-01a2-026177000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * X-Azure-Ref-OriginShield: 0t1AxZQAAAAAIR1bOF0IvRaisB+V5/V9dU0pDMjExMDUxMjA3MDIzADM5YTEyZjdlLTg5OWYtNDZjZi1hNmQwLTI0YmJiYTI3ZDk1Ng== X-Azure-Ref: 0GGUxZQAAAABLnHS7EAIhTrep8/VmpGncTEFYRURHRTIyMDgAMzlhMTJmN2UtODk5Zi00NmNmLWE2ZDAtMjRiYmJhMjdkOTU2 Date: Thu, 19 Oct 2023 17:19:20 GMT Connection: close
2023-10-19 17:19:20 UTC	361	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 bc bd 7b 5f e3 38 d2 30 fa ff f3 29 82 77 0f 63 4f 4c c8 05 68 70 70 e7 4d 03 dd cd 0c b7 21 61 7a 66 69 96 9f 93 28 e0 ee 60 67 6d 07 9a 09 79 3f fb a9 8b 64 cb 8e 43 f7 ec 73 7e 67 2e c1 96 4a b2 54 aa 2a 55 95 4a d2 e6 cf 6b ff 53 f9 b9 b2 f1 e3 ff 54 7a fd ee 65 bf 72 fe be d2 ff 78 7c 79 58 b9 80 b7 3f 2b 67 e7 fd e3 83 a3 1f af 07 3f 8a ff f7 ef fd b8 32 f6 27 a2 02 7f 07 5e 2c 46 95 30 a8 84 51 c5 0f 86 61 34 0d 23 2f 11 71 e5 01 7e 23 df 9b 54 c6 51 f8 50 49 ee 45 65 1a 85 5f c4 30 89 2b 13 3f 4e a0 d0 40 4c c2 a7 8a 09 d5 45 a3 ca 85 17 25 cf 95 e3 0b ab 06 f5 0b a8 cd bf f3 03 28 3d 0c a7 cf f0 7c 9f 54 82 30 f1 87 a2 e2 05 23 aa 6d 02 2f 41 2c 2a b3 60 24 a2 ca d3 bd 3f bc af 9c fa c3 28 8c c3 71 52 89 c4 50 f8 8f Data Ascii: {_80)wcOLhppM!azfi(`gmy?dCs~g.JTUJkSTzerx\|yX?+g?2'^,F0Qa4#/q~#TQPIEe_0+?N@LE%(=\|T0#m/A,`$?(qRP
2023-10-19 17:19:21 UTC	376	IN	Data Raw: 33 f1 ba b9 ef 82 19 76 5e 12 fb 4a 12 fb d7 81 92 c4 be 2e 89 2d 3b 93 12 ee c8 34 d4 b3 21 33 78 b7 10 c8 21 8f 6a d5 e1 ca b2 a8 18 c9 29 b2 2f a4 dd 8b 05 96 12 33 d0 a3 40 f9 11 0b e8 c7 f3 17 ad f9 a4 33 29 c2 69 d9 8e bf be ee 9b 34 b2 b4 65 fb 4e fc ae 18 1c 3f 5b 4c 53 fd 42 6b 13 2f c8 4d f4 1e e5 13 15 28 1d bb 46 46 13 43 a5 ef 04 00 1f c0 84 e2 47 73 69 0c 48 07 5d d0 09 41 08 92 be 51 e6 34 8c b3 96 a4 2f 06 df fc 3d e3 29 25 d0 a7 b1 b2 93 a0 67 ee ec e5 05 a7 49 54 05 5e d1 25 ea ac 4b 6c a3 2a 31 5f 80 22 21 ab e7 63 cd f9 20 ad a5 91 e0 e2 50 20 c6 23 b6 1c 50 c3 fc c2 b1 5b 35 ed d4 2d ac 15 5b d1 f6 94 dc 4e 61 f1 b4 bd a5 34 ba c2 a7 24 1d a8 d6 9d 87 52 3c 87 f6 63 fe 9c f8 ec 0c ec c5 82 6f 85 c1 63 b9 f0 b2 11 ae 87 9c 01 df e4 9d Data Ascii: 3v^J.-;4!3x!j)/3@3)i4eN?[LSBk/M(FFCGsiH]AQ4/=)%gIT^%Kl*1_"!c P #P[5-[Na4$R<coc
2023-10-19 17:19:21 UTC	392	IN	Data Raw: 32 ff 95 92 a0 03 bb 06 23 eb a4 6c e2 08 8b 3a a4 fe 06 37 82 9b cd 66 73 87 13 63 8f 71 5b f3 4d d6 e9 c5 1e e3 b0 31 67 26 c6 d2 d9 c1 67 4d 02 28 50 37 b5 07 14 41 3a a6 6d e9 d0 e1 76 7b fb fd 8f 3a e4 38 d1 44 0f 14 cf f0 4b fa 78 b3 d4 13 46 45 aa fc 82 ab b6 5f 70 78 97 63 66 e5 29 97 20 04 55 73 2e 39 44 93 99 05 de 38 89 1f ec 37 0c 9f 83 7a 1f 38 c6 b6 48 4b 38 1a cc 49 64 ca 2f 0c 85 34 0e d8 d1 c0 bc f1 40 4b 86 37 19 b5 26 c8 7d 59 dc 81 78 d1 6f 26 59 dd 86 30 9d 76 97 4d b4 01 ae 83 19 15 05 51 a9 5d e7 26 3f fc a8 86 d1 dd c2 a4 f4 f2 3f c6 4f 52 e4 4f 36 1f d8 a0 e5 6e 93 ba e8 d0 95 36 5b 79 e7 67 6a 80 70 e4 4d 2a 42 21 08 1c 6e 81 33 70 50 d4 6e f6 f4 c1 6d 9f f0 da 92 8d d8 0c 81 07 32 b7 46 ee 06 f2 50 d0 5e 2a 10 d9 0d c1 89 cc cb Data Ascii: 2#l:7fscq[M1g&gM(P7A:mv{:8DKxFE_pxcf) Us.9D87z8HK8Id/4@K7&}Yxo&Y0vMQ]&??ORO6n6[ygjpMB!n3pPnm2FP^
2023-10-19 17:19:21 UTC	408	IN	Data Raw: 51 83 f8 c8 2a 6d 52 95 8d 9c 81 f6 c8 8b 07 aa e4 82 e6 f3 7a e0 56 34 c8 0a bf ef a2 f4 9c 96 15 8f 49 91 69 37 8e 2d ef ae 46 d4 4e 04 cb 69 ed f0 a0 7f ed 68 20 00 a7 d5 3e 6c 03 63 b8 ec 9f a7 2f f4 5e 69 fd b8 f7 45 4f ef 91 e2 f6 f5 9b f7 5f 1a 85 c2 8c 82 dd ed 21 27 5a 36 f9 7a 52 73 fe 21 2d 71 ae 34 c0 3a 26 85 d6 40 b1 3d 3e eb 2b 97 99 95 87 b0 84 23 63 85 78 d8 65 cf 42 a9 24 29 52 64 c5 54 38 07 87 ef 0f 3f 1c 1e bc fb e5 25 03 37 a7 61 e7 29 9d 58 20 e3 d4 fe d4 d3 da 33 f3 91 5c 0d 5f 3d d2 6e 32 6d 56 1a d4 b5 8c 1c 15 16 c9 43 df 3b 73 c8 4c 31 75 cb 16 0f 95 14 a5 78 9b b7 3c 94 11 90 af 23 17 da 5d 29 dc 1b ed 83 1e c4 49 87 62 d1 57 6b 07 b8 11 1c e0 06 3c 2b 01 bd 27 3e be 92 3a 97 96 f8 a3 ef 76 bd c9 96 8d fa a5 e1 70 de 3f 33 0b Data Ascii: Q*mRzV4Ii7-FNih >lc/^iEO_!'Z6zRs!-q4:&@=>+#cxeB$)RdT8?%7a)X 3\_=n2mVC;sL1ux<#])IbWk<+'>:vp?3

