Edit tour

Windows Analysis Report
http://securityupdatehub-my.sharepoint.com

Overview

General Information

Sample URL:	http://securityupdatehub-my.sharepoint.com
Analysis ID:	1579320
Infos:

Detection

Score:	1
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Detected suspicious crossdomain redirect

HTML body contains low number of good links

HTML title does not match URL

Classification

Process Tree

System is w10x64

chrome.exe (PID: 1860 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 5552 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2136 --field-trial-handle=1988,i,7594917267722297499,11007387598272349058,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6496 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "http://securityupdatehub-my.sharepoint.com" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: https://login.microsoftonline.com/9b82a082-52f4-44b9-a6c9-d3d75128b78b/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&scope=openid&nonce=ADE0690D93F719CF918CBB9C521182130797FDF54A0F08A1%2D03C14ECC01D987DB2D5375F0F48E93B6E757EE95005239FAA6916A25FD464BF3&redirect%5Furi=https%3A%2F%2Fsecurityupdatehub%2Dmy%2Esharepoint%2Ecom%2F%5Fforms%2Fdefault%2Easpx&state=OD0w&claims=%7B%22id%5Ftoken%22%3A%7B%22xms%5Fcc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&wsucxt=1&cobrandid=11bd8083%2D87e0%2D41b5%2Dbb78%2D0bc43c8a8e8a&client%2Drequest%2Did=4cbd6fa1%2D7032%2D7000%2D734f%2D6c042359b170	HTTP Parser: Number of links: 0
Source: https://login.microsoftonline.com/9b82a082-52f4-44b9-a6c9-d3d75128b78b/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&scope=openid&nonce=ADE0690D93F719CF918CBB9C521182130797FDF54A0F08A1%2D03C14ECC01D987DB2D5375F0F48E93B6E757EE95005239FAA6916A25FD464BF3&redirect%5Furi=https%3A%2F%2Fsecurityupdatehub%2Dmy%2Esharepoint%2Ecom%2F%5Fforms%2Fdefault%2Easpx&state=OD0w&claims=%7B%22id%5Ftoken%22%3A%7B%22xms%5Fcc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&wsucxt=1&cobrandid=11bd8083%2D87e0%2D41b5%2Dbb78%2D0bc43c8a8e8a&client%2Drequest%2Did=4cbd6fa1%2D7032%2D7000%2D734f%2D6c042359b170&sso_reload=true	HTTP Parser: Number of links: 0

Source: https://login.microsoftonline.com/9b82a082-52f4-44b9-a6c9-d3d75128b78b/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&scope=openid&nonce=ADE0690D93F719CF918CBB9C521182130797FDF54A0F08A1%2D03C14ECC01D987DB2D5375F0F48E93B6E757EE95005239FAA6916A25FD464BF3&redirect%5Furi=https%3A%2F%2Fsecurityupdatehub%2Dmy%2Esharepoint%2Ecom%2F%5Fforms%2Fdefault%2Easpx&state=OD0w&claims=%7B%22id%5Ftoken%22%3A%7B%22xms%5Fcc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&wsucxt=1&cobrandid=11bd8083%2D87e0%2D41b5%2Dbb78%2D0bc43c8a8e8a&client%2Drequest%2Did=4cbd6fa1%2D7032%2D7000%2D734f%2D6c042359b170	HTTP Parser: Title: Redirecting does not match URL
Source: https://login.microsoftonline.com/9b82a082-52f4-44b9-a6c9-d3d75128b78b/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&scope=openid&nonce=ADE0690D93F719CF918CBB9C521182130797FDF54A0F08A1%2D03C14ECC01D987DB2D5375F0F48E93B6E757EE95005239FAA6916A25FD464BF3&redirect%5Furi=https%3A%2F%2Fsecurityupdatehub%2Dmy%2Esharepoint%2Ecom%2F%5Fforms%2Fdefault%2Easpx&state=OD0w&claims=%7B%22id%5Ftoken%22%3A%7B%22xms%5Fcc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&wsucxt=1&cobrandid=11bd8083%2D87e0%2D41b5%2Dbb78%2D0bc43c8a8e8a&client%2Drequest%2Did=4cbd6fa1%2D7032%2D7000%2D734f%2D6c042359b170&sso_reload=true	HTTP Parser: Title: Sign in to your account does not match URL

Source: https://login.microsoftonline.com/9b82a082-52f4-44b9-a6c9-d3d75128b78b/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&scope=openid&nonce=ADE0690D93F719CF918CBB9C521182130797FDF54A0F08A1%2D03C14ECC01D987DB2D5375F0F48E93B6E757EE95005239FAA6916A25FD464BF3&redirect%5Furi=https%3A%2F%2Fsecurityupdatehub%2Dmy%2Esharepoint%2Ecom%2F%5Fforms%2Fdefault%2Easpx&state=OD0w&claims=%7B%22id%5Ftoken%22%3A%7B%22xms%5Fcc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&wsucxt=1&cobrandid=11bd8083%2D87e0%2D41b5%2Dbb78%2D0bc43c8a8e8a&client%2Drequest%2Did=4cbd6fa1%2D7032%2D7000%2D734f%2D6c042359b170&sso_reload=true

HTTP Parser: <input type="password" .../> found

HTTP Parser: No favicon

Source: https://login.microsoftonline.com/9b82a082-52f4-44b9-a6c9-d3d75128b78b/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&scope=openid&nonce=ADE0690D93F719CF918CBB9C521182130797FDF54A0F08A1%2D03C14ECC01D987DB2D5375F0F48E93B6E757EE95005239FAA6916A25FD464BF3&redirect%5Furi=https%3A%2F%2Fsecurityupdatehub%2Dmy%2Esharepoint%2Ecom%2F%5Fforms%2Fdefault%2Easpx&state=OD0w&claims=%7B%22id%5Ftoken%22%3A%7B%22xms%5Fcc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&wsucxt=1&cobrandid=11bd8083%2D87e0%2D41b5%2Dbb78%2D0bc43c8a8e8a&client%2Drequest%2Did=4cbd6fa1%2D7032%2D7000%2D734f%2D6c042359b170	HTTP Parser: No <meta name="author".. found
Source: https://login.microsoftonline.com/9b82a082-52f4-44b9-a6c9-d3d75128b78b/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&scope=openid&nonce=ADE0690D93F719CF918CBB9C521182130797FDF54A0F08A1%2D03C14ECC01D987DB2D5375F0F48E93B6E757EE95005239FAA6916A25FD464BF3&redirect%5Furi=https%3A%2F%2Fsecurityupdatehub%2Dmy%2Esharepoint%2Ecom%2F%5Fforms%2Fdefault%2Easpx&state=OD0w&claims=%7B%22id%5Ftoken%22%3A%7B%22xms%5Fcc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&wsucxt=1&cobrandid=11bd8083%2D87e0%2D41b5%2Dbb78%2D0bc43c8a8e8a&client%2Drequest%2Did=4cbd6fa1%2D7032%2D7000%2D734f%2D6c042359b170&sso_reload=true	HTTP Parser: No <meta name="author".. found
Source: https://login.microsoftonline.com/9b82a082-52f4-44b9-a6c9-d3d75128b78b/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&scope=openid&nonce=ADE0690D93F719CF918CBB9C521182130797FDF54A0F08A1%2D03C14ECC01D987DB2D5375F0F48E93B6E757EE95005239FAA6916A25FD464BF3&redirect%5Furi=https%3A%2F%2Fsecurityupdatehub%2Dmy%2Esharepoint%2Ecom%2F%5Fforms%2Fdefault%2Easpx&state=OD0w&claims=%7B%22id%5Ftoken%22%3A%7B%22xms%5Fcc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&wsucxt=1&cobrandid=11bd8083%2D87e0%2D41b5%2Dbb78%2D0bc43c8a8e8a&client%2Drequest%2Did=4cbd6fa1%2D7032%2D7000%2D734f%2D6c042359b170&sso_reload=true	HTTP Parser: No <meta name="author".. found
Source: https://login.microsoftonline.com/9b82a082-52f4-44b9-a6c9-d3d75128b78b/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&scope=openid&nonce=ADE0690D93F719CF918CBB9C521182130797FDF54A0F08A1%2D03C14ECC01D987DB2D5375F0F48E93B6E757EE95005239FAA6916A25FD464BF3&redirect%5Furi=https%3A%2F%2Fsecurityupdatehub%2Dmy%2Esharepoint%2Ecom%2F%5Fforms%2Fdefault%2Easpx&state=OD0w&claims=%7B%22id%5Ftoken%22%3A%7B%22xms%5Fcc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&wsucxt=1&cobrandid=11bd8083%2D87e0%2D41b5%2Dbb78%2D0bc43c8a8e8a&client%2Drequest%2Did=4cbd6fa1%2D7032%2D7000%2D734f%2D6c042359b170&sso_reload=true	HTTP Parser: No <meta name="author".. found
Source: https://login.microsoftonline.com/9b82a082-52f4-44b9-a6c9-d3d75128b78b/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&scope=openid&nonce=ADE0690D93F719CF918CBB9C521182130797FDF54A0F08A1%2D03C14ECC01D987DB2D5375F0F48E93B6E757EE95005239FAA6916A25FD464BF3&redirect%5Furi=https%3A%2F%2Fsecurityupdatehub%2Dmy%2Esharepoint%2Ecom%2F%5Fforms%2Fdefault%2Easpx&state=OD0w&claims=%7B%22id%5Ftoken%22%3A%7B%22xms%5Fcc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&wsucxt=1&cobrandid=11bd8083%2D87e0%2D41b5%2Dbb78%2D0bc43c8a8e8a&client%2Drequest%2Did=4cbd6fa1%2D7032%2D7000%2D734f%2D6c042359b170&sso_reload=true	HTTP Parser: No <meta name="author".. found
Source: https://login.microsoftonline.com/9b82a082-52f4-44b9-a6c9-d3d75128b78b/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&scope=openid&nonce=ADE0690D93F719CF918CBB9C521182130797FDF54A0F08A1%2D03C14ECC01D987DB2D5375F0F48E93B6E757EE95005239FAA6916A25FD464BF3&redirect%5Furi=https%3A%2F%2Fsecurityupdatehub%2Dmy%2Esharepoint%2Ecom%2F%5Fforms%2Fdefault%2Easpx&state=OD0w&claims=%7B%22id%5Ftoken%22%3A%7B%22xms%5Fcc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&wsucxt=1&cobrandid=11bd8083%2D87e0%2D41b5%2Dbb78%2D0bc43c8a8e8a&client%2Drequest%2Did=4cbd6fa1%2D7032%2D7000%2D734f%2D6c042359b170&sso_reload=true	HTTP Parser: No <meta name="author".. found

Source: https://login.microsoftonline.com/9b82a082-52f4-44b9-a6c9-d3d75128b78b/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&scope=openid&nonce=ADE0690D93F719CF918CBB9C521182130797FDF54A0F08A1%2D03C14ECC01D987DB2D5375F0F48E93B6E757EE95005239FAA6916A25FD464BF3&redirect%5Furi=https%3A%2F%2Fsecurityupdatehub%2Dmy%2Esharepoint%2Ecom%2F%5Fforms%2Fdefault%2Easpx&state=OD0w&claims=%7B%22id%5Ftoken%22%3A%7B%22xms%5Fcc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&wsucxt=1&cobrandid=11bd8083%2D87e0%2D41b5%2Dbb78%2D0bc43c8a8e8a&client%2Drequest%2Did=4cbd6fa1%2D7032%2D7000%2D734f%2D6c042359b170	HTTP Parser: No <meta name="copyright".. found
Source: https://login.microsoftonline.com/9b82a082-52f4-44b9-a6c9-d3d75128b78b/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&scope=openid&nonce=ADE0690D93F719CF918CBB9C521182130797FDF54A0F08A1%2D03C14ECC01D987DB2D5375F0F48E93B6E757EE95005239FAA6916A25FD464BF3&redirect%5Furi=https%3A%2F%2Fsecurityupdatehub%2Dmy%2Esharepoint%2Ecom%2F%5Fforms%2Fdefault%2Easpx&state=OD0w&claims=%7B%22id%5Ftoken%22%3A%7B%22xms%5Fcc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&wsucxt=1&cobrandid=11bd8083%2D87e0%2D41b5%2Dbb78%2D0bc43c8a8e8a&client%2Drequest%2Did=4cbd6fa1%2D7032%2D7000%2D734f%2D6c042359b170&sso_reload=true	HTTP Parser: No <meta name="copyright".. found
Source: https://login.microsoftonline.com/9b82a082-52f4-44b9-a6c9-d3d75128b78b/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&scope=openid&nonce=ADE0690D93F719CF918CBB9C521182130797FDF54A0F08A1%2D03C14ECC01D987DB2D5375F0F48E93B6E757EE95005239FAA6916A25FD464BF3&redirect%5Furi=https%3A%2F%2Fsecurityupdatehub%2Dmy%2Esharepoint%2Ecom%2F%5Fforms%2Fdefault%2Easpx&state=OD0w&claims=%7B%22id%5Ftoken%22%3A%7B%22xms%5Fcc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&wsucxt=1&cobrandid=11bd8083%2D87e0%2D41b5%2Dbb78%2D0bc43c8a8e8a&client%2Drequest%2Did=4cbd6fa1%2D7032%2D7000%2D734f%2D6c042359b170&sso_reload=true	HTTP Parser: No <meta name="copyright".. found
Source: https://login.microsoftonline.com/9b82a082-52f4-44b9-a6c9-d3d75128b78b/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&scope=openid&nonce=ADE0690D93F719CF918CBB9C521182130797FDF54A0F08A1%2D03C14ECC01D987DB2D5375F0F48E93B6E757EE95005239FAA6916A25FD464BF3&redirect%5Furi=https%3A%2F%2Fsecurityupdatehub%2Dmy%2Esharepoint%2Ecom%2F%5Fforms%2Fdefault%2Easpx&state=OD0w&claims=%7B%22id%5Ftoken%22%3A%7B%22xms%5Fcc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&wsucxt=1&cobrandid=11bd8083%2D87e0%2D41b5%2Dbb78%2D0bc43c8a8e8a&client%2Drequest%2Did=4cbd6fa1%2D7032%2D7000%2D734f%2D6c042359b170&sso_reload=true	HTTP Parser: No <meta name="copyright".. found
Source: https://login.microsoftonline.com/9b82a082-52f4-44b9-a6c9-d3d75128b78b/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&scope=openid&nonce=ADE0690D93F719CF918CBB9C521182130797FDF54A0F08A1%2D03C14ECC01D987DB2D5375F0F48E93B6E757EE95005239FAA6916A25FD464BF3&redirect%5Furi=https%3A%2F%2Fsecurityupdatehub%2Dmy%2Esharepoint%2Ecom%2F%5Fforms%2Fdefault%2Easpx&state=OD0w&claims=%7B%22id%5Ftoken%22%3A%7B%22xms%5Fcc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&wsucxt=1&cobrandid=11bd8083%2D87e0%2D41b5%2Dbb78%2D0bc43c8a8e8a&client%2Drequest%2Did=4cbd6fa1%2D7032%2D7000%2D734f%2D6c042359b170&sso_reload=true	HTTP Parser: No <meta name="copyright".. found
Source: https://login.microsoftonline.com/9b82a082-52f4-44b9-a6c9-d3d75128b78b/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&scope=openid&nonce=ADE0690D93F719CF918CBB9C521182130797FDF54A0F08A1%2D03C14ECC01D987DB2D5375F0F48E93B6E757EE95005239FAA6916A25FD464BF3&redirect%5Furi=https%3A%2F%2Fsecurityupdatehub%2Dmy%2Esharepoint%2Ecom%2F%5Fforms%2Fdefault%2Easpx&state=OD0w&claims=%7B%22id%5Ftoken%22%3A%7B%22xms%5Fcc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&wsucxt=1&cobrandid=11bd8083%2D87e0%2D41b5%2Dbb78%2D0bc43c8a8e8a&client%2Drequest%2Did=4cbd6fa1%2D7032%2D7000%2D734f%2D6c042359b170&sso_reload=true	HTTP Parser: No <meta name="copyright".. found

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

HTTP traffic: Redirect from: securityupdatehub-my.sharepoint.com to https://login.microsoftonline.com:443/9b82a082-52f4-44b9-a6c9-d3d75128b78b/oauth2/authorize?client%5fid=00000003%2d0000%2d0ff1%2dce00%2d000000000000&response%5fmode=form%5fpost&response%5ftype=code%20id%5ftoken&resource=00000003%2d0000%2d0ff1%2dce00%2d000000000000&scope=openid&nonce=ade0690d93f719cf918cbb9c521182130797fdf54a0f08a1%2d03c14ecc01d987db2d5375f0f48e93b6e757ee95005239faa6916a25fd464bf3&redirect%5furi=https%3a%2f%2fsecurityupdatehub%2dmy%2esharepoint%2ecom%2f%5fforms%2fdefault%2easpx&state=od0w&claims=%7b%22id%5ftoken%22%3a%7b%22xms%5fcc%22%3a%7b%22values%22%3a%5b%22cp1%22%5d%7d%7d%7d&wsucxt=1&cobrandid=11bd8083%2d87e0%2d41b5%2dbb78%2d0bc43c8a8e8a&client%2drequest%2did=4cbd6fa1%2d7032%2d7000%2d734f%2d6c042359b170

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 2.22.50.144
Source: unknown	TCP traffic detected without corresponding DNS query: 2.22.50.144
Source: unknown	TCP traffic detected without corresponding DNS query: 23.32.238.18
Source: unknown	TCP traffic detected without corresponding DNS query: 23.32.238.18
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: securityupdatehub-my.sharepoint.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_layouts/15/authenticate.aspx?Source=%2F HTTP/1.1Host: securityupdatehub-my.sharepoint.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_forms/default.aspx?ReturnUrl=%2f_layouts%2f15%2fauthenticate.aspx%3fSource%3d%252F&Source=cookie HTTP/1.1Host: securityupdatehub-my.sharepoint.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: RpsContextCookie=U291cmNlPSUyRg==
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/asyncchunk/convergedlogin_pcustomizationloader_27cef08ca792f8e8b149.js HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/asyncchunk/convergedlogin_pcustomizationloader_27cef08ca792f8e8b149.js HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: securityupdatehub-my.sharepoint.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: securityupdatehub-my.sharepoint.com
Source: global traffic	DNS traffic detected: DNS query: login.microsoftonline.com
Source: global traffic	DNS traffic detected: DNS query: identity.nel.measure.office.net
Source: global traffic	DNS traffic detected: DNS query: aadcdn.msftauth.net

Source: chromecache_73.2.dr, chromecache_70.2.dr	String found in binary or memory: http://feross.org
Source: chromecache_73.2.dr, chromecache_70.2.dr	String found in binary or memory: https://github.com/douglascrockford/JSON-js
Source: chromecache_60.2.dr	String found in binary or memory: https://login.microsoftonline.com
Source: chromecache_60.2.dr	String found in binary or memory: https://login.windows-ppe.net

Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49811

Source: classification engine

Classification label: clean1.win@17/42@16/6

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2136 --field-trial-handle=1988,i,7594917267722297499,11007387598272349058,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "http://securityupdatehub-my.sharepoint.com"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2136 --field-trial-handle=1988,i,7594917267722297499,11007387598272349058,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	1 Process Injection	1 Process Injection	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	2 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Name	IP	Active	Malicious	Reputation
dual-spo-0005.spo-msedge.net	13.107.136.10	true	false	high
sni1gl.wpc.omegacdn.net	152.199.21.175	true	false	high
www.google.com	142.250.181.100	true	false	high
s-part-0035.t-0009.t-msedge.net	13.107.246.63	true	false	high
securityupdatehub-my.sharepoint.com	unknown	unknown	false	unknown
identity.nel.measure.office.net	unknown	unknown	false	high
aadcdn.msftauth.net	unknown	unknown	false	high
login.microsoftonline.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
https://aadcdn.msftauth.net/shared/1.0/content/js/asyncchunk/convergedlogin_pcustomizationloader_27cef08ca792f8e8b149.js	false	high
https://securityupdatehub-my.sharepoint.com/_layouts/15/authenticate.aspx?Source=%2F	false	unknown
https://login.microsoftonline.com/9b82a082-52f4-44b9-a6c9-d3d75128b78b/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&scope=openid&nonce=ADE0690D93F719CF918CBB9C521182130797FDF54A0F08A1%2D03C14ECC01D987DB2D5375F0F48E93B6E757EE95005239FAA6916A25FD464BF3&redirect%5Furi=https%3A%2F%2Fsecurityupdatehub%2Dmy%2Esharepoint%2Ecom%2F%5Fforms%2Fdefault%2Easpx&state=OD0w&claims=%7B%22id%5Ftoken%22%3A%7B%22xms%5Fcc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&wsucxt=1&cobrandid=11bd8083%2D87e0%2D41b5%2Dbb78%2D0bc43c8a8e8a&client%2Drequest%2Did=4cbd6fa1%2D7032%2D7000%2D734f%2D6c042359b170&sso_reload=true	false	high
https://login.microsoftonline.com/9b82a082-52f4-44b9-a6c9-d3d75128b78b/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&scope=openid&nonce=ADE0690D93F719CF918CBB9C521182130797FDF54A0F08A1%2D03C14ECC01D987DB2D5375F0F48E93B6E757EE95005239FAA6916A25FD464BF3&redirect%5Furi=https%3A%2F%2Fsecurityupdatehub%2Dmy%2Esharepoint%2Ecom%2F%5Fforms%2Fdefault%2Easpx&state=OD0w&claims=%7B%22id%5Ftoken%22%3A%7B%22xms%5Fcc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&wsucxt=1&cobrandid=11bd8083%2D87e0%2D41b5%2Dbb78%2D0bc43c8a8e8a&client%2Drequest%2Did=4cbd6fa1%2D7032%2D7000%2D734f%2D6c042359b170	false	high
https://securityupdatehub-my.sharepoint.com/_forms/default.aspx?ReturnUrl=%2f_layouts%2f15%2fauthenticate.aspx%3fSource%3d%252F&Source=cookie	false	unknown
http://securityupdatehub-my.sharepoint.com/	false	unknown
https://securityupdatehub-my.sharepoint.com/	false	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://login.microsoftonline.com	chromecache_60.2.dr	false	high
https://github.com/douglascrockford/JSON-js	chromecache_73.2.dr, chromecache_70.2.dr	false	high
https://login.windows-ppe.net	chromecache_60.2.dr	false	high
http://feross.org	chromecache_73.2.dr, chromecache_70.2.dr	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
13.107.138.10	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
13.107.136.10	dual-spo-0005.spo-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
142.250.181.100	www.google.com	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
152.199.21.175	sni1gl.wpc.omegacdn.net	United States	15133	EDGECASTUS	false

Private

IP
192.168.2.4

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1579320
Start date and time:	2024-12-21 15:37:30 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 5s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	http://securityupdatehub-my.sharepoint.com
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	CLEAN
Classification:	clean1.win@17/42@16/6
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 216.58.208.227, 64.233.164.84, 172.217.17.78, 172.217.17.46, 20.190.147.3, 20.190.177.85, 20.190.147.12, 20.190.177.148, 20.190.177.149, 20.190.147.9, 20.190.147.11, 20.190.177.20, 217.20.58.99, 192.229.221.95, 23.32.238.168, 23.32.238.209, 20.190.147.1, 20.190.177.23, 20.190.177.146, 20.190.177.21, 20.190.147.2, 142.250.181.106, 142.250.181.138, 172.217.17.42, 172.217.17.74, 172.217.19.202, 216.58.208.234, 142.250.181.74, 142.250.181.42, 172.217.19.234, 142.250.181.10, 172.217.19.170, 172.217.19.10, 40.126.53.14, 40.126.53.19, 20.190.181.6, 20.231.128.66, 40.126.53.11, 40.126.53.10, 40.126.53.17, 20.190.181.1, 172.217.17.35, 92.122.16.236, 172.202.163.200, 13.107.246.63
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, www.tm.lg.prod.aadmsa.akadns.net, clientservices.googleapis.com, ak.privatelink.msidentity.com, a1894.dscb.akamai.net, clients2.google.com, ocsp.digicert.com, redirector.gvt1.com, login.live.com, update.googleapis.com, login.mso.msidentity.com, prdv4a.aadg.msidentity.com, fs.microsoft.com, accounts.google.com, content-autofill.googleapis.com, otelrules.azureedge.net, aadcdnoriginwus2.azureedge.net, www.tm.ak.prd.aadg.akadns.net, www.tm.v4.a.prd.aadg.akadns.net, ctldl.windowsupdate.com, aadcdn.msauth.net, firstparty-azurefd-prod.trafficmanager.net, login.msa.msidentity.com, fe3cr.delivery.mp.microsoft.com, 193771-ipv4v6e.farm.dprodmgd105.sharepointonline.com.akadns.net, edgedl.me.gvt1.com, nel.measure.office.net.edgesuite.net, aadcdnoriginwus2.afd.azureedge.net, clients.l.google.com, www.tm.lg.prod.aadmsa.trafficmanager.net
Not all processes where analyzed, report is missing behavior information
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: http://securityupdatehub-my.sharepoint.com

