Edit tour

Windows Analysis Report
https://794609.documents.savethenote2.com/healthesystems/viewAgreement?tsid=ZGFyeWxAaGVhbHRoZXN5c3RlbXMuY29t#%25EMAILX

Overview

General Information

Sample URL:	https://794609.documents.savethenote2.com/healthesystems/viewAgreement?tsid=ZGFyeWxAaGVhbHRoZXN5c3RlbXMuY29t#%25EMAILX
Analysis ID:	628360
Infos:

Detection

Score:	48
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Classification

Process Tree

System is w10x64

chrome.exe (PID: 3420 cmdline: C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --enable-automation "https://794609.documents.savethenote2.com/healthesystems/viewAgreement?tsid=ZGFyeWxAaGVhbHRoZXN5c3RlbXMuY29t#%25EMAILX MD5: C139654B5C1438A95B321BB01AD63EF6)

chrome.exe (PID: 5612 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1536,186412520852336944,848366137565786927,131072 --lang=en-GB --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1952 /prefetch:8 MD5: C139654B5C1438A95B321BB01AD63EF6)

cleanup

HTTP traffic detected: POST /threshold/xls.aspx HTTP/1.1Origin: https://www.bing.comReferer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/InitContent-type: text/xmlX-MSEdge-ExternalExpType: JointCoordX-MSEdge-ExternalExp: d-thshld39,d-thshld42,d-thshld77,d-thshld78,d-thshldspcl40X-PositionerType: DesktopX-Search-CortanaAvailableCapabilities: CortanaExperience,SpeechLanguageX-Search-SafeSearch: ModerateX-Device-MachineId: {A2AB526A-D38D-4FC9-8BA0-E34B8D6354E8}X-UserAgeClass: UnknownX-BM-Market: USX-BM-DateFormat: M/d/yyyyX-CortanaAccessAboveLock: falseX-Device-OSSKU: 48X-BM-DTZ: 60X-BM-FirstEnabledTime: 132061327679472806X-DeviceID: 0100748C0900D485X-BM-DeviceScale: 100X-Search-TimeZone: Bias=-60; StandardBias=0; TimeZoneKeyName=W. Europe Standard TimeX-BM-Theme: 000000;0078d7X-BM-DeviceDimensionsLogical: 1232x1024X-BM-DeviceDimensions: 1232x1024X-Search-RPSToken: t%3DEwDYAkR8BAAUcvamItSE/vUHpyZRp3BeyOJPQDsAAcrCUQHVmc1QWYMPz0DXFqeRx8wamoowmwbwUSyNYpjtyJpJRDfEtLg1rKS4/zxABCoKsuMFRUBIP7PFid4xD2qKyI0URDzKuBMFjFkKzlG3Ps9MGF%2BBZXTdKnpAzZrlgOtRPCtamchXz28q0CRmPxXD6ZHI2rcMOvnUBLbt1zkoTBTKYibaVaGygpAEYQDTKkpAamKV8eOep8EnHN50LiR92MCKiQtLylSx/qTDVfvmE81bne2UzPZEbqlm/DPuKdzajAWp%2BXa91MUXk%2BgPu95uggy8QPGrNOWbn7IkTjFjqBdAhJ5m/BiU45rQu3ck%2B6RC%2BU%2BEalYU42PwbfQmsDwDZgAACHBtXI8rJNLaqAG5bveMLq14sdqoo9yPGDTdHxA7OjsAOmIxUTUXgi%2B44zK9rStYOMPMq4e6et15tJFBbG2jKGVdJMY3ZkTFu%2BHWNopmckOWLVgFNq79y3hmsdxc1wOedU50wO01k4tR95v4Imjx%2BJujGLa9TWHvuxeDQi9Y4ybY/y9vY1LteXSo0kKHbGazTsLNxyFfmSDOcn8ClbW9bmk0c4jHKD1yRpmMUoJ6GMEDPMqNOCkwrk63Ab7wPb/Ik//Xt/R1gr%2Bom7Tc2OeYYcdyru5UC/xxsJOAvl6NlTvqnrrwv3tNwIcpsdUqBF6TuxWSlAQvZrc4R0FfqAmC1gmCnHgcn6LOJmRb0NP4X2cysqVe7yMirSTCCMByWMIyPaVuut%2BME7E/g1i7%2BF6GOmOb4jaw5esWXZItZITutJph%2B%2BiB5Jhj5m5K8KwagRMAS5gWCtioSFd8CezxoiPqJxEvqdn2z7PYPJa2IEPLnuo8hgVRtHuU8/aTQiACqk%2BA7ilNPbpjD1XsiVE35rwQalWYecZgjOX1bVhMm1bTSpRC5s14qea2UC8ENIkJSR9nRsud1AE%3D%26p%3DX-Agent-DeviceId: 0100748C0900D485X-BM-CBT: 1646732532X-Device-isOptin: trueX-Device-Touch: falseX-Device-ClientSession: B3FD0EB2977A44E390C07B484049F516X-Search-AppId: Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUIX-BM-ClientFeatures: pbitcpdisabled,AmbientWidescreen,rs1musicprod,CortanaSPAXamlHeaderAccept: */*Accept-Language: en-USAccept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.10.7.17134; 10.0.0.0.17134.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: www.bing.comContent-Length: 87238Connection: Keep-AliveCache-Control: no-cacheCookie: MUID=BEEBF15262804E24A8DF6781500AB975; _SS=CPID=1652795010993&AC=1&CPH=4ef661f2

Source: unknown	HTTPS traffic detected: 163.181.56.168:443 -> 192.168.2.4:49775 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.35.236.56:443 -> 192.168.2.4:49803 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.159.70:443 -> 192.168.2.4:49805 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.159.70:443 -> 192.168.2.4:49806 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.50.102.62:443 -> 192.168.2.4:49807 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.50.102.62:443 -> 192.168.2.4:49808 version: TLS 1.2

Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49808
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49804
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49803
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443

Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.200
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.200
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.200
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.200
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.200
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.200
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.200
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.200
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.200
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.200
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.200
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.200
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.200
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.200
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.200
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.4
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.4
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.4
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.4
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.4
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.4
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.4
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.4
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.4
Source: unknown	TCP traffic detected without corresponding DNS query: 93.184.220.29
Source: unknown	TCP traffic detected without corresponding DNS query: 8.248.119.254
Source: unknown	TCP traffic detected without corresponding DNS query: 93.184.220.29
Source: unknown	TCP traffic detected without corresponding DNS query: 8.248.119.254
Source: unknown	TCP traffic detected without corresponding DNS query: 8.248.119.254
Source: unknown	TCP traffic detected without corresponding DNS query: 93.184.220.29
Source: unknown	TCP traffic detected without corresponding DNS query: 8.248.119.254
Source: unknown	TCP traffic detected without corresponding DNS query: 93.184.220.29
Source: unknown	TCP traffic detected without corresponding DNS query: 8.248.119.254
Source: unknown	TCP traffic detected without corresponding DNS query: 93.184.220.29
Source: unknown	TCP traffic detected without corresponding DNS query: 8.248.119.254
Source: unknown	TCP traffic detected without corresponding DNS query: 93.184.220.29
Source: unknown	TCP traffic detected without corresponding DNS query: 8.248.119.254
Source: unknown	TCP traffic detected without corresponding DNS query: 93.184.220.29
Source: unknown	TCP traffic detected without corresponding DNS query: 23.35.236.56
Source: unknown	TCP traffic detected without corresponding DNS query: 23.35.236.56
Source: unknown	TCP traffic detected without corresponding DNS query: 23.35.236.56
Source: unknown	TCP traffic detected without corresponding DNS query: 23.35.236.56
Source: unknown	TCP traffic detected without corresponding DNS query: 23.35.236.56
Source: unknown	TCP traffic detected without corresponding DNS query: 23.35.236.56
Source: unknown	TCP traffic detected without corresponding DNS query: 23.35.236.56
Source: unknown	TCP traffic detected without corresponding DNS query: 23.35.236.56
Source: unknown	TCP traffic detected without corresponding DNS query: 23.35.236.56
Source: unknown	TCP traffic detected without corresponding DNS query: 23.35.236.56
Source: unknown	TCP traffic detected without corresponding DNS query: 23.35.236.56
Source: unknown	TCP traffic detected without corresponding DNS query: 23.35.236.56

Source: global traffic	HTTP traffic detected: GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=310091&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:D9BC7EDF-91E8-C8ED-3ED4-3B144B30C00C&ctry=US&time=20220308T094328Z&lc=en-US&pl=en-US&idtp=mid&uid=a9223225-82ba-4622-a95e-dcecd6738abd&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=340fcbd17d984582956074ac2676dc1d&ctmode=MultiSession&arch=x64&cdm=1&cdmver=10.0.17134.1&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.17134.1&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=1417890&metered=false&nettype=ethernet&npid=sc-310091&oemName=VMware%2C%20Inc.&oemid=VMware%2C%20Inc.&ossku=Professional&rver=2&smBiosDm=VMware7%2C1&tl=2&tsu=1417890&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing= HTTP/1.1Accept-Encoding: gzip, deflateX-SDK-CACHE: chs=0&imp=0&chf=0&ds=50583&fs=32089&sc=6Cache-Control: no-cacheMS-CV: 3Frur/zANU+2hPRe.0User-Agent: WindowsShellClient/9.0.40929.0 (Windows)X-SDK-HWF: tch0,m301,m751,mA01,mT01Host: arc.msn.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=314559&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:D9BC7EDF-91E8-C8ED-3ED4-3B144B30C00C&ctry=US&time=20220308T094328Z&lc=en-US&pl=en-US&idtp=mid&uid=a9223225-82ba-4622-a95e-dcecd6738abd&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=0cd746982547431ebc0f1410502cc6dc&ctmode=MultiSession&arch=x64&cdm=1&cdmver=10.0.17134.1&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.17134.1&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=1417890&metered=false&nettype=ethernet&npid=sc-314559&oemName=VMware%2C%20Inc.&oemid=VMware%2C%20Inc.&ossku=Professional&smBiosDm=VMware7%2C1&tl=2&tsu=1417890&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing= HTTP/1.1Accept-Encoding: gzip, deflateX-SDK-CACHE: chs=0&imp=0&chf=0&ds=50583&fs=32089&sc=6Cache-Control: no-cacheMS-CV: 3Frur/zANU+2hPRe.0User-Agent: WindowsShellClient/9.0.40929.0 (Windows)X-SDK-HWF: tch0,m301,m751,mA01,mT01Host: arc.msn.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=85.0.4183.121&lang=en-GB&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1&x=id%3Dpkedcjkdefgpdelpbcmbmeomcjbeemfm%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1Host: clients2.google.comConnection: keep-aliveX-Goog-Update-Interactivity: fgX-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmieda,pkedcjkdefgpdelpbcmbmeomcjbeemfmX-Goog-Update-Updater: chromecrx-85.0.4183.121Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic	HTTP traffic detected: GET /healthesystems/viewAgreement?tsid=ZGFyeWxAaGVhbHRoZXN5c3RlbXMuY29t HTTP/1.1Host: 794609.documents.savethenote2.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic	HTTP traffic detected: GET /300/150/?image=824 HTTP/1.1Host: picsum.photosConnection: keep-aliveOrigin: https://794609.documents.savethenote2.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: imageReferer: https://794609.documents.savethenote2.com/healthesystems/viewAgreement?tsid=ZGFyeWxAaGVhbHRoZXN5c3RlbXMuY29tAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic	HTTP traffic detected: GET //2.6.3/images/icon_light.f13cff3.png HTTP/1.1Host: cstaticdun.126.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://794609.documents.savethenote2.com/healthesystems/viewAgreement?tsid=ZGFyeWxAaGVhbHRoZXN5c3RlbXMuY29tAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic	HTTP traffic detected: GET /id/824/300/150.jpg?hmac=YLOxcCAmebF9Wvsp1kXa3AWYWkixtbvoNd_HdkCBBTE HTTP/1.1Host: i.picsum.photosConnection: keep-aliveOrigin: nullUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: imageReferer: https://794609.documents.savethenote2.com/healthesystems/viewAgreement?tsid=ZGFyeWxAaGVhbHRoZXN5c3RlbXMuY29tAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: 794609.documents.savethenote2.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://794609.documents.savethenote2.com/healthesystems/viewAgreement?tsid=ZGFyeWxAaGVhbHRoZXN5c3RlbXMuY29tAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic	HTTP traffic detected: GET //2.6.3/images/icon_light.f13cff3.png HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: cstaticdun.126.net
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Thu, 20 Apr 2017 16:10:39 GMTUser-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=280815&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:D9BC7EDF-91E8-C8ED-3ED4-3B144B30C00C&ctry=US&time=20220517T134422Z&lc=en-US&pl=en-US&idtp=mid&uid=a9223225-82ba-4622-a95e-dcecd6738abd&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=a7b9b775e4244c17a2ebb9b348f2e15b&ctmode=MultiSession&arch=x64&cdm=1&cdmver=10.0.17134.1&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.17134.1&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=1518931&metered=false&nettype=ethernet&npid=sc-280815&oemName=hqfxfl%2C%20Inc.&oemid=hqfxfl%2C%20Inc.&ossku=Professional&smBiosDm=hqfxfl7%2C1&tl=2&tsu=1518931&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing= HTTP/1.1Accept-Encoding: gzip, deflateX-SDK-CACHE: chs=0&imp=0&chf=0&ds=50583&fs=32089&sc=6X-SDK-HW-TOKEN: t=EwDgAppeBAAUlAKXDAofTQM+n+MaRVFKzH/ehWgAARv7pEmU4rHAqGoJtj7oLSB7v2mwo43vyD+jN/gk3QZIlZytJXk/gSdJdrqom9LMkpbx5q52rTOUcWeySoU1PLcNmtBMdJaE6JD0HtBaB5hCqsJVawrWly7rtJA8RvE8yD5/UA7Go+f/Y5zG9wg5eei7acRCsS7+kaTbNsSVG+99ds/Q2CN2lULRIyni/dGAvALBGERxqjkkAvrMGuVYqrXHljAAZpFbJEYX4mICp3VJTA0p6oFnLhdLQnZFrFHiBwNh/zPgYz3DH1DGAHfXOCa9J8Ht4vCrKGPIrpA3r5dFe8wNhXN1b0bwPmboXlmVS9zyZQtCNG4TcACF9m3bQWYDZgAACLw17X7Ub0dbsAGKuSJVgxSwi0tKQ+TNf8JJmL63B6BCOLjUH5I+HTsU8HL8yBmScnGFeIUjxwABKk+yQ5FuYoKT5el5ZHhj8bK/Lqgj2K0jXexFv7So5dDFHGWBt/QM4LK7IXpkrhPtQexjN1XRl9ZimwP4ARxK2pvZ4JDKsiviJE5gvFkNdqB1Qcmt1xO3KPVbtBBK4Ima8M5aPihMW+E4jO3oLOEE79zsH0ZpeZUcspD2tc9+tCOKvnjbx8UmAnJ4g7gN9gXI4NtvliRjBiozoyQJqTkrjnFofBvyaou/IPhBBD3yALwiEV8aKDiVhLAGu6bgzrHeiPPOR/huZtUW9poR1Qg+eB1ypgElFq0oSFqqFtidpV1/oDjd87FjqUtfMiu2gC7SmpbaRkCnKkBmwkEbBkbOVZ1dihVEFnZcOv/mED6OR6bAIZqSXYR4WK0KQVoEnKI75+po0gwgsjfS7vnrhE/wtE4SqLk+byXg0nYEmbeCw7UW7SOGzDrZmR2ki1DEXXfenU4Gj2a7j/92itPbvh214HIE+AdnxOU3zRK9XliCU2wNcbhbXD7y9+BCqM3DEKZmGBLVAQ==&p=Cache-Control: no-cacheMS-CV: yZRXp+ETA0iBnc90.0User-Agent: WindowsShellClient/9.0.40929.0 (Windows)X-SDK-HWF: tch0,m301,m751,mA01,mT01Host: arc.msn.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=338389&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:D9BC7EDF-91E8-C8ED-3ED4-3B144B30C00C&ctry=US&time=20220517T134422Z&lc=en-US&pl=en-US&idtp=mid&uid=a9223225-82ba-4622-a95e-dcecd6738abd&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=88de42ba51a74435b63ce5307e97d3db&ctmode=MultiSession&arch=x64&cdm=1&cdmver=10.0.17134.1&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.17134.1&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=1518931&metered=false&nettype=ethernet&npid=sc-338389&oemName=hqfxfl%2C%20Inc.&oemid=hqfxfl%2C%20Inc.&ossku=Professional&smBiosDm=hqfxfl7%2C1&tl=2&tsu=1518931&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing= HTTP/1.1Accept-Encoding: gzip, deflateX-SDK-CACHE: chs=0&imp=0&chf=0&ds=50583&fs=32089&sc=6X-SDK-HW-TOKEN: t=EwDgAppeBAAUlAKXDAofTQM+n+MaRVFKzH/ehWgAAYsYKM5ZU2Pb/75z7e4LkjPFpqpXjR3ia8MwwiKgB042MZCULMjptCZQbXpXYTIhKbJ4vhYwiZu05TXgF+bzBFAPoIf+cYoXdWxtXqTod94sJJWfQ6OYTFdX7heii6jJwXFfP8w4XBsKTzmFP/j3T2rysSlmlPEH6NyTIJAe+xtuOzwsMkHq9LCEeeIhl5/Xn1X0kQl3D2r9/nTMXYHny8N455ERdLDjTld7e27bmlq0RTK0OzxW9pkPFm006asI+yrfcg026+McHDK1YfEnKubX2GRshPOd/d/v/Dm1mYGXI19oT8IflwJKcQELOjev7cGQTNrTFxicy/1WGNAmZZYDZgAACKQR4ZejftO5sAH80dZ2R2rL48TFIxX0JqvOA3il6Q7oHrPELZYGQ2kZaFg2844HDd71owhVaOWvnMbJT1ouHXTKAvn8n3548hiodrutgVBXPnwf9anVHO+HBDHouooXHP5y7JY6GrrydpoUojV4MAGYtZHIu2EziJ68sZPUARTQhbEezd8mOwMvEEQegHv9yFCqq23/4iUrXq2v1HywyX0p9MNp55o4iUmimGn/gcA6+WK8VqBX77uAlB5Ib7DlkZgMqj32uzBndxA5KoklC1Bqasf9I5WfR23gxL1xfT8lmliCkIhcddART8CHYT0DDrPq7HmV+jL5Y9QLBJDB8jpkGlC/QZl1WpskHkpivv0j/V1IAkMbI0ZJBnkJMPMSPJJ4iAcOuzhTVzM9G7SYKbCBG5JyKyfJv6EA5Z7ohDI3UWuN8yoivQ/m6ubqs4jZxzWtm/hiO92BYld4gsrufiGO+KQn35fEJwFJrDXCVh2LG0cuE254mIv97LcIWQAIfuEqYyOJ/Q59k+4qDO3HlL7UdavBbeMKkO6DUqMpYS9MRxg/rJqNZ4Zf0H/UzMJSm1QgtmzDwDkXry7VAQ==&p=Cache-Control: no-cacheMS-CV: yZRXp+ETA0iBnc90.0User-Agent: WindowsShellClient/9.0.40929.0 (Windows)X-SDK-HWF: tch0,m301,m751,mA01,mT01Host: arc.msn.comConnection: Keep-Alive

