Windows Analysis Report
https://aka.ms/LearnAboutSenderIdentification

Phishing

Source: Yara match

File source: 0.2.pages.csv, type: HTML

Source: https://support.microsoft.com/en-us/windows/protect-yourself-from-phishing-0c7ea947-ba98-3bd9-7184-430e1f860a44

HTTP Parser: Form action: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=ee272b19-4411-433f-8f28-5c13cb6fd407&redirect_uri=https%3A%2F%2Fsupport.microsoft.com%2Fsignin-oidc&response_type=code%20id_token&scope=openid%20profile%20offline_access&response_mode=form_post&nonce=638603790833558006.NzhlNDI0NWUtZjhjOC00ZTVmLWFlNWMtYzA2MTQwYjJiNzMyYzNlODRjYTUtNTAxNi00NjI0LThkNWYtOTRlMmU5MjFmMDVj&prompt=none&nopa=2&state=CfDJ8LWN6nmb9HBGpcIJvpEgkL16ugdD2Ev-VlZ65HgDGlug9ztbmgngrbBKb11zK4sEMY2pxKvm4Rfo5yCoy2BpRtyq6am22bo_zyzlym7CslLnZe_-bCiOsgXqe9KvRXkG05UEIw29PJ4ztz91gQ03BherHMBrc7wZROX5wr9KNdshRG4c4Bo0CLRxiTOMXucS0L90mbBZPhNH_uohc_a8E9CBWwQzwcq72V9zfidlUfG6WaRs9PutO9NbRljXvBQk8YLi9xs8w3ELF5QtUpSbtxVZu76Zm6wV1RL0DT2u7H2T9LxgBmEsyifXJnN8sP-jL-USyrXboHOS1_lm6vFRUCFJBWjUYWLdp8g5suJ0bynE&x-client-SKU=ID_NET6_0&x-client-ver=7.6.0.0&sso_reload=true microsoft microsoftonline

Source: https://support.microsoft.com/en-us/windows/protect-yourself-from-phishing-0c7ea947-ba98-3bd9-7184-430e1f860a44	HTTP Parser: Iframe src: https://login.live.com/Me.htm?v=3
Source: https://support.microsoft.com/en-us	HTTP Parser: Iframe src: https://login.live.com/Me.htm?v=3
Source: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=ee272b19-4411-433f-8f28-5c13cb6fd407&redirect_uri=https%3A%2F%2Fsupport.microsoft.com%2Fsignin-oidc&response_type=code%20id_token&scope=openid%20profile%20offline_access&response_mode=form_post&nonce=638603791301466725.NWNjZmFhOTctNjg2ZS00MTcyLWIwOWYtZDVhODJhNjhhMTMxMjgyOWM2ZWItYjc2OC00MTU0LWFhMjEtODBiOWNkMmYwMDZh&nopa=2&state=CfDJ8LWN6nmb9HBGpcIJvpEgkL3nNPi-VnwXnEmrNqxD-nvvMeUPhuo1O40j6_55Q-s3D-MAvmn3bfxLqRHi-f4Z5Yx9DEYxc_U5XjtzS5HMnfcynAdQrLBuQzc8tOiJPYo9cuxn7OfvLNI6RwcM6jJhs8FPrDMIXBT7CNoMVIHQjPJZ46CrWDoA0VTXHhXY8y-9lSdMWzCsYmqkRVutFYoKFZtvXR6rJzjoY_lBLVLXq2zlj5gwnhPwaw93YmH25fz_yaYSSFPYvhnPCpFiwfYVywDeGrAsbAEPxTS6s_a5nzGiRo3zrn2Rdd0dil0FTYQlbKSf-s3P5xmtx2pOr1yBhcc&x-client-SKU=ID_NET6_0&x-client-ver=7.6.0.0	HTTP Parser: Iframe src: https://login.live.com/Me.htm?v=3
Source: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=ee272b19-4411-433f-8f28-5c13cb6fd407&redirect_uri=https%3A%2F%2Fsupport.microsoft.com%2Fsignin-oidc&response_type=code%20id_token&scope=openid%20profile%20offline_access&response_mode=form_post&nonce=638603791301466725.NWNjZmFhOTctNjg2ZS00MTcyLWIwOWYtZDVhODJhNjhhMTMxMjgyOWM2ZWItYjc2OC00MTU0LWFhMjEtODBiOWNkMmYwMDZh&nopa=2&state=CfDJ8LWN6nmb9HBGpcIJvpEgkL3nNPi-VnwXnEmrNqxD-nvvMeUPhuo1O40j6_55Q-s3D-MAvmn3bfxLqRHi-f4Z5Yx9DEYxc_U5XjtzS5HMnfcynAdQrLBuQzc8tOiJPYo9cuxn7OfvLNI6RwcM6jJhs8FPrDMIXBT7CNoMVIHQjPJZ46CrWDoA0VTXHhXY8y-9lSdMWzCsYmqkRVutFYoKFZtvXR6rJzjoY_lBLVLXq2zlj5gwnhPwaw93YmH25fz_yaYSSFPYvhnPCpFiwfYVywDeGrAsbAEPxTS6s_a5nzGiRo3zrn2Rdd0dil0FTYQlbKSf-s3P5xmtx2pOr1yBhcc&x-client-SKU=ID_NET6_0&x-client-ver=7.6.0.0	HTTP Parser: Iframe src: https://login.live.com/Me.htm?v=3
Source: https://support.microsoft.com/en-us/office/the-keys-to-the-kingdom-securing-your-devices-and-accounts-a925f8ad-af7e-40d8-9ce4-60ea1cac2ba4	HTTP Parser: Iframe src: https://login.live.com/Me.htm?v=3