Input	Output
URL: http://securityupdatehub-my.sharepoint.com Model: Joe Sandbox AI	{ "typosquatting": false, "unusual_query_string": false, "suspicious_tld": false, "ip_in_url": false, "long_subdomain": false, "malicious_keywords": true, "encoded_characters": false, "redirection": false, "contains_email_address": false, "known_domain": true, "brand_spoofing_attempt": false, "third_party_hosting": false }
URL: http://securityupdatehub-my.sharepoint.com
URL: https://login.microsoftonline.com/9b82a082-52f4-44b9-a6c9-d3d75128b78b/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D0000000 Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "Sign in", "prominent_button_name": "Next", "text_input_field_labels": [ "1bgyxz@abc.io" ], "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: https://login.microsoftonline.com/9b82a082-52f4-44b9-a6c9-d3d75128b78b/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D0000000 Model: Joe Sandbox AI	{ "brands": [ "Microsoft" ] }
	{ "brands": [ "Microsoft" ] }
URL: https://login.microsoftonline.com/9b82a082-52f4-44b9-a6c9-d3d75128b78b/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D0000000 Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "We couldn't find an account with that username.", "prominent_button_name": "Next", "text_input_field_labels": [ "1bgyxz@abc.io" ], "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: https://login.microsoftonline.com/9b82a082-52f4-44b9-a6c9-d3d75128b78b/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D0000000 Model: Joe Sandbox AI	{ "brands": [ "Microsoft" ] }
	{ "brands": [ "Microsoft" ] }

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 190152
Category:	downloaded
Size (bytes):	61052
Entropy (8bit):	7.996159932827634
Encrypted:	true
SSDEEP:	1536:HQaq1Q7XOos5ZBIp+1Zr52IGmCJijm1qAxTe9wzf:fq1HoUBIpU5TG7JSmwuTe+b
MD5:	C1E82BF71ADD622AD0F3BF8572F634FC
SHA1:	6CA863D4CAB96669202548D301693B3F5F80B0D5
SHA-256:	BA48AF15D297DB450DC4870242482145ADDB2D18375A4871C490429E2DC5464A
SHA-512:	820A7F8A0C8EA33A8FE1E90CDC35F45DC1E143E836B0D8EA047E1E312F8CAEC72CDEE4E7DB54760A4D749CD0ACFE103A27E39A9A56EB2D704E448A67B0D0C079
Malicious:	false
Reputation:	low
URL:	https://aadcdn.msauth.net/shared/1.0/content/js/oneDs_f2e0f4a029670f10d892.js
Preview:	...........iw.F.0.....'W...4)/qH#..D.L.EK...................().}.{..@.z........Qz.,..Ox.....i4..S.&.p......9..W....);a.].a....Y......Y<,.n..."`Is....5....P..\|.-..x1.F...@...yRlG.O..5.Q.\|.gy.c.^....r.EC.....xd.oL..$./..\|3.......r^.j.}...M... )x.D.....%.....B..t....vZ....2L......px.G.1..lZYh...$.....,.../.a..;Q...._..#.....e.T.:trA_.0.:.f...........(I.x?.S...<7...o..0.`r.x.+.2..o+...4/..vzY7.C'.....!.r..4n....]P.+a..........._.8,..G>...{.4B....o.9.....r......X3..U.....'.0.@...lrX....r.W\e...].}....(.l......=........3....S..........^=D..[.zw6..e...<WQ.w.(.X..S....>.^.....^B..O-.(..U.R;h..v.......4.Dc .?..z....r.._.Y......M.a.?,...?..U.....OF.w\h$.Q..5....Q.Oj ....5U..8..Y......gYZM....y..OrY.z]B..y..;o.....oT.r...H..{K...Y&Q.........W....N4.......].0m..m........E.bc..~..e.. .nzS.i3^......).,Y}.=1H...... V...g.)....X..G...C....@o,.i.~...as...ehEH....u9l.2...y\J.?.(.I.q%..F#..D../>pr$...,...m.6..:,<s..~S.fl;k.'<..}z.Y.

Chrome Cache Entry: 60

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (3450), with CRLF line terminators
Category:	downloaded
Size (bytes):	3452
Entropy (8bit):	5.117912766689607
Encrypted:	false
SSDEEP:	96:3qO9I9Sz9KHULI5m4UidBGLosqAsosushswsosry:a2IYz95qTdBac
MD5:	CB06E9A552B197D5C0EA600B431A3407
SHA1:	04E167433F2F1038C78F387F8A166BB6542C2008
SHA-256:	1F4EDBD2416E15BD82E61BA1A8E5558D44C4E914536B1B07712181BF57934021
SHA-512:	1B4A3919E442EE4D2F30AE29B1C70DF7274E5428BCB6B3EDD84DCB92D60A0D6BDD9FA6D9DDE8EAB341FF4C12DE00A50858BF1FC5B6135B71E9E177F5A9ED34B9
Malicious:	false
Reputation:	low
URL:	https://login.live.com/Me.htm?v=3
Preview:	<script type="text/javascript">!function(t,e){for(var s in e)t[s]=e[s]}(this,function(t){function e(n){if(s[n])return s[n].exports;var i=s[n]={exports:{},id:n,loaded:!1};return t[n].call(i.exports,i,i.exports,e),i.loaded=!0,i.exports}var s={};return e.m=t,e.c=s,e.p="",e(0)}([function(t,e){function s(t){for(var e=f[S],s=0,n=e.length;s<n;++s)if(e[s]===t)return!0;return!1}function n(t){if(!t)return null;for(var e=t+"=",s=document.cookie.split(";"),n=0,i=s.length;n<i;n++){var a=s[n].replace(/^\s(\w+)\s=\s*/,"$1=").replace(/(\s+$)/,"");if(0===a.indexOf(e))return a.substring(e.length)}return null}function i(t,e,s){if(t)for(var n=t.split(":"),i=null,a=0,r=n.length;a<r;++a){var c=null,S=n[a].split("$");if(0===a&&(i=parseInt(S.shift()),!i))return;var l=S.length;if(l>=1){var p=o(i,S[0]);if(!p\|\|s[p])continue;c={signInName:p,idp:"msa",isSignedIn:!0}}if(l>=3&&(c.firstName=o(i,S[1]),c.lastName=o(i,S[2])),l>=4){var f=S[3],d=f.split("\|");c.otherHashedAliases=d}if(l>=5){var h=parseInt(S[4],16);h&&(c.

Chrome Cache Entry: 61

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 190152
Category:	dropped
Size (bytes):	61052
Entropy (8bit):	7.996159932827634
Encrypted:	true
SSDEEP:	1536:HQaq1Q7XOos5ZBIp+1Zr52IGmCJijm1qAxTe9wzf:fq1HoUBIpU5TG7JSmwuTe+b
MD5:	C1E82BF71ADD622AD0F3BF8572F634FC
SHA1:	6CA863D4CAB96669202548D301693B3F5F80B0D5
SHA-256:	BA48AF15D297DB450DC4870242482145ADDB2D18375A4871C490429E2DC5464A
SHA-512:	820A7F8A0C8EA33A8FE1E90CDC35F45DC1E143E836B0D8EA047E1E312F8CAEC72CDEE4E7DB54760A4D749CD0ACFE103A27E39A9A56EB2D704E448A67B0D0C079
Malicious:	false
Reputation:	low
Preview:	...........iw.F.0.....'W...4)/qH#..D.L.EK...................().}.{..@.z........Qz.,..Ox.....i4..S.&.p......9..W....);a.].a....Y......Y<,.n..."`Is....5....P..\|.-..x1.F...@...yRlG.O..5.Q.\|.gy.c.^....r.EC.....xd.oL..$./..\|3.......r^.j.}...M... )x.D.....%.....B..t....vZ....2L......px.G.1..lZYh...$.....,.../.a..;Q...._..#.....e.T.:trA_.0.:.f...........(I.x?.S...<7...o..0.`r.x.+.2..o+...4/..vzY7.C'.....!.r..4n....]P.+a..........._.8,..G>...{.4B....o.9.....r......X3..U.....'.0.@...lrX....r.W\e...].}....(.l......=........3....S..........^=D..[.zw6..e...<WQ.w.(.X..S....>.^.....^B..O-.(..U.R;h..v.......4.Dc .?..z....r.._.Y......M.a.?,...?..U.....OF.w\h$.Q..5....Q.Oj ....5U..8..Y......gYZM....y..OrY.z]B..y..;o.....oT.r...H..{K...Y&Q.........W....N4.......].0m..m........E.bc..~..e.. .nzS.i3^......).,Y}.=1H...... V...g.)....X..G...C....@o,.i.~...as...ehEH....u9l.2...y\J.?.(.I.q%..F#..D../>pr$...,...m.6..:,<s..~S.fl;k.'<..}z.Y.

Chrome Cache Entry: 62

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 3651
Category:	downloaded
Size (bytes):	1435
Entropy (8bit):	7.8613342322590265
Encrypted:	false
SSDEEP:	24:XjtSZi0kq+yVCGYXVrO4vDxik/N/z5VaLPbholJvf6dblke68eRZJyBDz3BnZcNX:XgDkpyVCGca4b//9z5oPXdbl9688qRzY
MD5:	9F368BC4580FED907775F31C6B26D6CF
SHA1:	E393A40B3E337F43057EEE3DE189F197AB056451
SHA-256:	7ECBBA946C099539C3D9C03F4B6804958900E5B90D48336EEA7E5A2ED050FA36
SHA-512:	0023B04D1EEC26719363AED57C95C1A91244C5AFF0BB53091938798FB16E230680E1F972D166B633C1D2B314B34FE0B9D7C18442410DB7DD6024E279AAFD61B0
Malicious:	false
Reputation:	low
URL:	https://aadcdn.msauth.net/shared/1.0/content/images/microsoft_logo_564db913a7fa0ca42727161c6d031bef.svg
Preview:	...........WMo.7..+..uV.HJ...{..........&..v...(Q.F.....aW.Q.\|..~.\|{~...b{8...zv.....8\|...b.gxb.y{.x<\lS...p...p..l7...o.}.v.....t.........r..r.\|9?.......HP...r.4.aGA.j....7.!....K.n.B.Z.C.]....kj..A..p...xI...b..I!K..><.B..O....#...$.]h.bU.;.Y...).r.u....g.-w.2..vPh....q....4_..N\..@y).t{.2pj.f..4h.....NC.....x.R..P..9.....".4.`%N..&...a.@.......fS)A4.F..8e9KHE....8d.CR.K..g..Q.......a....f.....dgN.N.k..#w..........,.".%..I.q.Y.R]..7.!.:.Ux...T.qI..{..,b..2..B...Bh...[o..[4....dZ.z.!.l....E.9$..Y.'...M.,p..$..8Ns3.B.....{.....H..Se3....%.Ly...VP{.Bh.D.+....p..(..`....t....U.e....2......j...%..0.f<...q...B.k..N....03...8....l.....bS...vh..8..Q..LWXW..C.......3..Pr.V.l...^=VX\,d9f.Y;1!w.d,.qvs....f;.....Zhrr.,.U....6.Y....+Zd.R...but....".....4.L...z........L.Q......)....,.].Y.&....*ZsIVG.^...#...e..r....Z..F..c..... .QDCmV..1.~...J9..b_Oov\..X.R..._.TqH.q.5G.0{ZphQ..k...s..\.../.Dp..d`#......8.#Y...Mb.j.Q......=n4.c....p.[.SI.....0.N.

Chrome Cache Entry: 63

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 3651
Category:	dropped
Size (bytes):	1435
Entropy (8bit):	7.8613342322590265
Encrypted:	false
SSDEEP:	24:XjtSZi0kq+yVCGYXVrO4vDxik/N/z5VaLPbholJvf6dblke68eRZJyBDz3BnZcNX:XgDkpyVCGca4b//9z5oPXdbl9688qRzY
MD5:	9F368BC4580FED907775F31C6B26D6CF
SHA1:	E393A40B3E337F43057EEE3DE189F197AB056451
SHA-256:	7ECBBA946C099539C3D9C03F4B6804958900E5B90D48336EEA7E5A2ED050FA36
SHA-512:	0023B04D1EEC26719363AED57C95C1A91244C5AFF0BB53091938798FB16E230680E1F972D166B633C1D2B314B34FE0B9D7C18442410DB7DD6024E279AAFD61B0
Malicious:	false
Reputation:	low
Preview:	...........WMo.7..+..uV.HJ...{..........&..v...(Q.F.....aW.Q.\|..~.\|{~...b{8...zv.....8\|...b.gxb.y{.x<\lS...p...p..l7...o.}.v.....t.........r..r.\|9?.......HP...r.4.aGA.j....7.!....K.n.B.Z.C.]....kj..A..p...xI...b..I!K..><.B..O....#...$.]h.bU.;.Y...).r.u....g.-w.2..vPh....q....4_..N\..@y).t{.2pj.f..4h.....NC.....x.R..P..9.....".4.`%N..&...a.@.......fS)A4.F..8e9KHE....8d.CR.K..g..Q.......a....f.....dgN.N.k..#w..........,.".%..I.q.Y.R]..7.!.:.Ux...T.qI..{..,b..2..B...Bh...[o..[4....dZ.z.!.l....E.9$..Y.'...M.,p..$..8Ns3.B.....{.....H..Se3....%.Ly...VP{.Bh.D.+....p..(..`....t....U.e....2......j...%..0.f<...q...B.k..N....03...8....l.....bS...vh..8..Q..LWXW..C.......3..Pr.V.l...^=VX\,d9f.Y;1!w.d,.qvs....f;.....Zhrr.,.U....6.Y....+Zd.R...but....".....4.L...z........L.Q......)....,.].Y.&....*ZsIVG.^...#...e..r....Z..F..c..... .QDCmV..1.~...J9..b_Oov\..X.R..._.TqH.q.5G.0{ZphQ..k...s..\.../.Dp..d`#......8.#Y...Mb.j.Q......=n4.c....p.[.SI.....0.N.

Chrome Cache Entry: 64

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 142367
Category:	dropped
Size (bytes):	49911
Entropy (8bit):	7.994516776763163
Encrypted:	true
SSDEEP:	1536:vr2T/J/l2R6ACJVMQPYmlBXTm12g9bcKo0y0ci:CzJ/lG2KQzBjm1b3ci
MD5:	9B96CC09F9E89D0334BA2FBC22B5197A
SHA1:	B5FE69F39E9F61FEF88DF794F02DC4F4086E2592
SHA-256:	E6331018533143C411BAE25326AB52FCED541C48674551AEA78E750855BDCD1D
SHA-512:	2BDD71A34A7D6172AD4B7B6CF077A891D6266C148000EEF8345E2343E6C21ED8783B2EA328EF3BF7176462A3CA575D2D6D4B55A07138CFD1B02900C95F61077D
Malicious:	false
Reputation:	low
Preview:	...........m[.8.0........OL....;w.....a.....\N.......h.r~........=........,..JU.......T~.l..?..y..2.X9.\|xvP9...TN.......?.....qe.OE.~Gn,.J.T....0......r..#.V&Qx_I.De.._.8.+S?N..HL..J......%O..S........(=.gO.\|.T.0......6.. ..y....x....8..p.T"1...\|$.Cz..V.D%.Ie.F....^."..5....c...?..T8..._..b.gs.4....S]kDZ..7.J.V..l}..?.....c...g.A...8.......8.VB......^..f..O.... ...`...H.{.$. OP..S..AC.gVE.I8..).-U.....R...A..%.T[...Fc{..49..If...y.'w.Q}..oz..v.....W...pp..%..G.+.r:.A......[.:..s.?U......_............k.y0.U....+I5..0.>.Q%.".w.....O....5w..;.;.>..mr.k53r.......k.0.I.<.D......d&...c..jhE..zx.]....y\|W....i...`.. .k.P...@.Uq.\;..1............z\|.O..Y5..........XtR,....R...k3..<..\.2.>.;T..$...kj.5-.i?/..YH`!jb..Z..=.&.L..F...([..y....K5pzQ.>i.1.......0..P...@...L.".n.x..Cj?..w.:+...n..4..H.. .....S.....h....8....v.l.[M.0..q..c;.....0..*.8.......l.TM..n "..km..S.<.T..].k.+1.....P.V...4-W.C....0-/.S;.w......K.z+...DZ....=q.E.@ .Dv.z...@.d.#tE...

Chrome Cache Entry: 65

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 450755
Category:	downloaded
Size (bytes):	122515
Entropy (8bit):	7.997419459076181
Encrypted:	true
SSDEEP:	3072:1L4xVJNv/cJPu5OEjvuUQIq40zDH227PURbj:1kbGugELatzL7PUlj
MD5:	AC9A6ED508328361A4C9530325A94076
SHA1:	ADC81FAE51EB66A220539EEEDECEB96CFF390BBB
SHA-256:	BA93F4A83BB77D32AF9AFB9B014BFD13FD497E3D8F15AF016C782ABD1D34037B
SHA-512:	066D92389A7EFB3A80FCFC86696EE6AE008259570F73814303A9ACC1690F881DF2034A16D5C7970BA703648CA79C2E7CBAA2CAD98C28879ADD44AB06620305B4
Malicious:	false
Reputation:	low
URL:	https://aadcdn.msauth.net/shared/1.0/content/js/ConvergedLogin_PCore_kAx9qZOSH4g90FNHstHMCA2.js
Preview:	...........}[.8......\&.L..{.x.t.nv.p......ql%xH...rB....J.-'..=...}...&.Jo.R..T}.y...\....J....uipR..\|zuT....(]..O..._.6.......?e%.;rb...F%?p.h.FN......\|gZ.G.<..<..dn...~.@.....2T.y.K'J^K.....6...P.....!).a.....6.. f.E......s..8.'......F.....KN.J1KJ.0J.x?..!B.Zcj....8t.....1......!vq..Ac.0..V.N..a..}(%a.5\..g..I..6...L...x.7.......8..B..J....^b/s.....I...r..L.3.... ..y...^K.l.....%.'.\|.8.T.....$.R..8.j.?.R.f..}..o.....$....a.'..Q..g..p1.:1t.}..y..}8...3...8....b.=(..3..d[..Os......%....Z...G.......x...2.,..RP..+..O. _....n.;=.?.....w../au.I.p...U\|;......WM.f?...9.>8..9.....S../;._..un...].:_..e..V:.....@..[..Ue.'Pe..&wv..T..ow.........?..\)WVb..r.;.....A........mpW.X.........B.....I...}j.....(...1.e.D.~.....;F..:..P.=.....(r^........N1.F....@..W%y.....t...Q....Y.5.$.O..x@.l.4.a.b.f..3.2.B...DL}4Y.:.u........`?....W`Z".S.S..}= .:......i.@E"1T.....`\.a....J:].....R....=R..y.........s<;....~NXr<%...\|.v&...5..*....D.(9...

Chrome Cache Entry: 66

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1592
Category:	downloaded
Size (bytes):	621
Entropy (8bit):	7.673946009263606
Encrypted:	false
SSDEEP:	12:Xp7fmqfW/e4YC2L0E5DZLB62y/+6lbPa1Gotq8mdd2Xmy2QLBwxD+QkCfBJ:Xp6qf2SCk3LBpy/rtPa1GKq8mOX5jLcD
MD5:	4761405717E938D7E7400BB15715DB1E
SHA1:	76FED7C229D353A27DB3257F5927C1EAF0AB8DE9
SHA-256:	F7ED91A1DAB5BB2802A7A3B3890DF4777588CCBE04903260FBA83E6E64C90DDF
SHA-512:	E8DAC6F81EB4EBA2722E9F34DAF9B99548E5C40CCA93791FBEDA3DEBD8D6E401975FC1A75986C0E7262AFA1B9D1475E1008A89B92C8A7BEC84D8A917F221B4A2
Malicious:	false
Reputation:	low
URL:	https://aadcdn.msauth.net/shared/1.0/content/images/signin-options_3e3f6b73c3f310c31d2c4d131a8ab8c6.svg
Preview:	..........}UMo"1..+.....G; .8l...M..$.U.AW......UaX..`'.=......\|..z3...Ms>..Y...QB..W..y..6.......?..........L.W=m....=..w.)...nw...a.z......#.y.j...m...P...#...6....6.u.u...OF.V..07b..\...s.f..U..N..B...>.d.-z..x.2..Lr.Rr)....JF.z.;Lh.....q.2.A....[.&".S..:......]........#k.U#57V..k5.tdM.j.9.FMQ2..H:.~op..H.......hQ.#...r[.T.$.@........j.xc.x0..I.B:#{iP1.e'..S4.:...mN.4)<W.A.).g.+..PZ&.$.#.6v.+.!...x...}.._...d...#.Cb..(..^k..h!..7.dx.WHB......(.6g.7.Wwt.I<.......o.;.....Oi$}f.6.....:P..!<5.(.p.e.%et.)w8LA.l9r..n.....?.F.DrK...H....0F...{.,.......{E..".......x.@..?u......../....8...

Chrome Cache Entry: 67

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 450755
Category:	dropped
Size (bytes):	122515
Entropy (8bit):	7.997419459076181
Encrypted:	true
SSDEEP:	3072:1L4xVJNv/cJPu5OEjvuUQIq40zDH227PURbj:1kbGugELatzL7PUlj
MD5:	AC9A6ED508328361A4C9530325A94076
SHA1:	ADC81FAE51EB66A220539EEEDECEB96CFF390BBB
SHA-256:	BA93F4A83BB77D32AF9AFB9B014BFD13FD497E3D8F15AF016C782ABD1D34037B
SHA-512:	066D92389A7EFB3A80FCFC86696EE6AE008259570F73814303A9ACC1690F881DF2034A16D5C7970BA703648CA79C2E7CBAA2CAD98C28879ADD44AB06620305B4
Malicious:	false
Reputation:	low
Preview:	...........}[.8......\&.L..{.x.t.nv.p......ql%xH...rB....J.-'..=...}...&.Jo.R..T}.y...\....J....uipR..\|zuT....(]..O..._.6.......?e%.;rb...F%?p.h.FN......\|gZ.G.<..<..dn...~.@.....2T.y.K'J^K.....6...P.....!).a.....6.. f.E......s..8.'......F.....KN.J1KJ.0J.x?..!B.Zcj....8t.....1......!vq..Ac.0..V.N..a..}(%a.5\..g..I..6...L...x.7.......8..B..J....^b/s.....I...r..L.3.... ..y...^K.l.....%.'.\|.8.T.....$.R..8.j.?.R.f..}..o.....$....a.'..Q..g..p1.:1t.}..y..}8...3...8....b.=(..3..d[..Os......%....Z...G.......x...2.,..RP..+..O. _....n.;=.?.....w../au.I.p...U\|;......WM.f?...9.>8..9.....S../;._..un...].:_..e..V:.....@..[..Ue.'Pe..&wv..T..ow.........?..\)WVb..r.;.....A........mpW.X.........B.....I...}j.....(...1.e.D.~.....;F..:..P.=.....(r^........N1.F....@..W%y.....t...Q....Y.5.$.O..x@.l.4.a.b.f..3.2.B...DL}4Y.:.u........`?....W`Z".S.S..}= .:......i.@E"1T.....`\.a....J:].....R....=R..y.........s<;....~NXr<%...\|.v&...5..*....D.(9...