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 17 May 2022 13:43:51 GMTServer: ApacheUpgrade: h2,h2cConnection: Upgrade, closeAccept-Ranges: bytesContent-Length: 10855Content-Type: text/html
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 17 May 2022 13:43:52 GMTServer: ApacheUpgrade: h2,h2cConnection: Upgrade, closeAccept-Ranges: bytesContent-Length: 10855Content-Type: text/html

Source: 89c591ae-3842-475c-aea8-3969c74e8deb.tmp.1.dr	String found in binary or memory: https://accounts.google.com
Source: craw_window.js.0.dr	String found in binary or memory: https://accounts.google.com/MergeSession
Source: 89c591ae-3842-475c-aea8-3969c74e8deb.tmp.1.dr	String found in binary or memory: https://apis.google.com
Source: 89c591ae-3842-475c-aea8-3969c74e8deb.tmp.1.dr	String found in binary or memory: https://clients2.google.com
Source: manifest.json.0.dr	String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: 89c591ae-3842-475c-aea8-3969c74e8deb.tmp.1.dr	String found in binary or memory: https://clients2.googleusercontent.com
Source: 89c591ae-3842-475c-aea8-3969c74e8deb.tmp.1.dr, f3713998-9dc4-4d07-a259-ed8b9f4487ce.tmp.1.dr	String found in binary or memory: https://dns.google
Source: 89c591ae-3842-475c-aea8-3969c74e8deb.tmp.1.dr	String found in binary or memory: https://fonts.googleapis.com
Source: 89c591ae-3842-475c-aea8-3969c74e8deb.tmp.1.dr	String found in binary or memory: https://fonts.gstatic.com
Source: craw_window.js.0.dr, craw_background.js.0.dr	String found in binary or memory: https://github.com/google/closure-library/wiki/goog.module:-an-ES6-module-like-alternative-to-goog.p
Source: 89c591ae-3842-475c-aea8-3969c74e8deb.tmp.1.dr	String found in binary or memory: https://ogs.google.com
Source: craw_window.js.0.dr, manifest.json.0.dr	String found in binary or memory: https://payments.google.com/payments/v4/js/integrator.js
Source: 89c591ae-3842-475c-aea8-3969c74e8deb.tmp.1.dr	String found in binary or memory: https://play.google.com
Source: 89c591ae-3842-475c-aea8-3969c74e8deb.tmp.1.dr	String found in binary or memory: https://r5---sn-h0jeln7l.gvt1.com
Source: 89c591ae-3842-475c-aea8-3969c74e8deb.tmp.1.dr	String found in binary or memory: https://redirector.gvt1.com
Source: craw_window.js.0.dr, manifest.json.0.dr	String found in binary or memory: https://sandbox.google.com/payments/v4/js/integrator.js
Source: 89c591ae-3842-475c-aea8-3969c74e8deb.tmp.1.dr	String found in binary or memory: https://ssl.gstatic.com
Source: craw_window.js.0.dr, craw_background.js.0.dr	String found in binary or memory: https://www-googleapis-staging.sandbox.google.com
Source: 89c591ae-3842-475c-aea8-3969c74e8deb.tmp.1.dr	String found in binary or memory: https://www.google.com
Source: manifest.json.0.dr	String found in binary or memory: https://www.google.com/
Source: craw_window.js.0.dr	String found in binary or memory: https://www.google.com/accounts/OAuthLogin?issueuberauth=1
Source: craw_window.js.0.dr	String found in binary or memory: https://www.google.com/images/cleardot.gif
Source: craw_window.js.0.dr	String found in binary or memory: https://www.google.com/images/dot2.gif
Source: craw_window.js.0.dr	String found in binary or memory: https://www.google.com/images/x2.gif
Source: craw_background.js.0.dr	String found in binary or memory: https://www.google.com/intl/en-US/chrome/blank.html
Source: 89c591ae-3842-475c-aea8-3969c74e8deb.tmp.1.dr, craw_window.js.0.dr, craw_background.js.0.dr	String found in binary or memory: https://www.googleapis.com
Source: manifest.json.0.dr	String found in binary or memory: https://www.googleapis.com/
Source: manifest.json.0.dr	String found in binary or memory: https://www.googleapis.com/auth/chromewebstore
Source: manifest.json.0.dr	String found in binary or memory: https://www.googleapis.com/auth/chromewebstore.readonly
Source: manifest.json.0.dr	String found in binary or memory: https://www.googleapis.com/auth/sierra
Source: manifest.json.0.dr	String found in binary or memory: https://www.googleapis.com/auth/sierrasandbox
Source: 89c591ae-3842-475c-aea8-3969c74e8deb.tmp.1.dr	String found in binary or memory: https://www.gstatic.com

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --enable-automation "https://794609.documents.savethenote2.com/healthesystems/viewAgreement?tsid=ZGFyeWxAaGVhbHRoZXN5c3RlbXMuY29t#%25EMAILX
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1536,186412520852336944,848366137565786927,131072 --lang=en-GB --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1952 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1536,186412520852336944,848366137565786927,131072 --lang=en-GB --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1952 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation	Path Interception	1 Process Injection	1 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	Exfiltration Over Other Network Medium	1 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	4 Non-Application Layer Protocol	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	5 Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	3 Ingress Tool Transfer	SIM Card Swap		Carrier Billing Fraud

Source	Detection	Scanner	Label	Link
https://794609.documents.savethenote2.com/healthesystems/viewAgreement?tsid=ZGFyeWxAaGVhbHRoZXN5c3RlbXMuY29t#%25EMAILX	0%	Avira URL Cloud	safe
https://794609.documents.savethenote2.com/healthesystems/viewAgreement?tsid=ZGFyeWxAaGVhbHRoZXN5c3RlbXMuY29t#%25EMAILX	100%	SlashNext	Credential Stealing type: Phishing & Social Engineering

Source	Detection	Scanner	Label
https://dns.google	0%	URL Reputation	safe
https://794609.documents.savethenote2.com/healthesystems/viewAgreement?tsid=ZGFyeWxAaGVhbHRoZXN5c3RlbXMuY29t	0%	Avira URL Cloud	safe
https://794609.documents.savethenote2.com/favicon.ico	0%	Avira URL Cloud	safe

Name	IP	Active	Malicious	Reputation
i.picsum.photos	104.26.5.30	true	false	high
accounts.google.com	216.58.212.173	true	false	high
clients.l.google.com	142.250.185.174	true	false	high
cstaticdun.126.net.w.kunluncan.com	163.181.56.170	true	false	unknown
picsum.photos	172.67.74.163	true	false	high
794609.documents.savethenote2.com	162.215.222.33	true	false	unknown
clients2.google.com	unknown	unknown	false	high
cstaticdun.126.net	unknown	unknown	false	high

IP	Domain	Country	ASN	ASN Name	Malicious
104.26.5.30	i.picsum.photos	United States	13335	CLOUDFLARENETUS	false
162.215.222.33	794609.documents.savethenote2.com	United States	46606	UNIFIEDLAYER-AS-1US	false
163.181.56.170	cstaticdun.126.net.w.kunluncan.com	United States	24429	TAOBAOZhejiangTaobaoNetworkCoLtdCN	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
142.250.185.174	clients.l.google.com	United States	15169	GOOGLEUS	false
216.58.212.173	accounts.google.com	United States	15169	GOOGLEUS	false
172.67.74.163	picsum.photos	United States	13335	CLOUDFLARENETUS	false

IP
192.168.2.1
192.168.2.4
127.0.0.1

Joe Sandbox Version:	34.0.0 Boulder Opal
Analysis ID:	628360
Start date and time: 17/05/202215:42:31	2022-05-17 15:42:31 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 3m 36s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	https://794609.documents.savethenote2.com/healthesystems/viewAgreement?tsid=ZGFyeWxAaGVhbHRoZXN5c3RlbXMuY29t#%25EMAILX
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	14
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal48.win@21/82@7/10
EGA Information:	Failed
HDC Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Adjust boot time Enable AMSI

Name	Malicious	Antivirus Detection	Reputation
https://picsum.photos/300/150/?image=824	false		high
https://794609.documents.savethenote2.com/healthesystems/viewAgreement?tsid=ZGFyeWxAaGVhbHRoZXN5c3RlbXMuY29t	false	Avira URL Cloud: safe	unknown
https://cstaticdun.126.net//2.6.3/images/icon_light.f13cff3.png	false		high
https://accounts.google.com/ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard	false		high
https://794609.documents.savethenote2.com/healthesystems/viewAgreement?tsid=ZGFyeWxAaGVhbHRoZXN5c3RlbXMuY29t#%25EMAILX	true		unknown
https://clients2.google.com/service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=85.0.4183.121&lang=en-GB&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1&x=id%3Dpkedcjkdefgpdelpbcmbmeomcjbeemfm%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1	false		high
https://i.picsum.photos/id/824/300/150.jpg?hmac=YLOxcCAmebF9Wvsp1kXa3AWYWkixtbvoNd_HdkCBBTE	false		high
https://794609.documents.savethenote2.com/favicon.ico	false	Avira URL Cloud: safe	unknown

Name	Source	Malicious	Antivirus Detection	Reputation
https://dns.google	89c591ae-3842-475c-aea8-3969c74e8deb.tmp.1.dr, f3713998-9dc4-4d07-a259-ed8b9f4487ce.tmp.1.dr	false	URL Reputation: safe	unknown
https://github.com/google/closure-library/wiki/goog.module:-an-ES6-module-like-alternative-to-goog.p	craw_window.js.0.dr, craw_background.js.0.dr	false		high
https://www.google.com/intl/en-US/chrome/blank.html	craw_background.js.0.dr	false		high
https://ogs.google.com	89c591ae-3842-475c-aea8-3969c74e8deb.tmp.1.dr	false		high
https://www.google.com/images/cleardot.gif	craw_window.js.0.dr	false		high
https://play.google.com	89c591ae-3842-475c-aea8-3969c74e8deb.tmp.1.dr	false		high
https://payments.google.com/payments/v4/js/integrator.js	craw_window.js.0.dr, manifest.json.0.dr	false		high
https://sandbox.google.com/payments/v4/js/integrator.js	craw_window.js.0.dr, manifest.json.0.dr	false		high
https://www.google.com/images/x2.gif	craw_window.js.0.dr	false		high
https://accounts.google.com/MergeSession	craw_window.js.0.dr	false		high
https://www.google.com	89c591ae-3842-475c-aea8-3969c74e8deb.tmp.1.dr	false		high
https://www.google.com/images/dot2.gif	craw_window.js.0.dr	false		high
https://accounts.google.com	89c591ae-3842-475c-aea8-3969c74e8deb.tmp.1.dr	false		high
https://clients2.googleusercontent.com	89c591ae-3842-475c-aea8-3969c74e8deb.tmp.1.dr	false		high
https://apis.google.com	89c591ae-3842-475c-aea8-3969c74e8deb.tmp.1.dr	false		high
https://www.google.com/accounts/OAuthLogin?issueuberauth=1	craw_window.js.0.dr	false		high
https://www.google.com/	manifest.json.0.dr	false		high
https://www-googleapis-staging.sandbox.google.com	craw_window.js.0.dr, craw_background.js.0.dr	false		high
https://clients2.google.com	89c591ae-3842-475c-aea8-3969c74e8deb.tmp.1.dr	false		high
https://clients2.google.com/service/update2/crx	manifest.json.0.dr	false		high

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	3.3041625260016576
Encrypted:	false
SSDEEP:	3:FkXwgs0oRLn:+taRLn
MD5:	7AE9008C2AA5ED3E5ED52743E082F5BF
SHA1:	CD90099842F51474494BFC490433578A89C1B539
SHA-256:	94E7D9BF431A0E3F0FD02F0FBA7321F43DD8B523E3D32092AFC474D3FD5ABF62
SHA-512:	596E66D10186ADAD552F4CF7E74CD438AD19AF4C30950D2D6EB80E9F9430CA475D12BB79423EC8D15EAF37ABE0AD1DCCAE459C356A00055A82155C24A35C6F14
Malicious:	false
Reputation:	low
Preview:	sdPC.....................UO..E.D.Q.o....

