Edit tour

Windows Analysis Report
https://husgu4aab.cc.rs6.net/tn.jsp?f=001Kgt4Y2UB61RJ-8HwGvpJdBIbmN2KmnsaQqGoOmBznZv-sZNQDwRSSQ7g-eK51O4by9IOD2KnWORRgU0x0E3aNqtENPlCG9IRkHoovRH87tIhjQapV8qvGaEivg08QWSvEYUiMWZbUAA5F-TBphmYo54Yji4b0P6N0DJh_NbVO20TarWgnPQ3SuLKbE7xetLRM8vyBQFA3FDAk2Yb7PHHNhkTNOnLAjlPaIIitR9YG-b5PWKzzl53xiiNEfQzHPo5f_H

Overview

General Information

Sample URL:	https://husgu4aab.cc.rs6.net/tn.jsp?f=001Kgt4Y2UB61RJ-8HwGvpJdBIbmN2KmnsaQqGoOmBznZv-sZNQDwRSSQ7g-eK51O4by9IOD2KnWORRgU0x0E3aNqtENPlCG9IRkHoovRH87tIhjQapV8qvGaEivg08QWSvEYUiMWZbUAA5F-TBphmYo54Yji4b0P6
Analysis ID:	1524421
Infos:

Detection

Score:	1
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Detected non-DNS traffic on DNS port

Detected suspicious crossdomain redirect

HTML page contains hidden javascript code

Classification

Process Tree

System is w10x64

chrome.exe (PID: 3468 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 6672 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 --field-trial-handle=1972,i,5130704395067591626,10697424571899277825,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 1464 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://husgu4aab.cc.rs6.net/tn.jsp?f=001Kgt4Y2UB61RJ-8HwGvpJdBIbmN2KmnsaQqGoOmBznZv-sZNQDwRSSQ7g-eK51O4by9IOD2KnWORRgU0x0E3aNqtENPlCG9IRkHoovRH87tIhjQapV8qvGaEivg08QWSvEYUiMWZbUAA5F-TBphmYo54Yji4b0P6N0DJh_NbVO20TarWgnPQ3SuLKbE7xetLRM8vyBQFA3FDAk2Yb7PHHNhkTNOnLAjlPaIIitR9YG-b5PWKzzl53xiiNEfQzHPo5f_HVv0eLJVI13jaoVLCWlUD41vb-4jiIEzxYy7L3VVF3KxBtVO6BE2E1jRiUdWGiYagIkSTi87BHv9cWMOqrRRElHJKtM_LH7LWPcyQYm-e7t7Np0yuIiSG2a7kcUa83fxnFKBlD3XQWk3tBK_A6UHfOpVtGfh58aA3wMAw29cIbI5nWpV6ItQSoKR9GlwPgZ9_RwLBJtBRlGly3vddfujNsc6LR0pWXaYSrJULantDqQJ_4b9XaCQ==&c=IyjvwkVNXkSM3EQNeu1AFyYVkMBKrNrka4UrFHY9Xgi8_nQQx7j-YA==&ch=Kpqbu5OxQl-CnKQeZK4xThguts9KPf_lvJrsntwD6ZjuGxnpSh2o9w==" MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: https://teams.microsoft.com/dl/launcher/launcher.html?url=%2F_%23%2Fl%2Fmeetup-join%2F19%3Ameeting_MmE0NjAzMTAtYzgyMS00MDliLWE1YTUtZjJhZmM1ZGY4YzZh%40thread.v2%2F0%3Fcontext%3D%257B%2522Tid%2522%253A%25221a40aa3f-1477-4f8f-980e-9c88fa937847%2522%252C%2522Oid%2522%253A%2522b08fca2d-a34f-492c-bc56-309cea6ba5ef%2522%257D%26anon%3Dtrue&type=meetup-join&deeplinkId=f35de3fe-1833-4040-a2d1-3b28cea1b10c&directDl=true&msLaunch=true&enableMobilePage=true&suppressPrompt=true

HTTP Parser: Base64 decoded: 2a460310-c821-409b-a5a5-f2afc5df8c6a

Source: https://teams.microsoft.com/dl/launcher/attribution.txt

HTTP Parser: No favicon

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.7:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.7:49715 version: TLS 1.2

Source: global traffic

TCP traffic: 192.168.2.7:54835 -> 1.1.1.1:53

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

HTTP traffic: Redirect from: husgu4aab.cc.rs6.net to https://teams.microsoft.com/l/meetup-join/19%3ameeting_mme0njazmtatyzgyms00mdlilwe1ytutzjjhzmm1zgy4yzzh%40thread.v2/0?context=%7b%22tid%22%3a%221a40aa3f-1477-4f8f-980e-9c88fa937847%22%2c%22oid%22%3a%22b08fca2d-a34f-492c-bc56-309cea6ba5ef%22%7d

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /tn.jsp?f=001Kgt4Y2UB61RJ-8HwGvpJdBIbmN2KmnsaQqGoOmBznZv-sZNQDwRSSQ7g-eK51O4by9IOD2KnWORRgU0x0E3aNqtENPlCG9IRkHoovRH87tIhjQapV8qvGaEivg08QWSvEYUiMWZbUAA5F-TBphmYo54Yji4b0P6N0DJh_NbVO20TarWgnPQ3SuLKbE7xetLRM8vyBQFA3FDAk2Yb7PHHNhkTNOnLAjlPaIIitR9YG-b5PWKzzl53xiiNEfQzHPo5f_HVv0eLJVI13jaoVLCWlUD41vb-4jiIEzxYy7L3VVF3KxBtVO6BE2E1jRiUdWGiYagIkSTi87BHv9cWMOqrRRElHJKtM_LH7LWPcyQYm-e7t7Np0yuIiSG2a7kcUa83fxnFKBlD3XQWk3tBK_A6UHfOpVtGfh58aA3wMAw29cIbI5nWpV6ItQSoKR9GlwPgZ9_RwLBJtBRlGly3vddfujNsc6LR0pWXaYSrJULantDqQJ_4b9XaCQ==&c=IyjvwkVNXkSM3EQNeu1AFyYVkMBKrNrka4UrFHY9Xgi8_nQQx7j-YA==&ch=Kpqbu5OxQl-CnKQeZK4xThguts9KPf_lvJrsntwD6ZjuGxnpSh2o9w== HTTP/1.1Host: husgu4aab.cc.rs6.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /l/meetup-join/19%3Ameeting_MmE0NjAzMTAtYzgyMS00MDliLWE1YTUtZjJhZmM1ZGY4YzZh%40thread.v2/0?context=%7B%22Tid%22%3A%221a40aa3f-1477-4f8f-980e-9c88fa937847%22%2C%22Oid%22%3A%22b08fca2d-a34f-492c-bc56-309cea6ba5ef%22%7D HTTP/1.1Host: teams.microsoft.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /dl/launcher/launcher.html?url=%2F_%23%2Fl%2Fmeetup-join%2F19%3Ameeting_MmE0NjAzMTAtYzgyMS00MDliLWE1YTUtZjJhZmM1ZGY4YzZh%40thread.v2%2F0%3Fcontext%3D%257B%2522Tid%2522%253A%25221a40aa3f-1477-4f8f-980e-9c88fa937847%2522%252C%2522Oid%2522%253A%2522b08fca2d-a34f-492c-bc56-309cea6ba5ef%2522%257D%26anon%3Dtrue&type=meetup-join&deeplinkId=f35de3fe-1833-4040-a2d1-3b28cea1b10c&directDl=true&msLaunch=true&enableMobilePage=true HTTP/1.1Host: teams.microsoft.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: MUIDB=0B6624FFE9C26969214A31F3E86A685B
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /api/mt/beta/tenant/anonPrivacyProfile?joinUrl=https%3A%2F%2Fteams.microsoft.com%2Fl%2Fmeetup-join%2F19%3Ameeting_MmE0NjAzMTAtYzgyMS00MDliLWE1YTUtZjJhZmM1ZGY4YzZh%40thread.v2%2F0%3Fcontext%3D%257B%2522Tid%2522%253A%25221a40aa3f-1477-4f8f-980e-9c88fa937847%2522%252C%2522Oid%2522%253A%2522b08fca2d-a34f-492c-bc56-309cea6ba5ef%2522%257D&tenantId=1a40aa3f-1477-4f8f-980e-9c88fa937847&organizerId=b08fca2d-a34f-492c-bc56-309cea6ba5ef HTTP/1.1Host: teams.microsoft.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://teams.microsoft.com/dl/launcher/launcher.html?url=%2F_%23%2Fl%2Fmeetup-join%2F19%3Ameeting_MmE0NjAzMTAtYzgyMS00MDliLWE1YTUtZjJhZmM1ZGY4YzZh%40thread.v2%2F0%3Fcontext%3D%257B%2522Tid%2522%253A%25221a40aa3f-1477-4f8f-980e-9c88fa937847%2522%252C%2522Oid%2522%253A%2522b08fca2d-a34f-492c-bc56-309cea6ba5ef%2522%257D%26anon%3Dtrue&type=meetup-join&deeplinkId=f35de3fe-1833-4040-a2d1-3b28cea1b10c&directDl=true&msLaunch=true&enableMobilePage=trueAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /api/mt/beta/meetings/branding?tenantId=1a40aa3f-1477-4f8f-980e-9c88fa937847&userId=b08fca2d-a34f-492c-bc56-309cea6ba5ef HTTP/1.1Host: teams.microsoft.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://teams.microsoft.com/dl/launcher/launcher.html?url=%2F_%23%2Fl%2Fmeetup-join%2F19%3Ameeting_MmE0NjAzMTAtYzgyMS00MDliLWE1YTUtZjJhZmM1ZGY4YzZh%40thread.v2%2F0%3Fcontext%3D%257B%2522Tid%2522%253A%25221a40aa3f-1477-4f8f-980e-9c88fa937847%2522%252C%2522Oid%2522%253A%2522b08fca2d-a34f-492c-bc56-309cea6ba5ef%2522%257D%26anon%3Dtrue&type=meetup-join&deeplinkId=f35de3fe-1833-4040-a2d1-3b28cea1b10c&directDl=true&msLaunch=true&enableMobilePage=trueAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /api/mt/beta/meetings/branding?tenantId=1a40aa3f-1477-4f8f-980e-9c88fa937847&userId=b08fca2d-a34f-492c-bc56-309cea6ba5ef HTTP/1.1Host: teams.microsoft.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: MUIDB=0B6624FFE9C26969214A31F3E86A685B; MicrosoftApplicationsTelemetryDeviceId=90230161-febc-42ae-9abf-2adbfc0de18b
Source: global traffic	HTTP traffic detected: GET /api/mt/beta/tenant/anonPrivacyProfile?joinUrl=https%3A%2F%2Fteams.microsoft.com%2Fl%2Fmeetup-join%2F19%3Ameeting_MmE0NjAzMTAtYzgyMS00MDliLWE1YTUtZjJhZmM1ZGY4YzZh%40thread.v2%2F0%3Fcontext%3D%257B%2522Tid%2522%253A%25221a40aa3f-1477-4f8f-980e-9c88fa937847%2522%252C%2522Oid%2522%253A%2522b08fca2d-a34f-492c-bc56-309cea6ba5ef%2522%257D&tenantId=1a40aa3f-1477-4f8f-980e-9c88fa937847&organizerId=b08fca2d-a34f-492c-bc56-309cea6ba5ef HTTP/1.1Host: teams.microsoft.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: MUIDB=0B6624FFE9C26969214A31F3E86A685B; MicrosoftApplicationsTelemetryDeviceId=90230161-febc-42ae-9abf-2adbfc0de18b
Source: global traffic	HTTP traffic detected: GET /dl/launcher/attribution.txt HTTP/1.1Host: teams.microsoft.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: MicrosoftApplicationsTelemetryDeviceId=90230161-febc-42ae-9abf-2adbfc0de18b; MicrosoftApplicationsTelemetryFirstLaunchTime=2024-10-02T16:52:57.777Z; MUIDB=0B6624FFE9C26969214A31F3E86A685B; clocale=en-us; MicrosoftApplicationsTelemetryDeviceId=90230161-febc-42ae-9abf-2adbfc0de18b; ai_session=HLl6rm+lJCYS4klaLOJS/g\|1727887979710\|1727887979710
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: teams.microsoft.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://teams.microsoft.com/dl/launcher/attribution.txtAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: MUIDB=0B6624FFE9C26969214A31F3E86A685B; clocale=en-us; MicrosoftApplicationsTelemetryDeviceId=90230161-febc-42ae-9abf-2adbfc0de18b; ai_session=HLl6rm+lJCYS4klaLOJS/g\|1727887979710\|1727887979710

Source: global traffic	DNS traffic detected: DNS query: husgu4aab.cc.rs6.net
Source: global traffic	DNS traffic detected: DNS query: www.google.com

Source: chromecache_61.2.dr	String found in binary or memory: http://creativecommons.org/publicdomain/zero/1.0/
Source: chromecache_61.2.dr	String found in binary or memory: http://underscorejs.org/
Source: chromecache_61.2.dr	String found in binary or memory: https://github.com/lodash/lodash
Source: chromecache_61.2.dr	String found in binary or memory: https://js.foundation/
Source: chromecache_65.2.dr	String found in binary or memory: https://statics.teams.cdn.office.net
Source: chromecache_65.2.dr	String found in binary or memory: https://statics.teams.cdn.office.net/hashedcss-launcher/launcher.d6cd10b8b26b2130799c.css
Source: chromecache_65.2.dr	String found in binary or memory: https://statics.teams.cdn.office.net/hashedjs-launcher/launcher.bd11421f64e348db1253.js
Source: chromecache_65.2.dr	String found in binary or memory: https://statics.teams.cdn.office.net/hashedjs-launcher/polyfills.1f5a03d113c6ac7b91f5.js

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54838
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49699 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49699
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49677 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49671 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.7:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.7:49715 version: TLS 1.2

Source: classification engine

Classification label: clean1.win@20/28@4/7

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 --field-trial-handle=1972,i,5130704395067591626,10697424571899277825,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://husgu4aab.cc.rs6.net/tn.jsp?f=001Kgt4Y2UB61RJ-8HwGvpJdBIbmN2KmnsaQqGoOmBznZv-sZNQDwRSSQ7g-eK51O4by9IOD2KnWORRgU0x0E3aNqtENPlCG9IRkHoovRH87tIhjQapV8qvGaEivg08QWSvEYUiMWZbUAA5F-TBphmYo54Yji4b0P6N0DJh_NbVO20TarWgnPQ3SuLKbE7xetLRM8vyBQFA3FDAk2Yb7PHHNhkTNOnLAjlPaIIitR9YG-b5PWKzzl53xiiNEfQzHPo5f_HVv0eLJVI13jaoVLCWlUD41vb-4jiIEzxYy7L3VVF3KxBtVO6BE2E1jRiUdWGiYagIkSTi87BHv9cWMOqrRRElHJKtM_LH7LWPcyQYm-e7t7Np0yuIiSG2a7kcUa83fxnFKBlD3XQWk3tBK_A6UHfOpVtGfh58aA3wMAw29cIbI5nWpV6ItQSoKR9GlwPgZ9_RwLBJtBRlGly3vddfujNsc6LR0pWXaYSrJULantDqQJ_4b9XaCQ==&c=IyjvwkVNXkSM3EQNeu1AFyYVkMBKrNrka4UrFHY9Xgi8_nQQx7j-YA==&ch=Kpqbu5OxQl-CnKQeZK4xThguts9KPf_lvJrsntwD6ZjuGxnpSh2o9w=="
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 --field-trial-handle=1972,i,5130704395067591626,10697424571899277825,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	1 Process Injection	1 Process Injection	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	2 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
https://js.foundation/	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
www.google.com	142.250.184.196	true	false	unknown
husgu4aab.cc.rs6.net	208.75.122.11	true	false	unknown
s-0005.dual-s-msedge.net	52.123.128.14	true	false	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://husgu4aab.cc.rs6.net/tn.jsp?f=001Kgt4Y2UB61RJ-8HwGvpJdBIbmN2KmnsaQqGoOmBznZv-sZNQDwRSSQ7g-eK51O4by9IOD2KnWORRgU0x0E3aNqtENPlCG9IRkHoovRH87tIhjQapV8qvGaEivg08QWSvEYUiMWZbUAA5F-TBphmYo54Yji4b0P6N0DJh_NbVO20TarWgnPQ3SuLKbE7xetLRM8vyBQFA3FDAk2Yb7PHHNhkTNOnLAjlPaIIitR9YG-b5PWKzzl53xiiNEfQzHPo5f_HVv0eLJVI13jaoVLCWlUD41vb-4jiIEzxYy7L3VVF3KxBtVO6BE2E1jRiUdWGiYagIkSTi87BHv9cWMOqrRRElHJKtM_LH7LWPcyQYm-e7t7Np0yuIiSG2a7kcUa83fxnFKBlD3XQWk3tBK_A6UHfOpVtGfh58aA3wMAw29cIbI5nWpV6ItQSoKR9GlwPgZ9_RwLBJtBRlGly3vddfujNsc6LR0pWXaYSrJULantDqQJ_4b9XaCQ==&c=IyjvwkVNXkSM3EQNeu1AFyYVkMBKrNrka4UrFHY9Xgi8_nQQx7j-YA==&ch=Kpqbu5OxQl-CnKQeZK4xThguts9KPf_lvJrsntwD6ZjuGxnpSh2o9w==	false		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://creativecommons.org/publicdomain/zero/1.0/	chromecache_61.2.dr	false		unknown
http://underscorejs.org/	chromecache_61.2.dr	false		unknown
https://js.foundation/	chromecache_61.2.dr	false	URL Reputation: safe	unknown
https://github.com/lodash/lodash	chromecache_61.2.dr	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.184.196	www.google.com	United States	15169	GOOGLEUS	false
52.123.128.14	s-0005.dual-s-msedge.net	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
208.75.122.11	husgu4aab.cc.rs6.net	United States	40444	ASN-CCUS	false