Chrome Cache Entry: 68

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 142367
Category:	downloaded
Size (bytes):	49911
Entropy (8bit):	7.994516776763163
Encrypted:	true
SSDEEP:	1536:vr2T/J/l2R6ACJVMQPYmlBXTm12g9bcKo0y0ci:CzJ/lG2KQzBjm1b3ci
MD5:	9B96CC09F9E89D0334BA2FBC22B5197A
SHA1:	B5FE69F39E9F61FEF88DF794F02DC4F4086E2592
SHA-256:	E6331018533143C411BAE25326AB52FCED541C48674551AEA78E750855BDCD1D
SHA-512:	2BDD71A34A7D6172AD4B7B6CF077A891D6266C148000EEF8345E2343E6C21ED8783B2EA328EF3BF7176462A3CA575D2D6D4B55A07138CFD1B02900C95F61077D
Malicious:	false
Reputation:	low
URL:	https://aadcdn.msauth.net/shared/1.0/content/js/BssoInterrupt_Core_zKox_QMcTIVut7mG_Z9Eew2.js
Preview:	...........m[.8.0........OL....;w.....a.....\N.......h.r~........=........,..JU.......T~.l..?..y..2.X9.\|xvP9...TN.......?.....qe.OE.~Gn,.J.T....0......r..#.V&Qx_I.De.._.8.+S?N..HL..J......%O..S........(=.gO.\|.T.0......6.. ..y....x....8..p.T"1...\|$.Cz..V.D%.Ie.F....^."..5....c...?..T8..._..b.gs.4....S]kDZ..7.J.V..l}..?.....c...g.A...8.......8.VB......^..f..O.... ...`...H.{.$. OP..S..AC.gVE.I8..).-U.....R...A..%.T[...Fc{..49..If...y.'w.Q}..oz..v.....W...pp..%..G.+.r:.A......[.:..s.?U......_............k.y0.U....+I5..0.>.Q%.".w.....O....5w..;.;.>..mr.k53r.......k.0.I.<.D......d&...c..jhE..zx.]....y\|W....i...`.. .k.P...@.Uq.\;..1............z\|.O..Y5..........XtR,....R...k3..<..\.2.>.;T..$...kj.5-.i?/..YH`!jb..Z..=.&.L..F...([..y....K5pzQ.>i.1.......0..P...@...L.".n.x..Cj?..w.:+...n..4..H.. .....S.....h....8....v.l.[M.0..q..c;.....0..*.8.......l.TM..n "..km..S.<.T..].k.+1.....P.V...4-W.C....0-/.S;.w......K.z+...DZ....=q.E.@ .Dv.z...@.d.#tE...

Chrome Cache Entry: 69

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	36
Entropy (8bit):	4.503258334775644
Encrypted:	false
SSDEEP:	3:Eq62iczBr9ks:EqdiczBys
MD5:	06B313E93DD76909460FBFC0CD98CB6B
SHA1:	C4F9B2BBD840A4328F85F54873C434336A193888
SHA-256:	B4532478707B495D0BB1C21C314AEF959DD1A5E0F66E52DAD5FC332C8B697CBA
SHA-512:	EFD7E8195D9C126883C71FED3EFEDE55916848B784F8434ED2677DF5004436F7EDE9F80277CB4675C4DEB8F243B2705A3806B412FAA8842E039E9DC467C11645
Malicious:	false
Reputation:	low
URL:	https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzISFwmCAmly1gHbXRIFDdFbUVISBQ1Xevf9?alt=proto
Preview:	ChgKDQ3RW1FSGgQIVhgCIAEKBw1Xevf9GgA=

Chrome Cache Entry: 70

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (45797)
Category:	downloaded
Size (bytes):	406986
Entropy (8bit):	5.31789636250024
Encrypted:	false
SSDEEP:	3072:o8MOoLTvZBZdxn7oW/Cs9wQ2JcP2RTQ/Opsm7m5dihTuZykwFM8dteY2or/cOsF3:yTL7nxp/1+eH/8smQZnL3
MD5:	9083D228E539FD87EF95A94B7ABC396C
SHA1:	159AE950D79B4987D65F18FFBF6FF87D76C5B536
SHA-256:	54B34EA260D9DCF6D7961A60C9B540673312A965F9DDC2F1AB9855D622BFA07C
SHA-512:	1306A0CFBA637F249786677E9C29D72E15C72F1575DEB217E9E965E456D2320C5644CDE43F06BA1E8373D11E16D33DD955FB3E9077C38F585E4A33B5A1075A0B
Malicious:	false
Reputation:	low
URL:	https://aadcdn.msftauth.net/shared/1.0/content/js/asyncchunk/convergedlogin_pcustomizationloader_27cef08ca792f8e8b149.js
Preview:	/!. ------------------------------------------- START OF THIRD PARTY NOTICE -----------------------------------------. * . * This file is based on or incorporates material from the projects listed below (Third Party IP). The original copyright notice and the license under which Microsoft received such Third Party IP, are set forth below. Such licenses and notices are provided for informational purposes only. Microsoft licenses the Third Party IP to you under the licensing terms for the Microsoft product. Microsoft reserves all other rights not expressly granted under this agreement, whether by implication, estoppel or otherwise.. * . * json2.js (2016-05-01). * https://github.com/douglascrockford/JSON-js. * License: Public Domain. * . * Provided for Informational Purposes Only. * . * ----------------------------------------------- END OF THIRD PARTY NOTICE ------------------------------------------. */.(window.webpackJsonp=window.webpackJsonp\|\|[]).push([[8],Array(539).concat([f

Chrome Cache Entry: 71

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1592
Category:	dropped
Size (bytes):	621
Entropy (8bit):	7.673946009263606
Encrypted:	false
SSDEEP:	12:Xp7fmqfW/e4YC2L0E5DZLB62y/+6lbPa1Gotq8mdd2Xmy2QLBwxD+QkCfBJ:Xp6qf2SCk3LBpy/rtPa1GKq8mOX5jLcD
MD5:	4761405717E938D7E7400BB15715DB1E
SHA1:	76FED7C229D353A27DB3257F5927C1EAF0AB8DE9
SHA-256:	F7ED91A1DAB5BB2802A7A3B3890DF4777588CCBE04903260FBA83E6E64C90DDF
SHA-512:	E8DAC6F81EB4EBA2722E9F34DAF9B99548E5C40CCA93791FBEDA3DEBD8D6E401975FC1A75986C0E7262AFA1B9D1475E1008A89B92C8A7BEC84D8A917F221B4A2
Malicious:	false
Reputation:	low
Preview:	..........}UMo"1..+.....G; .8l...M..$.U.AW......UaX..`'.=......\|..z3...Ms>..Y...QB..W..y..6.......?..........L.W=m....=..w.)...nw...a.z......#.y.j...m...P...#...6....6.u.u...OF.V..07b..\...s.f..U..N..B...>.d.-z..x.2..Lr.Rr)....JF.z.;Lh.....q.2.A....[.&".S..:......]........#k.U#57V..k5.tdM.j.9.FMQ2..H:.~op..H.......hQ.#...r[.T.$.@........j.xc.x0..I.B:#{iP1.e'..S4.:...mN.4)<W.A.).g.+..PZ&.$.#.6v.+.!...x...}.._...d...#.Cb..(..^k..h!..7.dx.WHB......(.6g.7.Wwt.I<.......o.;.....Oi$}f.6.....:P..!<5.(.p.e.%et.)w8LA.l9r..n.....?.F.DrK...H....0F...{.,.......{E..".......x.@..?u......../....8...

Chrome Cache Entry: 72

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 352 x 3
Category:	dropped
Size (bytes):	3620
Entropy (8bit):	6.867828878374734
Encrypted:	false
SSDEEP:	48:ZumKaT5ezv47j2/ZiRDlq16x8XvEUcg777shHdpHVGJqFd:Eal647jPDlL8XvEUcg77kVGyd
MD5:	B540A8E518037192E32C4FE58BF2DBAB
SHA1:	3047C1DB97B86F6981E0AD2F96AF40CDF43511AF
SHA-256:	8737D721808655F37B333F08A90185699E7E8B9BDAAA15CDB63C8448B426F95D
SHA-512:	E3612D9E6809EC192F6E2D035290B730871C269A267115E4A5515CADB7E6E14E3DD4290A35ABAA8D14CF1FA3924DC76E11926AC341E0F6F372E9FC5434B546E5
Malicious:	false
Reputation:	low
Preview:	GIF89a`.........iii!.......!.&Edited with ezgif.com online GIF maker.!..NETSCAPE2.0.....,....`.....6......P.l.......H....I..:qJ......k....`BY..L..&...!.......,....`.....9..i....Q4......H..j.=.k9-5_..........j7..({.........!.......,....`.....9.......trV.......H....`.[.q6......>.. .CZ.&!.....M...!.......,....`.....8..........:......H..jJ..U..6_....../.el...q.).....!.......,....`.....9.....i..l.go.....H..".U...f......._......5......n..!.......,....`.....:..i......./.....H...5%.kE/5.........In.a..@&3.....J...!.......,....`.....9.......kr.j.....H...-.{Im5c..............@&.........!.......,....`.....9.........j..q....H...].&..\.5.........8..S..........!.......,....`.....9.......3q.g..5....H...:u..............Al..x.q.........!.......,....`.....9......\.F....z....H...zX...ov.........h3N.x4......j..!.......,....`.....9........Q.:......H....y..^...1.........n.!.F......E...!.......,....`.....8.........i,......H....*_.21.I.........%...

Chrome Cache Entry: 73

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (45797)
Category:	dropped
Size (bytes):	406986
Entropy (8bit):	5.31789636250024
Encrypted:	false
SSDEEP:	3072:o8MOoLTvZBZdxn7oW/Cs9wQ2JcP2RTQ/Opsm7m5dihTuZykwFM8dteY2or/cOsF3:yTL7nxp/1+eH/8smQZnL3
MD5:	9083D228E539FD87EF95A94B7ABC396C
SHA1:	159AE950D79B4987D65F18FFBF6FF87D76C5B536
SHA-256:	54B34EA260D9DCF6D7961A60C9B540673312A965F9DDC2F1AB9855D622BFA07C
SHA-512:	1306A0CFBA637F249786677E9C29D72E15C72F1575DEB217E9E965E456D2320C5644CDE43F06BA1E8373D11E16D33DD955FB3E9077C38F585E4A33B5A1075A0B
Malicious:	false
Reputation:	low
Preview:	/!. ------------------------------------------- START OF THIRD PARTY NOTICE -----------------------------------------. * . * This file is based on or incorporates material from the projects listed below (Third Party IP). The original copyright notice and the license under which Microsoft received such Third Party IP, are set forth below. Such licenses and notices are provided for informational purposes only. Microsoft licenses the Third Party IP to you under the licensing terms for the Microsoft product. Microsoft reserves all other rights not expressly granted under this agreement, whether by implication, estoppel or otherwise.. * . * json2.js (2016-05-01). * https://github.com/douglascrockford/JSON-js. * License: Public Domain. * . * Provided for Informational Purposes Only. * . * ----------------------------------------------- END OF THIRD PARTY NOTICE ------------------------------------------. */.(window.webpackJsonp=window.webpackJsonp\|\|[]).push([[8],Array(539).concat([f

Chrome Cache Entry: 74

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 113769
Category:	dropped
Size (bytes):	35170
Entropy (8bit):	7.993096534744333
Encrypted:	true
SSDEEP:	768:K+LvEzA9nny7u0zF35Hm4ngomu6yeLDKDnccqmcmHvVVPCLVf:ny7f5GpuheL4htv3Pkf
MD5:	171A4DD9400708B88724B57D62B24A6A
SHA1:	9C6F1303B8F02FCE18D20EC9CADA11D38D0C4B37
SHA-256:	EA00750636C11DBD4FA3ACB1B3CDCBAE3EFA43F6B6C3753444B6D6A242AE9336
SHA-512:	5B13B63912B34E3EEEDD8DA5953B869A83DF82FFD2A8D737AA81DC984F1811800A534F340C48041DA803C25B6B8F5605EA8D003B6A09A1874408F95A710F5126
Malicious:	false
Reputation:	low
Preview:	...........kC.H.0......e....0.pX..Iv3..\f..0YY.m..e$.K..o...j..g.3.lpW.......[..Y.?k.Y.......8~.a..../_.;]{.............v...0..q.Dk.w...h-....Z<..l.fA..k3.7..dm....b..-...(,.$...4...f...e...AV..z.mA....O.9........k..h-.......<Z[.GQ.v3....Oq..y:..(..k.$_...._..h-...q..S.ck.=.T......Sq@.:.A.c.(....SDq..Ac.t..m.$Lc....Z...K...O<....f9..p...0Z..3.<...$YK.x.F......v....nm..s$...&..dQ4.......n-.-.......E.XD..-5~...f.....t...-_.....fsg...8kZ..\|.{{....p+Lg.t9I..P./ap......o9Wx.._{....k..,...............................7.\|..t...Ax.7..b..v..v.m-...~v...:....r..._........,...A........z.....\|..t.. [.C.....{...~..c......ua...~.v<.I..P#._{{}._.......Km...eR....u?GY..h..}..gAv...<.l.Z...#.....:P?Q..."..........,.D...I<._.'..-..=..;.>.C_..#.....D[0.Y..*...M.....{.YT,...x..SQ/......N<`...\|._.k....0)......+.Z..4...M. ...i...`.ml..-X.E.....d.. .}.e4.{6hz^..}....@....W.1...d8...>.@.....(.'[..`..A..?...yL.\|..QTF...-.='S@.Q.sM.`...}.t..$..y^..0J.kC.S...U.

Chrome Cache Entry: 75

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors
Category:	downloaded
Size (bytes):	17174
Entropy (8bit):	2.9129715116732746
Encrypted:	false
SSDEEP:	24:QSNTmTFxg4lyyyyyyyyyyyyyio7eeeeeeeeekzgsLsLsLsLsLsQZp:nfgyyyyyyyyyyyyynzQQQQQO
MD5:	12E3DAC858061D088023B2BD48E2FA96
SHA1:	E08CE1A144ECEAE0C3C2EA7A9D6FBC5658F24CE5
SHA-256:	90CDAF487716184E4034000935C605D1633926D348116D198F355A98B8C6CD21
SHA-512:	C5030C55A855E7A9E20E22F4C70BF1E0F3C558A9B7D501CFAB6992AC2656AE5E41B050CCAC541EFA55F9603E0D349B247EB4912EE169D44044271789C719CD01
Malicious:	false
Reputation:	low
URL:	https://aadcdn.msauth.net/shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico
Preview:	..............h(..f...HH...........(..00......h....6.. ...........=...............@..........(....A..(....................(....................................."P.........................................."""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333""""""""""""""""""""""""""

Chrome Cache Entry: 76

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 57510
Category:	dropped
Size (bytes):	16345
Entropy (8bit):	7.98960525258912
Encrypted:	false
SSDEEP:	384:hOBEj/gTOkWow6mhJqXnYI/0PiQBSoe122Yw/:hOBKJBXO586QB+11J
MD5:	187B9EBA41FDF66B2C8F7EB645D2BC17
SHA1:	B1C034F7F5F754F271D094FB417B9A820C1F712C
SHA-256:	CA0FBF8421A0CF4CCDA7310B2AE74CBD92214901EC2D0F273EA3B07F12CF96EA
SHA-512:	0D7FB682D24E97C9E3FC04AA87CCB8EC508CA0CF197DA0617EFFD981BC8B5E3600824FDD08F1F31F59D276B5BF53229D00805D984E01D512FD968610C5FE9609
Malicious:	false
Reputation:	low
Preview:	...........}Ms#.......\.@..'F.........3RH2....~......Q.x7...}..'.}..?e#...QU]....Vo..................?........w!......=.G...P.../......8z....q._5....g..}g..31......l*...],.b..;..`...Y....3..5.uGAi..NP.6<.w.(..`...y..d.N.x..^u.....^...?..N........Fq.....z..wgN./..Ep/f..c/.D4~X.W~).s/.E8...T...8,:..Q.p>.....7.....4....Z,&c.)n.[.pcQp...4...&...i.............CkL=.....g..m&vG..p... ....:N`y...ea.,....[......^.../D#(y.....l4.n..,.=_.p2P.....A,..RP..E.T......8 .v....Iw.X..?.r......nk....?Wj..a.\|..........JAs.j......?.)..t.z.-..m.]..3y...3@...'.)...Aa..1.kQ.....l+.....-q..n.p..{^...$..{/...=a..A...4.VH}..SBwju......S..hN.P..-..O,..S7.J,.....p.iLU.6W.....eO.7 ..C...{.E.Z...1...5s.!uY...@^. ,D".N.E......5.NE..\...VQa.A7..X.B..{.q..Ra..S....x(x7.Cp.#.#..:.......D..`,!IGr.. ...z.?.._0O.......;..0.z.h....5.../...q..5.\|..B.OY..k...].Sw.>.".@..!.9.V\|...=.dv.3!sr.....#...X8s.w.\|7..O/....!.."...3.."D..)...[........!^....3(..{...F2'..q.....x........

Chrome Cache Entry: 77

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1864
Category:	downloaded
Size (bytes):	673
Entropy (8bit):	7.6596900876595075
Encrypted:	false
SSDEEP:	12:Xl0t8TUViiYi5m6FhSBXWPsigK99WCqKMvBBFThSqfLd81CK6bC+k7LqZLsFlD:XFUVpkNK0Rwid81p6btk7LqZ6D
MD5:	0E176276362B94279A4492511BFCBD98
SHA1:	389FE6B51F62254BB98939896B8C89EBEFFE2A02
SHA-256:	9A2C174AE45CAC057822844211156A5ED293E65C5F69E1D211A7206472C5C80C
SHA-512:	8D61C9E464C8F3C77BF1729E32F92BBB1B426A19907E418862EFE117DBD1F0A26FCC3A6FE1D1B22B836853D43C964F6B6D25E414649767FBEA7FE10D2048D7A1
Malicious:	false
Reputation:	low
URL:	https://aadcdn.msauth.net/shared/1.0/content/images/backgrounds/2_11d9e3bcdfede9ce5ce5ace2d129f1c4.svg
Preview:	...........U.n.0....}i..P..C..7l/..d........n...G....yl. .E.......Tu.F.........?$.i.s..s...C..wi$.....r....CT.U.FuS..r.e.~...G.q.....~M..mu}.0.=..&.~.e.WLX.....X..%p..i......7+.........?......WN..%>...$..c..}N....Y4?..x.1......#v...Gal9.!.9.A.u..b..>..".#A2"+...<qc.v....)3...x.p&..K.&..T.r.'....J.T....Q..=..H).X...<.r...KkX........)5i4.+.h.....5.<..5.^O.eC%V^....Nx.E..;..52..h....C"I./.`..O...f..r..n.h.r]}.G^..D.7..i.].}.G.].....{....oW............h.4...}~=6u..k...=.X..+z}.4.].....YS5..J......)......m....w.......~}.C.b_..[.u..9_7.u.u.....y.ss....:_yQ<{..K.V_Z....c.G.N.a...?/..%. .-..K.td....4...5.(.e.`G7..]t?.3..\..... ....G.H...

Chrome Cache Entry: 78

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 352 x 3
Category:	dropped
Size (bytes):	2672
Entropy (8bit):	6.640973516071413
Encrypted:	false
SSDEEP:	48:ZaOdwduTYPpS9pZy9vDNi1miicsvrJkafMiS+MGQ09DU/X9/4Xp6m5Z9SQcq:4CIuTYPpSTc9vcPZX9/2gzQ/
MD5:	166DE53471265253AB3A456DEFE6DA23
SHA1:	17C6DF4D7CCF1FA2C9EFD716FBAE0FC2C71C8D6D
SHA-256:	A46201581A7C7C667FD42787CD1E9ADF2F6BF809EFB7596E61A03E8DBA9ADA13
SHA-512:	80978C1D262BC225A8BA1758DF546E27B5BE8D84CBCF7E6044910E5E05E04AFFEFEC3C0DA0818145EB8A917E1A8D90F4BAC833B64A1F6DE97AD3D5FC80A02308
Malicious:	false
Reputation:	low
Preview:	GIF89a`............!..NETSCAPE2.0.....!.......,....`.....6......P.l.......H....I..:qJ......k....`BY..L..&...!.......,....0.............<....[.\K8j.tr.g..!.......,....3............^;...\UK.]\.%.V.c...!.......,....7........`....lo...[.a..*Rw~i...!.......,....;........h.....l.G-.[K.,_XA]..'g..!.......,....?........i.....g....Z.}..)..u...F..!.......,....C...............P.,nt^.i....Xq...i..!.......,....F...........{^b....n.y..i...\C.-...!.......,....H..............R...o....h.xV!.z#...!.......,"...L.............r.jY..w~aP(.......[i...!.......,(...N.............r....w.aP.j.'.)Y..S..!.......,....H.........`......hew..9`.%z.xVeS..!.......,5...A.........`...\m.Vmtzw.}.d.%...Q..!.......,9...=.........h......3S..s.-W8m...Q..!.......,A...5.........h.....N...:..!..U..!.......,H.............h....M.x...f.i.4..!.......,O...'.........i...tp......(..!.......,X.............j...@.x....!.......,].............j..L..3em..!.......,e.............`......!.......,n..............{i..!..

Chrome Cache Entry: 79

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 113424
Category:	downloaded
Size (bytes):	20410
Entropy (8bit):	7.980582012022051
Encrypted:	false
SSDEEP:	384:8RvmaMFysnOXZ2m9zM+udO6GGUpeAU02oDGnN5EsQwWUQGTS8r2k:8pmm7ZFM+ObGGUIjN5PJV3Tp
MD5:	3BA4D76A17ADD0A6C34EE696F28C8541
SHA1:	5E8A4B8334539A7EAB798A7799F6E232016CB263
SHA-256:	17D6FF63DD857A72F37292B5906B40DC087EA27D7B1DEFCFA6DD1BA82AEA0B59
SHA-512:	8DA16A9759BB68A6B408F9F274B882ABB3EE7BA19F888448E495B721094BDB2CE5664E9A26BAE306A00491235EB94C143E53F618CCD6D50307C3C7F2EF1B4455
Malicious:	false
Reputation:	low
URL:	https://aadcdn.msauth.net/ests/2.1/content/cdnbundles/converged.v2.login.min_81imvbluez-v5hbzpkxfcg2.css
Preview:	...........}k..6..w...R..J.H=GSI..x.9...}T.....)Q..f<...~.F.h..x..{+.-.....h..n....</v.ev......W.,.bU..rW.I...0x...C..2...6]..W_......../x.........~.z.}.\|.#x......AgO.\|XgU...4 .^'U...mP.A.].Z.U.!..Y.......:.ve.?.!..d.N...xJ...mR......0.@p...lKr/...E.-. .....\|l.4.o.i.......L.iF..T{.n....2....VEY.y=..=..T+V./.b....\....7.sH.w{.h.....!.."F.k.!.......d...mS.rh.&G.../..h&..RE"!.A/.......A....L...8.q.M...t[...R...>.6;R..^.Vu..9.[F........>A.:HT}w]......2........p......'T.^]}.^..yJ>.<..pq..h.\|..j....j.x..-...c...f...=".)..U.X'.M..l.]ZVtl\.I..}.0.~B0Y'.N...E.4.Xd..e...a.........."..9+d.&..l.$E..R.u.g.Q..w&...~I. .y..D.4;..'.."-.....b...)k.n.M...,3J.z_..&2f.h;.&.R.y..P..X.....\P.....r...B.$........<....H5.M.."'#.6mQl..mQ5.=.\...O.....^..jM..u.F..Oh.lNI..j..T..u...I..._........{.\...{..._\|..={O..z..>......x..5Q.D7?{...^...^.......o.=.z......v......z.C...Gtw...0!..M@....^...^.x..G....W...{...)..y.<c3...^>{......7._..'d__...;R.

Chrome Cache Entry: 80

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 352 x 3
Category:	downloaded
Size (bytes):	2672
Entropy (8bit):	6.640973516071413
Encrypted:	false
SSDEEP:	48:ZaOdwduTYPpS9pZy9vDNi1miicsvrJkafMiS+MGQ09DU/X9/4Xp6m5Z9SQcq:4CIuTYPpSTc9vcPZX9/2gzQ/
MD5:	166DE53471265253AB3A456DEFE6DA23
SHA1:	17C6DF4D7CCF1FA2C9EFD716FBAE0FC2C71C8D6D
SHA-256:	A46201581A7C7C667FD42787CD1E9ADF2F6BF809EFB7596E61A03E8DBA9ADA13
SHA-512:	80978C1D262BC225A8BA1758DF546E27B5BE8D84CBCF7E6044910E5E05E04AFFEFEC3C0DA0818145EB8A917E1A8D90F4BAC833B64A1F6DE97AD3D5FC80A02308
Malicious:	false
Reputation:	low
URL:	https://aadcdn.msauth.net/shared/1.0/content/images/marching_ants_white_8257b0707cbe1d0bd2661b80068676fe.gif
Preview:	GIF89a`............!..NETSCAPE2.0.....!.......,....`.....6......P.l.......H....I..:qJ......k....`BY..L..&...!.......,....0.............<....[.\K8j.tr.g..!.......,....3............^;...\UK.]\.%.V.c...!.......,....7........`....lo...[.a..*Rw~i...!.......,....;........h.....l.G-.[K.,_XA]..'g..!.......,....?........i.....g....Z.}..)..u...F..!.......,....C...............P.,nt^.i....Xq...i..!.......,....F...........{^b....n.y..i...\C.-...!.......,....H..............R...o....h.xV!.z#...!.......,"...L.............r.jY..w~aP(.......[i...!.......,(...N.............r....w.aP.j.'.)Y..S..!.......,....H.........`......hew..9`.%z.xVeS..!.......,5...A.........`...\m.Vmtzw.}.d.%...Q..!.......,9...=.........h......3S..s.-W8m...Q..!.......,A...5.........h.....N...:..!..U..!.......,H.............h....M.x...f.i.4..!.......,O...'.........i...tp......(..!.......,X.............j...@.x....!.......,].............j..L..3em..!.......,e.............`......!.......,n..............{i..!..