Source: https://support.microsoft.com/en-us/windows/protect-yourself-from-phishing-0c7ea947-ba98-3bd9-7184-430e1f860a44	HTTP Parser: Number of links: 0
Source: https://support.microsoft.com/en-us	HTTP Parser: Number of links: 0
Source: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=ee272b19-4411-433f-8f28-5c13cb6fd407&redirect_uri=https%3A%2F%2Fsupport.microsoft.com%2Fsignin-oidc&response_type=code%20id_token&scope=openid%20profile%20offline_access&response_mode=form_post&nonce=638603791301466725.NWNjZmFhOTctNjg2ZS00MTcyLWIwOWYtZDVhODJhNjhhMTMxMjgyOWM2ZWItYjc2OC00MTU0LWFhMjEtODBiOWNkMmYwMDZh&nopa=2&state=CfDJ8LWN6nmb9HBGpcIJvpEgkL3nNPi-VnwXnEmrNqxD-nvvMeUPhuo1O40j6_55Q-s3D-MAvmn3bfxLqRHi-f4Z5Yx9DEYxc_U5XjtzS5HMnfcynAdQrLBuQzc8tOiJPYo9cuxn7OfvLNI6RwcM6jJhs8FPrDMIXBT7CNoMVIHQjPJZ46CrWDoA0VTXHhXY8y-9lSdMWzCsYmqkRVutFYoKFZtvXR6rJzjoY_lBLVLXq2zlj5gwnhPwaw93YmH25fz_yaYSSFPYvhnPCpFiwfYVywDeGrAsbAEPxTS6s_a5nzGiRo3zrn2Rdd0dil0FTYQlbKSf-s3P5xmtx2pOr1yBhcc&x-client-SKU=ID_NET6_0&x-client-ver=7.6.0.0	HTTP Parser: Number of links: 0
Source: https://support.microsoft.com/en-us/office/the-keys-to-the-kingdom-securing-your-devices-and-accounts-a925f8ad-af7e-40d8-9ce4-60ea1cac2ba4	HTTP Parser: Number of links: 0

Source: https://support.microsoft.com/en-us/windows/protect-yourself-from-phishing-0c7ea947-ba98-3bd9-7184-430e1f860a44

HTTP Parser: Base64 decoded: 78e4245e-f8c8-4e5f-ae5c-c06140b2b732c3e84ca5-5016-4624-8d5f-94e2e921f05c

Source: https://support.microsoft.com/en-us/windows/protect-yourself-from-phishing-0c7ea947-ba98-3bd9-7184-430e1f860a44	HTTP Parser: Title: Redirecting does not match URL
Source: https://support.microsoft.com/en-us	HTTP Parser: Title: Redirecting does not match URL
Source: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=ee272b19-4411-433f-8f28-5c13cb6fd407&redirect_uri=https%3A%2F%2Fsupport.microsoft.com%2Fsignin-oidc&response_type=code%20id_token&scope=openid%20profile%20offline_access&response_mode=form_post&nonce=638603791301466725.NWNjZmFhOTctNjg2ZS00MTcyLWIwOWYtZDVhODJhNjhhMTMxMjgyOWM2ZWItYjc2OC00MTU0LWFhMjEtODBiOWNkMmYwMDZh&nopa=2&state=CfDJ8LWN6nmb9HBGpcIJvpEgkL3nNPi-VnwXnEmrNqxD-nvvMeUPhuo1O40j6_55Q-s3D-MAvmn3bfxLqRHi-f4Z5Yx9DEYxc_U5XjtzS5HMnfcynAdQrLBuQzc8tOiJPYo9cuxn7OfvLNI6RwcM6jJhs8FPrDMIXBT7CNoMVIHQjPJZ46CrWDoA0VTXHhXY8y-9lSdMWzCsYmqkRVutFYoKFZtvXR6rJzjoY_lBLVLXq2zlj5gwnhPwaw93YmH25fz_yaYSSFPYvhnPCpFiwfYVywDeGrAsbAEPxTS6s_a5nzGiRo3zrn2Rdd0dil0FTYQlbKSf-s3P5xmtx2pOr1yBhcc&x-client-SKU=ID_NET6_0&x-client-ver=7.6.0.0	HTTP Parser: Title: Sign in to your account does not match URL
Source: https://support.microsoft.com/en-us/office/the-keys-to-the-kingdom-securing-your-devices-and-accounts-a925f8ad-af7e-40d8-9ce4-60ea1cac2ba4	HTTP Parser: Title: Redirecting does not match URL

Source: https://support.microsoft.com/en-us/windows/protect-yourself-from-phishing-0c7ea947-ba98-3bd9-7184-430e1f860a44	HTTP Parser: No favicon
Source: https://support.microsoft.com/en-us/windows/protect-yourself-from-phishing-0c7ea947-ba98-3bd9-7184-430e1f860a44	HTTP Parser: No favicon
Source: https://support.microsoft.com/en-us/windows/protect-yourself-from-phishing-0c7ea947-ba98-3bd9-7184-430e1f860a44	HTTP Parser: No favicon
Source: https://support.microsoft.com/en-us	HTTP Parser: No favicon
Source: https://support.microsoft.com/en-us/office/the-keys-to-the-kingdom-securing-your-devices-and-accounts-a925f8ad-af7e-40d8-9ce4-60ea1cac2ba4	HTTP Parser: No favicon