Private

IP
192.168.2.7
192.168.2.23
192.168.2.15

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1524421
Start date and time:	2024-10-02 18:51:55 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 51s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	https://husgu4aab.cc.rs6.net/tn.jsp?f=001Kgt4Y2UB61RJ-8HwGvpJdBIbmN2KmnsaQqGoOmBznZv-sZNQDwRSSQ7g-eK51O4by9IOD2KnWORRgU0x0E3aNqtENPlCG9IRkHoovRH87tIhjQapV8qvGaEivg08QWSvEYUiMWZbUAA5F-TBphmYo54Yji4b0P6N0DJh_NbVO20TarWgnPQ3SuLKbE7xetLRM8vyBQFA3FDAk2Yb7PHHNhkTNOnLAjlPaIIitR9YG-b5PWKzzl53xiiNEfQzHPo5f_HVv0eLJVI13jaoVLCWlUD41vb-4jiIEzxYy7L3VVF3KxBtVO6BE2E1jRiUdWGiYagIkSTi87BHv9cWMOqrRRElHJKtM_LH7LWPcyQYm-e7t7Np0yuIiSG2a7kcUa83fxnFKBlD3XQWk3tBK_A6UHfOpVtGfh58aA3wMAw29cIbI5nWpV6ItQSoKR9GlwPgZ9_RwLBJtBRlGly3vddfujNsc6LR0pWXaYSrJULantDqQJ_4b9XaCQ==&c=IyjvwkVNXkSM3EQNeu1AFyYVkMBKrNrka4UrFHY9Xgi8_nQQx7j-YA==&ch=Kpqbu5OxQl-CnKQeZK4xThguts9KPf_lvJrsntwD6ZjuGxnpSh2o9w==
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	16
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	CLEAN
Classification:	clean1.win@20/28@4/7
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Browse: https://teams.microsoft.com/dl/launcher/attribution.txt

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 172.217.18.3, 216.58.206.78, 74.125.206.84, 34.104.35.123, 2.19.126.151, 2.19.126.154, 20.42.65.91, 51.116.246.105, 20.114.59.183, 93.184.221.240, 40.69.42.241, 20.3.187.198, 20.242.39.171, 52.165.164.15, 131.107.255.255, 20.12.23.50, 142.250.184.227, 13.89.179.9, 51.104.15.252, 13.85.23.86, 142.250.186.174
Excluded domains from analysis (whitelisted): onedscolprdgwc03.germanywestcentral.cloudapp.azure.com, slscr.update.microsoft.com, onedscolprdeus17.eastus.cloudapp.azure.com, clientservices.googleapis.com, browser.events.data.trafficmanager.net, time.windows.com, wu.azureedge.net, dns.msftncsi.com, onedscolprdcus09.centralus.cloudapp.azure.com, clients2.google.com, bg.apr-52dd2-0503.edgecastdns.net, cs11.wpc.v0cdn.net, glb.cws.prod.dcat.dsp.trafficmanager.net, teams-staticscdn.trafficmanager.net, sls.update.microsoft.com, hlb.apr-52dd2-0.edgecastdns.net, update.googleapis.com, wu-b-net.trafficmanager.net, statics.teams.cdn.office.net, glb.sls.prod.dcat.dsp.trafficmanager.net, clients1.google.com, fs.microsoft.com, accounts.google.com, ctldl.windowsupdate.com.delivery.microsoft.com, wu.ec.azureedge.net, teams.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com, fe3.delivery.mp.microsoft.com, edgedl.me.gvt1.com, onedscolprduks01.uksouth.cloudapp.azure.com, statics.teams.cdn.office.net-c.edges
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtSetInformationFile calls found.
VT rate limit hit for: https://husgu4aab.cc.rs6.net/tn.jsp?f=001Kgt4Y2UB61RJ-8HwGvpJdBIbmN2KmnsaQqGoOmBznZv-sZNQDwRSSQ7g-eK51O4by9IOD2KnWORRgU0x0E3aNqtENPlCG9IRkHoovRH87tIhjQapV8qvGaEivg08QWSvEYUiMWZbUAA5F-TBphmYo54Yji4b0P6N0DJh_NbVO20TarWgnPQ3SuLKbE7xetLRM8vyBQFA3FDAk2Yb7PHHNhkTNOnLAjlPaIIitR9YG-b5PWKzzl53xiiNEfQzHPo5f_HVv0eLJVI13jaoVLCWlUD41vb-4jiIEzxYy7L3VVF3KxBtVO6BE2E1jRiUdWGiYagIkSTi87BHv9cWMOqrRRElHJKtM_LH7LWPcyQYm-e7t7Np0yuIiSG2a7kcUa83fxnFKBlD3XQWk3tBK_A6UHfOpVtGfh58aA3wMAw29cIbI5nWpV6ItQSoKR9GlwPgZ9_RwLBJtBRlGly3vddfujNsc6LR0pWXaYSrJULantDqQJ_4b9XaCQ==&c=IyjvwkVNXkSM3EQNeu1AFyYVkMBKrNrka4UrFHY9Xgi8_nQQx7j-YA==&ch=Kpqbu5OxQl-CnKQeZK4xThguts9KPf_lvJrsntwD6ZjuGxnpSh2o9w==

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (4212)
Category:	downloaded
Size (bytes):	31054
Entropy (8bit):	5.115262666558672
Encrypted:	false
SSDEEP:	384:dZJPRAKEMuYgmJT0cISW6Z6qDD6b9nQFFQUR2IVf69AWhLX47SHTlk4nO8FIYTJ8:DE2tUsIW8FhdVG
MD5:	62624B374594C5B37AC2840166D36869
SHA1:	4F1ED0D897D0A729DB319A914DDC0607875C39C6
SHA-256:	80270CC751ED1DE7959C538CD7032E811207AF63B73477A446865AA3870ED3F8
SHA-512:	CD01101EFAE2A9AF2194AE020B00E68C8F453BA53293CC17618968065001D79E76F729A084E8214F29E82DD11BA8424CD50BCA694EBB476AB65E8246228B40C7
Malicious:	false
Reputation:	low
URL:	https://statics.teams.cdn.office.net/hashedcss-launcher/launcher.d6cd10b8b26b2130799c.css
Preview:	@font-face{font-family:"Segoe UI";src:local("Segoe UI Light");font-style:normal;font-weight:200}@font-face{font-family:"Segoe UI";src:local("Segoe UI Semilight");font-style:normal;font-weight:300}@font-face{font-family:"Segoe UI";src:local("Segoe UI");font-style:normal;font-weight:400}@font-face{font-family:"Segoe UI";src:local("Segoe UI Semibold");font-style:normal;font-weight:600}@font-face{font-family:"Segoe UI";src:local("Segoe UI Bold");font-style:normal;font-weight:700}@font-face{font-family:"Segoe UI";src:local("Segoe UI Light Italic");font-style:italic;font-weight:200}@font-face{font-family:"Segoe UI";src:local("Segoe UI Semilight Italic");font-style:italic;font-weight:300}@font-face{font-family:"Segoe UI";src:local("Segoe UI Italic");font-style:italic;font-weight:400}@font-face{font-family:"Segoe UI";src:local("Segoe UI Semibold Italic");font-style:italic;font-weight:600}@font-face{font-family:"Segoe UI";src:local("Segoe UI Bold Italic");font-style:italic;font-weight:700}body,

Chrome Cache Entry: 58

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65449)
Category:	dropped
Size (bytes):	732260
Entropy (8bit):	5.392644678082118
Encrypted:	false
SSDEEP:	6144:5zoNDcDzTDZqLLWkYx2H2l9ai07FkmCml9JlsOb11zMsEpPqJ1JCY8U4UYUKuIan:5zoNy07FkmhpACngpWl
MD5:	48E0C9FB1710E5DBF0FB4DE47D24883A
SHA1:	20DA225D954787A819C8AA444091C39D6936DE99
SHA-256:	B8E4EEF641BC1188191E821739EBA6204FEF2F5C971089CD28FC77834D700CE7
SHA-512:	C33EB9E788F0F741B44931EC12C612A691B0FCA6F8D672D1B7107CC925936A68F41E57F2C5D5FDD01387C097D649C427C238B090E6E367AF4061CF258CFD4B1F
Malicious:	false
Reputation:	low
Preview:	/! For license information please see launcher.bd11421f64e348db1253.js.LICENSE.txt /.!function(){var e={1247:function(e,t){"use strict";var n;Object.defineProperty(t,"__esModule",{value:!0}),(n=t._BondDataType\|\|(t._BondDataType={}))[n._BT_STOP=0]="_BT_STOP",n[n._BT_STOP_BASE=1]="_BT_STOP_BASE",n[n._BT_BOOL=2]="_BT_BOOL",n[n._BT_DOUBLE=8]="_BT_DOUBLE",n[n._BT_STRING=9]="_BT_STRING",n[n._BT_STRUCT=10]="_BT_STRUCT",n[n._BT_LIST=11]="_BT_LIST",n[n._BT_MAP=13]="_BT_MAP",n[n._BT_INT32=16]="_BT_INT32",n[n._BT_INT64=17]="_BT_INT64"},6601:function(e,t,n){"use strict";Object.defineProperty(t,"__esModule",{value:!0});var r=n(1953),i=n(8833),o=n(1486);t._Utf8_GetBytes=function(e){for(var t=[],n=0;n<e.length;++n){var r=e.charCodeAt(n);r<128?t.push(r):r<2048?t.push(192\|r>>6,128\|63&r):r<55296\|\|r>=57344?t.push(224\|r>>12,128\|r>>6&63,128\|63&r):(r=65536+((1023&r)<<10\|1023&e.charCodeAt(++n)),t.push(240\|r>>18,128\|r>>12&63,128\|r>>6&63,128\|63&r))}return t},t._Base64_GetString=function(e){for(var t,n="ABCDE

Chrome Cache Entry: 59

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	378
Entropy (8bit):	4.776232459714454
Encrypted:	false
SSDEEP:	6:tnrVzUOtumc4sl6KS7jl/nNjlt9O59CS7jl/nNjltZHZ597mcjl/nNjlt9lO5yco:trVzNtuyBfXtAHVBfXtZ5H7mcBfXtHOg
MD5:	E15B60F79E5AA4DD00A5DBA376D9BB27
SHA1:	858DD14EDDC67EEBF968BC346038757A084C8745
SHA-256:	3EA31966DE64EB2B53B74E9BF9D0F5AA1E28967EE904DF3883717D94AAE13B68
SHA-512:	7312C3A1113AB4F748B17F7A7C6C280FB3C0FCF22B2F7CCD4A125B68081A320BBD0A943BB4A817FF6F73F76B553642ACC02C599D2560D7A4A45CDCFCD05E9066
Malicious:	false
Reputation:	low
URL:	https://statics.teams.cdn.office.net/hashedassets-launcher/v3/microsoft_logo.3c5fb2e769272b22e31e2535162f6a38.svg
Preview:	<svg width="12" height="12" viewBox="0 0 12 12" fill="none" xmlns="http://www.w3.org/2000/svg">. <rect x="1" y="1" width="4.75" height="4.75" fill="#F25022"/>. <rect x="6.25" y="1" width="4.75" height="4.75" fill="#80BA01"/>. <rect x="6.25" y="6.25" width="4.75" height="4.75" fill="#FFB902"/>. <rect x="1" y="6.25" width="4.75" height="4.75" fill="#02A4EF"/>.</svg>

Chrome Cache Entry: 60

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	3763
Entropy (8bit):	4.990395952954171
Encrypted:	false
SSDEEP:	96:Nf60b4fcuT0VKBfMsCFpHhMufKBftfyFEr6V5J1:R60MPT7BMsCFpSuiBtfEEr+J1
MD5:	2806C5625995DC0F79C4747B5DE9D43D
SHA1:	3449F951AEAB055DA6DD70DC2CA9AE3338A87E51
SHA-256:	2530737992DBFE5F3FFBBE61DE0C496EFF1C577BA01ADC78471B76F625DD0E36
SHA-512:	4CC078EF2EE3CCBC5D8C8C5FE5929BAEA603149CBF0EE3693CC446F1E9B2962A271D02C7A50C09245E56CC1D6FACB764D62F987204334FDADAC3ADDA470D710E
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="utf-8"?>.<svg version="1.1" id="Layer_1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px" y="0px".. viewBox="0 0 38 38" style="enable-background:new 0 0 38 38;" xml:space="preserve">.<style type="text/css">...st0{fill:#7B83EB;}...st1{opacity:0.1;enable-background:new ;}...st2{opacity:0.2;enable-background:new ;}...st3{fill:#5059C9;}...st4{fill:#4B53BC;}...st5{fill:#FFFFFF;}...st6{fill:none;}.</style>.<g id="Teams">..<g id="Teams_32x" transform="translate(3.000000, 3.000000)">...<circle id="Oval" class="st0" cx="17" cy="6" r="4.6669998"/>...<path id="Path" class="st1" d="M16.6669998,7H12.441l0.0209999,0.0929999v0.0079999....c0.007,0.0290003,0.0139999,0.0570002,0.0220003,0.086C13.1217108,9.6077375,15.5547476,11.0950832,18,10.559V8.3330002....C17.9978027,7.5977163,17.4022846,7.0021963,16.6669998,7L16.6669998,7z"/>...<path id="Path_1_" class="st2" d="M15.6669998,8H12.783c0.7725716,1.6288652,2.4142056,2.6671009,4.217,2

Chrome Cache Entry: 61

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with CRLF, LF line terminators
Category:	downloaded
Size (bytes):	17514
Entropy (8bit):	5.194383164357832
Encrypted:	false
SSDEEP:	384:0V262CyC63D6UpR6L66646F6Or6f6e2686D6t6b:UVylOUpwWN3M1CmDeEb
MD5:	BAA8CDEDEF47FD3950E654413765C8E6
SHA1:	C618384521AA608E6E895DED423AA5974CEEDFB7
SHA-256:	31534A922F42A7AE5672ED088270BA9BF07689774C375BC23A672614E86883BD
SHA-512:	683A0D41A8F73C40ABA73AAD0CD5937A7022C46885058D90FF991EF915A376A8D9D1FC9A8C351363EE81CCD2813AA77A286733CDBDC9A2130785C3BAE82BA423
Malicious:	false
Reputation:	low
URL:	https://teams.microsoft.com/dl/launcher/attribution.txt
Preview:	.THIRD PARTY SOFTWARE NOTICES AND INFORMATION.Do Not Translate or Localize..This software incorporates material from third parties. Microsoft makes certain.open source code available at http://3rdpartysource.microsoft.com, or you may.send a check or money order for US $5.00, including the product name, the open.source component name, and version number, to:..Source Code Compliance Team.Microsoft Corporation.One Microsoft Way.Redmond, WA 98052.USA..Notwithstanding any other terms, you may reverse engineer this software to the.extent required to debug changes to any libraries licensed under the GNU Lesser.General Public License...@babel/polyfill@7.6.0.Copyright (c) 2014-present Sebastian McKenzie and other contributors....Permission is hereby granted, free of charge, to any person obtaining a copy.of this software and associated documentation files (the "Software"), to deal.in the Software without restriction, including without limitation the rights.to use, copy, modify, merge, publish,

Chrome Cache Entry: 62

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	48
Entropy (8bit):	4.03280638688745
Encrypted:	false
SSDEEP:	3:YXLf+1iH7AzDMrS3R4:Y61rQX
MD5:	D78A26A9BF059B36F1C23E8CAF264B75
SHA1:	1736C3C7E3F445B27329E36B1192E06AD75AFCE0
SHA-256:	F9673E7713DCE183F45FB712EA2EDDF3DAC028F9F96B25228FF2C39211FBE577
SHA-512:	13DC691758AB89169BD07318B70916A6D556AF65028F00C1D33219B6B471038FB176523AA9CA3A687EADB26664890538932A2FD5D120F494F75199B0CA4D3150
Malicious:	false
Reputation:	low
URL:	https://teams.microsoft.com/api/mt/beta/meetings/branding?tenantId=1a40aa3f-1477-4f8f-980e-9c88fa937847&userId=b08fca2d-a34f-492c-bc56-309cea6ba5ef
Preview:	{"reason":"No branding defined for the tenant."}