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 17, 2022 15:43:39.872883081 CEST	137	137	192.168.2.4	192.168.2.255
May 17, 2022 15:43:40.638710022 CEST	137	137	192.168.2.4	192.168.2.255
May 17, 2022 15:43:49.972973108 CEST	137	137	192.168.2.4	192.168.2.255
May 17, 2022 15:43:49.976231098 CEST	137	137	192.168.2.4	192.168.2.255
May 17, 2022 15:43:50.575684071 CEST	64277	53	192.168.2.4	8.8.8.8
May 17, 2022 15:43:50.578582048 CEST	56076	53	192.168.2.4	8.8.8.8
May 17, 2022 15:43:50.595175982 CEST	53	64277	8.8.8.8	192.168.2.4
May 17, 2022 15:43:50.595815897 CEST	53	56076	8.8.8.8	192.168.2.4
May 17, 2022 15:43:50.651923895 CEST	60758	53	192.168.2.4	8.8.8.8
May 17, 2022 15:43:50.731089115 CEST	137	137	192.168.2.4	192.168.2.255
May 17, 2022 15:43:50.733891964 CEST	137	137	192.168.2.4	192.168.2.255
May 17, 2022 15:43:50.735598087 CEST	137	137	192.168.2.4	192.168.2.255
May 17, 2022 15:43:50.814306021 CEST	53	60758	8.8.8.8	192.168.2.4
May 17, 2022 15:43:51.484242916 CEST	137	137	192.168.2.4	192.168.2.255
May 17, 2022 15:43:51.484292984 CEST	137	137	192.168.2.4	192.168.2.255
May 17, 2022 15:43:51.486154079 CEST	137	137	192.168.2.4	192.168.2.255
May 17, 2022 15:43:52.237229109 CEST	137	137	192.168.2.4	192.168.2.255
May 17, 2022 15:43:52.461802959 CEST	56509	53	192.168.2.4	8.8.8.8
May 17, 2022 15:43:52.484074116 CEST	53	56509	8.8.8.8	192.168.2.4
May 17, 2022 15:43:52.504420042 CEST	54069	53	192.168.2.4	8.8.8.8
May 17, 2022 15:43:52.860997915 CEST	53	54069	8.8.8.8	192.168.2.4
May 17, 2022 15:43:52.879009962 CEST	57747	53	192.168.2.4	8.8.8.8
May 17, 2022 15:43:52.900036097 CEST	53	57747	8.8.8.8	192.168.2.4
May 17, 2022 15:43:53.913489103 CEST	58171	53	192.168.2.4	8.8.8.8
May 17, 2022 15:43:53.966068029 CEST	53	58171	8.8.8.8	192.168.2.4
May 17, 2022 15:43:55.331737995 CEST	137	137	192.168.2.4	192.168.2.255
May 17, 2022 15:43:55.334065914 CEST	137	137	192.168.2.4	192.168.2.255
May 17, 2022 15:43:55.334131956 CEST	137	137	192.168.2.4	192.168.2.255
May 17, 2022 15:43:56.090254068 CEST	137	137	192.168.2.4	192.168.2.255
May 17, 2022 15:43:56.090311050 CEST	137	137	192.168.2.4	192.168.2.255
May 17, 2022 15:43:56.090313911 CEST	137	137	192.168.2.4	192.168.2.255
May 17, 2022 15:43:56.840303898 CEST	137	137	192.168.2.4	192.168.2.255
May 17, 2022 15:43:56.844505072 CEST	137	137	192.168.2.4	192.168.2.255
May 17, 2022 15:43:56.844540119 CEST	137	137	192.168.2.4	192.168.2.255
May 17, 2022 15:43:58.097619057 CEST	61364	443	192.168.2.4	142.250.185.174
May 17, 2022 15:43:58.124727011 CEST	443	61364	142.250.185.174	192.168.2.4
May 17, 2022 15:43:58.203514099 CEST	61364	443	192.168.2.4	142.250.185.174
May 17, 2022 15:43:58.229481936 CEST	443	61364	142.250.185.174	192.168.2.4
May 17, 2022 15:43:58.229518890 CEST	443	61364	142.250.185.174	192.168.2.4
May 17, 2022 15:43:58.229541063 CEST	443	61364	142.250.185.174	192.168.2.4
May 17, 2022 15:43:58.229563951 CEST	443	61364	142.250.185.174	192.168.2.4
May 17, 2022 15:43:58.288642883 CEST	61364	443	192.168.2.4	142.250.185.174
May 17, 2022 15:43:58.291732073 CEST	61364	443	192.168.2.4	142.250.185.174
May 17, 2022 15:43:58.406804085 CEST	61364	443	192.168.2.4	142.250.185.174
May 17, 2022 15:43:58.408258915 CEST	61364	443	192.168.2.4	142.250.185.174
May 17, 2022 15:43:58.434947014 CEST	443	61364	142.250.185.174	192.168.2.4
May 17, 2022 15:43:58.443339109 CEST	443	61364	142.250.185.174	192.168.2.4
May 17, 2022 15:43:58.443370104 CEST	443	61364	142.250.185.174	192.168.2.4
May 17, 2022 15:43:58.443383932 CEST	443	61364	142.250.185.174	192.168.2.4
May 17, 2022 15:43:58.505095959 CEST	61364	443	192.168.2.4	142.250.185.174
May 17, 2022 15:43:58.505506992 CEST	61364	443	192.168.2.4	142.250.185.174
May 17, 2022 15:43:58.604916096 CEST	61364	443	192.168.2.4	142.250.185.174
May 17, 2022 15:43:58.610934019 CEST	137	137	192.168.2.4	192.168.2.255
May 17, 2022 15:43:58.611064911 CEST	443	61364	142.250.185.174	192.168.2.4
May 17, 2022 15:43:58.614217043 CEST	61364	443	192.168.2.4	142.250.185.174
May 17, 2022 15:43:58.746669054 CEST	137	137	192.168.2.4	192.168.2.255
May 17, 2022 15:43:59.364439964 CEST	137	137	192.168.2.4	192.168.2.255
May 17, 2022 15:43:59.505096912 CEST	137	137	192.168.2.4	192.168.2.255
May 17, 2022 15:43:59.942100048 CEST	137	137	192.168.2.4	192.168.2.255
May 17, 2022 15:44:00.130204916 CEST	137	137	192.168.2.4	192.168.2.255
May 17, 2022 15:44:00.255129099 CEST	137	137	192.168.2.4	192.168.2.255
May 17, 2022 15:44:00.692686081 CEST	137	137	192.168.2.4	192.168.2.255
May 17, 2022 15:44:01.458381891 CEST	137	137	192.168.2.4	192.168.2.255