Source: https://support.microsoft.com/en-us/windows/protect-yourself-from-phishing-0c7ea947-ba98-3bd9-7184-430e1f860a44	HTTP Parser: No <meta name="author".. found
Source: https://support.microsoft.com/en-us/windows/protect-yourself-from-phishing-0c7ea947-ba98-3bd9-7184-430e1f860a44	HTTP Parser: No <meta name="author".. found
Source: https://support.microsoft.com/en-us	HTTP Parser: No <meta name="author".. found
Source: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=ee272b19-4411-433f-8f28-5c13cb6fd407&redirect_uri=https%3A%2F%2Fsupport.microsoft.com%2Fsignin-oidc&response_type=code%20id_token&scope=openid%20profile%20offline_access&response_mode=form_post&nonce=638603791301466725.NWNjZmFhOTctNjg2ZS00MTcyLWIwOWYtZDVhODJhNjhhMTMxMjgyOWM2ZWItYjc2OC00MTU0LWFhMjEtODBiOWNkMmYwMDZh&nopa=2&state=CfDJ8LWN6nmb9HBGpcIJvpEgkL3nNPi-VnwXnEmrNqxD-nvvMeUPhuo1O40j6_55Q-s3D-MAvmn3bfxLqRHi-f4Z5Yx9DEYxc_U5XjtzS5HMnfcynAdQrLBuQzc8tOiJPYo9cuxn7OfvLNI6RwcM6jJhs8FPrDMIXBT7CNoMVIHQjPJZ46CrWDoA0VTXHhXY8y-9lSdMWzCsYmqkRVutFYoKFZtvXR6rJzjoY_lBLVLXq2zlj5gwnhPwaw93YmH25fz_yaYSSFPYvhnPCpFiwfYVywDeGrAsbAEPxTS6s_a5nzGiRo3zrn2Rdd0dil0FTYQlbKSf-s3P5xmtx2pOr1yBhcc&x-client-SKU=ID_NET6_0&x-client-ver=7.6.0.0	HTTP Parser: No <meta name="author".. found
Source: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=ee272b19-4411-433f-8f28-5c13cb6fd407&redirect_uri=https%3A%2F%2Fsupport.microsoft.com%2Fsignin-oidc&response_type=code%20id_token&scope=openid%20profile%20offline_access&response_mode=form_post&nonce=638603791301466725.NWNjZmFhOTctNjg2ZS00MTcyLWIwOWYtZDVhODJhNjhhMTMxMjgyOWM2ZWItYjc2OC00MTU0LWFhMjEtODBiOWNkMmYwMDZh&nopa=2&state=CfDJ8LWN6nmb9HBGpcIJvpEgkL3nNPi-VnwXnEmrNqxD-nvvMeUPhuo1O40j6_55Q-s3D-MAvmn3bfxLqRHi-f4Z5Yx9DEYxc_U5XjtzS5HMnfcynAdQrLBuQzc8tOiJPYo9cuxn7OfvLNI6RwcM6jJhs8FPrDMIXBT7CNoMVIHQjPJZ46CrWDoA0VTXHhXY8y-9lSdMWzCsYmqkRVutFYoKFZtvXR6rJzjoY_lBLVLXq2zlj5gwnhPwaw93YmH25fz_yaYSSFPYvhnPCpFiwfYVywDeGrAsbAEPxTS6s_a5nzGiRo3zrn2Rdd0dil0FTYQlbKSf-s3P5xmtx2pOr1yBhcc&x-client-SKU=ID_NET6_0&x-client-ver=7.6.0.0	HTTP Parser: No <meta name="author".. found
Source: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=ee272b19-4411-433f-8f28-5c13cb6fd407&redirect_uri=https%3A%2F%2Fsupport.microsoft.com%2Fsignin-oidc&response_type=code%20id_token&scope=openid%20profile%20offline_access&response_mode=form_post&nonce=638603791301466725.NWNjZmFhOTctNjg2ZS00MTcyLWIwOWYtZDVhODJhNjhhMTMxMjgyOWM2ZWItYjc2OC00MTU0LWFhMjEtODBiOWNkMmYwMDZh&nopa=2&state=CfDJ8LWN6nmb9HBGpcIJvpEgkL3nNPi-VnwXnEmrNqxD-nvvMeUPhuo1O40j6_55Q-s3D-MAvmn3bfxLqRHi-f4Z5Yx9DEYxc_U5XjtzS5HMnfcynAdQrLBuQzc8tOiJPYo9cuxn7OfvLNI6RwcM6jJhs8FPrDMIXBT7CNoMVIHQjPJZ46CrWDoA0VTXHhXY8y-9lSdMWzCsYmqkRVutFYoKFZtvXR6rJzjoY_lBLVLXq2zlj5gwnhPwaw93YmH25fz_yaYSSFPYvhnPCpFiwfYVywDeGrAsbAEPxTS6s_a5nzGiRo3zrn2Rdd0dil0FTYQlbKSf-s3P5xmtx2pOr1yBhcc&x-client-SKU=ID_NET6_0&x-client-ver=7.6.0.0	HTTP Parser: No <meta name="author".. found
Source: https://support.microsoft.com/en-us/office/the-keys-to-the-kingdom-securing-your-devices-and-accounts-a925f8ad-af7e-40d8-9ce4-60ea1cac2ba4	HTTP Parser: No <meta name="author".. found