Chrome Cache Entry: 81

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 113769
Category:	downloaded
Size (bytes):	35170
Entropy (8bit):	7.993096534744333
Encrypted:	true
SSDEEP:	768:K+LvEzA9nny7u0zF35Hm4ngomu6yeLDKDnccqmcmHvVVPCLVf:ny7f5GpuheL4htv3Pkf
MD5:	171A4DD9400708B88724B57D62B24A6A
SHA1:	9C6F1303B8F02FCE18D20EC9CADA11D38D0C4B37
SHA-256:	EA00750636C11DBD4FA3ACB1B3CDCBAE3EFA43F6B6C3753444B6D6A242AE9336
SHA-512:	5B13B63912B34E3EEEDD8DA5953B869A83DF82FFD2A8D737AA81DC984F1811800A534F340C48041DA803C25B6B8F5605EA8D003B6A09A1874408F95A710F5126
Malicious:	false
Reputation:	low
URL:	https://aadcdn.msauth.net/shared/1.0/content/js/asyncchunk/convergedlogin_pstringcustomizationhelper_cc2c59f5ef2c09e14b08.js
Preview:	...........kC.H.0......e....0.pX..Iv3..\f..0YY.m..e$.K..o...j..g.3.lpW.......[..Y.?k.Y.......8~.a..../_.;]{.............v...0..q.Dk.w...h-....Z<..l.fA..k3.7..dm....b..-...(,.$...4...f...e...AV..z.mA....O.9........k..h-.......<Z[.GQ.v3....Oq..y:..(..k.$_...._..h-...q..S.ck.=.T......Sq@.:.A.c.(....SDq..Ac.t..m.$Lc....Z...K...O<....f9..p...0Z..3.<...$YK.x.F......v....nm..s$...&..dQ4.......n-.-.......E.XD..-5~...f.....t...-_.....fsg...8kZ..\|.{{....p+Lg.t9I..P./ap......o9Wx.._{....k..,...............................7.\|..t...Ax.7..b..v..v.m-...~v...:....r..._........,...A........z.....\|..t.. [.C.....{...~..c......ua...~.v<.I..P#._{{}._.......Km...eR....u?GY..h..}..gAv...<.l.Z...#.....:P?Q..."..........,.D...I<._.'..-..=..;.>.C_..#.....D[0.Y..*...M.....{.YT,...x..SQ/......N<`...\|._.k....0)......+.Z..4...M. ...i...`.ml..-X.E.....d.. .}.e4.{6hz^..}....@....W.1...d8...>.@.....(.'[..`..A..?...yL.\|..QTF...-.='S@.Q.sM.`...}.t..$..y^..0J.kC.S...U.

Chrome Cache Entry: 82

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 57510
Category:	downloaded
Size (bytes):	16345
Entropy (8bit):	7.98960525258912
Encrypted:	false
SSDEEP:	384:hOBEj/gTOkWow6mhJqXnYI/0PiQBSoe122Yw/:hOBKJBXO586QB+11J
MD5:	187B9EBA41FDF66B2C8F7EB645D2BC17
SHA1:	B1C034F7F5F754F271D094FB417B9A820C1F712C
SHA-256:	CA0FBF8421A0CF4CCDA7310B2AE74CBD92214901EC2D0F273EA3B07F12CF96EA
SHA-512:	0D7FB682D24E97C9E3FC04AA87CCB8EC508CA0CF197DA0617EFFD981BC8B5E3600824FDD08F1F31F59D276B5BF53229D00805D984E01D512FD968610C5FE9609
Malicious:	false
Reputation:	low
URL:	https://aadcdn.msauth.net/ests/2.1/content/cdnbundles/ux.converged.login.strings-en.min_i8f-75gfk3tbsm8bmatnqa2.js
Preview:	...........}Ms#.......\.@..'F.........3RH2....~......Q.x7...}..'.}..?e#...QU]....Vo..................?........w!......=.G...P.../......8z....q._5....g..}g..31......l*...],.b..;..`...Y....3..5.uGAi..NP.6<.w.(..`...y..d.N.x..^u.....^...?..N........Fq.....z..wgN./..Ep/f..c/.D4~X.W~).s/.E8...T...8,:..Q.p>.....7.....4....Z,&c.)n.[.pcQp...4...&...i.............CkL=.....g..m&vG..p... ....:N`y...ea.,....[......^.../D#(y.....l4.n..,.=_.p2P.....A,..RP..E.T......8 .v....Iw.X..?.r......nk....?Wj..a.\|..........JAs.j......?.)..t.z.-..m.]..3y...3@...'.)...Aa..1.kQ.....l+.....-q..n.p..{^...$..{/...=a..A...4.VH}..SBwju......S..hN.P..-..O,..S7.J,.....p.iLU.6W.....eO.7 ..C...{.E.Z...1...5s.!uY...@^. ,D".N.E......5.NE..\...VQa.A7..X.B..{.q..Ra..S....x(x7.Cp.#.#..:.......D..`,!IGr.. ...z.?.._0O.......;..0.z.h....5.../...q..5.\|..B.OY..k...].Sw.>.".@..!.9.V\|...=.dv.3!sr.....#...X8s.w.\|7..O/....!.."...3.."D..)...[........!^....3(..{...F2'..q.....x........

Chrome Cache Entry: 83

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1864
Category:	dropped
Size (bytes):	673
Entropy (8bit):	7.6596900876595075
Encrypted:	false
SSDEEP:	12:Xl0t8TUViiYi5m6FhSBXWPsigK99WCqKMvBBFThSqfLd81CK6bC+k7LqZLsFlD:XFUVpkNK0Rwid81p6btk7LqZ6D
MD5:	0E176276362B94279A4492511BFCBD98
SHA1:	389FE6B51F62254BB98939896B8C89EBEFFE2A02
SHA-256:	9A2C174AE45CAC057822844211156A5ED293E65C5F69E1D211A7206472C5C80C
SHA-512:	8D61C9E464C8F3C77BF1729E32F92BBB1B426A19907E418862EFE117DBD1F0A26FCC3A6FE1D1B22B836853D43C964F6B6D25E414649767FBEA7FE10D2048D7A1
Malicious:	false
Reputation:	low
Preview:	...........U.n.0....}i..P..C..7l/..d........n...G....yl. .E.......Tu.F.........?$.i.s..s...C..wi$.....r....CT.U.FuS..r.e.~...G.q.....~M..mu}.0.=..&.~.e.WLX.....X..%p..i......7+.........?......WN..%>...$..c..}N....Y4?..x.1......#v...Gal9.!.9.A.u..b..>..".#A2"+...<qc.v....)3...x.p&..K.&..T.r.'....J.T....Q..=..H).X...<.r...KkX........)5i4.+.h.....5.<..5.^O.eC%V^....Nx.E..;..52..h....C"I./.`..O...f..r..n.h.r]}.G^..D.7..i.].}.G.].....{....oW............h.4...}~=6u..k...=.X..+z}.4.].....YS5..J......)......m....w.......~}.C.b_..[.u..9_7.u.u.....y.ss....:_yQ<{..K.V_Z....c.G.N.a...?/..%. .-..K.td....4...5.(.e.`G7..]t?.3..\..... ....G.H...

Chrome Cache Entry: 84

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 352 x 3
Category:	downloaded
Size (bytes):	3620
Entropy (8bit):	6.867828878374734
Encrypted:	false
SSDEEP:	48:ZumKaT5ezv47j2/ZiRDlq16x8XvEUcg777shHdpHVGJqFd:Eal647jPDlL8XvEUcg77kVGyd
MD5:	B540A8E518037192E32C4FE58BF2DBAB
SHA1:	3047C1DB97B86F6981E0AD2F96AF40CDF43511AF
SHA-256:	8737D721808655F37B333F08A90185699E7E8B9BDAAA15CDB63C8448B426F95D
SHA-512:	E3612D9E6809EC192F6E2D035290B730871C269A267115E4A5515CADB7E6E14E3DD4290A35ABAA8D14CF1FA3924DC76E11926AC341E0F6F372E9FC5434B546E5
Malicious:	false
Reputation:	low
URL:	https://aadcdn.msauth.net/shared/1.0/content/images/marching_ants_986f40b5a9dc7d39ef8396797f61b323.gif
Preview:	GIF89a`.........iii!.......!.&Edited with ezgif.com online GIF maker.!..NETSCAPE2.0.....,....`.....6......P.l.......H....I..:qJ......k....`BY..L..&...!.......,....`.....9..i....Q4......H..j.=.k9-5_..........j7..({.........!.......,....`.....9.......trV.......H....`.[.q6......>.. .CZ.&!.....M...!.......,....`.....8..........:......H..jJ..U..6_....../.el...q.).....!.......,....`.....9.....i..l.go.....H..".U...f......._......5......n..!.......,....`.....:..i......./.....H...5%.kE/5.........In.a..@&3.....J...!.......,....`.....9.......kr.j.....H...-.{Im5c..............@&.........!.......,....`.....9.........j..q....H...].&..\.5.........8..S..........!.......,....`.....9.......3q.g..5....H...:u..............Al..x.q.........!.......,....`.....9......\.F....z....H...zX...ov.........h3N.x4......j..!.......,....`.....9........Q.:......H....y..^...1.........n.!.F......E...!.......,....`.....8.........i,......H....*_.21.I.........%...

Chrome Cache Entry: 85

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors
Category:	dropped
Size (bytes):	17174
Entropy (8bit):	2.9129715116732746
Encrypted:	false
SSDEEP:	24:QSNTmTFxg4lyyyyyyyyyyyyyio7eeeeeeeeekzgsLsLsLsLsLsQZp:nfgyyyyyyyyyyyyynzQQQQQO
MD5:	12E3DAC858061D088023B2BD48E2FA96
SHA1:	E08CE1A144ECEAE0C3C2EA7A9D6FBC5658F24CE5
SHA-256:	90CDAF487716184E4034000935C605D1633926D348116D198F355A98B8C6CD21
SHA-512:	C5030C55A855E7A9E20E22F4C70BF1E0F3C558A9B7D501CFAB6992AC2656AE5E41B050CCAC541EFA55F9603E0D349B247EB4912EE169D44044271789C719CD01
Malicious:	false
Reputation:	low
Preview:	..............h(..f...HH...........(..00......h....6.. ...........=...............@..........(....A..(....................(....................................."P.........................................."""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333""""""""""""""""""""""""""