Timestamp	kBytes transferred	Direction	Data
2022-05-17 13:43:36 UTC	0	OUT	POST /threshold/xls.aspx HTTP/1.1 Origin: https://www.bing.com Referer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/Init Content-type: text/xml X-MSEdge-ExternalExpType: JointCoord X-MSEdge-ExternalExp: d-thshld39,d-thshld42,d-thshld77,d-thshld78,d-thshldspcl40 X-PositionerType: Desktop X-Search-CortanaAvailableCapabilities: CortanaExperience,SpeechLanguage X-Search-SafeSearch: Moderate X-Device-MachineId: {A2AB526A-D38D-4FC9-8BA0-E34B8D6354E8} X-UserAgeClass: Unknown X-BM-Market: US X-BM-DateFormat: M/d/yyyy X-CortanaAccessAboveLock: false X-Device-OSSKU: 48 X-BM-DTZ: 60 X-BM-FirstEnabledTime: 132061327679472806 X-DeviceID: 0100748C0900D485 X-BM-DeviceScale: 100 X-Search-TimeZone: Bias=-60; StandardBias=0; TimeZoneKeyName=W. Europe Standard Time X-BM-Theme: 000000;0078d7 X-BM-DeviceDimensionsLogical: 1232x1024 X-BM-DeviceDimensions: 1232x1024 X-Search-RPSToken: t%3DEwDYAkR8BAAUcvamItSE/vUHpyZRp3BeyOJPQDsAAcrCUQHVmc1QWYMPz0DXFqeRx8wamoowmwbwUSyNYpjtyJpJRDfEtLg1rKS4/zxABCoKsuMFRUBIP7PFid4xD2qKyI0URDzKuBMFjFkKzlG3Ps9MGF%2BBZXTdKnpAzZrlgOtRPCtamchXz28q0CRmPxXD6ZHI2rcMOvnUBLbt1zkoTBTKYibaVaGygpAEYQDTKkpAamKV8eOep8EnHN50LiR92MCKiQtLylSx/qTDVfvmE81bne2UzPZEbqlm/DPuKdzajAWp%2BXa91MUXk%2BgPu95uggy8QPGrNOWbn7IkTjFjqBdAhJ5m/BiU45rQu3ck%2B6RC%2BU%2BEalYU42PwbfQmsDwDZgAACHBtXI8rJNLaqAG5bveMLq14sdqoo9yPGDTdHxA7OjsAOmIxUTUXgi%2B44zK9rStYOMPMq4e6et15tJFBbG2jKGVdJMY3ZkTFu%2BHWNopmckOWLVgFNq79y3hmsdxc1wOedU50wO01k4tR95v4Imjx%2BJujGLa9TWHvuxeDQi9Y4ybY/y9vY1LteXSo0kKHbGazTsLNxyFfmSDOcn8ClbW9bmk0c4jHKD1yRpmMUoJ6GMEDPMqNOCkwrk63Ab7wPb/Ik//Xt/R1gr%2Bom7Tc2OeYYcdyru5UC/xxsJOAvl6NlTvqnrrwv3tNwIcpsdUqBF6TuxWSlAQvZrc4R0FfqAmC1gmCnHgcn6LOJmRb0NP4X2cysqVe7yMirSTCCMByWMIyPaVuut%2BME7E/g1i7%2BF6GOmOb4jaw5esWXZItZITutJph%2B%2BiB5Jhj5m5K8KwagRMAS5gWCtioSFd8CezxoiPqJxEvqdn2z7PYPJa2IEPLnuo8hgVRtHuU8/aTQiACqk%2BA7ilNPbpjD1XsiVE35rwQalWYecZgjOX1bVhMm1bTSpRC5s14qea2UC8ENIkJSR9nRsud1AE%3D%26p%3D X-Agent-DeviceId: 0100748C0900D485 X-BM-CBT: 1646732532 X-Device-isOptin: true X-Device-Touch: false X-Device-ClientSession: B3FD0EB2977A44E390C07B484049F516 X-Search-AppId: Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUI X-BM-ClientFeatures: pbitcpdisabled,AmbientWidescreen,rs1musicprod,CortanaSPAXamlHeader Accept: / Accept-Language: en-US Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.10.7.17134; 10.0.0.0.17134.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134 Host: www.bing.com Content-Length: 87238 Connection: Keep-Alive Cache-Control: no-cache Cookie: MUID=BEEBF15262804E24A8DF6781500AB975; _SS=CPID=1652795010993&AC=1&CPH=4ef661f2
2022-05-17 13:43:36 UTC	2	OUT	Data Raw: 3c 43 6c 69 65 6e 74 49 6e 73 74 52 65 71 75 65 73 74 3e 3c 43 49 44 3e 31 34 44 35 41 36 39 41 42 45 46 46 36 39 36 32 30 31 34 35 41 44 30 35 42 46 43 37 36 38 35 38 3c 2f 43 49 44 3e 3c 45 76 65 6e 74 73 3e 3c 45 3e 3c 54 3e 45 76 65 6e 74 2e 43 6c 69 65 6e 74 49 6e 73 74 3c 2f 54 3e 3c 49 47 3e 31 66 61 37 30 66 62 64 31 62 66 63 34 39 66 61 38 64 65 65 61 62 63 31 34 36 35 65 65 61 64 62 3c 2f 49 47 3e 3c 44 3e 3c 21 5b 43 44 41 54 41 5b 7b 22 43 75 72 55 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 62 69 6e 67 2e 63 6f 6d 2f 41 53 2f 41 50 49 2f 57 69 6e 64 6f 77 73 43 6f 72 74 61 6e 61 50 61 6e 65 2f 56 32 2f 49 6e 69 74 22 2c 22 50 69 76 6f 74 22 3a 22 51 46 22 2c 22 43 46 22 3a 22 70 62 69 74 63 70 64 69 73 61 62 6c 65 64 2c 41 6d 62 69 65 Data Ascii: <ClientInstRequest><CID>14D5A69ABEFF69620145AD05BFC76858</CID><Events><E><T>Event.ClientInst</T><IG>1fa70fbd1bfc49fa8deeabc1465eeadb</IG><D><![CDATA[{"CurUrl":"https://www.bing.com/AS/API/WindowsCortanaPane/V2/Init","Pivot":"QF","CF":"pbitcpdisabled,Ambie
2022-05-17 13:43:36 UTC	18	OUT	Data Raw: 43 75 72 55 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 62 69 6e 67 2e 63 6f 6d 2f 41 53 2f 41 50 49 2f 57 69 6e 64 6f 77 73 43 6f 72 74 61 6e 61 50 61 6e 65 2f 56 32 2f 49 6e 69 74 22 2c 22 50 69 76 6f 74 22 3a 22 51 46 22 2c 22 43 46 22 3a 22 70 62 69 74 63 70 64 69 73 61 62 6c 65 64 2c 41 6d 62 69 65 6e 74 57 69 64 65 73 63 72 65 65 6e 2c 72 73 31 6d 75 73 69 63 70 72 6f 64 2c 43 6f 72 74 61 6e 61 53 50 41 58 61 6d 6c 48 65 61 64 65 72 22 2c 22 54 22 3a 22 43 49 2e 51 46 50 65 72 66 50 69 6e 67 22 2c 22 53 54 22 3a 22 41 70 70 43 61 63 68 65 22 2c 22 43 56 49 44 22 3a 22 66 37 62 31 38 31 62 34 62 39 38 31 34 33 32 36 38 63 34 66 62 35 66 63 33 61 61 39 63 30 30 39 22 2c 22 4f 46 46 53 45 54 53 22 3a 5b 7b 22 49 22 3a 35 2c 22 45 22 3a 7b 22 30 Data Ascii: CurUrl":"https://www.bing.com/AS/API/WindowsCortanaPane/V2/Init","Pivot":"QF","CF":"pbitcpdisabled,AmbientWidescreen,rs1musicprod,CortanaSPAXamlHeader","T":"CI.QFPerfPing","ST":"AppCache","CVID":"f7b181b4b98143268c4fb5fc3aa9c009","OFFSETS":[{"I":5,"E":{"0
2022-05-17 13:43:36 UTC	34	OUT	Data Raw: 31 33 2c 22 32 39 36 22 3a 31 7d 2c 22 66 62 63 53 63 6f 72 65 22 3a 30 2e 38 32 34 39 31 7d 7d 2c 7b 22 54 22 3a 22 44 2e 55 72 6c 22 2c 22 4b 22 3a 31 30 30 32 2c 22 51 22 3a 22 43 68 6f 6f 73 65 20 61 20 64 65 66 61 75 6c 74 20 77 65 62 20 62 72 6f 77 73 65 72 22 2c 22 4d 51 22 3a 22 64 65 66 61 75 6c 74 20 62 72 6f 77 73 65 72 22 2c 22 56 61 6c 22 3a 22 53 54 22 2c 22 48 6f 22 3a 32 2c 22 47 72 22 3a 31 2c 22 44 65 76 69 63 65 53 69 67 6e 61 6c 73 22 3a 7b 22 52 61 6e 6b 22 3a 38 31 32 36 2c 22 50 48 69 74 73 22 3a 22 53 79 73 74 65 6d 2e 50 61 72 73 69 6e 67 4e 61 6d 65 22 2c 22 49 64 22 3a 22 41 41 41 5f 53 79 73 74 65 6d 53 65 74 74 69 6e 67 73 5f 44 65 66 61 75 6c 74 41 70 70 73 5f 42 72 6f 77 73 65 72 22 2c 22 44 4e 61 6d 65 22 3a 22 43 68 6f 6f Data Ascii: 13,"296":1},"fbcScore":0.82491}},{"T":"D.Url","K":1002,"Q":"Choose a default web browser","MQ":"default browser","Val":"ST","Ho":2,"Gr":1,"DeviceSignals":{"Rank":8126,"PHits":"System.ParsingName","Id":"AAA_SystemSettings_DefaultApps_Browser","DName":"Choo
2022-05-17 13:43:36 UTC	50	OUT	Data Raw: 51 75 65 72 79 22 20 76 61 6c 75 65 3d 22 66 61 6c 73 65 22 2f 3e 3c 72 65 71 75 65 73 74 49 6e 66 6f 20 6b 65 79 3d 22 46 6f 72 6d 22 20 76 61 6c 75 65 3d 22 22 2f 3e 3c 75 73 65 72 49 6e 66 6f 20 6b 65 79 3d 22 41 70 70 4e 61 6d 65 22 20 76 61 6c 75 65 3d 22 53 6d 61 72 74 53 65 61 72 63 68 22 2f 3e 3c 2f 4f 76 72 3e 3c 2f 4d 3e 3c 2f 47 72 6f 75 70 3e 3c 47 72 6f 75 70 3e 3c 4d 3e 3c 49 47 3e 66 61 66 39 62 35 31 32 61 35 38 61 34 61 30 61 38 33 66 33 36 64 62 30 30 34 36 63 61 32 33 34 3c 2f 49 47 3e 3c 44 53 3e 3c 21 5b 43 44 41 54 41 5b 5b 7b 22 54 22 3a 22 44 2e 41 67 67 72 65 67 61 74 6f 72 22 2c 22 53 65 72 76 69 63 65 22 3a 22 41 75 74 6f 53 75 67 67 65 73 74 22 2c 22 53 63 65 6e 61 72 69 6f 22 3a 22 41 67 67 72 65 67 61 74 6f 72 22 2c 22 41 70 Data Ascii: Query" value="false"/><requestInfo key="Form" value=""/><userInfo key="AppName" value="SmartSearch"/></Ovr></M></Group><Group><M><IG>faf9b512a58a4a0a83f36db0046ca234</IG><DS><![CDATA[[{"T":"D.Aggregator","Service":"AutoSuggest","Scenario":"Aggregator","Ap
2022-05-17 13:43:36 UTC	66	OUT	Data Raw: 74 73 22 3a 22 53 79 73 74 65 6d 2e 50 61 72 73 69 6e 67 4e 61 6d 65 22 2c 22 49 64 22 3a 22 41 41 41 5f 53 65 74 74 69 6e 67 73 50 61 67 65 4e 65 74 77 6f 72 6b 53 74 61 74 75 73 22 2c 22 44 4e 61 6d 65 22 3a 22 4e 65 74 77 6f 72 6b 20 73 74 61 74 75 73 22 2c 22 4d 44 4e 22 3a 31 7d 7d 2c 7b 22 54 22 3a 22 44 2e 55 72 6c 22 2c 22 4b 22 3a 31 30 30 33 2c 22 51 22 3a 22 43 68 65 63 6b 20 6e 65 74 77 6f 72 6b 20 73 74 61 74 75 73 22 2c 22 56 61 6c 22 3a 22 53 54 22 2c 22 48 6f 22 3a 32 2c 22 47 72 22 3a 31 2c 22 44 65 76 69 63 65 53 69 67 6e 61 6c 73 22 3a 7b 22 52 61 6e 6b 22 3a 31 32 38 30 30 31 2c 22 50 48 69 74 73 22 3a 22 53 79 73 74 65 6d 2e 50 61 72 73 69 6e 67 4e 61 6d 65 22 2c 22 49 64 22 3a 22 41 41 41 5f 53 65 74 74 69 6e 67 73 5f 47 72 6f 75 70 Data Ascii: ts":"System.ParsingName","Id":"AAA_SettingsPageNetworkStatus","DName":"Network status","MDN":1}},{"T":"D.Url","K":1003,"Q":"Check network status","Val":"ST","Ho":2,"Gr":1,"DeviceSignals":{"Rank":128001,"PHits":"System.ParsingName","Id":"AAA_Settings_Group
2022-05-17 13:43:36 UTC	82	OUT	Data Raw: 2e 35 2c 22 31 33 36 22 3a 31 2c 22 31 33 37 22 3a 31 36 2c 22 31 35 37 22 3a 31 2c 22 31 35 39 22 3a 36 39 34 36 2c 22 31 36 39 22 3a 31 2c 22 32 36 34 22 3a 31 2c 22 32 36 39 22 3a 36 39 34 36 2c 22 32 37 30 22 3a 36 39 34 36 2c 22 32 38 34 22 3a 38 2c 22 32 39 36 22 3a 31 7d 2c 22 6d 72 75 53 75 70 70 72 65 73 73 69 6f 6e 53 63 6f 72 65 22 3a 30 2e 31 34 37 34 38 7d 7d 2c 7b 22 54 22 3a 22 44 2e 55 72 6c 22 2c 22 4b 22 3a 31 30 30 35 2c 22 51 22 3a 22 42 6c 6f 63 6b 20 6f 72 20 61 6c 6c 6f 77 20 70 6f 70 2d 75 70 73 22 2c 22 56 61 6c 22 3a 22 53 54 22 2c 22 48 6f 22 3a 32 2c 22 47 72 22 3a 31 2c 22 44 65 76 69 63 65 53 69 67 6e 61 6c 73 22 3a 7b 22 52 61 6e 6b 22 3a 38 36 38 2c 22 50 48 69 74 73 22 3a 22 53 79 73 74 65 6d 2e 50 61 72 73 69 6e 67 4e 61 Data Ascii: .5,"136":1,"137":16,"157":1,"159":6946,"169":1,"264":1,"269":6946,"270":6946,"284":8,"296":1},"mruSuppressionScore":0.14748}},{"T":"D.Url","K":1005,"Q":"Block or allow pop-ups","Val":"ST","Ho":2,"Gr":1,"DeviceSignals":{"Rank":868,"PHits":"System.ParsingNa
2022-05-17 13:43:36 UTC	87	IN	HTTP/1.1 204 No Content Access-Control-Allow-Origin: * X-Cache: CONFIG_NOCACHE Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: 6609F9BF1E67496D9E4F54CC2438AC2C Ref B: VIEEDGE1818 Ref C: 2022-05-17T13:43:36Z Date: Tue, 17 May 2022 13:43:36 GMT Connection: close

Timestamp	kBytes transferred	Direction	Data
2022-05-17 13:43:39 UTC	88	OUT	GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=310091&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:D9BC7EDF-91E8-C8ED-3ED4-3B144B30C00C&ctry=US&time=20220308T094328Z&lc=en-US&pl=en-US&idtp=mid&uid=a9223225-82ba-4622-a95e-dcecd6738abd&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=340fcbd17d984582956074ac2676dc1d&ctmode=MultiSession&arch=x64&cdm=1&cdmver=10.0.17134.1&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.17134.1&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=1417890&metered=false&nettype=ethernet&npid=sc-310091&oemName=VMware%2C%20Inc.&oemid=VMware%2C%20Inc.&ossku=Professional&rver=2&smBiosDm=VMware7%2C1&tl=2&tsu=1417890&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing= HTTP/1.1 Accept-Encoding: gzip, deflate X-SDK-CACHE: chs=0&imp=0&chf=0&ds=50583&fs=32089&sc=6 Cache-Control: no-cache MS-CV: 3Frur/zANU+2hPRe.0 User-Agent: WindowsShellClient/9.0.40929.0 (Windows) X-SDK-HWF: tch0,m301,m751,mA01,mT01 Host: arc.msn.com Connection: Keep-Alive
2022-05-17 13:43:39 UTC	90	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Length: 167 Content-Type: application/json; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [{"OPTOUTSTATE":"256"}] X-ARC-SIG: SGq7WkXSorYEr2bOMVP+vUajDA42zSTq1J89uuYq9m6WV+5m6x8MFWbc8resW58wYqHEnLtLmx89jwEJUETZ8BPyQq0OLM1Ky2SIp8wqOK/4DAsxyzcj0oYVDosVfa1utrk0FVJ5X4y+TgqtNvp49SGa4igYN1eFd6OHdkBDWbbjTROUsCjWTbRNdHf9yVPFDefBvaE2uVLpRC51ZJIEohcXebBi7mw523BWx6Gm3AWEbTi78w7VGDq8nXSHxGfUbvbyLDyAt23q6EHC95v5q1LiIpUBZgwqskjWzFMQSxLEmsSqGh/1JNo2pDw5AmLlFcf4FL6PpvfKp1aiETJ61Q== Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Tue, 17 May 2022 13:43:38 GMT Connection: close
2022-05-17 13:43:39 UTC	91	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 65 72 72 6f 72 73 22 3a 5b 7b 22 63 6f 64 65 22 3a 32 30 34 30 2c 22 6d 73 67 22 3a 22 44 65 6d 61 6e 64 20 73 6f 75 72 63 65 20 72 65 74 75 72 6e 73 20 65 72 72 6f 72 20 28 4e 61 6d 65 3a 20 47 4e 5f 70 73 2c 20 45 72 72 6f 72 3a 20 4e 6f 20 65 6c 69 67 69 62 6c 65 20 63 6f 6e 74 65 6e 74 2e 29 2e 22 7d 5d 2c 22 72 65 66 72 65 73 68 74 69 6d 65 22 3a 22 32 30 32 32 2d 30 35 2d 31 37 54 31 37 3a 34 33 3a 33 39 22 7d 7d Data Ascii: {"batchrsp":{"ver":"1.0","errors":[{"code":2040,"msg":"Demand source returns error (Name: GN_ps, Error: No eligible content.)."}],"refreshtime":"2022-05-17T17:43:39"}}

Timestamp	kBytes transferred	Direction	Data
2022-05-17 13:43:53 UTC	275	OUT	GET /favicon.ico HTTP/1.1 Host: 794609.documents.savethenote2.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept: image/avif,image/webp,image/apng,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://794609.documents.savethenote2.com/healthesystems/viewAgreement?tsid=ZGFyeWxAaGVhbHRoZXN5c3RlbXMuY29t Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en-US;q=0.9,en;q=0.8
2022-05-17 13:43:53 UTC	276	IN	HTTP/1.1 404 Not Found Date: Tue, 17 May 2022 13:43:52 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Accept-Ranges: bytes Content-Length: 10855 Content-Type: text/html
2022-05-17 13:43:53 UTC	276	IN	Data Raw: 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 20 3c 74 69 74 6c 65 3e 43 61 70 74 63 68 61 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 2e 62 6c 6f 63 6b 7b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 6c 65 66 74 3a 30 3b 74 6f 70 3a 30 7d 2e 73 6c 69 64 65 72 43 6f 6e 74 61 69 6e 65 72 7b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 77 69 64 74 68 3a 33 31 30 70 78 3b 68 65 69 67 68 74 3a 34 30 70 78 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 34 30 70 78 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 31 35 70 78 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 76 65 72 64 61 6e 61 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 37 66 39 66 61 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 34 70 78 3b 63 6f 6c 6f 72 3a 23 34 35 Data Ascii: </body></html> <title>Captcha</title><style>.block{position:absolute;left:0;top:0}.sliderContainer{position:relative;text-align:center;width:310px;height:40px;line-height:40px;margin-top:15px;font-family:verdana;background:#f7f9fa;font-size:14px;color:#45
2022-05-17 13:43:53 UTC	284	IN	Data Raw: 76 61 72 20 74 3d 6e 2e 62 6c 6f 63 6b 43 74 78 2e 67 65 74 49 6d 61 67 65 44 61 74 61 28 6e 2e 78 2d 33 2c 65 2c 6f 2c 6f 29 3b 6e 2e 62 6c 6f 63 6b 2e 77 69 64 74 68 3d 6f 2c 6e 2e 62 6c 6f 63 6b 43 74 78 2e 70 75 74 49 6d 61 67 65 44 61 74 61 28 74 2c 30 2c 65 29 7d 7d 2c 28 74 3d 76 28 22 69 6d 67 22 29 29 2e 63 72 6f 73 73 4f 72 69 67 69 6e 3d 22 41 6e 6f 6e 79 6d 6f 75 73 22 2c 74 2e 6f 6e 6c 6f 61 64 3d 65 2c 74 2e 6f 6e 65 72 72 6f 72 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 74 2e 73 72 63 3d 61 28 29 7d 2c 74 2e 73 72 63 3d 61 28 29 2c 74 29 3b 74 68 69 73 2e 69 6d 67 3d 69 7d 7d 2c 7b 6b 65 79 3a 22 64 72 61 77 22 2c 76 61 6c 75 65 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 69 73 2e 78 3d 74 28 37 33 2c 32 33 37 29 2c 74 68 69 73 2e 79 3d 74 28 32 38 Data Ascii: var t=n.blockCtx.getImageData(n.x-3,e,o,o);n.block.width=o,n.blockCtx.putImageData(t,0,e)}},(t=v("img")).crossOrigin="Anonymous",t.onload=e,t.onerror=function(){t.src=a()},t.src=a(),t);this.img=i}},{key:"draw",value:function(){this.x=t(73,237),this.y=t(28