Source: https://support.microsoft.com/en-us/windows/protect-yourself-from-phishing-0c7ea947-ba98-3bd9-7184-430e1f860a44	HTTP Parser: No <meta name="copyright".. found
Source: https://support.microsoft.com/en-us/windows/protect-yourself-from-phishing-0c7ea947-ba98-3bd9-7184-430e1f860a44	HTTP Parser: No <meta name="copyright".. found
Source: https://support.microsoft.com/en-us	HTTP Parser: No <meta name="copyright".. found
Source: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=ee272b19-4411-433f-8f28-5c13cb6fd407&redirect_uri=https%3A%2F%2Fsupport.microsoft.com%2Fsignin-oidc&response_type=code%20id_token&scope=openid%20profile%20offline_access&response_mode=form_post&nonce=638603791301466725.NWNjZmFhOTctNjg2ZS00MTcyLWIwOWYtZDVhODJhNjhhMTMxMjgyOWM2ZWItYjc2OC00MTU0LWFhMjEtODBiOWNkMmYwMDZh&nopa=2&state=CfDJ8LWN6nmb9HBGpcIJvpEgkL3nNPi-VnwXnEmrNqxD-nvvMeUPhuo1O40j6_55Q-s3D-MAvmn3bfxLqRHi-f4Z5Yx9DEYxc_U5XjtzS5HMnfcynAdQrLBuQzc8tOiJPYo9cuxn7OfvLNI6RwcM6jJhs8FPrDMIXBT7CNoMVIHQjPJZ46CrWDoA0VTXHhXY8y-9lSdMWzCsYmqkRVutFYoKFZtvXR6rJzjoY_lBLVLXq2zlj5gwnhPwaw93YmH25fz_yaYSSFPYvhnPCpFiwfYVywDeGrAsbAEPxTS6s_a5nzGiRo3zrn2Rdd0dil0FTYQlbKSf-s3P5xmtx2pOr1yBhcc&x-client-SKU=ID_NET6_0&x-client-ver=7.6.0.0	HTTP Parser: No <meta name="copyright".. found
Source: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=ee272b19-4411-433f-8f28-5c13cb6fd407&redirect_uri=https%3A%2F%2Fsupport.microsoft.com%2Fsignin-oidc&response_type=code%20id_token&scope=openid%20profile%20offline_access&response_mode=form_post&nonce=638603791301466725.NWNjZmFhOTctNjg2ZS00MTcyLWIwOWYtZDVhODJhNjhhMTMxMjgyOWM2ZWItYjc2OC00MTU0LWFhMjEtODBiOWNkMmYwMDZh&nopa=2&state=CfDJ8LWN6nmb9HBGpcIJvpEgkL3nNPi-VnwXnEmrNqxD-nvvMeUPhuo1O40j6_55Q-s3D-MAvmn3bfxLqRHi-f4Z5Yx9DEYxc_U5XjtzS5HMnfcynAdQrLBuQzc8tOiJPYo9cuxn7OfvLNI6RwcM6jJhs8FPrDMIXBT7CNoMVIHQjPJZ46CrWDoA0VTXHhXY8y-9lSdMWzCsYmqkRVutFYoKFZtvXR6rJzjoY_lBLVLXq2zlj5gwnhPwaw93YmH25fz_yaYSSFPYvhnPCpFiwfYVywDeGrAsbAEPxTS6s_a5nzGiRo3zrn2Rdd0dil0FTYQlbKSf-s3P5xmtx2pOr1yBhcc&x-client-SKU=ID_NET6_0&x-client-ver=7.6.0.0	HTTP Parser: No <meta name="copyright".. found
Source: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=ee272b19-4411-433f-8f28-5c13cb6fd407&redirect_uri=https%3A%2F%2Fsupport.microsoft.com%2Fsignin-oidc&response_type=code%20id_token&scope=openid%20profile%20offline_access&response_mode=form_post&nonce=638603791301466725.NWNjZmFhOTctNjg2ZS00MTcyLWIwOWYtZDVhODJhNjhhMTMxMjgyOWM2ZWItYjc2OC00MTU0LWFhMjEtODBiOWNkMmYwMDZh&nopa=2&state=CfDJ8LWN6nmb9HBGpcIJvpEgkL3nNPi-VnwXnEmrNqxD-nvvMeUPhuo1O40j6_55Q-s3D-MAvmn3bfxLqRHi-f4Z5Yx9DEYxc_U5XjtzS5HMnfcynAdQrLBuQzc8tOiJPYo9cuxn7OfvLNI6RwcM6jJhs8FPrDMIXBT7CNoMVIHQjPJZ46CrWDoA0VTXHhXY8y-9lSdMWzCsYmqkRVutFYoKFZtvXR6rJzjoY_lBLVLXq2zlj5gwnhPwaw93YmH25fz_yaYSSFPYvhnPCpFiwfYVywDeGrAsbAEPxTS6s_a5nzGiRo3zrn2Rdd0dil0FTYQlbKSf-s3P5xmtx2pOr1yBhcc&x-client-SKU=ID_NET6_0&x-client-ver=7.6.0.0	HTTP Parser: No <meta name="copyright".. found
Source: https://support.microsoft.com/en-us/office/the-keys-to-the-kingdom-securing-your-devices-and-accounts-a925f8ad-af7e-40d8-9ce4-60ea1cac2ba4	HTTP Parser: No <meta name="copyright".. found

