Create Interactive Tour

Windows Analysis Report
http://tsdtocl.com

Overview

General Information

Sample URL:	http://tsdtocl.com
Analysis ID:	562232
Infos:

Detection

Score:	0
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

No high impact signatures.

Classification

Process Tree

System is w10x64

chrome.exe (PID: 6300 cmdline: C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --enable-automation "http://tsdtocl.com MD5: C139654B5C1438A95B321BB01AD63EF6)

chrome.exe (PID: 5500 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1532,15172801009055681325,1324788210358366606,131072 --lang=en-GB --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1952 /prefetch:8 MD5: C139654B5C1438A95B321BB01AD63EF6)

cleanup

HTTP traffic detected: POST /RST2.srf HTTP/1.0Connection: Keep-AliveContent-Type: application/soap+xmlAccept: */*User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 18.10.0.17134.0.0; IDCRL-cfg 16.000.27716.00; App svchost.exe, 10.0.17134.1, {DF60E2DF-88AD-4526-AE21-83D130EF0F68})Content-Length: 4740Host: login.live.com

Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.200
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.200
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.200
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.200
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.200
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.200
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.200
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.200
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.200
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.200
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.200
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.200
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.200
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.200
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.200
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.200
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.200
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.200
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.200
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.200
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.200
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.200
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.200
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.200
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.200
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.200
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.200
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.200
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.200
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.200
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.200
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.200
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.200
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.200
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.200
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.200
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.200
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.200
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.200
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.200
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.200
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.200
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.200
Source: unknown	TCP traffic detected without corresponding DNS query: 20.82.209.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.82.209.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.82.209.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.82.209.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.82.209.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.82.209.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.82.209.183

Source: unknown	HTTPS traffic detected: 20.82.209.183:443 -> 192.168.2.4:49795 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.82.209.183:443 -> 192.168.2.4:49796 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.54.104.15:443 -> 192.168.2.4:49797 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.54.7.98:443 -> 192.168.2.4:49798 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.54.104.15:443 -> 192.168.2.4:49800 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.112.88.60:443 -> 192.168.2.4:49801 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.54.104.15:443 -> 192.168.2.4:49802 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.54.104.15:443 -> 192.168.2.4:49805 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.54.104.15:443 -> 192.168.2.4:49808 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.54.104.15:443 -> 192.168.2.4:49812 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 95.101.180.43:443 -> 192.168.2.4:49836 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.82.210.154:443 -> 192.168.2.4:49867 version: TLS 1.2

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Local\Temp\ffe5dc20-0c3b-403b-a2b8-4d8cfddf1bf4.tmp

Jump to behavior

Source: classification engine

Classification label: clean0.win@32/235@4/9

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --enable-automation "http://tsdtocl.com
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1532,15172801009055681325,1324788210358366606,131072 --lang=en-GB --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1952 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1532,15172801009055681325,1324788210358366606,131072 --lang=en-GB --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1952 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\BrowserMetrics\BrowserMetrics-61F41257-189C.pma

Jump to behavior

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation	Path Interception	1 Process Injection	1 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	Exfiltration Over Other Network Medium	1 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	3 Non-Application Layer Protocol	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	4 Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	1 Ingress Tool Transfer	SIM Card Swap		Carrier Billing Fraud

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
http://tsdtocl.com	0%	Virustotal		Browse
http://tsdtocl.com	0%	Avira URL Cloud	safe

Source	Detection	Scanner	Label
http://tsdtocl.com/2:	0%	Avira URL Cloud	safe
http://tsdtocl.com/O	0%	Avira URL Cloud	safe
http://tsdtocl.com/2	0%	Avira URL Cloud	safe
http://tsdtocl.com/favicon.icod	0%	Avira URL Cloud	safe
http://tsdtocl.com//5	0%	Avira URL Cloud	safe
http://tsdtocl.com/favicon.ico	0%	Avira URL Cloud	safe
https://dns.google	0%	URL Reputation	safe
https://www.google.com;	0%	Avira URL Cloud	safe
http://tsdtocl.com/t	0%	Avira URL Cloud	safe
http://tsdtocl.com/	0%	Avira URL Cloud	safe

Domains and IPs

Download Network PCAP: filtered – full

Contacted Domains

Name	IP	Active	Malicious	Reputation
tsdtocl.com	151.101.2.133	true	false	unknown
accounts.google.com	142.250.203.109	true	false	high
clients.l.google.com	142.250.203.110	true	false	high
googlehosted.l.googleusercontent.com	172.217.168.33	true	false	high
clients2.googleusercontent.com	unknown	unknown	false	high
clients2.google.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://clients2.googleusercontent.com/crx/blobs/Acy1k0bLIjHsvnKaKN_oRpVaYYvFs25d7GKYF1WXrT6yizCMksBO0c_ggE0B6tx6HPRHe6q1GOEe3_NcIbSiGG8kXeLMUY0sAKVvC6R89zvKM13s5VqoAMZSmuUgjQL5vlygJuArQghXXE_qTL7NlQ/extension_8520_615_0_5.crx	false		high
http://tsdtocl.com/favicon.ico	false	Avira URL Cloud: safe	unknown
https://accounts.google.com/ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard	false		high
https://clients2.google.com/service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=85.0.4183.121&lang=en-GB&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1&x=id%3Dpkedcjkdefgpdelpbcmbmeomcjbeemfm%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1	false		high
http://tsdtocl.com/	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://apis.google.com/js/client.js	mirroring_common.js.0.dr	false		high
https://www.google.com/images/cleardot.gif	craw_window.js.0.dr	false		high
https://play.google.com	40166924-9b54-4dfb-a6bc-b84d1026f5d5.tmp.1.dr, a8d84cd4-4f39-4b90-b408-4ae859ed16c7.tmp.1.dr	false		high
https://crash.corp.google.com/samples?reportid=&q=	mirroring_cast_streaming.js.0.dr, common.js.0.dr	false		high
https://www.google.com/log?format=json&hasfast=true	mirroring_hangouts.js.0.dr	false		high
http://tsdtocl.com/2:	History Provider Cache.0.dr	false	Avira URL Cloud: safe	unknown
http://tsdtocl.com/O	data_1.1.dr	false	Avira URL Cloud: safe	unknown
https://sandbox.google.com/payments/v4/js/integrator.js	craw_window.js.0.dr, manifest.json.0.dr	false		high
http://www.ietf.org/id/draft-holmer-rmcat-transport-wide-cc-extensions-01	mirroring_hangouts.js.0.dr	false		high
https://accounts.google.com/MergeSession	craw_window.js.0.dr	false		high
https://preprod-hangouts-googleapis.sandbox.google.com	mirroring_hangouts.js.0.dr	false		high
https://www.google.com	manifest.json1.0.dr, 40166924-9b54-4dfb-a6bc-b84d1026f5d5.tmp.1.dr, a8d84cd4-4f39-4b90-b408-4ae859ed16c7.tmp.1.dr	false		high
https://hangouts.clients6.google.com	mirroring_hangouts.js.0.dr	false		high
https://meet.google.com	mirroring_common.js.0.dr	false		high
https://hangouts.google.com/hangouts/_/logpref	mirroring_hangouts.js.0.dr	false		high
https://accounts.google.com	manifest.json1.0.dr, 40166924-9b54-4dfb-a6bc-b84d1026f5d5.tmp.1.dr, a8d84cd4-4f39-4b90-b408-4ae859ed16c7.tmp.1.dr	false		high
https://clients2.google.com/cr/report	mirroring_hangouts.js.0.dr, mirroring_cast_streaming.js.0.dr	false		high
http://angularjs.org	angular.js.0.dr	false		high
http://tsdtocl.com/2	History Provider Cache.0.dr	false	Avira URL Cloud: safe	unknown
http://tsdtocl.com/favicon.icod	data_1.1.dr	false	Avira URL Cloud: safe	unknown
http://tsdtocl.com//5	History.0.dr	false	Avira URL Cloud: safe	unknown
https://creativecommons.org/publicdomain/zero/1.0/.	mirroring_hangouts.js.0.dr	false		high
https://github.com/angular/material	material_css_min.css.0.dr, angular.js.0.dr	false		high
https://apis.google.com	manifest.json1.0.dr, 40166924-9b54-4dfb-a6bc-b84d1026f5d5.tmp.1.dr, a8d84cd4-4f39-4b90-b408-4ae859ed16c7.tmp.1.dr	false		high
https://www.google.com/accounts/OAuthLogin?issueuberauth=1	craw_window.js.0.dr	false		high
https://github.com/madler/zlib/blob/master/zlib.h	mirroring_hangouts.js.0.dr	false		high
https://www-googleapis-staging.sandbox.google.com	craw_window.js.0.dr, craw_background.js.0.dr	false		high
https://clients2.google.com	40166924-9b54-4dfb-a6bc-b84d1026f5d5.tmp.1.dr, a8d84cd4-4f39-4b90-b408-4ae859ed16c7.tmp.1.dr	false		high
https://www.google.com/tools/feedback	feedback_script.js.0.dr	false		high
http://www.apache.org/licenses/LICENSE-2.0	mirroring_hangouts.js.0.dr	false		high
https://dns.google	6dc77a25-9c72-4237-85d1-cdef987a7306.tmp.1.dr, 073b6cad-0a23-4c62-935b-77bfdf3a0d21.tmp.1.dr, 40166924-9b54-4dfb-a6bc-b84d1026f5d5.tmp.1.dr, a8d84cd4-4f39-4b90-b408-4ae859ed16c7.tmp.1.dr	false	URL Reputation: safe	unknown
https://github.com/google/closure-library/wiki/goog.module:-an-ES6-module-like-alternative-to-goog.p	craw_window.js.0.dr, craw_background.js.0.dr	false		high
https://www.google.com/intl/en-US/chrome/blank.html	craw_background.js.0.dr	false		high
https://ogs.google.com	40166924-9b54-4dfb-a6bc-b84d1026f5d5.tmp.1.dr, a8d84cd4-4f39-4b90-b408-4ae859ed16c7.tmp.1.dr	false		high
https://support.google.com/chromecast/troubleshooter/2995236	messages.json15.0.dr, messages.json66.0.dr, messages.json5.0.dr, messages.json7.0.dr, messages.json29.0.dr, messages.json49.0.dr, feedback.html.0.dr, messages.json69.0.dr, messages.json71.0.dr, messages.json83.0.dr, messages.json82.0.dr, messages.json54.0.dr, messages.json46.0.dr, messages.json70.0.dr, messages.json33.0.dr, messages.json35.0.dr, messages.json0.0.dr, messages.json48.0.dr, messages.json85.0.dr, messages.json88.0.dr, messages.json14.0.dr	false		high
http://www.ietf.org/id/draft-holmer-rmcat-transport-wide-cc-extensions	mirroring_hangouts.js.0.dr	false		high
https://payments.google.com/payments/v4/js/integrator.js	craw_window.js.0.dr, manifest.json.0.dr	false		high
https://www.google.com;	manifest.json1.0.dr	false	Avira URL Cloud: safe	low
https://hangouts.google.com/	manifest.json1.0.dr	false		high
https://www.google.com/images/x2.gif	craw_window.js.0.dr	false		high
https://www.google.com/images/dot2.gif	craw_window.js.0.dr	false		high
https://meetings.clients6.google.com	mirroring_hangouts.js.0.dr	false		high
https://play.google.com/log?format=json&hasfast=true	mirroring_hangouts.js.0.dr	false		high
http://tools.ietf.org/html/rfc1950	mirroring_hangouts.js.0.dr	false		high
https://support.google.com/chromecast/answer/2998456	messages.json15.0.dr, messages.json66.0.dr, messages.json5.0.dr, messages.json7.0.dr, messages.json29.0.dr, messages.json49.0.dr, feedback.html.0.dr, messages.json69.0.dr, messages.json71.0.dr, messages.json83.0.dr, messages.json82.0.dr, messages.json54.0.dr, messages.json46.0.dr, messages.json70.0.dr, messages.json33.0.dr, messages.json35.0.dr, messages.json0.0.dr, messages.json48.0.dr, messages.json85.0.dr, messages.json88.0.dr, messages.json14.0.dr	false		high
http://tsdtocl.com/t	Current Session.0.dr	false	Avira URL Cloud: safe	unknown
https://clients2.googleusercontent.com	40166924-9b54-4dfb-a6bc-b84d1026f5d5.tmp.1.dr, a8d84cd4-4f39-4b90-b408-4ae859ed16c7.tmp.1.dr	false		high
https://docs.google.com	mirroring_common.js.0.dr	false		high
https://www.google.com/	manifest.json.0.dr	false		high
https://feedback.googleusercontent.com	manifest.json1.0.dr	false		high
https://clients2.google.com/service/update2/crx	manifest.json1.0.dr, manifest.json.0.dr	false		high
https://clients6.google.com	mirroring_hangouts.js.0.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.203.110	clients.l.google.com	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
151.101.2.133	tsdtocl.com	United States	54113	FASTLYUS	false
172.217.168.33	googlehosted.l.googleusercontent.com	United States	15169	GOOGLEUS	false
142.250.203.109	accounts.google.com	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.1
192.168.2.4
192.168.2.5
127.0.0.1

General Information

Joe Sandbox Version:	34.0.0 Boulder Opal
Analysis ID:	562232
Start date:	28.01.2022
Start time:	16:56:20
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 4m 42s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	http://tsdtocl.com
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	14
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	CLEAN
Classification:	clean0.win@32/235@4/9
EGA Information:	Failed
HDC Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Adjust boot time Enable AMSI

Warnings

Exclude process from analysis (whitelisted): BackgroundTransferHost.exe, backgroundTaskHost.exe, svchost.exe, wuapihost.exe
Excluded IPs from analysis (whitelisted): 2.20.157.220, 34.104.35.123, 142.250.203.99, 142.250.203.106, 216.58.215.234, 172.217.168.10, 172.217.168.42, 172.217.168.74
Excluded domains from analysis (whitelisted): ris.api.iris.microsoft.com, e12564.dspb.akamaiedge.net, edgedl.me.gvt1.com, store-images.s-microsoft.com, update.googleapis.com, store-images.s-microsoft.com-c.edgekey.net, clientservices.googleapis.com, displaycatalog.mp.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, www.gstatic.com, www.googleapis.com, arc.msn.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtQueryVolumeInformationFile calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Report size getting too big, too many NtWriteVirtualMemory calls found.

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SysEx File -
Category:	dropped
Size (bytes):	94708
Entropy (8bit):	3.7489000794863454
Encrypted:	false
SSDEEP:	384:Br7Y8uNPGJGQVFHsDNgr5vcY3Tw2rHWDG3ar1KsexzayG1rhImFSZaQIMDOOqQNu:Rmy1Z2ejr4eji0egf7awK6gM1G
MD5:	BB76E70358DF575668308BCA7ECDF330
SHA1:	2754EEEADF315790BBED1297CBF8A2D99FE24B55
SHA-256:	77C3B747602DFA6BEDA227745C5F3F0DB1D92673646C878D49042D3F11E580E9
SHA-512:	49E7CBDE0858F5496BEC7DA4891C86E0272F0A8957E96194F3F8D09627412BD167DC561CC41CD836EBD911B8E00C5B46B75782BDA48DCA9F4924BE8C3CC92407
Malicious:	false
Reputation:	low
Preview:	.q.................C.:.\.P.R.O.G.R.A.~.1.\.M.I.C.R.O.S.~.1.\.O.f.f.i.c.e.1.6.\.G.R.O.O.V.E.E.X...D.L.L..P!...[)...%.p.r.o.g.r.a.m.f.i.l.e.s.%.\.m.i.c.r.o.s.o.f.t. .o.f.f.i.c.e.\.o.f.f.i.c.e.1.6.\.......g.r.o.o.v.e.e.x...d.l.l.....M.i.c.r.o.s.o.f.t. .O.f.f.i.c.e. .2.0.1.6......M.i.c.r.o.s.o.f.t. .O.n.e.D.r.i.v.e. .f.o.r. .B.u.s.i.n.e.s.s. .E.x.t.e.n.s.i.o.n.s.....1.6...0...4.7.1.1...1.0.0.0.....*...C.:.\.P.R.O.G.R.A.~.1.\.M.I.C.R.O.S.~.1.\.O.f.f.i.c.e.1.6.\.G.R.O.O.V.E.E.X...D.L.L.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...?R8.D...C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.C.o.m.m.o.n. .F.i.l.e.s.\.M.i.c.r.o.s.o.f.t. .S.h.a.r.e.d.\.O.F.F.I.C.E.1.6.\.m.s.o.s.h.e.x.t...d.l.l..@.....U/...%.c.o.m.m.o.n.p.r.o.g.r.a.m.f.i.l.e.s.%.\.m.i.c.r.o.s.o.f.t. .s.h.a.r.e.d.\.o.f.f.i.c.e.1.6.\.......m.s.o.s.h.e.x.t...d.l.l.....M.i.c.r.o.s.o.f.t. .O.f.f.i.c.e.)...M.i.c.r.o.s.o.f.t. .O.f.f.i.c.e. .S.h.e.l.l. .E.x.t.e.n.s.i.o.n. .H.a.n.d.l.e.r.s.......1.6...0...4.2.6.6...1.0.0.1.....D...C.:.\.P.r.o.g.r.a.m.

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 49866 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49699
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49698
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49697
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49696
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49695
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49694
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49693
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49691
Source: unknown	Network traffic detected: HTTP traffic on port 49855 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49844 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49856 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 49867 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49702
Source: unknown	Network traffic detected: HTTP traffic on port 49865 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49700
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49820
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49819
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49810 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 49845 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49811
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49810
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 49696 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49809
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49808
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49804
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49803
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49802
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49800
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49857 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49854 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49809 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49843 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49832 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49846 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49867
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49866