Timestamp	kBytes transferred	Direction	Data
2022-05-17 13:43:54 UTC	287	OUT	GET //2.6.3/images/icon_light.f13cff3.png HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36 Host: cstaticdun.126.net
2022-05-17 13:43:54 UTC	287	IN	HTTP/1.1 200 OK Server: Tengine Content-Type: image/png Content-Length: 11413 Connection: close Date: Tue, 17 May 2022 13:43:20 GMT Timing-Allow-Origin: , Accept-Ranges: bytes Last-Modified: Tue, 10 May 2022 06:45:46 GMT Cache-Control: max-age=43200 Expires: Tue, 17 May 2022 18:29:48 GMT Ali-Swift-Global-Savetime: 1652795000 Via: cache11.l2de2[0,0,304-0,H], cache12.l2de2[0,0], ens-cache7.de4[0,0,200-0,H], ens-cache4.de4[1,0] Age: 34 X-Cache: HIT TCP_MEM_HIT dirn:8:338520431 X-Swift-SaveTime: Tue, 17 May 2022 13:43:52 GMT X-Swift-CacheTime: 28 Access-Control-Allow-Methods: GET,POST,OPTIONS,HEAD Access-Control-Expose-Headers: * Access-Control-Allow-Origin: * EagleId: 2ff62b1c16527950341018693e
2022-05-17 13:43:54 UTC	287	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 22 00 00 01 d7 08 06 00 00 00 d9 6f 88 dc 00 00 28 23 49 44 41 54 78 01 ec c1 0b bc 96 75 81 28 ea e7 ff 7f 5f 40 16 43 28 b8 80 c5 4d d2 b8 58 a0 96 34 a4 48 ba d4 12 67 d4 72 7b 9c 40 73 2b ba bb 88 a3 c7 19 c3 b1 b4 c6 1a 85 84 d4 69 4b 9b 71 cf 38 e9 2e 53 f7 74 53 2b 6b d2 96 06 69 1a b3 1b 45 72 c0 4b 10 02 4b 90 52 09 e4 b2 be f7 bf bf 73 5e 7e bf c5 92 75 f9 80 b5 d8 9e a3 cf 13 52 4a f6 40 03 7e 8c 2d 21 84 63 74 a3 a8 76 0d 68 c2 11 e8 ab 9b 45 b5 69 40 13 c6 61 39 4e d5 cd a2 ae 35 a0 09 e3 b0 1c 8d 58 a7 9b e5 78 18 f5 98 86 d5 da 6a 40 13 c6 61 39 1a b1 4e 0f 88 e8 8b 77 a3 09 23 b5 6a 40 13 c6 61 39 1a b1 4e 0f 89 38 0d cb 70 18 9a 30 12 0d 68 c2 38 2c 47 23 d6 e9 41 39 36 a0 11 4d 78 Data Ascii: PNGIHDR"o(#IDATxu(_@C(MX4Hgr{@s+iKq8.StS+kiErKKRs^~uRJ@~-!ctvhEi@a9N5Xxj@a9Nw#j@a9N8p0h8,G#A96Mx
2022-05-17 13:43:54 UTC	295	IN	Data Raw: 29 d9 a8 a3 86 84 be 3a 70 dd f1 d9 f0 69 87 c5 41 58 88 bf b6 97 a2 8e 2d c0 4d aa 2e 3a 32 d6 6b c7 9c 13 b2 e1 67 1f 1e 07 2b 7d c5 3e 88 3a f7 19 7c ff ac f1 b1 fe ba e3 b3 61 76 71 c5 e4 38 e4 82 23 e2 50 a5 33 f0 82 7d 10 75 2e 61 a1 aa 0b 8f 8c 0d e7 4e 88 03 55 9d 35 3e 1e 78 c5 e4 6c 84 d2 e5 b8 df 3e ca 75 ed 5f f1 39 cc 99 7f 62 f6 ce b1 03 c3 01 9f 38 2a 36 28 7d 19 5f d5 0d a2 da cc c5 02 55 9f 38 2a 36 28 2d c0 67 75 93 5c ed 2e c5 37 30 0d 3f c6 13 de f6 56 10 d4 2e d8 3b 49 0d 72 9d 0b 5a 05 a5 a0 14 b4 2f 29 25 1d 4b de 20 e8 58 50 0a 4a 01 01 01 01 01 41 5b 49 29 21 21 21 29 25 a5 a4 ad a4 2a d8 5d d0 2a 20 20 20 22 20 22 20 20 68 2b 29 25 24 24 14 4a 09 09 09 49 29 29 a5 a0 ad a0 14 10 10 10 10 11 11 11 10 11 10 ec 2e 21 21 21 a1 40 42 Data Ascii: ):piAX-M.:2kg+}>:\|avq8#P3}u.aNU5>xl>u_9b86(}_U86(-gu\.70?V.;IrZ/)%K XPJA[I)!!!)%] " " h+)%$$JI)).!!!@B

Timestamp	kBytes transferred	Direction	Data
2022-05-17 13:44:20 UTC	299	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2022-05-17 13:44:20 UTC	299	IN	HTTP/1.1 200 OK Content-Length: 55 Content-Type: application/octet-stream Last-Modified: Thu, 20 Apr 2017 16:10:39 GMT Accept-Ranges: bytes ETag: "f9c874a7f0b9d21:0" Server: Microsoft-IIS/10.0 Content-Disposition: attachment; filename=config.json X-Powered-By: ASP.NET Cache-Control: public, max-age=97883 Date: Tue, 17 May 2022 13:44:20 GMT Connection: close X-CID: 2

Timestamp	kBytes transferred	Direction	Data
2022-05-17 13:44:21 UTC	299	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Thu, 20 Apr 2017 16:10:39 GMT User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2022-05-17 13:44:21 UTC	299	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Last-Modified: Thu, 20 Apr 2017 16:10:39 GMT ETag: "f9c874a7f0b9d21:0" Server: Microsoft-IIS/10.0 Content-Disposition: attachment; filename=config.json X-Powered-By: ASP.NET Cache-Control: public, max-age=120748 Date: Tue, 17 May 2022 13:44:21 GMT Content-Length: 55 Connection: close X-CID: 2
2022-05-17 13:44:21 UTC	300	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://794609.documents.savethenote2.com/healthesystems/viewAgreement?tsid=ZGFyeWxAaGVhbHRoZXN5c3RlbXMuY29t#%25EMAILX

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\4023cfd3-74ad-4f9f-858b-7d74d5af42ce.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\89c591ae-3842-475c-aea8-3969c74e8deb.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\9dc71c67-c053-4a0d-957a-11f85d4ca22b.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB\000003.log

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB\LOG

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB\LOG.old (copy)

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network Persistent State (copy)

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Preferences (copy)

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences (copy)

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\GPUCache\data_1

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\Network Persistent State (copy)

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\f3713998-9dc4-4d07-a259-ed8b9f4487ce.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\b19e87e9-3cab-47cd-896a-19226b8eaf2a.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\000004.dbtmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\CURRENT (copy)

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\eb7c9816-fe95-4543-acb0-e14b3daaf4ac.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Last Browser

C:\Users\user\AppData\Local\Google\Chrome\User Data\Last Version

C:\Users\user\AppData\Local\Google\Chrome\User Data\Local State (copy)

C:\Users\user\AppData\Local\Google\Chrome\User Data\Module Info Cache (copy)

C:\Users\user\AppData\Local\Google\Chrome\User Data\acd893d2-9d3b-4a46-b813-af93b85d086d.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\b56d66e2-0ebf-4204-913c-29698512c796.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\dbeca99a-9e79-4b93-b737-59fa5c41a241.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\eca94c15-024c-467e-a775-3ebac13f70a8.tmp

C:\Users\user\AppData\Local\Temp\b33c3693-a439-4fa6-b094-3f106329a49c.tmp

C:\Users\user\AppData\Local\Temp\e648c7db-04fa-4e8c-8081-f53df1529b54.tmp

C:\Users\user\AppData\Local\Temp\scoped_dir3420_903609529\CRX_INSTALL\_locales\bg\messages.json

C:\Users\user\AppData\Local\Temp\scoped_dir3420_903609529\CRX_INSTALL\_locales\ca\messages.json

Windows Analysis Report
https://794609.documents.savethenote2.com/healthesystems/viewAgreement?tsid=ZGFyeWxAaGVhbHRoZXN5c3RlbXMuY29t#%25EMAILX

Timestamp	kBytes transferred	Direction	Data
2022-05-17 13:44:23 UTC	300	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 18.10.0.17134.0.0; IDCRL-cfg 16.000.29340.5; App svchost.exe, 10.0.17134.1, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4796 Host: login.live.com
2022-05-17 13:44:23 UTC	300	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2022-05-17 13:44:23 UTC	310	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Tue, 17 May 2022 13:43:23 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: R3_BL2 x-ms-request-id: 7da73ab3-7571-4663-8e2c-a291299e6bf5 PPServer: PPV: 30 H: BL02EPF00006862 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Tue, 17 May 2022 13:44:23 GMT Connection: close Content-Length: 11093
2022-05-17 13:44:23 UTC	310	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Timestamp	kBytes transferred	Direction	Data
2022-05-17 13:44:28 UTC	333	OUT	GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=280815&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:D9BC7EDF-91E8-C8ED-3ED4-3B144B30C00C&ctry=US&time=20220517T134422Z&lc=en-US&pl=en-US&idtp=mid&uid=a9223225-82ba-4622-a95e-dcecd6738abd&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=a7b9b775e4244c17a2ebb9b348f2e15b&ctmode=MultiSession&arch=x64&cdm=1&cdmver=10.0.17134.1&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.17134.1&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=1518931&metered=false&nettype=ethernet&npid=sc-280815&oemName=hqfxfl%2C%20Inc.&oemid=hqfxfl%2C%20Inc.&ossku=Professional&smBiosDm=hqfxfl7%2C1&tl=2&tsu=1518931&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing= HTTP/1.1 Accept-Encoding: gzip, deflate X-SDK-CACHE: chs=0&imp=0&chf=0&ds=50583&fs=32089&sc=6 X-SDK-HW-TOKEN: t=EwDgAppeBAAUlAKXDAofTQM+n+MaRVFKzH/ehWgAARv7pEmU4rHAqGoJtj7oLSB7v2mwo43vyD+jN/gk3QZIlZytJXk/gSdJdrqom9LMkpbx5q52rTOUcWeySoU1PLcNmtBMdJaE6JD0HtBaB5hCqsJVawrWly7rtJA8RvE8yD5/UA7Go+f/Y5zG9wg5eei7acRCsS7+kaTbNsSVG+99ds/Q2CN2lULRIyni/dGAvALBGERxqjkkAvrMGuVYqrXHljAAZpFbJEYX4mICp3VJTA0p6oFnLhdLQnZFrFHiBwNh/zPgYz3DH1DGAHfXOCa9J8Ht4vCrKGPIrpA3r5dFe8wNhXN1b0bwPmboXlmVS9zyZQtCNG4TcACF9m3bQWYDZgAACLw17X7Ub0dbsAGKuSJVgxSwi0tKQ+TNf8JJmL63B6BCOLjUH5I+HTsU8HL8yBmScnGFeIUjxwABKk+yQ5FuYoKT5el5ZHhj8bK/Lqgj2K0jXexFv7So5dDFHGWBt/QM4LK7IXpkrhPtQexjN1XRl9ZimwP4ARxK2pvZ4JDKsiviJE5gvFkNdqB1Qcmt1xO3KPVbtBBK4Ima8M5aPihMW+E4jO3oLOEE79zsH0ZpeZUcspD2tc9+tCOKvnjbx8UmAnJ4g7gN9gXI4NtvliRjBiozoyQJqTkrjnFofBvyaou/IPhBBD3yALwiEV8aKDiVhLAGu6bgzrHeiPPOR/huZtUW9poR1Qg+eB1ypgElFq0oSFqqFtidpV1/oDjd87FjqUtfMiu2gC7SmpbaRkCnKkBmwkEbBkbOVZ1dihVEFnZcOv/mED6OR6bAIZqSXYR4WK0KQVoEnKI75+po0gwgsjfS7vnrhE/wtE4SqLk+byXg0nYEmbeCw7UW7SOGzDrZmR2ki1DEXXfenU4Gj2a7j/92itPbvh214HIE+AdnxOU3zRK9XliCU2wNcbhbXD7y9+BCqM3DEKZmGBLVAQ==&p= Cache-Control: no-cache MS-CV: yZRXp+ETA0iBnc90.0 User-Agent: WindowsShellClient/9.0.40929.0 (Windows) X-SDK-HWF: tch0,m301,m751,mA01,mT01 Host: arc.msn.com Connection: Keep-Alive
2022-05-17 13:44:28 UTC	341	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Length: 3047 Content-Type: application/json; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [{"RADIDS":"1,P425116123-T700333390-C128000000001627409+B+P20+S1"},{"OPTOUTSTATE":"256"}] X-ARC-SIG: GHU9On1ZEbT9kEO3Rz4oK+CAO8C6oUPhxDJsw6gOalCK8GeY45PHu3XijRx95NcThc8FgX8jhEXRPORZb+3uXXrGGI8B7PNanN/V/UxonnDDpg0Oytpcx/t07tAtkfjH/P5GiV/iaR2cibJrJ9WThwgkqqh1c/w21bphfllA/Ex7s+isL/KRKpQrxUM+xLwjma5dtSiEYNL+3HtUNTGsTg/Zg/EzGPXLDAvUS8E2ssj7mo5mCJEcS4BQxv4dy0mY5CAyw6PexWKc8nlAWTCBNZPM9LyEjZCiLkGA1OtHpbWdb5hi4V5H1v1qm5F9cqoE1OJj65WEXJFBu7GRrrskNA== Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Tue, 17 May 2022 13:44:28 GMT Connection: close
2022-05-17 13:44:28 UTC	342	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 69 74 65 6d 73 22 3a 5b 7b 22 69 74 65 6d 22 3a 22 7b 5c 22 66 5c 22 3a 5c 22 72 61 66 5c 22 2c 5c 22 76 5c 22 3a 5c 22 31 2e 30 5c 22 2c 5c 22 72 64 72 5c 22 3a 5b 7b 5c 22 63 5c 22 3a 5c 22 43 44 4d 5c 22 2c 5c 22 75 5c 22 3a 5c 22 53 75 62 73 63 72 69 62 65 64 43 6f 6e 74 65 6e 74 5c 22 7d 5d 2c 5c 22 61 64 5c 22 3a 7b 5c 22 63 6c 61 73 73 5c 22 3a 5c 22 63 6f 6e 74 65 6e 74 5c 22 2c 5c 22 63 6f 6c 6c 65 63 74 69 6f 6e 73 5c 22 3a 5b 5d 2c 5c 22 69 74 65 6d 50 72 6f 70 65 72 74 79 4d 61 6e 69 66 65 73 74 5c 22 3a 7b 5c 22 6e 6f 4f 70 5c 22 3a 7b 5c 22 74 79 70 65 5c 22 3a 5c 22 61 63 74 69 6f 6e 5c 22 7d 7d 2c 5c 22 69 74 65 6d 73 5c 22 3a 5b 7b 5c 22 70 72 6f 70 65 72 74 69 Data Ascii: {"batchrsp":{"ver":"1.0","items":[{"item":"{\"f\":\"raf\",\"v\":\"1.0\",\"rdr\":[{\"c\":\"CDM\",\"u\":\"SubscribedContent\"}],\"ad\":{\"class\":\"content\",\"collections\":[],\"itemPropertyManifest\":{\"noOp\":{\"type\":\"action\"}},\"items\":[{\"properti