Compliance

Source: unknown	HTTPS traffic detected: 20.42.73.29:443 -> 192.168.2.4:49743 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.4:49753 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.4:49771 version: TLS 1.2

Networking

Source: global traffic	TCP traffic: 192.168.2.4:49856 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.4:49943 -> 1.1.1.1:53

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.151.9
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.151.9
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.151.9
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.151.9
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.151.9
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.151.9
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.151.9
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.151.9
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.151.9
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.151.9
Source: unknown	TCP traffic detected without corresponding DNS query: 20.42.73.29
Source: unknown	TCP traffic detected without corresponding DNS query: 20.42.73.29
Source: unknown	TCP traffic detected without corresponding DNS query: 20.42.73.29
Source: unknown	TCP traffic detected without corresponding DNS query: 20.42.73.29
Source: unknown	TCP traffic detected without corresponding DNS query: 20.42.73.29
Source: unknown	TCP traffic detected without corresponding DNS query: 20.42.73.29
Source: unknown	TCP traffic detected without corresponding DNS query: 20.42.73.29
Source: unknown	TCP traffic detected without corresponding DNS query: 20.42.73.29
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 217.20.57.19
Source: unknown	TCP traffic detected without corresponding DNS query: 217.20.57.19
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /LearnAboutSenderIdentification HTTP/1.1Host: aka.msConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: */*Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /meversion?partner=SMCConvergence&market=en-us&uhf=1 HTTP/1.1Host: mem.gfx.msConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://support.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /meversion?partner=SMCConvergence&market=en-us&uhf=1 HTTP/1.1Host: mem.gfx.msConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /scripts/c/ms.shared.analytics.mectrl-3.gbl.min.js HTTP/1.1Host: js.monitor.azure.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://support.microsoft.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://support.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /scripts/c/ms.shared.analytics.mectrl-3.gbl.min.js HTTP/1.1Host: js.monitor.azure.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /scripts/me/MeControl/10.24086.4/en-US/meBoot.min.js HTTP/1.1Host: mem.gfx.msConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://support.microsoft.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://support.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/BssoInterrupt_Core_JQnUxWSvwsd9FrpspQmznw2.js HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://login.microsoftonline.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/BssoInterrupt_Core_JQnUxWSvwsd9FrpspQmznw2.js HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/FetchSessions_Core_H0Uqy7LYr6Y7NSjywO4LTQ2.js HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://login.microsoftonline.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/FetchSessions_Core_H0Uqy7LYr6Y7NSjywO4LTQ2.js HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /scripts/me/MeControl/10.24086.4/en-US/meBoot.min.js HTTP/1.1Host: mem.gfx.msConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://support.microsoft.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://support.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Range: bytes=179616-179616If-Range: "1daef8f5cfb6a17"
Source: global traffic	HTTP traffic detected: GET /scripts/me/MeControl/10.24086.4/en-US/meBoot.min.js HTTP/1.1Host: mem.gfx.msConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://support.microsoft.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://support.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Range: bytes=179616-204054If-Range: "1daef8f5cfb6a17"
Source: global traffic	HTTP traffic detected: GET /scripts/me/MeControl/10.24086.4/en-US/meBoot.min.js HTTP/1.1Host: mem.gfx.msConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /scripts/me/MeControl/10.24086.4/en-US/meCore.min.js HTTP/1.1Host: mem.gfx.msConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://support.microsoft.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://support.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /scripts/me/MeControl/10.24086.4/en-US/meCore.min.js HTTP/1.1Host: mem.gfx.msConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /16.000/content/js/MeControl_byKfhfjpuoP7eXmeHHGYoA2.js HTTP/1.1Host: logincdn.msftauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://login.live.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://login.live.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /16.000/content/js/MeControl_byKfhfjpuoP7eXmeHHGYoA2.js HTTP/1.1Host: logincdn.msftauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ests/2.1/content/cdnbundles/converged.v2.login.min_qzvqnltrxpy99ajspyxbgq2.css HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://login.microsoftonline.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,*/*;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: styleReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/ConvergedLogin_PCore_Cr8LUIyurKoYeKwC2s2vJw2.js HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://login.microsoftonline.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ests/2.1/content/cdnbundles/ux.converged.login.strings-en.min_tzwwq6wdslxjdiwzdatg6a2.js HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://login.microsoftonline.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/asyncchunk/convergedlogin_pcustomizationloader_6c7dc46bb93924417b57.js HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ests/2.1/content/cdnbundles/ux.converged.login.strings-en.min_tzwwq6wdslxjdiwzdatg6a2.js HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/ConvergedLogin_PCore_Cr8LUIyurKoYeKwC2s2vJw2.js HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/asyncchunk/convergedlogin_pfetchsessionsprogress_758d4d3367a37038a3b2.js HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/asyncchunk/convergedlogin_pcustomizationloader_6c7dc46bb93924417b57.js HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/marching_ants_white_8257b0707cbe1d0bd2661b80068676fe.gif HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/marching_ants_986f40b5a9dc7d39ef8396797f61b323.gif HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/backgrounds/2_11d9e3bcdfede9ce5ce5ace2d129f1c4.svg HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/microsoft_logo_564db913a7fa0ca42727161c6d031bef.svg HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/asyncchunk/convergedlogin_pfetchsessionsprogress_758d4d3367a37038a3b2.js HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/marching_ants_986f40b5a9dc7d39ef8396797f61b323.gif HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/marching_ants_white_8257b0707cbe1d0bd2661b80068676fe.gif HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/backgrounds/2_11d9e3bcdfede9ce5ce5ace2d129f1c4.svg HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/microsoft_logo_564db913a7fa0ca42727161c6d031bef.svg HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: chromecache_243.2.dr, chromecache_365.2.dr	String found in binary or memory: "//www.linkedin.com/shareArticle?mini=true&url=" + equals www.linkedin.com (Linkedin)
Source: chromecache_243.2.dr, chromecache_365.2.dr	String found in binary or memory: url: "//www.facebook.com/share.php?u=" + h, equals www.facebook.com (Facebook)