Chrome Cache Entry: 63

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 8 icons, 256x256 with PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced, 32 bits/pixel, 256x256 with PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced, 32 bits/pixel
Category:	dropped
Size (bytes):	91302
Entropy (8bit):	5.083847889045784
Encrypted:	false
SSDEEP:	1536:59iJX9Lgm9iJX9Lgm9iJX9Lg/jHXZwuumF:54p4p4qXZwuumF
MD5:	2B4509D8A869917BBC5CE10982956619
SHA1:	DC21BD40ED9B873779F855026F253BDD3322723D
SHA-256:	397EDDF44E1BF7E557B0B4F5173DA95D8FD832B6F2F10D6E41C17DC539D5A822
SHA-512:	2D0A54E85C7BBDD653B1557A3741D44B621876503D6E8B8CFD5FC6BD3047E28B9702DFB132474DD3981174D96F994B46083008A327646C8D16467E80DA164BAB
Malicious:	false
Reputation:	low
Preview:	............ ............... ............... ......7..``.... ......S..@@.... .(B......00.... ..%...).. .... ......O........ .h...>`...PNG........IHDR.............\r.f....pHYs..........o.d...:IDATx...{........Uu...f.......#ry.='^....1...A].q!...$^.2...`.h...&...0Q@7.=.{6.%z..-.]#....0.L.tW}.....KOOW.......Q...w..@)..RJ)..RJ)..RJ)..RJ)..R.....H...L[..7.j.....#.0..L.....y.U..@D%.i...g..3....x..Cd...R....-.^...nY...{..\..@.4..~.zz/..\|.....g..@6S......~....W.N...%.J....r.9G ./.2......_.`..L.b.7Z.%......["...1VB.;H.].o....~+....J....E..+>..h..............y...JH..mR..,..4.Y.Bp.k.+..#^..E...P.."&.{>.$D..y.Dz$ou..5'I.v....(r..GtKj...c;.P.\[.K...>..%....M..{...'.2.v.\...s..Fn..%....*77-.{.../....2..x..h....D..@..y......".....H.x._.p....D........=C../.(..%...._Z0...D..@....{O.3..%./d.q.3..@.h......#..........M.$=;P.z...$EL........80.-..I...,....@f..b;.?."rNf.F.9.@w.B...6)-.....o...;U...K..BLD..3.#.......3.%_.,P}...V...W....l.h.s.....3w..v.R...Rw.%

Chrome Cache Entry: 64

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65449)
Category:	downloaded
Size (bytes):	732260
Entropy (8bit):	5.392644678082118
Encrypted:	false
SSDEEP:	6144:5zoNDcDzTDZqLLWkYx2H2l9ai07FkmCml9JlsOb11zMsEpPqJ1JCY8U4UYUKuIan:5zoNy07FkmhpACngpWl
MD5:	48E0C9FB1710E5DBF0FB4DE47D24883A
SHA1:	20DA225D954787A819C8AA444091C39D6936DE99
SHA-256:	B8E4EEF641BC1188191E821739EBA6204FEF2F5C971089CD28FC77834D700CE7
SHA-512:	C33EB9E788F0F741B44931EC12C612A691B0FCA6F8D672D1B7107CC925936A68F41E57F2C5D5FDD01387C097D649C427C238B090E6E367AF4061CF258CFD4B1F
Malicious:	false
Reputation:	low
URL:	https://statics.teams.cdn.office.net/hashedjs-launcher/launcher.bd11421f64e348db1253.js
Preview:	/! For license information please see launcher.bd11421f64e348db1253.js.LICENSE.txt /.!function(){var e={1247:function(e,t){"use strict";var n;Object.defineProperty(t,"__esModule",{value:!0}),(n=t._BondDataType\|\|(t._BondDataType={}))[n._BT_STOP=0]="_BT_STOP",n[n._BT_STOP_BASE=1]="_BT_STOP_BASE",n[n._BT_BOOL=2]="_BT_BOOL",n[n._BT_DOUBLE=8]="_BT_DOUBLE",n[n._BT_STRING=9]="_BT_STRING",n[n._BT_STRUCT=10]="_BT_STRUCT",n[n._BT_LIST=11]="_BT_LIST",n[n._BT_MAP=13]="_BT_MAP",n[n._BT_INT32=16]="_BT_INT32",n[n._BT_INT64=17]="_BT_INT64"},6601:function(e,t,n){"use strict";Object.defineProperty(t,"__esModule",{value:!0});var r=n(1953),i=n(8833),o=n(1486);t._Utf8_GetBytes=function(e){for(var t=[],n=0;n<e.length;++n){var r=e.charCodeAt(n);r<128?t.push(r):r<2048?t.push(192\|r>>6,128\|63&r):r<55296\|\|r>=57344?t.push(224\|r>>12,128\|r>>6&63,128\|63&r):(r=65536+((1023&r)<<10\|1023&e.charCodeAt(++n)),t.push(240\|r>>18,128\|r>>12&63,128\|r>>6&63,128\|63&r))}return t},t._Base64_GetString=function(e){for(var t,n="ABCDE

Chrome Cache Entry: 65

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (17753), with no line terminators
Category:	downloaded
Size (bytes):	17769
Entropy (8bit):	4.994370700439415
Encrypted:	false
SSDEEP:	384:PhLhehehehnh4ZZkybCgKX6v169F7sV4Jz3ECGR7sjFtUQkwcuj3egT1gF7OU6T4:PhLhehehehnh4Y+CgKqv16LsV4JzUCja
MD5:	FBBA155FC40874AE8E68D09AA6083618
SHA1:	1712D48F1C148A82F3572C67BB800BEDBE803B2B
SHA-256:	66DEC17F5036D5D2D68024C8DE158A23BCC1214F828E51D5E23F96BEC24A0E48
SHA-512:	5241FDF5E7226D0888A1BE26BAC7E33BB30D13778B6AE94AF0FF470916AC899FB5DBFB0842EF6C35715AC557B31FDB9B0EC12267E55ABC143A07966A7C00FCB1
Malicious:	false
Reputation:	low
URL:	https://teams.microsoft.com/dl/launcher/launcher.html?url=%2F_%23%2Fl%2Fmeetup-join%2F19%3Ameeting_MmE0NjAzMTAtYzgyMS00MDliLWE1YTUtZjJhZmM1ZGY4YzZh%40thread.v2%2F0%3Fcontext%3D%257B%2522Tid%2522%253A%25221a40aa3f-1477-4f8f-980e-9c88fa937847%2522%252C%2522Oid%2522%253A%2522b08fca2d-a34f-492c-bc56-309cea6ba5ef%2522%257D%26anon%3Dtrue&type=meetup-join&deeplinkId=f35de3fe-1833-4040-a2d1-3b28cea1b10c&directDl=true&msLaunch=true&enableMobilePage=true
Preview:	<!doctype html><html lang="en-US" dir="ltr" class="ltr"><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"><meta http-equiv="X-UA-Compatible" content="IE=edge"><meta name="googlebot" content="noindex, nofollow"><meta name="robots" content="noindex, nofollow"><meta name="viewport" content="width=device-width,initial-scale=1"><link rel="shortcut icon" href="https://statics.teams.cdn.office.net/hashedassets-launcher/favicon/favicon.ico" type="image/x-icon"><link rel="apple-touch-icon" href="https://statics.teams.cdn.office.net/hashedassets-launcher/favicon/favicon-96x96.png"><link rel="apple-touch-icon" sizes="16x16" href="https://statics.teams.cdn.office.net/hashedassets-launcher/favicon/favicon-16x16.png"><link rel="apple-touch-icon" sizes="32x32" href="https://statics.teams.cdn.office.net/hashedassets-launcher/favicon/favicon-32x32.png"><link rel="apple-touch-icon" sizes="96x96" href="https://statics.teams.cdn.office.net/hashedassets-launcher/favicon/favicon-96x96

Chrome Cache Entry: 66

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	378
Entropy (8bit):	4.776232459714454
Encrypted:	false
SSDEEP:	6:tnrVzUOtumc4sl6KS7jl/nNjlt9O59CS7jl/nNjltZHZ597mcjl/nNjlt9lO5yco:trVzNtuyBfXtAHVBfXtZ5H7mcBfXtHOg
MD5:	E15B60F79E5AA4DD00A5DBA376D9BB27
SHA1:	858DD14EDDC67EEBF968BC346038757A084C8745
SHA-256:	3EA31966DE64EB2B53B74E9BF9D0F5AA1E28967EE904DF3883717D94AAE13B68
SHA-512:	7312C3A1113AB4F748B17F7A7C6C280FB3C0FCF22B2F7CCD4A125B68081A320BBD0A943BB4A817FF6F73F76B553642ACC02C599D2560D7A4A45CDCFCD05E9066
Malicious:	false
Reputation:	low
Preview:	<svg width="12" height="12" viewBox="0 0 12 12" fill="none" xmlns="http://www.w3.org/2000/svg">. <rect x="1" y="1" width="4.75" height="4.75" fill="#F25022"/>. <rect x="6.25" y="1" width="4.75" height="4.75" fill="#80BA01"/>. <rect x="6.25" y="6.25" width="4.75" height="4.75" fill="#FFB902"/>. <rect x="1" y="6.25" width="4.75" height="4.75" fill="#02A4EF"/>.</svg>

Chrome Cache Entry: 67

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	4.241202481433726
Encrypted:	false
SSDEEP:	3:YozDD/RNgQJzRWWlKFiFD3e4xCzY:YovtNgmzR/wYFDxkY
MD5:	9E576E34B18E986347909C29AE6A82C6
SHA1:	532C767978DC2B55854B3CA2D2DF5B4DB221C934
SHA-256:	88BDF5AF090328963973990DE427779F9C4DF3B8E1F5BADC3D972BAC3087006D
SHA-512:	5EF6DCFFD93434D45760888BF4B95FF134D53F34DA9DC904AD3C5EBEDC58409073483F531FEA4233869ED3EC75F38B022A70B2E179A5D3A13BDB10AB5C46B124
Malicious:	false
Reputation:	low
Preview:	{"Message":"The requested resource does not support http method 'GET'."}

Chrome Cache Entry: 68

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 8 icons, 256x256 with PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced, 32 bits/pixel, 256x256 with PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced, 32 bits/pixel
Category:	downloaded
Size (bytes):	91302
Entropy (8bit):	5.083847889045784
Encrypted:	false
SSDEEP:	1536:59iJX9Lgm9iJX9Lgm9iJX9Lg/jHXZwuumF:54p4p4qXZwuumF
MD5:	2B4509D8A869917BBC5CE10982956619
SHA1:	DC21BD40ED9B873779F855026F253BDD3322723D
SHA-256:	397EDDF44E1BF7E557B0B4F5173DA95D8FD832B6F2F10D6E41C17DC539D5A822
SHA-512:	2D0A54E85C7BBDD653B1557A3741D44B621876503D6E8B8CFD5FC6BD3047E28B9702DFB132474DD3981174D96F994B46083008A327646C8D16467E80DA164BAB
Malicious:	false
Reputation:	low
URL:	https://statics.teams.cdn.office.net/hashedassets-launcher/favicon/favicon.ico
Preview:	............ ............... ............... ......7..``.... ......S..@@.... .(B......00.... ..%...).. .... ......O........ .h...>`...PNG........IHDR.............\r.f....pHYs..........o.d...:IDATx...{........Uu...f.......#ry.='^....1...A].q!...$^.2...`.h...&...0Q@7.=.{6.%z..-.]#....0.L.tW}.....KOOW.......Q...w..@)..RJ)..RJ)..RJ)..RJ)..R.....H...L[..7.j.....#.0..L.....y.U..@D%.i...g..3....x..Cd...R....-.^...nY...{..\..@.4..~.zz/..\|.....g..@6S......~....W.N...%.J....r.9G ./.2......_.`..L.b.7Z.%......["...1VB.;H.].o....~+....J....E..+>..h..............y...JH..mR..,..4.Y.Bp.k.+..#^..E...P.."&.{>.$D..y.Dz$ou..5'I.v....(r..GtKj...c;.P.\[.K...>..%....M..{...'.2.v.\...s..Fn..%....*77-.{.../....2..x..h....D..@..y......".....H.x._.p....D........=C../.(..%...._Z0...D..@....{O.3..%./d.q.3..@.h......#..........M.$=;P.z...$EL........80.-..I...,....@f..b;.?."rNf.F.9.@w.B...6)-.....o...;U...K..BLD..3.#.......3.%_.,P}...V...W....l.h.s.....3w..v.R...Rw.%

Chrome Cache Entry: 69

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	4.241202481433726
Encrypted:	false
SSDEEP:	3:YozDD/RNgQJzRWWlKFiFD3e4xCzY:YovtNgmzR/wYFDxkY
MD5:	9E576E34B18E986347909C29AE6A82C6
SHA1:	532C767978DC2B55854B3CA2D2DF5B4DB221C934
SHA-256:	88BDF5AF090328963973990DE427779F9C4DF3B8E1F5BADC3D972BAC3087006D
SHA-512:	5EF6DCFFD93434D45760888BF4B95FF134D53F34DA9DC904AD3C5EBEDC58409073483F531FEA4233869ED3EC75F38B022A70B2E179A5D3A13BDB10AB5C46B124
Malicious:	false
Reputation:	low
Preview:	{"Message":"The requested resource does not support http method 'GET'."}

Chrome Cache Entry: 70

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 8 icons, 256x256 with PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced, 32 bits/pixel, 256x256 with PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced, 32 bits/pixel
Category:	dropped
Size (bytes):	91302
Entropy (8bit):	5.083847889045784
Encrypted:	false
SSDEEP:	1536:59iJX9Lgm9iJX9Lgm9iJX9Lg/jHXZwuumF:54p4p4qXZwuumF
MD5:	2B4509D8A869917BBC5CE10982956619
SHA1:	DC21BD40ED9B873779F855026F253BDD3322723D
SHA-256:	397EDDF44E1BF7E557B0B4F5173DA95D8FD832B6F2F10D6E41C17DC539D5A822
SHA-512:	2D0A54E85C7BBDD653B1557A3741D44B621876503D6E8B8CFD5FC6BD3047E28B9702DFB132474DD3981174D96F994B46083008A327646C8D16467E80DA164BAB
Malicious:	false
Reputation:	low
Preview:	............ ............... ............... ......7..``.... ......S..@@.... .(B......00.... ..%...).. .... ......O........ .h...>`...PNG........IHDR.............\r.f....pHYs..........o.d...:IDATx...{........Uu...f.......#ry.='^....1...A].q!...$^.2...`.h...&...0Q@7.=.{6.%z..-.]#....0.L.tW}.....KOOW.......Q...w..@)..RJ)..RJ)..RJ)..RJ)..R.....H...L[..7.j.....#.0..L.....y.U..@D%.i...g..3....x..Cd...R....-.^...nY...{..\..@.4..~.zz/..\|.....g..@6S......~....W.N...%.J....r.9G ./.2......_.`..L.b.7Z.%......["...1VB.;H.].o....~+....J....E..+>..h..............y...JH..mR..,..4.Y.Bp.k.+..#^..E...P.."&.{>.$D..y.Dz$ou..5'I.v....(r..GtKj...c;.P.\[.K...>..%....M..{...'.2.v.\...s..Fn..%....*77-.{.../....2..x..h....D..@..y......".....H.x._.p....D........=C../.(..%...._Z0...D..@....{O.3..%./d.q.3..@.h......#..........M.$=;P.z...$EL........80.-..I...,....@f..b;.?."rNf.F.9.@w.B...6)-.....o...;U...K..BLD..3.#.......3.%_.,P}...V...W....l.h.s.....3w..v.R...Rw.%

Chrome Cache Entry: 71

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	4.241202481433726
Encrypted:	false
SSDEEP:	3:YozDD/RNgQJzRWWlKFiFD3e4xCzY:YovtNgmzR/wYFDxkY
MD5:	9E576E34B18E986347909C29AE6A82C6
SHA1:	532C767978DC2B55854B3CA2D2DF5B4DB221C934
SHA-256:	88BDF5AF090328963973990DE427779F9C4DF3B8E1F5BADC3D972BAC3087006D
SHA-512:	5EF6DCFFD93434D45760888BF4B95FF134D53F34DA9DC904AD3C5EBEDC58409073483F531FEA4233869ED3EC75F38B022A70B2E179A5D3A13BDB10AB5C46B124
Malicious:	false
Reputation:	low
Preview:	{"Message":"The requested resource does not support http method 'GET'."}