Timestamp	kBytes transferred	Direction	Data
2023-10-19 17:19:22 UTC	409	IN	HTTP/1.1 200 OK Content-Length: 181223 Content-Type: application/javascript Last-Modified: Tue, 10 Oct 2023 21:40:52 GMT ETag: "1d9fbfd1d3fa1e7" X-Cache: TCP_HIT X-Content-Type-Options: nosniff Access-Control-Allow-Origin: * X-UA-Compatible: IE=edge Strict-Transport-Security: max-age=31536000; includeSubDomains X-Azure-Ref-OriginShield: 0wpMwZQAAAAAjazyKiugfQrliIji/gaN5U0pDMjExMDUxMjA3MDQ5AGVhYzVmNDlmLWUwMmQtNGY0MS1iMGE2LTJkNTBmOWZjZjg0YQ== X-Azure-Ref: 0GmUxZQAAAAAGG9FS9ZA8RagIyUMy0KDVTEFYRURHRTIyMTgAZWFjNWY0OWYtZTAyZC00ZjQxLWIwYTYtMmQ1MGY5ZmNmODRh Date: Thu, 19 Oct 2023 17:19:21 GMT Connection: close
2023-10-19 17:19:22 UTC	409	IN	Data Raw: 4d 65 43 6f 6e 74 72 6f 6c 44 65 66 69 6e 65 28 22 6d 65 42 6f 6f 74 22 2c 5b 22 65 78 70 6f 72 74 73 22 2c 22 40 6d 65 63 6f 6e 74 72 6f 6c 2f 77 65 62 2d 69 6e 6c 69 6e 65 22 5d 2c 66 75 6e 63 74 69 6f 6e 28 74 2c 53 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 63 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 7d 2c 69 3d 7b 7d 2c 75 3d 5b 5d 2c 70 3d 5b 5d 3b 66 75 6e 63 74 69 6f 6e 20 4f 28 74 2c 65 29 7b 76 61 72 20 72 2c 6e 2c 6f 2c 69 2c 61 3d 70 3b 66 6f 72 28 69 3d 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3b 32 3c 69 2d 2d 3b 29 75 2e 70 75 73 68 28 61 72 67 75 6d 65 6e 74 73 5b 69 5d 29 3b 66 6f 72 28 65 26 26 6e 75 6c 6c 21 3d 65 2e 63 68 69 6c 64 72 65 6e 26 26 28 75 2e 6c 65 6e 67 74 68 7c 7c 75 2e 70 75 73 68 28 65 2e 63 68 69 6c 64 Data Ascii: MeControlDefine("meBoot",["exports","@mecontrol/web-inline"],function(t,S){"use strict";var c=function(){},i={},u=[],p=[];function O(t,e){var r,n,o,i,a=p;for(i=arguments.length;2<i--;)u.push(arguments[i]);for(e&&null!=e.children&&(u.length\|\|u.push(e.child
2023-10-19 17:19:22 UTC	425	IN	Data Raw: 29 2c 72 3d 30 3b 72 3c 74 3b 72 2b 2b 29 65 5b 72 5d 3d 61 72 67 75 6d 65 6e 74 73 5b 72 5d 3b 72 65 74 75 72 6e 20 30 3d 3d 3d 65 2e 6c 65 6e 67 74 68 3f 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 20 74 7d 3a 31 3d 3d 3d 65 2e 6c 65 6e 67 74 68 3f 65 5b 30 5d 3a 65 2e 72 65 64 75 63 65 28 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 74 28 65 2e 61 70 70 6c 79 28 76 6f 69 64 20 30 2c 61 72 67 75 6d 65 6e 74 73 29 29 7d 7d 29 7d 76 61 72 20 74 74 3d 41 72 72 61 79 2e 69 73 41 72 72 61 79 3b 66 75 6e 63 74 69 6f 6e 20 65 74 28 74 29 7b 76 61 72 20 65 2c 72 2c 6e 2c 6f 3d 22 22 2c 69 3d 74 79 70 65 6f 66 20 74 3b 69 66 28 22 73 74 72 69 6e 67 22 3d 3d 69 7c 7c 22 6e 75 6d 62 Data Ascii: ),r=0;r<t;r++)e[r]=arguments[r];return 0===e.length?function(t){return t}:1===e.length?e[0]:e.reduce(function(t,e){return function(){return t(e.apply(void 0,arguments))}})}var tt=Array.isArray;function et(t){var e,r,n,o="",i=typeof t;if("string"==i\|\|"numb
2023-10-19 17:19:22 UTC	441	IN	Data Raw: 72 69 6e 67 22 3a 72 65 74 75 72 6e 22 22 3d 3d 3d 74 7c 7c 21 77 65 2e 74 65 73 74 28 74 29 3b 64 65 66 61 75 6c 74 3a 72 65 74 75 72 6e 21 31 7d 7d 66 75 6e 63 74 69 6f 6e 20 4f 65 28 74 29 7b 66 6f 72 28 76 61 72 20 65 3d 5b 5d 2c 72 3d 31 3b 72 3c 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3b 72 2b 2b 29 65 5b 72 2d 31 5d 3d 61 72 67 75 6d 65 6e 74 73 5b 72 5d 3b 66 6f 72 28 76 61 72 20 6e 3d 30 2c 6f 3d 65 3b 6e 3c 6f 2e 6c 65 6e 67 74 68 3b 6e 2b 2b 29 7b 76 61 72 20 69 3d 6f 5b 6e 5d 3b 66 6f 72 28 76 61 72 20 61 20 69 6e 20 69 29 69 66 28 53 2e 68 61 73 4f 77 6e 28 69 2c 61 29 29 7b 76 61 72 20 73 3d 69 5b 61 5d 3b 6e 75 6c 6c 3d 3d 73 7c 7c 53 65 28 73 29 7c 7c 28 74 5b 61 5d 3d 73 29 7d 7d 72 65 74 75 72 6e 20 74 7d 66 75 6e 63 74 69 6f 6e Data Ascii: ring":return""===t\|\|!we.test(t);default:return!1}}function Oe(t){for(var e=[],r=1;r<arguments.length;r++)e[r-1]=arguments[r];for(var n=0,o=e;n<o.length;n++){var i=o[n];for(var a in i)if(S.hasOwn(i,a)){var s=i[a];null==s\|\|Se(s)\|\|(t[a]=s)}}return t}function
2023-10-19 17:19:22 UTC	457	IN	Data Raw: 2e 70 72 6f 70 73 2c 72 3d 65 2e 63 73 73 43 6c 61 73 73 2c 6e 3d 65 2e 63 68 69 6c 64 72 65 6e 2c 6f 3d 74 68 69 73 2e 73 74 61 74 65 2e 61 63 74 69 76 61 74 65 64 3b 72 65 74 75 72 6e 20 4f 28 22 64 69 76 22 2c 7b 63 6c 61 73 73 3a 65 74 28 5b 72 2c 28 74 3d 7b 7d 2c 74 2e 6d 65 63 74 72 6c 5f 66 6f 63 75 73 5f 76 69 73 69 62 6c 65 3d 6f 2c 74 29 5d 29 7d 2c 6e 29 7d 2c 66 72 29 3b 66 75 6e 63 74 69 6f 6e 20 66 72 28 74 29 7b 76 61 72 20 65 3d 75 72 2e 63 61 6c 6c 28 74 68 69 73 2c 74 29 7c 7c 74 68 69 73 3b 72 65 74 75 72 6e 20 65 2e 73 74 61 74 65 3d 7b 61 63 74 69 76 61 74 65 64 3a 21 21 74 2e 76 69 73 69 62 6c 65 4f 6e 53 74 61 72 74 7d 2c 65 2e 68 61 73 52 65 63 65 6e 74 4b 65 79 62 6f 61 72 64 41 63 74 69 6f 6e 3d 21 31 2c 65 2e 6b 65 79 64 6f 77 Data Ascii: .props,r=e.cssClass,n=e.children,o=this.state.activated;return O("div",{class:et([r,(t={},t.mectrl_focus_visible=o,t)])},n)},fr);function fr(t){var e=ur.call(this,t)\|\|this;return e.state={activated:!!t.visibleOnStart},e.hasRecentKeyboardAction=!1,e.keydow
2023-10-19 17:19:22 UTC	473	IN	Data Raw: 29 3b 63 61 73 65 22 73 69 67 6e 4f 75 74 46 72 6f 6d 49 64 70 22 3a 72 65 74 75 72 6e 21 31 3b 63 61 73 65 22 73 69 67 6e 4f 75 74 41 6e 64 46 6f 72 67 65 74 46 72 6f 6d 49 64 70 22 3a 72 65 74 75 72 6e 20 78 74 28 6e 75 6c 6c 3d 3d 3d 28 72 3d 74 68 69 73 2e 63 6f 6e 66 69 67 2e 6d 73 61 29 7c 7c 76 6f 69 64 20 30 3d 3d 3d 72 3f 76 6f 69 64 20 30 3a 72 2e 73 69 67 6e 4f 75 74 41 6e 64 46 6f 72 67 65 74 55 72 6c 29 3b 63 61 73 65 22 73 77 69 74 63 68 22 3a 72 65 74 75 72 6e 20 78 74 28 74 68 69 73 2e 63 6f 6e 66 69 67 2e 61 70 70 53 77 69 74 63 68 55 72 6c 29 3b 63 61 73 65 22 73 77 69 74 63 68 54 6f 22 3a 72 65 74 75 72 6e 20 78 74 28 74 68 69 73 2e 63 6f 6e 66 69 67 2e 61 70 70 53 77 69 74 63 68 54 6f 55 72 6c 29 3b 63 61 73 65 22 67 65 74 52 65 6d 65 Data Ascii: );case"signOutFromIdp":return!1;case"signOutAndForgetFromIdp":return xt(null===(r=this.config.msa)\|\|void 0===r?void 0:r.signOutAndForgetUrl);case"switch":return xt(this.config.appSwitchUrl);case"switchTo":return xt(this.config.appSwitchToUrl);case"getReme
2023-10-19 17:19:22 UTC	489	IN	Data Raw: 6e 28 74 29 7b 72 65 74 75 72 6e 21 21 74 26 26 2d 31 3c 6d 74 28 74 29 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 2e 69 6e 64 65 78 4f 66 28 22 6c 6f 67 69 6e 2e 6c 69 76 65 2e 63 6f 6d 22 29 7d 66 75 6e 63 74 69 6f 6e 20 6d 6e 28 74 29 7b 72 65 74 75 72 6e 20 6e 65 77 20 79 6e 28 74 29 7d 76 61 72 20 79 6e 3d 28 76 6e 2e 70 72 6f 74 6f 74 79 70 65 2e 73 75 70 70 6f 72 74 73 4d 73 61 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 22 6d 73 61 6c 4a 73 57 69 74 68 4d 73 61 22 3d 3d 3d 74 68 69 73 2e 63 6f 6e 66 69 67 2e 74 79 70 65 7d 2c 76 6e 2e 70 72 6f 74 6f 74 79 70 65 2e 69 73 4f 70 65 72 61 74 69 6f 6e 53 75 70 70 6f 72 74 65 64 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 76 61 72 20 72 2c 6e 2c 6f 3b 73 77 69 74 63 68 28 74 29 7b 63 61 73 65 Data Ascii: n(t){return!!t&&-1<mt(t).toLowerCase().indexOf("login.live.com")}function mn(t){return new yn(t)}var yn=(vn.prototype.supportsMsa=function(){return"msalJsWithMsa"===this.config.type},vn.prototype.isOperationSupported=function(t,e){var r,n,o;switch(t){case
2023-10-19 17:19:22 UTC	505	IN	Data Raw: 63 61 63 68 65 64 44 61 74 61 2c 6c 3d 74 2c 66 3d 30 3b 66 3c 64 2e 6c 65 6e 67 74 68 3b 66 2b 2b 29 7b 69 66 28 79 3d 6c 5b 6e 75 6c 6c 21 3d 28 6f 3d 64 5b 66 5d 2e 61 63 63 6f 75 6e 74 49 64 29 3f 6f 3a 64 5b 66 5d 2e 70 61 79 6c 6f 61 64 2e 6b 65 79 5d 29 7b 76 61 72 20 68 3d 64 5b 66 5d 2e 70 61 79 6c 6f 61 64 3b 79 2e 70 69 63 74 75 72 65 55 72 6c 3d 6e 75 6c 6c 21 3d 28 69 3d 79 2e 70 69 63 74 75 72 65 55 72 6c 29 3f 69 3a 68 2e 72 65 73 6f 75 72 63 65 2c 79 2e 63 61 63 68 65 4d 65 74 61 3f 79 2e 63 61 63 68 65 4d 65 74 61 2e 70 69 63 74 75 72 65 55 72 6c 3d 68 2e 72 65 73 6f 75 72 63 65 45 54 61 67 3a 79 2e 63 61 63 68 65 4d 65 74 61 3d 28 28 72 3d 7b 7d 29 2e 70 69 63 74 75 72 65 55 72 6c 3d 68 2e 72 65 73 6f 75 72 63 65 45 54 61 67 2c 72 29 7d Data Ascii: cachedData,l=t,f=0;f<d.length;f++){if(y=l[null!=(o=d[f].accountId)?o:d[f].payload.key]){var h=d[f].payload;y.pictureUrl=null!=(i=y.pictureUrl)?i:h.resource,y.cacheMeta?y.cacheMeta.pictureUrl=h.resourceETag:y.cacheMeta=((r={}).pictureUrl=h.resourceETag,r)}
2023-10-19 17:19:22 UTC	521	IN	Data Raw: 78 33 62 6f 75 74 6c 69 6e 65 2d 77 69 64 74 68 5c 78 33 61 32 70 78 5c 78 32 31 69 6d 70 6f 72 74 61 6e 74 5c 78 33 62 6f 75 74 6c 69 6e 65 2d 6f 66 66 73 65 74 5c 78 33 61 2d 32 70 78 5c 78 32 31 69 6d 70 6f 72 74 61 6e 74 5c 78 37 64 2e 6d 65 63 74 72 6c 5f 67 6c 79 70 68 5c 78 37 62 6f 76 65 72 66 6c 6f 77 5c 78 33 61 68 69 64 64 65 6e 5c 78 33 62 62 61 63 6b 67 72 6f 75 6e 64 2d 73 69 7a 65 5c 78 33 61 63 6f 76 65 72 5c 78 33 62 62 61 63 6b 67 72 6f 75 6e 64 2d 70 6f 73 69 74 69 6f 6e 5c 78 33 61 63 65 6e 74 65 72 20 63 65 6e 74 65 72 5c 78 33 62 62 61 63 6b 67 72 6f 75 6e 64 2d 72 65 70 65 61 74 5c 78 33 61 6e 6f 2d 72 65 70 65 61 74 5c 78 37 64 2e 67 6c 79 70 68 5f 6d 6f 72 65 5c 78 37 62 77 69 64 74 68 5c 78 33 61 32 34 70 78 5c 78 33 62 68 65 69 Data Ascii: x3boutline-width\x3a2px\x21important\x3boutline-offset\x3a-2px\x21important\x7d.mectrl_glyph\x7boverflow\x3ahidden\x3bbackground-size\x3acover\x3bbackground-position\x3acenter center\x3bbackground-repeat\x3ano-repeat\x7d.glyph_more\x7bwidth\x3a24px\x3bhei
2023-10-19 17:19:22 UTC	536	IN	Data Raw: 39 20 31 34 68 32 2e 34 33 6c 35 2e 35 38 20 31 31 2e 32 35 61 31 2e 30 34 36 20 31 2e 30 34 36 20 30 20 30 31 2d 31 2e 37 39 31 20 31 2e 30 38 6c 2d 2e 35 34 39 2d 31 2e 30 38 7a 5c 78 32 37 5c 78 32 66 5c 78 32 35 33 45 5c 78 32 35 33 43 5c 78 32 66 67 5c 78 32 35 33 45 5c 78 32 35 33 43 5c 78 32 66 73 76 67 5c 78 32 35 33 45 5c 78 32 32 5c 78 32 39 5c 78 37 64 2e 63 2d 75 68 66 68 5c 78 33 65 2e 74 68 65 6d 65 2d 64 61 72 6b 20 2e 63 2d 6d 65 20 2e 67 6c 79 70 68 5f 61 63 63 6f 75 6e 74 5f 63 69 72 63 6c 65 2c 2e 6d 65 63 74 72 6c 5f 74 68 65 6d 65 5f 61 7a 75 72 65 5f 68 63 64 61 72 6b 20 2e 67 6c 79 70 68 5f 61 63 63 6f 75 6e 74 5f 63 69 72 63 6c 65 2c 2e 6d 65 63 74 72 6c 5f 74 68 65 6d 65 5f 64 61 72 6b 20 2e 67 6c 79 70 68 5f 61 63 63 6f 75 6e 74 Data Ascii: 9 14h2.43l5.58 11.25a1.046 1.046 0 01-1.791 1.08l-.549-1.08z\x27\x2f\x253E\x253C\x2fg\x253E\x253C\x2fsvg\x253E\x22\x29\x7d.c-uhfh\x3e.theme-dark .c-me .glyph_account_circle,.mectrl_theme_azure_hcdark .glyph_account_circle,.mectrl_theme_dark .glyph_account
2023-10-19 17:19:22 UTC	552	IN	Data Raw: 34 68 2d 32 2e 33 32 39 56 38 2e 35 30 37 68 32 2e 33 32 39 7a 6d 37 2e 30 36 34 2d 31 2e 36 39 34 61 33 2e 32 32 35 20 33 2e 32 32 35 20 30 20 30 30 31 2e 31 34 35 2d 2e 32 34 20 34 2e 38 30 38 20 34 2e 38 30 38 20 30 20 30 30 31 2e 31 35 35 2d 2e 36 33 36 56 31 38 61 34 2e 36 35 39 20 34 2e 36 35 39 20 30 20 30 31 2d 31 2e 32 36 36 2e 34 38 31 20 36 2e 39 20 36 2e 39 20 30 20 30 31 2d 31 2e 35 35 34 2e 31 36 33 20 34 2e 37 30 37 20 34 2e 37 30 37 20 30 20 30 31 2d 34 2e 39 31 38 2d 34 2e 39 30 37 20 35 2e 36 34 34 20 35 2e 36 34 34 20 30 20 30 31 31 2e 34 2d 33 2e 39 33 32 20 35 2e 30 35 34 20 35 2e 30 35 34 20 30 20 30 31 33 2e 39 35 35 2d 31 2e 35 34 35 20 35 2e 34 32 20 35 2e 34 32 20 30 20 30 31 31 2e 33 32 34 2e 31 36 39 20 34 2e 34 20 34 2e 34 20 Data Ascii: 4h-2.329V8.507h2.329zm7.064-1.694a3.225 3.225 0 001.145-.24 4.808 4.808 0 001.155-.636V18a4.659 4.659 0 01-1.266.481 6.9 6.9 0 01-1.554.163 4.707 4.707 0 01-4.918-4.907 5.644 5.644 0 011.4-3.932 5.054 5.054 0 013.955-1.545 5.42 5.42 0 011.324.169 4.4 4.4
2023-10-19 17:19:22 UTC	568	IN	Data Raw: 64 5c 78 33 64 5c 78 32 37 4d 36 20 35 61 31 38 2e 34 35 34 20 31 38 2e 34 35 34 20 30 20 30 31 36 20 31 76 31 63 30 20 2e 39 38 34 2d 2e 31 34 33 20 31 2e 39 33 35 2d 2e 34 33 20 32 2e 38 35 32 2d 2e 32 38 36 2e 39 31 36 2d 2e 36 39 20 31 2e 37 36 38 2d 31 2e 32 31 20 32 2e 35 35 34 41 39 2e 37 32 35 20 39 2e 37 32 35 20 30 20 30 31 36 20 31 36 61 39 2e 35 39 35 20 39 2e 35 39 35 20 30 20 30 31 2d 32 2e 34 36 2d 31 2e 34 38 34 20 39 2e 36 35 20 39 2e 36 35 20 30 20 30 31 2d 31 2e 38 39 32 2d 32 2e 31 30 32 41 31 30 2e 32 34 35 20 31 30 2e 32 34 35 20 30 20 30 31 2e 34 33 20 39 2e 38 36 37 20 39 2e 31 31 33 20 39 2e 31 31 33 20 30 20 30 31 30 20 37 2e 30 32 33 63 30 2d 2e 30 36 37 2e 30 30 35 2d 2e 31 34 35 2e 30 31 36 2d 2e 32 33 34 6c 2e 30 33 2d 2e 32 Data Ascii: d\x3d\x27M6 5a18.454 18.454 0 016 1v1c0 .984-.143 1.935-.43 2.852-.286.916-.69 1.768-1.21 2.554A9.725 9.725 0 016 16a9.595 9.595 0 01-2.46-1.484 9.65 9.65 0 01-1.892-2.102A10.245 10.245 0 01.43 9.867 9.113 9.113 0 010 7.023c0-.067.005-.145.016-.234l.03-.2
2023-10-19 17:19:22 UTC	584	IN	Data Raw: 63 74 72 6c 5f 74 68 65 6d 65 5f 64 61 72 6b 20 2e 6d 65 63 74 72 6c 5f 61 75 74 68 41 70 70 5f 63 6c 6f 73 65 5c 78 33 61 68 6f 76 65 72 5c 78 37 62 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 5c 78 33 61 5c 78 32 33 30 30 35 62 61 31 5c 78 37 64 2e 63 2d 75 68 66 68 5c 78 33 65 2e 74 68 65 6d 65 2d 64 61 72 6b 20 2e 63 2d 6d 65 20 2e 6d 65 63 74 72 6c 5f 61 75 74 68 41 70 70 5f 62 61 6e 6e 65 72 5c 78 33 61 66 6f 63 75 73 2c 2e 63 2d 75 68 66 68 5c 78 33 65 2e 74 68 65 6d 65 2d 64 61 72 6b 20 2e 63 2d 6d 65 20 2e 6d 65 63 74 72 6c 5f 61 75 74 68 41 70 70 5f 62 61 6e 6e 65 72 5f 70 61 72 65 6e 74 5c 78 33 61 66 6f 63 75 73 2c 2e 63 2d 75 68 66 68 5c 78 33 65 2e 74 68 65 6d 65 2d 64 61 72 6b 20 2e 63 2d 6d 65 20 2e 6d 65 63 74 72 6c 5f 61 75 74 68 41 Data Ascii: ctrl_theme_dark .mectrl_authApp_close\x3ahover\x7bbackground-color\x3a\x23005ba1\x7d.c-uhfh\x3e.theme-dark .c-me .mectrl_authApp_banner\x3afocus,.c-uhfh\x3e.theme-dark .c-me .mectrl_authApp_banner_parent\x3afocus,.c-uhfh\x3e.theme-dark .c-me .mectrl_authA