Timestamp	kBytes transferred	Direction	Data
2022-05-17 13:43:41 UTC	145	OUT	POST /threshold/xls.aspx HTTP/1.1 Origin: https://www.bing.com Referer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/Init Content-type: text/xml X-MSEdge-ExternalExpType: JointCoord X-MSEdge-ExternalExp: d-thshld39,d-thshld42,d-thshld77,d-thshld78,d-thshldspcl40 X-PositionerType: Desktop X-Search-CortanaAvailableCapabilities: CortanaExperience,SpeechLanguage X-Search-SafeSearch: Moderate X-Device-MachineId: {A2AB526A-D38D-4FC9-8BA0-E34B8D6354E8} X-UserAgeClass: Unknown X-BM-Market: US X-BM-DateFormat: M/d/yyyy X-CortanaAccessAboveLock: false X-Device-OSSKU: 48 X-BM-DTZ: 60 X-BM-FirstEnabledTime: 132061327679472806 X-DeviceID: 0100748C0900D485 X-BM-DeviceScale: 100 X-Search-TimeZone: Bias=-60; StandardBias=0; TimeZoneKeyName=W. Europe Standard Time X-BM-Theme: 000000;0078d7 X-BM-DeviceDimensionsLogical: 1232x1024 X-BM-DeviceDimensions: 1232x1024 X-Search-RPSToken: t%3DEwDYAkR8BAAUcvamItSE/vUHpyZRp3BeyOJPQDsAAcrCUQHVmc1QWYMPz0DXFqeRx8wamoowmwbwUSyNYpjtyJpJRDfEtLg1rKS4/zxABCoKsuMFRUBIP7PFid4xD2qKyI0URDzKuBMFjFkKzlG3Ps9MGF%2BBZXTdKnpAzZrlgOtRPCtamchXz28q0CRmPxXD6ZHI2rcMOvnUBLbt1zkoTBTKYibaVaGygpAEYQDTKkpAamKV8eOep8EnHN50LiR92MCKiQtLylSx/qTDVfvmE81bne2UzPZEbqlm/DPuKdzajAWp%2BXa91MUXk%2BgPu95uggy8QPGrNOWbn7IkTjFjqBdAhJ5m/BiU45rQu3ck%2B6RC%2BU%2BEalYU42PwbfQmsDwDZgAACHBtXI8rJNLaqAG5bveMLq14sdqoo9yPGDTdHxA7OjsAOmIxUTUXgi%2B44zK9rStYOMPMq4e6et15tJFBbG2jKGVdJMY3ZkTFu%2BHWNopmckOWLVgFNq79y3hmsdxc1wOedU50wO01k4tR95v4Imjx%2BJujGLa9TWHvuxeDQi9Y4ybY/y9vY1LteXSo0kKHbGazTsLNxyFfmSDOcn8ClbW9bmk0c4jHKD1yRpmMUoJ6GMEDPMqNOCkwrk63Ab7wPb/Ik//Xt/R1gr%2Bom7Tc2OeYYcdyru5UC/xxsJOAvl6NlTvqnrrwv3tNwIcpsdUqBF6TuxWSlAQvZrc4R0FfqAmC1gmCnHgcn6LOJmRb0NP4X2cysqVe7yMirSTCCMByWMIyPaVuut%2BME7E/g1i7%2BF6GOmOb4jaw5esWXZItZITutJph%2B%2BiB5Jhj5m5K8KwagRMAS5gWCtioSFd8CezxoiPqJxEvqdn2z7PYPJa2IEPLnuo8hgVRtHuU8/aTQiACqk%2BA7ilNPbpjD1XsiVE35rwQalWYecZgjOX1bVhMm1bTSpRC5s14qea2UC8ENIkJSR9nRsud1AE%3D%26p%3D X-Agent-DeviceId: 0100748C0900D485 X-BM-CBT: 1646732532 X-Device-isOptin: true X-Device-Touch: false X-Device-ClientSession: B3FD0EB2977A44E390C07B484049F516 X-Search-AppId: Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUI X-BM-ClientFeatures: pbitcpdisabled,AmbientWidescreen,rs1musicprod,CortanaSPAXamlHeader Accept: / Accept-Language: en-US Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.10.7.17134; 10.0.0.0.17134.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134 Host: www.bing.com Content-Length: 88754 Connection: Keep-Alive Cache-Control: no-cache Cookie: MUID=BEEBF15262804E24A8DF6781500AB975; _SS=CPID=1652795010993&AC=1&CPH=4ef661f2
2022-05-17 13:43:41 UTC	147	OUT	Data Raw: 3c 43 6c 69 65 6e 74 49 6e 73 74 52 65 71 75 65 73 74 3e 3c 43 49 44 3e 31 34 44 35 41 36 39 41 42 45 46 46 36 39 36 32 30 31 34 35 41 44 30 35 42 46 43 37 36 38 35 38 3c 2f 43 49 44 3e 3c 45 76 65 6e 74 73 3e 3c 45 3e 3c 54 3e 45 76 65 6e 74 2e 43 6c 69 65 6e 74 49 6e 73 74 3c 2f 54 3e 3c 49 47 3e 43 30 34 30 39 45 38 34 43 37 45 43 34 44 31 36 41 32 43 44 44 41 34 38 30 35 45 32 44 33 43 34 3c 2f 49 47 3e 3c 44 3e 3c 21 5b 43 44 41 54 41 5b 7b 22 43 75 72 55 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 62 69 6e 67 2e 63 6f 6d 2f 41 53 2f 41 50 49 2f 57 69 6e 64 6f 77 73 43 6f 72 74 61 6e 61 50 61 6e 65 2f 56 32 2f 49 6e 69 74 22 2c 22 50 69 76 6f 74 22 3a 22 51 46 22 2c 22 43 46 22 3a 22 70 62 69 74 63 70 64 69 73 61 62 6c 65 64 2c 41 6d 62 69 65 Data Ascii: <ClientInstRequest><CID>14D5A69ABEFF69620145AD05BFC76858</CID><Events><E><T>Event.ClientInst</T><IG>C0409E84C7EC4D16A2CDDA4805E2D3C4</IG><D><![CDATA[{"CurUrl":"https://www.bing.com/AS/API/WindowsCortanaPane/V2/Init","Pivot":"QF","CF":"pbitcpdisabled,Ambie
2022-05-17 13:43:41 UTC	163	OUT	Data Raw: 22 51 46 22 2c 22 43 46 22 3a 22 70 62 69 74 63 70 64 69 73 61 62 6c 65 64 2c 41 6d 62 69 65 6e 74 57 69 64 65 73 63 72 65 65 6e 2c 72 73 31 6d 75 73 69 63 70 72 6f 64 2c 43 6f 72 74 61 6e 61 53 50 41 58 61 6d 6c 48 65 61 64 65 72 22 2c 22 54 65 78 74 22 3a 22 5b 63 6f 6e 73 74 72 61 69 6e 74 49 6e 64 65 78 44 6f 77 6e 6c 6f 61 64 65 72 2e 74 72 79 44 6f 77 6e 6c 6f 61 64 46 72 6f 6d 55 72 6c 41 73 79 6e 63 5d 20 44 6f 77 6e 6c 6f 61 64 20 66 61 69 6c 65 64 22 2c 22 53 74 61 63 6b 22 3a 22 5b 63 6f 6e 73 74 72 61 69 6e 74 49 6e 64 65 78 44 6f 77 6e 6c 6f 61 64 65 72 2e 74 72 79 44 6f 77 6e 6c 6f 61 64 46 72 6f 6d 55 72 6c 41 73 79 6e 63 5d 20 44 6f 77 6e 6c 6f 61 64 20 66 61 69 6c 65 64 5c 6e 68 74 74 70 73 3a 2f 2f 77 77 77 2e 62 69 6e 67 2e 63 6f 6d 2f Data Ascii: "QF","CF":"pbitcpdisabled,AmbientWidescreen,rs1musicprod,CortanaSPAXamlHeader","Text":"[constraintIndexDownloader.tryDownloadFromUrlAsync] Download failed","Stack":"[constraintIndexDownloader.tryDownloadFromUrlAsync] Download failed\nhttps://www.bing.com/
2022-05-17 13:43:41 UTC	179	OUT	Data Raw: 63 70 72 6f 64 2c 43 6f 72 74 61 6e 61 53 50 41 58 61 6d 6c 48 65 61 64 65 72 22 2c 22 65 72 72 6f 72 54 79 70 65 22 3a 22 53 65 6e 64 54 69 6d 65 64 4f 75 74 22 2c 22 66 61 69 6c 43 6f 75 6e 74 22 3a 31 2c 22 54 53 22 3a 31 35 39 35 34 39 39 39 32 34 39 31 36 2c 22 52 54 53 22 3a 35 35 36 39 2c 22 53 45 51 22 3a 32 2c 22 55 54 53 22 3a 31 36 35 32 37 39 35 30 32 31 30 31 35 7d 5d 5d 3e 3c 2f 44 3e 3c 54 53 3e 31 35 39 35 34 39 39 39 32 34 39 31 36 3c 2f 54 53 3e 3c 2f 45 3e 3c 45 3e 3c 54 3e 45 76 65 6e 74 2e 43 6c 69 65 6e 74 49 6e 73 74 3c 2f 54 3e 3c 49 47 3e 43 30 34 30 39 45 38 34 43 37 45 43 34 44 31 36 41 32 43 44 44 41 34 38 30 35 45 32 44 33 43 34 3c 2f 49 47 3e 3c 44 3e 3c 21 5b 43 44 41 54 41 5b 7b 22 43 75 72 55 72 6c 22 3a 22 68 74 74 70 73 Data Ascii: cprod,CortanaSPAXamlHeader","errorType":"SendTimedOut","failCount":1,"TS":1595499924916,"RTS":5569,"SEQ":2,"UTS":1652795021015}...</D><TS>1595499924916</TS></E><E><T>Event.ClientInst</T><IG>C0409E84C7EC4D16A2CDDA4805E2D3C4</IG><D><![CDATA[{"CurUrl":"https
2022-05-17 13:43:41 UTC	195	OUT	Data Raw: 74 6f 53 75 67 67 65 73 74 22 2c 22 53 63 65 6e 61 72 69 6f 22 3a 22 4d 50 50 22 2c 22 53 43 22 3a 31 2c 22 44 53 22 3a 5b 7b 22 54 22 3a 22 44 2e 55 72 6c 22 2c 22 4b 22 3a 31 30 30 33 2c 22 51 22 3a 22 54 61 73 6b 20 4d 61 6e 61 67 65 72 22 2c 22 56 61 6c 22 3a 22 50 50 22 2c 22 48 6f 22 3a 32 2c 22 47 72 22 3a 30 2c 22 48 53 22 3a 31 2c 22 44 65 76 69 63 65 53 69 67 6e 61 6c 73 22 3a 7b 22 52 61 6e 6b 22 3a 30 2c 22 50 48 69 74 73 22 3a 22 53 79 73 74 65 6d 2e 50 61 72 73 69 6e 67 4e 61 6d 65 22 2c 22 49 64 22 3a 22 4d 69 63 72 6f 73 6f 66 74 2e 41 75 74 6f 47 65 6e 65 72 61 74 65 64 2e 7b 39 32 33 44 44 34 37 37 2d 35 38 34 36 2d 36 38 36 42 2d 41 36 35 39 2d 30 46 43 43 44 37 33 38 35 31 41 38 7d 22 2c 22 44 4e 61 6d 65 22 3a 22 54 61 73 6b 20 4d 61 Data Ascii: toSuggest","Scenario":"MPP","SC":1,"DS":[{"T":"D.Url","K":1003,"Q":"Task Manager","Val":"PP","Ho":2,"Gr":0,"HS":1,"DeviceSignals":{"Rank":0,"PHits":"System.ParsingName","Id":"Microsoft.AutoGenerated.{923DD477-5846-686B-A659-0FCCD73851A8}","DName":"Task Ma
2022-05-17 13:43:41 UTC	211	OUT	Data Raw: 66 6f 22 3a 7b 22 4d 55 49 44 22 3a 22 42 45 45 42 46 31 35 32 36 32 38 30 34 45 32 34 41 38 44 46 36 37 38 31 35 30 30 41 42 39 37 35 22 2c 22 41 43 56 65 72 22 3a 22 34 65 66 36 36 31 66 32 22 2c 22 46 44 50 61 72 74 6e 65 72 45 6e 74 72 79 22 3a 22 61 75 74 6f 73 75 67 67 65 73 74 22 2c 22 69 73 4f 66 66 6c 69 6e 65 22 3a 30 2c 22 77 65 62 52 65 71 75 65 73 74 65 64 22 3a 31 2c 22 65 6e 74 72 79 50 6f 69 6e 74 22 3a 22 57 4e 53 53 54 42 22 2c 22 70 72 65 76 69 6f 75 73 45 78 70 65 72 69 65 6e 63 65 22 3a 22 53 65 61 72 63 68 42 6f 78 22 2c 22 64 65 76 69 63 65 48 69 73 74 6f 72 79 45 6e 61 62 6c 65 64 22 3a 31 2c 22 77 69 6e 64 6f 77 73 41 63 63 6f 75 6e 74 22 3a 22 33 22 2c 22 63 6f 72 74 61 6e 61 41 63 63 6f 75 6e 74 22 3a 22 33 22 2c 22 73 65 61 72 Data Ascii: fo":{"MUID":"BEEBF15262804E24A8DF6781500AB975","ACVer":"4ef661f2","FDPartnerEntry":"autosuggest","isOffline":0,"webRequested":1,"entryPoint":"WNSSTB","previousExperience":"SearchBox","deviceHistoryEnabled":1,"windowsAccount":"3","cortanaAccount":"3","sear
2022-05-17 13:43:41 UTC	227	OUT	Data Raw: 69 63 65 53 69 67 6e 61 6c 73 22 3a 7b 22 52 61 6e 6b 22 3a 30 2c 22 50 48 69 74 73 22 3a 22 53 79 73 74 65 6d 2e 50 61 72 73 69 6e 67 4e 61 6d 65 22 2c 22 49 64 22 3a 22 4d 69 63 72 6f 73 6f 66 74 2e 41 75 74 6f 47 65 6e 65 72 61 74 65 64 2e 7b 39 32 33 44 44 34 37 37 2d 35 38 34 36 2d 36 38 36 42 2d 41 36 35 39 2d 30 46 43 43 44 37 33 38 35 31 41 38 7d 22 2c 22 44 4e 61 6d 65 22 3a 22 54 61 73 6b 20 4d 61 6e 61 67 65 72 22 2c 22 41 70 70 4c 6e 63 68 22 3a 30 2c 22 41 72 67 73 22 3a 30 2c 22 4d 44 4e 22 3a 30 2c 22 45 78 74 22 3a 22 2e 65 78 65 22 7d 7d 5d 7d 2c 7b 22 54 22 3a 22 44 2e 50 50 22 2c 22 41 70 70 4e 53 22 3a 22 53 6d 61 72 74 53 65 61 72 63 68 22 2c 22 53 65 72 76 69 63 65 22 3a 22 41 75 74 6f 53 75 67 67 65 73 74 22 2c 22 53 63 65 6e 61 72 Data Ascii: iceSignals":{"Rank":0,"PHits":"System.ParsingName","Id":"Microsoft.AutoGenerated.{923DD477-5846-686B-A659-0FCCD73851A8}","DName":"Task Manager","AppLnch":0,"Args":0,"MDN":0,"Ext":".exe"}}]},{"T":"D.PP","AppNS":"SmartSearch","Service":"AutoSuggest","Scenar
2022-05-17 13:43:41 UTC	234	IN	HTTP/1.1 204 No Content Access-Control-Allow-Origin: * X-Cache: CONFIG_NOCACHE Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: 8225699EA2DF432AABB335ABA4B1C3E0 Ref B: VIEEDGE2513 Ref C: 2022-05-17T13:43:41Z Date: Tue, 17 May 2022 13:43:41 GMT Connection: close

Timestamp	kBytes transferred	Direction	Data
2022-05-17 13:43:51 UTC	234	OUT	POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1 Host: accounts.google.com Connection: keep-alive Content-Length: 1 Origin: https://www.google.com Content-Type: application/x-www-form-urlencoded Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en-US;q=0.9,en;q=0.8
2022-05-17 13:43:51 UTC	235	OUT	Data Raw: 20 Data Ascii:
2022-05-17 13:43:51 UTC	237	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=utf-8 Access-Control-Allow-Origin: https://www.google.com Access-Control-Allow-Credentials: true X-Content-Type-Options: nosniff Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Tue, 17 May 2022 13:43:51 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/IdentityListAccountsHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-Tovv018tYl5byZeaCYxK4w' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/IdentityListAccountsHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'nonce-Tovv018tYl5byZeaCYxK4w' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/IdentityListAccountsHttp/cspreport Report-To: {"group":"IdentityListAccountsHttp","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/IdentityListAccountsHttp/external"}]} Cross-Origin-Opener-Policy: same-origin; report-to="IdentityListAccountsHttp" Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2022-05-17 13:43:51 UTC	239	IN	Data Raw: 31 31 0d 0a 5b 22 67 61 69 61 2e 6c 2e 61 2e 72 22 2c 5b 5d 5d 0d 0a Data Ascii: 11["gaia.l.a.r",[]]
2022-05-17 13:43:51 UTC	239	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	kBytes transferred	Direction	Data
2022-05-17 13:43:51 UTC	235	OUT	GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=85.0.4183.121&lang=en-GB&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1&x=id%3Dpkedcjkdefgpdelpbcmbmeomcjbeemfm%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1 Host: clients2.google.com Connection: keep-alive X-Goog-Update-Interactivity: fg X-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmieda,pkedcjkdefgpdelpbcmbmeomcjbeemfm X-Goog-Update-Updater: chromecrx-85.0.4183.121 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en-US;q=0.9,en;q=0.8
2022-05-17 13:43:51 UTC	236	IN	HTTP/1.1 200 OK Content-Security-Policy: script-src 'report-sample' 'nonce-V_Iq1IVDWVzAgNHT5wcqbQ' 'unsafe-inline' 'strict-dynamic' https: http:;object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/clientupdate-aus/1 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Tue, 17 May 2022 13:43:51 GMT Content-Type: text/xml; charset=UTF-8 X-Daynum: 5615 X-Daystart: 24231 X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block Server: GSE Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2022-05-17 13:43:51 UTC	237	IN	Data Raw: 33 36 64 0d 0a 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 67 75 70 64 61 74 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 75 70 64 61 74 65 32 2f 72 65 73 70 6f 6e 73 65 22 20 70 72 6f 74 6f 63 6f 6c 3d 22 32 2e 30 22 20 73 65 72 76 65 72 3d 22 70 72 6f 64 22 3e 3c 64 61 79 73 74 61 72 74 20 65 6c 61 70 73 65 64 5f 64 61 79 73 3d 22 35 36 31 35 22 20 65 6c 61 70 73 65 64 5f 73 65 63 6f 6e 64 73 3d 22 32 34 32 33 31 22 2f 3e 3c 61 70 70 20 61 70 70 69 64 3d 22 6e 6d 6d 68 6b 6b 65 67 63 63 61 67 64 6c 64 67 69 69 6d 65 64 70 69 63 63 6d 67 6d 69 65 64 61 22 20 63 6f 68 6f 72 74 3d 22 31 3a 3a 22 20 63 6f 68 6f 72 74 6e 61 6d 65 3d 22 22 Data Ascii: 36d<?xml version="1.0" encoding="UTF-8"?><gupdate xmlns="http://www.google.com/update2/response" protocol="2.0" server="prod"><daystart elapsed_days="5615" elapsed_seconds="24231"/><app appid="nmmhkkegccagdldgiimedpiccmgmieda" cohort="1::" cohortname=""
2022-05-17 13:43:51 UTC	237	IN	Data Raw: 6d 68 6b 6b 65 67 63 63 61 67 64 6c 64 67 69 69 6d 65 64 70 69 63 63 6d 67 6d 69 65 64 61 2e 63 72 78 22 20 66 70 3d 22 31 2e 38 31 65 33 61 34 64 34 33 61 37 33 36 39 39 65 31 62 37 37 38 31 37 32 33 66 35 36 62 38 37 31 37 31 37 35 63 35 33 36 36 38 35 63 35 34 35 30 31 32 32 62 33 30 37 38 39 34 36 34 61 64 38 32 22 20 68 61 73 68 5f 73 68 61 32 35 36 3d 22 38 31 65 33 61 34 64 34 33 61 37 33 36 39 39 65 31 62 37 37 38 31 37 32 33 66 35 36 62 38 37 31 37 31 37 35 63 35 33 36 36 38 35 63 35 34 35 30 31 32 32 62 33 30 37 38 39 34 36 34 61 64 38 32 22 20 70 72 6f 74 65 63 74 65 64 3d 22 30 22 20 73 69 7a 65 3d 22 32 34 38 35 33 31 22 20 73 74 61 74 75 73 3d 22 6f 6b 22 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 2e 30 2e 36 22 2f 3e 3c 2f 61 70 70 3e 3c 61 70 Data Ascii: mhkkegccagdldgiimedpiccmgmieda.crx" fp="1.81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82" hash_sha256="81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82" protected="0" size="248531" status="ok" version="1.0.0.6"/></app><ap
2022-05-17 13:43:51 UTC	237	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	kBytes transferred	Direction	Data
2022-05-17 13:43:51 UTC	239	OUT	GET /healthesystems/viewAgreement?tsid=ZGFyeWxAaGVhbHRoZXN5c3RlbXMuY29t HTTP/1.1 Host: 794609.documents.savethenote2.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en-US;q=0.9,en;q=0.8
2022-05-17 13:43:51 UTC	240	IN	HTTP/1.1 404 Not Found Date: Tue, 17 May 2022 13:43:51 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Accept-Ranges: bytes Content-Length: 10855 Content-Type: text/html
2022-05-17 13:43:51 UTC	240	IN	Data Raw: 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 20 3c 74 69 74 6c 65 3e 43 61 70 74 63 68 61 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 2e 62 6c 6f 63 6b 7b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 6c 65 66 74 3a 30 3b 74 6f 70 3a 30 7d 2e 73 6c 69 64 65 72 43 6f 6e 74 61 69 6e 65 72 7b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 77 69 64 74 68 3a 33 31 30 70 78 3b 68 65 69 67 68 74 3a 34 30 70 78 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 34 30 70 78 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 31 35 70 78 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 76 65 72 64 61 6e 61 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 37 66 39 66 61 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 34 70 78 3b 63 6f 6c 6f 72 3a 23 34 35 Data Ascii: </body></html> <title>Captcha</title><style>.block{position:absolute;left:0;top:0}.sliderContainer{position:relative;text-align:center;width:310px;height:40px;line-height:40px;margin-top:15px;font-family:verdana;background:#f7f9fa;font-size:14px;color:#45
2022-05-17 13:43:51 UTC	248	IN	Data Raw: 76 61 72 20 74 3d 6e 2e 62 6c 6f 63 6b 43 74 78 2e 67 65 74 49 6d 61 67 65 44 61 74 61 28 6e 2e 78 2d 33 2c 65 2c 6f 2c 6f 29 3b 6e 2e 62 6c 6f 63 6b 2e 77 69 64 74 68 3d 6f 2c 6e 2e 62 6c 6f 63 6b 43 74 78 2e 70 75 74 49 6d 61 67 65 44 61 74 61 28 74 2c 30 2c 65 29 7d 7d 2c 28 74 3d 76 28 22 69 6d 67 22 29 29 2e 63 72 6f 73 73 4f 72 69 67 69 6e 3d 22 41 6e 6f 6e 79 6d 6f 75 73 22 2c 74 2e 6f 6e 6c 6f 61 64 3d 65 2c 74 2e 6f 6e 65 72 72 6f 72 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 74 2e 73 72 63 3d 61 28 29 7d 2c 74 2e 73 72 63 3d 61 28 29 2c 74 29 3b 74 68 69 73 2e 69 6d 67 3d 69 7d 7d 2c 7b 6b 65 79 3a 22 64 72 61 77 22 2c 76 61 6c 75 65 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 69 73 2e 78 3d 74 28 37 33 2c 32 33 37 29 2c 74 68 69 73 2e 79 3d 74 28 32 38 Data Ascii: var t=n.blockCtx.getImageData(n.x-3,e,o,o);n.block.width=o,n.blockCtx.putImageData(t,0,e)}},(t=v("img")).crossOrigin="Anonymous",t.onload=e,t.onerror=function(){t.src=a()},t.src=a(),t);this.img=i}},{key:"draw",value:function(){this.x=t(73,237),this.y=t(28

Timestamp	kBytes transferred	Direction	Data
2022-05-17 13:43:52 UTC	251	OUT	GET /300/150/?image=824 HTTP/1.1 Host: picsum.photos Connection: keep-alive Origin: https://794609.documents.savethenote2.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept: image/avif,image/webp,image/apng,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: image Referer: https://794609.documents.savethenote2.com/healthesystems/viewAgreement?tsid=ZGFyeWxAaGVhbHRoZXN5c3RlbXMuY29t Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en-US;q=0.9,en;q=0.8
2022-05-17 13:43:52 UTC	251	IN	HTTP/1.1 302 Found Date: Tue, 17 May 2022 13:43:52 GMT Content-Length: 0 Connection: close location: https://i.picsum.photos/id/824/300/150.jpg?hmac=YLOxcCAmebF9Wvsp1kXa3AWYWkixtbvoNd_HdkCBBTE strict-transport-security: max-age=15552000 access-control-allow-origin: * Cache-Control: no-cache, no-store, must-revalidate CF-Cache-Status: DYNAMIC Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=iUjVJbZvFcBweQ1BhkDkQzLOdAfNoqSd5ryWZkjfKPBqmmY1S%2FYvh88j%2Bbj6OEB3oGpJWIJ7wWpptc%2BCFd0guv2rAxJ8cnOnJdRb4sIqA5MzcxmMdg5Zm1h5yYItADo%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} X-Content-Type-Options: nosniff Server: cloudflare CF-RAY: 70ccc8dafca29c0d-FRA alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