Chrome Cache Entry: 72

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 8 icons, 256x256 with PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced, 32 bits/pixel, 256x256 with PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced, 32 bits/pixel
Category:	downloaded
Size (bytes):	91302
Entropy (8bit):	5.083847889045784
Encrypted:	false
SSDEEP:	1536:59iJX9Lgm9iJX9Lgm9iJX9Lg/jHXZwuumF:54p4p4qXZwuumF
MD5:	2B4509D8A869917BBC5CE10982956619
SHA1:	DC21BD40ED9B873779F855026F253BDD3322723D
SHA-256:	397EDDF44E1BF7E557B0B4F5173DA95D8FD832B6F2F10D6E41C17DC539D5A822
SHA-512:	2D0A54E85C7BBDD653B1557A3741D44B621876503D6E8B8CFD5FC6BD3047E28B9702DFB132474DD3981174D96F994B46083008A327646C8D16467E80DA164BAB
Malicious:	false
Reputation:	low
URL:	https://statics.teams.cdn.office.net/hashed/favicon/prod/favicon-f1722d9.ico
Preview:	............ ............... ............... ......7..``.... ......S..@@.... .(B......00.... ..%...).. .... ......O........ .h...>`...PNG........IHDR.............\r.f....pHYs..........o.d...:IDATx...{........Uu...f.......#ry.='^....1...A].q!...$^.2...`.h...&...0Q@7.=.{6.%z..-.]#....0.L.tW}.....KOOW.......Q...w..@)..RJ)..RJ)..RJ)..RJ)..R.....H...L[..7.j.....#.0..L.....y.U..@D%.i...g..3....x..Cd...R....-.^...nY...{..\..@.4..~.zz/..\|.....g..@6S......~....W.N...%.J....r.9G ./.2......_.`..L.b.7Z.%......["...1VB.;H.].o....~+....J....E..+>..h..............y...JH..mR..,..4.Y.Bp.k.+..#^..E...P.."&.{>.$D..y.Dz$ou..5'I.v....(r..GtKj...c;.P.\[.K...>..%....M..{...'.2.v.\...s..Fn..%....*77-.{.../....2..x..h....D..@..y......".....H.x._.p....D........=C../.(..%...._Z0...D..@....{O.3..%./d.q.3..@.h......#..........M.$=;P.z...$EL........80.-..I...,....@f..b;.?."rNf.F.9.@w.B...6)-.....o...;U...K..BLD..3.#.......3.%_.,P}...V...W....l.h.s.....3w..v.R...Rw.%

Chrome Cache Entry: 73

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	4.241202481433726
Encrypted:	false
SSDEEP:	3:YozDD/RNgQJzRWWlKFiFD3e4xCzY:YovtNgmzR/wYFDxkY
MD5:	9E576E34B18E986347909C29AE6A82C6
SHA1:	532C767978DC2B55854B3CA2D2DF5B4DB221C934
SHA-256:	88BDF5AF090328963973990DE427779F9C4DF3B8E1F5BADC3D972BAC3087006D
SHA-512:	5EF6DCFFD93434D45760888BF4B95FF134D53F34DA9DC904AD3C5EBEDC58409073483F531FEA4233869ED3EC75F38B022A70B2E179A5D3A13BDB10AB5C46B124
Malicious:	false
Reputation:	low
Preview:	{"Message":"The requested resource does not support http method 'GET'."}

Chrome Cache Entry: 74

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	4.03280638688745
Encrypted:	false
SSDEEP:	3:YXLf+1iH7AzDMrS3R4:Y61rQX
MD5:	D78A26A9BF059B36F1C23E8CAF264B75
SHA1:	1736C3C7E3F445B27329E36B1192E06AD75AFCE0
SHA-256:	F9673E7713DCE183F45FB712EA2EDDF3DAC028F9F96B25228FF2C39211FBE577
SHA-512:	13DC691758AB89169BD07318B70916A6D556AF65028F00C1D33219B6B471038FB176523AA9CA3A687EADB26664890538932A2FD5D120F494F75199B0CA4D3150
Malicious:	false
Reputation:	low
Preview:	{"reason":"No branding defined for the tenant."}

Chrome Cache Entry: 75

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	3763
Entropy (8bit):	4.990395952954171
Encrypted:	false
SSDEEP:	96:Nf60b4fcuT0VKBfMsCFpHhMufKBftfyFEr6V5J1:R60MPT7BMsCFpSuiBtfEEr+J1
MD5:	2806C5625995DC0F79C4747B5DE9D43D
SHA1:	3449F951AEAB055DA6DD70DC2CA9AE3338A87E51
SHA-256:	2530737992DBFE5F3FFBBE61DE0C496EFF1C577BA01ADC78471B76F625DD0E36
SHA-512:	4CC078EF2EE3CCBC5D8C8C5FE5929BAEA603149CBF0EE3693CC446F1E9B2962A271D02C7A50C09245E56CC1D6FACB764D62F987204334FDADAC3ADDA470D710E
Malicious:	false
Reputation:	low
URL:	https://statics.teams.cdn.office.net/hashedassets-launcher/v2/logo_teams.2da5b2c1a6861ba76de6c658322f4626.svg
Preview:	<?xml version="1.0" encoding="utf-8"?>.<svg version="1.1" id="Layer_1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px" y="0px".. viewBox="0 0 38 38" style="enable-background:new 0 0 38 38;" xml:space="preserve">.<style type="text/css">...st0{fill:#7B83EB;}...st1{opacity:0.1;enable-background:new ;}...st2{opacity:0.2;enable-background:new ;}...st3{fill:#5059C9;}...st4{fill:#4B53BC;}...st5{fill:#FFFFFF;}...st6{fill:none;}.</style>.<g id="Teams">..<g id="Teams_32x" transform="translate(3.000000, 3.000000)">...<circle id="Oval" class="st0" cx="17" cy="6" r="4.6669998"/>...<path id="Path" class="st1" d="M16.6669998,7H12.441l0.0209999,0.0929999v0.0079999....c0.007,0.0290003,0.0139999,0.0570002,0.0220003,0.086C13.1217108,9.6077375,15.5547476,11.0950832,18,10.559V8.3330002....C17.9978027,7.5977163,17.4022846,7.0021963,16.6669998,7L16.6669998,7z"/>...<path id="Path_1_" class="st2" d="M15.6669998,8H12.783c0.7725716,1.6288652,2.4142056,2.6671009,4.217,2

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 2, 2024 18:52:43.520610094 CEST	49671	443	192.168.2.7	204.79.197.203
Oct 2, 2024 18:52:44.677079916 CEST	49675	443	192.168.2.7	104.98.116.138
Oct 2, 2024 18:52:44.677128077 CEST	49674	443	192.168.2.7	104.98.116.138
Oct 2, 2024 18:52:44.723737001 CEST	49671	443	192.168.2.7	204.79.197.203
Oct 2, 2024 18:52:44.880040884 CEST	49672	443	192.168.2.7	104.98.116.138
Oct 2, 2024 18:52:47.129971027 CEST	49671	443	192.168.2.7	204.79.197.203
Oct 2, 2024 18:52:51.291925907 CEST	49677	443	192.168.2.7	20.50.201.200
Oct 2, 2024 18:52:51.723702908 CEST	49677	443	192.168.2.7	20.50.201.200
Oct 2, 2024 18:52:52.129919052 CEST	49671	443	192.168.2.7	204.79.197.203
Oct 2, 2024 18:52:52.518372059 CEST	49677	443	192.168.2.7	20.50.201.200
Oct 2, 2024 18:52:53.265022039 CEST	49705	443	192.168.2.7	208.75.122.11
Oct 2, 2024 18:52:53.265078068 CEST	443	49705	208.75.122.11	192.168.2.7
Oct 2, 2024 18:52:53.265141964 CEST	49705	443	192.168.2.7	208.75.122.11
Oct 2, 2024 18:52:53.265470028 CEST	49706	443	192.168.2.7	208.75.122.11
Oct 2, 2024 18:52:53.265480995 CEST	443	49706	208.75.122.11	192.168.2.7
Oct 2, 2024 18:52:53.265734911 CEST	49706	443	192.168.2.7	208.75.122.11
Oct 2, 2024 18:52:53.265975952 CEST	49706	443	192.168.2.7	208.75.122.11
Oct 2, 2024 18:52:53.265993118 CEST	443	49706	208.75.122.11	192.168.2.7
Oct 2, 2024 18:52:53.266091108 CEST	49705	443	192.168.2.7	208.75.122.11
Oct 2, 2024 18:52:53.266105890 CEST	443	49705	208.75.122.11	192.168.2.7
Oct 2, 2024 18:52:53.842643023 CEST	443	49706	208.75.122.11	192.168.2.7
Oct 2, 2024 18:52:53.842932940 CEST	49706	443	192.168.2.7	208.75.122.11
Oct 2, 2024 18:52:53.842962027 CEST	443	49706	208.75.122.11	192.168.2.7
Oct 2, 2024 18:52:53.843988895 CEST	443	49706	208.75.122.11	192.168.2.7
Oct 2, 2024 18:52:53.844057083 CEST	49706	443	192.168.2.7	208.75.122.11
Oct 2, 2024 18:52:53.845185995 CEST	49706	443	192.168.2.7	208.75.122.11
Oct 2, 2024 18:52:53.845236063 CEST	443	49706	208.75.122.11	192.168.2.7
Oct 2, 2024 18:52:53.845350027 CEST	49706	443	192.168.2.7	208.75.122.11
Oct 2, 2024 18:52:53.845357895 CEST	443	49706	208.75.122.11	192.168.2.7
Oct 2, 2024 18:52:53.859085083 CEST	443	49705	208.75.122.11	192.168.2.7
Oct 2, 2024 18:52:53.859325886 CEST	49705	443	192.168.2.7	208.75.122.11
Oct 2, 2024 18:52:53.859334946 CEST	443	49705	208.75.122.11	192.168.2.7
Oct 2, 2024 18:52:53.860325098 CEST	443	49705	208.75.122.11	192.168.2.7
Oct 2, 2024 18:52:53.860405922 CEST	49705	443	192.168.2.7	208.75.122.11
Oct 2, 2024 18:52:53.860961914 CEST	49705	443	192.168.2.7	208.75.122.11
Oct 2, 2024 18:52:53.861010075 CEST	443	49705	208.75.122.11	192.168.2.7
Oct 2, 2024 18:52:53.885178089 CEST	49706	443	192.168.2.7	208.75.122.11
Oct 2, 2024 18:52:53.915941954 CEST	49705	443	192.168.2.7	208.75.122.11
Oct 2, 2024 18:52:53.915975094 CEST	443	49705	208.75.122.11	192.168.2.7
Oct 2, 2024 18:52:53.961301088 CEST	443	49706	208.75.122.11	192.168.2.7
Oct 2, 2024 18:52:53.961396933 CEST	443	49706	208.75.122.11	192.168.2.7
Oct 2, 2024 18:52:53.961570978 CEST	49706	443	192.168.2.7	208.75.122.11
Oct 2, 2024 18:52:53.961658955 CEST	49705	443	192.168.2.7	208.75.122.11
Oct 2, 2024 18:52:53.963037014 CEST	49706	443	192.168.2.7	208.75.122.11
Oct 2, 2024 18:52:53.963053942 CEST	443	49706	208.75.122.11	192.168.2.7
Oct 2, 2024 18:52:53.971362114 CEST	49708	443	192.168.2.7	52.123.128.14
Oct 2, 2024 18:52:53.971421957 CEST	443	49708	52.123.128.14	192.168.2.7
Oct 2, 2024 18:52:53.971515894 CEST	49708	443	192.168.2.7	52.123.128.14
Oct 2, 2024 18:52:53.971699953 CEST	49708	443	192.168.2.7	52.123.128.14
Oct 2, 2024 18:52:53.971731901 CEST	443	49708	52.123.128.14	192.168.2.7
Oct 2, 2024 18:52:54.008125067 CEST	49677	443	192.168.2.7	20.50.201.200
Oct 2, 2024 18:52:54.282007933 CEST	49674	443	192.168.2.7	104.98.116.138
Oct 2, 2024 18:52:54.282119036 CEST	49675	443	192.168.2.7	104.98.116.138
Oct 2, 2024 18:52:54.485208988 CEST	49672	443	192.168.2.7	104.98.116.138
Oct 2, 2024 18:52:54.890736103 CEST	443	49708	52.123.128.14	192.168.2.7
Oct 2, 2024 18:52:54.891606092 CEST	49708	443	192.168.2.7	52.123.128.14
Oct 2, 2024 18:52:54.891679049 CEST	443	49708	52.123.128.14	192.168.2.7
Oct 2, 2024 18:52:54.892577887 CEST	443	49708	52.123.128.14	192.168.2.7
Oct 2, 2024 18:52:54.892662048 CEST	49708	443	192.168.2.7	52.123.128.14
Oct 2, 2024 18:52:54.900115967 CEST	49708	443	192.168.2.7	52.123.128.14
Oct 2, 2024 18:52:54.900202990 CEST	443	49708	52.123.128.14	192.168.2.7
Oct 2, 2024 18:52:54.900659084 CEST	49708	443	192.168.2.7	52.123.128.14
Oct 2, 2024 18:52:54.900681973 CEST	443	49708	52.123.128.14	192.168.2.7
Oct 2, 2024 18:52:54.945775032 CEST	49708	443	192.168.2.7	52.123.128.14
Oct 2, 2024 18:52:55.023437977 CEST	443	49708	52.123.128.14	192.168.2.7
Oct 2, 2024 18:52:55.023650885 CEST	443	49708	52.123.128.14	192.168.2.7
Oct 2, 2024 18:52:55.023721933 CEST	49708	443	192.168.2.7	52.123.128.14
Oct 2, 2024 18:52:55.031785965 CEST	49708	443	192.168.2.7	52.123.128.14
Oct 2, 2024 18:52:55.031806946 CEST	443	49708	52.123.128.14	192.168.2.7
Oct 2, 2024 18:52:55.036961079 CEST	49710	443	192.168.2.7	52.123.128.14
Oct 2, 2024 18:52:55.036997080 CEST	443	49710	52.123.128.14	192.168.2.7
Oct 2, 2024 18:52:55.037060022 CEST	49710	443	192.168.2.7	52.123.128.14
Oct 2, 2024 18:52:55.037549973 CEST	49710	443	192.168.2.7	52.123.128.14
Oct 2, 2024 18:52:55.037559986 CEST	443	49710	52.123.128.14	192.168.2.7
Oct 2, 2024 18:52:55.291163921 CEST	49711	443	192.168.2.7	142.250.184.196
Oct 2, 2024 18:52:55.291198015 CEST	443	49711	142.250.184.196	192.168.2.7
Oct 2, 2024 18:52:55.291251898 CEST	49711	443	192.168.2.7	142.250.184.196
Oct 2, 2024 18:52:55.291722059 CEST	49711	443	192.168.2.7	142.250.184.196
Oct 2, 2024 18:52:55.291734934 CEST	443	49711	142.250.184.196	192.168.2.7
Oct 2, 2024 18:52:55.605289936 CEST	443	49710	52.123.128.14	192.168.2.7
Oct 2, 2024 18:52:55.605570078 CEST	49710	443	192.168.2.7	52.123.128.14
Oct 2, 2024 18:52:55.605585098 CEST	443	49710	52.123.128.14	192.168.2.7
Oct 2, 2024 18:52:55.605917931 CEST	443	49710	52.123.128.14	192.168.2.7
Oct 2, 2024 18:52:55.606308937 CEST	49710	443	192.168.2.7	52.123.128.14
Oct 2, 2024 18:52:55.606373072 CEST	443	49710	52.123.128.14	192.168.2.7
Oct 2, 2024 18:52:55.606457949 CEST	49710	443	192.168.2.7	52.123.128.14
Oct 2, 2024 18:52:55.647403955 CEST	443	49710	52.123.128.14	192.168.2.7
Oct 2, 2024 18:52:55.726613998 CEST	443	49710	52.123.128.14	192.168.2.7
Oct 2, 2024 18:52:55.726690054 CEST	443	49710	52.123.128.14	192.168.2.7
Oct 2, 2024 18:52:55.726691008 CEST	49710	443	192.168.2.7	52.123.128.14
Oct 2, 2024 18:52:55.726710081 CEST	443	49710	52.123.128.14	192.168.2.7
Oct 2, 2024 18:52:55.726754904 CEST	49710	443	192.168.2.7	52.123.128.14
Oct 2, 2024 18:52:55.731056929 CEST	443	49710	52.123.128.14	192.168.2.7
Oct 2, 2024 18:52:55.731066942 CEST	443	49710	52.123.128.14	192.168.2.7
Oct 2, 2024 18:52:55.731120110 CEST	49710	443	192.168.2.7	52.123.128.14
Oct 2, 2024 18:52:55.731131077 CEST	443	49710	52.123.128.14	192.168.2.7
Oct 2, 2024 18:52:55.784995079 CEST	49710	443	192.168.2.7	52.123.128.14
Oct 2, 2024 18:52:55.813755035 CEST	443	49710	52.123.128.14	192.168.2.7
Oct 2, 2024 18:52:55.813770056 CEST	443	49710	52.123.128.14	192.168.2.7
Oct 2, 2024 18:52:55.813888073 CEST	49710	443	192.168.2.7	52.123.128.14
Oct 2, 2024 18:52:55.813901901 CEST	443	49710	52.123.128.14	192.168.2.7
Oct 2, 2024 18:52:55.813914061 CEST	443	49710	52.123.128.14	192.168.2.7
Oct 2, 2024 18:52:55.814229965 CEST	49710	443	192.168.2.7	52.123.128.14
Oct 2, 2024 18:52:55.814237118 CEST	443	49710	52.123.128.14	192.168.2.7
Oct 2, 2024 18:52:55.814266920 CEST	49710	443	192.168.2.7	52.123.128.14
Oct 2, 2024 18:52:55.814266920 CEST	49710	443	192.168.2.7	52.123.128.14
Oct 2, 2024 18:52:55.814352036 CEST	49710	443	192.168.2.7	52.123.128.14
Oct 2, 2024 18:52:55.944542885 CEST	443	49711	142.250.184.196	192.168.2.7
Oct 2, 2024 18:52:55.944801092 CEST	49711	443	192.168.2.7	142.250.184.196
Oct 2, 2024 18:52:55.944823980 CEST	443	49711	142.250.184.196	192.168.2.7
Oct 2, 2024 18:52:55.946297884 CEST	443	49711	142.250.184.196	192.168.2.7
Oct 2, 2024 18:52:55.947496891 CEST	49711	443	192.168.2.7	142.250.184.196
Oct 2, 2024 18:52:56.029454947 CEST	49711	443	192.168.2.7	142.250.184.196
Oct 2, 2024 18:52:56.029854059 CEST	443	49711	142.250.184.196	192.168.2.7
Oct 2, 2024 18:52:56.079438925 CEST	49711	443	192.168.2.7	142.250.184.196
Oct 2, 2024 18:52:56.079448938 CEST	443	49711	142.250.184.196	192.168.2.7
Oct 2, 2024 18:52:56.132318974 CEST	49711	443	192.168.2.7	142.250.184.196
Oct 2, 2024 18:52:56.520420074 CEST	49714	443	192.168.2.7	184.28.90.27
Oct 2, 2024 18:52:56.520473957 CEST	443	49714	184.28.90.27	192.168.2.7
Oct 2, 2024 18:52:56.521425009 CEST	49714	443	192.168.2.7	184.28.90.27
Oct 2, 2024 18:52:56.529550076 CEST	49714	443	192.168.2.7	184.28.90.27
Oct 2, 2024 18:52:56.529567003 CEST	443	49714	184.28.90.27	192.168.2.7
Oct 2, 2024 18:52:56.933132887 CEST	443	49699	104.98.116.138	192.168.2.7
Oct 2, 2024 18:52:56.933573961 CEST	49699	443	192.168.2.7	104.98.116.138
Oct 2, 2024 18:52:56.990058899 CEST	49677	443	192.168.2.7	20.50.201.200
Oct 2, 2024 18:52:57.174082041 CEST	443	49714	184.28.90.27	192.168.2.7
Oct 2, 2024 18:52:57.174166918 CEST	49714	443	192.168.2.7	184.28.90.27
Oct 2, 2024 18:52:57.183851004 CEST	49714	443	192.168.2.7	184.28.90.27
Oct 2, 2024 18:52:57.183870077 CEST	443	49714	184.28.90.27	192.168.2.7
Oct 2, 2024 18:52:57.184142113 CEST	443	49714	184.28.90.27	192.168.2.7
Oct 2, 2024 18:52:57.223834038 CEST	49714	443	192.168.2.7	184.28.90.27
Oct 2, 2024 18:52:57.264713049 CEST	49714	443	192.168.2.7	184.28.90.27
Oct 2, 2024 18:52:57.311418056 CEST	443	49714	184.28.90.27	192.168.2.7
Oct 2, 2024 18:52:57.450463057 CEST	443	49714	184.28.90.27	192.168.2.7
Oct 2, 2024 18:52:57.450519085 CEST	443	49714	184.28.90.27	192.168.2.7
Oct 2, 2024 18:52:57.450570107 CEST	49714	443	192.168.2.7	184.28.90.27
Oct 2, 2024 18:52:57.450685024 CEST	49714	443	192.168.2.7	184.28.90.27
Oct 2, 2024 18:52:57.450705051 CEST	443	49714	184.28.90.27	192.168.2.7
Oct 2, 2024 18:52:57.495805979 CEST	49715	443	192.168.2.7	184.28.90.27
Oct 2, 2024 18:52:57.495860100 CEST	443	49715	184.28.90.27	192.168.2.7
Oct 2, 2024 18:52:57.495964050 CEST	49715	443	192.168.2.7	184.28.90.27
Oct 2, 2024 18:52:57.496226072 CEST	49715	443	192.168.2.7	184.28.90.27
Oct 2, 2024 18:52:57.496237040 CEST	443	49715	184.28.90.27	192.168.2.7
Oct 2, 2024 18:52:58.142697096 CEST	443	49715	184.28.90.27	192.168.2.7
Oct 2, 2024 18:52:58.142798901 CEST	49715	443	192.168.2.7	184.28.90.27
Oct 2, 2024 18:52:58.145591021 CEST	49715	443	192.168.2.7	184.28.90.27
Oct 2, 2024 18:52:58.145613909 CEST	443	49715	184.28.90.27	192.168.2.7
Oct 2, 2024 18:52:58.145867109 CEST	443	49715	184.28.90.27	192.168.2.7
Oct 2, 2024 18:52:58.151932955 CEST	49715	443	192.168.2.7	184.28.90.27
Oct 2, 2024 18:52:58.199409008 CEST	443	49715	184.28.90.27	192.168.2.7
Oct 2, 2024 18:52:58.422076941 CEST	443	49715	184.28.90.27	192.168.2.7
Oct 2, 2024 18:52:58.422175884 CEST	443	49715	184.28.90.27	192.168.2.7
Oct 2, 2024 18:52:58.422243118 CEST	49715	443	192.168.2.7	184.28.90.27
Oct 2, 2024 18:52:58.424390078 CEST	49715	443	192.168.2.7	184.28.90.27
Oct 2, 2024 18:52:58.424416065 CEST	443	49715	184.28.90.27	192.168.2.7
Oct 2, 2024 18:52:58.424428940 CEST	49715	443	192.168.2.7	184.28.90.27
Oct 2, 2024 18:52:58.424434900 CEST	443	49715	184.28.90.27	192.168.2.7
Oct 2, 2024 18:53:00.118534088 CEST	49717	443	192.168.2.7	52.123.128.14
Oct 2, 2024 18:53:00.118603945 CEST	443	49717	52.123.128.14	192.168.2.7
Oct 2, 2024 18:53:00.118669033 CEST	49717	443	192.168.2.7	52.123.128.14
Oct 2, 2024 18:53:00.119151115 CEST	49718	443	192.168.2.7	52.123.128.14
Oct 2, 2024 18:53:00.119158030 CEST	443	49718	52.123.128.14	192.168.2.7
Oct 2, 2024 18:53:00.119205952 CEST	49718	443	192.168.2.7	52.123.128.14
Oct 2, 2024 18:53:00.121222019 CEST	49717	443	192.168.2.7	52.123.128.14
Oct 2, 2024 18:53:00.121238947 CEST	443	49717	52.123.128.14	192.168.2.7
Oct 2, 2024 18:53:00.121439934 CEST	49718	443	192.168.2.7	52.123.128.14
Oct 2, 2024 18:53:00.121449947 CEST	443	49718	52.123.128.14	192.168.2.7
Oct 2, 2024 18:53:00.679791927 CEST	443	49718	52.123.128.14	192.168.2.7
Oct 2, 2024 18:53:00.690907001 CEST	49718	443	192.168.2.7	52.123.128.14
Oct 2, 2024 18:53:00.690967083 CEST	443	49718	52.123.128.14	192.168.2.7
Oct 2, 2024 18:53:00.694968939 CEST	443	49718	52.123.128.14	192.168.2.7
Oct 2, 2024 18:53:00.695074081 CEST	49718	443	192.168.2.7	52.123.128.14
Oct 2, 2024 18:53:00.696146965 CEST	49718	443	192.168.2.7	52.123.128.14
Oct 2, 2024 18:53:00.696361065 CEST	443	49718	52.123.128.14	192.168.2.7
Oct 2, 2024 18:53:00.703254938 CEST	49718	443	192.168.2.7	52.123.128.14
Oct 2, 2024 18:53:00.703290939 CEST	443	49718	52.123.128.14	192.168.2.7
Oct 2, 2024 18:53:00.709913015 CEST	443	49717	52.123.128.14	192.168.2.7
Oct 2, 2024 18:53:00.712608099 CEST	49717	443	192.168.2.7	52.123.128.14
Oct 2, 2024 18:53:00.712626934 CEST	443	49717	52.123.128.14	192.168.2.7
Oct 2, 2024 18:53:00.713785887 CEST	443	49717	52.123.128.14	192.168.2.7
Oct 2, 2024 18:53:00.713872910 CEST	49717	443	192.168.2.7	52.123.128.14
Oct 2, 2024 18:53:00.715296984 CEST	49717	443	192.168.2.7	52.123.128.14
Oct 2, 2024 18:53:00.715394020 CEST	443	49717	52.123.128.14	192.168.2.7
Oct 2, 2024 18:53:00.715559006 CEST	49717	443	192.168.2.7	52.123.128.14
Oct 2, 2024 18:53:00.715574026 CEST	443	49717	52.123.128.14	192.168.2.7
Oct 2, 2024 18:53:00.756160021 CEST	49717	443	192.168.2.7	52.123.128.14
Oct 2, 2024 18:53:00.756160975 CEST	49718	443	192.168.2.7	52.123.128.14
Oct 2, 2024 18:53:00.900417089 CEST	443	49717	52.123.128.14	192.168.2.7
Oct 2, 2024 18:53:00.900902033 CEST	443	49717	52.123.128.14	192.168.2.7
Oct 2, 2024 18:53:00.901005983 CEST	49717	443	192.168.2.7	52.123.128.14
Oct 2, 2024 18:53:00.901458979 CEST	49717	443	192.168.2.7	52.123.128.14
Oct 2, 2024 18:53:00.901494980 CEST	443	49717	52.123.128.14	192.168.2.7
Oct 2, 2024 18:53:00.916043997 CEST	49723	443	192.168.2.7	52.123.128.14
Oct 2, 2024 18:53:00.916080952 CEST	443	49723	52.123.128.14	192.168.2.7
Oct 2, 2024 18:53:00.916172028 CEST	49723	443	192.168.2.7	52.123.128.14
Oct 2, 2024 18:53:00.916390896 CEST	49723	443	192.168.2.7	52.123.128.14
Oct 2, 2024 18:53:00.916403055 CEST	443	49723	52.123.128.14	192.168.2.7
Oct 2, 2024 18:53:01.112585068 CEST	443	49718	52.123.128.14	192.168.2.7
Oct 2, 2024 18:53:01.112675905 CEST	443	49718	52.123.128.14	192.168.2.7
Oct 2, 2024 18:53:01.112806082 CEST	49718	443	192.168.2.7	52.123.128.14
Oct 2, 2024 18:53:01.113591909 CEST	49718	443	192.168.2.7	52.123.128.14
Oct 2, 2024 18:53:01.113620996 CEST	443	49718	52.123.128.14	192.168.2.7
Oct 2, 2024 18:53:01.120814085 CEST	49727	443	192.168.2.7	52.123.128.14
Oct 2, 2024 18:53:01.120851994 CEST	443	49727	52.123.128.14	192.168.2.7
Oct 2, 2024 18:53:01.120909929 CEST	49727	443	192.168.2.7	52.123.128.14
Oct 2, 2024 18:53:01.121133089 CEST	49727	443	192.168.2.7	52.123.128.14
Oct 2, 2024 18:53:01.121145964 CEST	443	49727	52.123.128.14	192.168.2.7
Oct 2, 2024 18:53:01.472992897 CEST	443	49723	52.123.128.14	192.168.2.7
Oct 2, 2024 18:53:01.473284006 CEST	49723	443	192.168.2.7	52.123.128.14
Oct 2, 2024 18:53:01.473304987 CEST	443	49723	52.123.128.14	192.168.2.7
Oct 2, 2024 18:53:01.474720001 CEST	443	49723	52.123.128.14	192.168.2.7
Oct 2, 2024 18:53:01.475130081 CEST	49723	443	192.168.2.7	52.123.128.14
Oct 2, 2024 18:53:01.475130081 CEST	49723	443	192.168.2.7	52.123.128.14
Oct 2, 2024 18:53:01.475212097 CEST	443	49723	52.123.128.14	192.168.2.7
Oct 2, 2024 18:53:01.475272894 CEST	49723	443	192.168.2.7	52.123.128.14
Oct 2, 2024 18:53:01.519408941 CEST	443	49723	52.123.128.14	192.168.2.7
Oct 2, 2024 18:53:01.522330999 CEST	49723	443	192.168.2.7	52.123.128.14
Oct 2, 2024 18:53:01.522350073 CEST	443	49723	52.123.128.14	192.168.2.7
Oct 2, 2024 18:53:01.569183111 CEST	49723	443	192.168.2.7	52.123.128.14
Oct 2, 2024 18:53:01.636610985 CEST	443	49723	52.123.128.14	192.168.2.7
Oct 2, 2024 18:53:01.636699915 CEST	443	49723	52.123.128.14	192.168.2.7
Oct 2, 2024 18:53:01.636802912 CEST	49723	443	192.168.2.7	52.123.128.14
Oct 2, 2024 18:53:01.637487888 CEST	49723	443	192.168.2.7	52.123.128.14
Oct 2, 2024 18:53:01.637511969 CEST	443	49723	52.123.128.14	192.168.2.7
Oct 2, 2024 18:53:01.719959974 CEST	443	49727	52.123.128.14	192.168.2.7
Oct 2, 2024 18:53:01.720350981 CEST	49727	443	192.168.2.7	52.123.128.14
Oct 2, 2024 18:53:01.720391989 CEST	443	49727	52.123.128.14	192.168.2.7
Oct 2, 2024 18:53:01.721399069 CEST	443	49727	52.123.128.14	192.168.2.7
Oct 2, 2024 18:53:01.721512079 CEST	49727	443	192.168.2.7	52.123.128.14
Oct 2, 2024 18:53:01.721879959 CEST	49727	443	192.168.2.7	52.123.128.14
Oct 2, 2024 18:53:01.721951962 CEST	443	49727	52.123.128.14	192.168.2.7
Oct 2, 2024 18:53:01.722215891 CEST	49727	443	192.168.2.7	52.123.128.14
Oct 2, 2024 18:53:01.722234964 CEST	443	49727	52.123.128.14	192.168.2.7
Oct 2, 2024 18:53:01.739504099 CEST	49671	443	192.168.2.7	204.79.197.203
Oct 2, 2024 18:53:01.770751953 CEST	49727	443	192.168.2.7	52.123.128.14
Oct 2, 2024 18:53:01.970587015 CEST	443	49727	52.123.128.14	192.168.2.7
Oct 2, 2024 18:53:01.971229076 CEST	443	49727	52.123.128.14	192.168.2.7
Oct 2, 2024 18:53:01.971282959 CEST	49727	443	192.168.2.7	52.123.128.14
Oct 2, 2024 18:53:01.971674919 CEST	49727	443	192.168.2.7	52.123.128.14
Oct 2, 2024 18:53:01.971687078 CEST	443	49727	52.123.128.14	192.168.2.7
Oct 2, 2024 18:53:02.957794905 CEST	49677	443	192.168.2.7	20.50.201.200
Oct 2, 2024 18:53:05.371716022 CEST	49699	443	192.168.2.7	104.98.116.138
Oct 2, 2024 18:53:05.373354912 CEST	49735	443	192.168.2.7	104.98.116.138
Oct 2, 2024 18:53:05.373415947 CEST	443	49735	104.98.116.138	192.168.2.7
Oct 2, 2024 18:53:05.373492956 CEST	49735	443	192.168.2.7	104.98.116.138
Oct 2, 2024 18:53:05.376916885 CEST	443	49699	104.98.116.138	192.168.2.7
Oct 2, 2024 18:53:05.383291960 CEST	49735	443	192.168.2.7	104.98.116.138
Oct 2, 2024 18:53:05.383332968 CEST	443	49735	104.98.116.138	192.168.2.7
Oct 2, 2024 18:53:05.707433939 CEST	49736	443	192.168.2.7	52.123.128.14
Oct 2, 2024 18:53:05.707480907 CEST	443	49736	52.123.128.14	192.168.2.7
Oct 2, 2024 18:53:05.707540989 CEST	49736	443	192.168.2.7	52.123.128.14
Oct 2, 2024 18:53:05.708431005 CEST	49737	443	192.168.2.7	52.123.128.14
Oct 2, 2024 18:53:05.708473921 CEST	443	49737	52.123.128.14	192.168.2.7
Oct 2, 2024 18:53:05.708547115 CEST	49737	443	192.168.2.7	52.123.128.14
Oct 2, 2024 18:53:05.712790966 CEST	49737	443	192.168.2.7	52.123.128.14
Oct 2, 2024 18:53:05.712800980 CEST	443	49737	52.123.128.14	192.168.2.7
Oct 2, 2024 18:53:05.713120937 CEST	49736	443	192.168.2.7	52.123.128.14
Oct 2, 2024 18:53:05.713144064 CEST	443	49736	52.123.128.14	192.168.2.7
Oct 2, 2024 18:53:05.832036018 CEST	443	49711	142.250.184.196	192.168.2.7
Oct 2, 2024 18:53:05.832212925 CEST	443	49711	142.250.184.196	192.168.2.7
Oct 2, 2024 18:53:05.832273960 CEST	49711	443	192.168.2.7	142.250.184.196
Oct 2, 2024 18:53:05.877079010 CEST	49711	443	192.168.2.7	142.250.184.196
Oct 2, 2024 18:53:05.877100945 CEST	443	49711	142.250.184.196	192.168.2.7
Oct 2, 2024 18:53:06.263905048 CEST	443	49736	52.123.128.14	192.168.2.7
Oct 2, 2024 18:53:06.264148951 CEST	49736	443	192.168.2.7	52.123.128.14
Oct 2, 2024 18:53:06.264166117 CEST	443	49736	52.123.128.14	192.168.2.7
Oct 2, 2024 18:53:06.264533043 CEST	443	49736	52.123.128.14	192.168.2.7
Oct 2, 2024 18:53:06.264939070 CEST	49736	443	192.168.2.7	52.123.128.14
Oct 2, 2024 18:53:06.265001059 CEST	443	49736	52.123.128.14	192.168.2.7
Oct 2, 2024 18:53:06.265110016 CEST	49736	443	192.168.2.7	52.123.128.14
Oct 2, 2024 18:53:06.307403088 CEST	443	49736	52.123.128.14	192.168.2.7
Oct 2, 2024 18:53:06.309278011 CEST	443	49737	52.123.128.14	192.168.2.7
Oct 2, 2024 18:53:06.309556007 CEST	49737	443	192.168.2.7	52.123.128.14
Oct 2, 2024 18:53:06.309628010 CEST	443	49737	52.123.128.14	192.168.2.7
Oct 2, 2024 18:53:06.309994936 CEST	443	49737	52.123.128.14	192.168.2.7
Oct 2, 2024 18:53:06.310523987 CEST	49737	443	192.168.2.7	52.123.128.14
Oct 2, 2024 18:53:06.310602903 CEST	443	49737	52.123.128.14	192.168.2.7
Oct 2, 2024 18:53:06.352895021 CEST	49737	443	192.168.2.7	52.123.128.14
Oct 2, 2024 18:53:06.388578892 CEST	443	49736	52.123.128.14	192.168.2.7
Oct 2, 2024 18:53:06.388603926 CEST	443	49736	52.123.128.14	192.168.2.7
Oct 2, 2024 18:53:06.388655901 CEST	49736	443	192.168.2.7	52.123.128.14
Oct 2, 2024 18:53:06.388673067 CEST	443	49736	52.123.128.14	192.168.2.7
Oct 2, 2024 18:53:06.388716936 CEST	49736	443	192.168.2.7	52.123.128.14
Oct 2, 2024 18:53:06.389131069 CEST	443	49736	52.123.128.14	192.168.2.7
Oct 2, 2024 18:53:06.389138937 CEST	443	49736	52.123.128.14	192.168.2.7
Oct 2, 2024 18:53:06.389183044 CEST	49736	443	192.168.2.7	52.123.128.14
Oct 2, 2024 18:53:06.389190912 CEST	443	49736	52.123.128.14	192.168.2.7
Oct 2, 2024 18:53:06.393497944 CEST	443	49736	52.123.128.14	192.168.2.7
Oct 2, 2024 18:53:06.393565893 CEST	49736	443	192.168.2.7	52.123.128.14
Oct 2, 2024 18:53:06.393573999 CEST	443	49736	52.123.128.14	192.168.2.7
Oct 2, 2024 18:53:06.393737078 CEST	443	49736	52.123.128.14	192.168.2.7
Oct 2, 2024 18:53:06.393784046 CEST	49736	443	192.168.2.7	52.123.128.14
Oct 2, 2024 18:53:06.393788099 CEST	443	49736	52.123.128.14	192.168.2.7
Oct 2, 2024 18:53:06.393815041 CEST	443	49736	52.123.128.14	192.168.2.7
Oct 2, 2024 18:53:06.393857002 CEST	49736	443	192.168.2.7	52.123.128.14
Oct 2, 2024 18:53:06.394010067 CEST	49736	443	192.168.2.7	52.123.128.14
Oct 2, 2024 18:53:06.394026041 CEST	443	49736	52.123.128.14	192.168.2.7
Oct 2, 2024 18:53:06.508096933 CEST	49737	443	192.168.2.7	52.123.128.14
Oct 2, 2024 18:53:06.555411100 CEST	443	49737	52.123.128.14	192.168.2.7
Oct 2, 2024 18:53:06.775940895 CEST	443	49737	52.123.128.14	192.168.2.7
Oct 2, 2024 18:53:06.776143074 CEST	443	49737	52.123.128.14	192.168.2.7
Oct 2, 2024 18:53:06.776209116 CEST	49737	443	192.168.2.7	52.123.128.14
Oct 2, 2024 18:53:06.792606115 CEST	49737	443	192.168.2.7	52.123.128.14
Oct 2, 2024 18:53:06.792627096 CEST	443	49737	52.123.128.14	192.168.2.7
Oct 2, 2024 18:53:10.781996965 CEST	54835	53	192.168.2.7	1.1.1.1
Oct 2, 2024 18:53:10.786823034 CEST	53	54835	1.1.1.1	192.168.2.7
Oct 2, 2024 18:53:10.786906958 CEST	54835	53	192.168.2.7	1.1.1.1
Oct 2, 2024 18:53:10.786952972 CEST	54835	53	192.168.2.7	1.1.1.1
Oct 2, 2024 18:53:10.791776896 CEST	53	54835	1.1.1.1	192.168.2.7
Oct 2, 2024 18:53:11.231004000 CEST	53	54835	1.1.1.1	192.168.2.7
Oct 2, 2024 18:53:11.232223034 CEST	54835	53	192.168.2.7	1.1.1.1
Oct 2, 2024 18:53:11.237401009 CEST	53	54835	1.1.1.1	192.168.2.7
Oct 2, 2024 18:53:11.237466097 CEST	54835	53	192.168.2.7	1.1.1.1
Oct 2, 2024 18:53:14.866411924 CEST	49677	443	192.168.2.7	20.50.201.200
Oct 2, 2024 18:53:38.926728010 CEST	49705	443	192.168.2.7	208.75.122.11
Oct 2, 2024 18:53:38.926759958 CEST	443	49705	208.75.122.11	192.168.2.7
Oct 2, 2024 18:53:48.519501925 CEST	443	49735	104.98.116.138	192.168.2.7
Oct 2, 2024 18:53:48.519684076 CEST	49735	443	192.168.2.7	104.98.116.138
Oct 2, 2024 18:53:54.969573975 CEST	49705	443	192.168.2.7	208.75.122.11
Oct 2, 2024 18:53:54.969723940 CEST	443	49705	208.75.122.11	192.168.2.7
Oct 2, 2024 18:53:54.969800949 CEST	49705	443	192.168.2.7	208.75.122.11
Oct 2, 2024 18:53:55.335366964 CEST	54838	443	192.168.2.7	142.250.184.196
Oct 2, 2024 18:53:55.335489988 CEST	443	54838	142.250.184.196	192.168.2.7
Oct 2, 2024 18:53:55.335582018 CEST	54838	443	192.168.2.7	142.250.184.196
Oct 2, 2024 18:53:55.335834980 CEST	54838	443	192.168.2.7	142.250.184.196
Oct 2, 2024 18:53:55.335872889 CEST	443	54838	142.250.184.196	192.168.2.7
Oct 2, 2024 18:53:56.294554949 CEST	443	54838	142.250.184.196	192.168.2.7
Oct 2, 2024 18:53:56.295816898 CEST	54838	443	192.168.2.7	142.250.184.196
Oct 2, 2024 18:53:56.295841932 CEST	443	54838	142.250.184.196	192.168.2.7
Oct 2, 2024 18:53:56.296452999 CEST	443	54838	142.250.184.196	192.168.2.7
Oct 2, 2024 18:53:56.297091007 CEST	54838	443	192.168.2.7	142.250.184.196
Oct 2, 2024 18:53:56.297166109 CEST	443	54838	142.250.184.196	192.168.2.7
Oct 2, 2024 18:53:56.349487066 CEST	54838	443	192.168.2.7	142.250.184.196
Oct 2, 2024 18:54:05.899832010 CEST	443	54838	142.250.184.196	192.168.2.7
Oct 2, 2024 18:54:05.899894953 CEST	443	54838	142.250.184.196	192.168.2.7
Oct 2, 2024 18:54:05.900115013 CEST	54838	443	192.168.2.7	142.250.184.196
Oct 2, 2024 18:54:08.727431059 CEST	54838	443	192.168.2.7	142.250.184.196
Oct 2, 2024 18:54:08.727467060 CEST	443	54838	142.250.184.196	192.168.2.7

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 2, 2024 18:52:51.143333912 CEST	53	61055	1.1.1.1	192.168.2.7
Oct 2, 2024 18:52:51.454710007 CEST	53	53223	1.1.1.1	192.168.2.7
Oct 2, 2024 18:52:52.675478935 CEST	53	59052	1.1.1.1	192.168.2.7
Oct 2, 2024 18:52:53.250664949 CEST	59840	53	192.168.2.7	1.1.1.1
Oct 2, 2024 18:52:53.250893116 CEST	50667	53	192.168.2.7	1.1.1.1
Oct 2, 2024 18:52:53.260061026 CEST	53	50667	1.1.1.1	192.168.2.7
Oct 2, 2024 18:52:53.260086060 CEST	53	59840	1.1.1.1	192.168.2.7
Oct 2, 2024 18:52:55.281644106 CEST	62730	53	192.168.2.7	1.1.1.1
Oct 2, 2024 18:52:55.281644106 CEST	63941	53	192.168.2.7	1.1.1.1
Oct 2, 2024 18:52:55.288645029 CEST	53	63941	1.1.1.1	192.168.2.7
Oct 2, 2024 18:52:55.288707018 CEST	53	62730	1.1.1.1	192.168.2.7
Oct 2, 2024 18:52:55.880207062 CEST	123	123	192.168.2.7	20.101.57.9
Oct 2, 2024 18:52:56.437290907 CEST	123	123	20.101.57.9	192.168.2.7
Oct 2, 2024 18:52:57.427187920 CEST	123	123	192.168.2.7	20.101.57.9
Oct 2, 2024 18:52:57.599889040 CEST	123	123	20.101.57.9	192.168.2.7
Oct 2, 2024 18:53:10.216912985 CEST	53	63188	1.1.1.1	192.168.2.7
Oct 2, 2024 18:53:10.781610966 CEST	53	63350	1.1.1.1	192.168.2.7
Oct 2, 2024 18:53:29.062777042 CEST	53	57698	1.1.1.1	192.168.2.7
Oct 2, 2024 18:53:51.036937952 CEST	53	49393	1.1.1.1	192.168.2.7
Oct 2, 2024 18:53:51.630445004 CEST	53	64801	1.1.1.1	192.168.2.7
Oct 2, 2024 18:53:51.647475958 CEST	138	138	192.168.2.7	192.168.2.255
Oct 2, 2024 18:54:20.694401026 CEST	53	53081	1.1.1.1	192.168.2.7

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 2, 2024 18:52:53.250664949 CEST	192.168.2.7	1.1.1.1	0x74e1	Standard query (0)	husgu4aab.cc.rs6.net	A (IP address)	IN (0x0001)	false
Oct 2, 2024 18:52:53.250893116 CEST	192.168.2.7	1.1.1.1	0xa9bb	Standard query (0)	husgu4aab.cc.rs6.net	65	IN (0x0001)	false
Oct 2, 2024 18:52:55.281644106 CEST	192.168.2.7	1.1.1.1	0x5c3b	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Oct 2, 2024 18:52:55.281644106 CEST	192.168.2.7	1.1.1.1	0xbd1e	Standard query (0)	www.google.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 2, 2024 18:52:53.260086060 CEST	1.1.1.1	192.168.2.7	0x74e1	No error (0)	husgu4aab.cc.rs6.net		208.75.122.11	A (IP address)	IN (0x0001)	false
Oct 2, 2024 18:52:53.970541000 CEST	1.1.1.1	192.168.2.7	0x6b2c	No error (0)	teams.office.com	tmc-g2.tm-4.office.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 2, 2024 18:52:53.970541000 CEST	1.1.1.1	192.168.2.7	0x6b2c	No error (0)	tmc-g2.tm-4.office.com	teams-office-com.s-0005.dual-s-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 2, 2024 18:52:53.970541000 CEST	1.1.1.1	192.168.2.7	0x6b2c	No error (0)	teams-office-com.s-0005.dual-s-msedge.net	s-0005.dual-s-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 2, 2024 18:52:53.970541000 CEST	1.1.1.1	192.168.2.7	0x6b2c	No error (0)	s-0005.dual-s-msedge.net		52.123.128.14	A (IP address)	IN (0x0001)	false
Oct 2, 2024 18:52:53.970541000 CEST	1.1.1.1	192.168.2.7	0x6b2c	No error (0)	s-0005.dual-s-msedge.net		52.123.129.14	A (IP address)	IN (0x0001)	false
Oct 2, 2024 18:52:53.970982075 CEST	1.1.1.1	192.168.2.7	0xaba4	No error (0)	teams.office.com	tmc-g2.tm-4.office.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 2, 2024 18:52:55.288645029 CEST	1.1.1.1	192.168.2.7	0xbd1e	No error (0)	www.google.com			65	IN (0x0001)	false
Oct 2, 2024 18:52:55.288707018 CEST	1.1.1.1	192.168.2.7	0x5c3b	No error (0)	www.google.com		142.250.184.196	A (IP address)	IN (0x0001)	false
Oct 2, 2024 18:53:00.911751032 CEST	1.1.1.1	192.168.2.7	0x6f9b	No error (0)	teams.office.com	tmc-g2.tm-4.office.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 2, 2024 18:53:00.911751032 CEST	1.1.1.1	192.168.2.7	0x6f9b	No error (0)	tmc-g2.tm-4.office.com	teams-office-com.s-0005.dual-s-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 2, 2024 18:53:00.915606022 CEST	1.1.1.1	192.168.2.7	0xa7fc	No error (0)	teams.office.com	tmc-g2.tm-4.office.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 2, 2024 18:53:00.915606022 CEST	1.1.1.1	192.168.2.7	0xa7fc	No error (0)	tmc-g2.tm-4.office.com	teams-office-com.s-0005.dual-s-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 2, 2024 18:53:00.915606022 CEST	1.1.1.1	192.168.2.7	0xa7fc	No error (0)	teams-office-com.s-0005.dual-s-msedge.net	s-0005.dual-s-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 2, 2024 18:53:00.915606022 CEST	1.1.1.1	192.168.2.7	0xa7fc	No error (0)	s-0005.dual-s-msedge.net		52.123.128.14	A (IP address)	IN (0x0001)	false
Oct 2, 2024 18:53:00.915606022 CEST	1.1.1.1	192.168.2.7	0xa7fc	No error (0)	s-0005.dual-s-msedge.net		52.123.129.14	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

husgu4aab.cc.rs6.net

teams.microsoft.com

fs.microsoft.com

https:

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49706	208.75.122.11	443	6672	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 16:52:53 UTC	1298	OUT	GET /tn.jsp?f=001Kgt4Y2UB61RJ-8HwGvpJdBIbmN2KmnsaQqGoOmBznZv-sZNQDwRSSQ7g-eK51O4by9IOD2KnWORRgU0x0E3aNqtENPlCG9IRkHoovRH87tIhjQapV8qvGaEivg08QWSvEYUiMWZbUAA5F-TBphmYo54Yji4b0P6N0DJh_NbVO20TarWgnPQ3SuLKbE7xetLRM8vyBQFA3FDAk2Yb7PHHNhkTNOnLAjlPaIIitR9YG-b5PWKzzl53xiiNEfQzHPo5f_HVv0eLJVI13jaoVLCWlUD41vb-4jiIEzxYy7L3VVF3KxBtVO6BE2E1jRiUdWGiYagIkSTi87BHv9cWMOqrRRElHJKtM_LH7LWPcyQYm-e7t7Np0yuIiSG2a7kcUa83fxnFKBlD3XQWk3tBK_A6UHfOpVtGfh58aA3wMAw29cIbI5nWpV6ItQSoKR9GlwPgZ9_RwLBJtBRlGly3vddfujNsc6LR0pWXaYSrJULantDqQJ_4b9XaCQ==&c=IyjvwkVNXkSM3EQNeu1AFyYVkMBKrNrka4UrFHY9Xgi8_nQQx7j-YA==&ch=Kpqbu5OxQl-CnKQeZK4xThguts9KPf_lvJrsntwD6ZjuGxnpSh2o9w== HTTP/1.1 Host: husgu4aab.cc.rs6.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-02 16:52:53 UTC	561	IN	HTTP/1.1 302 Found Date: Wed, 02 Oct 2024 16:52:53 GMT Server: Apache P3P: CP="CAO DSP TAIa OUR NOR UNI" Location: https://teams.microsoft.com/l/meetup-join/19%3Ameeting_MmE0NjAzMTAtYzgyMS00MDliLWE1YTUtZjJhZmM1ZGY4YzZh%40thread.v2/0?context=%7B%22Tid%22%3A%221a40aa3f-1477-4f8f-980e-9c88fa937847%22%2C%22Oid%22%3A%22b08fca2d-a34f-492c-bc56-309cea6ba5ef%22%7D Content-Length: 0 Cache-Control: private, no-cache, no-store, max-age=0, must-revalidate, no-cache="Set-Cookie" Pragma: no-cache Connection: close Content-Type: text/html;charset=ISO-8859-1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	49708	52.123.128.14	443	6672	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 16:52:54 UTC	877	OUT	GET /l/meetup-join/19%3Ameeting_MmE0NjAzMTAtYzgyMS00MDliLWE1YTUtZjJhZmM1ZGY4YzZh%40thread.v2/0?context=%7B%22Tid%22%3A%221a40aa3f-1477-4f8f-980e-9c88fa937847%22%2C%22Oid%22%3A%22b08fca2d-a34f-492c-bc56-309cea6ba5ef%22%7D HTTP/1.1 Host: teams.microsoft.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-02 16:52:55 UTC	1133	IN	HTTP/1.1 302 Found Location: /dl/launcher/launcher.html?url=%2F_%23%2Fl%2Fmeetup-join%2F19%3Ameeting_MmE0NjAzMTAtYzgyMS00MDliLWE1YTUtZjJhZmM1ZGY4YzZh%40thread.v2%2F0%3Fcontext%3D%257B%2522Tid%2522%253A%25221a40aa3f-1477-4f8f-980e-9c88fa937847%2522%252C%2522Oid%2522%253A%2522b08fca2d-a34f-492c-bc56-309cea6ba5ef%2522%257D%26anon%3Dtrue&type=meetup-join&deeplinkId=f35de3fe-1833-4040-a2d1-3b28cea1b10c&directDl=true&msLaunch=true&enableMobilePage=true strict-transport-security: max-age=2592000 x-ring-info: web: general [assigned], mt: general [assigned] requestid: 492bbe0f320b0950515d4311edc00edb x-content-type-options: nosniff timing-allow-origin: * x-xss-protection: 1; mode=block x-frame-options: SAMEORIGIN x-envoy-upstream-service-time: 19 x-request-id: abfc61ee-021e-4ffa-91b5-d4835ab163e1 X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: 9F07F655AB23415599DE913CA4876081 Ref B: EWR30EDGE1419 Ref C: 2024-10-02T16:52:54Z Set-Cookie: MUIDB=0B6624FFE9C26969214A31F3E86A685B; path=/; httponly; secure; expires=Mon, 27-Oct-2025 16:52:54 GMT Date: Wed, 02 Oct 2024 16:52:54 GMT Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.7	49710	52.123.128.14	443	6672	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 16:52:55 UTC	1130	OUT	GET /dl/launcher/launcher.html?url=%2F_%23%2Fl%2Fmeetup-join%2F19%3Ameeting_MmE0NjAzMTAtYzgyMS00MDliLWE1YTUtZjJhZmM1ZGY4YzZh%40thread.v2%2F0%3Fcontext%3D%257B%2522Tid%2522%253A%25221a40aa3f-1477-4f8f-980e-9c88fa937847%2522%252C%2522Oid%2522%253A%2522b08fca2d-a34f-492c-bc56-309cea6ba5ef%2522%257D%26anon%3Dtrue&type=meetup-join&deeplinkId=f35de3fe-1833-4040-a2d1-3b28cea1b10c&directDl=true&msLaunch=true&enableMobilePage=true HTTP/1.1 Host: teams.microsoft.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: MUIDB=0B6624FFE9C26969214A31F3E86A685B
2024-10-02 16:52:55 UTC	5076	IN	HTTP/1.1 200 OK Content-Length: 17769 Content-Type: text/html; charset=utf-8 Set-Cookie: clocale=en-us; expires=Thu, 02 Oct 2025 16:52:55 GMT; path=/;Partitioned; secure; httponly strict-transport-security: max-age=2592000 x-ring-info: web: general [assigned], mt: general [assigned] content-security-policy: block-all-mixed-content ; base-uri 'self' .protection.outlook.com; child-src 'self' https: data: blob:; connect-src 'self' blob: https: data: wss://.delve.office.com:443 wss://.dc.trouter.io:443 wss://.trouter.io:443 wss://.broadcast.skype.com:443 wss://.tip.skype.net:443 wss://.cortana.ai:443 wss://.customspeech.ai:443 wss://.cts.speech.microsoft.com:443 wss://speech.platform.bing.com:443 wss://.teams.microsoft.com:443 wss://.ecdn.microsoft.com:443 wss://.pptservicescast.officeapps.live.com wss://pptservicescast.officeapps.live.com wss://pptservicescast.gcc.osi.office365.us wss://pptservicescast.osi.office365.us wss://.pptservicescast.edog.officeapps.live.com wss://pptservicescast.edog.officeapps.live.com wss://.stateservice.officeapps.live.com wss://stateservice.officeapps.live.com wss://stateservice.gcc.osi.office365.us wss://stateservice.osi.office365.us wss://.stateservice.edog.officeapps.live.com wss://.hivestreaming.com:443 wss://.kollective.app:443 wss://.kol [TRUNCATED] requestid: f8096fd0bbcfa9e8917446a52d6a2513 x-content-type-options: nosniff timing-allow-origin: * x-xss-protection: 1; mode=block x-frame-options: SAMEORIGIN x-envoy-upstream-service-time: 7 x-request-id: dacc7f7f-d772-471f-aed0-c922291f270c X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: FA726F548F104266BC0FE8F0F9D0ECA9 Ref B: EWR30EDGE0322 Ref C: 2024-10-02T16:52:55Z Date: Wed, 02 Oct 2024 16:52:55 GMT Connection: close
2024-10-02 16:52:55 UTC	1919	IN	Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 20 64 69 72 3d 22 6c 74 72 22 20 63 6c 61 73 73 3d 22 6c 74 72 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 67 6f 6f 67 6c 65 62 6f 74 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 69 6e 64 65 78 2c 20 6e 6f 66 6f 6c 6c 6f 77 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f Data Ascii: <!doctype html><html lang="en-US" dir="ltr" class="ltr"><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"><meta http-equiv="X-UA-Compatible" content="IE=edge"><meta name="googlebot" content="noindex, nofollow"><meta name="robots" co
2024-10-02 16:52:55 UTC	8192	IN	Data Raw: 69 6e 5f 74 68 69 73 5f 62 72 6f 77 73 65 72 3a 22 4a 6f 69 6e 20 69 6e 20 74 68 69 73 20 62 72 6f 77 73 65 72 20 69 6e 73 74 65 61 64 22 2c 68 64 72 5f 62 74 6e 5f 6a 6f 69 6e 5f 69 6e 5f 74 68 69 73 5f 62 72 6f 77 73 65 72 5f 74 6f 6f 6c 74 69 70 3a 22 49 66 20 79 6f 75 20 6a 6f 69 6e 20 68 65 72 65 2c 20 79 6f 75 27 6c 6c 20 68 61 76 65 20 74 6f 20 75 73 65 20 79 6f 75 72 20 70 68 6f 6e 65 20 66 6f 72 20 61 75 64 69 6f 22 2c 68 64 72 5f 62 74 6e 5f 6a 6f 69 6e 5f 69 6e 5f 65 64 67 65 3a 22 4a 6f 69 6e 20 69 6e 20 4d 69 63 72 6f 73 6f 66 74 20 45 64 67 65 22 2c 68 64 72 5f 62 74 6e 5f 6c 65 61 72 6e 5f 6d 6f 72 65 3a 22 4c 65 61 72 6e 20 6d 6f 72 65 22 2c 68 64 72 5f 62 74 6e 5f 6c 61 75 6e 63 68 5f 6f 70 65 6e 5f 74 65 61 6d 73 3a 22 55 73 65 20 74 68 Data Ascii: in_this_browser:"Join in this browser instead",hdr_btn_join_in_this_browser_tooltip:"If you join here, you'll have to use your phone for audio",hdr_btn_join_in_edge:"Join in Microsoft Edge",hdr_btn_learn_more:"Learn more",hdr_btn_launch_open_teams:"Use th
2024-10-02 16:52:55 UTC	1330	IN	Data Raw: 68 64 72 5f 67 6f 6f 67 6c 65 5f 63 61 6c 65 6e 64 61 72 5f 73 79 6e 63 5f 64 65 73 63 72 69 70 74 69 6f 6e 3a 22 4f 70 65 6e 20 74 68 65 20 54 65 61 6d 73 20 61 70 70 20 74 6f 20 66 69 6e 69 73 68 20 73 79 6e 63 69 6e 67 20 79 6f 75 72 20 47 6f 6f 67 6c 65 20 63 61 6c 65 6e 64 61 72 2e 22 2c 22 68 64 72 5f 67 6f 6f 67 6c 65 5f 63 61 6c 65 6e 64 61 72 5f 73 79 6e 63 5f 64 65 73 63 72 69 70 74 69 6f 6e 2e 63 6f 6d 6d 65 6e 74 22 3a 22 44 65 74 61 69 6c 73 20 63 6f 6e 63 65 72 6e 69 6e 67 20 6e 65 78 74 20 73 74 65 70 73 20 66 6f 72 20 63 61 6c 65 6e 64 61 72 20 73 79 6e 63 69 6e 67 2e 22 2c 68 64 72 5f 67 6f 6f 67 6c 65 5f 64 65 66 61 75 6c 74 5f 64 65 73 63 72 69 70 74 69 6f 6e 3a 22 4f 70 65 6e 20 74 68 65 20 54 65 61 6d 73 20 61 70 70 20 74 6f 20 66 69 Data Ascii: hdr_google_calendar_sync_description:"Open the Teams app to finish syncing your Google calendar.","hdr_google_calendar_sync_description.comment":"Details concerning next steps for calendar syncing.",hdr_google_default_description:"Open the Teams app to fi
2024-10-02 16:52:55 UTC	6328	IN	Data Raw: 63 6c 69 70 62 6f 61 72 64 5f 64 65 73 63 72 69 70 74 69 6f 6e 3a 22 54 68 65 20 6d 65 65 74 69 6e 67 20 6c 69 6e 6b 20 77 69 6c 6c 20 62 65 20 63 6f 70 69 65 64 20 74 6f 20 79 6f 75 72 20 63 6c 69 70 62 6f 61 72 64 2e 22 2c 68 64 72 5f 6d 6f 62 69 6c 65 5f 6d 65 65 74 69 6e 67 5f 74 69 74 6c 65 3a 22 4a 6f 69 6e 20 74 68 65 20 6d 65 65 74 69 6e 67 20 6f 6e 20 4d 69 63 72 6f 73 6f 66 74 20 54 65 61 6d 73 22 2c 68 64 72 5f 63 6f 6d 6d 75 6e 69 74 79 5f 65 76 65 6e 74 5f 74 69 74 6c 65 3a 22 4a 6f 69 6e 20 74 68 65 20 65 76 65 6e 74 20 6f 6e 20 4d 69 63 72 6f 73 6f 66 74 20 54 65 61 6d 73 22 2c 68 64 72 5f 74 65 61 6d 73 5f 69 6e 73 69 64 65 72 5f 72 61 77 5f 74 69 74 6c 65 3a 22 54 65 61 6d 73 20 49 6e 73 69 64 65 72 22 2c 68 64 72 5f 74 65 61 6d 73 5f 69 Data Ascii: clipboard_description:"The meeting link will be copied to your clipboard.",hdr_mobile_meeting_title:"Join the meeting on Microsoft Teams",hdr_community_event_title:"Join the event on Microsoft Teams",hdr_teams_insider_raw_title:"Teams Insider",hdr_teams_i