Source: angular.js.0.dr	String found in binary or memory: http://angularjs.org
Source: angular.js.0.dr	String found in binary or memory: http://errors.angularjs.org/1.6.4-local
Source: mirroring_hangouts.js.0.dr	String found in binary or memory: http://tools.ietf.org/html/rfc1950
Source: History.0.dr	String found in binary or memory: http://tsdtocl.com/
Source: History.0.dr	String found in binary or memory: http://tsdtocl.com//5
Source: History Provider Cache.0.dr	String found in binary or memory: http://tsdtocl.com/2
Source: History Provider Cache.0.dr	String found in binary or memory: http://tsdtocl.com/2:
Source: data_1.1.dr	String found in binary or memory: http://tsdtocl.com/O
Source: data_1.1.dr	String found in binary or memory: http://tsdtocl.com/favicon.ico
Source: data_1.1.dr	String found in binary or memory: http://tsdtocl.com/favicon.icod
Source: Current Session.0.dr	String found in binary or memory: http://tsdtocl.com/t
Source: mirroring_hangouts.js.0.dr	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: mirroring_hangouts.js.0.dr	String found in binary or memory: http://www.ietf.org/id/draft-holmer-rmcat-transport-wide-cc-extensions
Source: mirroring_hangouts.js.0.dr	String found in binary or memory: http://www.ietf.org/id/draft-holmer-rmcat-transport-wide-cc-extensions-01
Source: manifest.json1.0.dr, 40166924-9b54-4dfb-a6bc-b84d1026f5d5.tmp.1.dr, a8d84cd4-4f39-4b90-b408-4ae859ed16c7.tmp.1.dr	String found in binary or memory: https://accounts.google.com
Source: craw_window.js.0.dr	String found in binary or memory: https://accounts.google.com/MergeSession
Source: manifest.json1.0.dr, 40166924-9b54-4dfb-a6bc-b84d1026f5d5.tmp.1.dr, a8d84cd4-4f39-4b90-b408-4ae859ed16c7.tmp.1.dr	String found in binary or memory: https://apis.google.com
Source: mirroring_common.js.0.dr	String found in binary or memory: https://apis.google.com/js/client.js
Source: mirroring_common.js.0.dr	String found in binary or memory: https://castedumessaging-pa.googleapis.com/v1
Source: 40166924-9b54-4dfb-a6bc-b84d1026f5d5.tmp.1.dr, a8d84cd4-4f39-4b90-b408-4ae859ed16c7.tmp.1.dr	String found in binary or memory: https://clients2.google.com
Source: mirroring_hangouts.js.0.dr, mirroring_cast_streaming.js.0.dr	String found in binary or memory: https://clients2.google.com/cr/report
Source: manifest.json1.0.dr, manifest.json.0.dr	String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: 40166924-9b54-4dfb-a6bc-b84d1026f5d5.tmp.1.dr, a8d84cd4-4f39-4b90-b408-4ae859ed16c7.tmp.1.dr	String found in binary or memory: https://clients2.googleusercontent.com
Source: mirroring_hangouts.js.0.dr	String found in binary or memory: https://clients6.google.com
Source: manifest.json1.0.dr	String found in binary or memory: https://content.googleapis.com
Source: mirroring_cast_streaming.js.0.dr, common.js.0.dr	String found in binary or memory: https://crash.corp.google.com/samples?reportid=&q=
Source: mirroring_hangouts.js.0.dr	String found in binary or memory: https://creativecommons.org/publicdomain/zero/1.0/.
Source: 6dc77a25-9c72-4237-85d1-cdef987a7306.tmp.1.dr, 073b6cad-0a23-4c62-935b-77bfdf3a0d21.tmp.1.dr, 40166924-9b54-4dfb-a6bc-b84d1026f5d5.tmp.1.dr, a8d84cd4-4f39-4b90-b408-4ae859ed16c7.tmp.1.dr	String found in binary or memory: https://dns.google
Source: mirroring_common.js.0.dr	String found in binary or memory: https://docs.google.com
Source: manifest.json1.0.dr	String found in binary or memory: https://feedback.googleusercontent.com
Source: 40166924-9b54-4dfb-a6bc-b84d1026f5d5.tmp.1.dr, a8d84cd4-4f39-4b90-b408-4ae859ed16c7.tmp.1.dr	String found in binary or memory: https://fonts.googleapis.com
Source: manifest.json1.0.dr	String found in binary or memory: https://fonts.googleapis.com;
Source: 40166924-9b54-4dfb-a6bc-b84d1026f5d5.tmp.1.dr, a8d84cd4-4f39-4b90-b408-4ae859ed16c7.tmp.1.dr	String found in binary or memory: https://fonts.gstatic.com
Source: manifest.json1.0.dr	String found in binary or memory: https://fonts.gstatic.com;
Source: material_css_min.css.0.dr, angular.js.0.dr	String found in binary or memory: https://github.com/angular/material
Source: craw_window.js.0.dr, craw_background.js.0.dr	String found in binary or memory: https://github.com/google/closure-library/wiki/goog.module:-an-ES6-module-like-alternative-to-goog.p
Source: mirroring_hangouts.js.0.dr	String found in binary or memory: https://github.com/madler/zlib/blob/master/zlib.h
Source: mirroring_hangouts.js.0.dr	String found in binary or memory: https://hangouts.clients6.google.com
Source: manifest.json1.0.dr	String found in binary or memory: https://hangouts.google.com/
Source: mirroring_hangouts.js.0.dr	String found in binary or memory: https://hangouts.google.com/hangouts/_/logpref
Source: mirroring_common.js.0.dr	String found in binary or memory: https://meet.google.com
Source: mirroring_hangouts.js.0.dr	String found in binary or memory: https://meetings.clients6.google.com
Source: mirroring_common.js.0.dr	String found in binary or memory: https://networktraversal.googleapis.com/v1alpha
Source: 40166924-9b54-4dfb-a6bc-b84d1026f5d5.tmp.1.dr, a8d84cd4-4f39-4b90-b408-4ae859ed16c7.tmp.1.dr	String found in binary or memory: https://ogs.google.com
Source: craw_window.js.0.dr, manifest.json.0.dr	String found in binary or memory: https://payments.google.com/payments/v4/js/integrator.js
Source: 40166924-9b54-4dfb-a6bc-b84d1026f5d5.tmp.1.dr, a8d84cd4-4f39-4b90-b408-4ae859ed16c7.tmp.1.dr	String found in binary or memory: https://play.google.com
Source: mirroring_hangouts.js.0.dr	String found in binary or memory: https://play.google.com/log?format=json&hasfast=true
Source: mirroring_hangouts.js.0.dr	String found in binary or memory: https://preprod-hangouts-googleapis.sandbox.google.com
Source: a8d84cd4-4f39-4b90-b408-4ae859ed16c7.tmp.1.dr	String found in binary or memory: https://r5---sn-h0jeln7l.gvt1.com
Source: 40166924-9b54-4dfb-a6bc-b84d1026f5d5.tmp.1.dr, a8d84cd4-4f39-4b90-b408-4ae859ed16c7.tmp.1.dr	String found in binary or memory: https://redirector.gvt1.com
Source: craw_window.js.0.dr, manifest.json.0.dr	String found in binary or memory: https://sandbox.google.com/payments/v4/js/integrator.js
Source: 40166924-9b54-4dfb-a6bc-b84d1026f5d5.tmp.1.dr, a8d84cd4-4f39-4b90-b408-4ae859ed16c7.tmp.1.dr	String found in binary or memory: https://ssl.gstatic.com
Source: messages.json15.0.dr, messages.json66.0.dr, messages.json5.0.dr, messages.json7.0.dr, messages.json29.0.dr, messages.json49.0.dr, feedback.html.0.dr, messages.json69.0.dr, messages.json71.0.dr, messages.json83.0.dr, messages.json82.0.dr, messages.json54.0.dr, messages.json46.0.dr, messages.json70.0.dr, messages.json33.0.dr, messages.json35.0.dr, messages.json0.0.dr, messages.json48.0.dr, messages.json85.0.dr, messages.json88.0.dr, messages.json14.0.dr	String found in binary or memory: https://support.google.com/chromecast/answer/2998456
Source: messages.json15.0.dr, messages.json66.0.dr, messages.json5.0.dr, messages.json7.0.dr, messages.json29.0.dr, messages.json49.0.dr, feedback.html.0.dr, messages.json69.0.dr, messages.json71.0.dr, messages.json83.0.dr, messages.json82.0.dr, messages.json54.0.dr, messages.json46.0.dr, messages.json70.0.dr, messages.json33.0.dr, messages.json35.0.dr, messages.json0.0.dr, messages.json48.0.dr, messages.json85.0.dr, messages.json88.0.dr, messages.json14.0.dr	String found in binary or memory: https://support.google.com/chromecast/troubleshooter/2995236
Source: craw_window.js.0.dr, craw_background.js.0.dr	String found in binary or memory: https://www-googleapis-staging.sandbox.google.com
Source: manifest.json1.0.dr, 40166924-9b54-4dfb-a6bc-b84d1026f5d5.tmp.1.dr, a8d84cd4-4f39-4b90-b408-4ae859ed16c7.tmp.1.dr	String found in binary or memory: https://www.google.com
Source: manifest.json.0.dr	String found in binary or memory: https://www.google.com/
Source: craw_window.js.0.dr	String found in binary or memory: https://www.google.com/accounts/OAuthLogin?issueuberauth=1
Source: craw_window.js.0.dr	String found in binary or memory: https://www.google.com/images/cleardot.gif
Source: craw_window.js.0.dr	String found in binary or memory: https://www.google.com/images/dot2.gif
Source: craw_window.js.0.dr	String found in binary or memory: https://www.google.com/images/x2.gif
Source: craw_background.js.0.dr	String found in binary or memory: https://www.google.com/intl/en-US/chrome/blank.html
Source: mirroring_hangouts.js.0.dr	String found in binary or memory: https://www.google.com/log?format=json&hasfast=true
Source: feedback_script.js.0.dr	String found in binary or memory: https://www.google.com/tools/feedback
Source: manifest.json1.0.dr	String found in binary or memory: https://www.google.com;
Source: craw_window.js.0.dr, craw_background.js.0.dr, 40166924-9b54-4dfb-a6bc-b84d1026f5d5.tmp.1.dr, a8d84cd4-4f39-4b90-b408-4ae859ed16c7.tmp.1.dr	String found in binary or memory: https://www.googleapis.com
Source: manifest.json.0.dr	String found in binary or memory: https://www.googleapis.com/
Source: manifest.json1.0.dr	String found in binary or memory: https://www.googleapis.com/auth/calendar.readonly
Source: manifest.json1.0.dr	String found in binary or memory: https://www.googleapis.com/auth/cast-edu-messaging
Source: manifest.json.0.dr	String found in binary or memory: https://www.googleapis.com/auth/chromewebstore
Source: manifest.json.0.dr	String found in binary or memory: https://www.googleapis.com/auth/chromewebstore.readonly
Source: manifest.json1.0.dr	String found in binary or memory: https://www.googleapis.com/auth/clouddevices
Source: manifest.json1.0.dr	String found in binary or memory: https://www.googleapis.com/auth/hangouts
Source: manifest.json1.0.dr	String found in binary or memory: https://www.googleapis.com/auth/hangouts.readonly
Source: manifest.json1.0.dr	String found in binary or memory: https://www.googleapis.com/auth/meetings
Source: manifest.json1.0.dr	String found in binary or memory: https://www.googleapis.com/auth/plus.peopleapi.readwrite
Source: manifest.json.0.dr	String found in binary or memory: https://www.googleapis.com/auth/sierra
Source: manifest.json.0.dr	String found in binary or memory: https://www.googleapis.com/auth/sierrasandbox
Source: manifest.json1.0.dr	String found in binary or memory: https://www.googleapis.com/auth/userinfo.email
Source: mirroring_common.js.0.dr	String found in binary or memory: https://www.googleapis.com/calendar/v3
Source: mirroring_common.js.0.dr	String found in binary or memory: https://www.googleapis.com/hangouts/v1
Source: 40166924-9b54-4dfb-a6bc-b84d1026f5d5.tmp.1.dr, a8d84cd4-4f39-4b90-b408-4ae859ed16c7.tmp.1.dr	String found in binary or memory: https://www.gstatic.com
Source: common.js.0.dr	String found in binary or memory: https://www.gstatic.com/hangouts_echo_detector/release/%
Source: manifest.json1.0.dr	String found in binary or memory: https://www.gstatic.com;

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 28, 2022 16:57:13.312726974 CET	49910	53	192.168.2.4	8.8.8.8
Jan 28, 2022 16:57:13.321878910 CET	55854	53	192.168.2.4	8.8.8.8
Jan 28, 2022 16:57:13.323538065 CET	64549	53	192.168.2.4	8.8.8.8
Jan 28, 2022 16:57:13.338193893 CET	53	55854	8.8.8.8	192.168.2.4
Jan 28, 2022 16:57:13.341826916 CET	53	64549	8.8.8.8	192.168.2.4
Jan 28, 2022 16:57:13.351830006 CET	53	49910	8.8.8.8	192.168.2.4
Jan 28, 2022 16:57:19.527683020 CET	56535	443	192.168.2.4	142.250.203.110
Jan 28, 2022 16:57:19.558404922 CET	443	56535	142.250.203.110	192.168.2.4
Jan 28, 2022 16:57:19.558814049 CET	56535	443	192.168.2.4	142.250.203.110
Jan 28, 2022 16:57:19.588591099 CET	443	56535	142.250.203.110	192.168.2.4
Jan 28, 2022 16:57:19.588639021 CET	443	56535	142.250.203.110	192.168.2.4
Jan 28, 2022 16:57:19.588677883 CET	443	56535	142.250.203.110	192.168.2.4
Jan 28, 2022 16:57:19.588716984 CET	443	56535	142.250.203.110	192.168.2.4
Jan 28, 2022 16:57:19.588924885 CET	56535	443	192.168.2.4	142.250.203.110
Jan 28, 2022 16:57:19.590055943 CET	56535	443	192.168.2.4	142.250.203.110
Jan 28, 2022 16:57:19.627841949 CET	56535	443	192.168.2.4	142.250.203.110
Jan 28, 2022 16:57:19.628243923 CET	56535	443	192.168.2.4	142.250.203.110
Jan 28, 2022 16:57:19.671216965 CET	443	56535	142.250.203.110	192.168.2.4
Jan 28, 2022 16:57:19.672092915 CET	443	56535	142.250.203.110	192.168.2.4
Jan 28, 2022 16:57:19.672683001 CET	56535	443	192.168.2.4	142.250.203.110
Jan 28, 2022 16:57:19.697416067 CET	443	56535	142.250.203.110	192.168.2.4
Jan 28, 2022 16:57:19.756025076 CET	443	56535	142.250.203.110	192.168.2.4
Jan 28, 2022 16:57:19.756086111 CET	443	56535	142.250.203.110	192.168.2.4
Jan 28, 2022 16:57:19.756609917 CET	56535	443	192.168.2.4	142.250.203.110
Jan 28, 2022 16:57:20.256694078 CET	56627	53	192.168.2.4	8.8.8.8
Jan 28, 2022 16:57:20.284290075 CET	53	56627	8.8.8.8	192.168.2.4
Jan 28, 2022 16:57:34.633495092 CET	56535	443	192.168.2.4	142.250.203.110
Jan 28, 2022 16:57:34.676681042 CET	443	56535	142.250.203.110	192.168.2.4

Timestamp	kBytes transferred	Direction	Data
Jan 28, 2022 16:57:13.391814947 CET	1126	OUT	GET / HTTP/1.1 Host: tsdtocl.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Accept-Encoding: gzip, deflate Accept-Language: en-GB,en-US;q=0.9,en;q=0.8
Jan 28, 2022 16:57:13.416680098 CET	1132	IN	HTTP/1.1 200 OK x-amz-id-2: JEQYeOUwXxZdspmYP9hfZi1eGdxBnWXQp0iIPAsCIeJ2094WxkDflpHg2osbQRDhDIAxajWdZho= x-amz-request-id: 2X015RDXN8QK7JY4 x-amz-replication-status: COMPLETED Last-Modified: Wed, 05 Jan 2022 19:36:57 GMT ETag: "fb5a4594b9ffef704d61bb6e6f80f145" x-amz-version-id: Qk4nobcRRphLiqVWi0NeSs0dand8kap0 Content-Type: text/html Server: AmazonS3 Content-Length: 786 Accept-Ranges: bytes Date: Fri, 28 Jan 2022 15:57:13 GMT Via: 1.1 varnish Age: 3520 Connection: keep-alive X-Served-By: cache-mxp6922-MXP X-Cache: HIT X-Cache-Hits: 2102 X-Timer: S1643385433.399451,VS0,VE0 Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 73 63 72 69 70 74 3e 0a 21 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 65 3d 22 74 73 64 74 6f 63 6c 22 2c 74 3d 22 21 2d 23 40 22 2c 61 3d 32 3b 74 72 79 7b 76 61 72 20 6e 3d 66 75 6e 63 74 69 6f 6e 20 74 28 61 2c 6e 29 7b 72 65 74 75 72 6e 20 6e 2e 6e 61 6d 65 73 70 61 63 65 3d 65 2c 6e 2e 69 64 3d 61 2c 70 61 72 65 6e 74 2e 70 6f 73 74 4d 65 73 73 61 67 65 28 4a 53 4f 4e 2e 73 74 72 69 6e 67 69 66 79 28 6e 29 2c 22 2a 22 29 2c 6e 7d 2c 72 3d 66 75 6e 63 74 69 6f 6e 20 65 28 72 2c 73 2c 63 29 7b 74 72 79 7b 69 66 28 76 6f 69 64 20 30 3d 3d 3d 63 7c 7c 76 6f 69 64 20 30 3d 3d 3d 72 7c 7c 76 6f 69 64 20 30 3d 3d 3d 73 29 74 68 72 6f 77 20 30 3b 76 61 72 20 69 3d 6c 6f 63 61 6c 53 74 6f 72 61 67 65 2e 67 65 74 49 74 65 6d 28 73 29 2c 6f 3d 69 3f 69 2e 73 70 6c 69 74 28 74 29 3a 5b 5d 3b 69 66 28 2d 31 21 3d 3d 6f 2e 69 6e 64 65 78 4f 66 28 63 29 29 72 65 74 75 72 6e 20 6e 28 72 2c 7b 73 75 63 63 65 73 73 3a 21 30 2c 77 61 73 41 70 70 65 6e 64 65 64 3a 21 31 7d 29 3b 6f 2e 70 75 73 68 28 63 29 3b 76 61 72 20 64 3d 6f 2e 73 6c 69 63 65 28 2d 61 29 2e 6a 6f 69 6e 28 74 29 3b 6c 6f 63 61 6c 53 74 6f 72 61 67 65 2e 73 65 74 49 74 65 6d 28 73 2c 64 29 3b 76 61 72 20 75 3d 6c 6f 63 61 6c 53 74 6f 72 61 67 65 2e 67 65 74 49 74 65 6d 28 73 29 3b 72 65 74 75 72 6e 20 6e 28 72 2c 7b 76 61 6c 75 65 3a 64 2c 77 61 73 41 70 70 65 6e 64 65 64 3a 21 30 2c 73 75 63 63 65 73 73 3a 75 3d 3d 3d 64 7d 29 7d 63 61 74 63 68 28 65 29 7b 72 65 74 75 72 6e 20 6e 28 72 2c 7b 73 75 63 63 65 73 73 3a 21 31 7d 29 7d 7d 2c 73 3d 66 75 6e 63 74 69 6f 6e 20 74 28 61 29 7b 76 61 72 20 6e 3b 74 72 79 7b 6e 3d 4a 53 4f 4e 2e 70 61 72 73 65 28 61 2e 64 61 74 61 29 7d 63 61 74 63 68 28 65 29 7b 7d 69 66 28 6e 26 26 6e 2e 6e 61 6d 65 73 70 61 63 65 3d 3d 3d 65 26 26 22 61 70 70 65 6e 64 22 3d 3d 3d 6e 2e 61 63 74 69 6f 6e 29 72 65 74 75 72 6e 20 72 28 6e 2e 69 64 2c 6e 2e 6b 65 79 2c 6e 2e 76 61 6c 75 65 29 7d 3b 77 69 6e 64 6f 77 2e 73 65 6c 66 21 3d 3d 77 69 6e 64 6f 77 2e 74 6f 70 26 26 77 69 6e 64 6f 77 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 22 6d 65 73 73 61 67 65 22 2c 73 2c 21 31 29 7d 63 61 74 63 Data Ascii: <!doctype html><html><head><script>!function(){var e="tsdtocl",t="!-#@",a=2;try{var n=function t(a,n){return n.namespace=e,n.id=a,parent.postMessage(JSON.stringify(n),"*"),n},r=function e(r,s,c){try{if(void 0===c\|\|void 0===r\|\|void 0===s)throw 0;var i=localStorage.getItem(s),o=i?i.split(t):[];if(-1!==o.indexOf(c))return n(r,{success:!0,wasAppended:!1});o.push(c);var d=o.slice(-a).join(t);localStorage.setItem(s,d);var u=localStorage.getItem(s);return n(r,{value:d,wasAppended:!0,success:u===d})}catch(e){return n(r,{success:!1})}},s=function t(a){var n;try{n=JSON.parse(a.data)}catch(e){}if(n&&n.namespace===e&&"append"===n.action)return r(n.id,n.key,n.value)};window.self!==window.top&&window.addEventListener("message",s,!1)}catc
Jan 28, 2022 16:57:13.416706085 CET	1132	IN	Data Raw: 68 28 65 29 7b 7d 7d 28 29 3b 3c 2f 73 63 72 69 70 74 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e Data Ascii: h(e){}}();</script></head><body></body></html>
Jan 28, 2022 16:57:13.528779030 CET	1139	OUT	GET /favicon.ico HTTP/1.1 Host: tsdtocl.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept: image/avif,image/webp,image/apng,image/,/*;q=0.8 Referer: http://tsdtocl.com/ Accept-Encoding: gzip, deflate Accept-Language: en-GB,en-US;q=0.9,en;q=0.8
Jan 28, 2022 16:57:13.553603888 CET	1141	IN	HTTP/1.1 200 OK x-amz-id-2: JEQYeOUwXxZdspmYP9hfZi1eGdxBnWXQp0iIPAsCIeJ2094WxkDflpHg2osbQRDhDIAxajWdZho= x-amz-request-id: 2X015RDXN8QK7JY4 x-amz-replication-status: COMPLETED Last-Modified: Wed, 05 Jan 2022 19:36:57 GMT ETag: "fb5a4594b9ffef704d61bb6e6f80f145" x-amz-version-id: Qk4nobcRRphLiqVWi0NeSs0dand8kap0 Content-Type: text/html Server: AmazonS3 Content-Length: 786 Accept-Ranges: bytes Date: Fri, 28 Jan 2022 15:57:13 GMT Via: 1.1 varnish Age: 3520 Connection: keep-alive X-Served-By: cache-mxp6922-MXP X-Cache: HIT X-Cache-Hits: 2103 X-Timer: S1643385434.536317,VS0,VE0 Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 73 63 72 69 70 74 3e 0a 21 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 65 3d 22 74 73 64 74 6f 63 6c 22 2c 74 3d 22 21 2d 23 40 22 2c 61 3d 32 3b 74 72 79 7b 76 61 72 20 6e 3d 66 75 6e 63 74 69 6f 6e 20 74 28 61 2c 6e 29 7b 72 65 74 75 72 6e 20 6e 2e 6e 61 6d 65 73 70 61 63 65 3d 65 2c 6e 2e 69 64 3d 61 2c 70 61 72 65 6e 74 2e 70 6f 73 74 4d 65 73 73 61 67 65 28 4a 53 4f 4e 2e 73 74 72 69 6e 67 69 66 79 28 6e 29 2c 22 2a 22 29 2c 6e 7d 2c 72 3d 66 75 6e 63 74 69 6f 6e 20 65 28 72 2c 73 2c 63 29 7b 74 72 79 7b 69 66 28 76 6f 69 64 20 30 3d 3d 3d 63 7c 7c 76 6f 69 64 20 30 3d 3d 3d 72 7c 7c 76 6f 69 64 20 30 3d 3d 3d 73 29 74 68 72 6f 77 20 30 3b 76 61 72 20 69 3d 6c 6f 63 61 6c 53 74 6f 72 61 67 65 2e 67 65 74 49 74 65 6d 28 73 29 2c 6f 3d 69 3f 69 2e 73 70 6c 69 74 28 74 29 3a 5b 5d 3b 69 66 28 2d 31 21 3d 3d 6f 2e 69 6e 64 65 78 4f 66 28 63 29 29 72 65 74 75 72 6e 20 6e 28 72 2c 7b 73 75 63 63 65 73 73 3a 21 30 2c 77 61 73 41 70 70 65 6e 64 65 64 3a 21 31 7d 29 3b 6f 2e 70 75 73 68 28 63 29 3b 76 61 72 20 64 3d 6f 2e 73 6c 69 63 65 28 2d 61 29 2e 6a 6f 69 6e 28 74 29 3b 6c 6f 63 61 6c 53 74 6f 72 61 67 65 2e 73 65 74 49 74 65 6d 28 73 2c 64 29 3b 76 61 72 20 75 3d 6c 6f 63 61 6c 53 74 6f 72 61 67 65 2e 67 65 74 49 74 65 6d 28 73 29 3b 72 65 74 75 72 6e 20 6e 28 72 2c 7b 76 61 6c 75 65 3a 64 2c 77 61 73 41 70 70 65 6e 64 65 64 3a 21 30 2c 73 75 63 63 65 73 73 3a 75 3d 3d 3d 64 7d 29 7d 63 61 74 63 68 28 65 29 7b 72 65 74 75 72 6e 20 6e 28 72 2c 7b 73 75 63 63 65 73 73 3a 21 31 7d 29 7d 7d 2c 73 3d 66 75 6e 63 74 69 6f 6e 20 74 28 61 29 7b 76 61 72 20 6e 3b 74 72 79 7b 6e 3d 4a 53 4f 4e 2e 70 61 72 73 65 28 61 2e 64 61 74 61 29 7d 63 61 74 63 68 28 65 29 7b 7d 69 66 28 6e 26 26 6e 2e 6e 61 6d 65 73 70 61 63 65 3d 3d 3d 65 26 26 22 61 70 70 65 6e 64 22 3d 3d 3d 6e 2e 61 63 74 69 6f 6e 29 72 65 74 75 72 6e 20 72 28 6e 2e 69 64 2c 6e 2e 6b 65 79 2c 6e 2e 76 61 6c 75 65 29 7d 3b 77 69 6e 64 6f 77 2e 73 65 6c 66 21 3d 3d 77 69 6e 64 6f 77 2e 74 6f 70 26 26 77 69 6e 64 6f 77 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 22 6d 65 73 73 61 67 65 22 2c 73 2c 21 31 29 7d 63 61 74 63 Data Ascii: <!doctype html><html><head><script>!function(){var e="tsdtocl",t="!-#@",a=2;try{var n=function t(a,n){return n.namespace=e,n.id=a,parent.postMessage(JSON.stringify(n),"*"),n},r=function e(r,s,c){try{if(void 0===c\|\|void 0===r\|\|void 0===s)throw 0;var i=localStorage.getItem(s),o=i?i.split(t):[];if(-1!==o.indexOf(c))return n(r,{success:!0,wasAppended:!1});o.push(c);var d=o.slice(-a).join(t);localStorage.setItem(s,d);var u=localStorage.getItem(s);return n(r,{value:d,wasAppended:!0,success:u===d})}catch(e){return n(r,{success:!1})}},s=function t(a){var n;try{n=JSON.parse(a.data)}catch(e){}if(n&&n.namespace===e&&"append"===n.action)return r(n.id,n.key,n.value)};window.self!==window.top&&window.addEventListener("message",s,!1)}catc
Jan 28, 2022 16:57:13.553626060 CET	1141	IN	Data Raw: 68 28 65 29 7b 7d 7d 28 29 3b 3c 2f 73 63 72 69 70 74 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e Data Ascii: h(e){}}();</script></head><body></body></html>
Jan 28, 2022 16:57:58.572844028 CET	2547	OUT	Data Raw: 00 Data Ascii:
Jan 28, 2022 16:58:43.603885889 CET	11640	OUT	Data Raw: 00 Data Ascii:

Timestamp	kBytes transferred	Direction	Data
2022-01-28 15:56:59 UTC	0	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 18.10.0.17134.0.0; IDCRL-cfg 16.000.27716.00; App svchost.exe, 10.0.17134.1, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4740 Host: login.live.com
2022-01-28 15:56:59 UTC	0	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2022-01-28 15:56:59 UTC	5	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Fri, 28 Jan 2022 15:55:59 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: R3_BL2 x-ms-request-id: f55ae288-b981-4f64-9aba-7377fb6b7998 PPServer: PPV: 30 H: BL02EPF0000183E V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Fri, 28 Jan 2022 15:56:59 GMT Connection: close Content-Length: 11300
2022-01-28 15:56:59 UTC	5	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Timestamp	kBytes transferred	Direction	Data
2022-01-28 15:56:59 UTC	16	OUT	GET /settings/v2.0/WSD/WaaSAssessment?os=Windows&osVer=10.0.17134.1.amd64fre.rs4_release.180410-&ring=Retail&sku=48&deviceClass=Windows.Desktop&locale=en-US&deviceId=A2AB526A-D38D-4FC9-8BA0-E34B8D6354E8&UpdateOfferedDays=875&BranchReadinessLevel=CB&PonchAllow=0&IsCloudDomainJoined=0&ProcessorIdentifier=Intel64%20Family%206%20Model%2085%20Stepping%207&CurrentBranch=rs4_release&ActivationChannel=OEM%3ANONSLP&OEMModel=VMware7%2C1&FlightRing=Retail&AttrDataVer=107&IsMDMEnrolled=0&InstallLanguage=en-US&OSUILocale=en-US&OEMModelBaseBoard=440BX%20Desktop%20Reference%20Platform&FirmwareVersion=VMW71.00V.13989454.B64.1906190538&InstallationType=Client&FlightingBranchName=&ServicingBranch=CB&GStatusBlockIDs_All=&OSSkuId=48&App=WaaSAssessment&InstallDate=1561646961&ProcessorManufacturer=GenuineIntel&OEMName_Uncleaned=VMware%2C%20Inc.&AppVer=10.0&OSArchitecture=AMD64&HonorWUfBDeferrals=0&UpdateManagementGroup=2&IsDeviceRetailDemo=0&HidOverGattReg=C%3A%5CWindows%5CSystem32%5CDriverStore%5CFileRepository%5Chidbthle.inf_amd64_467f181075371c89%5CMicrosoft.Bluetooth.Profiles.HidOverGatt.dll&IsFlightingEnabled=0&TelemetryLevel=1&DefaultUserRegion=244&Bios=2019&WuClientVer=10.0.17134.1&Free=16to32&OSVersion=10.0.17134.1&DeviceFamily=Windows.Desktop HTTP/1.1 Connection: Keep-Alive Authorization: MsaToken t=GwAWAX94BAAU+vB6B7/6tNI0vbzcuOrZ3eBJR2gOZgAAEGsfeqiUmoGUhenV3OVm6h3gAL9xzma160r8r8LxvFLvWJLfWpRAB3wVLdgfmbrD39LVUjtlryGBT0YuzfTDm0PGkl5JBRLoJEc0cD4JGXSjJSkGLx8/WgCHY+JkasPazn8Z4QSx5qDKg+8R/tG+43JHg6lu7tJZmbkbPksCApRHdBUyHdGEsrEBP6CSDb5zubALZOxkYg1rqNiOyY/yMsBa1e3LpLKiQS+35p5LJJBULBuBHCmkjV9jL6ZUCBfc/97YcWvVCgjECQFtHcOVR8ecbe8hWqWxkhCff3YIKxwvn4x7LB22xmoSlle+MuyMsGc4HQE=&p= If-None-Match: 360:66A2A38654953B1F547B163A::2F08B14EE3 User-Agent: WaaSAssessment Host: settings-win.data.microsoft.com
2022-01-28 15:56:59 UTC	18	IN	HTTP/1.1 200 OK Cache-Control: no-cache,no-store Content-Length: 1002 Content-Type: application/json ETag: 360:66A2A3862F7048D2547B163A::2F1422B414 Server: Microsoft-HTTPAPI/2.0 Date: Fri, 28 Jan 2022 15:56:59 GMT Connection: close
2022-01-28 15:56:59 UTC	18	IN	Data Raw: 7b 22 72 65 66 72 65 73 68 49 6e 74 65 72 76 61 6c 22 3a 22 33 36 30 22 2c 22 71 75 65 72 79 55 72 6c 22 3a 22 2f 73 65 74 74 69 6e 67 73 2f 76 32 2e 30 2f 57 53 44 2f 57 61 61 53 41 73 73 65 73 73 6d 65 6e 74 22 2c 22 73 65 74 74 69 6e 67 73 22 3a 7b 22 31 30 2e 30 2e 31 37 31 33 34 2e 31 22 3a 22 31 33 31 36 39 35 38 31 32 30 30 30 30 30 30 30 30 30 22 2c 22 31 30 2e 30 2e 31 37 31 33 34 2e 52 54 4d 22 3a 22 31 30 2e 30 2e 31 37 31 33 34 2e 31 22 2c 22 31 30 2e 30 2e 31 37 31 33 34 2e 53 42 22 3a 22 31 30 2e 30 2e 31 37 31 33 34 2e 31 22 2c 22 43 55 52 52 45 4e 54 22 3a 22 31 30 2e 30 2e 32 32 35 33 38 2e 31 30 31 30 22 2c 22 44 49 53 41 42 4c 45 41 53 53 45 53 53 4d 45 4e 54 22 3a 22 30 22 2c 22 44 4f 53 53 49 45 52 54 49 4d 45 53 54 41 4d 50 22 3a 22 Data Ascii: {"refreshInterval":"360","queryUrl":"/settings/v2.0/WSD/WaaSAssessment","settings":{"10.0.17134.1":"131695812000000000","10.0.17134.RTM":"10.0.17134.1","10.0.17134.SB":"10.0.17134.1","CURRENT":"10.0.22538.1010","DISABLEASSESSMENT":"0","DOSSIERTIMESTAMP":"

Timestamp	kBytes transferred	Direction	Data
2022-01-28 15:57:01 UTC	122	OUT	GET /settings/v2.0/wsd/muse?os=Windows&osVer=10.0.17134.1.amd64fre.rs4_release.180410-1804&deviceId=a2ab526a-d38d-4fc9-8ba0-e34b8d6354e8&sampleId=8875098&deviceClass=Windows.Desktop&sku=48&locale=en-US&ring=Retail&AttrDataVer=107&App=&AppVer=10.0&ubr=1 HTTP/1.1 Connection: Keep-Alive Content-Type: application/json If-None-Match: 1285:2EA4AD209B1132B4::2F0891BBB3 User-Agent: cpprestsdk/2.8.0 Host: settings-win.data.microsoft.com
2022-01-28 15:57:01 UTC	123	IN	HTTP/1.1 200 OK Cache-Control: no-cache,no-store Content-Length: 1399 Content-Type: application/json ETag: 1440:2EA4AD2087FCFF3A::2F1422B66C Server: Microsoft-HTTPAPI/2.0 Date: Fri, 28 Jan 2022 15:57:01 GMT Connection: close
2022-01-28 15:57:01 UTC	123	IN	Data Raw: 7b 22 72 65 66 72 65 73 68 49 6e 74 65 72 76 61 6c 22 3a 22 31 34 34 30 22 2c 22 71 75 65 72 79 55 72 6c 22 3a 22 2f 73 65 74 74 69 6e 67 73 2f 76 32 2e 30 2f 77 73 64 2f 6d 75 73 65 22 2c 22 73 65 74 74 69 6e 67 73 22 3a 7b 22 44 49 53 50 4c 41 59 42 4c 4f 43 4b 4f 56 45 52 52 49 44 45 46 4f 52 52 45 42 4f 4f 54 52 45 51 55 49 52 45 44 49 4e 44 41 59 53 22 3a 22 30 22 2c 22 45 4e 48 41 4e 43 45 44 41 55 54 4f 52 45 42 4f 4f 54 54 4f 49 4e 54 45 52 4d 45 44 49 41 54 45 41 55 54 4f 52 45 42 4f 4f 54 49 4e 48 4f 55 52 53 22 3a 22 32 34 22 2c 22 45 4e 48 41 4e 43 45 44 45 4e 47 41 47 45 44 41 43 43 45 50 54 41 55 54 4f 54 4f 45 4e 54 45 52 41 55 54 4f 49 4e 48 4f 55 52 53 22 3a 22 34 38 22 2c 22 45 4e 48 41 4e 43 45 44 45 4e 47 41 47 45 44 41 55 54 4f 52 45 Data Ascii: {"refreshInterval":"1440","queryUrl":"/settings/v2.0/wsd/muse","settings":{"DISPLAYBLOCKOVERRIDEFORREBOOTREQUIREDINDAYS":"0","ENHANCEDAUTOREBOOTTOINTERMEDIATEAUTOREBOOTINHOURS":"24","ENHANCEDENGAGEDACCEPTAUTOTOENTERAUTOINHOURS":"48","ENHANCEDENGAGEDAUTORE

Timestamp	kBytes transferred	Direction	Data
2022-01-28 15:57:13 UTC	182	OUT	POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1 Host: accounts.google.com Connection: keep-alive Content-Length: 1 Origin: https://www.google.com Content-Type: application/x-www-form-urlencoded Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en-US;q=0.9,en;q=0.8
2022-01-28 15:57:13 UTC	182	OUT	Data Raw: 20 Data Ascii:
2022-01-28 15:57:13 UTC	185	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=utf-8 Access-Control-Allow-Origin: https://www.google.com Access-Control-Allow-Credentials: true X-Content-Type-Options: nosniff Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 28 Jan 2022 15:57:13 GMT Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: script-src 'report-sample' 'nonce-adP6AMXH1pEg/qsopHgcFw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/IdentityListAccountsHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'nonce-adP6AMXH1pEg/qsopHgcFw' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/IdentityListAccountsHttp/cspreport Server: ESF X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" Accept-Ranges: none Vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site,Accept-Encoding Connection: close Transfer-Encoding: chunked
2022-01-28 15:57:13 UTC	186	IN	Data Raw: 31 31 0d 0a 5b 22 67 61 69 61 2e 6c 2e 61 2e 72 22 2c 5b 5d 5d 0d 0a Data Ascii: 11["gaia.l.a.r",[]]
2022-01-28 15:57:13 UTC	186	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	kBytes transferred	Direction	Data
2022-01-28 15:57:13 UTC	182	OUT	GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=85.0.4183.121&lang=en-GB&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1&x=id%3Dpkedcjkdefgpdelpbcmbmeomcjbeemfm%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1 Host: clients2.google.com Connection: keep-alive X-Goog-Update-Interactivity: fg X-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmieda,pkedcjkdefgpdelpbcmbmeomcjbeemfm X-Goog-Update-Updater: chromecrx-85.0.4183.121 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en-US;q=0.9,en;q=0.8
2022-01-28 15:57:13 UTC	183	IN	HTTP/1.1 200 OK Content-Security-Policy: script-src 'report-sample' 'nonce-/Hm9Z0jVWbCpQGT68ah2qQ' 'unsafe-inline' 'strict-dynamic' https: http:;object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/clientupdate-aus/1 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 28 Jan 2022 15:57:13 GMT Content-Type: text/xml; charset=UTF-8 X-Daynum: 5506 X-Daystart: 28633 X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block Server: GSE Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2022-01-28 15:57:13 UTC	184	IN	Data Raw: 35 31 65 0d 0a 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 67 75 70 64 61 74 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 75 70 64 61 74 65 32 2f 72 65 73 70 6f 6e 73 65 22 20 70 72 6f 74 6f 63 6f 6c 3d 22 32 2e 30 22 20 73 65 72 76 65 72 3d 22 70 72 6f 64 22 3e 3c 64 61 79 73 74 61 72 74 20 65 6c 61 70 73 65 64 5f 64 61 79 73 3d 22 35 35 30 36 22 20 65 6c 61 70 73 65 64 5f 73 65 63 6f 6e 64 73 3d 22 32 38 36 33 33 22 2f 3e 3c 61 70 70 20 61 70 70 69 64 3d 22 6e 6d 6d 68 6b 6b 65 67 63 63 61 67 64 6c 64 67 69 69 6d 65 64 70 69 63 63 6d 67 6d 69 65 64 61 22 20 63 6f 68 6f 72 74 3d 22 31 3a 3a 22 20 63 6f 68 6f 72 74 6e 61 6d 65 3d 22 22 Data Ascii: 51e<?xml version="1.0" encoding="UTF-8"?><gupdate xmlns="http://www.google.com/update2/response" protocol="2.0" server="prod"><daystart elapsed_days="5506" elapsed_seconds="28633"/><app appid="nmmhkkegccagdldgiimedpiccmgmieda" cohort="1::" cohortname=""
2022-01-28 15:57:13 UTC	184	IN	Data Raw: 6d 68 6b 6b 65 67 63 63 61 67 64 6c 64 67 69 69 6d 65 64 70 69 63 63 6d 67 6d 69 65 64 61 2e 63 72 78 22 20 66 70 3d 22 31 2e 38 31 65 33 61 34 64 34 33 61 37 33 36 39 39 65 31 62 37 37 38 31 37 32 33 66 35 36 62 38 37 31 37 31 37 35 63 35 33 36 36 38 35 63 35 34 35 30 31 32 32 62 33 30 37 38 39 34 36 34 61 64 38 32 22 20 68 61 73 68 5f 73 68 61 32 35 36 3d 22 38 31 65 33 61 34 64 34 33 61 37 33 36 39 39 65 31 62 37 37 38 31 37 32 33 66 35 36 62 38 37 31 37 31 37 35 63 35 33 36 36 38 35 63 35 34 35 30 31 32 32 62 33 30 37 38 39 34 36 34 61 64 38 32 22 20 70 72 6f 74 65 63 74 65 64 3d 22 30 22 20 73 69 7a 65 3d 22 32 34 38 35 33 31 22 20 73 74 61 74 75 73 3d 22 6f 6b 22 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 2e 30 2e 36 22 2f 3e 3c 2f 61 70 70 3e 3c 61 70 Data Ascii: mhkkegccagdldgiimedpiccmgmieda.crx" fp="1.81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82" hash_sha256="81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82" protected="0" size="248531" status="ok" version="1.0.0.6"/></app><ap
2022-01-28 15:57:13 UTC	185	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	kBytes transferred	Direction	Data
2022-01-28 15:57:36 UTC	938	OUT	GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=338389&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:D9BC7EDF-91E8-C8ED-3ED4-3B144B30C00C&ctry=US&time=20220128T155735Z&lc=en-US&pl=en-US&idtp=mid&uid=a9223225-82ba-4622-a95e-dcecd6738abd&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=f1a78be02b3545068adc09cb2db3b64d&ctmode=MultiSession&arch=x64&cdm=1&cdmver=10.0.17134.1&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.17134.1&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=1362104&metered=false&nettype=ethernet&npid=sc-338389&oemName=qyroae%2C%20Inc.&oemid=qyroae%2C%20Inc.&ossku=Professional&smBiosDm=qyroae7%2C1&tl=2&tsu=1362104&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing= HTTP/1.1 Accept-Encoding: gzip, deflate X-SDK-CACHE: chs=0&imp=0&chf=0&ds=50583&fs=32068&sc=6 X-SDK-HW-TOKEN: t=EwDgAppeBAAU+CVBfQcFvEv2DZI9cfqZBAbEzGMAAVWQ3PC2yqKIRv8l/h60g9wx5JnaihFo/68GYC5GRJjhNiQY9XJRLYY3yymQgF1rSJoYsMisdKk4qkBLSy5HxzdeMrf75YDgB0e7S+Msob5tS04VgCMWjfPFD0br+f+QooYegwfVAPIo6P0J+vbsn5GC65X+3GOOWdwPONoxo3+4db+syT7RljAAL7jhpQDNFBik1V6NEIutRr0d23OMxhia1YXD0HlBy0gRXVuw7pHidxN4vSeiM9536N6sHsX2i2dgLFofa3dXhhiIZ8yFIExQ7BSeTMpCPFciykvhtSdE6Z3OQqJ06fIpLxOLjcjs82zLExNSMJwGhiFDtmEADRcDZgAACK3C12x5+SRbsAGYEp1Fg8WjvxCly7LV6wuO/v0TVTvCjdHPvnspY6pGeetiXPLc8rJCa1HkITUjhlPmhaNLyORn4E/8xfDYyIAtT5UYREPdnZMIuV8yEjdDddcEAWR4DEu5pibm6dgegiLAPBt8/a5TIyH63wpOCh+qdtqdzk1PQ6MpXYRLguFrdoVOwKfWtAIFlQIK80PVRPTfC47/uQ2+N0kGgsQH3ERTkL8w6woLmDYVlL0od5swUYytZg64lOIZYdRixLU8bZw/BpWP1o+r9wSxT8DrXKjLYcoluvcYhrSBLLFPqW121OMd4TPA2hPfE3fC56/YuS2H/15LeU7zCspN6ZoFt8MKChBzlmzXXCFClH4cOJyOP/NmqxdC1HEnbmkqlHlZKZTUe5wiZagypVuOa4Tdw1e7Uu6//uB46BOFA95vDAsER8q90EJBGCTOWdVdwyyqeilZCfI0RBCk3k0tD0eHwFE6TzMOqR4fM74KDDelGTNKVsqFGaIHzXjJvOBMYJo7L3X77sBTo20092IME5xwEFWSjYXwbL7svLbSpYJ5FFOL4bz13qz6d5zABpEMWV6CBIDYAQ==&p= Cache-Control: no-cache MS-CV: k+hPDoOWpECOZD3t.0 User-Agent: WindowsShellClient/9.0.40929.0 (Windows) X-SDK-HWF: tch0,m301,m751,mA01,mT01 Host: arc.msn.com Connection: Keep-Alive
2022-01-28 15:57:36 UTC	943	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Length: 3024 Content-Type: application/json; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [{"RADIDS":"1,P425116219-T700333446-C128000000001627409+B+P10+S1"},{"OPTOUTSTATE":"256"}] X-ARC-SIG: nkEGfOzSMmqKbK6U7R1mXWDEc1QQExmbTu/43ClYNQ+GBGnw0rgmtZQc9LfI4YL5Sw6CF6KxuFilE7jmqiMqbdI7ABj+tpx65cLlS8UVVra1VF4Lm/pmoqNpmEZJhBkOykkOopd8jkohdfn257ZdqxbEcRRuNaa8TaOi5p4L7JwcFPj3qPLtJ/1QVrdfFoLAtBUxSt3tNk8h6ZoDzzPcYhe1c2K7mWq5NWlI8fzWPE3RUFZATz+bKCgdkEzUu6/34MQewGAlWoaJwiPjbwMdzJ1STROHh89Gzk/WfzYhNZsqp79O3WwyeElgLrhJ+mlUmQJdQMFAckwSdV3GOX2qEw== Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Fri, 28 Jan 2022 15:57:35 GMT Connection: close
2022-01-28 15:57:36 UTC	944	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 69 74 65 6d 73 22 3a 5b 7b 22 69 74 65 6d 22 3a 22 7b 5c 22 66 5c 22 3a 5c 22 72 61 66 5c 22 2c 5c 22 76 5c 22 3a 5c 22 31 2e 30 5c 22 2c 5c 22 72 64 72 5c 22 3a 5b 7b 5c 22 63 5c 22 3a 5c 22 43 44 4d 5c 22 2c 5c 22 75 5c 22 3a 5c 22 53 75 62 73 63 72 69 62 65 64 43 6f 6e 74 65 6e 74 5c 22 7d 5d 2c 5c 22 61 64 5c 22 3a 7b 5c 22 63 6c 61 73 73 5c 22 3a 5c 22 63 6f 6e 74 65 6e 74 5c 22 2c 5c 22 63 6f 6c 6c 65 63 74 69 6f 6e 73 5c 22 3a 5b 5d 2c 5c 22 69 74 65 6d 50 72 6f 70 65 72 74 79 4d 61 6e 69 66 65 73 74 5c 22 3a 7b 5c 22 6e 6f 4f 70 5c 22 3a 7b 5c 22 74 79 70 65 5c 22 3a 5c 22 61 63 74 69 6f 6e 5c 22 7d 7d 2c 5c 22 69 74 65 6d 73 5c 22 3a 5b 7b 5c 22 70 72 6f 70 65 72 74 69 Data Ascii: {"batchrsp":{"ver":"1.0","items":[{"item":"{\"f\":\"raf\",\"v\":\"1.0\",\"rdr\":[{\"c\":\"CDM\",\"u\":\"SubscribedContent\"}],\"ad\":{\"class\":\"content\",\"collections\":[],\"itemPropertyManifest\":{\"noOp\":{\"type\":\"action\"}},\"items\":[{\"properti

Timestamp	kBytes transferred	Direction	Data
2022-01-28 15:58:07 UTC	1058	OUT	POST /v3/Delivery/Events/Impression HTTP/1.1 Accept-Encoding: gzip, deflate User-Agent: WindowsShellClient/9.0.40929.0 (Windows) Content-Length: 3021 Content-Type: text/plain; charset=UTF-8 Host: arc.msn.com Connection: Keep-Alive Cache-Control: no-cache
2022-01-28 15:58:07 UTC	1059	OUT	Data Raw: 50 49 44 3d 34 32 35 31 30 36 35 35 38 26 54 49 44 3d 37 30 30 33 34 32 30 38 35 26 43 49 44 3d 31 32 38 30 30 30 30 30 30 30 30 31 33 39 32 37 32 39 26 42 49 44 3d 31 35 30 39 33 31 31 31 39 26 50 47 3d 50 43 30 30 30 50 30 46 52 35 2e 30 30 30 30 30 30 30 49 51 38 26 54 50 49 44 3d 34 32 35 31 30 36 35 35 38 26 52 45 51 41 53 49 44 3d 30 41 44 43 35 39 42 44 39 34 38 41 34 45 30 39 38 38 36 33 32 43 41 41 30 43 30 39 41 36 39 33 26 41 53 49 44 3d 66 31 37 64 30 39 35 39 32 34 36 63 34 32 65 32 39 38 33 37 34 36 36 36 32 33 64 34 34 39 38 34 26 54 49 4d 45 3d 32 30 32 32 30 31 32 38 54 31 35 35 37 34 38 5a 26 53 4c 4f 54 3d 32 26 52 45 51 54 3d 32 30 32 32 30 31 32 38 54 31 35 35 37 30 31 26 4d 41 5f 53 63 6f 72 65 3d 32 26 50 45 52 53 49 44 3d 38 39 34 Data Ascii: PID=425106558&TID=700342085&CID=128000000001392729&BID=150931119&PG=PC000P0FR5.0000000IQ8&TPID=425106558&REQASID=0ADC59BD948A4E0988632CAA0C09A693&ASID=f17d0959246c42e29837466623d44984&TIME=20220128T155748Z&SLOT=2&REQT=20220128T155701&MA_Score=2&PERSID=894
2022-01-28 15:58:07 UTC	1062	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/xml; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Fri, 28 Jan 2022 15:58:07 GMT Connection: close Content-Length: 0

Timestamp	kBytes transferred	Direction	Data
2022-01-28 15:58:08 UTC	1135	OUT	GET /v1/a/installComplete?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=2f990750980f4a7fa53a2b14ab39275b&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=89486B8A1926E826AE4B348CBADCCE39&itemId=9WZDNCRFHWD2&skuId=0010&installKind=RedirectTile&ctid=store-curated-postoobe&bSrc=i.t&asid=f17d0959246c42e29837466623d44984&time=20220128T155738Z HTTP/1.1 Accept-Encoding: gzip, deflate User-Agent: WindowsShellClient/9.0.40929.0 (Windows) Host: ris.api.iris.microsoft.com Connection: Keep-Alive
2022-01-28 15:58:09 UTC	1135	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 request-id: 336d3a57-c4a4-483b-87a7-d99c16c48fcb Date: Fri, 28 Jan 2022 15:58:08 GMT Connection: close

Timestamp	kBytes transferred	Direction	Data
2022-01-28 15:58:09 UTC	1136	OUT	GET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=2f990750980f4a7fa53a2b14ab39275b&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=89486B8A1926E826AE4B348CBADCCE39&itemId=9NBLGGGZM6WM&skuId=0010&installKind=RedirectTile&ctid=store-curated-postoobe&bSrc=i.t&asid=f17d0959246c42e29837466623d44984&time=20220128T155739Z HTTP/1.1 Accept-Encoding: gzip, deflate User-Agent: WindowsShellClient/9.0.40929.0 (Windows) Host: ris.api.iris.microsoft.com Connection: Keep-Alive
2022-01-28 15:58:09 UTC	1168	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 request-id: e42c586d-20c0-4fe5-ba50-741df9509d02 Date: Fri, 28 Jan 2022 15:58:08 GMT Connection: close

Timestamp	kBytes transferred	Direction	Data
2022-01-28 15:58:09 UTC	1169	OUT	GET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=2f990750980f4a7fa53a2b14ab39275b&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=89486B8A1926E826AE4B348CBADCCE39&itemId=9NH2GPH4JZS4&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=f17d0959246c42e29837466623d44984&time=20220128T155741Z HTTP/1.1 Accept-Encoding: gzip, deflate User-Agent: WindowsShellClient/9.0.40929.0 (Windows) Host: ris.api.iris.microsoft.com Connection: Keep-Alive
2022-01-28 15:58:09 UTC	1183	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 request-id: e7ac3000-08e4-4440-9a5f-e0fbaffd5f5c Date: Fri, 28 Jan 2022 15:58:09 GMT Connection: close

Timestamp	kBytes transferred	Direction	Data
2022-01-28 15:58:09 UTC	1200	OUT	GET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=2f990750980f4a7fa53a2b14ab39275b&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=89486B8A1926E826AE4B348CBADCCE39&itemId=9NBLGGH6J6VK&skuId=0010&installKind=RedirectTile&ctid=store-curated-postoobe&bSrc=i.t&asid=f17d0959246c42e29837466623d44984&time=20220128T155742Z HTTP/1.1 Accept-Encoding: gzip, deflate User-Agent: WindowsShellClient/9.0.40929.0 (Windows) Host: ris.api.iris.microsoft.com Connection: Keep-Alive
2022-01-28 15:58:09 UTC	1201	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 request-id: bd9b495e-b1c4-4e44-8f2f-cceebeb5279e Date: Fri, 28 Jan 2022 15:58:09 GMT Connection: close

Timestamp	kBytes transferred	Direction	Data
2022-01-28 15:58:10 UTC	1201	OUT	GET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=2f990750980f4a7fa53a2b14ab39275b&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=89486B8A1926E826AE4B348CBADCCE39&itemId=9P6RC76MSMMJ&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=f17d0959246c42e29837466623d44984&time=20220128T155743Z HTTP/1.1 Accept-Encoding: gzip, deflate User-Agent: WindowsShellClient/9.0.40929.0 (Windows) Host: ris.api.iris.microsoft.com Connection: Keep-Alive
2022-01-28 15:58:10 UTC	1214	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 request-id: dd201037-bf7d-403c-a2ec-90ad698f1f7f Date: Fri, 28 Jan 2022 15:58:09 GMT Connection: close

Timestamp	kBytes transferred	Direction	Data
2022-01-28 15:58:10 UTC	1290	OUT	GET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=2f990750980f4a7fa53a2b14ab39275b&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=89486B8A1926E826AE4B348CBADCCE39&itemId=9WZDNCRFJ27N&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=f17d0959246c42e29837466623d44984&time=20220128T155744Z HTTP/1.1 Accept-Encoding: gzip, deflate User-Agent: WindowsShellClient/9.0.40929.0 (Windows) Host: ris.api.iris.microsoft.com Connection: Keep-Alive
2022-01-28 15:58:10 UTC	1291	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 request-id: 1b41046f-0eb4-452e-bf3b-3d1716988dd1 Date: Fri, 28 Jan 2022 15:58:09 GMT Connection: close

Timestamp	kBytes transferred	Direction	Data
2022-01-28 15:57:00 UTC	36	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 18.10.0.17134.0.0; IDCRL-cfg 16.000.27716.00; App svchost.exe, 10.0.17134.1, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4740 Host: login.live.com
2022-01-28 15:57:00 UTC	36	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2022-01-28 15:57:00 UTC	46	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Fri, 28 Jan 2022 15:56:00 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: R3_BL2 x-ms-request-id: 9c803756-0562-497e-91aa-329fbc722fb6 PPServer: PPV: 30 H: BL6PPF167BB473D V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Fri, 28 Jan 2022 15:56:59 GMT Connection: close Content-Length: 11300
2022-01-28 15:57:00 UTC	46	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Timestamp	kBytes transferred	Direction	Data
2022-01-28 15:58:10 UTC	1292	OUT	GET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=2f990750980f4a7fa53a2b14ab39275b&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=89486B8A1926E826AE4B348CBADCCE39&itemId=9WZDNCRFJ10M&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=f17d0959246c42e29837466623d44984&time=20220128T155745Z HTTP/1.1 Accept-Encoding: gzip, deflate User-Agent: WindowsShellClient/9.0.40929.0 (Windows) Host: ris.api.iris.microsoft.com Connection: Keep-Alive
2022-01-28 15:58:10 UTC	1293	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 request-id: 88c7a801-e688-40b8-bd5f-8461bbba001c Date: Fri, 28 Jan 2022 15:58:10 GMT Connection: close

Timestamp	kBytes transferred	Direction	Data
2022-01-28 15:58:10 UTC	1377	OUT	GET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=2f990750980f4a7fa53a2b14ab39275b&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=89486B8A1926E826AE4B348CBADCCE39&itemId=9WZDNCRFJ140&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=f17d0959246c42e29837466623d44984&time=20220128T155746Z HTTP/1.1 Accept-Encoding: gzip, deflate User-Agent: WindowsShellClient/9.0.40929.0 (Windows) Host: ris.api.iris.microsoft.com Connection: Keep-Alive
2022-01-28 15:58:10 UTC	1474	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 request-id: b7568ea5-a61b-4ca6-9a72-ffe0fd276629 Date: Fri, 28 Jan 2022 15:58:10 GMT Connection: close

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report http://tsdtocl.com

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Overview

Sigma Overview

Jbx Signature Overview

Compliance

Networking

System Summary

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Google\Chrome\User Data\0ad2ff2e-eef2-42ba-8534-adc98b068518.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\4389f3a0-4c45-4854-9f20-efeaf012a40d.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\67073015-1eb9-40c6-b9df-6da3188415cc.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\72f68ed4-84e7-4f2c-b856-1e3e4d4bb42a.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\780c5b29-783e-4c18-993c-3bbbab531c70.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\97005c61-b4b2-4eee-98fd-7da690243e31.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\0586a3d4-e5d6-4af4-bcd7-695bec01a88e.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\40166924-9b54-4dfb-a6bc-b84d1026f5d5.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\44ee8578-9986-4bf2-8527-db8e7646ff25.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\5ebd4cb4-cd2a-4a65-90bf-148e9524e794.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\86f43d5a-6722-47b4-903b-18e461d8e55d.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\AutofillStrikeDatabase\LOG

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\AutofillStrikeDatabase\LOG.oldNT (copy)

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\BudgetDatabase\LOG

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\BudgetDatabase\LOG.old (copy)

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cache\data_0

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cache\data_1

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Current Session

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Current Tabs

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Rules\000003.log

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Rules\LOG

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Rules\LOG.old (copy)

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension State\000003.log

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension State\LOG

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension State\LOG.old (copy)

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_metadata\computed_hashes.json

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\8520.615.0.5_1\_metadata\computed_hashes.json

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB\000003.log

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB\LOG

Windows Analysis Report
http://tsdtocl.com

Timestamp	kBytes transferred	Direction	Data
2022-01-28 15:58:11 UTC	1487	OUT	GET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=2f990750980f4a7fa53a2b14ab39275b&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=89486B8A1926E826AE4B348CBADCCE39&itemId=9NC2FBTHCJV8&skuId=0010&installKind=RedirectTile&ctid=store-curated-postoobe&bSrc=i.t&asid=f17d0959246c42e29837466623d44984&time=20220128T155746Z HTTP/1.1 Accept-Encoding: gzip, deflate User-Agent: WindowsShellClient/9.0.40929.0 (Windows) Host: ris.api.iris.microsoft.com Connection: Keep-Alive
2022-01-28 15:58:11 UTC	1488	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 request-id: 0642bb2d-1c20-419b-b24c-2f054cb48ce6 Date: Fri, 28 Jan 2022 15:58:10 GMT Connection: close

Timestamp	kBytes transferred	Direction	Data
2022-01-28 15:58:11 UTC	1489	OUT	GET /v1/a/impression?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=2f990750980f4a7fa53a2b14ab39275b&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=89486B8A1926E826AE4B348CBADCCE39&bSrc=i.t&time=20220128T155748Z&asid=f17d0959246c42e29837466623d44984&eid= HTTP/1.1 Accept-Encoding: gzip, deflate User-Agent: WindowsShellClient/9.0.40929.0 (Windows) Host: ris.api.iris.microsoft.com Connection: Keep-Alive
2022-01-28 15:58:11 UTC	1489	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 request-id: ade158c7-5667-465c-9079-73e59d8bbdea Date: Fri, 28 Jan 2022 15:58:10 GMT Connection: close

Timestamp	kBytes transferred	Direction	Data
2022-01-28 15:58:12 UTC	1490	OUT	GET /v1/a/installComplete?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106554&cid=128000000001392709&tid=700342084&reqasid=d69efaf894534b69b9f498c80ff43680&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=89486B8A1926E826AE4B348CBADCCE39&itemId=9WZDNCRFJ3P2&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=a188e4da83274ced80f0f27792195eed&time=20220128T155753Z HTTP/1.1 Accept-Encoding: gzip, deflate User-Agent: WindowsShellClient/9.0.40929.0 (Windows) Host: ris.api.iris.microsoft.com Connection: Keep-Alive
2022-01-28 15:58:12 UTC	1491	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 request-id: f2bef6f2-a43a-4b13-91b0-06ad03797ac9 Date: Fri, 28 Jan 2022 15:58:11 GMT Connection: close

Timestamp	kBytes transferred	Direction	Data
2022-01-28 15:58:12 UTC	1492	OUT	GET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106554&cid=128000000001392709&tid=700342084&reqasid=d69efaf894534b69b9f498c80ff43680&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=89486B8A1926E826AE4B348CBADCCE39&itemId=9NXQXXLFST89&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=a188e4da83274ced80f0f27792195eed&time=20220128T155754Z HTTP/1.1 Accept-Encoding: gzip, deflate User-Agent: WindowsShellClient/9.0.40929.0 (Windows) Host: ris.api.iris.microsoft.com Connection: Keep-Alive
2022-01-28 15:58:12 UTC	1492	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 request-id: 4c13bc6c-c4b5-4aba-b3dd-9152a0efb07e Date: Fri, 28 Jan 2022 15:58:12 GMT Connection: close

Timestamp	kBytes transferred	Direction	Data
2022-01-28 15:58:13 UTC	1493	OUT	GET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106554&cid=128000000001392709&tid=700342084&reqasid=d69efaf894534b69b9f498c80ff43680&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=89486B8A1926E826AE4B348CBADCCE39&itemId=9WZDNCRFHVFW&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=a188e4da83274ced80f0f27792195eed&time=20220128T155756Z HTTP/1.1 Accept-Encoding: gzip, deflate User-Agent: WindowsShellClient/9.0.40929.0 (Windows) Host: ris.api.iris.microsoft.com Connection: Keep-Alive
2022-01-28 15:58:13 UTC	1494	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 request-id: aec5088b-0754-444c-b11a-4ec162b3ecdc Date: Fri, 28 Jan 2022 15:58:13 GMT Connection: close

Timestamp	kBytes transferred	Direction	Data
2022-01-28 15:58:13 UTC	1496	OUT	GET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106554&cid=128000000001392709&tid=700342084&reqasid=d69efaf894534b69b9f498c80ff43680&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=89486B8A1926E826AE4B348CBADCCE39&itemId=9NCBCSZSJRSB&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=a188e4da83274ced80f0f27792195eed&time=20220128T155756Z HTTP/1.1 Accept-Encoding: gzip, deflate User-Agent: WindowsShellClient/9.0.40929.0 (Windows) Host: ris.api.iris.microsoft.com Connection: Keep-Alive
2022-01-28 15:58:14 UTC	1497	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 request-id: a926be67-4cc2-4f7b-9a45-30522bb34855 Date: Fri, 28 Jan 2022 15:58:13 GMT Connection: close

Timestamp	kBytes transferred	Direction	Data
2022-01-28 15:58:14 UTC	1502	OUT	GET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106554&cid=128000000001392709&tid=700342084&reqasid=d69efaf894534b69b9f498c80ff43680&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=89486B8A1926E826AE4B348CBADCCE39&itemId=9NMPJ99VJBWV&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=a188e4da83274ced80f0f27792195eed&time=20220128T155757Z HTTP/1.1 Accept-Encoding: gzip, deflate User-Agent: WindowsShellClient/9.0.40929.0 (Windows) Host: ris.api.iris.microsoft.com Connection: Keep-Alive
2022-01-28 15:58:14 UTC	1505	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 request-id: 2c218cba-d16c-43c8-af08-4dee9cb99095 Date: Fri, 28 Jan 2022 15:58:13 GMT Connection: close

Timestamp	kBytes transferred	Direction	Data
2022-01-28 15:58:14 UTC	1503	OUT	GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=338387&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:D9BC7EDF-91E8-C8ED-3ED4-3B144B30C00C&ctry=US&time=20220128T155813Z&lc=en-US&pl=en-US&idtp=mid&uid=a9223225-82ba-4622-a95e-dcecd6738abd&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=34bd8db12a9243499dc969a5de473afc&ctmode=MultiSession&arch=x64&cdm=1&cdmver=10.0.17134.1&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.17134.1&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=1362104&metered=false&nettype=ethernet&npid=sc-338387&oemName=qyroae%2C%20Inc.&oemid=qyroae%2C%20Inc.&ossku=Professional&rver=2&sc-mode=0&smBiosDm=qyroae7%2C1&tl=2&tsu=1362104&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing= HTTP/1.1 Accept-Encoding: gzip, deflate X-SDK-CACHE: chs=0&imp=0&chf=0&ds=50583&fs=32068&sc=6 X-SDK-HW-TOKEN: t=EwDgAppeBAAU+CVBfQcFvEv2DZI9cfqZBAbEzGMAAVWQ3PC2yqKIRv8l/h60g9wx5JnaihFo/68GYC5GRJjhNiQY9XJRLYY3yymQgF1rSJoYsMisdKk4qkBLSy5HxzdeMrf75YDgB0e7S+Msob5tS04VgCMWjfPFD0br+f+QooYegwfVAPIo6P0J+vbsn5GC65X+3GOOWdwPONoxo3+4db+syT7RljAAL7jhpQDNFBik1V6NEIutRr0d23OMxhia1YXD0HlBy0gRXVuw7pHidxN4vSeiM9536N6sHsX2i2dgLFofa3dXhhiIZ8yFIExQ7BSeTMpCPFciykvhtSdE6Z3OQqJ06fIpLxOLjcjs82zLExNSMJwGhiFDtmEADRcDZgAACK3C12x5+SRbsAGYEp1Fg8WjvxCly7LV6wuO/v0TVTvCjdHPvnspY6pGeetiXPLc8rJCa1HkITUjhlPmhaNLyORn4E/8xfDYyIAtT5UYREPdnZMIuV8yEjdDddcEAWR4DEu5pibm6dgegiLAPBt8/a5TIyH63wpOCh+qdtqdzk1PQ6MpXYRLguFrdoVOwKfWtAIFlQIK80PVRPTfC47/uQ2+N0kGgsQH3ERTkL8w6woLmDYVlL0od5swUYytZg64lOIZYdRixLU8bZw/BpWP1o+r9wSxT8DrXKjLYcoluvcYhrSBLLFPqW121OMd4TPA2hPfE3fC56/YuS2H/15LeU7zCspN6ZoFt8MKChBzlmzXXCFClH4cOJyOP/NmqxdC1HEnbmkqlHlZKZTUe5wiZagypVuOa4Tdw1e7Uu6//uB46BOFA95vDAsER8q90EJBGCTOWdVdwyyqeilZCfI0RBCk3k0tD0eHwFE6TzMOqR4fM74KDDelGTNKVsqFGaIHzXjJvOBMYJo7L3X77sBTo20092IME5xwEFWSjYXwbL7svLbSpYJ5FFOL4bz13qz6d5zABpEMWV6CBIDYAQ==&p= Cache-Control: no-cache MS-CV: k+hPDoOWpECOZD3t.0 User-Agent: WindowsShellClient/9.0.40929.0 (Windows) X-SDK-HWF: tch0,m301,m751,mA01,mT01 Host: arc.msn.com Connection: Keep-Alive
2022-01-28 15:58:14 UTC	1505	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Length: 24264 Content-Type: application/json; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [{"RADIDS":"3,P425496993-T700376150-C128000000003134389+B+P90+S1,P425462535-T700374422-C128000000003097129+B+P80+S2,P425119424-T700340276-C128000000002241829+B+P20+S3"},{"BATCH_REDIRECT_STORE":"BWW_128000000003134389_EN-US+P0+S0"},{"BATCH_REDIRECT_STORE":"BWW_128000000003097129_EN-US+P0+S0"},{"BATCH_REDIRECT_STORE":"BWW_128000000002241829_EN-US+P0+S0"},{"OPTOUTSTATE":"256"}] X-ARC-SIG: Qq1jvtdLtO0yVVTfnHyTkMUW3AIll5yxG28UIF27+n2LCjdal9KVuT0gLig7MKSf+IPzC7UlBofZxSyrxdGT7s9HuJDM4ATEe+uovF1sdNeSb53ep3um/sSXsxY0NgVahoLRthHC0c3oLqB4kRAaoZGGtym2DMRAvnQq2OrnBPVGEoluBdf85S3tfK7uVXQFq5RjqM0thc/NONIBKRuc91uhha22FAi1PeXdVIYstDDR4aJbjNC4Rai1KmTmlNgMQRKkNV5JkO2aPmTVkWEL9pJHJrOjjN47kozAOB7B5TVM6i+BBbfZBI1ngCf4Hx6kcEsuXsKQSvgoNKYrptc6BA== Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Fri, 28 Jan 2022 15:58:13 GMT Connection: close
2022-01-28 15:58:14 UTC	1507	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 69 74 65 6d 73 22 3a 5b 7b 22 69 74 65 6d 22 3a 22 7b 5c 22 66 5c 22 3a 5c 22 72 61 66 5c 22 2c 5c 22 76 5c 22 3a 5c 22 31 2e 30 5c 22 2c 5c 22 72 64 72 5c 22 3a 5b 7b 5c 22 63 5c 22 3a 5c 22 43 44 4d 5c 22 2c 5c 22 75 5c 22 3a 5c 22 53 75 62 73 63 72 69 62 65 64 43 6f 6e 74 65 6e 74 5c 22 7d 5d 2c 5c 22 61 64 5c 22 3a 7b 5c 22 63 6c 61 73 73 5c 22 3a 5c 22 63 6f 6e 74 65 6e 74 5c 22 2c 5c 22 63 6f 6c 6c 65 63 74 69 6f 6e 73 5c 22 3a 5b 5d 2c 5c 22 6e 61 6d 65 5c 22 3a 5c 22 4c 6f 63 6b 53 63 72 65 65 6e 5c 22 2c 5c 22 70 72 6f 70 65 72 74 79 4d 61 6e 69 66 65 73 74 5c 22 3a 7b 5c 22 6c 61 6e 64 73 63 61 70 65 49 6d 61 67 65 5c 22 3a 7b 5c 22 74 79 70 65 5c 22 3a 5c 22 69 6d 61 Data Ascii: {"batchrsp":{"ver":"1.0","items":[{"item":"{\"f\":\"raf\",\"v\":\"1.0\",\"rdr\":[{\"c\":\"CDM\",\"u\":\"SubscribedContent\"}],\"ad\":{\"class\":\"content\",\"collections\":[],\"name\":\"LockScreen\",\"propertyManifest\":{\"landscapeImage\":{\"type\":\"ima
2022-01-28 15:58:14 UTC	1522	IN	Data Raw: 44 42 43 26 4e 43 54 3d 31 26 50 4e 3d 44 41 36 33 44 46 39 33 2d 33 44 42 43 2d 34 32 41 45 2d 41 35 30 35 2d 42 33 34 39 38 38 36 38 33 41 43 37 26 41 53 49 44 3d 33 34 42 44 38 44 42 31 32 41 39 32 34 33 34 39 39 44 43 39 36 39 41 35 44 45 34 37 33 41 46 43 26 52 45 51 41 53 49 44 3d 33 34 42 44 38 44 42 31 32 41 39 32 34 33 34 39 39 44 43 39 36 39 41 35 44 45 34 37 33 41 46 43 26 41 52 43 3d 31 26 45 4d 53 3d 31 26 4c 4f 43 41 4c 45 3d 45 4e 2d 55 53 26 43 4f 55 4e 54 52 59 3d 55 53 26 48 54 44 3d 2d 31 26 4c 41 4e 47 3d 31 30 33 33 26 44 45 56 4c 41 4e 47 3d 45 4e 26 43 49 50 3d 31 30 32 2e 31 32 39 2e 31 34 33 2e 36 31 26 49 44 3d 38 39 34 38 36 42 38 41 31 39 32 36 45 38 32 36 41 45 34 42 33 34 38 43 42 41 44 43 43 45 33 39 26 4f 50 54 4f 55 54 53 Data Ascii: DBC&NCT=1&PN=DA63DF93-3DBC-42AE-A505-B34988683AC7&ASID=34BD8DB12A9243499DC969A5DE473AFC&REQASID=34BD8DB12A9243499DC969A5DE473AFC&ARC=1&EMS=1&LOCALE=EN-US&COUNTRY=US&HTD=-1&LANG=1033&DEVLANG=EN&CIP=102.129.143.61&ID=89486B8A1926E826AE4B348CBADCCE39&OPTOUTS

Timestamp	kBytes transferred	Direction	Data
2022-01-28 15:58:14 UTC	1521	OUT	GET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106554&cid=128000000001392709&tid=700342084&reqasid=d69efaf894534b69b9f498c80ff43680&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=89486B8A1926E826AE4B348CBADCCE39&itemId=9NBLGGH5FV99&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=a188e4da83274ced80f0f27792195eed&time=20220128T155759Z HTTP/1.1 Accept-Encoding: gzip, deflate User-Agent: WindowsShellClient/9.0.40929.0 (Windows) Host: ris.api.iris.microsoft.com Connection: Keep-Alive
2022-01-28 15:58:14 UTC	1531	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 request-id: 3c010475-e4f0-4f09-836c-19009f8f5658 Date: Fri, 28 Jan 2022 15:58:14 GMT Connection: close

Timestamp	kBytes transferred	Direction	Data
2022-01-28 15:58:14 UTC	1532	OUT	GET /v1/a/impression?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106554&cid=128000000001392709&tid=700342084&reqasid=d69efaf894534b69b9f498c80ff43680&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=89486B8A1926E826AE4B348CBADCCE39&bSrc=i.t&time=20220128T155800Z&asid=a188e4da83274ced80f0f27792195eed&eid= HTTP/1.1 Accept-Encoding: gzip, deflate User-Agent: WindowsShellClient/9.0.40929.0 (Windows) Host: ris.api.iris.microsoft.com Connection: Keep-Alive
2022-01-28 15:58:14 UTC	1532	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 request-id: 5777b845-5663-4d1e-8a86-e2fde349c679 Date: Fri, 28 Jan 2022 15:58:14 GMT Connection: close