Timestamp	kBytes transferred	Direction	Data
2023-10-19 17:19:23 UTC	587	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Age: 4139778 Cache-Control: public, max-age=31536000 Content-MD5: YIXwSG9DUX9RSvEqscUD9Q== Content-Type: application/x-javascript Date: Thu, 19 Oct 2023 17:19:23 GMT Etag: 0x8DBAA40059384DA Last-Modified: Thu, 31 Aug 2023 16:33:35 GMT Server: ECAcc (laa/7BDF) Vary: Accept-Encoding X-Cache: HIT X-EC-BBR-Enable: 1 x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: d9919a3b-f01e-00c8-0809-dd8673000000 x-ms-version: 2009-09-19 Content-Length: 146251 Connection: close
2023-10-19 17:19:23 UTC	588	IN	Data Raw: 2f 2a 21 0a 20 2a 20 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 20 53 54 41 52 54 20 4f 46 20 54 48 49 52 44 20 50 41 52 54 59 20 4e 4f 54 49 43 45 20 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 0a 20 2a 20 0a 20 2a 20 54 68 69 73 20 66 69 6c 65 20 69 73 20 62 61 73 65 64 20 6f 6e 20 6f 72 20 69 6e 63 6f 72 70 6f 72 61 74 65 73 20 6d 61 74 65 72 69 61 6c 20 66 72 6f 6d 20 74 68 65 20 70 72 6f 6a 65 63 74 73 20 6c 69 73 74 65 64 20 62 65 6c 6f 77 20 28 54 68 69 72 64 20 50 61 72 74 79 20 49 50 29 2e 20 54 68 65 20 6f 72 69 67 69 6e 61 6c 20 63 6f 70 79 72 69 67 68 74 20 6e 6f 74 69 63 65 20 61 Data Ascii: /! ------------------------------------------- START OF THIRD PARTY NOTICE ----------------------------------------- * * This file is based on or incorporates material from the projects listed below (Third Party IP). The original copyright notice a
2023-10-19 17:19:23 UTC	604	IN	Data Raw: 4f 43 45 53 53 5f 41 4c 54 45 4d 41 49 4c 53 41 4d 45 41 53 4d 41 49 4c 42 4f 58 3a 22 38 30 30 34 39 43 32 44 22 2c 50 50 5f 45 5f 45 4d 41 49 4c 5f 52 49 47 48 54 5f 54 4f 4f 5f 4c 4f 4e 47 3a 22 38 30 30 34 31 31 30 43 22 2c 50 50 5f 45 5f 4e 41 4d 45 5f 54 4f 4f 5f 4c 4f 4e 47 3a 22 38 30 30 34 31 31 30 32 22 2c 50 50 5f 45 5f 41 4c 49 41 53 5f 41 55 54 48 5f 4e 4f 54 50 45 52 4d 49 54 54 45 44 3a 22 38 30 30 34 37 38 38 42 22 2c 50 50 5f 45 5f 54 4f 54 50 5f 49 4e 56 41 4c 49 44 3a 22 38 30 30 34 39 43 33 34 22 2c 50 50 5f 45 5f 4f 4c 44 5f 53 4b 59 50 45 5f 50 41 53 53 57 4f 52 44 3a 22 38 30 30 34 33 35 35 37 22 2c 50 50 5f 45 5f 4f 54 54 5f 44 41 54 41 5f 49 4e 56 41 4c 49 44 3a 22 38 30 30 34 33 34 38 46 22 2c 50 50 5f 45 5f 4f 54 54 5f 41 4c 52 Data Ascii: OCESS_ALTEMAILSAMEASMAILBOX:"80049C2D",PP_E_EMAIL_RIGHT_TOO_LONG:"8004110C",PP_E_NAME_TOO_LONG:"80041102",PP_E_ALIAS_AUTH_NOTPERMITTED:"8004788B",PP_E_TOTP_INVALID:"80049C34",PP_E_OLD_SKYPE_PASSWORD:"80043557",PP_E_OTT_DATA_INVALID:"8004348F",PP_E_OTT_ALR
2023-10-19 17:19:23 UTC	620	IN	Data Raw: 22 2c Data Ascii: ",
2023-10-19 17:19:23 UTC	620	IN	Data Raw: 22 3d 22 29 29 3a 2d 31 21 3d 3d 6f 26 26 2d 31 21 3d 3d 69 26 26 28 6e 3d 65 2e 73 75 62 73 74 72 69 6e 67 28 30 2c 6f 29 2c 74 3d 75 2e 64 6f 75 62 6c 65 53 70 6c 69 74 28 65 2e 73 75 62 73 74 72 69 6e 67 28 6f 2b 31 2c 69 29 2c 22 26 22 2c 22 3d 22 29 2c 72 3d 75 2e 64 6f 75 62 6c 65 53 70 6c 69 74 28 65 2e 73 75 62 73 74 72 69 6e 67 28 69 2b 31 29 2c 22 26 22 2c 22 3d 22 29 29 7d 72 65 74 75 72 6e 7b 6f 72 69 67 69 6e 41 6e 64 50 61 74 68 3a 6e 2c 71 75 65 72 79 3a 74 2c 66 72 61 67 6d 65 6e 74 3a 72 7d 7d 2c 6a 6f 69 6e 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 6e 3d 65 2e 6f 72 69 67 69 6e 41 6e 64 50 61 74 68 7c 7c 22 22 3b 72 65 74 75 72 6e 20 65 2e 71 75 65 72 79 26 26 28 6e 2b 3d 22 3f 22 2b 73 2e 6a 6f 69 6e 28 65 2e 71 75 65 72 79 2c Data Ascii: "=")):-1!==o&&-1!==i&&(n=e.substring(0,o),t=u.doubleSplit(e.substring(o+1,i),"&","="),r=u.doubleSplit(e.substring(i+1),"&","="))}return{originAndPath:n,query:t,fragment:r}},join:function(e){var n=e.originAndPath\|\|"";return e.query&&(n+="?"+s.join(e.query,
2023-10-19 17:19:23 UTC	636	IN	Data Raw: 72 20 73 3d 6e 2e 67 65 74 54 72 61 63 69 6e 67 43 6f 6e 74 65 78 74 4f 62 6a 65 63 74 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 65 3f 28 69 5b 65 5d 7c 7c 28 69 5b 65 5d 3d 7b 7d 29 2c 69 5b 65 5d 29 3a 61 3d 61 7c 7c 7b 7d 7d 3b 6e 2e 67 65 74 54 72 61 63 69 6e 67 43 6f 6e 74 65 78 74 4f 62 6a 65 63 74 73 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 65 3d 5b 5d 3b 72 65 74 75 72 6e 20 72 2e 4f 62 6a 65 63 74 2e 66 6f 72 45 61 63 68 28 69 2c 28 66 75 6e 63 74 69 6f 6e 28 6e 2c 74 29 7b 74 26 26 65 2e 70 75 73 68 28 7b 76 69 65 77 4d 6f 64 65 6c 3a 6e 2c 63 6f 6e 74 65 78 74 3a 74 7d 29 7d 29 29 2c 61 26 26 65 2e 70 75 73 68 28 61 29 2c 65 7d 2c 6e 2e 72 65 67 69 73 74 65 72 54 72 61 63 69 6e 67 4f 62 73 65 72 76 61 62 6c 65 73 3d 66 Data Ascii: r s=n.getTracingContextObject=function(e){return e?(i[e]\|\|(i[e]={}),i[e]):a=a\|\|{}};n.getTracingContextObjects=function(){var e=[];return r.Object.forEach(i,(function(n,t){t&&e.push({viewModel:n,context:t})})),a&&e.push(a),e},n.registerTracingObservables=f
2023-10-19 17:19:23 UTC	652	IN	Data Raw: 28 65 2c 6e 29 7b 65 2e 65 71 75 61 6c 69 74 79 43 6f 6d 70 61 72 65 72 3d 22 61 6c 77 61 79 73 22 3d 3d 6e 3f 6e 75 6c 6c 3a 74 7d 7d 3b 76 61 72 20 45 3d 7b 75 6e 64 65 66 69 6e 65 64 3a 31 2c 62 6f 6f 6c 65 61 6e 3a 31 2c 6e 75 6d 62 65 72 3a 31 2c 73 74 72 69 6e 67 3a 31 7d 3b 53 2e 62 28 22 65 78 74 65 6e 64 65 72 73 22 2c 53 2e 54 61 29 2c 53 2e 69 63 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 6e 2c 74 29 7b 74 68 69 73 2e 64 61 3d 65 2c 74 68 69 73 2e 6c 63 3d 6e 2c 74 68 69 73 2e 6d 63 3d 74 2c 74 68 69 73 2e 49 62 3d 21 31 2c 74 68 69 73 2e 66 62 3d 74 68 69 73 2e 4a 62 3d 6e 75 6c 6c 2c 53 2e 4c 28 74 68 69 73 2c 22 64 69 73 70 6f 73 65 22 2c 74 68 69 73 2e 73 29 2c 53 2e 4c 28 74 68 69 73 2c 22 64 69 73 70 6f 73 65 57 68 65 6e 4e 6f 64 65 49 73 52 65 Data Ascii: (e,n){e.equalityComparer="always"==n?null:t}};var E={undefined:1,boolean:1,number:1,string:1};S.b("extenders",S.Ta),S.ic=function(e,n,t){this.da=e,this.lc=n,this.mc=t,this.Ib=!1,this.fb=this.Jb=null,S.L(this,"dispose",this.s),S.L(this,"disposeWhenNodeIsRe
2023-10-19 17:19:23 UTC	668	IN	Data Raw: 73 74 22 29 2e 74 65 78 74 2c 69 3d 6f 3f 2f 5e 5c 78 33 63 21 2d 2d 5c 73 2a 6b 6f 28 3f 3a 5c 73 2b 28 5b 5c 73 5c 53 5d 2b 29 29 3f 5c 73 2a 2d 2d 5c 78 33 65 24 2f 3a 2f 5e 5c 73 2a 6b 6f 28 3f 3a 5c 73 2b 28 5b 5c 73 5c 53 5d 2b 29 29 3f 5c 73 2a 24 2f 2c 61 3d 6f 3f 2f 5e 5c 78 33 63 21 2d 2d 5c 73 2a 5c 2f 6b 6f 5c 73 2a 2d 2d 5c 78 33 65 24 2f 3a 2f 5e 5c 73 2a 5c 2f 6b 6f 5c 73 2a 24 2f 2c 73 3d 7b 75 6c 3a 21 30 2c 6f 6c 3a 21 30 7d 2c 63 3d 22 5f 5f 6b 6f 5f 6d 61 74 63 68 65 64 45 6e 64 43 6f 6d 6d 65 6e 74 5f 5f 22 3b 53 2e 68 3d 7b 65 61 3a 7b 7d 2c 63 68 69 6c 64 4e 6f 64 65 73 3a 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 72 65 74 75 72 6e 20 65 28 6e 29 3f 74 28 6e 29 3a 6e 2e 63 68 69 6c 64 4e 6f 64 65 73 7d 2c 45 61 3a 66 75 6e 63 74 69 6f 6e Data Ascii: st").text,i=o?/^\x3c!--\sko(?:\s+([\s\S]+))?\s--\x3e$/:/^\sko(?:\s+([\s\S]+))?\s$/,a=o?/^\x3c!--\s\/ko\s--\x3e$/:/^\s\/ko\s$/,s={ul:!0,ol:!0},c="__ko_matchedEndComment__";S.h={ea:{},childNodes:function(n){return e(n)?t(n):n.childNodes},Ea:function
2023-10-19 17:19:23 UTC	684	IN	Data Raw: 43 68 69 6c 64 43 6f 6e 74 65 78 74 2c 69 6e 63 6c 75 64 65 44 65 73 74 72 6f 79 65 64 3a 74 2e 69 6e 63 6c 75 64 65 44 65 73 74 72 6f 79 65 64 2c 61 66 74 65 72 41 64 64 3a 74 2e 61 66 74 65 72 41 64 64 2c 62 65 66 6f 72 65 52 65 6d 6f 76 65 3a 74 2e 62 65 66 6f 72 65 52 65 6d 6f 76 65 2c 61 66 74 65 72 52 65 6e 64 65 72 3a 74 2e 61 66 74 65 72 52 65 6e 64 65 72 2c 62 65 66 6f 72 65 4d 6f 76 65 3a 74 2e 62 65 66 6f 72 65 4d 6f 76 65 2c 61 66 74 65 72 4d 6f 76 65 3a 74 2e 61 66 74 65 72 4d 6f 76 65 2c 74 65 6d 70 6c 61 74 65 45 6e 67 69 6e 65 3a 53 2e 62 61 2e 4d 61 7d 29 3a 7b 66 6f 72 65 61 63 68 3a 6e 2c 74 65 6d 70 6c 61 74 65 45 6e 67 69 6e 65 3a 53 2e 62 61 2e 4d 61 7d 7d 7d 2c 69 6e 69 74 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 6e 29 7b 72 65 74 75 72 Data Ascii: ChildContext,includeDestroyed:t.includeDestroyed,afterAdd:t.afterAdd,beforeRemove:t.beforeRemove,afterRender:t.afterRender,beforeMove:t.beforeMove,afterMove:t.afterMove,templateuser:S.ba.Ma}):{foreach:n,templateuser:S.ba.Ma}}},init:function(e,n){retur
2023-10-19 17:19:23 UTC	700	IN	Data Raw: 72 7d 3a 72 7c 7c 7b 7d 2c 74 3d 74 7c 7c 5b 5d 2c 28 6e 3d 6e 7c 7c 5b 5d 29 2e 6c 65 6e 67 74 68 3c 74 2e 6c 65 6e 67 74 68 3f 65 28 6e 2c 74 2c 22 61 64 64 65 64 22 2c 22 64 65 6c 65 74 65 64 22 2c 72 29 3a 65 28 74 2c 6e 2c 22 64 65 6c 65 74 65 64 22 2c 22 61 64 64 65 64 22 2c 72 29 7d 7d 28 29 2c 53 2e 62 28 22 75 74 69 6c 73 2e 63 6f 6d 70 61 72 65 41 72 72 61 79 73 22 2c 53 2e 61 2e 50 62 29 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 65 28 65 2c 6e 2c 74 2c 72 2c 6f 29 7b 76 61 72 20 69 3d 5b 5d 2c 73 3d 53 2e 24 28 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 61 3d 6e 28 74 2c 6f 2c 53 2e 61 2e 55 61 28 69 2c 65 29 29 7c 7c 5b 5d 3b 30 3c 69 2e 6c 65 6e 67 74 68 26 26 28 53 2e 61 2e 58 63 28 69 2c 61 29 2c 72 26 26 53 2e 75 Data Ascii: r}:r\|\|{},t=t\|\|[],(n=n\|\|[]).length<t.length?e(n,t,"added","deleted",r):e(t,n,"deleted","added",r)}}(),S.b("utils.compareArrays",S.a.Pb),function(){function e(e,n,t,r,o){var i=[],s=S.$((function(){var a=n(t,o,S.a.Ua(i,e))\|\|[];0<i.length&&(S.a.Xc(i,a),r&&S.u
2023-10-19 17:19:23 UTC	716	IN	Data Raw: 2e 74 69 6c 65 73 53 74 61 74 65 7d 63 61 74 63 68 28 73 29 7b 72 65 74 75 72 6e 7d 69 26 26 22 6d 73 61 4d 65 43 61 63 68 65 64 22 3d 3d 3d 6f 2e 6d 65 73 73 61 67 65 54 79 70 65 26 26 28 21 66 75 6e 63 74 69 6f 6e 28 65 2c 6e 29 7b 69 66 28 65 3d 65 7c 7c 5b 5d 2c 6e 3d 6e 7c 7c 5b 5d 2c 54 3d 72 2e 75 74 69 6c 73 2e 61 72 72 61 79 46 69 6c 74 65 72 28 6e 2c 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 28 65 2e 69 73 53 69 67 6e 65 64 49 6e 7c 7c 65 2e 69 73 57 69 6e 64 6f 77 73 53 73 6f 29 26 26 21 65 2e 69 73 4d 65 43 6f 6e 74 72 6f 6c 53 65 73 73 69 6f 6e 26 26 65 2e 69 64 7d 29 29 2c 77 3d 54 2e 6c 65 6e 67 74 68 2c 41 3d 72 2e 75 74 69 6c 73 2e 61 72 72 61 79 46 69 6c 74 65 72 28 65 2c 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 Data Ascii: .tilesState}catch(s){return}i&&"msaMeCached"===o.messageType&&(!function(e,n){if(e=e\|\|[],n=n\|\|[],T=r.utils.arrayFilter(n,(function(e){return(e.isSignedIn\|\|e.isWindowsSso)&&!e.isMeControlSession&&e.id})),w=T.length,A=r.utils.arrayFilter(e,(function(e){retu