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.7	49714	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-10-02 16:52:57 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-10-02 16:52:57 UTC	466	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-neu-z1 Cache-Control: public, max-age=85973 Date: Wed, 02 Oct 2024 16:52:57 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.7	49715	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-10-02 16:52:58 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-10-02 16:52:58 UTC	514	IN	HTTP/1.1 200 OK ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=85916 Date: Wed, 02 Oct 2024 16:52:58 GMT Content-Length: 55 Connection: close X-CID: 2
2024-10-02 16:52:58 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.7	49718	52.123.128.14	443	6672	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 16:53:00 UTC	1367	OUT	GET /api/mt/beta/tenant/anonPrivacyProfile?joinUrl=https%3A%2F%2Fteams.microsoft.com%2Fl%2Fmeetup-join%2F19%3Ameeting_MmE0NjAzMTAtYzgyMS00MDliLWE1YTUtZjJhZmM1ZGY4YzZh%40thread.v2%2F0%3Fcontext%3D%257B%2522Tid%2522%253A%25221a40aa3f-1477-4f8f-980e-9c88fa937847%2522%252C%2522Oid%2522%253A%2522b08fca2d-a34f-492c-bc56-309cea6ba5ef%2522%257D&tenantId=1a40aa3f-1477-4f8f-980e-9c88fa937847&organizerId=b08fca2d-a34f-492c-bc56-309cea6ba5ef HTTP/1.1 Host: teams.microsoft.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://teams.microsoft.com/dl/launcher/launcher.html?url=%2F_%23%2Fl%2Fmeetup-join%2F19%3Ameeting_MmE0NjAzMTAtYzgyMS00MDliLWE1YTUtZjJhZmM1ZGY4YzZh%40thread.v2%2F0%3Fcontext%3D%257B%2522Tid%2522%253A%25221a40aa3f-1477-4f8f-980e-9c88fa937847%2522%252C%2522Oid%2522%253A%2522b08fca2d-a34f-492c-bc56-309cea6ba5ef%2522%257D%26anon%3Dtrue&type=meetup-join&deeplinkId=f35de3fe-1833-4040-a2d1-3b28cea1b10c&directDl=true&msLaunch=true&enableMobilePage=true Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-02 16:53:01 UTC	501	IN	HTTP/1.1 200 OK Cache-Control: no-cache, no-store Content-Length: 19 Content-Type: application/json; charset=utf-8 Access-Control-Expose-Headers: X-ServerRequestId X-ServerRequestId: 10E75E4C09244985B261EB26ED41CCD6 X-MachineName: mtsvc00000F Strict-Transport-Security: max-age=31536000; includeSubDomains X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: 10E75E4C09244985B261EB26ED41CCD6 Ref B: EWR30EDGE0306 Ref C: 2024-10-02T16:53:00Z Date: Wed, 02 Oct 2024 16:53:00 GMT Connection: close
2024-10-02 16:53:01 UTC	19	IN	Data Raw: 7b 22 73 74 61 74 65 6d 65 6e 74 55 72 6c 22 3a 22 22 7d Data Ascii: {"statementUrl":""}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.7	49717	52.123.128.14	443	6672	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 16:53:00 UTC	1058	OUT	GET /api/mt/beta/meetings/branding?tenantId=1a40aa3f-1477-4f8f-980e-9c88fa937847&userId=b08fca2d-a34f-492c-bc56-309cea6ba5ef HTTP/1.1 Host: teams.microsoft.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://teams.microsoft.com/dl/launcher/launcher.html?url=%2F_%23%2Fl%2Fmeetup-join%2F19%3Ameeting_MmE0NjAzMTAtYzgyMS00MDliLWE1YTUtZjJhZmM1ZGY4YzZh%40thread.v2%2F0%3Fcontext%3D%257B%2522Tid%2522%253A%25221a40aa3f-1477-4f8f-980e-9c88fa937847%2522%252C%2522Oid%2522%253A%2522b08fca2d-a34f-492c-bc56-309cea6ba5ef%2522%257D%26anon%3Dtrue&type=meetup-join&deeplinkId=f35de3fe-1833-4040-a2d1-3b28cea1b10c&directDl=true&msLaunch=true&enableMobilePage=true Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-02 16:53:00 UTC	504	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=86400 Content-Length: 48 Content-Type: application/json; charset=utf-8 Access-Control-Expose-Headers: X-ServerRequestId X-ServerRequestId: 25C93B374AB049E8B46D587E581C2063 X-MachineName: mtsvc00000H Strict-Transport-Security: max-age=31536000; includeSubDomains X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: 25C93B374AB049E8B46D587E581C2063 Ref B: EWR30EDGE1012 Ref C: 2024-10-02T16:53:00Z Date: Wed, 02 Oct 2024 16:53:00 GMT Connection: close
2024-10-02 16:53:00 UTC	48	IN	Data Raw: 7b 22 72 65 61 73 6f 6e 22 3a 22 4e 6f 20 62 72 61 6e 64 69 6e 67 20 64 65 66 69 6e 65 64 20 66 6f 72 20 74 68 65 20 74 65 6e 61 6e 74 2e 22 7d Data Ascii: {"reason":"No branding defined for the tenant."}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.7	49723	52.123.128.14	443	6672	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 16:53:01 UTC	587	OUT	GET /api/mt/beta/meetings/branding?tenantId=1a40aa3f-1477-4f8f-980e-9c88fa937847&userId=b08fca2d-a34f-492c-bc56-309cea6ba5ef HTTP/1.1 Host: teams.microsoft.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: MUIDB=0B6624FFE9C26969214A31F3E86A685B; MicrosoftApplicationsTelemetryDeviceId=90230161-febc-42ae-9abf-2adbfc0de18b
2024-10-02 16:53:01 UTC	504	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=86400 Content-Length: 48 Content-Type: application/json; charset=utf-8 Access-Control-Expose-Headers: X-ServerRequestId X-ServerRequestId: 86B210A2CC92405CA697D9B1D9317523 X-MachineName: mtsvc000004 Strict-Transport-Security: max-age=31536000; includeSubDomains X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: 86B210A2CC92405CA697D9B1D9317523 Ref B: EWR30EDGE0109 Ref C: 2024-10-02T16:53:01Z Date: Wed, 02 Oct 2024 16:53:01 GMT Connection: close
2024-10-02 16:53:01 UTC	48	IN	Data Raw: 7b 22 72 65 61 73 6f 6e 22 3a 22 4e 6f 20 62 72 61 6e 64 69 6e 67 20 64 65 66 69 6e 65 64 20 66 6f 72 20 74 68 65 20 74 65 6e 61 6e 74 2e 22 7d Data Ascii: {"reason":"No branding defined for the tenant."}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.7	49727	52.123.128.14	443	6672	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 16:53:01 UTC	896	OUT	GET /api/mt/beta/tenant/anonPrivacyProfile?joinUrl=https%3A%2F%2Fteams.microsoft.com%2Fl%2Fmeetup-join%2F19%3Ameeting_MmE0NjAzMTAtYzgyMS00MDliLWE1YTUtZjJhZmM1ZGY4YzZh%40thread.v2%2F0%3Fcontext%3D%257B%2522Tid%2522%253A%25221a40aa3f-1477-4f8f-980e-9c88fa937847%2522%252C%2522Oid%2522%253A%2522b08fca2d-a34f-492c-bc56-309cea6ba5ef%2522%257D&tenantId=1a40aa3f-1477-4f8f-980e-9c88fa937847&organizerId=b08fca2d-a34f-492c-bc56-309cea6ba5ef HTTP/1.1 Host: teams.microsoft.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: MUIDB=0B6624FFE9C26969214A31F3E86A685B; MicrosoftApplicationsTelemetryDeviceId=90230161-febc-42ae-9abf-2adbfc0de18b
2024-10-02 16:53:01 UTC	501	IN	HTTP/1.1 200 OK Cache-Control: no-cache, no-store Content-Length: 19 Content-Type: application/json; charset=utf-8 Access-Control-Expose-Headers: X-ServerRequestId X-ServerRequestId: 9B910396AB1049BAA6D65BA8368AA4A3 X-MachineName: mtsvc00000J Strict-Transport-Security: max-age=31536000; includeSubDomains X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: 9B910396AB1049BAA6D65BA8368AA4A3 Ref B: EWR30EDGE0118 Ref C: 2024-10-02T16:53:01Z Date: Wed, 02 Oct 2024 16:53:01 GMT Connection: close
2024-10-02 16:53:01 UTC	19	IN	Data Raw: 7b 22 73 74 61 74 65 6d 65 6e 74 55 72 6c 22 3a 22 22 7d Data Ascii: {"statementUrl":""}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.7	49736	52.123.128.14	443	6672	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 16:53:06 UTC	1021	OUT	GET /dl/launcher/attribution.txt HTTP/1.1 Host: teams.microsoft.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: MicrosoftApplicationsTelemetryDeviceId=90230161-febc-42ae-9abf-2adbfc0de18b; MicrosoftApplicationsTelemetryFirstLaunchTime=2024-10-02T16:52:57.777Z; MUIDB=0B6624FFE9C26969214A31F3E86A685B; clocale=en-us; MicrosoftApplicationsTelemetryDeviceId=90230161-febc-42ae-9abf-2adbfc0de18b; ai_session=HLl6rm+lJCYS4klaLOJS/g\|1727887979710\|1727887979710
2024-10-02 16:53:06 UTC	609	IN	HTTP/1.1 200 OK Content-Length: 17514 Content-Type: text/plain strict-transport-security: max-age=2592000 x-ring-info: web: general [assigned], mt: general [assigned] requestid: d088cc8fa0eb165f5fc331707baed562 x-content-type-options: nosniff timing-allow-origin: * x-xss-protection: 1; mode=block x-frame-options: SAMEORIGIN x-envoy-upstream-service-time: 9 x-request-id: 65c6d786-b0e9-4bec-a0b7-ef977825f714 X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: 3AAEE99FC76C446ABB013AB72810B8E3 Ref B: EWR30EDGE0412 Ref C: 2024-10-02T16:53:06Z Date: Wed, 02 Oct 2024 16:53:06 GMT Connection: close
2024-10-02 16:53:06 UTC	3021	IN	Data Raw: 0a 54 48 49 52 44 20 50 41 52 54 59 20 53 4f 46 54 57 41 52 45 20 4e 4f 54 49 43 45 53 20 41 4e 44 20 49 4e 46 4f 52 4d 41 54 49 4f 4e 0a 44 6f 20 4e 6f 74 20 54 72 61 6e 73 6c 61 74 65 20 6f 72 20 4c 6f 63 61 6c 69 7a 65 0a 0a 54 68 69 73 20 73 6f 66 74 77 61 72 65 20 69 6e 63 6f 72 70 6f 72 61 74 65 73 20 6d 61 74 65 72 69 61 6c 20 66 72 6f 6d 20 74 68 69 72 64 20 70 61 72 74 69 65 73 2e 20 4d 69 63 72 6f 73 6f 66 74 20 6d 61 6b 65 73 20 63 65 72 74 61 69 6e 0a 6f 70 65 6e 20 73 6f 75 72 63 65 20 63 6f 64 65 20 61 76 61 69 6c 61 62 6c 65 20 61 74 20 68 74 74 70 3a 2f 2f 33 72 64 70 61 72 74 79 73 6f 75 72 63 65 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2c 20 6f 72 20 79 6f 75 20 6d 61 79 0a 73 65 6e 64 20 61 20 63 68 65 63 6b 20 6f 72 20 6d 6f 6e 65 79 Data Ascii: THIRD PARTY SOFTWARE NOTICES AND INFORMATIONDo Not Translate or LocalizeThis software incorporates material from third parties. Microsoft makes certainopen source code available at http://3rdpartysource.microsoft.com, or you maysend a check or money
2024-10-02 16:53:06 UTC	8192	IN	Data Raw: 4e 46 52 49 4e 47 45 4d 45 4e 54 2e 20 49 4e 20 4e 4f 20 45 56 45 4e 54 20 53 48 41 4c 4c 20 54 48 45 0a 41 55 54 48 4f 52 53 20 4f 52 20 43 4f 50 59 52 49 47 48 54 20 48 4f 4c 44 45 52 53 20 42 45 20 4c 49 41 42 4c 45 20 46 4f 52 20 41 4e 59 20 43 4c 41 49 4d 2c 20 44 41 4d 41 47 45 53 20 4f 52 20 4f 54 48 45 52 0a 4c 49 41 42 49 4c 49 54 59 2c 20 57 48 45 54 48 45 52 20 49 4e 20 41 4e 20 41 43 54 49 4f 4e 20 4f 46 20 43 4f 4e 54 52 41 43 54 2c 20 54 4f 52 54 20 4f 52 20 4f 54 48 45 52 57 49 53 45 2c 20 41 52 49 53 49 4e 47 20 46 52 4f 4d 2c 0a 4f 55 54 20 4f 46 20 4f 52 20 49 4e 20 43 4f 4e 4e 45 43 54 49 4f 4e 20 57 49 54 48 20 54 48 45 20 53 4f 46 54 57 41 52 45 20 4f 52 20 54 48 45 20 55 53 45 20 4f 52 20 4f 54 48 45 52 20 44 45 41 4c 49 4e 47 53 20 Data Ascii: NFRINGEMENT. IN NO EVENT SHALL THEAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHERLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS
2024-10-02 16:53:06 UTC	4695	IN	Data Raw: 6f 20 75 73 65 2c 20 63 6f 70 79 2c 20 6d 6f 64 69 66 79 2c 20 6d 65 72 67 65 2c 20 70 75 62 6c 69 73 68 2c 20 64 69 73 74 72 69 62 75 74 65 2c 20 73 75 62 6c 69 63 65 6e 73 65 2c 20 61 6e 64 2f 6f 72 20 73 65 6c 6c 0a 63 6f 70 69 65 73 20 6f 66 20 74 68 65 20 53 6f 66 74 77 61 72 65 2c 20 61 6e 64 20 74 6f 20 70 65 72 6d 69 74 20 70 65 72 73 6f 6e 73 20 74 6f 20 77 68 6f 6d 20 74 68 65 20 53 6f 66 74 77 61 72 65 20 69 73 0a 66 75 72 6e 69 73 68 65 64 20 74 6f 20 64 6f 20 73 6f 2c 20 73 75 62 6a 65 63 74 20 74 6f 20 74 68 65 20 66 6f 6c 6c 6f 77 69 6e 67 20 63 6f 6e 64 69 74 69 6f 6e 73 3a 0a 0a 54 68 65 20 61 62 6f 76 65 20 63 6f 70 79 72 69 67 68 74 20 6e 6f 74 69 63 65 20 61 6e 64 20 74 68 69 73 20 70 65 72 6d 69 73 73 69 6f 6e 20 6e 6f 74 69 63 65 20 Data Ascii: o use, copy, modify, merge, publish, distribute, sublicense, and/or sellcopies of the Software, and to permit persons to whom the Software isfurnished to do so, subject to the following conditions:The above copyright notice and this permission notice
2024-10-02 16:53:06 UTC	1606	IN	Data Raw: 63 6c 75 64 65 64 20 69 6e 20 61 6c 6c 0a 63 6f 70 69 65 73 20 6f 72 20 73 75 62 73 74 61 6e 74 69 61 6c 20 70 6f 72 74 69 6f 6e 73 20 6f 66 20 74 68 65 20 53 6f 66 74 77 61 72 65 2e 0a 0a 54 48 45 20 53 4f 46 54 57 41 52 45 20 49 53 20 50 52 4f 56 49 44 45 44 20 22 41 53 20 49 53 22 2c 20 57 49 54 48 4f 55 54 20 57 41 52 52 41 4e 54 59 20 4f 46 20 41 4e 59 20 4b 49 4e 44 2c 20 45 58 50 52 45 53 53 20 4f 52 0a 49 4d 50 4c 49 45 44 2c 20 49 4e 43 4c 55 44 49 4e 47 20 42 55 54 20 4e 4f 54 20 4c 49 4d 49 54 45 44 20 54 4f 20 54 48 45 20 57 41 52 52 41 4e 54 49 45 53 20 4f 46 20 4d 45 52 43 48 41 4e 54 41 42 49 4c 49 54 59 2c 0a 46 49 54 4e 45 53 53 20 46 4f 52 20 41 20 50 41 52 54 49 43 55 4c 41 52 20 50 55 52 50 4f 53 45 20 41 4e 44 20 4e 4f 4e 49 4e 46 52 Data Ascii: cluded in allcopies or substantial portions of the Software.THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS ORIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,FITNESS FOR A PARTICULAR PURPOSE AND NONINFR

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.7	49737	52.123.128.14	443	6672	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 16:53:06 UTC	824	OUT	GET /favicon.ico HTTP/1.1 Host: teams.microsoft.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://teams.microsoft.com/dl/launcher/attribution.txt Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: MUIDB=0B6624FFE9C26969214A31F3E86A685B; clocale=en-us; MicrosoftApplicationsTelemetryDeviceId=90230161-febc-42ae-9abf-2adbfc0de18b; ai_session=HLl6rm+lJCYS4klaLOJS/g\|1727887979710\|1727887979710
2024-10-02 16:53:06 UTC	710	IN	HTTP/1.1 302 Found Cache-Control: public,max-age=31536000 Location: https://statics.teams.cdn.office.net/hashed/favicon/prod/favicon-f1722d9.ico strict-transport-security: max-age=2592000 x-ring-info: web: general [assigned], mt: general [assigned] requestid: 015a4a30011ba27866d8a48e1e3063c5 x-content-type-options: nosniff timing-allow-origin: * x-xss-protection: 1; mode=block x-frame-options: SAMEORIGIN x-envoy-upstream-service-time: 8 x-request-id: f9d47911-1615-49f8-af73-361e4a7090ab X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: 26FC80B1D71746F3AF53045688FE43C6 Ref B: EWR30EDGE1113 Ref C: 2024-10-02T16:53:06Z Date: Wed, 02 Oct 2024 16:53:06 GMT Connection: close Content-Length: 0

Target ID:	0
Start time:	12:52:46
Start date:	02/10/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Imagebase:	0x7ff6c4390000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	12:52:48
Start date:	02/10/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 --field-trial-handle=1972,i,5130704395067591626,10697424571899277825,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff6c4390000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	12:52:51
Start date:	02/10/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://husgu4aab.cc.rs6.net/tn.jsp?f=001Kgt4Y2UB61RJ-8HwGvpJdBIbmN2KmnsaQqGoOmBznZv-sZNQDwRSSQ7g-eK51O4by9IOD2KnWORRgU0x0E3aNqtENPlCG9IRkHoovRH87tIhjQapV8qvGaEivg08QWSvEYUiMWZbUAA5F-TBphmYo54Yji4b0P6N0DJh_NbVO20TarWgnPQ3SuLKbE7xetLRM8vyBQFA3FDAk2Yb7PHHNhkTNOnLAjlPaIIitR9YG-b5PWKzzl53xiiNEfQzHPo5f_HVv0eLJVI13jaoVLCWlUD41vb-4jiIEzxYy7L3VVF3KxBtVO6BE2E1jRiUdWGiYagIkSTi87BHv9cWMOqrRRElHJKtM_LH7LWPcyQYm-e7t7Np0yuIiSG2a7kcUa83fxnFKBlD3XQWk3tBK_A6UHfOpVtGfh58aA3wMAw29cIbI5nWpV6ItQSoKR9GlwPgZ9_RwLBJtBRlGly3vddfujNsc6LR0pWXaYSrJULantDqQJ_4b9XaCQ==&c=IyjvwkVNXkSM3EQNeu1AFyYVkMBKrNrka4UrFHY9Xgi8_nQQx7j-YA==&ch=Kpqbu5OxQl-CnKQeZK4xThguts9KPf_lvJrsntwD6ZjuGxnpSh2o9w=="
Imagebase:	0x7ff6c4390000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Phishing

Compliance

Networking

System Summary

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Chrome Cache Entry: 57

Chrome Cache Entry: 58

Chrome Cache Entry: 59

Chrome Cache Entry: 60

Chrome Cache Entry: 61

Chrome Cache Entry: 62

Chrome Cache Entry: 63

Chrome Cache Entry: 64

Chrome Cache Entry: 65

Chrome Cache Entry: 66

Chrome Cache Entry: 67

Chrome Cache Entry: 68

Chrome Cache Entry: 69

Chrome Cache Entry: 70

Chrome Cache Entry: 71

Chrome Cache Entry: 72

Chrome Cache Entry: 73

Chrome Cache Entry: 74

Chrome Cache Entry: 75

Static File Info

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

HTTPS Proxied Packets

Statistics

CPU Usage