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 21, 2024 15:38:14.285698891 CET	49675	443	192.168.2.4	173.222.162.32
Dec 21, 2024 15:38:23.894186974 CET	49675	443	192.168.2.4	173.222.162.32
Dec 21, 2024 15:38:27.486635923 CET	49739	443	192.168.2.4	142.250.181.100
Dec 21, 2024 15:38:27.486679077 CET	443	49739	142.250.181.100	192.168.2.4
Dec 21, 2024 15:38:27.486752033 CET	49739	443	192.168.2.4	142.250.181.100
Dec 21, 2024 15:38:27.486974955 CET	49739	443	192.168.2.4	142.250.181.100
Dec 21, 2024 15:38:27.486988068 CET	443	49739	142.250.181.100	192.168.2.4
Dec 21, 2024 15:38:28.823338985 CET	49741	80	192.168.2.4	13.107.136.10
Dec 21, 2024 15:38:28.824007034 CET	49742	80	192.168.2.4	13.107.136.10
Dec 21, 2024 15:38:28.914961100 CET	49743	80	192.168.2.4	13.107.136.10
Dec 21, 2024 15:38:28.943504095 CET	80	49741	13.107.136.10	192.168.2.4
Dec 21, 2024 15:38:28.943603039 CET	49741	80	192.168.2.4	13.107.136.10
Dec 21, 2024 15:38:28.944164991 CET	80	49742	13.107.136.10	192.168.2.4
Dec 21, 2024 15:38:28.946748972 CET	49742	80	192.168.2.4	13.107.136.10
Dec 21, 2024 15:38:28.955842972 CET	49742	80	192.168.2.4	13.107.136.10
Dec 21, 2024 15:38:29.035269022 CET	80	49743	13.107.136.10	192.168.2.4
Dec 21, 2024 15:38:29.035482883 CET	49743	80	192.168.2.4	13.107.136.10
Dec 21, 2024 15:38:29.076141119 CET	80	49742	13.107.136.10	192.168.2.4
Dec 21, 2024 15:38:29.183804035 CET	443	49739	142.250.181.100	192.168.2.4
Dec 21, 2024 15:38:29.184048891 CET	49739	443	192.168.2.4	142.250.181.100
Dec 21, 2024 15:38:29.184071064 CET	443	49739	142.250.181.100	192.168.2.4
Dec 21, 2024 15:38:29.185076952 CET	443	49739	142.250.181.100	192.168.2.4
Dec 21, 2024 15:38:29.185163021 CET	49739	443	192.168.2.4	142.250.181.100
Dec 21, 2024 15:38:29.208473921 CET	49739	443	192.168.2.4	142.250.181.100
Dec 21, 2024 15:38:29.208621979 CET	443	49739	142.250.181.100	192.168.2.4
Dec 21, 2024 15:38:29.253844023 CET	49739	443	192.168.2.4	142.250.181.100
Dec 21, 2024 15:38:29.253874063 CET	443	49739	142.250.181.100	192.168.2.4
Dec 21, 2024 15:38:29.300383091 CET	49739	443	192.168.2.4	142.250.181.100
Dec 21, 2024 15:38:30.185576916 CET	80	49742	13.107.136.10	192.168.2.4
Dec 21, 2024 15:38:30.185640097 CET	80	49742	13.107.136.10	192.168.2.4
Dec 21, 2024 15:38:30.185903072 CET	49742	80	192.168.2.4	13.107.136.10
Dec 21, 2024 15:38:30.327672005 CET	49745	443	192.168.2.4	13.107.138.10
Dec 21, 2024 15:38:30.327759981 CET	443	49745	13.107.138.10	192.168.2.4
Dec 21, 2024 15:38:30.327934027 CET	49745	443	192.168.2.4	13.107.138.10
Dec 21, 2024 15:38:30.328136921 CET	49745	443	192.168.2.4	13.107.138.10
Dec 21, 2024 15:38:30.328191996 CET	443	49745	13.107.138.10	192.168.2.4
Dec 21, 2024 15:38:31.865504980 CET	443	49745	13.107.138.10	192.168.2.4
Dec 21, 2024 15:38:31.865804911 CET	49745	443	192.168.2.4	13.107.138.10
Dec 21, 2024 15:38:31.865891933 CET	443	49745	13.107.138.10	192.168.2.4
Dec 21, 2024 15:38:31.866878986 CET	443	49745	13.107.138.10	192.168.2.4
Dec 21, 2024 15:38:31.867060900 CET	49745	443	192.168.2.4	13.107.138.10
Dec 21, 2024 15:38:31.867897034 CET	49745	443	192.168.2.4	13.107.138.10
Dec 21, 2024 15:38:31.867974043 CET	443	49745	13.107.138.10	192.168.2.4
Dec 21, 2024 15:38:31.868645906 CET	49745	443	192.168.2.4	13.107.138.10
Dec 21, 2024 15:38:31.868701935 CET	443	49745	13.107.138.10	192.168.2.4
Dec 21, 2024 15:38:31.915199041 CET	49745	443	192.168.2.4	13.107.138.10
Dec 21, 2024 15:38:32.410671949 CET	443	49745	13.107.138.10	192.168.2.4
Dec 21, 2024 15:38:32.410828114 CET	443	49745	13.107.138.10	192.168.2.4
Dec 21, 2024 15:38:32.410897017 CET	49745	443	192.168.2.4	13.107.138.10
Dec 21, 2024 15:38:32.412360907 CET	49745	443	192.168.2.4	13.107.138.10
Dec 21, 2024 15:38:32.412425041 CET	443	49745	13.107.138.10	192.168.2.4
Dec 21, 2024 15:38:32.414170980 CET	49746	443	192.168.2.4	13.107.138.10
Dec 21, 2024 15:38:32.414226055 CET	443	49746	13.107.138.10	192.168.2.4
Dec 21, 2024 15:38:32.414290905 CET	49746	443	192.168.2.4	13.107.138.10
Dec 21, 2024 15:38:32.414542913 CET	49746	443	192.168.2.4	13.107.138.10
Dec 21, 2024 15:38:32.414556980 CET	443	49746	13.107.138.10	192.168.2.4
Dec 21, 2024 15:38:33.942189932 CET	443	49746	13.107.138.10	192.168.2.4
Dec 21, 2024 15:38:33.942470074 CET	49746	443	192.168.2.4	13.107.138.10
Dec 21, 2024 15:38:33.942492008 CET	443	49746	13.107.138.10	192.168.2.4
Dec 21, 2024 15:38:33.942815065 CET	443	49746	13.107.138.10	192.168.2.4
Dec 21, 2024 15:38:33.943136930 CET	49746	443	192.168.2.4	13.107.138.10
Dec 21, 2024 15:38:33.943195105 CET	443	49746	13.107.138.10	192.168.2.4
Dec 21, 2024 15:38:33.943259001 CET	49746	443	192.168.2.4	13.107.138.10
Dec 21, 2024 15:38:33.987330914 CET	443	49746	13.107.138.10	192.168.2.4
Dec 21, 2024 15:38:34.487010956 CET	443	49746	13.107.138.10	192.168.2.4
Dec 21, 2024 15:38:34.487090111 CET	443	49746	13.107.138.10	192.168.2.4
Dec 21, 2024 15:38:34.487144947 CET	49746	443	192.168.2.4	13.107.138.10
Dec 21, 2024 15:38:34.487706900 CET	49746	443	192.168.2.4	13.107.138.10
Dec 21, 2024 15:38:34.487720013 CET	443	49746	13.107.138.10	192.168.2.4
Dec 21, 2024 15:38:34.489806890 CET	49747	443	192.168.2.4	13.107.138.10
Dec 21, 2024 15:38:34.489900112 CET	443	49747	13.107.138.10	192.168.2.4
Dec 21, 2024 15:38:34.490009069 CET	49747	443	192.168.2.4	13.107.138.10
Dec 21, 2024 15:38:34.490185022 CET	49747	443	192.168.2.4	13.107.138.10
Dec 21, 2024 15:38:34.490221977 CET	443	49747	13.107.138.10	192.168.2.4
Dec 21, 2024 15:38:36.016129017 CET	443	49747	13.107.138.10	192.168.2.4
Dec 21, 2024 15:38:36.016479015 CET	49747	443	192.168.2.4	13.107.138.10
Dec 21, 2024 15:38:36.016541958 CET	443	49747	13.107.138.10	192.168.2.4
Dec 21, 2024 15:38:36.016905069 CET	443	49747	13.107.138.10	192.168.2.4
Dec 21, 2024 15:38:36.017405987 CET	49747	443	192.168.2.4	13.107.138.10
Dec 21, 2024 15:38:36.017507076 CET	49747	443	192.168.2.4	13.107.138.10
Dec 21, 2024 15:38:36.017537117 CET	443	49747	13.107.138.10	192.168.2.4
Dec 21, 2024 15:38:36.017563105 CET	443	49747	13.107.138.10	192.168.2.4
Dec 21, 2024 15:38:36.065665007 CET	49747	443	192.168.2.4	13.107.138.10
Dec 21, 2024 15:38:36.572819948 CET	443	49747	13.107.138.10	192.168.2.4
Dec 21, 2024 15:38:36.572838068 CET	443	49747	13.107.138.10	192.168.2.4
Dec 21, 2024 15:38:36.572869062 CET	443	49747	13.107.138.10	192.168.2.4
Dec 21, 2024 15:38:36.573018074 CET	49747	443	192.168.2.4	13.107.138.10
Dec 21, 2024 15:38:36.573086023 CET	443	49747	13.107.138.10	192.168.2.4
Dec 21, 2024 15:38:36.573142052 CET	49747	443	192.168.2.4	13.107.138.10
Dec 21, 2024 15:38:36.574640989 CET	49747	443	192.168.2.4	13.107.138.10
Dec 21, 2024 15:38:36.574641943 CET	49747	443	192.168.2.4	13.107.138.10
Dec 21, 2024 15:38:38.882663012 CET	443	49739	142.250.181.100	192.168.2.4
Dec 21, 2024 15:38:38.882723093 CET	443	49739	142.250.181.100	192.168.2.4
Dec 21, 2024 15:38:38.882798910 CET	49739	443	192.168.2.4	142.250.181.100
Dec 21, 2024 15:38:39.267021894 CET	49739	443	192.168.2.4	142.250.181.100
Dec 21, 2024 15:38:39.267055988 CET	443	49739	142.250.181.100	192.168.2.4
Dec 21, 2024 15:38:44.397737980 CET	49723	80	192.168.2.4	2.22.50.144
Dec 21, 2024 15:38:44.517911911 CET	80	49723	2.22.50.144	192.168.2.4
Dec 21, 2024 15:38:44.517995119 CET	49723	80	192.168.2.4	2.22.50.144
Dec 21, 2024 15:38:53.134483099 CET	49776	443	192.168.2.4	152.199.21.175
Dec 21, 2024 15:38:53.134574890 CET	443	49776	152.199.21.175	192.168.2.4
Dec 21, 2024 15:38:53.134677887 CET	49776	443	192.168.2.4	152.199.21.175
Dec 21, 2024 15:38:53.134849072 CET	49776	443	192.168.2.4	152.199.21.175
Dec 21, 2024 15:38:53.134891987 CET	443	49776	152.199.21.175	192.168.2.4
Dec 21, 2024 15:38:54.930392027 CET	443	49776	152.199.21.175	192.168.2.4
Dec 21, 2024 15:38:54.930785894 CET	49776	443	192.168.2.4	152.199.21.175
Dec 21, 2024 15:38:54.930849075 CET	443	49776	152.199.21.175	192.168.2.4
Dec 21, 2024 15:38:54.931854010 CET	443	49776	152.199.21.175	192.168.2.4
Dec 21, 2024 15:38:54.932074070 CET	49776	443	192.168.2.4	152.199.21.175
Dec 21, 2024 15:38:54.933053970 CET	49776	443	192.168.2.4	152.199.21.175
Dec 21, 2024 15:38:54.933131933 CET	49776	443	192.168.2.4	152.199.21.175
Dec 21, 2024 15:38:54.933159113 CET	443	49776	152.199.21.175	192.168.2.4
Dec 21, 2024 15:38:54.933185101 CET	443	49776	152.199.21.175	192.168.2.4
Dec 21, 2024 15:38:54.987386942 CET	49776	443	192.168.2.4	152.199.21.175
Dec 21, 2024 15:38:54.987467051 CET	443	49776	152.199.21.175	192.168.2.4
Dec 21, 2024 15:38:55.034248114 CET	49776	443	192.168.2.4	152.199.21.175
Dec 21, 2024 15:38:55.445211887 CET	443	49776	152.199.21.175	192.168.2.4
Dec 21, 2024 15:38:55.488611937 CET	49776	443	192.168.2.4	152.199.21.175
Dec 21, 2024 15:38:55.515176058 CET	443	49776	152.199.21.175	192.168.2.4
Dec 21, 2024 15:38:55.515187025 CET	443	49776	152.199.21.175	192.168.2.4
Dec 21, 2024 15:38:55.515223026 CET	443	49776	152.199.21.175	192.168.2.4
Dec 21, 2024 15:38:55.515240908 CET	443	49776	152.199.21.175	192.168.2.4
Dec 21, 2024 15:38:55.515249968 CET	443	49776	152.199.21.175	192.168.2.4
Dec 21, 2024 15:38:55.515265942 CET	49776	443	192.168.2.4	152.199.21.175
Dec 21, 2024 15:38:55.515265942 CET	49776	443	192.168.2.4	152.199.21.175
Dec 21, 2024 15:38:55.515355110 CET	443	49776	152.199.21.175	192.168.2.4
Dec 21, 2024 15:38:55.515412092 CET	49776	443	192.168.2.4	152.199.21.175
Dec 21, 2024 15:38:55.515412092 CET	49776	443	192.168.2.4	152.199.21.175
Dec 21, 2024 15:38:55.683393002 CET	443	49776	152.199.21.175	192.168.2.4
Dec 21, 2024 15:38:55.683403015 CET	443	49776	152.199.21.175	192.168.2.4
Dec 21, 2024 15:38:55.683435917 CET	443	49776	152.199.21.175	192.168.2.4
Dec 21, 2024 15:38:55.683459044 CET	443	49776	152.199.21.175	192.168.2.4
Dec 21, 2024 15:38:55.683485031 CET	49776	443	192.168.2.4	152.199.21.175
Dec 21, 2024 15:38:55.683504105 CET	443	49776	152.199.21.175	192.168.2.4
Dec 21, 2024 15:38:55.683528900 CET	49776	443	192.168.2.4	152.199.21.175
Dec 21, 2024 15:38:55.683546066 CET	49776	443	192.168.2.4	152.199.21.175
Dec 21, 2024 15:38:55.758027077 CET	443	49776	152.199.21.175	192.168.2.4
Dec 21, 2024 15:38:55.758049965 CET	443	49776	152.199.21.175	192.168.2.4
Dec 21, 2024 15:38:55.758220911 CET	49776	443	192.168.2.4	152.199.21.175
Dec 21, 2024 15:38:55.758285046 CET	443	49776	152.199.21.175	192.168.2.4
Dec 21, 2024 15:38:55.758344889 CET	49776	443	192.168.2.4	152.199.21.175
Dec 21, 2024 15:38:55.855654955 CET	443	49776	152.199.21.175	192.168.2.4
Dec 21, 2024 15:38:55.855674028 CET	443	49776	152.199.21.175	192.168.2.4
Dec 21, 2024 15:38:55.855880022 CET	49776	443	192.168.2.4	152.199.21.175
Dec 21, 2024 15:38:55.855945110 CET	443	49776	152.199.21.175	192.168.2.4
Dec 21, 2024 15:38:55.856019974 CET	49776	443	192.168.2.4	152.199.21.175
Dec 21, 2024 15:38:55.894236088 CET	443	49776	152.199.21.175	192.168.2.4
Dec 21, 2024 15:38:55.894253016 CET	443	49776	152.199.21.175	192.168.2.4
Dec 21, 2024 15:38:55.894337893 CET	49776	443	192.168.2.4	152.199.21.175
Dec 21, 2024 15:38:55.894401073 CET	443	49776	152.199.21.175	192.168.2.4
Dec 21, 2024 15:38:55.894464970 CET	49776	443	192.168.2.4	152.199.21.175
Dec 21, 2024 15:38:55.912986040 CET	443	49776	152.199.21.175	192.168.2.4
Dec 21, 2024 15:38:55.913007021 CET	443	49776	152.199.21.175	192.168.2.4
Dec 21, 2024 15:38:55.913188934 CET	49776	443	192.168.2.4	152.199.21.175
Dec 21, 2024 15:38:55.913189888 CET	49776	443	192.168.2.4	152.199.21.175
Dec 21, 2024 15:38:55.913275957 CET	443	49776	152.199.21.175	192.168.2.4
Dec 21, 2024 15:38:55.913337946 CET	49776	443	192.168.2.4	152.199.21.175
Dec 21, 2024 15:38:55.935081959 CET	443	49776	152.199.21.175	192.168.2.4
Dec 21, 2024 15:38:55.935098886 CET	443	49776	152.199.21.175	192.168.2.4
Dec 21, 2024 15:38:55.935291052 CET	49776	443	192.168.2.4	152.199.21.175
Dec 21, 2024 15:38:55.935384989 CET	443	49776	152.199.21.175	192.168.2.4
Dec 21, 2024 15:38:55.935446024 CET	49776	443	192.168.2.4	152.199.21.175
Dec 21, 2024 15:38:56.038111925 CET	443	49776	152.199.21.175	192.168.2.4
Dec 21, 2024 15:38:56.038130045 CET	443	49776	152.199.21.175	192.168.2.4
Dec 21, 2024 15:38:56.038191080 CET	49776	443	192.168.2.4	152.199.21.175
Dec 21, 2024 15:38:56.038259029 CET	443	49776	152.199.21.175	192.168.2.4
Dec 21, 2024 15:38:56.038299084 CET	49776	443	192.168.2.4	152.199.21.175
Dec 21, 2024 15:38:56.038321018 CET	49776	443	192.168.2.4	152.199.21.175
Dec 21, 2024 15:38:56.056617022 CET	443	49776	152.199.21.175	192.168.2.4
Dec 21, 2024 15:38:56.056636095 CET	443	49776	152.199.21.175	192.168.2.4
Dec 21, 2024 15:38:56.056704044 CET	49776	443	192.168.2.4	152.199.21.175
Dec 21, 2024 15:38:56.056768894 CET	443	49776	152.199.21.175	192.168.2.4
Dec 21, 2024 15:38:56.056828022 CET	49776	443	192.168.2.4	152.199.21.175
Dec 21, 2024 15:38:56.071449041 CET	443	49776	152.199.21.175	192.168.2.4
Dec 21, 2024 15:38:56.071466923 CET	443	49776	152.199.21.175	192.168.2.4
Dec 21, 2024 15:38:56.071628094 CET	49776	443	192.168.2.4	152.199.21.175
Dec 21, 2024 15:38:56.071628094 CET	49776	443	192.168.2.4	152.199.21.175
Dec 21, 2024 15:38:56.071692944 CET	443	49776	152.199.21.175	192.168.2.4
Dec 21, 2024 15:38:56.071753025 CET	49776	443	192.168.2.4	152.199.21.175
Dec 21, 2024 15:38:56.084824085 CET	443	49776	152.199.21.175	192.168.2.4
Dec 21, 2024 15:38:56.084840059 CET	443	49776	152.199.21.175	192.168.2.4
Dec 21, 2024 15:38:56.084980011 CET	49776	443	192.168.2.4	152.199.21.175
Dec 21, 2024 15:38:56.084980011 CET	49776	443	192.168.2.4	152.199.21.175
Dec 21, 2024 15:38:56.085052013 CET	443	49776	152.199.21.175	192.168.2.4
Dec 21, 2024 15:38:56.085104942 CET	49776	443	192.168.2.4	152.199.21.175
Dec 21, 2024 15:38:56.097635031 CET	443	49776	152.199.21.175	192.168.2.4
Dec 21, 2024 15:38:56.097651005 CET	443	49776	152.199.21.175	192.168.2.4
Dec 21, 2024 15:38:56.097840071 CET	49776	443	192.168.2.4	152.199.21.175
Dec 21, 2024 15:38:56.097907066 CET	443	49776	152.199.21.175	192.168.2.4
Dec 21, 2024 15:38:56.097976923 CET	49776	443	192.168.2.4	152.199.21.175
Dec 21, 2024 15:38:56.107084036 CET	443	49776	152.199.21.175	192.168.2.4
Dec 21, 2024 15:38:56.107100964 CET	443	49776	152.199.21.175	192.168.2.4
Dec 21, 2024 15:38:56.107284069 CET	49776	443	192.168.2.4	152.199.21.175
Dec 21, 2024 15:38:56.107284069 CET	49776	443	192.168.2.4	152.199.21.175
Dec 21, 2024 15:38:56.107378960 CET	443	49776	152.199.21.175	192.168.2.4
Dec 21, 2024 15:38:56.107445002 CET	49776	443	192.168.2.4	152.199.21.175
Dec 21, 2024 15:38:56.219069004 CET	443	49776	152.199.21.175	192.168.2.4
Dec 21, 2024 15:38:56.219089031 CET	443	49776	152.199.21.175	192.168.2.4
Dec 21, 2024 15:38:56.219150066 CET	49776	443	192.168.2.4	152.199.21.175
Dec 21, 2024 15:38:56.219218016 CET	443	49776	152.199.21.175	192.168.2.4
Dec 21, 2024 15:38:56.219286919 CET	49776	443	192.168.2.4	152.199.21.175
Dec 21, 2024 15:38:56.219286919 CET	49776	443	192.168.2.4	152.199.21.175
Dec 21, 2024 15:38:56.230758905 CET	443	49776	152.199.21.175	192.168.2.4
Dec 21, 2024 15:38:56.230776072 CET	443	49776	152.199.21.175	192.168.2.4
Dec 21, 2024 15:38:56.230828047 CET	49776	443	192.168.2.4	152.199.21.175
Dec 21, 2024 15:38:56.230895996 CET	443	49776	152.199.21.175	192.168.2.4
Dec 21, 2024 15:38:56.230951071 CET	49776	443	192.168.2.4	152.199.21.175
Dec 21, 2024 15:38:56.230951071 CET	49776	443	192.168.2.4	152.199.21.175
Dec 21, 2024 15:38:56.242645979 CET	443	49776	152.199.21.175	192.168.2.4
Dec 21, 2024 15:38:56.242661953 CET	443	49776	152.199.21.175	192.168.2.4
Dec 21, 2024 15:38:56.242721081 CET	49776	443	192.168.2.4	152.199.21.175
Dec 21, 2024 15:38:56.242786884 CET	443	49776	152.199.21.175	192.168.2.4
Dec 21, 2024 15:38:56.242831945 CET	49776	443	192.168.2.4	152.199.21.175
Dec 21, 2024 15:38:56.242831945 CET	49776	443	192.168.2.4	152.199.21.175
Dec 21, 2024 15:38:56.254132032 CET	443	49776	152.199.21.175	192.168.2.4
Dec 21, 2024 15:38:56.254153967 CET	443	49776	152.199.21.175	192.168.2.4
Dec 21, 2024 15:38:56.254425049 CET	49776	443	192.168.2.4	152.199.21.175
Dec 21, 2024 15:38:56.254425049 CET	49776	443	192.168.2.4	152.199.21.175
Dec 21, 2024 15:38:56.254489899 CET	443	49776	152.199.21.175	192.168.2.4
Dec 21, 2024 15:38:56.254549980 CET	49776	443	192.168.2.4	152.199.21.175
Dec 21, 2024 15:38:56.265172958 CET	443	49776	152.199.21.175	192.168.2.4
Dec 21, 2024 15:38:56.265187025 CET	443	49776	152.199.21.175	192.168.2.4
Dec 21, 2024 15:38:56.265356064 CET	49776	443	192.168.2.4	152.199.21.175
Dec 21, 2024 15:38:56.265423059 CET	443	49776	152.199.21.175	192.168.2.4
Dec 21, 2024 15:38:56.265482903 CET	49776	443	192.168.2.4	152.199.21.175
Dec 21, 2024 15:38:56.275110960 CET	443	49776	152.199.21.175	192.168.2.4
Dec 21, 2024 15:38:56.275126934 CET	443	49776	152.199.21.175	192.168.2.4
Dec 21, 2024 15:38:56.275360107 CET	49776	443	192.168.2.4	152.199.21.175
Dec 21, 2024 15:38:56.275360107 CET	49776	443	192.168.2.4	152.199.21.175
Dec 21, 2024 15:38:56.275461912 CET	443	49776	152.199.21.175	192.168.2.4
Dec 21, 2024 15:38:56.275525093 CET	49776	443	192.168.2.4	152.199.21.175
Dec 21, 2024 15:38:56.287235022 CET	443	49776	152.199.21.175	192.168.2.4
Dec 21, 2024 15:38:56.287250996 CET	443	49776	152.199.21.175	192.168.2.4
Dec 21, 2024 15:38:56.287379980 CET	49776	443	192.168.2.4	152.199.21.175
Dec 21, 2024 15:38:56.287379980 CET	49776	443	192.168.2.4	152.199.21.175
Dec 21, 2024 15:38:56.287447929 CET	443	49776	152.199.21.175	192.168.2.4
Dec 21, 2024 15:38:56.287502050 CET	49776	443	192.168.2.4	152.199.21.175
Dec 21, 2024 15:38:56.297969103 CET	443	49776	152.199.21.175	192.168.2.4
Dec 21, 2024 15:38:56.297982931 CET	443	49776	152.199.21.175	192.168.2.4
Dec 21, 2024 15:38:56.298166990 CET	49776	443	192.168.2.4	152.199.21.175
Dec 21, 2024 15:38:56.298166990 CET	49776	443	192.168.2.4	152.199.21.175
Dec 21, 2024 15:38:56.298233032 CET	443	49776	152.199.21.175	192.168.2.4
Dec 21, 2024 15:38:56.298358917 CET	49776	443	192.168.2.4	152.199.21.175
Dec 21, 2024 15:38:56.412683010 CET	443	49776	152.199.21.175	192.168.2.4
Dec 21, 2024 15:38:56.412699938 CET	443	49776	152.199.21.175	192.168.2.4
Dec 21, 2024 15:38:56.412856102 CET	49776	443	192.168.2.4	152.199.21.175
Dec 21, 2024 15:38:56.412856102 CET	49776	443	192.168.2.4	152.199.21.175
Dec 21, 2024 15:38:56.412923098 CET	443	49776	152.199.21.175	192.168.2.4
Dec 21, 2024 15:38:56.412978888 CET	49776	443	192.168.2.4	152.199.21.175
Dec 21, 2024 15:38:56.420535088 CET	443	49776	152.199.21.175	192.168.2.4
Dec 21, 2024 15:38:56.420550108 CET	443	49776	152.199.21.175	192.168.2.4
Dec 21, 2024 15:38:56.420627117 CET	49776	443	192.168.2.4	152.199.21.175
Dec 21, 2024 15:38:56.420628071 CET	49776	443	192.168.2.4	152.199.21.175
Dec 21, 2024 15:38:56.420694113 CET	443	49776	152.199.21.175	192.168.2.4
Dec 21, 2024 15:38:56.420747042 CET	49776	443	192.168.2.4	152.199.21.175
Dec 21, 2024 15:38:56.429138899 CET	443	49776	152.199.21.175	192.168.2.4
Dec 21, 2024 15:38:56.429157019 CET	443	49776	152.199.21.175	192.168.2.4
Dec 21, 2024 15:38:56.429341078 CET	49776	443	192.168.2.4	152.199.21.175
Dec 21, 2024 15:38:56.429341078 CET	49776	443	192.168.2.4	152.199.21.175
Dec 21, 2024 15:38:56.429406881 CET	443	49776	152.199.21.175	192.168.2.4
Dec 21, 2024 15:38:56.429466009 CET	49776	443	192.168.2.4	152.199.21.175
Dec 21, 2024 15:38:56.436633110 CET	443	49776	152.199.21.175	192.168.2.4
Dec 21, 2024 15:38:56.436667919 CET	443	49776	152.199.21.175	192.168.2.4
Dec 21, 2024 15:38:56.436718941 CET	443	49776	152.199.21.175	192.168.2.4
Dec 21, 2024 15:38:56.436868906 CET	49776	443	192.168.2.4	152.199.21.175
Dec 21, 2024 15:38:56.436868906 CET	49776	443	192.168.2.4	152.199.21.175
Dec 21, 2024 15:38:56.436868906 CET	49776	443	192.168.2.4	152.199.21.175
Dec 21, 2024 15:38:56.436973095 CET	49776	443	192.168.2.4	152.199.21.175
Dec 21, 2024 15:38:56.437011003 CET	443	49776	152.199.21.175	192.168.2.4
Dec 21, 2024 15:38:56.581892014 CET	49780	443	192.168.2.4	152.199.21.175
Dec 21, 2024 15:38:56.581928968 CET	443	49780	152.199.21.175	192.168.2.4
Dec 21, 2024 15:38:56.581985950 CET	49780	443	192.168.2.4	152.199.21.175
Dec 21, 2024 15:38:56.582425117 CET	49780	443	192.168.2.4	152.199.21.175
Dec 21, 2024 15:38:56.582437038 CET	443	49780	152.199.21.175	192.168.2.4
Dec 21, 2024 15:38:58.354769945 CET	443	49780	152.199.21.175	192.168.2.4
Dec 21, 2024 15:38:58.354993105 CET	49780	443	192.168.2.4	152.199.21.175
Dec 21, 2024 15:38:58.355015039 CET	443	49780	152.199.21.175	192.168.2.4
Dec 21, 2024 15:38:58.355868101 CET	443	49780	152.199.21.175	192.168.2.4
Dec 21, 2024 15:38:58.355930090 CET	49780	443	192.168.2.4	152.199.21.175
Dec 21, 2024 15:38:58.356215954 CET	49780	443	192.168.2.4	152.199.21.175
Dec 21, 2024 15:38:58.356266975 CET	443	49780	152.199.21.175	192.168.2.4
Dec 21, 2024 15:38:58.356322050 CET	49780	443	192.168.2.4	152.199.21.175
Dec 21, 2024 15:38:58.356328011 CET	443	49780	152.199.21.175	192.168.2.4
Dec 21, 2024 15:38:58.409823895 CET	49780	443	192.168.2.4	152.199.21.175
Dec 21, 2024 15:38:58.876734018 CET	443	49780	152.199.21.175	192.168.2.4
Dec 21, 2024 15:38:58.927306890 CET	49780	443	192.168.2.4	152.199.21.175
Dec 21, 2024 15:38:58.943837881 CET	443	49780	152.199.21.175	192.168.2.4
Dec 21, 2024 15:38:58.943845987 CET	443	49780	152.199.21.175	192.168.2.4
Dec 21, 2024 15:38:58.943875074 CET	443	49780	152.199.21.175	192.168.2.4
Dec 21, 2024 15:38:58.943886995 CET	443	49780	152.199.21.175	192.168.2.4
Dec 21, 2024 15:38:58.943900108 CET	443	49780	152.199.21.175	192.168.2.4
Dec 21, 2024 15:38:58.943912983 CET	49780	443	192.168.2.4	152.199.21.175
Dec 21, 2024 15:38:58.943927050 CET	443	49780	152.199.21.175	192.168.2.4
Dec 21, 2024 15:38:58.943963051 CET	49780	443	192.168.2.4	152.199.21.175
Dec 21, 2024 15:38:58.943994999 CET	49780	443	192.168.2.4	152.199.21.175
Dec 21, 2024 15:38:59.111776114 CET	443	49780	152.199.21.175	192.168.2.4
Dec 21, 2024 15:38:59.111785889 CET	443	49780	152.199.21.175	192.168.2.4
Dec 21, 2024 15:38:59.111814976 CET	443	49780	152.199.21.175	192.168.2.4
Dec 21, 2024 15:38:59.111845016 CET	49780	443	192.168.2.4	152.199.21.175
Dec 21, 2024 15:38:59.111855030 CET	443	49780	152.199.21.175	192.168.2.4
Dec 21, 2024 15:38:59.111890078 CET	49780	443	192.168.2.4	152.199.21.175
Dec 21, 2024 15:38:59.111910105 CET	49780	443	192.168.2.4	152.199.21.175
Dec 21, 2024 15:38:59.188556910 CET	443	49780	152.199.21.175	192.168.2.4
Dec 21, 2024 15:38:59.188570976 CET	443	49780	152.199.21.175	192.168.2.4
Dec 21, 2024 15:38:59.188616991 CET	49780	443	192.168.2.4	152.199.21.175
Dec 21, 2024 15:38:59.188627958 CET	443	49780	152.199.21.175	192.168.2.4
Dec 21, 2024 15:38:59.188672066 CET	49780	443	192.168.2.4	152.199.21.175
Dec 21, 2024 15:38:59.188679934 CET	49780	443	192.168.2.4	152.199.21.175
Dec 21, 2024 15:38:59.278127909 CET	443	49780	152.199.21.175	192.168.2.4
Dec 21, 2024 15:38:59.278155088 CET	443	49780	152.199.21.175	192.168.2.4
Dec 21, 2024 15:38:59.278198004 CET	49780	443	192.168.2.4	152.199.21.175
Dec 21, 2024 15:38:59.278212070 CET	443	49780	152.199.21.175	192.168.2.4
Dec 21, 2024 15:38:59.278238058 CET	49780	443	192.168.2.4	152.199.21.175
Dec 21, 2024 15:38:59.278254032 CET	49780	443	192.168.2.4	152.199.21.175
Dec 21, 2024 15:38:59.308139086 CET	443	49780	152.199.21.175	192.168.2.4
Dec 21, 2024 15:38:59.308155060 CET	443	49780	152.199.21.175	192.168.2.4
Dec 21, 2024 15:38:59.308199883 CET	49780	443	192.168.2.4	152.199.21.175
Dec 21, 2024 15:38:59.308207035 CET	443	49780	152.199.21.175	192.168.2.4
Dec 21, 2024 15:38:59.308240891 CET	49780	443	192.168.2.4	152.199.21.175