Source: global traffic	DNS traffic detected: DNS query: aka.ms
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: support.content.office.net
Source: global traffic	DNS traffic detected: DNS query: c.s-microsoft.com
Source: global traffic	DNS traffic detected: DNS query: js.monitor.azure.com
Source: global traffic	DNS traffic detected: DNS query: aadcdn.msftauth.net
Source: global traffic	DNS traffic detected: DNS query: mem.gfx.ms
Source: global traffic	DNS traffic detected: DNS query: login.microsoftonline.com
Source: global traffic	DNS traffic detected: DNS query: assets.onestore.ms
Source: global traffic	DNS traffic detected: DNS query: microsoftwindows.112.2o7.net
Source: global traffic	DNS traffic detected: DNS query: lptag.liveperson.net
Source: global traffic	DNS traffic detected: DNS query: lpcdn.lpsnmedia.net
Source: global traffic	DNS traffic detected: DNS query: accdn.lpsnmedia.net
Source: global traffic	DNS traffic detected: DNS query: publisher.liveperson.net
Source: global traffic	DNS traffic detected: DNS query: www.clarity.ms
Source: global traffic	DNS traffic detected: DNS query: d.impactradius-event.com
Source: global traffic	DNS traffic detected: DNS query: cdnssl.clicktale.net
Source: global traffic	DNS traffic detected: DNS query: analytics.tiktok.com
Source: global traffic	DNS traffic detected: DNS query: ajax.aspnetcdn.com
Source: global traffic	DNS traffic detected: DNS query: logincdn.msftauth.net
Source: global traffic	DNS traffic detected: DNS query: acctcdn.msftauth.net
Source: global traffic	DNS traffic detected: DNS query: amp.azure.net

Source: unknown

HTTP traffic detected: POST /Telemetry.Request HTTP/1.1Connection: Keep-AliveUser-Agent: MSDWMSA_DeviceTicket_Error: 0x80004004Content-Length: 5110Host: umwatson.events.data.microsoft.com