Timestamp	kBytes transferred	Direction	Data
2022-05-17 13:43:52 UTC	253	OUT	GET /id/824/300/150.jpg?hmac=YLOxcCAmebF9Wvsp1kXa3AWYWkixtbvoNd_HdkCBBTE HTTP/1.1 Host: i.picsum.photos Connection: keep-alive Origin: null User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept: image/avif,image/webp,image/apng,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: image Referer: https://794609.documents.savethenote2.com/healthesystems/viewAgreement?tsid=ZGFyeWxAaGVhbHRoZXN5c3RlbXMuY29t Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en-US;q=0.9,en;q=0.8
2022-05-17 13:43:53 UTC	265	IN	HTTP/1.1 200 OK Date: Tue, 17 May 2022 13:43:53 GMT Content-Type: image/jpeg Content-Length: 9194 Connection: close Cache-Control: public, max-age=2592000 Cf-Bgj: h2pri access-control-allow-origin: * access-control-expose-headers: Picsum-ID content-disposition: inline; filename="824-300x150.jpg" picsum-id: 824 strict-transport-security: max-age=15552000 via: 1.1 varnish (Varnish/6.2) x-varnish: 332138805 195855315 Last-Modified: Sat, 14 May 2022 21:14:58 GMT CF-Cache-Status: HIT Accept-Ranges: bytes Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=71ekLw3GUb0am1sqL4wuvmprfULyI3VVNvZcJTMc%2FlgAkb1ZFMZn87wEtwlYZ4xRVxYhVtvU4QogJwg1jYdoruyipxwXQusMTm%2BbLJs229UcJwW1JX5CgM6C%2FcjWnQcc6w%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} X-Content-Type-Options: nosniff Server: cloudflare CF-RAY: 70ccc8dc1dae9bdd-FRA alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
2022-05-17 13:43:53 UTC	266	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 00 00 01 00 01 00 00 ff e1 00 de 45 78 69 66 00 00 49 49 2a 00 08 00 00 00 06 00 12 01 03 00 01 00 00 00 01 00 00 00 1a 01 05 00 01 00 00 00 56 00 00 00 1b 01 05 00 01 00 00 00 5e 00 00 00 28 01 03 00 01 00 00 00 02 00 00 00 13 02 03 00 01 00 00 00 01 00 00 00 69 87 04 00 01 00 00 00 66 00 00 00 00 00 00 00 48 00 00 00 01 00 00 00 48 00 00 00 01 00 00 00 07 00 00 90 07 00 04 00 00 00 30 32 31 30 01 91 07 00 04 00 00 00 01 02 03 00 86 92 07 00 16 00 00 00 c0 00 00 00 00 a0 07 00 04 00 00 00 30 31 30 30 01 a0 03 00 01 00 00 00 ff ff 00 00 02 a0 04 00 01 00 00 00 2c 01 00 00 03 a0 04 00 01 00 00 00 96 00 00 00 00 00 00 00 41 53 43 49 49 00 00 00 50 69 63 73 75 6d 20 49 44 3a 20 38 32 34 ff db 00 43 00 08 06 06 07 06 05 Data Ascii: JFIFExifII*V^(ifHH02100100,ASCIIPicsum ID: 824C
2022-05-17 13:43:53 UTC	267	IN	Data Raw: 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d 38 32 3c 2e 33 34 32 ff db 00 43 01 09 09 09 0c 0b 0c 18 0d 0d 18 32 21 1c 21 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 ff c2 00 11 08 00 96 01 2c 03 01 22 00 02 11 01 03 11 01 ff c4 00 1a 00 00 02 03 01 01 00 00 00 00 00 00 00 00 00 00 00 02 03 00 01 04 05 06 ff c4 00 19 01 00 03 01 01 01 00 00 00 00 00 00 00 00 00 00 00 00 01 02 03 04 05 ff da 00 0c 03 01 00 02 10 03 10 00 00 01 d3 75 7d bc 72 e4 09 72 d1 57 2c 72 4b 0a ab a1 54 b8 03 2e 35 54 51 15 77 06 36 58 22 b7 09 a5 a4 b7 9b ae 2b 48 b4 76 cd 74 51 aa 28 69 94 35 cd a5 0e 0b cd 9d 7c 4f c7 7c 77 d4 4d 4e 18 c1 a9 ab Data Ascii: $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222,"u}rrW,rKT.5TQw6X"+HvtQ(i5\|O\|wMN
2022-05-17 13:43:53 UTC	268	IN	Data Raw: 2d 67 e0 71 ec 87 81 44 b3 8d c4 69 c7 a1 2b 65 bd 59 ff 00 01 e8 cd 4c d4 f4 c1 85 71 d4 2f 4c 4c 40 71 36 9b 19 9e 86 62 04 98 2b 18 e7 a2 cc cc cb 2f c1 57 cc ef bb 1a cf 7c b1 44 4b 2f 76 85 91 62 9d d3 aa a9 33 b6 33 b7 4c 09 99 9c c5 ab 33 b4 a0 09 89 89 81 3d af a9 98 17 c6 20 59 8e 9e 31 81 30 27 a9 9f 3b fd 72 cc 96 db bd bb e6 25 76 3a de b7 57 3e 4e 1b b9 65 87 84 db 71 ba 86 22 6d 32 7a e6 2f 27 ef 57 2f eb f3 0e 53 90 45 43 96 d3 e5 78 f9 67 1f 28 e7 e6 6c cd c9 24 8e 53 60 f2 db 1f 25 c4 1c a6 cf c9 39 f9 47 07 94 d8 a7 92 cc a3 92 67 c8 2c 7b 8c 17 f9 2d b0 14 48 6b 7b 2f b0 d9 93 6d 6c 7b 7c 4d bb bd a5 e1 5f 81 f2 be cd 7b 67 bc c0 9e 51 df e5 18 b7 92 3e 43 61 79 7b 4f 9b 88 a3 03 62 c7 c6 87 c3 64 ac cf d7 5d 53 fe 33 84 15 58 11 00 fa Data Ascii: -gqDi+eYLq/LL@q6b+/W\|DK/vb33L3= Y10';r%v:W>Neq"m2z/'W/SECxg(l$S`%9Gg,{-Hk{/ml{\|M_{gQ>Cay{Obd]S3X
2022-05-17 13:43:53 UTC	269	IN	Data Raw: 3b dd 1b 7e 17 5c 95 3d 56 0a 3f b9 4e c9 dc 32 17 08 54 c5 d5 95 94 21 0b 0b 1b 2b 9d c9 45 70 fa a8 8b c2 21 af 9a 37 5a 4c f6 1e 21 62 11 6f 84 0f 10 01 51 41 a3 72 24 c2 0d bd 23 3c ca c6 d8 84 e0 d3 72 7f 29 e6 77 44 4a 94 6e a9 b2 c2 db 28 c8 5b 2d 97 fd a0 e8 c7 44 77 74 a6 89 80 a3 60 a9 93 95 e6 a7 f0 ad e4 a3 9e ea a1 2a 0d a9 4e e7 94 d9 37 19 46 0d fa 29 ab f0 9d b5 94 b5 11 28 8b a0 4a a6 ba 66 f4 a6 cb e4 ff 00 9a 2d 6e af 92 76 99 25 e3 ed 44 30 52 0e ce 55 9d 46 87 6d 7d 91 aa f0 56 a8 00 65 1f 25 50 c1 ca 38 26 2c 55 59 5d 66 51 f4 37 47 d1 13 d6 16 3d 51 15 71 1b aa af c5 d5 44 1e b0 87 28 e4 81 71 94 5c 4c ef 01 1a b6 d9 17 55 4c 2b 5f a1 50 07 a2 83 a9 c2 dd 82 13 84 2c 51 99 dc a0 6d d8 71 65 78 b3 6f 08 f4 5e 02 0a 35 36 e7 0b c2 67 Data Ascii: ;~\=V?N2T!+Ep!7ZL!boQAr$#<r)wDJn([-Dwt`*N7F)(Jf-nv%D0RUFm}Ve%P8&,UY]fQ7G=QqD(q\LUL+_P,Qmqexo^56g
2022-05-17 13:43:53 UTC	271	IN	Data Raw: 60 02 a6 4c da a6 7a 81 45 91 7e b2 cc b6 d7 31 dc 07 30 05 4b 18 b9 a3 74 c1 9d 4d fc 44 42 14 38 8a d6 59 b2 af 3d 40 b5 a7 5b 4f 1a e6 6d 50 a1 86 90 7d 71 80 35 db ff 00 20 41 8a 50 ca 64 6e 4e 25 e3 a5 85 70 0c 88 6d f5 00 02 ae c5 4a 95 00 a9 78 b4 a5 86 09 e9 2d 76 a8 f1 d1 16 8b 7f 17 04 71 18 05 c0 c3 29 6c 62 2e 94 34 85 72 95 18 74 b7 c7 88 6f 00 81 52 e8 10 95 87 f7 94 ab ef 82 2c d2 72 cc 6b 46 98 d8 75 f3 1c d6 7a 49 96 17 8c 91 c8 d3 31 18 9a c8 63 9c aa 0f 51 49 ac 0e e6 bd a2 07 de 4c 09 9d 1c 07 57 c1 17 73 7e c9 e6 08 8b 57 40 5f 15 5d c3 2a 63 18 02 1f ce bb f0 90 44 2d 74 08 a6 68 96 11 d7 cc ac 9b 76 7f 10 62 3d 1a 9b 46 3d 45 a5 2a ae 1e a3 5e 62 3c 29 77 0b 72 28 dc a0 02 e5 51 0a 31 be aa 06 e2 b3 8b 9b 7b 97 50 a0 41 4c ad 88 a0 Data Ascii: `LzE~10KtMDB8Y=@[OmP}q5 APdnN%pmJx-vq)lb.4rtoR,rkFuzI1cQILWs~W@_]cD-thvb=F=E^b<)wr(Q1{PAL
2022-05-17 13:43:53 UTC	272	IN	Data Raw: ff c4 00 21 11 01 01 01 00 02 03 01 00 02 03 00 00 00 00 00 00 01 00 11 21 31 10 41 61 51 20 81 30 71 f1 ff da 00 08 01 02 01 01 3f 10 ff 00 0e ca c5 ea d5 9b 39 fd 43 e1 6e e3 02 7b e2 17 dd a3 20 87 7f 9f 31 1e 99 63 9b 71 dd a0 36 d9 6c 62 c2 d5 e0 ee 70 3f 8e db 7b 9f f6 07 af 10 7e 6d 90 16 96 db 39 ea 36 cb 44 30 77 c2 4e d9 80 bd 48 b4 35 70 f8 01 df 71 a9 c4 70 cf 9f 1b 9c 10 fa 4c 2c ae b6 4e 25 d2 e4 bf 49 21 c4 b2 d1 ce 9f dd a6 31 ea 7c 42 3a 85 8c 39 60 3d c6 ed 2e da 6c 67 3b f1 53 ad 80 94 39 97 49 42 46 95 86 f7 b0 0f 3d de ac 81 3d 41 ae 30 0b 72 e2 73 27 d5 b6 18 09 4f 0d 41 09 75 9c f6 0c e0 17 8c 8c 5f bf 22 88 e5 90 b6 c3 5c 46 64 f0 5a fa cd 9f ad f4 be 97 da d3 9d b4 f7 28 2e c7 eb f6 f4 7f b6 de e1 db 27 86 fa 5f 5b ef 7d 2e 0e 2c Data Ascii: !!1AaQ 0q?9Cn{ 1cq6lbp?{~m96D0wNH5pqpL,N%I!1\|B:9`=.lg;S9IBF==A0rs'OAu_"\FdZ(.'_[}.,
2022-05-17 13:43:53 UTC	273	IN	Data Raw: d5 71 63 6c 03 4a ed 88 e1 8d d9 16 16 d2 18 a4 40 b4 30 8b 41 7e 65 53 40 f7 00 00 37 d3 2f 0d c5 35 70 e8 65 4a 9c 09 67 29 2d e6 2a c1 40 6e 87 7d 81 cb 48 0d 54 3d 25 8c 46 41 aa 63 7e 29 66 5c 21 71 9c 37 b1 a2 e2 c6 02 ab 94 a6 b4 f3 45 1e 99 49 35 59 7c d7 80 96 cc 75 34 ac a0 de 44 db 10 2a d6 df dc 14 ee 71 4d 11 d9 7b 9e 00 94 94 42 a1 30 38 c4 d9 80 be cf 32 9e 88 08 2d b2 70 0c df 22 c5 17 2c 74 76 58 d2 43 79 a4 65 18 3c 84 c9 50 9a ad a5 c5 92 85 8c a8 2b 98 2a a2 99 34 62 38 8a 88 19 38 05 41 85 d7 b6 23 a6 b1 96 d8 36 2e ac e1 2a a5 68 cb 01 46 51 b5 cd f3 b2 80 83 a2 9f 25 1e 5f ee 56 bc d2 3d 0a 36 ef be 6b 75 ea 1f c9 da 4c ed df 34 67 4f 96 18 80 e0 72 a7 d3 af c1 95 2a 3a 44 02 fd c2 8c bb 95 80 3c d4 c8 62 51 b0 d4 49 6a 9f 11 36 b3 Data Ascii: qclJ@0A~eS@7/5peJg)-@n}HT=%FAc~)f\!q7EI5Y\|u4DqM{B082-p",tvXCye<P+4b88A#6.hFQ%_V=6kuL4gOr*:D<bQIj6
2022-05-17 13:43:53 UTC	275	IN	Data Raw: 95 75 03 c3 37 6a 72 37 3f 50 ed aa ae e8 69 67 1d 47 60 69 07 4e 9e 89 af f1 2e c8 b6 3e 4f af 8b ab 85 0d 0d 7b 6d 9d 30 52 b0 4a 57 d0 71 19 8c 81 a6 83 4d f3 5f a8 e7 9c a0 32 bb 21 ba dc 65 aa 6b 67 05 0f be 79 f7 2c 2a d1 e0 d1 41 5e 73 a9 70 86 05 a4 70 25 f6 f1 bf a8 cc 28 24 f4 0f 93 58 0c 55 20 d2 19 2f e1 fd cc a7 f2 91 1e 39 94 6c 57 2d 41 69 53 34 02 bb d9 57 83 82 a0 4b 0c 60 3d 3b 35 b0 3d 43 08 9e 78 d3 9d 7c e7 d4 be d8 d8 9a e5 6d 79 be 27 1e 8d 0d 79 fb 65 9e 0f 72 f8 d0 65 5a b1 57 1c 75 fc 4b 72 3e 98 40 76 bc ad c0 27 76 d1 72 ed f6 f3 7e e5 56 80 1c 83 6d f8 bd 43 ae f2 64 22 2e 56 ad 35 ef ff 00 25 b4 5d 17 14 3d 79 9a 96 a0 a7 ca ab ea 09 c3 b6 98 df ed 4c 48 10 b7 2d 1e 0f 4a 77 05 a2 75 06 09 6f ee ba ea 0b 88 54 a1 5b c4 a3 db Data Ascii: u7jr7?PigG`iN.>O{m0RJWqM_2!ekgy,*A^spp%($XU /9lW-AiS4WK`=;5=Cx\|my'yereZWuKr>@v'vr~VmCd".V5%]=yLH-JwuoT[

Target ID:	0
Start time:	15:43:45
Start date:	17/05/2022
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --enable-automation "https://794609.documents.savethenote2.com/healthesystems/viewAgreement?tsid=ZGFyeWxAaGVhbHRoZXN5c3RlbXMuY29t#%25EMAILX
Imagebase:	0x7ff7964c0000
File size:	2150896 bytes
MD5 hash:	C139654B5C1438A95B321BB01AD63EF6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Target ID:	1
Start time:	15:43:47
Start date:	17/05/2022
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1536,186412520852336944,848366137565786927,131072 --lang=en-GB --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1952 /prefetch:8
Imagebase:	0x7ff7964c0000
File size:	2150896 bytes
MD5 hash:	C139654B5C1438A95B321BB01AD63EF6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low