Dec 21, 2024 15:38:59.333110094 CET	443	49780	152.199.21.175	192.168.2.4
Dec 21, 2024 15:38:59.333127022 CET	443	49780	152.199.21.175	192.168.2.4
Dec 21, 2024 15:38:59.333175898 CET	49780	443	192.168.2.4	152.199.21.175
Dec 21, 2024 15:38:59.333185911 CET	443	49780	152.199.21.175	192.168.2.4
Dec 21, 2024 15:38:59.333223104 CET	49780	443	192.168.2.4	152.199.21.175
Dec 21, 2024 15:38:59.351511002 CET	443	49780	152.199.21.175	192.168.2.4
Dec 21, 2024 15:38:59.351535082 CET	443	49780	152.199.21.175	192.168.2.4
Dec 21, 2024 15:38:59.351564884 CET	49780	443	192.168.2.4	152.199.21.175
Dec 21, 2024 15:38:59.351572037 CET	443	49780	152.199.21.175	192.168.2.4
Dec 21, 2024 15:38:59.351624012 CET	49780	443	192.168.2.4	152.199.21.175
Dec 21, 2024 15:38:59.463531017 CET	443	49780	152.199.21.175	192.168.2.4
Dec 21, 2024 15:38:59.463548899 CET	443	49780	152.199.21.175	192.168.2.4
Dec 21, 2024 15:38:59.463591099 CET	49780	443	192.168.2.4	152.199.21.175
Dec 21, 2024 15:38:59.463603020 CET	443	49780	152.199.21.175	192.168.2.4
Dec 21, 2024 15:38:59.463625908 CET	49780	443	192.168.2.4	152.199.21.175
Dec 21, 2024 15:38:59.463643074 CET	49780	443	192.168.2.4	152.199.21.175
Dec 21, 2024 15:38:59.478914022 CET	443	49780	152.199.21.175	192.168.2.4
Dec 21, 2024 15:38:59.478928089 CET	443	49780	152.199.21.175	192.168.2.4
Dec 21, 2024 15:38:59.478966951 CET	49780	443	192.168.2.4	152.199.21.175
Dec 21, 2024 15:38:59.478976011 CET	443	49780	152.199.21.175	192.168.2.4
Dec 21, 2024 15:38:59.479015112 CET	49780	443	192.168.2.4	152.199.21.175
Dec 21, 2024 15:38:59.491493940 CET	443	49780	152.199.21.175	192.168.2.4
Dec 21, 2024 15:38:59.491509914 CET	443	49780	152.199.21.175	192.168.2.4
Dec 21, 2024 15:38:59.491542101 CET	49780	443	192.168.2.4	152.199.21.175
Dec 21, 2024 15:38:59.491549969 CET	443	49780	152.199.21.175	192.168.2.4
Dec 21, 2024 15:38:59.491575956 CET	49780	443	192.168.2.4	152.199.21.175
Dec 21, 2024 15:38:59.491592884 CET	49780	443	192.168.2.4	152.199.21.175
Dec 21, 2024 15:38:59.506802082 CET	443	49780	152.199.21.175	192.168.2.4
Dec 21, 2024 15:38:59.506817102 CET	443	49780	152.199.21.175	192.168.2.4
Dec 21, 2024 15:38:59.506853104 CET	49780	443	192.168.2.4	152.199.21.175
Dec 21, 2024 15:38:59.506858110 CET	443	49780	152.199.21.175	192.168.2.4
Dec 21, 2024 15:38:59.506881952 CET	49780	443	192.168.2.4	152.199.21.175
Dec 21, 2024 15:38:59.506901026 CET	49780	443	192.168.2.4	152.199.21.175
Dec 21, 2024 15:38:59.519829035 CET	443	49780	152.199.21.175	192.168.2.4
Dec 21, 2024 15:38:59.519844055 CET	443	49780	152.199.21.175	192.168.2.4
Dec 21, 2024 15:38:59.519879103 CET	49780	443	192.168.2.4	152.199.21.175
Dec 21, 2024 15:38:59.519882917 CET	443	49780	152.199.21.175	192.168.2.4
Dec 21, 2024 15:38:59.519913912 CET	49780	443	192.168.2.4	152.199.21.175
Dec 21, 2024 15:38:59.534220934 CET	443	49780	152.199.21.175	192.168.2.4
Dec 21, 2024 15:38:59.534239054 CET	443	49780	152.199.21.175	192.168.2.4
Dec 21, 2024 15:38:59.534281969 CET	49780	443	192.168.2.4	152.199.21.175
Dec 21, 2024 15:38:59.534288883 CET	443	49780	152.199.21.175	192.168.2.4
Dec 21, 2024 15:38:59.534337044 CET	49780	443	192.168.2.4	152.199.21.175
Dec 21, 2024 15:38:59.649039030 CET	443	49780	152.199.21.175	192.168.2.4
Dec 21, 2024 15:38:59.649055004 CET	443	49780	152.199.21.175	192.168.2.4
Dec 21, 2024 15:38:59.649102926 CET	49780	443	192.168.2.4	152.199.21.175
Dec 21, 2024 15:38:59.649111986 CET	443	49780	152.199.21.175	192.168.2.4
Dec 21, 2024 15:38:59.649148941 CET	49780	443	192.168.2.4	152.199.21.175
Dec 21, 2024 15:38:59.658703089 CET	443	49780	152.199.21.175	192.168.2.4
Dec 21, 2024 15:38:59.658716917 CET	443	49780	152.199.21.175	192.168.2.4
Dec 21, 2024 15:38:59.658752918 CET	49780	443	192.168.2.4	152.199.21.175
Dec 21, 2024 15:38:59.658759117 CET	443	49780	152.199.21.175	192.168.2.4
Dec 21, 2024 15:38:59.658787012 CET	49780	443	192.168.2.4	152.199.21.175
Dec 21, 2024 15:38:59.658809900 CET	49780	443	192.168.2.4	152.199.21.175
Dec 21, 2024 15:38:59.669168949 CET	443	49780	152.199.21.175	192.168.2.4
Dec 21, 2024 15:38:59.669184923 CET	443	49780	152.199.21.175	192.168.2.4
Dec 21, 2024 15:38:59.669224977 CET	49780	443	192.168.2.4	152.199.21.175
Dec 21, 2024 15:38:59.669230938 CET	443	49780	152.199.21.175	192.168.2.4
Dec 21, 2024 15:38:59.669265985 CET	49780	443	192.168.2.4	152.199.21.175
Dec 21, 2024 15:38:59.679636955 CET	443	49780	152.199.21.175	192.168.2.4
Dec 21, 2024 15:38:59.679655075 CET	443	49780	152.199.21.175	192.168.2.4
Dec 21, 2024 15:38:59.679693937 CET	49780	443	192.168.2.4	152.199.21.175
Dec 21, 2024 15:38:59.679699898 CET	443	49780	152.199.21.175	192.168.2.4
Dec 21, 2024 15:38:59.679732084 CET	49780	443	192.168.2.4	152.199.21.175
Dec 21, 2024 15:38:59.688625097 CET	443	49780	152.199.21.175	192.168.2.4
Dec 21, 2024 15:38:59.688640118 CET	443	49780	152.199.21.175	192.168.2.4
Dec 21, 2024 15:38:59.688678026 CET	49780	443	192.168.2.4	152.199.21.175
Dec 21, 2024 15:38:59.688683987 CET	443	49780	152.199.21.175	192.168.2.4
Dec 21, 2024 15:38:59.688725948 CET	49780	443	192.168.2.4	152.199.21.175
Dec 21, 2024 15:38:59.699753046 CET	443	49780	152.199.21.175	192.168.2.4
Dec 21, 2024 15:38:59.699768066 CET	443	49780	152.199.21.175	192.168.2.4
Dec 21, 2024 15:38:59.699810982 CET	49780	443	192.168.2.4	152.199.21.175
Dec 21, 2024 15:38:59.699816942 CET	443	49780	152.199.21.175	192.168.2.4
Dec 21, 2024 15:38:59.699851990 CET	49780	443	192.168.2.4	152.199.21.175
Dec 21, 2024 15:38:59.708865881 CET	443	49780	152.199.21.175	192.168.2.4
Dec 21, 2024 15:38:59.708879948 CET	443	49780	152.199.21.175	192.168.2.4
Dec 21, 2024 15:38:59.708921909 CET	49780	443	192.168.2.4	152.199.21.175
Dec 21, 2024 15:38:59.708926916 CET	443	49780	152.199.21.175	192.168.2.4
Dec 21, 2024 15:38:59.708961010 CET	49780	443	192.168.2.4	152.199.21.175
Dec 21, 2024 15:38:59.719105959 CET	443	49780	152.199.21.175	192.168.2.4
Dec 21, 2024 15:38:59.719120979 CET	443	49780	152.199.21.175	192.168.2.4
Dec 21, 2024 15:38:59.719172955 CET	49780	443	192.168.2.4	152.199.21.175
Dec 21, 2024 15:38:59.719177961 CET	443	49780	152.199.21.175	192.168.2.4
Dec 21, 2024 15:38:59.719187021 CET	49780	443	192.168.2.4	152.199.21.175
Dec 21, 2024 15:38:59.719208956 CET	49780	443	192.168.2.4	152.199.21.175
Dec 21, 2024 15:38:59.840991974 CET	443	49780	152.199.21.175	192.168.2.4
Dec 21, 2024 15:38:59.841012955 CET	443	49780	152.199.21.175	192.168.2.4
Dec 21, 2024 15:38:59.841052055 CET	49780	443	192.168.2.4	152.199.21.175
Dec 21, 2024 15:38:59.841063023 CET	443	49780	152.199.21.175	192.168.2.4
Dec 21, 2024 15:38:59.841089964 CET	49780	443	192.168.2.4	152.199.21.175
Dec 21, 2024 15:38:59.841108084 CET	49780	443	192.168.2.4	152.199.21.175
Dec 21, 2024 15:38:59.849971056 CET	443	49780	152.199.21.175	192.168.2.4
Dec 21, 2024 15:38:59.849984884 CET	443	49780	152.199.21.175	192.168.2.4
Dec 21, 2024 15:38:59.850020885 CET	49780	443	192.168.2.4	152.199.21.175
Dec 21, 2024 15:38:59.850025892 CET	443	49780	152.199.21.175	192.168.2.4
Dec 21, 2024 15:38:59.850050926 CET	49780	443	192.168.2.4	152.199.21.175
Dec 21, 2024 15:38:59.850063086 CET	49780	443	192.168.2.4	152.199.21.175
Dec 21, 2024 15:38:59.857978106 CET	443	49780	152.199.21.175	192.168.2.4
Dec 21, 2024 15:38:59.857992887 CET	443	49780	152.199.21.175	192.168.2.4
Dec 21, 2024 15:38:59.858026028 CET	49780	443	192.168.2.4	152.199.21.175
Dec 21, 2024 15:38:59.858031988 CET	443	49780	152.199.21.175	192.168.2.4
Dec 21, 2024 15:38:59.858059883 CET	49780	443	192.168.2.4	152.199.21.175
Dec 21, 2024 15:38:59.858077049 CET	49780	443	192.168.2.4	152.199.21.175
Dec 21, 2024 15:38:59.865905046 CET	443	49780	152.199.21.175	192.168.2.4
Dec 21, 2024 15:38:59.865938902 CET	443	49780	152.199.21.175	192.168.2.4
Dec 21, 2024 15:38:59.865953922 CET	49780	443	192.168.2.4	152.199.21.175
Dec 21, 2024 15:38:59.865958929 CET	443	49780	152.199.21.175	192.168.2.4
Dec 21, 2024 15:38:59.865987062 CET	49780	443	192.168.2.4	152.199.21.175
Dec 21, 2024 15:38:59.865998030 CET	443	49780	152.199.21.175	192.168.2.4
Dec 21, 2024 15:38:59.866033077 CET	49780	443	192.168.2.4	152.199.21.175
Dec 21, 2024 15:38:59.866141081 CET	49780	443	192.168.2.4	152.199.21.175
Dec 21, 2024 15:38:59.866153002 CET	443	49780	152.199.21.175	192.168.2.4
Dec 21, 2024 15:39:13.956406116 CET	49741	80	192.168.2.4	13.107.136.10
Dec 21, 2024 15:39:14.041346073 CET	49743	80	192.168.2.4	13.107.136.10
Dec 21, 2024 15:39:14.076471090 CET	80	49741	13.107.136.10	192.168.2.4
Dec 21, 2024 15:39:14.161607981 CET	80	49743	13.107.136.10	192.168.2.4
Dec 21, 2024 15:39:15.191097021 CET	49742	80	192.168.2.4	13.107.136.10
Dec 21, 2024 15:39:15.311378956 CET	80	49742	13.107.136.10	192.168.2.4
Dec 21, 2024 15:39:27.410706997 CET	49811	443	192.168.2.4	142.250.181.100
Dec 21, 2024 15:39:27.410825014 CET	443	49811	142.250.181.100	192.168.2.4
Dec 21, 2024 15:39:27.410917044 CET	49811	443	192.168.2.4	142.250.181.100
Dec 21, 2024 15:39:27.411139011 CET	49811	443	192.168.2.4	142.250.181.100
Dec 21, 2024 15:39:27.411189079 CET	443	49811	142.250.181.100	192.168.2.4
Dec 21, 2024 15:39:29.107250929 CET	443	49811	142.250.181.100	192.168.2.4
Dec 21, 2024 15:39:29.107507944 CET	49811	443	192.168.2.4	142.250.181.100
Dec 21, 2024 15:39:29.107531071 CET	443	49811	142.250.181.100	192.168.2.4
Dec 21, 2024 15:39:29.107990980 CET	443	49811	142.250.181.100	192.168.2.4
Dec 21, 2024 15:39:29.108411074 CET	49811	443	192.168.2.4	142.250.181.100
Dec 21, 2024 15:39:29.108496904 CET	443	49811	142.250.181.100	192.168.2.4
Dec 21, 2024 15:39:29.159265995 CET	49811	443	192.168.2.4	142.250.181.100
Dec 21, 2024 15:39:29.223588943 CET	49741	80	192.168.2.4	13.107.136.10
Dec 21, 2024 15:39:29.223629951 CET	49743	80	192.168.2.4	13.107.136.10
Dec 21, 2024 15:39:29.344157934 CET	80	49741	13.107.136.10	192.168.2.4
Dec 21, 2024 15:39:29.344221115 CET	49741	80	192.168.2.4	13.107.136.10
Dec 21, 2024 15:39:29.344786882 CET	80	49743	13.107.136.10	192.168.2.4
Dec 21, 2024 15:39:29.344861984 CET	49743	80	192.168.2.4	13.107.136.10
Dec 21, 2024 15:39:31.441284895 CET	49724	80	192.168.2.4	23.32.238.18
Dec 21, 2024 15:39:31.594772100 CET	80	49724	23.32.238.18	192.168.2.4
Dec 21, 2024 15:39:31.594830036 CET	49724	80	192.168.2.4	23.32.238.18
Dec 21, 2024 15:39:34.687737942 CET	80	49742	13.107.136.10	192.168.2.4
Dec 21, 2024 15:39:34.687840939 CET	49742	80	192.168.2.4	13.107.136.10
Dec 21, 2024 15:39:35.223725080 CET	49742	80	192.168.2.4	13.107.136.10
Dec 21, 2024 15:39:35.343655109 CET	80	49742	13.107.136.10	192.168.2.4
Dec 21, 2024 15:39:38.805684090 CET	443	49811	142.250.181.100	192.168.2.4
Dec 21, 2024 15:39:38.805746078 CET	443	49811	142.250.181.100	192.168.2.4
Dec 21, 2024 15:39:38.805846930 CET	49811	443	192.168.2.4	142.250.181.100
Dec 21, 2024 15:39:39.223885059 CET	49811	443	192.168.2.4	142.250.181.100
Dec 21, 2024 15:39:39.223917007 CET	443	49811	142.250.181.100	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 21, 2024 15:38:22.838522911 CET	53	62052	1.1.1.1	192.168.2.4
Dec 21, 2024 15:38:22.978811026 CET	53	59790	1.1.1.1	192.168.2.4
Dec 21, 2024 15:38:25.703208923 CET	53	53493	1.1.1.1	192.168.2.4
Dec 21, 2024 15:38:27.347980976 CET	57107	53	192.168.2.4	1.1.1.1
Dec 21, 2024 15:38:27.348133087 CET	55641	53	192.168.2.4	1.1.1.1
Dec 21, 2024 15:38:27.485375881 CET	53	55641	1.1.1.1	192.168.2.4
Dec 21, 2024 15:38:27.485690117 CET	53	57107	1.1.1.1	192.168.2.4
Dec 21, 2024 15:38:28.100549936 CET	56528	53	192.168.2.4	1.1.1.1
Dec 21, 2024 15:38:28.100899935 CET	57790	53	192.168.2.4	1.1.1.1
Dec 21, 2024 15:38:30.188551903 CET	52219	53	192.168.2.4	1.1.1.1
Dec 21, 2024 15:38:30.188817024 CET	62330	53	192.168.2.4	1.1.1.1
Dec 21, 2024 15:38:36.575535059 CET	59579	53	192.168.2.4	1.1.1.1
Dec 21, 2024 15:38:36.575685024 CET	59566	53	192.168.2.4	1.1.1.1
Dec 21, 2024 15:38:42.726350069 CET	53	63369	1.1.1.1	192.168.2.4
Dec 21, 2024 15:38:43.025645971 CET	138	138	192.168.2.4	192.168.2.255
Dec 21, 2024 15:38:44.352826118 CET	61790	53	192.168.2.4	1.1.1.1
Dec 21, 2024 15:38:44.352979898 CET	55486	53	192.168.2.4	1.1.1.1
Dec 21, 2024 15:38:45.050230980 CET	55391	53	192.168.2.4	1.1.1.1
Dec 21, 2024 15:38:45.050807953 CET	60471	53	192.168.2.4	1.1.1.1
Dec 21, 2024 15:38:45.187489986 CET	53	55391	1.1.1.1	192.168.2.4
Dec 21, 2024 15:38:45.189598083 CET	53	60471	1.1.1.1	192.168.2.4
Dec 21, 2024 15:38:56.443113089 CET	52945	53	192.168.2.4	1.1.1.1
Dec 21, 2024 15:38:56.443238020 CET	49209	53	192.168.2.4	1.1.1.1
Dec 21, 2024 15:38:56.580915928 CET	53	49209	1.1.1.1	192.168.2.4
Dec 21, 2024 15:38:56.580957890 CET	53	52945	1.1.1.1	192.168.2.4
Dec 21, 2024 15:38:56.721016884 CET	53	63085	1.1.1.1	192.168.2.4
Dec 21, 2024 15:39:01.522306919 CET	53	58975	1.1.1.1	192.168.2.4
Dec 21, 2024 15:39:11.362174034 CET	55332	53	192.168.2.4	1.1.1.1
Dec 21, 2024 15:39:11.362296104 CET	55488	53	192.168.2.4	1.1.1.1
Dec 21, 2024 15:39:22.807014942 CET	53	61584	1.1.1.1	192.168.2.4
Dec 21, 2024 15:39:24.236224890 CET	53	61910	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 21, 2024 15:38:27.347980976 CET	192.168.2.4	1.1.1.1	0x4501	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Dec 21, 2024 15:38:27.348133087 CET	192.168.2.4	1.1.1.1	0xa0e3	Standard query (0)	www.google.com	65	IN (0x0001)	false
Dec 21, 2024 15:38:28.100549936 CET	192.168.2.4	1.1.1.1	0xdc53	Standard query (0)	securityupdatehub-my.sharepoint.com	A (IP address)	IN (0x0001)	false
Dec 21, 2024 15:38:28.100899935 CET	192.168.2.4	1.1.1.1	0x539e	Standard query (0)	securityupdatehub-my.sharepoint.com	65	IN (0x0001)	false
Dec 21, 2024 15:38:30.188551903 CET	192.168.2.4	1.1.1.1	0x84d9	Standard query (0)	securityupdatehub-my.sharepoint.com	A (IP address)	IN (0x0001)	false
Dec 21, 2024 15:38:30.188817024 CET	192.168.2.4	1.1.1.1	0xec5f	Standard query (0)	securityupdatehub-my.sharepoint.com	65	IN (0x0001)	false
Dec 21, 2024 15:38:36.575535059 CET	192.168.2.4	1.1.1.1	0x913b	Standard query (0)	login.microsoftonline.com	A (IP address)	IN (0x0001)	false
Dec 21, 2024 15:38:36.575685024 CET	192.168.2.4	1.1.1.1	0x736c	Standard query (0)	login.microsoftonline.com	65	IN (0x0001)	false
Dec 21, 2024 15:38:44.352826118 CET	192.168.2.4	1.1.1.1	0xd5d5	Standard query (0)	identity.nel.measure.office.net	A (IP address)	IN (0x0001)	false
Dec 21, 2024 15:38:44.352979898 CET	192.168.2.4	1.1.1.1	0x625b	Standard query (0)	identity.nel.measure.office.net	65	IN (0x0001)	false
Dec 21, 2024 15:38:45.050230980 CET	192.168.2.4	1.1.1.1	0xc2b8	Standard query (0)	aadcdn.msftauth.net	A (IP address)	IN (0x0001)	false
Dec 21, 2024 15:38:45.050807953 CET	192.168.2.4	1.1.1.1	0x4284	Standard query (0)	aadcdn.msftauth.net	65	IN (0x0001)	false
Dec 21, 2024 15:38:56.443113089 CET	192.168.2.4	1.1.1.1	0xb702	Standard query (0)	aadcdn.msftauth.net	A (IP address)	IN (0x0001)	false
Dec 21, 2024 15:38:56.443238020 CET	192.168.2.4	1.1.1.1	0x6c9	Standard query (0)	aadcdn.msftauth.net	65	IN (0x0001)	false
Dec 21, 2024 15:39:11.362174034 CET	192.168.2.4	1.1.1.1	0x13c7	Standard query (0)	login.microsoftonline.com	A (IP address)	IN (0x0001)	false
Dec 21, 2024 15:39:11.362296104 CET	192.168.2.4	1.1.1.1	0xc1d9	Standard query (0)	login.microsoftonline.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 21, 2024 15:38:27.485375881 CET	1.1.1.1	192.168.2.4	0xa0e3	No error (0)	www.google.com			65	IN (0x0001)	false
Dec 21, 2024 15:38:27.485690117 CET	1.1.1.1	192.168.2.4	0x4501	No error (0)	www.google.com		142.250.181.100	A (IP address)	IN (0x0001)	false
Dec 21, 2024 15:38:28.727150917 CET	1.1.1.1	192.168.2.4	0x539e	No error (0)	securityupdatehub-my.sharepoint.com	securityupdatehub.sharepoint.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 21, 2024 15:38:28.727150917 CET	1.1.1.1	192.168.2.4	0x539e	No error (0)	securityupdatehub.sharepoint.com	7110-ipv4v6e.clump.dprodmgd105.aa-rt.sharepoint.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 21, 2024 15:38:28.727150917 CET	1.1.1.1	192.168.2.4	0x539e	No error (0)	7110-ipv4v6e.clump.dprodmgd105.aa-rt.sharepoint.com	193771-ipv4v6e.farm.dprodmgd105.aa-rt.sharepoint.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 21, 2024 15:38:28.727150917 CET	1.1.1.1	192.168.2.4	0x539e	No error (0)	193771-ipv4v6e.farm.dprodmgd105.aa-rt.sharepoint.com	193771-ipv4v6e.farm.dprodmgd105.sharepointonline.com.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 21, 2024 15:38:28.822010040 CET	1.1.1.1	192.168.2.4	0xdc53	No error (0)	securityupdatehub-my.sharepoint.com	securityupdatehub.sharepoint.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 21, 2024 15:38:28.822010040 CET	1.1.1.1	192.168.2.4	0xdc53	No error (0)	securityupdatehub.sharepoint.com	7110-ipv4v6e.clump.dprodmgd105.aa-rt.sharepoint.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 21, 2024 15:38:28.822010040 CET	1.1.1.1	192.168.2.4	0xdc53	No error (0)	7110-ipv4v6e.clump.dprodmgd105.aa-rt.sharepoint.com	193771-ipv4v6e.farm.dprodmgd105.aa-rt.sharepoint.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 21, 2024 15:38:28.822010040 CET	1.1.1.1	192.168.2.4	0xdc53	No error (0)	193771-ipv4v6e.farm.dprodmgd105.aa-rt.sharepoint.com	193771-ipv4v6e.farm.dprodmgd105.sharepointonline.com.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 21, 2024 15:38:28.822010040 CET	1.1.1.1	192.168.2.4	0xdc53	No error (0)	193771-ipv4v6.farm.dprodmgd105.aa-rt.sharepoint.com.dual-spo-0005.spo-msedge.net	dual-spo-0005.spo-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 21, 2024 15:38:28.822010040 CET	1.1.1.1	192.168.2.4	0xdc53	No error (0)	dual-spo-0005.spo-msedge.net		13.107.136.10	A (IP address)	IN (0x0001)	false
Dec 21, 2024 15:38:28.822010040 CET	1.1.1.1	192.168.2.4	0xdc53	No error (0)	dual-spo-0005.spo-msedge.net		13.107.138.10	A (IP address)	IN (0x0001)	false
Dec 21, 2024 15:38:30.326297998 CET	1.1.1.1	192.168.2.4	0x84d9	No error (0)	securityupdatehub-my.sharepoint.com	securityupdatehub.sharepoint.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 21, 2024 15:38:30.326297998 CET	1.1.1.1	192.168.2.4	0x84d9	No error (0)	securityupdatehub.sharepoint.com	7110-ipv4v6e.clump.dprodmgd105.aa-rt.sharepoint.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 21, 2024 15:38:30.326297998 CET	1.1.1.1	192.168.2.4	0x84d9	No error (0)	7110-ipv4v6e.clump.dprodmgd105.aa-rt.sharepoint.com	193771-ipv4v6e.farm.dprodmgd105.aa-rt.sharepoint.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 21, 2024 15:38:30.326297998 CET	1.1.1.1	192.168.2.4	0x84d9	No error (0)	193771-ipv4v6e.farm.dprodmgd105.aa-rt.sharepoint.com	193771-ipv4v6e.farm.dprodmgd105.sharepointonline.com.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 21, 2024 15:38:30.326297998 CET	1.1.1.1	192.168.2.4	0x84d9	No error (0)	193771-ipv4v6.farm.dprodmgd105.aa-rt.sharepoint.com.dual-spo-0005.spo-msedge.net	dual-spo-0005.spo-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 21, 2024 15:38:30.326297998 CET	1.1.1.1	192.168.2.4	0x84d9	No error (0)	dual-spo-0005.spo-msedge.net		13.107.138.10	A (IP address)	IN (0x0001)	false
Dec 21, 2024 15:38:30.326297998 CET	1.1.1.1	192.168.2.4	0x84d9	No error (0)	dual-spo-0005.spo-msedge.net		13.107.136.10	A (IP address)	IN (0x0001)	false
Dec 21, 2024 15:38:30.326951981 CET	1.1.1.1	192.168.2.4	0xec5f	No error (0)	securityupdatehub-my.sharepoint.com	securityupdatehub.sharepoint.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 21, 2024 15:38:30.326951981 CET	1.1.1.1	192.168.2.4	0xec5f	No error (0)	securityupdatehub.sharepoint.com	7110-ipv4v6e.clump.dprodmgd105.aa-rt.sharepoint.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 21, 2024 15:38:30.326951981 CET	1.1.1.1	192.168.2.4	0xec5f	No error (0)	7110-ipv4v6e.clump.dprodmgd105.aa-rt.sharepoint.com	193771-ipv4v6e.farm.dprodmgd105.aa-rt.sharepoint.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 21, 2024 15:38:30.326951981 CET	1.1.1.1	192.168.2.4	0xec5f	No error (0)	193771-ipv4v6e.farm.dprodmgd105.aa-rt.sharepoint.com	193771-ipv4v6e.farm.dprodmgd105.sharepointonline.com.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 21, 2024 15:38:36.712712049 CET	1.1.1.1	192.168.2.4	0x913b	No error (0)	login.microsoftonline.com	login.mso.msidentity.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 21, 2024 15:38:36.712737083 CET	1.1.1.1	192.168.2.4	0x736c	No error (0)	login.microsoftonline.com	login.mso.msidentity.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 21, 2024 15:38:39.479093075 CET	1.1.1.1	192.168.2.4	0xe162	No error (0)	shed.dual-low.s-part-0035.t-0009.t-msedge.net	s-part-0035.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 21, 2024 15:38:39.479093075 CET	1.1.1.1	192.168.2.4	0xe162	No error (0)	s-part-0035.t-0009.t-msedge.net		13.107.246.63	A (IP address)	IN (0x0001)	false
Dec 21, 2024 15:38:42.074166059 CET	1.1.1.1	192.168.2.4	0x219f	No error (0)	shed.dual-low.s-part-0035.t-0009.t-msedge.net	s-part-0035.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 21, 2024 15:38:42.074166059 CET	1.1.1.1	192.168.2.4	0x219f	No error (0)	s-part-0035.t-0009.t-msedge.net		13.107.246.63	A (IP address)	IN (0x0001)	false
Dec 21, 2024 15:38:44.490489960 CET	1.1.1.1	192.168.2.4	0x625b	No error (0)	identity.nel.measure.office.net	nel.measure.office.net.edgesuite.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 21, 2024 15:38:44.591365099 CET	1.1.1.1	192.168.2.4	0xd5d5	No error (0)	identity.nel.measure.office.net	nel.measure.office.net.edgesuite.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 21, 2024 15:38:45.187489986 CET	1.1.1.1	192.168.2.4	0xc2b8	No error (0)	aadcdn.msftauth.net	scdn38e6f.wpc.9be8f.omegacdn.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 21, 2024 15:38:45.187489986 CET	1.1.1.1	192.168.2.4	0xc2b8	No error (0)	scdn38e6f.wpc.9be8f.omegacdn.net	sni1gl.wpc.omegacdn.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 21, 2024 15:38:45.187489986 CET	1.1.1.1	192.168.2.4	0xc2b8	No error (0)	sni1gl.wpc.omegacdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Dec 21, 2024 15:38:45.189598083 CET	1.1.1.1	192.168.2.4	0x4284	No error (0)	aadcdn.msftauth.net	scdn38e6f.wpc.9be8f.omegacdn.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 21, 2024 15:38:45.189598083 CET	1.1.1.1	192.168.2.4	0x4284	No error (0)	scdn38e6f.wpc.9be8f.omegacdn.net	sni1gl.wpc.omegacdn.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 21, 2024 15:38:56.580915928 CET	1.1.1.1	192.168.2.4	0x6c9	No error (0)	aadcdn.msftauth.net	scdn38e6f.wpc.9be8f.omegacdn.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 21, 2024 15:38:56.580915928 CET	1.1.1.1	192.168.2.4	0x6c9	No error (0)	scdn38e6f.wpc.9be8f.omegacdn.net	sni1gl.wpc.omegacdn.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 21, 2024 15:38:56.580957890 CET	1.1.1.1	192.168.2.4	0xb702	No error (0)	aadcdn.msftauth.net	scdn38e6f.wpc.9be8f.omegacdn.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 21, 2024 15:38:56.580957890 CET	1.1.1.1	192.168.2.4	0xb702	No error (0)	scdn38e6f.wpc.9be8f.omegacdn.net	sni1gl.wpc.omegacdn.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 21, 2024 15:38:56.580957890 CET	1.1.1.1	192.168.2.4	0xb702	No error (0)	sni1gl.wpc.omegacdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Dec 21, 2024 15:39:11.499696970 CET	1.1.1.1	192.168.2.4	0xc1d9	No error (0)	login.microsoftonline.com	login.mso.msidentity.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 21, 2024 15:39:11.500348091 CET	1.1.1.1	192.168.2.4	0x13c7	No error (0)	login.microsoftonline.com	login.mso.msidentity.com		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