Source: chromecache_337.2.dr, chromecache_412.2.dr, chromecache_462.2.dr, chromecache_229.2.dr	String found in binary or memory: http://feross.org
Source: chromecache_297.2.dr, chromecache_256.2.dr	String found in binary or memory: http://github.com/aFarkas/lazysizes
Source: chromecache_410.2.dr, chromecache_399.2.dr, chromecache_292.2.dr, chromecache_472.2.dr	String found in binary or memory: http://github.com/requirejs/almond/LICENSE
Source: chromecache_382.2.dr, chromecache_374.2.dr	String found in binary or memory: http://github.com/requirejs/domReady
Source: chromecache_382.2.dr, chromecache_374.2.dr	String found in binary or memory: http://github.com/requirejs/requirejs/LICENSE
Source: chromecache_444.2.dr, chromecache_200.2.dr, chromecache_281.2.dr, chromecache_323.2.dr, chromecache_469.2.dr, chromecache_251.2.dr	String found in binary or memory: http://knockoutjs.com/
Source: chromecache_447.2.dr, chromecache_294.2.dr, chromecache_314.2.dr, chromecache_245.2.dr	String found in binary or memory: http://schema.org/Organization
Source: chromecache_207.2.dr, chromecache_267.2.dr	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: chromecache_337.2.dr, chromecache_229.2.dr	String found in binary or memory: http://www.opensource.org/licenses/mit-license.php
Source: chromecache_444.2.dr, chromecache_200.2.dr, chromecache_281.2.dr, chromecache_323.2.dr, chromecache_469.2.dr, chromecache_251.2.dr	String found in binary or memory: http://www.opensource.org/licenses/mit-license.php)
Source: chromecache_294.2.dr	String found in binary or memory: https://accdn.lpsnmedia.net
Source: chromecache_447.2.dr, chromecache_314.2.dr, chromecache_245.2.dr	String found in binary or memory: https://ajax.aspnetcdn.com/ajax/jQuery/jquery-1.9.1.min.js
Source: chromecache_294.2.dr	String found in binary or memory: https://aka.ms/edusupport
Source: chromecache_294.2.dr	String found in binary or memory: https://aka.ms/yourcaliforniaprivacychoices
Source: chromecache_294.2.dr	String found in binary or memory: https://analytics.tiktok.com
Source: chromecache_358.2.dr, chromecache_375.2.dr, chromecache_296.2.dr, chromecache_340.2.dr, chromecache_411.2.dr, chromecache_327.2.dr	String found in binary or memory: https://assets.onestore.ms
Source: chromecache_447.2.dr, chromecache_314.2.dr, chromecache_245.2.dr	String found in binary or memory: https://assets.onestore.ms/cdnfiles/external/mwf/long/v1/v1.25.0/css/mwf-west-european-default.min.c
Source: chromecache_447.2.dr, chromecache_245.2.dr	String found in binary or memory: https://az725175.vo.msecnd.net/scripts/jsll-4.js
Source: chromecache_294.2.dr	String found in binary or memory: https://cdnssl.clicktale.net
Source: chromecache_294.2.dr	String found in binary or memory: https://d.impactradius-event.com
Source: chromecache_402.2.dr, chromecache_215.2.dr	String found in binary or memory: https://github.com/carhartl/jquery-cookie
Source: chromecache_444.2.dr, chromecache_200.2.dr, chromecache_281.2.dr, chromecache_412.2.dr, chromecache_323.2.dr, chromecache_469.2.dr, chromecache_251.2.dr, chromecache_305.2.dr, chromecache_462.2.dr, chromecache_482.2.dr	String found in binary or memory: https://github.com/douglascrockford/JSON-js
Source: chromecache_294.2.dr, chromecache_340.2.dr, chromecache_411.2.dr, chromecache_327.2.dr	String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net
Source: chromecache_447.2.dr, chromecache_294.2.dr, chromecache_314.2.dr, chromecache_245.2.dr	String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE1Mu3b?ver=5c31
Source: chromecache_321.2.dr	String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RW1dIj6?ver=98df
Source: chromecache_356.2.dr	String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RW1dQ5q?ver=8edc
Source: chromecache_466.2.dr, chromecache_427.2.dr	String found in binary or memory: https://jquery.com/
Source: chromecache_466.2.dr, chromecache_427.2.dr	String found in binary or memory: https://jquery.org/license
Source: chromecache_466.2.dr, chromecache_427.2.dr	String found in binary or memory: https://js.foundation/
Source: chromecache_294.2.dr	String found in binary or memory: https://js.monitor.azure.com
Source: chromecache_315.2.dr, chromecache_479.2.dr	String found in binary or memory: https://login.live.com/Me.srf?wa
Source: chromecache_294.2.dr	String found in binary or memory: https://login.live.com/me.srf?wa=wsignin1.0
Source: chromecache_248.2.dr, chromecache_216.2.dr, chromecache_209.2.dr	String found in binary or memory: https://login.microsoftonline.com
Source: chromecache_315.2.dr, chromecache_479.2.dr	String found in binary or memory: https://login.microsoftonline.com/forgetuser
Source: chromecache_315.2.dr, chromecache_479.2.dr	String found in binary or memory: https://login.microsoftonline.com/savedusers?appid
Source: chromecache_479.2.dr	String found in binary or memory: https://login.microsoftonline.com/uxlogout?appid
Source: chromecache_248.2.dr, chromecache_216.2.dr, chromecache_209.2.dr	String found in binary or memory: https://login.windows-ppe.net
Source: chromecache_294.2.dr	String found in binary or memory: https://lpcdn.lpsnmedia.net
Source: chromecache_294.2.dr	String found in binary or memory: https://lptag.liveperson.net
Source: chromecache_294.2.dr, chromecache_340.2.dr, chromecache_411.2.dr, chromecache_327.2.dr	String found in binary or memory: https://mem.gfx.ms
Source: chromecache_358.2.dr, chromecache_375.2.dr, chromecache_296.2.dr, chromecache_340.2.dr, chromecache_411.2.dr, chromecache_327.2.dr	String found in binary or memory: https://microsoftwindows.112.2o7.net
Source: chromecache_294.2.dr	String found in binary or memory: https://office.com/systemrequirements
Source: chromecache_447.2.dr, chromecache_314.2.dr, chromecache_245.2.dr	String found in binary or memory: https://onedrive.live.com/about/en-us/
Source: chromecache_447.2.dr, chromecache_314.2.dr, chromecache_245.2.dr	String found in binary or memory: https://outlook.live.com/owa/
Source: chromecache_300.2.dr, chromecache_356.2.dr	String found in binary or memory: https://prod-video-cms-rt-microsoft-com.akamaized.net/cms/api/am/videofiledata/RW1dNAH-enus?ver=6d43
Source: chromecache_300.2.dr, chromecache_356.2.dr	String found in binary or memory: https://prod-video-cms-rt-microsoft-com.akamaized.net/cms/api/am/videofiledata/RW1dNAH-tscriptenus?v
Source: chromecache_347.2.dr, chromecache_321.2.dr	String found in binary or memory: https://prod-video-cms-rt-microsoft-com.akamaized.net/cms/api/am/videofiledata/RW1dQ5E-enus?ver=77bf
Source: chromecache_347.2.dr, chromecache_321.2.dr	String found in binary or memory: https://prod-video-cms-rt-microsoft-com.akamaized.net/cms/api/am/videofiledata/RW1dQ5E-tscriptenus?v
Source: chromecache_294.2.dr	String found in binary or memory: https://products.office.com/en-us/free-productivity-apps
Source: chromecache_447.2.dr, chromecache_314.2.dr, chromecache_245.2.dr	String found in binary or memory: https://products.office.com/en-us/home
Source: chromecache_447.2.dr, chromecache_314.2.dr, chromecache_245.2.dr	String found in binary or memory: https://products.office.com/en-us/microsoft-teams/free?icid=SSM_AS_Promo_Apps_MicrosoftTeams
Source: chromecache_294.2.dr	String found in binary or memory: https://products.office.com/microsoft-office-for-home-and-school-faq#cd6f27d6-3bb0-22a8-9228-1385af8
Source: chromecache_294.2.dr	String found in binary or memory: https://publisher.liveperson.net
Source: chromecache_294.2.dr	String found in binary or memory: https://publisher.liveperson.net/iframe-le-tag/iframe-cs.html?lpsite=60270350&lpsection=store-m3
Source: chromecache_294.2.dr	String found in binary or memory: https://schema.org
Source: chromecache_466.2.dr, chromecache_427.2.dr	String found in binary or memory: https://sizzlejs.com/
Source: chromecache_447.2.dr, chromecache_314.2.dr, chromecache_245.2.dr	String found in binary or memory: https://statics-marketingsites-wcus-ms-com.akamaized.net/statics/override.css?c=7
Source: chromecache_294.2.dr	String found in binary or memory: https://support.office.com/en-us/article/accounts-in-office-628ea040-f265-49de-b986-be09c3ebf8a9
Source: chromecache_294.2.dr	String found in binary or memory: https://support.office.com/en-us/article/what-s-new-in-office-365-95c8d81d-08ba-42c1-914f-bca4603e14
Source: chromecache_294.2.dr	String found in binary or memory: https://templates.office.com
Source: chromecache_318.2.dr, chromecache_308.2.dr	String found in binary or memory: https://ussearchprod.trafficmanager.net/services/api/v1.0/store/categories
Source: chromecache_356.2.dr	String found in binary or memory: https://wus-streaming-video-rt-microsoft-com.akamaized.net/1ebdc0bd-611c-4adf-aa3b-46e3ab48d080/2103
Source: chromecache_321.2.dr	String found in binary or memory: https://wus-streaming-video-rt-microsoft-com.akamaized.net/3ccef210-b6ef-4e48-950d-5c21a0c9cb8c/50ff
Source: chromecache_300.2.dr, chromecache_356.2.dr	String found in binary or memory: https://wus-streaming-video-rt-microsoft-com.akamaized.net/9e3ad847-da3d-4ac4-9723-9044fe5f42c4/2103
Source: chromecache_347.2.dr, chromecache_321.2.dr	String found in binary or memory: https://wus-streaming-video-rt-microsoft-com.akamaized.net/eebb33d0-226f-4448-8435-eea66f35c952/50ff
Source: chromecache_294.2.dr	String found in binary or memory: https://www.clarity.ms
Source: chromecache_294.2.dr	String found in binary or memory: https://www.office.com/?auth=1
Source: chromecache_294.2.dr	String found in binary or memory: https://www.office.com/?auth=2
Source: chromecache_447.2.dr, chromecache_314.2.dr, chromecache_245.2.dr	String found in binary or memory: https://www.onenote.com/
Source: chromecache_447.2.dr, chromecache_294.2.dr, chromecache_314.2.dr, chromecache_245.2.dr	String found in binary or memory: https://www.skype.com/en/
Source: chromecache_245.2.dr	String found in binary or memory: https://www.xbox.com/
Source: chromecache_294.2.dr	String found in binary or memory: https://www.xbox.com/en-us/games/store/pc-game-pass/cfq7ttc0kgq8?icid=CNavAllPCGamePass
Source: chromecache_294.2.dr	String found in binary or memory: https://www.xbox.com/en-us/games/store/xbox-game-pass-ultimate/cfq7ttc0khs0?icid=CNavAllXboxGamePass