Timestamp	kBytes transferred	Direction	Data
2023-10-19 17:19:26 UTC	731	IN	HTTP/1.1 200 OK Content-Length: 100769 Content-Type: application/javascript Last-Modified: Tue, 10 Oct 2023 21:40:56 GMT ETag: "1d9fbfd1f9e35a1" X-Cache: TCP_HIT X-Content-Type-Options: nosniff Access-Control-Allow-Origin: * X-UA-Compatible: IE=edge Strict-Transport-Security: max-age=31536000; includeSubDomains X-Azure-Ref-OriginShield: 0jfIvZQAAAAANFP8lSCjRTZOFgn22K6URU0pDMjExMDUxMjA4MDI3AGVhYzVmNDlmLWUwMmQtNGY0MS1iMGE2LTJkNTBmOWZjZjg0YQ== X-Azure-Ref: 0HWUxZQAAAAC9T2rRPEGQS6EgABHYfK/gTEFYRURHRTIxMTMAZWFjNWY0OWYtZTAyZC00ZjQxLWIwYTYtMmQ1MGY5ZmNmODRh Date: Thu, 19 Oct 2023 17:19:25 GMT Connection: close
2023-10-19 17:19:26 UTC	732	IN	Data Raw: 4d 65 43 6f 6e 74 72 6f 6c 44 65 66 69 6e 65 28 22 6d 65 43 6f 72 65 22 2c 5b 22 65 78 70 6f 72 74 73 22 2c 22 40 6d 65 63 6f 6e 74 72 6f 6c 2f 77 65 62 2d 69 6e 6c 69 6e 65 22 2c 22 40 6d 65 63 6f 6e 74 72 6f 6c 2f 77 65 62 2d 62 6f 6f 74 22 5d 2c 66 75 6e 63 74 69 6f 6e 28 65 2c 66 2c 68 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 72 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 72 65 74 75 72 6e 28 72 3d 4f 62 6a 65 63 74 2e 73 65 74 50 72 6f 74 6f 74 79 70 65 4f 66 7c 7c 7b 5f 5f 70 72 6f 74 6f 5f 5f 3a 5b 5d 7d 69 6e 73 74 61 6e 63 65 6f 66 20 41 72 72 61 79 26 26 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 65 2e 5f 5f 70 72 6f 74 6f 5f 5f 3d 74 7d 7c 7c 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 66 6f 72 28 76 61 72 20 6e 20 69 6e 20 74 29 Data Ascii: MeControlDefine("meCore",["exports","@mecontrol/web-inline","@mecontrol/web-boot"],function(e,f,h){"use strict";var r=function(e,t){return(r=Object.setPrototypeOf\|\|{__proto__:[]}instanceof Array&&function(e,t){e.__proto__=t}\|\|function(e,t){for(var n in t)
2023-10-19 17:19:26 UTC	747	IN	Data Raw: 6f 6c 6c 48 61 6e 64 6c 65 72 3d 68 2e 64 65 62 6f 75 6e 63 65 28 74 2e 65 78 70 61 6e 64 65 64 53 63 72 6f 6c 6c 48 61 6e 64 6c 65 72 2e 62 69 6e 64 28 74 29 29 2c 74 2e 73 74 61 74 65 3d 7b 65 78 70 61 6e 64 65 64 3a 21 31 7d 2c 74 7d 66 75 6e 63 74 69 6f 6e 20 24 28 65 2c 74 2c 6e 29 7b 76 61 72 20 72 3d 6e 65 77 20 66 2e 53 79 6e 74 68 65 74 69 63 45 76 65 6e 74 28 22 63 6f 6d 6d 61 6e 64 63 6c 69 63 6b 22 2c 7b 63 6f 6d 6d 61 6e 64 49 64 3a 74 2e 69 64 2c 63 75 72 72 65 6e 74 41 63 63 6f 75 6e 74 3a 6e 7d 29 2c 6f 3d 66 2e 67 65 74 4f 70 74 69 6f 6e 73 28 29 3b 6f 26 26 28 6f 2e 73 79 6e 74 68 65 74 69 63 45 76 65 6e 74 54 61 72 67 65 74 2e 64 69 73 70 61 74 63 68 45 76 65 6e 74 28 72 29 7c 7c 65 2e 70 72 65 76 65 6e 74 44 65 66 61 75 6c 74 28 29 29 Data Ascii: ollHandler=h.debounce(t.expandedScrollHandler.bind(t)),t.state={expanded:!1},t}function $(e,t,n){var r=new f.SyntheticEvent("commandclick",{commandId:t.id,currentAccount:n}),o=f.getOptions();o&&(o.syntheticEventTarget.dispatchEvent(r)\|\|e.preventDefault())
2023-10-19 17:19:26 UTC	763	IN	Data Raw: 28 65 2e 63 6f 6e 74 65 6e 74 29 3b 72 65 74 75 72 6e 7b 70 61 72 74 41 3a 6e 2c 70 61 72 74 42 3a 7b 76 65 72 3a 22 31 2e 30 22 2c 69 6d 70 72 65 73 73 69 6f 6e 47 75 69 64 3a 74 2e 69 6d 70 72 65 73 73 69 6f 6e 47 75 69 64 2c 6d 61 72 6b 65 74 3a 66 2e 4d 45 2e 43 6f 6e 66 69 67 2e 6d 6b 74 2c 70 61 67 65 54 61 67 73 3a 4a 53 4f 4e 2e 73 74 72 69 6e 67 69 66 79 28 66 2e 67 65 74 50 61 67 65 54 61 67 73 28 74 2e 61 63 63 6f 75 6e 74 73 2e 63 6f 75 6e 74 73 2c 74 2e 61 63 63 6f 75 6e 74 73 2e 63 75 72 72 65 6e 74 29 29 2c 63 6f 6e 74 65 6e 74 56 65 72 3a 22 32 2e 30 22 2c 63 6f 6e 74 65 6e 74 3a 22 5b 22 2b 72 2b 22 5d 22 7d 2c 70 61 72 74 43 3a 7b 62 61 73 65 54 79 70 65 3a 46 65 2c 70 61 67 65 4c 6f 61 64 54 69 6d 65 3a 4d 61 74 68 2e 72 6f 75 6e 64 28 Data Ascii: (e.content);return{partA:n,partB:{ver:"1.0",impressionGuid:t.impressionGuid,market:f.ME.Config.mkt,pageTags:JSON.stringify(f.getPageTags(t.accounts.counts,t.accounts.current)),contentVer:"2.0",content:"["+r+"]"},partC:{baseType:Fe,pageLoadTime:Math.round(
2023-10-19 17:19:26 UTC	779	IN	Data Raw: 63 6f 6c 6f 72 5c 78 33 61 5c 78 32 33 66 66 66 5c 78 32 31 69 6d 70 6f 72 74 61 6e 74 5c 78 33 62 6f 75 74 6c 69 6e 65 2d 63 6f 6c 6f 72 5c 78 33 61 5c 78 32 33 66 66 66 5c 78 32 31 69 6d 70 6f 72 74 61 6e 74 5c 78 33 62 66 69 6c 6c 5c 78 33 61 5c 78 32 33 66 66 66 5c 78 32 31 69 6d 70 6f 72 74 61 6e 74 5c 78 33 62 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 5c 78 33 61 70 75 72 70 6c 65 5c 78 37 64 2e 6d 65 63 74 72 6c 5f 74 68 65 6d 65 5f 61 7a 75 72 65 5f 68 63 6c 69 67 68 74 20 2e 6d 65 63 74 72 6c 5f 63 75 72 72 65 6e 74 41 63 63 6f 75 6e 74 20 61 2e 6d 65 63 74 72 6c 5f 73 69 67 6e 6f 75 74 5c 78 33 61 61 63 74 69 76 65 5c 78 37 62 2d 6d 73 2d 68 69 67 68 2d 63 6f 6e 74 72 61 73 74 2d 61 64 6a 75 73 74 5c 78 33 61 6e 6f 6e 65 5c 78 33 62 63 6f Data Ascii: color\x3a\x23fff\x21important\x3boutline-color\x3a\x23fff\x21important\x3bfill\x3a\x23fff\x21important\x3bbackground-color\x3apurple\x7d.mectrl_theme_azure_hclight .mectrl_currentAccount a.mectrl_signout\x3aactive\x7b-ms-high-contrast-adjust\x3anone\x3bco
2023-10-19 17:19:26 UTC	795	IN	Data Raw: 2d 62 6c 61 63 6b 5c 78 32 39 5c 78 37 62 2e 6d 65 63 74 72 6c 5f 6d 65 6e 75 20 75 6c 20 6c 69 20 61 2c 2e 6d 65 63 74 72 6c 5f 6d 65 6e 75 20 75 6c 20 6c 69 20 62 75 74 74 6f 6e 5c 78 37 62 62 6f 72 64 65 72 5c 78 33 61 73 6f 6c 69 64 20 31 70 78 5c 78 37 64 5c 78 37 64 2e 6d 65 63 74 72 6c 5f 6d 65 6e 75 2e 66 69 78 65 64 2d 6d 65 6e 75 20 75 6c 5c 78 37 62 70 6f 73 69 74 69 6f 6e 5c 78 33 61 66 69 78 65 64 5c 78 37 64 2e 6d 65 63 74 72 6c 5f 6d 65 6e 75 20 75 6c 5c 78 37 62 63 6f 6c 6f 72 5c 78 33 61 5c 78 32 33 33 33 33 5c 78 32 31 69 6d 70 6f 72 74 61 6e 74 5c 78 33 62 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 5c 78 33 61 5c 78 32 33 66 66 66 5c 78 32 31 69 6d 70 6f 72 74 61 6e 74 5c 78 37 64 2e 6d 65 63 74 72 6c 5f 6d 65 6e 75 20 75 6c 20 61 Data Ascii: -black\x29\x7b.mectrl_menu ul li a,.mectrl_menu ul li button\x7bborder\x3asolid 1px\x7d\x7d.mectrl_menu.fixed-menu ul\x7bposition\x3afixed\x7d.mectrl_menu ul\x7bcolor\x3a\x23333\x21important\x3bbackground-color\x3a\x23fff\x21important\x7d.mectrl_menu ul a
2023-10-19 17:19:26 UTC	811	IN	Data Raw: 61 68 6f 76 65 72 20 2e 70 72 69 6d 61 72 79 41 63 74 69 6f 6e 2e 73 69 67 6e 49 6e 5c 78 37 62 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 5c 78 33 61 5c 78 32 33 30 66 66 5c 78 37 64 5c 78 37 64 5c 78 34 30 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 5c 78 32 38 2d 6d 73 2d 68 69 67 68 2d 63 6f 6e 74 72 61 73 74 5c 78 33 61 62 6c 61 63 6b 2d 6f 6e 2d 77 68 69 74 65 5c 78 32 39 5c 78 37 62 2e 6d 65 63 74 72 6c 5f 61 63 63 6f 75 6e 74 49 74 65 6d 20 2e 70 72 69 6d 61 72 79 41 63 74 69 6f 6e 2e 65 78 70 61 6e 64 65 64 2e 73 69 67 6e 49 6e 2c 2e 6d 65 63 74 72 6c 5f 61 63 63 6f 75 6e 74 49 74 65 6d 5c 78 33 61 68 6f 76 65 72 20 2e 70 72 69 6d 61 72 79 41 63 74 69 6f 6e 2e 73 69 67 6e 49 6e 5c 78 37 62 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f Data Ascii: ahover .primaryAction.signIn\x7bbackground-color\x3a\x230ff\x7d\x7d\x40media screen and \x28-ms-high-contrast\x3ablack-on-white\x29\x7b.mectrl_accountItem .primaryAction.expanded.signIn,.mectrl_accountItem\x3ahover .primaryAction.signIn\x7bbackground-colo
2023-10-19 17:19:26 UTC	827	IN	Data Raw: 65 6d 65 5f 61 7a 75 72 65 5f 68 63 6c 69 67 68 74 20 2e 6d 65 63 74 72 6c 5f 61 63 63 6f 75 6e 74 41 63 74 69 6f 6e 73 20 2e 6d 65 63 74 72 6c 5f 74 72 69 67 67 65 72 2e 65 78 70 61 6e 64 65 64 2c 2e 6d 65 63 74 72 6c 5f 74 68 65 6d 65 5f 61 7a 75 72 65 5f 68 63 6c 69 67 68 74 20 2e 6d 65 63 74 72 6c 5f 61 63 63 6f 75 6e 74 41 63 74 69 6f 6e 73 20 2e 6d 65 63 74 72 6c 5f 74 72 69 67 67 65 72 5c 78 33 61 68 6f 76 65 72 5c 78 37 62 2d 6d 73 2d 68 69 67 68 2d 63 6f 6e 74 72 61 73 74 2d 61 64 6a 75 73 74 5c 78 33 61 6e 6f 6e 65 5c 78 33 62 63 6f 6c 6f 72 5c 78 33 61 5c 78 32 33 66 66 66 5c 78 32 31 69 6d 70 6f 72 74 61 6e 74 5c 78 33 62 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 5c 78 33 61 5c 78 32 33 66 66 66 5c 78 32 31 69 6d 70 6f 72 74 61 6e 74 5c 78 33 62 6f Data Ascii: eme_azure_hclight .mectrl_accountActions .mectrl_trigger.expanded,.mectrl_theme_azure_hclight .mectrl_accountActions .mectrl_trigger\x3ahover\x7b-ms-high-contrast-adjust\x3anone\x3bcolor\x3a\x23fff\x21important\x3bborder-color\x3a\x23fff\x21important\x3bo

Timestamp	kBytes transferred	Direction	Data
2023-10-19 17:18:54 UTC	2	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=utf-8 Access-Control-Allow-Origin: https://www.google.com Access-Control-Allow-Credentials: true X-Content-Type-Options: nosniff Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 19 Oct 2023 17:18:54 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factor=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: script-src 'report-sample' 'nonce-B7oyFz5JYNf8waugrPIzqg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/IdentityListAccountsHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/IdentityListAccountsHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/IdentityListAccountsHttp/cspreport Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2023-10-19 17:18:54 UTC	4	IN	Data Raw: 31 31 0d 0a 5b 22 67 61 69 61 2e 6c 2e 61 2e 72 22 2c 5b 5d 5d 0d 0a Data Ascii: 11["gaia.l.a.r",[]]
2023-10-19 17:18:54 UTC	4	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	kBytes transferred	Direction	Data
2023-10-19 17:19:27 UTC	830	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 57 66 59 50 35 62 62 77 52 55 75 76 79 58 62 2f 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 33 66 39 66 35 62 65 32 66 31 34 31 39 65 37 30 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: WfYP5bbwRUuvyXb/.1Context: 3f9f5be2f1419e70
2023-10-19 17:19:27 UTC	830	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2023-10-19 17:19:27 UTC	830	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 34 31 0d 0a 4d 53 2d 43 56 3a 20 57 66 59 50 35 62 62 77 52 55 75 76 79 58 62 2f 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 33 66 39 66 35 62 65 32 66 31 34 31 39 65 37 30 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 6f 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 56 38 62 41 64 32 4c 4f 37 69 74 76 56 6e 47 43 54 79 58 52 31 55 4f 70 51 52 35 34 32 57 72 63 4e 42 6e 72 34 56 31 4d 73 4a 4d 46 69 33 4d 62 4d 6b 70 72 4a 5a 43 4e 75 70 7a 39 63 44 47 53 64 2b 4a 4b 4a 46 59 56 77 78 6d 72 4e 76 72 47 56 4a 68 31 67 32 65 48 6c 53 51 5a 74 38 4f 38 4e 68 6e 47 72 41 70 63 35 64 49 57 4e Data Ascii: ATH 2 CON\DEVICE 1041MS-CV: WfYP5bbwRUuvyXb/.2Context: 3f9f5be2f1419e70<device><compact-ticket>t=EwCoAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAV8bAd2LO7itvVnGCTyXR1UOpQR542WrcNBnr4V1MsJMFi3MbMkprJZCNupz9cDGSd+JKJFYVwxmrNvrGVJh1g2eHlSQZt8O8NhnGrApc5dIWN
2023-10-19 17:19:27 UTC	831	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 57 66 59 50 35 62 62 77 52 55 75 76 79 58 62 2f 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 33 66 39 66 35 62 65 32 66 31 34 31 39 65 37 30 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: WfYP5bbwRUuvyXb/.3Context: 3f9f5be2f1419e70<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2023-10-19 17:19:27 UTC	832	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2023-10-19 17:19:27 UTC	832	IN	Data Raw: 4d 53 2d 43 56 3a 20 6e 42 78 37 75 48 57 68 32 30 47 76 33 75 47 45 65 6d 50 43 50 67 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: nBx7uHWh20Gv3uGEemPCPg.0Payload parsing failed.

Timestamp	kBytes transferred	Direction	Data
2023-10-19 17:19:28 UTC	832	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=31536000 Content-Length: 6052 Content-Type: application/x-javascript Content-Encoding: gzip Content-MD5: EC/AZqKpiZ1MEVsUV5vy5w== Last-Modified: Thu, 07 Sep 2023 05:42:23 GMT ETag: 0x8DBAF65363F805B X-Cache: TCP_HIT x-ms-request-id: 5c7739ef-d01e-0006-5f8d-fdcd7f000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * X-Azure-Ref-OriginShield: 0t10xZQAAAABWXeIkaFOTQ4y0dRm/kdmMU0pDMjExMDUxMjA4MDUzAGRiNjYyZmUzLWY0MzgtNDNjMi1hMjlmLWU2NTkwYzRmNWU1MQ== X-Azure-Ref: 0IGUxZQAAAAAbQCzpZEcSR59gTLCWWl42TEFYRURHRTIxMDcAZGI2NjJmZTMtZjQzOC00M2MyLWEyOWYtZTY1OTBjNGY1ZTUx Date: Thu, 19 Oct 2023 17:19:28 GMT Connection: close
2023-10-19 17:19:28 UTC	833	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 a5 3b 6b 77 d3 ba b2 7f a5 f5 ea 02 fb c6 0d 49 d9 6c c0 a9 e1 b6 a5 1c 0a 85 02 2d 8f bd 4b 4f 96 2c 2b 89 5b c7 0e b6 d3 c7 0e b9 bf fd ce 8c 24 5b 76 1c e0 dc fb 01 2a 8f a4 d1 68 5e 9a 19 29 a3 79 c2 8b 28 4d 36 86 93 5b 9b 39 8b 4c 14 f3 2c d9 60 cf 8b 6c 2e 3c e6 fb bd 1f 3f e0 ff 11 8b 73 41 2d cb 5a 8e ca 39 2f e6 36 73 83 72 96 c4 f1 9c 79 81 31 e6 b5 89 76 23 4a f2 82 25 5c a4 a3 8d bd 2c 63 77 c6 c0 fd 17 c6 48 4b c3 ad ee 70 f4 b7 5d dc cd 70 0a 73 91 2c c7 98 f4 d2 98 a3 07 01 91 79 91 45 c9 d8 24 75 ff d0 18 29 09 bd 77 8f a6 df bb c7 36 6b db 82 c9 27 d9 0b 31 62 f3 b8 a8 ef 8f 90 34 f6 b7 f7 10 11 47 23 7b 93 b0 39 7a 03 d6 00 60 ac 1b b3 bc 38 4a 42 71 7b 32 b2 ad ae e5 ec f6 8c 11 9a 2d dd 22 3d 4e 6f 44 76 Data Ascii: ;kwIl-KO,+[$[v*h^)y(M6[9L,`l.<?sA-Z9/6sry1v#J%\,cwHKp]ps,yE$u)w6k'1b4G#{9z`8JBq{2-"=NoDv

Timestamp	kBytes transferred	Direction	Data
2023-10-19 17:19:48 UTC	839	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=o6fWca8PpRg8zp9&MD=a3lpZKhl HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2023-10-19 17:19:48 UTC	839	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "Mx1RoJH/qEwpWfKllx7sbsl28AuERz5IYdcsvtTJcgM=_2160" MS-CorrelationId: d6fba549-67b1-4238-acb4-635ccd835972 MS-RequestId: 0d223797-2a49-4a59-952d-4dd4641a8668 MS-CV: X+WNzgsOAUSgSIqp.0 X-Microsoft-SLSClientCache: 2160 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Thu, 19 Oct 2023 17:19:47 GMT Connection: close Content-Length: 25457
2023-10-19 17:19:48 UTC	840	IN	Data Raw: 4d 53 43 46 00 00 00 00 51 22 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 db 8e 00 00 14 00 00 00 00 00 10 00 51 22 00 00 20 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 f3 43 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 0d 92 6f db e5 21 f3 43 43 4b ed 5a 09 38 55 5b df 3f 93 99 90 29 99 e7 29 ec 73 cc 4a 66 32 cf 84 32 64 c8 31 c7 11 52 38 87 90 42 66 09 99 87 32 0f 19 0a 09 51 a6 a8 08 29 53 86 4a 52 84 50 df 46 83 ba dd 7b df fb 7e ef 7d ee 7d bf ef 9e e7 d9 67 ef 35 ee b5 fe eb 3f ff b6 96 81 a2 0a 04 fc 31 40 21 5b 3f a5 ed 1b 04 0e 85 42 a0 10 04 64 12 6c a5 de aa a1 d8 ea f3 58 01 f2 f5 67 0b 5e 9b bd e8 a0 90 1d bf 40 88 9d eb 49 b4 87 9b ab 8b 9d 2b 46 c8 c7 c5 19 92 Data Ascii: MSCFQ"DQ" AdCenvironment.cabo!CCKZ8U[?))sJf22d1R8Bf2Q)SJRPF{~}}g5?1@![?BdlXg^@I+F
2023-10-19 17:19:48 UTC	855	IN	Data Raw: 21 6f b3 eb a6 cc f5 31 be cf 05 e2 a9 fe fa 57 6d 19 30 b3 c2 c5 66 c9 6a df f5 e7 f0 78 bd c7 a8 9e 25 e3 f9 bc ed 6b 54 57 08 2b 51 82 44 12 fb b9 53 8c cc f4 60 12 8a 76 cc 40 40 41 9b dc 5c 17 ff 5c f9 5e 17 35 98 24 56 4b 74 ef 42 10 c8 af bf 7f c6 7f f2 37 7d 5a 3f 1c f2 99 79 4a 91 52 00 af 38 0f 17 f5 2f 79 81 65 d9 a9 b5 6b e4 c7 ce f6 ca 7a 00 6f 4b 30 44 24 22 3c cf ed 03 a5 96 8f 59 29 bc b6 fd 04 e1 70 9f 32 4a 27 fd 55 af 2f fe b6 e5 8e 33 bb 62 5f 9a db 57 40 e9 f1 ce 99 66 90 8c ff 6a 62 7f dd c5 4a 0b 91 26 e2 39 ec 19 4a 71 63 9d 7b 21 6d c3 9c a3 a2 3c fa 7f 7d 96 6a 90 78 a6 6d d2 e1 9c f9 1d fc 38 d8 94 f4 c6 a5 0a 96 86 a4 bd 9e 1a ae 04 42 83 b8 b5 80 9b 22 38 20 b5 25 e5 64 ec f7 f4 bf 7e 63 59 25 0f 7a 2e 39 57 76 a2 71 aa 06 8a Data Ascii: !o1Wm0fjx%kTW+QDS`v@@A\\^5$VKtB7}Z?yJR8/yekzoK0D$"<Y)p2J'U/3b_W@fjbJ&9Jqc{!m<}jxm8B"8 %d~cY%z.9Wvq

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://aka.ms/LearnAboutSenderIdentification

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

Phishing

Compliance

Networking

System Summary

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Chrome Cache Entry: 105

Chrome Cache Entry: 106

Chrome Cache Entry: 107

Chrome Cache Entry: 108

Chrome Cache Entry: 109

Chrome Cache Entry: 110

Chrome Cache Entry: 111

Chrome Cache Entry: 112

Chrome Cache Entry: 113

Chrome Cache Entry: 114

Chrome Cache Entry: 115

Chrome Cache Entry: 116

Chrome Cache Entry: 117

Chrome Cache Entry: 118

Chrome Cache Entry: 119

Chrome Cache Entry: 120

Chrome Cache Entry: 121

Chrome Cache Entry: 122

Chrome Cache Entry: 123

Chrome Cache Entry: 124

Chrome Cache Entry: 125

Chrome Cache Entry: 126

Chrome Cache Entry: 127

Chrome Cache Entry: 128

Chrome Cache Entry: 129

Chrome Cache Entry: 130

Chrome Cache Entry: 131

Chrome Cache Entry: 132

Chrome Cache Entry: 133

Windows Analysis Report
https://aka.ms/LearnAboutSenderIdentification

Timestamp	kBytes transferred	Direction	Data
2023-10-19 17:19:54 UTC	865	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 4e 76 48 31 44 6c 32 37 78 45 79 66 66 31 31 56 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 66 38 66 36 33 66 33 65 62 35 38 36 66 64 63 65 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: NvH1Dl27xEyff11V.1Context: f8f63f3eb586fdce
2023-10-19 17:19:54 UTC	865	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2023-10-19 17:19:54 UTC	865	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 34 31 0d 0a 4d 53 2d 43 56 3a 20 4e 76 48 31 44 6c 32 37 78 45 79 66 66 31 31 56 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 66 38 66 36 33 66 33 65 62 35 38 36 66 64 63 65 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 6f 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 56 38 62 41 64 32 4c 4f 37 69 74 76 56 6e 47 43 54 79 58 52 31 55 4f 70 51 52 35 34 32 57 72 63 4e 42 6e 72 34 56 31 4d 73 4a 4d 46 69 33 4d 62 4d 6b 70 72 4a 5a 43 4e 75 70 7a 39 63 44 47 53 64 2b 4a 4b 4a 46 59 56 77 78 6d 72 4e 76 72 47 56 4a 68 31 67 32 65 48 6c 53 51 5a 74 38 4f 38 4e 68 6e 47 72 41 70 63 35 64 49 57 4e Data Ascii: ATH 2 CON\DEVICE 1041MS-CV: NvH1Dl27xEyff11V.2Context: f8f63f3eb586fdce<device><compact-ticket>t=EwCoAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAV8bAd2LO7itvVnGCTyXR1UOpQR542WrcNBnr4V1MsJMFi3MbMkprJZCNupz9cDGSd+JKJFYVwxmrNvrGVJh1g2eHlSQZt8O8NhnGrApc5dIWN
2023-10-19 17:19:54 UTC	866	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 4e 76 48 31 44 6c 32 37 78 45 79 66 66 31 31 56 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 66 38 66 36 33 66 33 65 62 35 38 36 66 64 63 65 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: NvH1Dl27xEyff11V.3Context: f8f63f3eb586fdce<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2023-10-19 17:19:54 UTC	866	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2023-10-19 17:19:54 UTC	866	IN	Data Raw: 4d 53 2d 43 56 3a 20 54 68 35 38 71 33 69 70 53 55 75 65 69 52 33 38 77 6b 31 43 53 41 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: Th58q3ipSUueiR38wk1CSA.0Payload parsing failed.

Timestamp	kBytes transferred	Direction	Data
2023-10-19 17:19:57 UTC	867	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 34 0d 0a 4d 53 2d 43 56 3a 20 6c 72 70 6d 79 4d 55 4c 52 45 6d 61 4c 63 42 48 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 66 66 66 34 31 65 66 35 31 61 32 31 37 39 66 0d 0a 0d 0a Data Ascii: CNT 1 CON 304MS-CV: lrpmyMULREmaLcBH.1Context: fff41ef51a2179f
2023-10-19 17:19:57 UTC	867	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2023-10-19 17:19:57 UTC	867	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 34 30 0d 0a 4d 53 2d 43 56 3a 20 6c 72 70 6d 79 4d 55 4c 52 45 6d 61 4c 63 42 48 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 66 66 66 34 31 65 66 35 31 61 32 31 37 39 66 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 6f 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 56 38 62 41 64 32 4c 4f 37 69 74 76 56 6e 47 43 54 79 58 52 31 55 4f 70 51 52 35 34 32 57 72 63 4e 42 6e 72 34 56 31 4d 73 4a 4d 46 69 33 4d 62 4d 6b 70 72 4a 5a 43 4e 75 70 7a 39 63 44 47 53 64 2b 4a 4b 4a 46 59 56 77 78 6d 72 4e 76 72 47 56 4a 68 31 67 32 65 48 6c 53 51 5a 74 38 4f 38 4e 68 6e 47 72 41 70 63 35 64 49 57 4e 30 Data Ascii: ATH 2 CON\DEVICE 1040MS-CV: lrpmyMULREmaLcBH.2Context: fff41ef51a2179f<device><compact-ticket>t=EwCoAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAV8bAd2LO7itvVnGCTyXR1UOpQR542WrcNBnr4V1MsJMFi3MbMkprJZCNupz9cDGSd+JKJFYVwxmrNvrGVJh1g2eHlSQZt8O8NhnGrApc5dIWN0
2023-10-19 17:19:57 UTC	868	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 36 0d 0a 4d 53 2d 43 56 3a 20 6c 72 70 6d 79 4d 55 4c 52 45 6d 61 4c 63 42 48 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 66 66 66 34 31 65 66 35 31 61 32 31 37 39 66 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 196MS-CV: lrpmyMULREmaLcBH.3Context: fff41ef51a2179f<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2023-10-19 17:19:57 UTC	868	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2023-10-19 17:19:57 UTC	868	IN	Data Raw: 4d 53 2d 43 56 3a 20 36 6a 51 4f 67 77 35 67 57 55 4f 56 6f 55 63 66 75 35 32 72 38 51 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: 6jQOgw5gWUOVoUcfu52r8Q.0Payload parsing failed.

Timestamp	kBytes transferred	Direction	Data
2023-10-19 17:20:23 UTC	869	IN	HTTP/1.1 200 OK Content-Security-Policy: script-src 'report-sample' 'nonce-z8Aex9lJptlxVg_jwSBLBg' 'unsafe-inline' 'strict-dynamic' https: http:;object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/download-dt/1 Content-Security-Policy: script-src 'report-sample' 'nonce-46H-Y5HMtBrYtxC4zZKDgQ' 'unsafe-inline' 'strict-dynamic' https: http:;object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/download-dt/1 Content-Type: text/plain; charset=utf-8 Content-Length: 220 Date: Thu, 19 Oct 2023 17:20:22 GMT Expires: Thu, 19 Oct 2023 17:20:22 GMT Cache-Control: private, max-age=0 X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block Server: GSE Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2023-10-19 17:20:23 UTC	869	IN	Data Raw: 72 6c 7a 43 31 3a 20 31 43 31 4f 4e 47 52 5f 65 6e 55 53 31 30 38 30 0a 72 6c 7a 43 32 3a 20 31 43 32 4f 4e 47 52 5f 65 6e 55 53 31 30 38 30 0a 72 6c 7a 43 37 3a 20 31 43 37 4f 4e 47 52 5f 65 6e 55 53 31 30 38 30 0a 64 63 63 3a 20 0a 73 65 74 5f 64 63 63 3a 20 43 31 3a 31 43 31 4f 4e 47 52 5f 65 6e 55 53 31 30 38 30 2c 43 32 3a 31 43 32 4f 4e 47 52 5f 65 6e 55 53 31 30 38 30 2c 43 37 3a 31 43 37 4f 4e 47 52 5f 65 6e 55 53 31 30 38 30 0a 65 76 65 6e 74 73 3a 20 43 31 49 2c 43 32 49 2c 43 37 49 2c 43 31 53 2c 43 37 53 0a 73 74 61 74 65 66 75 6c 2d 65 76 65 6e 74 73 3a 20 43 31 49 2c 43 32 49 2c 43 37 49 0a 63 72 63 33 32 3a 20 33 66 38 64 62 65 38 64 0a Data Ascii: rlzC1: 1C1ONGR_enUS1080rlzC2: 1C2ONGR_enUS1080rlzC7: 1C7ONGR_enUS1080dcc: set_dcc: C1:1C1ONGR_enUS1080,C2:1C2ONGR_enUS1080,C7:1C7ONGR_enUS1080events: C1I,C2I,C7I,C1S,C7Sstateful-events: C1I,C2I,C7Icrc32: 3f8dbe8d

Timestamp	kBytes transferred	Direction	Data
2023-10-19 17:20:27 UTC	870	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 68 41 43 57 74 65 41 34 6e 6b 47 46 55 43 6f 6d 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 61 38 63 39 36 62 35 64 66 36 34 33 62 38 61 36 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: hACWteA4nkGFUCom.1Context: a8c96b5df643b8a6
2023-10-19 17:20:27 UTC	870	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2023-10-19 17:20:27 UTC	870	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 34 31 0d 0a 4d 53 2d 43 56 3a 20 68 41 43 57 74 65 41 34 6e 6b 47 46 55 43 6f 6d 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 61 38 63 39 36 62 35 64 66 36 34 33 62 38 61 36 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 6f 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 56 38 62 41 64 32 4c 4f 37 69 74 76 56 6e 47 43 54 79 58 52 31 55 4f 70 51 52 35 34 32 57 72 63 4e 42 6e 72 34 56 31 4d 73 4a 4d 46 69 33 4d 62 4d 6b 70 72 4a 5a 43 4e 75 70 7a 39 63 44 47 53 64 2b 4a 4b 4a 46 59 56 77 78 6d 72 4e 76 72 47 56 4a 68 31 67 32 65 48 6c 53 51 5a 74 38 4f 38 4e 68 6e 47 72 41 70 63 35 64 49 57 4e Data Ascii: ATH 2 CON\DEVICE 1041MS-CV: hACWteA4nkGFUCom.2Context: a8c96b5df643b8a6<device><compact-ticket>t=EwCoAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAV8bAd2LO7itvVnGCTyXR1UOpQR542WrcNBnr4V1MsJMFi3MbMkprJZCNupz9cDGSd+JKJFYVwxmrNvrGVJh1g2eHlSQZt8O8NhnGrApc5dIWN
2023-10-19 17:20:27 UTC	871	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 68 41 43 57 74 65 41 34 6e 6b 47 46 55 43 6f 6d 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 61 38 63 39 36 62 35 64 66 36 34 33 62 38 61 36 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: hACWteA4nkGFUCom.3Context: a8c96b5df643b8a6<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2023-10-19 17:20:27 UTC	871	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2023-10-19 17:20:27 UTC	871	IN	Data Raw: 4d 53 2d 43 56 3a 20 71 73 43 4c 37 6e 42 6b 6c 45 47 69 70 55 70 49 2b 53 53 37 72 77 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: qsCL7nBklEGipUpI+SS7rw.0Payload parsing failed.

Timestamp	kBytes transferred	Direction	Data
2023-10-19 17:18:57 UTC	5	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 33 4e 4e 4d 78 2b 79 45 35 45 32 2f 78 6c 30 78 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 65 35 36 39 30 30 66 39 36 63 30 32 65 65 65 33 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: 3NNMx+yE5E2/xl0x.1Context: e56900f96c02eee3
2023-10-19 17:18:57 UTC	5	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2023-10-19 17:18:57 UTC	5	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 34 31 0d 0a 4d 53 2d 43 56 3a 20 33 4e 4e 4d 78 2b 79 45 35 45 32 2f 78 6c 30 78 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 65 35 36 39 30 30 66 39 36 63 30 32 65 65 65 33 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 6f 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 56 38 62 41 64 32 4c 4f 37 69 74 76 56 6e 47 43 54 79 58 52 31 55 4f 70 51 52 35 34 32 57 72 63 4e 42 6e 72 34 56 31 4d 73 4a 4d 46 69 33 4d 62 4d 6b 70 72 4a 5a 43 4e 75 70 7a 39 63 44 47 53 64 2b 4a 4b 4a 46 59 56 77 78 6d 72 4e 76 72 47 56 4a 68 31 67 32 65 48 6c 53 51 5a 74 38 4f 38 4e 68 6e 47 72 41 70 63 35 64 49 57 4e Data Ascii: ATH 2 CON\DEVICE 1041MS-CV: 3NNMx+yE5E2/xl0x.2Context: e56900f96c02eee3<device><compact-ticket>t=EwCoAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAV8bAd2LO7itvVnGCTyXR1UOpQR542WrcNBnr4V1MsJMFi3MbMkprJZCNupz9cDGSd+JKJFYVwxmrNvrGVJh1g2eHlSQZt8O8NhnGrApc5dIWN
2023-10-19 17:18:57 UTC	6	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 33 4e 4e 4d 78 2b 79 45 35 45 32 2f 78 6c 30 78 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 65 35 36 39 30 30 66 39 36 63 30 32 65 65 65 33 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: 3NNMx+yE5E2/xl0x.3Context: e56900f96c02eee3<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2023-10-19 17:18:57 UTC	7	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2023-10-19 17:18:57 UTC	7	IN	Data Raw: 4d 53 2d 43 56 3a 20 6a 4c 43 7a 2b 32 6b 58 78 30 79 63 35 38 31 6c 51 36 58 4c 50 67 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: jLCz+2kXx0yc581lQ6XLPg.0Payload parsing failed.

Timestamp	kBytes transferred	Direction	Data
2023-10-19 17:18:59 UTC	8	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2023-10-19 17:18:59 UTC	8	IN	HTTP/1.1 200 OK ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: Kestrel X-CID: 11 Cache-Control: public, max-age=71976 Date: Thu, 19 Oct 2023 17:18:59 GMT Connection: close X-CID: 2

Target ID:	0
Start time:	19:18:49
Start date:	19/10/2023
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Target ID:	2
Start time:	19:18:50
Start date:	19/10/2023
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2044 --field-trial-handle=1996,i,15038716698156192417,8028089534391016875,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Target ID:	3
Start time:	19:18:54
Start date:	19/10/2023
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	C:\Program Files\Google\Chrome\Application\chrome.exe" "https://aka.ms/LearnAboutSenderIdentification
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Description:	Adversaries may gain access to a system through a user visiting a website over the normal course of browsing. With this technique, the user's web browser is typically targeted for exploitation, but adversaries may also use compromised websites for non-exploitation behavior such as acquiring Application Access Token .
Tactics:	Initial Access
Data Sources:	Network device logs, Network intrusion detection system, Packet capture, Process use of network, SSL/TLS inspection, Web proxy
Platforms:	Linux, macOS, SaaS, Windows
Url:	Open detailed description by Mitre