securityupdatehub-my.sharepoint.com

https:

aadcdn.msftauth.net

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49742	13.107.136.10	80	5552	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Dec 21, 2024 15:38:28.955842972 CET	450	OUT	GET / HTTP/1.1 Host: securityupdatehub-my.sharepoint.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Dec 21, 2024 15:38:30.185576916 CET	1236	IN	HTTP/1.1 301 Moved Permanently Location: https://securityupdatehub-my.sharepoint.com/ P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" X-NetworkStatistics: 0,23040,0,0,0,0,14400,0 X-DataBoundary: NONE X-1DSCollectorUrl: https://mobile.events.data.microsoft.com/OneCollector/1.0/ X-AriaCollectorURL: https://browser.pipe.aria.microsoft.com/Collector/3.0/ SPRequestGuid: 4abd6fa1-80a5-7000-680d-748267f50253 request-id: 4abd6fa1-80a5-7000-680d-748267f50253 MS-CV: oW+9SqWAAHBoDXSCZ/UCUw.0 Alt-Svc: h3=":443";ma=86400 Report-To: {"group":"network-errors","max_age":7200,"endpoints":[{"url":"https://spo.nel.measure.office.net/api/report?tenantId=00000000-0000-0000-0000-000000000000&destinationEndpoint=Edge-Prod-EWR31r5b&frontEnd=AFD&RemoteIP=8.46.123.0"}]} NEL: {"report_to":"network-errors","max_age":7200,"success_fraction":0.001,"failure_fraction":1.0} X-FRAME-OPTIONS: SAMEORIGIN Content-Security-Policy: frame-ancestors 'self' teams.microsoft.com .teams.microsoft.com .skype.com .teams.microsoft.us local.teams.office.com teams.cloud.microsoft .office365.com goals.cloud.microsoft .powerapps.com app.powerbi.com .yammer.com engage.cloud.microso Data Raw: Data Ascii:
Dec 21, 2024 15:38:30.185640097 CET	645	IN	Data Raw: 74 20 77 6f 72 64 2e 63 6c 6f 75 64 2e 6d 69 63 72 6f 73 6f 66 74 20 65 78 63 65 6c 2e 63 6c 6f 75 64 2e 6d 69 63 72 6f 73 6f 66 74 20 70 6f 77 65 72 70 6f 69 6e 74 2e 63 6c 6f 75 64 2e 6d 69 63 72 6f 73 6f 66 74 20 2a 2e 6f 66 66 69 63 65 61 70 Data Ascii: t word.cloud.microsoft excel.cloud.microsoft powerpoint.cloud.microsoft .officeapps.live.com .office.com .microsoft365.com .stream.azure-test.net .microsoftstream.com .dynamics.com .microsoft.com onedrive.live.com .onedrive.live.com se
Dec 21, 2024 15:39:15.191097021 CET	6	OUT	Data Raw: 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49741	13.107.136.10	80	5552	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Dec 21, 2024 15:39:13.956406116 CET	6	OUT	Data Raw: 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49743	13.107.136.10	80	5552	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Dec 21, 2024 15:39:14.041346073 CET	6	OUT	Data Raw: 00 Data Ascii:

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49745	13.107.138.10	443	5552	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-21 14:38:31 UTC	678	OUT	GET / HTTP/1.1 Host: securityupdatehub-my.sharepoint.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-21 14:38:32 UTC	2027	IN	HTTP/1.1 302 Found Content-Length: 201 Content-Type: text/html; charset=utf-8 Location: https://securityupdatehub-my.sharepoint.com/_layouts/15/authenticate.aspx?Source=%2F P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" X-NetworkStatistics: 0,4204800,0,692,472539,0,1905756,61 X-DataBoundary: NONE X-1DSCollectorUrl: https://mobile.events.data.microsoft.com/OneCollector/1.0/ X-AriaCollectorURL: https://browser.pipe.aria.microsoft.com/Collector/3.0/ SPRequestGuid: 4bbd6fa1-4030-7000-25f0-b7e67bf09748 request-id: 4bbd6fa1-4030-7000-25f0-b7e67bf09748 MS-CV: oW+9SzBAAHAl8Lfme/CXSA.0 Alt-Svc: h3=":443";ma=86400 Report-To: {"group":"network-errors","max_age":7200,"endpoints":[{"url":"https://spo.nel.measure.office.net/api/report?tenantId=00000000-0000-0000-0000-000000000000&destinationEndpoint=Edge-Prod-EWR31r5d&frontEnd=AFD&RemoteIP=8.46.123.0"}]} NEL: {"report_to":"network-errors","max_age":7200,"success_fraction":0.001,"failure_fraction":1.0} Strict-Transport-Security: max-age=31536000 X-FRAME-OPTIONS: SAMEORIGIN Content-Security-Policy: frame-ancestors 'self' teams.microsoft.com .teams.microsoft.com .skype.com .teams.microsoft.us local.teams.office.com teams.cloud.microsoft .office365.com goals.cloud.microsoft .powerapps.com app.powerbi.com .yammer.com engage.cloud.microsoft word.cloud.microsoft excel.cloud.microsoft powerpoint.cloud.microsoft .officeapps.live.com .office.com .microsoft365.com .stream.azure-test.net .microsoftstream.com .dynamics.com .microsoft.com onedrive.live.com .onedrive.live.com securebroker.sharepointonline.com; SPRequestDuration: 19 SPIisLatency: 0 X-Powered-By: ASP.NET MicrosoftSharePointTeamServices: 16.0.0.25520 X-Content-Type-Options: nosniff X-MS-InvokeApp: 1; RequireReadOnly X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: 6A944F94CA004D0CBD769AB8F6BA2D65 Ref B: EWR311000107023 Ref C: 2024-12-21T14:38:32Z Date: Sat, 21 Dec 2024 14:38:31 GMT Connection: close
2024-12-21 14:38:32 UTC	14	IN	Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 Data Ascii: <html><head><t
2024-12-21 14:38:32 UTC	187	IN	Data Raw: 69 74 6c 65 3e 4f 62 6a 65 63 74 20 6d 6f 76 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 32 3e 4f 62 6a 65 63 74 20 6d 6f 76 65 64 20 74 6f 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 65 63 75 72 69 74 79 75 70 64 61 74 65 68 75 62 2d 6d 79 2e 73 68 61 72 65 70 6f 69 6e 74 2e 63 6f 6d 2f 5f 6c 61 79 6f 75 74 73 2f 31 35 2f 61 75 74 68 65 6e 74 69 63 61 74 65 2e 61 73 70 78 3f 53 6f 75 72 63 65 3d 25 32 46 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 68 32 3e 0d 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: itle>Object moved</title></head><body><h2>Object moved to <a href="https://securityupdatehub-my.sharepoint.com/_layouts/15/authenticate.aspx?Source=%2F">here</a>.</h2></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49746	13.107.138.10	443	5552	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-21 14:38:33 UTC	718	OUT	GET /_layouts/15/authenticate.aspx?Source=%2F HTTP/1.1 Host: securityupdatehub-my.sharepoint.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-21 14:38:34 UTC	1667	IN	HTTP/1.1 302 Found Cache-Control: private Content-Length: 219 Content-Type: text/html; charset=utf-8 Location: /_forms/default.aspx?ReturnUrl=%2f_layouts%2f15%2fauthenticate.aspx%3fSource%3d%252F&Source=cookie P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: RpsContextCookie=U291cmNlPSUyRg==; expires=Sat, 21-Dec-2024 14:48:34 GMT; path=/; SameSite=None; secure; HttpOnly X-NetworkStatistics: 0,525568,0,0,813604,0,525568,61 X-SharePointHealthScore: 0 X-AspNet-Version: 4.0.30319 X-DataBoundary: NONE X-1DSCollectorUrl: https://mobile.events.data.microsoft.com/OneCollector/1.0/ X-AriaCollectorURL: https://browser.pipe.aria.microsoft.com/Collector/3.0/ SPRequestGuid: 4bbd6fa1-b0b1-7000-25f0-b8718ec5a859 request-id: 4bbd6fa1-b0b1-7000-25f0-b8718ec5a859 MS-CV: oW+9S7GwAHAl8LhxjsWoWQ.0 Alt-Svc: h3=":443";ma=86400 Report-To: {"group":"network-errors","max_age":7200,"endpoints":[{"url":"https://spo.nel.measure.office.net/api/report?tenantId=00000000-0000-0000-0000-000000000000&destinationEndpoint=Edge-Prod-EWR31r5d&frontEnd=AFD&RemoteIP=8.46.123.0"}]} NEL: {"report_to":"network-errors","max_age":7200,"success_fraction":0.001,"failure_fraction":1.0} Strict-Transport-Security: max-age=31536000 SPRequestDuration: 22 SPIisLatency: 0 X-Powered-By: ASP.NET MicrosoftSharePointTeamServices: 16.0.0.25520 X-Content-Type-Options: nosniff X-MS-InvokeApp: 1; RequireReadOnly X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: 054FD6C8C29544D5A4ED7FD7753C36B7 Ref B: EWR311000108047 Ref C: 2024-12-21T14:38:34Z Date: Sat, 21 Dec 2024 14:38:33 GMT Connection: close
2024-12-21 14:38:34 UTC	219	IN	Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 4f 62 6a 65 63 74 20 6d 6f 76 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 32 3e 4f 62 6a 65 63 74 20 6d 6f 76 65 64 20 74 6f 20 3c 61 20 68 72 65 66 3d 22 2f 5f 66 6f 72 6d 73 2f 64 65 66 61 75 6c 74 2e 61 73 70 78 3f 52 65 74 75 72 6e 55 72 6c 3d 25 32 66 5f 6c 61 79 6f 75 74 73 25 32 66 31 35 25 32 66 61 75 74 68 65 6e 74 69 63 61 74 65 2e 61 73 70 78 25 33 66 53 6f 75 72 63 65 25 33 64 25 32 35 32 46 26 61 6d 70 3b 53 6f 75 72 63 65 3d 63 6f 6f 6b 69 65 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 68 32 3e 0d 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Object moved</title></head><body><h2>Object moved to <a href="/_forms/default.aspx?ReturnUrl=%2f_layouts%2f15%2fauthenticate.aspx%3fSource%3d%252F&Source=cookie">here</a>.</h2></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49747	13.107.138.10	443	5552	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-21 14:38:36 UTC	818	OUT	GET /_forms/default.aspx?ReturnUrl=%2f_layouts%2f15%2fauthenticate.aspx%3fSource%3d%252F&Source=cookie HTTP/1.1 Host: securityupdatehub-my.sharepoint.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: RpsContextCookie=U291cmNlPSUyRg==
2024-12-21 14:38:36 UTC	3567	IN	HTTP/1.1 302 Found Cache-Control: no-cache, no-store Pragma: no-cache Content-Length: 893 Content-Type: text/html; charset=utf-8 Expires: -1 Location: https://login.microsoftonline.com:443/9b82a082-52f4-44b9-a6c9-d3d75128b78b/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&scope=openid&nonce=ADE0690D93F719CF918CBB9C521182130797FDF54A0F08A1%2D03C14ECC01D987DB2D5375F0F48E93B6E757EE95005239FAA6916A25FD464BF3&redirect%5Furi=https%3A%2F%2Fsecurityupdatehub%2Dmy%2Esharepoint%2Ecom%2F%5Fforms%2Fdefault%2Easpx&state=OD0w&claims=%7B%22id%5Ftoken%22%3A%7B%22xms%5Fcc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&wsucxt=1&cobrandid=11bd8083%2D87e0%2D41b5%2Dbb78%2D0bc43c8a8e8a&client%2Drequest%2Did=4cbd6fa1%2D7032%2D7000%2D734f%2D6c042359b170 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: nSGt-ADE0690D93F719CF918CBB9C521182130797FDF54A0F08A1=gYEwOEJCNDE5NEM1MTM3RUE4MDk4MkM2MjU1OTlCQjc0Q0YwNzRDOTc3RkZBREQ2MTU1MEFERTA2OTBEOTNGNzE5Q0Y5MThDQkI5QzUyMTE4MjEzMDc5N0ZERjU0QTBGMDhBMRIxMzM3OTI2NTc1NjM0MzI5MzMjc2VjdXJpdHl1cGRhdGVodWItbXkuc2hhcmVwb2ludC5jb21cYR3Qc9UhoosbiLWidv4nA1T2X33G82G9gR1YoFxK8tXGMdx72NSqv2k8GHh3GUahlUQnNmUqpFuxl9TMCQLSS2Ti944oyAuQGnd4V0AbA4NAOdUgqwUz7iDJ9zY1yW1SrzNqBwuaIxovbJ1rLd7pam6rLoBInbkmJO3lKAwvj6PPzV1UCEkoWEsljeBNwyQSGjP8P2J8NcX0ggJTBrRt5eM9KRPBTwDxYh8EkdEbhGbn5PQzJ8vKagZNisfB065iFMhxh8okb7lV9zfvDqTmgYksxF4WTnUnPPWm8x1Tr3/ffGY7Z7WIXerM/d5IhCYOQZ5aTHxjOozwJ4DoM9TvmwAAAA==; expires=Sat, 21-Dec-2024 14:42:36 GMT; path=/; SameSite=None; secure; HttpOnly Set-Cookie: nSGt-ADE0690D93F719CF918CBB9C521182130797FDF54A0F08A1=; expires=Thu, 01-Jan-1970 08:00:00 GMT; path=/; SameSite=None; Partitioned; secure; HttpOnly Set-Cookie: RpsContextCookie=U291cmNlPSUyRiZQcmV2aW91c1JlcXVlc3RDb3JyZWxhdGlvbklkPTRjYmQ2ZmExJTJENzAzMiUyRDcwMDAlMkQ3MzRmJTJENmMwNDIzNTliMTcwJlJldHVyblVybD0lMkYlNUZsYXlvdXRzJTJGMTUlMkZhdXRoZW50aWNhdGUlMkVhc3B4JTNGU291cmNlJTNEJTI1MkY=; expires=Sat, 21-Dec-2024 14:48:36 GMT; path=/; SameSite=None; secure; HttpOnly Set-Cookie: RpsContextCookie=; expires=Thu, 01-Jan-1970 08:00:00 GMT; path=/; SameSite=None; Partitioned; secure; HttpOnly X-NetworkStatistics: 0,1051136,57,236,2975734,0,1051136,57 X-SharePointHealthScore: 1 X-AspNet-Version: 4.0.30319 X-DataBoundary: NONE X-1DSCollectorUrl: https://mobile.events.data.microsoft.com/OneCollector/1.0/ X-AriaCollectorURL: https://browser.pipe.aria.microsoft.com/Collector/3.0/ SPRequestGuid: 4cbd6fa1-7032-7000-734f-6c042359b170 request-id: 4cbd6fa1-7032-7000-734f-6c042359b170 MS-CV: oW+9TDJwAHBzT2wEI1mxcA.0 Alt-Svc: h3=":443";ma=86400 Report-To: {"group":"network-errors","max_age":7200,"endpoints":[{"url":"https://spo.nel.measure.office.net/api/report?tenantId=9b82a082-52f4-44b9-a6c9-d3d75128b78b&destinationEndpoint=Edge-Prod-EWR31r5b&frontEnd=AFD&RemoteIP=8.46.123.0"}]} NEL: {"report_to":"network-errors","max_age":7200,"success_fraction":0.001,"failure_fraction":1.0} Strict-Transport-Security: max-age=31536000 SPRequestDuration: 47 SPIisLatency: 0 Include-Referred-Token-Binding-ID: true X-Powered-By: ASP.NET MicrosoftSharePointTeamServices: 16.0.0.25520 X-Content-Type-Options: nosniff X-MS-InvokeApp: 1; RequireReadOnly X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: 27BB99C6B1E94E9CBB366C035E252DA5 Ref B: EWR311000103031 Ref C: 2024-12-21T14:38:36Z Date: Sat, 21 Dec 2024 14:38:36 GMT Connection: close
2024-12-21 14:38:36 UTC	761	IN	Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 4f 62 6a 65 63 74 20 6d 6f 76 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 32 3e 4f 62 6a 65 63 74 20 6d 6f 76 65 64 20 74 6f 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 6c 6f 67 69 6e 2e 6d 69 63 72 6f 73 6f 66 74 6f 6e 6c 69 6e 65 2e 63 6f 6d 3a 34 34 33 2f 39 62 38 32 61 30 38 32 2d 35 32 66 34 2d 34 34 62 39 2d 61 36 63 39 2d 64 33 64 37 35 31 32 38 62 37 38 62 2f 6f 61 75 74 68 32 2f 61 75 74 68 6f 72 69 7a 65 3f 63 6c 69 65 6e 74 25 35 46 69 64 3d 30 30 30 30 30 30 30 33 25 32 44 30 30 30 30 25 32 44 30 66 66 31 25 32 44 63 65 30 30 25 32 44 30 30 30 30 30 30 30 30 30 30 30 30 26 61 6d 70 3b 72 65 73 70 6f 6e 73 65 25 35 46 6d 6f 64 65 3d 66 6f 72 Data Ascii: <html><head><title>Object moved</title></head><body><h2>Object moved to <a href="https://login.microsoftonline.com:443/9b82a082-52f4-44b9-a6c9-d3d75128b78b/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=for
2024-12-21 14:38:36 UTC	132	IN	Data Raw: 44 34 31 62 35 25 32 44 62 62 37 38 25 32 44 30 62 63 34 33 63 38 61 38 65 38 61 26 61 6d 70 3b 63 6c 69 65 6e 74 25 32 44 72 65 71 75 65 73 74 25 32 44 69 64 3d 34 63 62 64 36 66 61 31 25 32 44 37 30 33 32 25 32 44 37 30 30 30 25 32 44 37 33 34 66 25 32 44 36 63 30 34 32 33 35 39 62 31 37 30 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 68 32 3e 0d 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: D41b5%2Dbb78%2D0bc43c8a8e8a&client%2Drequest%2Did=4cbd6fa1%2D7032%2D7000%2D734f%2D6c042359b170">here</a>.</h2></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49776	152.199.21.175	443	5552	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-21 14:38:54 UTC	620	OUT	GET /shared/1.0/content/js/asyncchunk/convergedlogin_pcustomizationloader_27cef08ca792f8e8b149.js HTTP/1.1 Host: aadcdn.msftauth.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://login.microsoftonline.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-21 14:38:55 UTC	750	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Age: 2779491 Cache-Control: public, max-age=31536000 Content-MD5: MGOw2kC0W0ZgL86ZrFPTFQ== Content-Type: application/x-javascript Date: Sat, 21 Dec 2024 14:38:55 GMT Etag: 0x8DD05A56313A35E Last-Modified: Fri, 15 Nov 2024 18:43:24 GMT Server: ECAcc (lhc/78A2) Vary: Accept-Encoding X-Cache: HIT x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: c26802b4-101e-00c9-0e6e-3a3c8a000000 x-ms-version: 2009-09-19 Content-Length: 406986 Connection: close
2024-12-21 14:38:55 UTC	16383	IN	Data Raw: 2f 2a 21 0a 20 2a 20 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 20 53 54 41 52 54 20 4f 46 20 54 48 49 52 44 20 50 41 52 54 59 20 4e 4f 54 49 43 45 20 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 0a 20 2a 20 0a 20 2a 20 54 68 69 73 20 66 69 6c 65 20 69 73 20 62 61 73 65 64 20 6f 6e 20 6f 72 20 69 6e 63 6f 72 70 6f 72 61 74 65 73 20 6d 61 74 65 72 69 61 6c 20 66 72 6f 6d 20 74 68 65 20 70 72 6f 6a 65 63 74 73 20 6c 69 73 74 65 64 20 62 65 6c 6f 77 20 28 54 68 69 72 64 20 50 61 72 74 79 20 49 50 29 2e 20 54 68 65 20 6f 72 69 67 69 6e 61 6c 20 63 6f 70 79 72 69 67 68 74 20 6e 6f 74 69 63 65 20 61 Data Ascii: /! ------------------------------------------- START OF THIRD PARTY NOTICE ----------------------------------------- * * This file is based on or incorporates material from the projects listed below (Third Party IP). The original copyright notice a
2024-12-21 14:38:55 UTC	1	IN	Data Raw: 69 Data Ascii: i
2024-12-21 14:38:55 UTC	16383	IN	Data Raw: 3d 4d 61 74 68 2e 6d 69 6e 3b 74 2e 65 78 70 6f 72 74 73 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 76 61 72 20 72 3d 6e 28 74 29 3b 72 65 74 75 72 6e 20 72 3c 30 3f 6f 28 72 2b 65 2c 30 29 3a 69 28 72 2c 65 29 7d 7d 2c 66 75 6e 63 74 69 6f 6e 28 74 2c 65 2c 72 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 6e 3d 72 28 35 34 33 29 3b 74 2e 65 78 70 6f 72 74 73 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 76 61 72 20 72 3d 5b 5d 5b 74 5d 3b 72 65 74 75 72 6e 21 21 72 26 26 6e 28 28 66 75 6e 63 74 69 6f 6e 28 29 7b 72 2e 63 61 6c 6c 28 6e 75 6c 6c 2c 65 7c 7c 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 31 7d 2c 31 29 7d 29 29 7d 7d 2c 66 75 6e 63 74 69 6f 6e 28 74 2c 65 2c 72 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 6e Data Ascii: =Math.min;t.exports=function(t,e){var r=n(t);return r<0?o(r+e,0):i(r,e)}},function(t,e,r){"use strict";var n=r(543);t.exports=function(t,e){var r=[][t];return!!r&&n((function(){r.call(null,e\|\|function(){return 1},1)}))}},function(t,e,r){"use strict";var n
2024-12-21 14:38:55 UTC	16383	IN	Data Raw: 31 7d 29 2c 65 7d 28 72 28 36 38 38 29 29 3b 45 2e 72 65 67 69 73 74 65 72 50 61 72 73 65 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 3d 74 7d 2c 45 2e 72 65 67 69 73 74 65 72 52 75 6c 65 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 67 3d 74 7d 2c 45 2e 72 65 67 69 73 74 65 72 41 74 52 75 6c 65 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 6d 3d 74 7d 2c 45 2e 72 65 67 69 73 74 65 72 52 6f 6f 74 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 62 3d 74 7d 2c 74 2e 65 78 70 6f 72 74 73 3d 45 2c 45 5b 22 64 65 66 61 75 6c 74 22 5d 3d 45 2c 45 2e 72 65 62 75 69 6c 64 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 22 61 74 72 75 6c 65 22 3d 3d 3d 74 2e 74 79 70 65 3f 4f 62 6a 65 63 74 2e 73 65 74 50 72 6f 74 6f 74 79 70 65 4f 66 28 74 2c 6d 2e 70 72 6f 74 6f 74 79 70 65 29 3a 22 72 75 6c 65 Data Ascii: 1}),e}(r(688));E.registerParse=function(t){v=t},E.registerRule=function(t){g=t},E.registerAtRule=function(t){m=t},E.registerRoot=function(t){b=t},t.exports=E,E["default"]=E,E.rebuild=function(t){"atrule"===t.type?Object.setPrototypeOf(t,m.prototype):"rule
2024-12-21 14:38:55 UTC	16383	IN	Data Raw: 22 21 3d 74 79 70 65 6f 66 20 41 72 72 61 79 42 75 66 66 65 72 26 26 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 41 72 72 61 79 42 75 66 66 65 72 2e 69 73 56 69 65 77 26 26 28 41 72 72 61 79 42 75 66 66 65 72 2e 69 73 56 69 65 77 28 74 29 7c 7c 74 20 69 6e 73 74 61 6e 63 65 6f 66 20 41 72 72 61 79 42 75 66 66 65 72 29 29 72 65 74 75 72 6e 20 74 2e 62 79 74 65 4c 65 6e 67 74 68 3b 22 73 74 72 69 6e 67 22 21 3d 74 79 70 65 6f 66 20 74 26 26 28 74 3d 22 22 2b 74 29 3b 76 61 72 20 72 3d 74 2e 6c 65 6e 67 74 68 3b 69 66 28 30 3d 3d 3d 72 29 72 65 74 75 72 6e 20 30 3b 66 6f 72 28 76 61 72 20 6e 3d 21 31 3b 3b 29 73 77 69 74 63 68 28 65 29 7b 63 61 73 65 22 61 73 63 69 69 22 3a 63 61 73 65 22 6c 61 74 69 6e 31 22 3a 63 61 73 65 22 62 69 6e 61 72 79 Data Ascii: "!=typeof ArrayBuffer&&"function"==typeof ArrayBuffer.isView&&(ArrayBuffer.isView(t)\|\|t instanceof ArrayBuffer))return t.byteLength;"string"!=typeof t&&(t=""+t);var r=t.length;if(0===r)return 0;for(var n=!1;;)switch(e){case"ascii":case"latin1":case"binary
2024-12-21 14:38:55 UTC	16383	IN	Data Raw: 67 3b 66 75 6e 63 74 69 6f 6e 20 4e 28 74 29 7b 72 65 74 75 72 6e 20 74 3c 31 36 3f 22 30 22 2b 74 2e 74 6f 53 74 72 69 6e 67 28 31 36 29 3a 74 2e 74 6f 53 74 72 69 6e 67 28 31 36 29 7d 66 75 6e 63 74 69 6f 6e 20 46 28 74 2c 65 29 7b 76 61 72 20 72 3b 65 3d 65 7c 7c 49 6e 66 69 6e 69 74 79 3b 66 6f 72 28 76 61 72 20 6e 3d 74 2e 6c 65 6e 67 74 68 2c 6f 3d 6e 75 6c 6c 2c 69 3d 5b 5d 2c 73 3d 30 3b 73 3c 6e 3b 2b 2b 73 29 7b 69 66 28 28 72 3d 74 2e 63 68 61 72 43 6f 64 65 41 74 28 73 29 29 3e 35 35 32 39 35 26 26 72 3c 35 37 33 34 34 29 7b 69 66 28 21 6f 29 7b 69 66 28 72 3e 35 36 33 31 39 29 7b 28 65 2d 3d 33 29 3e 2d 31 26 26 69 2e 70 75 73 68 28 32 33 39 2c 31 39 31 2c 31 38 39 29 3b 63 6f 6e 74 69 6e 75 65 7d 69 66 28 73 2b 31 3d 3d 3d 6e 29 7b 28 65 2d Data Ascii: g;function N(t){return t<16?"0"+t.toString(16):t.toString(16)}function F(t,e){var r;e=e\|\|Infinity;for(var n=t.length,o=null,i=[],s=0;s<n;++s){if((r=t.charCodeAt(s))>55295&&r<57344){if(!o){if(r>56319){(e-=3)>-1&&i.push(239,191,189);continue}if(s+1===n){(e-
2024-12-21 14:38:55 UTC	4	IN	Data Raw: 76 61 72 20 Data Ascii: var
2024-12-21 14:38:55 UTC	16383	IN	Data Raw: 72 2c 6e 2c 6f 3b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 69 66 28 22 66 75 6e 63 74 69 6f 6e 22 21 3d 74 79 70 65 6f 66 20 65 26 26 6e 75 6c 6c 21 3d 3d 65 29 74 68 72 6f 77 20 6e 65 77 20 54 79 70 65 45 72 72 6f 72 28 22 53 75 70 65 72 20 65 78 70 72 65 73 73 69 6f 6e 20 6d 75 73 74 20 65 69 74 68 65 72 20 62 65 20 6e 75 6c 6c 20 6f 72 20 61 20 66 75 6e 63 74 69 6f 6e 22 29 3b 74 2e 70 72 6f 74 6f 74 79 70 65 3d 4f 62 6a 65 63 74 2e 63 72 65 61 74 65 28 65 26 26 65 2e 70 72 6f 74 6f 74 79 70 65 2c 7b 63 6f 6e 73 74 72 75 63 74 6f 72 3a 7b 76 61 6c 75 65 3a 74 2c 77 72 69 74 61 62 6c 65 3a 21 30 2c 63 6f 6e 66 69 67 75 72 61 62 6c 65 3a 21 30 7d 7d 29 2c 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 28 74 2c 22 70 Data Ascii: r,n,o;return function(t,e){if("function"!=typeof e&&null!==e)throw new TypeError("Super expression must either be null or a function");t.prototype=Object.create(e&&e.prototype,{constructor:{value:t,writable:!0,configurable:!0}}),Object.defineProperty(t,"p
2024-12-21 14:38:55 UTC	16383	IN	Data Raw: 74 75 72 6e 20 6e 65 77 20 6f 5b 22 64 65 66 61 75 6c 74 22 5d 28 74 29 7d 2c 65 2e 77 61 72 6e 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 65 2c 72 29 7b 76 61 72 20 6e 3d 7b 6e 6f 64 65 3a 74 68 69 73 7d 3b 66 6f 72 28 76 61 72 20 6f 20 69 6e 20 72 29 6e 5b 6f 5d 3d 72 5b 6f 5d 3b 72 65 74 75 72 6e 20 74 2e 77 61 72 6e 28 65 2c 6e 29 7d 2c 65 2e 72 65 6d 6f 76 65 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 70 61 72 65 6e 74 26 26 74 68 69 73 2e 70 61 72 65 6e 74 2e 72 65 6d 6f 76 65 43 68 69 6c 64 28 74 68 69 73 29 2c 74 68 69 73 2e 70 61 72 65 6e 74 3d 75 6e 64 65 66 69 6e 65 64 2c 74 68 69 73 7d 2c 65 2e 74 6f 53 74 72 69 6e 67 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 6f 69 64 20 30 3d 3d 3d 74 26 26 28 74 3d 73 5b 22 64 65 66 61 Data Ascii: turn new o["default"](t)},e.warn=function(t,e,r){var n={node:this};for(var o in r)n[o]=r[o];return t.warn(e,n)},e.remove=function(){return this.parent&&this.parent.removeChild(this),this.parent=undefined,this},e.toString=function(t){void 0===t&&(t=s["defa
2024-12-21 14:38:56 UTC	16383	IN	Data Raw: 72 74 73 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 69 66 28 61 26 26 22 73 74 72 69 6e 67 22 3d 3d 74 79 70 65 6f 66 20 74 26 26 21 6f 2e 70 72 65 70 61 72 65 53 74 61 63 6b 54 72 61 63 65 29 66 6f 72 28 3b 65 2d 2d 3b 29 74 3d 69 28 74 2c 75 2c 22 22 29 3b 72 65 74 75 72 6e 20 74 7d 7d 2c 66 75 6e 63 74 69 6f 6e 28 74 2c 65 2c 72 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 6e 3d 72 28 35 34 33 29 3b 74 2e 65 78 70 6f 72 74 73 3d 21 6e 28 28 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 74 28 29 7b 7d 72 65 74 75 72 6e 20 74 2e 70 72 6f 74 6f 74 79 70 65 2e 63 6f 6e 73 74 72 75 63 74 6f 72 3d 6e 75 6c 6c 2c 4f 62 6a 65 63 74 2e 67 65 74 50 72 6f 74 6f 74 79 70 65 4f 66 28 6e 65 77 20 74 29 21 3d 3d 74 2e 70 72 6f 74 6f 74 79 Data Ascii: rts=function(t,e){if(a&&"string"==typeof t&&!o.prepareStackTrace)for(;e--;)t=i(t,u,"");return t}},function(t,e,r){"use strict";var n=r(543);t.exports=!n((function(){function t(){}return t.prototype.constructor=null,Object.getPrototypeOf(new t)!==t.prototy

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49780	152.199.21.175	443	5552	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-21 14:38:58 UTC	435	OUT	GET /shared/1.0/content/js/asyncchunk/convergedlogin_pcustomizationloader_27cef08ca792f8e8b149.js HTTP/1.1 Host: aadcdn.msftauth.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-21 14:38:58 UTC	750	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Age: 2779494 Cache-Control: public, max-age=31536000 Content-MD5: MGOw2kC0W0ZgL86ZrFPTFQ== Content-Type: application/x-javascript Date: Sat, 21 Dec 2024 14:38:58 GMT Etag: 0x8DD05A56313A35E Last-Modified: Fri, 15 Nov 2024 18:43:24 GMT Server: ECAcc (lhc/78A2) Vary: Accept-Encoding X-Cache: HIT x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: c26802b4-101e-00c9-0e6e-3a3c8a000000 x-ms-version: 2009-09-19 Content-Length: 406986 Connection: close
2024-12-21 14:38:58 UTC	16383	IN	Data Raw: 2f 2a 21 0a 20 2a 20 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 20 53 54 41 52 54 20 4f 46 20 54 48 49 52 44 20 50 41 52 54 59 20 4e 4f 54 49 43 45 20 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 0a 20 2a 20 0a 20 2a 20 54 68 69 73 20 66 69 6c 65 20 69 73 20 62 61 73 65 64 20 6f 6e 20 6f 72 20 69 6e 63 6f 72 70 6f 72 61 74 65 73 20 6d 61 74 65 72 69 61 6c 20 66 72 6f 6d 20 74 68 65 20 70 72 6f 6a 65 63 74 73 20 6c 69 73 74 65 64 20 62 65 6c 6f 77 20 28 54 68 69 72 64 20 50 61 72 74 79 20 49 50 29 2e 20 54 68 65 20 6f 72 69 67 69 6e 61 6c 20 63 6f 70 79 72 69 67 68 74 20 6e 6f 74 69 63 65 20 61 Data Ascii: /! ------------------------------------------- START OF THIRD PARTY NOTICE ----------------------------------------- * * This file is based on or incorporates material from the projects listed below (Third Party IP). The original copyright notice a
2024-12-21 14:38:58 UTC	1	IN	Data Raw: 69 Data Ascii: i
2024-12-21 14:38:59 UTC	16383	IN	Data Raw: 3d 4d 61 74 68 2e 6d 69 6e 3b 74 2e 65 78 70 6f 72 74 73 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 76 61 72 20 72 3d 6e 28 74 29 3b 72 65 74 75 72 6e 20 72 3c 30 3f 6f 28 72 2b 65 2c 30 29 3a 69 28 72 2c 65 29 7d 7d 2c 66 75 6e 63 74 69 6f 6e 28 74 2c 65 2c 72 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 6e 3d 72 28 35 34 33 29 3b 74 2e 65 78 70 6f 72 74 73 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 76 61 72 20 72 3d 5b 5d 5b 74 5d 3b 72 65 74 75 72 6e 21 21 72 26 26 6e 28 28 66 75 6e 63 74 69 6f 6e 28 29 7b 72 2e 63 61 6c 6c 28 6e 75 6c 6c 2c 65 7c 7c 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 31 7d 2c 31 29 7d 29 29 7d 7d 2c 66 75 6e 63 74 69 6f 6e 28 74 2c 65 2c 72 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 6e Data Ascii: =Math.min;t.exports=function(t,e){var r=n(t);return r<0?o(r+e,0):i(r,e)}},function(t,e,r){"use strict";var n=r(543);t.exports=function(t,e){var r=[][t];return!!r&&n((function(){r.call(null,e\|\|function(){return 1},1)}))}},function(t,e,r){"use strict";var n
2024-12-21 14:38:59 UTC	16383	IN	Data Raw: 31 7d 29 2c 65 7d 28 72 28 36 38 38 29 29 3b 45 2e 72 65 67 69 73 74 65 72 50 61 72 73 65 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 3d 74 7d 2c 45 2e 72 65 67 69 73 74 65 72 52 75 6c 65 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 67 3d 74 7d 2c 45 2e 72 65 67 69 73 74 65 72 41 74 52 75 6c 65 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 6d 3d 74 7d 2c 45 2e 72 65 67 69 73 74 65 72 52 6f 6f 74 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 62 3d 74 7d 2c 74 2e 65 78 70 6f 72 74 73 3d 45 2c 45 5b 22 64 65 66 61 75 6c 74 22 5d 3d 45 2c 45 2e 72 65 62 75 69 6c 64 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 22 61 74 72 75 6c 65 22 3d 3d 3d 74 2e 74 79 70 65 3f 4f 62 6a 65 63 74 2e 73 65 74 50 72 6f 74 6f 74 79 70 65 4f 66 28 74 2c 6d 2e 70 72 6f 74 6f 74 79 70 65 29 3a 22 72 75 6c 65 Data Ascii: 1}),e}(r(688));E.registerParse=function(t){v=t},E.registerRule=function(t){g=t},E.registerAtRule=function(t){m=t},E.registerRoot=function(t){b=t},t.exports=E,E["default"]=E,E.rebuild=function(t){"atrule"===t.type?Object.setPrototypeOf(t,m.prototype):"rule
2024-12-21 14:38:59 UTC	16383	IN	Data Raw: 22 21 3d 74 79 70 65 6f 66 20 41 72 72 61 79 42 75 66 66 65 72 26 26 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 41 72 72 61 79 42 75 66 66 65 72 2e 69 73 56 69 65 77 26 26 28 41 72 72 61 79 42 75 66 66 65 72 2e 69 73 56 69 65 77 28 74 29 7c 7c 74 20 69 6e 73 74 61 6e 63 65 6f 66 20 41 72 72 61 79 42 75 66 66 65 72 29 29 72 65 74 75 72 6e 20 74 2e 62 79 74 65 4c 65 6e 67 74 68 3b 22 73 74 72 69 6e 67 22 21 3d 74 79 70 65 6f 66 20 74 26 26 28 74 3d 22 22 2b 74 29 3b 76 61 72 20 72 3d 74 2e 6c 65 6e 67 74 68 3b 69 66 28 30 3d 3d 3d 72 29 72 65 74 75 72 6e 20 30 3b 66 6f 72 28 76 61 72 20 6e 3d 21 31 3b 3b 29 73 77 69 74 63 68 28 65 29 7b 63 61 73 65 22 61 73 63 69 69 22 3a 63 61 73 65 22 6c 61 74 69 6e 31 22 3a 63 61 73 65 22 62 69 6e 61 72 79 Data Ascii: "!=typeof ArrayBuffer&&"function"==typeof ArrayBuffer.isView&&(ArrayBuffer.isView(t)\|\|t instanceof ArrayBuffer))return t.byteLength;"string"!=typeof t&&(t=""+t);var r=t.length;if(0===r)return 0;for(var n=!1;;)switch(e){case"ascii":case"latin1":case"binary
2024-12-21 14:38:59 UTC	16383	IN	Data Raw: 67 3b 66 75 6e 63 74 69 6f 6e 20 4e 28 74 29 7b 72 65 74 75 72 6e 20 74 3c 31 36 3f 22 30 22 2b 74 2e 74 6f 53 74 72 69 6e 67 28 31 36 29 3a 74 2e 74 6f 53 74 72 69 6e 67 28 31 36 29 7d 66 75 6e 63 74 69 6f 6e 20 46 28 74 2c 65 29 7b 76 61 72 20 72 3b 65 3d 65 7c 7c 49 6e 66 69 6e 69 74 79 3b 66 6f 72 28 76 61 72 20 6e 3d 74 2e 6c 65 6e 67 74 68 2c 6f 3d 6e 75 6c 6c 2c 69 3d 5b 5d 2c 73 3d 30 3b 73 3c 6e 3b 2b 2b 73 29 7b 69 66 28 28 72 3d 74 2e 63 68 61 72 43 6f 64 65 41 74 28 73 29 29 3e 35 35 32 39 35 26 26 72 3c 35 37 33 34 34 29 7b 69 66 28 21 6f 29 7b 69 66 28 72 3e 35 36 33 31 39 29 7b 28 65 2d 3d 33 29 3e 2d 31 26 26 69 2e 70 75 73 68 28 32 33 39 2c 31 39 31 2c 31 38 39 29 3b 63 6f 6e 74 69 6e 75 65 7d 69 66 28 73 2b 31 3d 3d 3d 6e 29 7b 28 65 2d Data Ascii: g;function N(t){return t<16?"0"+t.toString(16):t.toString(16)}function F(t,e){var r;e=e\|\|Infinity;for(var n=t.length,o=null,i=[],s=0;s<n;++s){if((r=t.charCodeAt(s))>55295&&r<57344){if(!o){if(r>56319){(e-=3)>-1&&i.push(239,191,189);continue}if(s+1===n){(e-
2024-12-21 14:38:59 UTC	4	IN	Data Raw: 76 61 72 20 Data Ascii: var
2024-12-21 14:38:59 UTC	16383	IN	Data Raw: 72 2c 6e 2c 6f 3b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 69 66 28 22 66 75 6e 63 74 69 6f 6e 22 21 3d 74 79 70 65 6f 66 20 65 26 26 6e 75 6c 6c 21 3d 3d 65 29 74 68 72 6f 77 20 6e 65 77 20 54 79 70 65 45 72 72 6f 72 28 22 53 75 70 65 72 20 65 78 70 72 65 73 73 69 6f 6e 20 6d 75 73 74 20 65 69 74 68 65 72 20 62 65 20 6e 75 6c 6c 20 6f 72 20 61 20 66 75 6e 63 74 69 6f 6e 22 29 3b 74 2e 70 72 6f 74 6f 74 79 70 65 3d 4f 62 6a 65 63 74 2e 63 72 65 61 74 65 28 65 26 26 65 2e 70 72 6f 74 6f 74 79 70 65 2c 7b 63 6f 6e 73 74 72 75 63 74 6f 72 3a 7b 76 61 6c 75 65 3a 74 2c 77 72 69 74 61 62 6c 65 3a 21 30 2c 63 6f 6e 66 69 67 75 72 61 62 6c 65 3a 21 30 7d 7d 29 2c 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 28 74 2c 22 70 Data Ascii: r,n,o;return function(t,e){if("function"!=typeof e&&null!==e)throw new TypeError("Super expression must either be null or a function");t.prototype=Object.create(e&&e.prototype,{constructor:{value:t,writable:!0,configurable:!0}}),Object.defineProperty(t,"p
2024-12-21 14:38:59 UTC	16383	IN	Data Raw: 74 75 72 6e 20 6e 65 77 20 6f 5b 22 64 65 66 61 75 6c 74 22 5d 28 74 29 7d 2c 65 2e 77 61 72 6e 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 65 2c 72 29 7b 76 61 72 20 6e 3d 7b 6e 6f 64 65 3a 74 68 69 73 7d 3b 66 6f 72 28 76 61 72 20 6f 20 69 6e 20 72 29 6e 5b 6f 5d 3d 72 5b 6f 5d 3b 72 65 74 75 72 6e 20 74 2e 77 61 72 6e 28 65 2c 6e 29 7d 2c 65 2e 72 65 6d 6f 76 65 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 70 61 72 65 6e 74 26 26 74 68 69 73 2e 70 61 72 65 6e 74 2e 72 65 6d 6f 76 65 43 68 69 6c 64 28 74 68 69 73 29 2c 74 68 69 73 2e 70 61 72 65 6e 74 3d 75 6e 64 65 66 69 6e 65 64 2c 74 68 69 73 7d 2c 65 2e 74 6f 53 74 72 69 6e 67 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 6f 69 64 20 30 3d 3d 3d 74 26 26 28 74 3d 73 5b 22 64 65 66 61 Data Ascii: turn new o["default"](t)},e.warn=function(t,e,r){var n={node:this};for(var o in r)n[o]=r[o];return t.warn(e,n)},e.remove=function(){return this.parent&&this.parent.removeChild(this),this.parent=undefined,this},e.toString=function(t){void 0===t&&(t=s["defa
2024-12-21 14:38:59 UTC	16383	IN	Data Raw: 72 74 73 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 69 66 28 61 26 26 22 73 74 72 69 6e 67 22 3d 3d 74 79 70 65 6f 66 20 74 26 26 21 6f 2e 70 72 65 70 61 72 65 53 74 61 63 6b 54 72 61 63 65 29 66 6f 72 28 3b 65 2d 2d 3b 29 74 3d 69 28 74 2c 75 2c 22 22 29 3b 72 65 74 75 72 6e 20 74 7d 7d 2c 66 75 6e 63 74 69 6f 6e 28 74 2c 65 2c 72 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 6e 3d 72 28 35 34 33 29 3b 74 2e 65 78 70 6f 72 74 73 3d 21 6e 28 28 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 74 28 29 7b 7d 72 65 74 75 72 6e 20 74 2e 70 72 6f 74 6f 74 79 70 65 2e 63 6f 6e 73 74 72 75 63 74 6f 72 3d 6e 75 6c 6c 2c 4f 62 6a 65 63 74 2e 67 65 74 50 72 6f 74 6f 74 79 70 65 4f 66 28 6e 65 77 20 74 29 21 3d 3d 74 2e 70 72 6f 74 6f 74 79 Data Ascii: rts=function(t,e){if(a&&"string"==typeof t&&!o.prepareStackTrace)for(;e--;)t=i(t,u,"");return t}},function(t,e,r){"use strict";var n=r(543);t.exports=!n((function(){function t(){}return t.prototype.constructor=null,Object.getPrototypeOf(new t)!==t.prototy

Target ID:	0
Start time:	09:38:19
Start date:	21/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	09:38:21
Start date:	21/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2136 --field-trial-handle=1988,i,7594917267722297499,11007387598272349058,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	09:38:27
Start date:	21/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "http://securityupdatehub-my.sharepoint.com"
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report http://securityupdatehub-my.sharepoint.com

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Phishing

Networking

System Summary

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Chrome Cache Entry: 59

Chrome Cache Entry: 60

Chrome Cache Entry: 61

Chrome Cache Entry: 62

Chrome Cache Entry: 63

Chrome Cache Entry: 64

Chrome Cache Entry: 65

Chrome Cache Entry: 66

Chrome Cache Entry: 67

Chrome Cache Entry: 68

Chrome Cache Entry: 69

Chrome Cache Entry: 70

Chrome Cache Entry: 71

Chrome Cache Entry: 72

Chrome Cache Entry: 73

Chrome Cache Entry: 74

Chrome Cache Entry: 75

Chrome Cache Entry: 76

Chrome Cache Entry: 77

Chrome Cache Entry: 78

Chrome Cache Entry: 79

Chrome Cache Entry: 80

Chrome Cache Entry: 81

Chrome Cache Entry: 82

Chrome Cache Entry: 83

Chrome Cache Entry: 84

Chrome Cache Entry: 85

Static File Info

Network Behavior

Windows Analysis Report
http://securityupdatehub-my.sharepoint.com