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 50145 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50151 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50177
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50176
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50179
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50178
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50061
Source: unknown	Network traffic detected: HTTP traffic on port 50071 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50154 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49990 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50177 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50227
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 50148 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50165 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50071
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 50088 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50227 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 49844 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49989 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50078
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50199
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50079
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50084
Source: unknown	Network traffic detected: HTTP traffic on port 50156 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 50167 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49672
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50087
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50089
Source: unknown	Network traffic detected: HTTP traffic on port 50150 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50088
Source: unknown	Network traffic detected: HTTP traffic on port 50079 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50048 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50178 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49865 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50170 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50061 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 50149 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50164 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50097
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50078 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50158 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 49902 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49899
Source: unknown	Network traffic detected: HTTP traffic on port 50087 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50029
Source: unknown	Network traffic detected: HTTP traffic on port 50169 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown	Network traffic detected: HTTP traffic on port 50144 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50149
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49893
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 50152 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50144
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50146
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50145
Source: unknown	Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50148
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50151
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50150
Source: unknown	Network traffic detected: HTTP traffic on port 50155 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49991 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50176 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50029 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 50084 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 50166 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50152
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50155
Source: unknown	Network traffic detected: HTTP traffic on port 50200 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50154
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50157
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50156
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50158
Source: unknown	Network traffic detected: HTTP traffic on port 50179 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50163 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50089 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49991
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49990
Source: unknown	Network traffic detected: HTTP traffic on port 50146 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50164
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50163
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50166
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50165
Source: unknown	Network traffic detected: HTTP traffic on port 49899 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50167
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50200
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50048
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50097 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50169
Source: unknown	Network traffic detected: HTTP traffic on port 50157 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50170
Source: unknown	Network traffic detected: HTTP traffic on port 50199 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49902
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49989
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49900

Source: unknown	HTTPS traffic detected: 20.42.73.29:443 -> 192.168.2.4:49743 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.4:49753 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.4:49771 version: TLS 1.2

System Summary

Source: classification engine

Classification label: mal48.phis.win@33/460@78/13

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2084 --field-trial-handle=1884,i,2462032054279707676,5775141490256060384,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://aka.ms/LearnAboutSenderIdentification"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2084 --field-trial-handle=1884,i,2462032054279707676,5775141490256060384,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected