Edit tour

Windows Analysis Report
Proposal From PipelinerSales Inc.docx

Overview

General Information

Sample name:	Proposal From PipelinerSales Inc.docx
Analysis ID:	1356266
MD5:	d4359887848e7f1ba824eafe175752cc
SHA1:	3143c5b061c177d49dd2fa0e3cee5aac087c2c22
SHA256:	ba759e8d9fd45a6c67741ca480413e9405caea520f72b538db3ed8b4b6380430
Infos:

Errors Corrupt sample or wrongly selected analyzer.

Detection

Score:	3
Range:	0 - 100
Whitelisted:	false
Confidence:	60%

Signatures

Creates files inside the system directory

Document contains embedded VBA macros

Document misses a certain OLE stream usually present in this Microsoft Office document type

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

Uses insecure TLS / SSL version for HTTPS connection

Classification

Analysis Advice

Joe Sandbox was unable to browse the URL (domain or webserver down or HTTPS issue), try to browse the URL again later

No malicious behavior found, analyze the document also on other version of Office / Acrobat

Process Tree

System is w10x64

WINWORD.EXE (PID: 5060 cmdline: "C:\Program Files (x86)\Microsoft Office\Root\Office16\WINWORD.EXE" /Automation -Embedding MD5: 1A0C2C2E7D9C4BC18E91604E9B0C7678)

chrome.exe (PID: 1272 cmdline: C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 2508 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2040 --field-trial-handle=1960,i,8437383881350741284,1943545155480533218,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 2404 cmdline: C:\Program Files\Google\Chrome\Application\chrome.exe" "https://0245524080.hartis9.com/ MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: unknown

HTTPS traffic detected: 104.98.116.138:443 -> 192.168.2.7:49771 version: TLS 1.0

Source: unknown	HTTPS traffic detected: 40.126.28.19:443 -> 192.168.2.7:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.7:49768 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.165.165.26:443 -> 192.168.2.7:49785 version: TLS 1.2

Source: winword.exe

Memory has grown: Private usage: 1MB later: 83MB

Source: Joe Sandbox View

IP Address: 239.255.255.250 239.255.255.250

Source: Joe Sandbox View	JA3 fingerprint: 1138de370e523e824bbca92d049a3777
Source: Joe Sandbox View	JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4

Source: unknown

HTTPS traffic detected: 104.98.116.138:443 -> 192.168.2.7:49771 version: TLS 1.0

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.28.19
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.28.19
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.28.19
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.28.19
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.28.19
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.28.19
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.28.19
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.28.19
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.28.19
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.28.19
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.28.19
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138

Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=GfuoSMC4nRfmxZD&MD=1ltm755w HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=117.0.5938.134&lang=en-US&acceptformat=crx3,puff&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26brand%3DONGR%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1Host: clients2.google.comConnection: keep-aliveX-Goog-Update-Interactivity: fgX-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmiedaX-Goog-Update-Updater: chromecrx-117.0.5938.134Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=GfuoSMC4nRfmxZD&MD=1ltm755w HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /tools/pso/ping?as=chrome&brand=ONGR&pid=&hl=en&events=C1I,C2I,C7I,C1S,C7S&rep=2&rlz=C1:,C2:,C7:&id=000000000000000000000000000000000000000030E60A8656 HTTP/1.1Host: clients1.google.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, br

Source: unknown

DNS traffic detected: queries for: clients2.google.com

Source: unknown

HTTP traffic detected: POST /RST2.srf HTTP/1.0Connection: Keep-AliveContent-Type: application/soap+xmlAccept: */*User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68})Content-Length: 4718Host: login.live.com

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 49699 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49699
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 49677 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49671 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789

Source: iso690.xsl.0.dr	OLE indicator, VBA macros: true
Source: mlaseventheditionofficeonline.xsl.0.dr	OLE indicator, VBA macros: true
Source: iso690nmerical.xsl.0.dr	OLE indicator, VBA macros: true
Source: gostname.xsl.0.dr	OLE indicator, VBA macros: true
Source: 17ACEF52-4111-45FD-8780-2A6A264BA30A.0.dr	OLE indicator, VBA macros: true
Source: gosttitle.xsl.0.dr	OLE indicator, VBA macros: true
Source: harvardanglia2008officeonline.xsl.0.dr	OLE indicator, VBA macros: true
Source: gb.xsl.0.dr	OLE indicator, VBA macros: true
Source: chicago.xsl.0.dr	OLE indicator, VBA macros: true
Source: sist02.xsl.0.dr	OLE indicator, VBA macros: true
Source: APASixthEditionOfficeOnline.xsl.0.dr	OLE indicator, VBA macros: true
Source: turabian.xsl.0.dr	OLE indicator, VBA macros: true
Source: ieee2006officeonline.xsl.0.dr	OLE indicator, VBA macros: true

Source: iso690.xsl.0.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: mlaseventheditionofficeonline.xsl.0.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: iso690nmerical.xsl.0.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: ~WRF{3776E5C8-62FC-4362-886D-86C7F61A6353}.tmp.0.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: gostname.xsl.0.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: 17ACEF52-4111-45FD-8780-2A6A264BA30A.0.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: gosttitle.xsl.0.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: harvardanglia2008officeonline.xsl.0.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: gb.xsl.0.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: chicago.xsl.0.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: sist02.xsl.0.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: APASixthEditionOfficeOnline.xsl.0.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: turabian.xsl.0.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: ieee2006officeonline.xsl.0.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false

Source: Proposal From PipelinerSales Inc.docx	OLE indicator, Word Document stream: true
Source: Element design set.dotx.0.dr	OLE indicator, Word Document stream: true
Source: Equations.dotx.0.dr	OLE indicator, Word Document stream: true
Source: Insight design set.dotx.0.dr	OLE indicator, Word Document stream: true
Source: Text Sidebar (Annual Report Red and Black design).docx.0.dr	OLE indicator, Word Document stream: true
Source: ~WRD0000.tmp.0.dr	OLE indicator, Word Document stream: true

Source: ~WRF{3776E5C8-62FC-4362-886D-86C7F61A6353}.tmp.0.dr	OLE document summary: title field not present or empty
Source: ~WRF{3776E5C8-62FC-4362-886D-86C7F61A6353}.tmp.0.dr	OLE document summary: author field not present or empty
Source: ~WRF{3776E5C8-62FC-4362-886D-86C7F61A6353}.tmp.0.dr	OLE document summary: edited time not present or 0

Source: unknown	Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\WINWORD.EXE" /Automation -Embedding
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2040 --field-trial-handle=1960,i,8437383881350741284,1943545155480533218,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe" "https://0245524080.hartis9.com/
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2040 --field-trial-handle=1960,i,8437383881350741284,1943545155480533218,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Templates.LNK.0.dr	LNK file: ..\..\Templates
Source: Proposal From PipelinerSales Inc.LNK.0.dr	LNK file: ..\..\..\..\..\Desktop\Proposal From PipelinerSales Inc.docx

Source: Element design set.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/settings.xml
Source: Element design set.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/_rels/document.xml.rels
Source: Element design set.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/document.xml
Source: Element design set.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/fontTable.xml
Source: Element design set.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/webSettings.xml
Source: Element design set.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/styles.xml
Source: Element design set.dotx.0.dr	Initial sample: OLE zip file path = customXml/itemProps2.xml
Source: Element design set.dotx.0.dr	Initial sample: OLE zip file path = customXml/item2.xml
Source: Element design set.dotx.0.dr	Initial sample: OLE zip file path = customXml/_rels/item2.xml.rels
Source: Element design set.dotx.0.dr	Initial sample: OLE zip file path = [trash]/0000.dat
Source: Element design set.dotx.0.dr	Initial sample: OLE zip file path = docProps/custom.xml
Source: Equations.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/document.xml
Source: Equations.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/settings.xml
Source: Equations.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/_rels/document.xml.rels
Source: Equations.dotx.0.dr	Initial sample: OLE zip file path = customXml/itemProps2.xml
Source: Equations.dotx.0.dr	Initial sample: OLE zip file path = docProps/custom.xml
Source: Equations.dotx.0.dr	Initial sample: OLE zip file path = customXml/_rels/item2.xml.rels
Source: Equations.dotx.0.dr	Initial sample: OLE zip file path = customXml/item2.xml
Source: Equations.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/webSettings.xml
Source: Equations.dotx.0.dr	Initial sample: OLE zip file path = [trash]/0000.dat
Source: Equations.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/styles.xml
Source: Equations.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/stylesWithEffects.xml
Source: Equations.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/fontTable.xml
Source: Insight design set.dotx.0.dr	Initial sample: OLE zip file path = word/media/image2.jpg
Source: Insight design set.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/settings.xml
Source: Insight design set.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/document.xml
Source: Insight design set.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/_rels/document.xml.rels
Source: Insight design set.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/styles.xml
Source: Insight design set.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/webSettings.xml
Source: Insight design set.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/fontTable.xml
Source: Insight design set.dotx.0.dr	Initial sample: OLE zip file path = word/media/image10.jpeg
Source: Insight design set.dotx.0.dr	Initial sample: OLE zip file path = customXml/itemProps2.xml
Source: Insight design set.dotx.0.dr	Initial sample: OLE zip file path = customXml/item2.xml
Source: Insight design set.dotx.0.dr	Initial sample: OLE zip file path = customXml/_rels/item2.xml.rels
Source: Insight design set.dotx.0.dr	Initial sample: OLE zip file path = [trash]/0000.dat
Source: Insight design set.dotx.0.dr	Initial sample: OLE zip file path = docProps/custom.xml
Source: Text Sidebar (Annual Report Red and Black design).docx.0.dr	Initial sample: OLE zip file path = word/theme/_rels/theme1.xml.rels
Source: Text Sidebar (Annual Report Red and Black design).docx.0.dr	Initial sample: OLE zip file path = word/glossary/settings.xml
Source: Text Sidebar (Annual Report Red and Black design).docx.0.dr	Initial sample: OLE zip file path = word/glossary/document.xml
Source: Text Sidebar (Annual Report Red and Black design).docx.0.dr	Initial sample: OLE zip file path = word/glossary/_rels/document.xml.rels
Source: Text Sidebar (Annual Report Red and Black design).docx.0.dr	Initial sample: OLE zip file path = word/_rels/settings.xml.rels
Source: Text Sidebar (Annual Report Red and Black design).docx.0.dr	Initial sample: OLE zip file path = word/glossary/webSettings.xml
Source: Text Sidebar (Annual Report Red and Black design).docx.0.dr	Initial sample: OLE zip file path = word/glossary/fontTable.xml
Source: Text Sidebar (Annual Report Red and Black design).docx.0.dr	Initial sample: OLE zip file path = word/glossary/styles.xml
Source: Text Sidebar (Annual Report Red and Black design).docx.0.dr	Initial sample: OLE zip file path = word/glossary/stylesWithEffects.xml
Source: Text Sidebar (Annual Report Red and Black design).docx.0.dr	Initial sample: OLE zip file path = customXml/item2.xml
Source: Text Sidebar (Annual Report Red and Black design).docx.0.dr	Initial sample: OLE zip file path = customXml/_rels/item2.xml.rels
Source: Text Sidebar (Annual Report Red and Black design).docx.0.dr	Initial sample: OLE zip file path = customXml/itemProps3.xml
Source: Text Sidebar (Annual Report Red and Black design).docx.0.dr	Initial sample: OLE zip file path = customXml/item3.xml
Source: Text Sidebar (Annual Report Red and Black design).docx.0.dr	Initial sample: OLE zip file path = customXml/itemProps2.xml
Source: Text Sidebar (Annual Report Red and Black design).docx.0.dr	Initial sample: OLE zip file path = customXml/_rels/item3.xml.rels
Source: Text Sidebar (Annual Report Red and Black design).docx.0.dr	Initial sample: OLE zip file path = [trash]/0000.dat
Source: Text Sidebar (Annual Report Red and Black design).docx.0.dr	Initial sample: OLE zip file path = docProps/custom.xml
Source: ~WRD0000.tmp.0.dr	Initial sample: OLE zip file path = word/glossary/document.xml
Source: ~WRD0000.tmp.0.dr	Initial sample: OLE zip file path = word/glossary/settings.xml
Source: ~WRD0000.tmp.0.dr	Initial sample: OLE zip file path = word/glossary/_rels/document.xml.rels
Source: ~WRD0000.tmp.0.dr	Initial sample: OLE zip file path = word/glossary/styles.xml
Source: ~WRD0000.tmp.0.dr	Initial sample: OLE zip file path = word/glossary/webSettings.xml
Source: ~WRD0000.tmp.0.dr	Initial sample: OLE zip file path = word/glossary/fontTable.xml

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact	Resource Development	Reconnaissance
Valid Accounts	1 Scripting	Path Interception	1 Process Injection	11 Masquerading	OS Credential Dumping	1 Process Discovery	Remote Services	Data from Local System	Exfiltration Over Other Network Medium	1 Encrypted Channel	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Abuse Accessibility Features	Acquire Infrastructure	Gather Victim Identity Information
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Extra Window Memory Injection	1 Process Injection	LSASS Memory	1 File and Directory Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	3 Non-Application Layer Protocol	SIM Card Swap	Obtain Device Cloud Backups	Network Denial of Service	Domains	Credentials
Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Scripting	Security Account Manager	1 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	4 Application Layer Protocol			Data Encrypted for Impact	DNS Server	Email Addresses
Local Accounts	Cron	Login Hook	Login Hook	1 Extra Window Memory Injection	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Traffic Duplication	1 Ingress Tool Transfer			Data Destruction	Virtual Private Server	Employee Names

Source	Detection	Scanner	Label
https://cdn.entity.	0%	URL Reputation	safe
https://powerlift.acompli.net	0%	URL Reputation	safe
https://rpsticket.partnerservices.getmicrosoftkey.com	0%	URL Reputation	safe
https://cortana.ai	0%	URL Reputation	safe
https://api.aadrm.com/	0%	URL Reputation	safe
https://ofcrecsvcapi-int.azurewebsites.net/	0%	URL Reputation	safe
https://res.getmicrosoftkey.com/api/redemptionevents	0%	URL Reputation	safe
https://powerlift-user.acompli.net	0%	URL Reputation	safe
https://officeci.azurewebsites.net/api/	0%	URL Reputation	safe
https://api.scheduler.	0%	URL Reputation	safe
https://my.microsoftpersonalcontent.com	0%	URL Reputation	safe
https://store.office.cn/addinstemplate	0%	URL Reputation	safe
https://api.aadrm.com	0%	URL Reputation	safe
https://dev0-api.acompli.net/autodetect	0%	URL Reputation	safe
https://www.odwebp.svc.ms	0%	URL Reputation	safe
https://api.addins.store.officeppe.com/addinstemplate	0%	URL Reputation	safe
https://dataservice.o365filtering.com/	0%	URL Reputation	safe
https://officesetup.getmicrosoftkey.com	0%	URL Reputation	safe
https://prod-global-autodetect.acompli.net/autodetect	0%	URL Reputation	safe
https://ncus.contentsync.	0%	URL Reputation	safe
https://apis.live.net/v5.0/	0%	URL Reputation	safe
https://wus2.contentsync.	0%	URL Reputation	safe
https://make.powerautomate.com	0%	URL Reputation	safe
https://asgsmsproxyapi.azurewebsites.net/	0%	URL Reputation	safe
https://login.windows.local	0%	URL Reputation	safe
https://augloop.office.com;https://augloop-int.officeppe.com;https://augloop-dogfood.officeppe.com;h	0%	Avira URL Cloud	safe
https://d.docs.live.net	0%	Avira URL Cloud	safe
https://otelrules.svc.static.microsoft	0%	Avira URL Cloud	safe

Source: 17ACEF52-4111-45FD-8780-2A6A264BA30A.0.dr	String found in binary or memory: http://b.c2r.ts.cdn.office.net/pr
Source: 17ACEF52-4111-45FD-8780-2A6A264BA30A.0.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr
Source: 17ACEF52-4111-45FD-8780-2A6A264BA30A.0.dr	String found in binary or memory: http://olkflt.edog.officeapps.live.com/olkflt/outlookflighting.svc/api/glides
Source: 17ACEF52-4111-45FD-8780-2A6A264BA30A.0.dr	String found in binary or memory: http://weather.service.msn.com/data.aspx
Source: 17ACEF52-4111-45FD-8780-2A6A264BA30A.0.dr	String found in binary or memory: https://addinsinstallation.store.office.com/app/acquisitionlogging
Source: 17ACEF52-4111-45FD-8780-2A6A264BA30A.0.dr	String found in binary or memory: https://addinsinstallation.store.office.com/app/download
Source: 17ACEF52-4111-45FD-8780-2A6A264BA30A.0.dr	String found in binary or memory: https://addinsinstallation.store.office.com/appinstall/authenticated
Source: 17ACEF52-4111-45FD-8780-2A6A264BA30A.0.dr	String found in binary or memory: https://addinsinstallation.store.office.com/appinstall/preinstalled
Source: 17ACEF52-4111-45FD-8780-2A6A264BA30A.0.dr	String found in binary or memory: https://addinsinstallation.store.office.com/appinstall/unauthenticated
Source: 17ACEF52-4111-45FD-8780-2A6A264BA30A.0.dr	String found in binary or memory: https://addinsinstallation.store.office.com/orgid/appinstall/authenticated
Source: 17ACEF52-4111-45FD-8780-2A6A264BA30A.0.dr	String found in binary or memory: https://addinslicensing.store.office.com/apps/remove
Source: 17ACEF52-4111-45FD-8780-2A6A264BA30A.0.dr	String found in binary or memory: https://addinslicensing.store.office.com/commerce/query
Source: 17ACEF52-4111-45FD-8780-2A6A264BA30A.0.dr	String found in binary or memory: https://addinslicensing.store.office.com/entitlement/query
Source: 17ACEF52-4111-45FD-8780-2A6A264BA30A.0.dr	String found in binary or memory: https://addinslicensing.store.office.com/orgid/apps/remove
Source: 17ACEF52-4111-45FD-8780-2A6A264BA30A.0.dr	String found in binary or memory: https://addinslicensing.store.office.com/orgid/entitlement/query
Source: 17ACEF52-4111-45FD-8780-2A6A264BA30A.0.dr	String found in binary or memory: https://analysis.windows.net/powerbi/api
Source: 17ACEF52-4111-45FD-8780-2A6A264BA30A.0.dr	String found in binary or memory: https://apc.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: 17ACEF52-4111-45FD-8780-2A6A264BA30A.0.dr	String found in binary or memory: https://api.aadrm.com
Source: 17ACEF52-4111-45FD-8780-2A6A264BA30A.0.dr	String found in binary or memory: https://api.aadrm.com/
Source: 17ACEF52-4111-45FD-8780-2A6A264BA30A.0.dr	String found in binary or memory: https://api.addins.omex.office.net/api/addins/search
Source: 17ACEF52-4111-45FD-8780-2A6A264BA30A.0.dr	String found in binary or memory: https://api.addins.omex.office.net/appinfo/query
Source: 17ACEF52-4111-45FD-8780-2A6A264BA30A.0.dr	String found in binary or memory: https://api.addins.omex.office.net/appstate/query
Source: 17ACEF52-4111-45FD-8780-2A6A264BA30A.0.dr	String found in binary or memory: https://api.addins.store.office.com/addinstemplate
Source: 17ACEF52-4111-45FD-8780-2A6A264BA30A.0.dr	String found in binary or memory: https://api.addins.store.office.com/app/query
Source: 17ACEF52-4111-45FD-8780-2A6A264BA30A.0.dr	String found in binary or memory: https://api.addins.store.officeppe.com/addinstemplate
Source: 17ACEF52-4111-45FD-8780-2A6A264BA30A.0.dr	String found in binary or memory: https://api.cortana.ai
Source: 17ACEF52-4111-45FD-8780-2A6A264BA30A.0.dr	String found in binary or memory: https://api.diagnostics.office.com
Source: 17ACEF52-4111-45FD-8780-2A6A264BA30A.0.dr	String found in binary or memory: https://api.diagnosticssdf.office.com
Source: 17ACEF52-4111-45FD-8780-2A6A264BA30A.0.dr	String found in binary or memory: https://api.diagnosticssdf.office.com/v2/feedback
Source: 17ACEF52-4111-45FD-8780-2A6A264BA30A.0.dr	String found in binary or memory: https://api.diagnosticssdf.office.com/v2/file
Source: 17ACEF52-4111-45FD-8780-2A6A264BA30A.0.dr	String found in binary or memory: https://api.microsoftstream.com
Source: 17ACEF52-4111-45FD-8780-2A6A264BA30A.0.dr	String found in binary or memory: https://api.microsoftstream.com/api/
Source: 17ACEF52-4111-45FD-8780-2A6A264BA30A.0.dr	String found in binary or memory: https://api.office.net
Source: 17ACEF52-4111-45FD-8780-2A6A264BA30A.0.dr	String found in binary or memory: https://api.officescripts.microsoftusercontent.com/api
Source: 17ACEF52-4111-45FD-8780-2A6A264BA30A.0.dr	String found in binary or memory: https://api.onedrive.com
Source: 17ACEF52-4111-45FD-8780-2A6A264BA30A.0.dr	String found in binary or memory: https://api.powerbi.com/v1.0/myorg/datasets
Source: 17ACEF52-4111-45FD-8780-2A6A264BA30A.0.dr	String found in binary or memory: https://api.powerbi.com/v1.0/myorg/groups
Source: 17ACEF52-4111-45FD-8780-2A6A264BA30A.0.dr	String found in binary or memory: https://api.powerbi.com/v1.0/myorg/imports
Source: 17ACEF52-4111-45FD-8780-2A6A264BA30A.0.dr	String found in binary or memory: https://api.scheduler.
Source: 17ACEF52-4111-45FD-8780-2A6A264BA30A.0.dr	String found in binary or memory: https://apis.live.net/v5.0/

Name	IP	Active	Malicious	Reputation
accounts.google.com	142.250.217.173	true	false	high
www.google.com	142.250.189.132	true	false	high
clients.l.google.com	142.250.64.174	true	false	high
0245524080.hartis9.com	76.223.67.189	true	false	unknown
clients1.google.com	unknown	unknown	false	high
clients2.google.com	unknown	unknown	false	high

Name	Malicious	Antivirus Detection	Reputation
https://clients1.google.com/tools/pso/ping?as=chrome&brand=ONGR&pid=&hl=en&events=C1I,C2I,C7I,C1S,C7S&rep=2&rlz=C1:,C2:,C7:&id=000000000000000000000000000000000000000030E60A8656	false		high
https://clients2.google.com/service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=117.0.5938.134&lang=en-US&acceptformat=crx3,puff&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26brand%3DONGR%26ping%3Dr%253D-1%2526e%253D1	false		high

Name	Source	Malicious	Antivirus Detection	Reputation
https://api.diagnosticssdf.office.com	17ACEF52-4111-45FD-8780-2A6A264BA30A.0.dr	false		high
https://login.microsoftonline.com/	17ACEF52-4111-45FD-8780-2A6A264BA30A.0.dr	false		high
https://shell.suite.office.com:1443	17ACEF52-4111-45FD-8780-2A6A264BA30A.0.dr	false		high
https://login.windows.net/72f988bf-86f1-41af-91ab-2d7cd011db47/oauth2/authorize	17ACEF52-4111-45FD-8780-2A6A264BA30A.0.dr	false		high
https://autodiscover-s.outlook.com/	17ACEF52-4111-45FD-8780-2A6A264BA30A.0.dr	false		high
https://useraudit.o365auditrealtimeingestion.manage.office.com	17ACEF52-4111-45FD-8780-2A6A264BA30A.0.dr	false		high
https://outlook.office365.com/connectors	17ACEF52-4111-45FD-8780-2A6A264BA30A.0.dr	false		high
https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Flickr	17ACEF52-4111-45FD-8780-2A6A264BA30A.0.dr	false		high
https://cdn.entity.	17ACEF52-4111-45FD-8780-2A6A264BA30A.0.dr	false	URL Reputation: safe	unknown
https://api.addins.omex.office.net/appinfo/query	17ACEF52-4111-45FD-8780-2A6A264BA30A.0.dr	false		high
https://clients.config.office.net/user/v1.0/tenantassociationkey	17ACEF52-4111-45FD-8780-2A6A264BA30A.0.dr	false		high
https://dev.virtualearth.net/REST/V1/GeospatialEndpoint/	17ACEF52-4111-45FD-8780-2A6A264BA30A.0.dr	false		high
https://powerlift.acompli.net	17ACEF52-4111-45FD-8780-2A6A264BA30A.0.dr	false	URL Reputation: safe	unknown
https://rpsticket.partnerservices.getmicrosoftkey.com	17ACEF52-4111-45FD-8780-2A6A264BA30A.0.dr	false	URL Reputation: safe	unknown
https://lookup.onenote.com/lookup/geolocation/v1	17ACEF52-4111-45FD-8780-2A6A264BA30A.0.dr	false		high
https://cortana.ai	17ACEF52-4111-45FD-8780-2A6A264BA30A.0.dr	false	URL Reputation: safe	unknown
https://apc.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech	17ACEF52-4111-45FD-8780-2A6A264BA30A.0.dr	false		high
https://api.powerbi.com/v1.0/myorg/imports	17ACEF52-4111-45FD-8780-2A6A264BA30A.0.dr	false		high
https://cloudfiles.onenote.com/upload.aspx	17ACEF52-4111-45FD-8780-2A6A264BA30A.0.dr	false		high
https://syncservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile	17ACEF52-4111-45FD-8780-2A6A264BA30A.0.dr	false		high
https://entitlement.diagnosticssdf.office.com	17ACEF52-4111-45FD-8780-2A6A264BA30A.0.dr	false		high
https://api.aadrm.com/	17ACEF52-4111-45FD-8780-2A6A264BA30A.0.dr	false	URL Reputation: safe	unknown
https://ofcrecsvcapi-int.azurewebsites.net/	17ACEF52-4111-45FD-8780-2A6A264BA30A.0.dr	false	URL Reputation: safe	unknown
https://www.yammer.com	17ACEF52-4111-45FD-8780-2A6A264BA30A.0.dr	false		high
https://dataservice.protection.outlook.com/PsorWebService/v1/ClientSyncFile/MipPolicies	17ACEF52-4111-45FD-8780-2A6A264BA30A.0.dr	false		high
https://api.microsoftstream.com/api/	17ACEF52-4111-45FD-8780-2A6A264BA30A.0.dr	false		high
https://insertmedia.bing.office.net/images/hosted?host=office&adlt=strict&hostType=Immersive	17ACEF52-4111-45FD-8780-2A6A264BA30A.0.dr	false		high
https://cr.office.com	17ACEF52-4111-45FD-8780-2A6A264BA30A.0.dr	false		high
https://augloop.office.com;https://augloop-int.officeppe.com;https://augloop-dogfood.officeppe.com;h	17ACEF52-4111-45FD-8780-2A6A264BA30A.0.dr	false	Avira URL Cloud: safe	low
https://otelrules.svc.static.microsoft	17ACEF52-4111-45FD-8780-2A6A264BA30A.0.dr	false	Avira URL Cloud: safe	unknown
https://portal.office.com/account/?ref=ClientMeControl	17ACEF52-4111-45FD-8780-2A6A264BA30A.0.dr	false		high
https://graph.ppe.windows.net	17ACEF52-4111-45FD-8780-2A6A264BA30A.0.dr	false		high
https://res.getmicrosoftkey.com/api/redemptionevents	17ACEF52-4111-45FD-8780-2A6A264BA30A.0.dr	false	URL Reputation: safe	unknown
https://powerlift-user.acompli.net	17ACEF52-4111-45FD-8780-2A6A264BA30A.0.dr	false	URL Reputation: safe	unknown
https://tasks.office.com	17ACEF52-4111-45FD-8780-2A6A264BA30A.0.dr	false		high
https://officeci.azurewebsites.net/api/	17ACEF52-4111-45FD-8780-2A6A264BA30A.0.dr	false	URL Reputation: safe	unknown
https://sr.outlook.office.net/ws/speech/recognize/assistant/work	17ACEF52-4111-45FD-8780-2A6A264BA30A.0.dr	false		high
https://api.scheduler.	17ACEF52-4111-45FD-8780-2A6A264BA30A.0.dr	false	URL Reputation: safe	unknown
https://my.microsoftpersonalcontent.com	17ACEF52-4111-45FD-8780-2A6A264BA30A.0.dr	false	URL Reputation: safe	unknown
https://store.office.cn/addinstemplate	17ACEF52-4111-45FD-8780-2A6A264BA30A.0.dr	false	URL Reputation: safe	unknown
https://api.aadrm.com	17ACEF52-4111-45FD-8780-2A6A264BA30A.0.dr	false	URL Reputation: safe	unknown
https://outlook.office.com/autosuggest/api/v1/init?cvid=	17ACEF52-4111-45FD-8780-2A6A264BA30A.0.dr	false		high
https://globaldisco.crm.dynamics.com	17ACEF52-4111-45FD-8780-2A6A264BA30A.0.dr	false		high
https://messaging.engagement.office.com/	17ACEF52-4111-45FD-8780-2A6A264BA30A.0.dr	false		high
https://nam.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech	17ACEF52-4111-45FD-8780-2A6A264BA30A.0.dr	false		high
https://dev0-api.acompli.net/autodetect	17ACEF52-4111-45FD-8780-2A6A264BA30A.0.dr	false	URL Reputation: safe	unknown
https://www.odwebp.svc.ms	17ACEF52-4111-45FD-8780-2A6A264BA30A.0.dr	false	URL Reputation: safe	unknown
https://api.diagnosticssdf.office.com/v2/feedback	17ACEF52-4111-45FD-8780-2A6A264BA30A.0.dr	false		high
https://api.powerbi.com/v1.0/myorg/groups	17ACEF52-4111-45FD-8780-2A6A264BA30A.0.dr	false		high
https://web.microsoftstream.com/video/	17ACEF52-4111-45FD-8780-2A6A264BA30A.0.dr	false		high
https://api.addins.store.officeppe.com/addinstemplate	17ACEF52-4111-45FD-8780-2A6A264BA30A.0.dr	false	URL Reputation: safe	unknown
https://graph.windows.net	17ACEF52-4111-45FD-8780-2A6A264BA30A.0.dr	false		high
https://dataservice.o365filtering.com/	17ACEF52-4111-45FD-8780-2A6A264BA30A.0.dr	false	URL Reputation: safe	unknown
https://officesetup.getmicrosoftkey.com	17ACEF52-4111-45FD-8780-2A6A264BA30A.0.dr	false	URL Reputation: safe	unknown
https://analysis.windows.net/powerbi/api	17ACEF52-4111-45FD-8780-2A6A264BA30A.0.dr	false		high
https://prod-global-autodetect.acompli.net/autodetect	17ACEF52-4111-45FD-8780-2A6A264BA30A.0.dr	false	URL Reputation: safe	unknown
https://substrate.office.com	17ACEF52-4111-45FD-8780-2A6A264BA30A.0.dr	false		high
https://outlook.office365.com/autodiscover/autodiscover.json	17ACEF52-4111-45FD-8780-2A6A264BA30A.0.dr	false		high
https://powerpoint.uservoice.com/forums/288952-powerpoint-for-ipad-iphone-ios	17ACEF52-4111-45FD-8780-2A6A264BA30A.0.dr	false		high
https://consent.config.office.com/consentcheckin/v1.0/consents	17ACEF52-4111-45FD-8780-2A6A264BA30A.0.dr	false		high
https://eur.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech	17ACEF52-4111-45FD-8780-2A6A264BA30A.0.dr	false		high
https://learningtools.onenote.com/learningtoolsapi/v2.0/Getvoices	17ACEF52-4111-45FD-8780-2A6A264BA30A.0.dr	false		high
https://pf.directory.live.com/profile/mine/System.ShortCircuitProfile.json	17ACEF52-4111-45FD-8780-2A6A264BA30A.0.dr	false		high
https://d.docs.live.net	17ACEF52-4111-45FD-8780-2A6A264BA30A.0.dr	false	Avira URL Cloud: safe	unknown
https://safelinks.protection.outlook.com/api/GetPolicy	17ACEF52-4111-45FD-8780-2A6A264BA30A.0.dr	false		high
https://ncus.contentsync.	17ACEF52-4111-45FD-8780-2A6A264BA30A.0.dr	false	URL Reputation: safe	unknown
https://onedrive.live.com/about/download/?windows10SyncClientInstalled=false	17ACEF52-4111-45FD-8780-2A6A264BA30A.0.dr	false		high
https://webdir.online.lync.com/autodiscover/autodiscoverservice.svc/root/	17ACEF52-4111-45FD-8780-2A6A264BA30A.0.dr	false		high
http://weather.service.msn.com/data.aspx	17ACEF52-4111-45FD-8780-2A6A264BA30A.0.dr	false		high
https://apis.live.net/v5.0/	17ACEF52-4111-45FD-8780-2A6A264BA30A.0.dr	false	URL Reputation: safe	unknown
https://officemobile.uservoice.com/forums/929800-office-app-ios-and-ipad-asks	17ACEF52-4111-45FD-8780-2A6A264BA30A.0.dr	false		high
https://word.uservoice.com/forums/304948-word-for-ipad-iphone-ios	17ACEF52-4111-45FD-8780-2A6A264BA30A.0.dr	false		high
https://messaging.lifecycle.office.com/	17ACEF52-4111-45FD-8780-2A6A264BA30A.0.dr	false		high
https://autodiscover-s.outlook.com/autodiscover/autodiscover.xml	17ACEF52-4111-45FD-8780-2A6A264BA30A.0.dr	false		high
https://pushchannel.1drv.ms	17ACEF52-4111-45FD-8780-2A6A264BA30A.0.dr	false		high
https://management.azure.com	17ACEF52-4111-45FD-8780-2A6A264BA30A.0.dr	false		high
https://outlook.office365.com	17ACEF52-4111-45FD-8780-2A6A264BA30A.0.dr	false		high
https://wus2.contentsync.	17ACEF52-4111-45FD-8780-2A6A264BA30A.0.dr	false	URL Reputation: safe	unknown
https://incidents.diagnostics.office.com	17ACEF52-4111-45FD-8780-2A6A264BA30A.0.dr	false		high
https://clients.config.office.net/user/v1.0/ios	17ACEF52-4111-45FD-8780-2A6A264BA30A.0.dr	false		high
https://make.powerautomate.com	17ACEF52-4111-45FD-8780-2A6A264BA30A.0.dr	false	URL Reputation: safe	unknown
https://api.addins.omex.office.net/api/addins/search	17ACEF52-4111-45FD-8780-2A6A264BA30A.0.dr	false		high
https://insertmedia.bing.office.net/odc/insertmedia	17ACEF52-4111-45FD-8780-2A6A264BA30A.0.dr	false		high
https://outlook.office365.com/api/v1.0/me/Activities	17ACEF52-4111-45FD-8780-2A6A264BA30A.0.dr	false		high
https://api.office.net	17ACEF52-4111-45FD-8780-2A6A264BA30A.0.dr	false		high
https://incidents.diagnosticssdf.office.com	17ACEF52-4111-45FD-8780-2A6A264BA30A.0.dr	false		high
https://asgsmsproxyapi.azurewebsites.net/	17ACEF52-4111-45FD-8780-2A6A264BA30A.0.dr	false	URL Reputation: safe	unknown
https://clients.config.office.net/user/v1.0/android/policies	17ACEF52-4111-45FD-8780-2A6A264BA30A.0.dr	false		high
https://entitlement.diagnostics.office.com	17ACEF52-4111-45FD-8780-2A6A264BA30A.0.dr	false		high
https://pf.directory.live.com/profile/mine/WLX.Profiles.IC.json	17ACEF52-4111-45FD-8780-2A6A264BA30A.0.dr	false		high
https://substrate.office.com/search/api/v2/init	17ACEF52-4111-45FD-8780-2A6A264BA30A.0.dr	false		high
https://outlook.office.com/	17ACEF52-4111-45FD-8780-2A6A264BA30A.0.dr	false		high
https://storage.live.com/clientlogs/uploadlocation	17ACEF52-4111-45FD-8780-2A6A264BA30A.0.dr	false		high
https://login.windows.local	17ACEF52-4111-45FD-8780-2A6A264BA30A.0.dr	false	URL Reputation: safe	unknown
https://outlook.office365.com/	17ACEF52-4111-45FD-8780-2A6A264BA30A.0.dr	false		high
https://webshell.suite.office.com	17ACEF52-4111-45FD-8780-2A6A264BA30A.0.dr	false		high
https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=OneDrive	17ACEF52-4111-45FD-8780-2A6A264BA30A.0.dr	false		high
https://login.microsoftonline.com	17ACEF52-4111-45FD-8780-2A6A264BA30A.0.dr	false		high

IP	Domain	Country	ASN	ASN Name	Malicious
76.223.67.189	0245524080.hartis9.com	United States	16509	AMAZON-02US	false
142.250.189.132	www.google.com	United States	15169	GOOGLEUS	false
142.250.217.206	unknown	United States	15169	GOOGLEUS	false
142.250.64.174	clients.l.google.com	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
142.250.217.173	accounts.google.com	United States	15169	GOOGLEUS	false

Joe Sandbox version:	38.0.0 Ammolite
Analysis ID:	1356266
Start date and time:	2023-12-08 14:42:31 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 27s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsofficecookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	26
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Proposal From PipelinerSales Inc.docx
Detection:	UNKNOWN
Classification:	unknown3.winDOCX@20/188@10/7
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .docx Found Word or Excel or PowerPoint or XPS Viewer Attach to Office via COM Browse link: https://0245524080.hartis9.com/ URL browsing timeout or error Scroll down Close Viewer

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
239.255.255.250	https://ndlc.us21.list-manage.com/track/click?u=c019ce2ced9d9c49756fb7da7&id=21b55f31be&e=398702c985	Get hash	malicious	HTMLPhisher	Browse
	https://ndlc.us21.list-manage.com/track/click?u=c019ce2ced9d9c49756fb7da7&id=21b55f31be&e=398702c985	Get hash	malicious	HTMLPhisher	Browse
	https://bafybeidjq7rweeul3rjin2gfuijmvdh6wiawwym3ecc5gblqbosbtnfohi.ipfs.dweb.link/MTcwMTc4NzYyMQ?fHqJzfixed8RVeoK2Gs4BnPzdDuay3zWxUWDLB7p2656-sfmaxmaersk-pgx--ifxBettina.alberti-isxdaiichi-sankyo.eusf-1MC4y	Get hash	malicious	Unknown	Browse
	Payment_45832.html	Get hash	malicious	Unknown	Browse
	https://customervoice.microsoft.com/Pages/ResponsePage.aspx?id=Ebb0j5QjXU-qQZYFfJozDJWY2o9D5BtLjngmk2mcQBRUQjVGQ1czU1BKSEZESVo0VENZT0UxR1dQQy4u&vt=8ff4b611-2394-4f5d-aa41-96057c9a330c_898deb5f-42fb-4f38-8d3d-fdd88a6aeed6_638376144220000000_EUR_Hash_MiEjQryDmSP0Q5%2bsfWmmkF1mqEGpCWipqllkfFFe3vg%3d&lang=en-us	Get hash	malicious	HTMLPhisher	Browse
	https://4nlmaunw.maktubb.com.br/cantehanger/am9zdWxsaXZhbkBjd2luZ2F0ZS5jb20=	Get hash	malicious	Unknown	Browse
	sRL6pMez3o.exe	Get hash	malicious	RedLine	Browse
	fpUb8anvfc.exe	Get hash	malicious	RedLine	Browse
	https://www.evernote.com/shard/s371/client/snv?isnewsnv=true&noteGuid=a553f699-8d8c-6d7a-7038-ed7dfe2d2412&noteKey=d4DcUbUev07ivx9dSCatHIXpZcTjwRaFe9Bb6knx7fD4Ix3t-8j9-rzsWA&sn=https%3A%2F%2Fwww.evernote.com%2Fshard%2Fs371%2Fsh%2Fa553f699-8d8c-6d7a-7038-ed7dfe2d2412%2Fd4DcUbUev07ivx9dSCatHIXpZcTjwRaFe9Bb6knx7fD4Ix3t-8j9-rzsWA&title=Town%2Bof%2BStratford%257E%2BDecember%2B6%252C%2B2023	Get hash	malicious	Unknown	Browse
	https://i.nupem.ufrj.br/Jakro_7DJSD	Get hash	malicious	HTMLPhisher	Browse
	Google_Gemini_AI_Ultra_v1.msi	Get hash	malicious	Unknown	Browse
	http://arsyology.xyz/gYefq09	Get hash	malicious	Unknown	Browse
	https://t.co/XbiWikRFDe	Get hash	malicious	Phisher	Browse
	https://minimalistbeliever.com/fa176211-3f4a-4815-bc61-5fa2c7f65fac/%7Byq3kVec)WO2l0D(_A,FBZt_o5~ld,g4Xi%7DXH&%5E3ygoA_StKyQ8%5EX23DpDe%60Eg7Ij$(%5Et%7BYuUh%7CDcomsDIB2B%5E7YL5B~ht(HNvGrU%7DfZn$v1QgXd9ZjVpe$Nyk7N&MzS6_%3E$,2Ck323fJBkG6ool0%5D~30)FIYE36sKCU%5BH0Ui%7B%3ERq.$Te3%3EgGSTVq1Fs4$o$VYm7ve,77%3Cw0e%3CT(A%7D%5E%5Be4&CQhWXTM7q.cbv-wu-d8mIRohAk%5Bm%3Ef_z%3Cum/verify?Vjf)dxIwh$EicXHFrE%60%5BIMXZ4hRpJg6D%7B.VMq92Y,OR(-bGUahj%3C&nM6Dh%3CnDY%5BtyECQdWO%3Cm~Ys6%60N&WhjNHB3rPU--qyjDJikV2Ar0&IM%3E&msS4BuB.90,AhZ6O9zG%5D~j5q6WpAOi$Oxd1Xnb~kM%5BH%7C%7BZyKp%5ERPm2%7Cj7cUu_Q9J&Ug9o_3ox.Lhdh%3C28Sp2df2dO~Ne,%5EL%3Ct1_~qgWS%5E-YhLiR8.FUkFb%7D7BbS)A%7CNhAb%3Es%5D%60BWZkwP.K%7DL$&data=mhj@sampension.dk	Get hash	malicious	Unknown	Browse
	https://79968e9b.6ad65e5283e89d8125e9a66c.workers.dev/	Get hash	malicious	HTMLPhisher	Browse
	tmpBA1E.html	Get hash	malicious	HTMLPhisher	Browse
	http://cz63224.tw1.ru/clients/login.php	Get hash	malicious	Unknown	Browse
	tmpB930.html	Get hash	malicious	HTMLPhisher	Browse
	tmpA8C2.html	Get hash	malicious	HTMLPhisher	Browse
	tmp2D5E.html	Get hash	malicious	HTMLPhisher	Browse

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AMAZON-02US	svo0k2D8I1.exe	Get hash	malicious	FormBook	Browse	52.220.48.161
	oO4jogbesK.exe	Get hash	malicious	Unknown	Browse	3.19.116.195
	Receipt.exe	Get hash	malicious	FormBook	Browse	76.223.105.230
	OYT57DouoW.exe	Get hash	malicious	FormBook, GuLoader	Browse	76.76.21.22
	SecuriteInfo.com.HEUR.Trojan.MSIL.Agent.gen.12009.5536.exe	Get hash	malicious	AsyncRAT, Clipboard Hijacker	Browse	99.84.252.86
	http://arsyology.xyz/gYefq09	Get hash	malicious	Unknown	Browse	99.84.245.76
	http://blix.sx	Get hash	malicious	Unknown	Browse	3.132.60.230
	ddmze3fN5n.exe	Get hash	malicious	Unknown	Browse	99.84.252.61
	3wXmFoN4vg.exe	Get hash	malicious	AsyncRAT, zgRAT	Browse	99.84.252.80
	JiN7cISj9e.exe	Get hash	malicious	AsyncRAT	Browse	99.84.252.61
	ddmze3fN5n.exe	Get hash	malicious	Unknown	Browse	99.84.252.86
	JX1Bv7eccf.exe	Get hash	malicious	AsyncRAT	Browse	99.84.252.86
	eoiNcJ276N.exe	Get hash	malicious	zgRAT	Browse	99.84.252.61
	b3RFyOIZUt.exe	Get hash	malicious	Njrat	Browse	18.158.249.75
	EVoLxNbDkh.exe	Get hash	malicious	Njrat	Browse	3.67.161.133
	https://tipiano.com/mai.php	Get hash	malicious	Phisher	Browse	13.249.98.68
	https://www.avast.com/sig-email?utm_medium=email&utm_source=link&utm_campaign=sig-email&utm_content=emailclient	Get hash	malicious	Unknown	Browse	13.226.52.14
	https://bitbucket.org/roootscauses/loralenahai/downloads/Scannned_Proforma_Invoices.pdf.zip	Get hash	malicious	Unknown	Browse	104.192.141.1
	SecuriteInfo.com.FileRepMalware.22191.31546.exe	Get hash	malicious	FormBook, NSISDropper	Browse	52.220.48.161
	2DFGVCXV.zip.exe	Get hash	malicious	AsyncRAT, zgRAT	Browse	99.84.252.15

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
1138de370e523e824bbca92d049a3777	https://bafybeidjq7rweeul3rjin2gfuijmvdh6wiawwym3ecc5gblqbosbtnfohi.ipfs.dweb.link/MTcwMTc4NzYyMQ?fHqJzfixed8RVeoK2Gs4BnPzdDuay3zWxUWDLB7p2656-sfmaxmaersk-pgx--ifxBettina.alberti-isxdaiichi-sankyo.eusf-1MC4y	Get hash	malicious	Unknown	Browse	104.98.116.138
	https://4nlmaunw.maktubb.com.br/cantehanger/am9zdWxsaXZhbkBjd2luZ2F0ZS5jb20=	Get hash	malicious	Unknown	Browse	104.98.116.138
	https://i.nupem.ufrj.br/Jakro_7DJSD	Get hash	malicious	HTMLPhisher	Browse	104.98.116.138
	https://79968e9b.6ad65e5283e89d8125e9a66c.workers.dev/	Get hash	malicious	HTMLPhisher	Browse	104.98.116.138
	tmpA8C2.html	Get hash	malicious	HTMLPhisher	Browse	104.98.116.138
	tmp59A1.html	Get hash	malicious	HTMLPhisher	Browse	104.98.116.138
	tmp59ED.html	Get hash	malicious	HTMLPhisher	Browse	104.98.116.138
	tmp8011.html	Get hash	malicious	HTMLPhisher	Browse	104.98.116.138
	https://bitbucket.org/roootscauses/loralenahai/downloads/Scannned_Proforma_Invoices.pdf.zip	Get hash	malicious	Unknown	Browse	104.98.116.138
	https://smbc-fsv6.shop/	Get hash	malicious	Unknown	Browse	104.98.116.138
	https://www.nhcarib.com/funccode.php	Get hash	malicious	Unknown	Browse	104.98.116.138
	http://americanexpressjywtwg.com/ja-jp/account/login	Get hash	malicious	Unknown	Browse	104.98.116.138
	https://smbbc-static.top/mem/index.html	Get hash	malicious	Unknown	Browse	104.98.116.138
	https://mail.104-194-156-45.cprapid.com/	Get hash	malicious	HTMLPhisher	Browse	104.98.116.138
	https://oxysystem.com/	Get hash	malicious	Unknown	Browse	104.98.116.138
	https://pub-9d707922154f4c4f9b20de6322835d6e.r2.dev/index.html	Get hash	malicious	HTMLPhisher	Browse	104.98.116.138
	https://trk.klclick3.com/ls/click?upn=ywBj43t9mVZI2hb2gzrWF7Y8ryyoXhCo72e-2FM6zXEePQKo8cGXdkY5zeBZSy0J69v4Sr1TFdBVAeLFvQIS6d5R-2BgnGf1fTK65ST8Cnjirxi7QmEXlA7wmb8GMeOQaMDoHOp-2FG86qr3iSN-2B7L4yYONw-3D-3D_ebm_PoPSv5Gw7kvm-2FaTPf5isV0F8OzVemx3-2BMda5lKttFwV5hYNASaBIOvhduvo23ZgN-2F8HqQRRSFyPnwsEPnCA4w6P3MZBb-2Fu7ndoP5jkyHgtPAjr1IIhAIBOj2tEXqozsB0JYWfrFie-2BoFymTIhPQam-2FQtdD82B1vvkVKlb2qkhyxCtFQY30ybv9whlz89clNYbKoRRrUVBhqVsw9oCUod-2BCA2Wjmxbz0N4lgLVECydwXz-2BPbht-2FggL4TKlWcAbuOFjLVcrlL7S28da2YF-2Fd5XZQ3aIWgulgAXIz4I5F7RAodOfCBNslNhrGqSfBLgshw2	Get hash	malicious	Fake Captcha	Browse	104.98.116.138
	http://lola.banca888b.info/4WReEa1975KJwf227rfpjpljqzg14482JCRGLGDBJKCITHK37301PDVC7685U12	Get hash	malicious	Phisher	Browse	104.98.116.138
	https://nervous-seed-snowplow.glitch.me	Get hash	malicious	Unknown	Browse	104.98.116.138
	http://exclusifmoveis.com.br/new/auth	Get hash	malicious	Unknown	Browse	104.98.116.138
28a2c9bd18a11de089ef85a160da29e4	https://ndlc.us21.list-manage.com/track/click?u=c019ce2ced9d9c49756fb7da7&id=21b55f31be&e=398702c985	Get hash	malicious	HTMLPhisher	Browse	40.126.28.19 52.165.165.26 20.12.23.50
	https://bafybeidjq7rweeul3rjin2gfuijmvdh6wiawwym3ecc5gblqbosbtnfohi.ipfs.dweb.link/MTcwMTc4NzYyMQ?fHqJzfixed8RVeoK2Gs4BnPzdDuay3zWxUWDLB7p2656-sfmaxmaersk-pgx--ifxBettina.alberti-isxdaiichi-sankyo.eusf-1MC4y	Get hash	malicious	Unknown	Browse	40.126.28.19 52.165.165.26 20.12.23.50
	https://4nlmaunw.maktubb.com.br/cantehanger/am9zdWxsaXZhbkBjd2luZ2F0ZS5jb20=	Get hash	malicious	Unknown	Browse	40.126.28.19 52.165.165.26 20.12.23.50
	https://www.evernote.com/shard/s371/client/snv?isnewsnv=true&noteGuid=a553f699-8d8c-6d7a-7038-ed7dfe2d2412&noteKey=d4DcUbUev07ivx9dSCatHIXpZcTjwRaFe9Bb6knx7fD4Ix3t-8j9-rzsWA&sn=https%3A%2F%2Fwww.evernote.com%2Fshard%2Fs371%2Fsh%2Fa553f699-8d8c-6d7a-7038-ed7dfe2d2412%2Fd4DcUbUev07ivx9dSCatHIXpZcTjwRaFe9Bb6knx7fD4Ix3t-8j9-rzsWA&title=Town%2Bof%2BStratford%257E%2BDecember%2B6%252C%2B2023	Get hash	malicious	Unknown	Browse	40.126.28.19 52.165.165.26 20.12.23.50
	https://i.nupem.ufrj.br/Jakro_7DJSD	Get hash	malicious	HTMLPhisher	Browse	40.126.28.19 52.165.165.26 20.12.23.50
	Google_Gemini_AI_Ultra_v1.msi	Get hash	malicious	Unknown	Browse	40.126.28.19 52.165.165.26 20.12.23.50
	http://arsyology.xyz/gYefq09	Get hash	malicious	Unknown	Browse	40.126.28.19 52.165.165.26 20.12.23.50
	https://t.co/XbiWikRFDe	Get hash	malicious	Phisher	Browse	40.126.28.19 52.165.165.26 20.12.23.50
	https://minimalistbeliever.com/fa176211-3f4a-4815-bc61-5fa2c7f65fac/%7Byq3kVec)WO2l0D(_A,FBZt_o5~ld,g4Xi%7DXH&%5E3ygoA_StKyQ8%5EX23DpDe%60Eg7Ij$(%5Et%7BYuUh%7CDcomsDIB2B%5E7YL5B~ht(HNvGrU%7DfZn$v1QgXd9ZjVpe$Nyk7N&MzS6_%3E$,2Ck323fJBkG6ool0%5D~30)FIYE36sKCU%5BH0Ui%7B%3ERq.$Te3%3EgGSTVq1Fs4$o$VYm7ve,77%3Cw0e%3CT(A%7D%5E%5Be4&CQhWXTM7q.cbv-wu-d8mIRohAk%5Bm%3Ef_z%3Cum/verify?Vjf)dxIwh$EicXHFrE%60%5BIMXZ4hRpJg6D%7B.VMq92Y,OR(-bGUahj%3C&nM6Dh%3CnDY%5BtyECQdWO%3Cm~Ys6%60N&WhjNHB3rPU--qyjDJikV2Ar0&IM%3E&msS4BuB.90,AhZ6O9zG%5D~j5q6WpAOi$Oxd1Xnb~kM%5BH%7C%7BZyKp%5ERPm2%7Cj7cUu_Q9J&Ug9o_3ox.Lhdh%3C28Sp2df2dO~Ne,%5EL%3Ct1_~qgWS%5E-YhLiR8.FUkFb%7D7BbS)A%7CNhAb%3Es%5D%60BWZkwP.K%7DL$&data=mhj@sampension.dk	Get hash	malicious	Unknown	Browse	40.126.28.19 52.165.165.26 20.12.23.50
	https://79968e9b.6ad65e5283e89d8125e9a66c.workers.dev/	Get hash	malicious	HTMLPhisher	Browse	40.126.28.19 52.165.165.26 20.12.23.50
	tmpBA1E.html	Get hash	malicious	HTMLPhisher	Browse	40.126.28.19 52.165.165.26 20.12.23.50
	http://cz63224.tw1.ru/clients/login.php	Get hash	malicious	Unknown	Browse	40.126.28.19 52.165.165.26 20.12.23.50
	tmpB930.html	Get hash	malicious	HTMLPhisher	Browse	40.126.28.19 52.165.165.26 20.12.23.50
	tmpA8C2.html	Get hash	malicious	HTMLPhisher	Browse	40.126.28.19 52.165.165.26 20.12.23.50
	tmp2D5E.html	Get hash	malicious	HTMLPhisher	Browse	40.126.28.19 52.165.165.26 20.12.23.50
	tmp59A1.html	Get hash	malicious	HTMLPhisher	Browse	40.126.28.19 52.165.165.26 20.12.23.50
	tmp59ED.html	Get hash	malicious	HTMLPhisher	Browse	40.126.28.19 52.165.165.26 20.12.23.50
	tmp8011.html	Get hash	malicious	HTMLPhisher	Browse	40.126.28.19 52.165.165.26 20.12.23.50
	tmp7738.html	Get hash	malicious	HTMLPhisher	Browse	40.126.28.19 52.165.165.26 20.12.23.50
	tmp1F2B.html	Get hash	malicious	HTMLPhisher	Browse	40.126.28.19 52.165.165.26 20.12.23.50

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	6448
Entropy (8bit):	7.897260397307811
Encrypted:	false
SSDEEP:	192:tgaoRbo1sMjb0NiJ85oPtqcS+yaXWoa8XBzdJYnLYFtWT7:LR1sk+i4o1qc1yaukzd8MK
MD5:	42A840DC06727E42D42C352703EC72AA
SHA1:	21AAAF517AFB76BF1AF4E06134786B1716241D29
SHA-256:	02CCE7D526F844F70093AC41731D1A1E9B040905DCBA63BA8BFFC0DBD4D3A7A7
SHA-512:	8886BFD240D070237317352DEB3D46C6B07E392EBD57730B1DED016BD8740E75B9965F7A3FCD43796864F32AAE0BE911AB1A670E9CCC70E0774F64B1BDA93488
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	PK.........k.>........'......diagrams/layout1.xmlz........].r.8.}.V.?p.n....g5..JUn.....(SU......T.l.......X.d."m."..S....F..P.........-..<Y^..=..e.L....m>.pG.....M~...+\....u}o...".Yn}Y.".-r......0...'/........{........F.~.M8.d....(.....q.D.....4\.;.D,.\.)n.S....Z.cl.\|<..7._.dk..7..E.......kS...d.....i.....noX...o.W#9..}.^..I0....G.......+.K.[i.O.\|G..8=.;.8.8.8.8.....{..-..^.y..[.....`...0..f...Q<^~...l....{...pA.z.$.$R.../...E.(..Q.(V.E_ ......X]Q..Y9.......>...8......l..--.ug.......I.;..].u.b.3Lv:.d.%H..l<...V...$.M..A>...^M./.[..I....o~,.U. .$d\..?........O.;..^M..O...A.$Yx..\|f.n...H.=.\|!cG)dd%..(... ..Xe......2B."i...n....P.R..E?... Y.I6...7n..Xs..J..K..'..JaU..d..\|.(y.a.....d......D.Dr...._.._..m..Yu..6.o.\......&.m....wy...4k?..~........f....0.. \...}iS.i..R....q-#_..g........{Z.u.V.r(....j.I...,R..f.=.n.[.'..L'd.n C.0.I.....RpaV........c.k..NR....)B^k...d.i...d0.E. ^..G.']....x.c.>'..p...y.ny.P.x6..%.J\.....De.B\.

File type:	Microsoft Word 2007+
Entropy (8bit):	7.971120931205593
TrID:	Word Microsoft Office Open XML Format document (49504/1) 49.01% Word Microsoft Office Open XML Format document (43504/1) 43.07% ZIP compressed archive (8000/1) 7.92%
File name:	Proposal From PipelinerSales Inc.docx
File size:	37'761 bytes
MD5:	d4359887848e7f1ba824eafe175752cc
SHA1:	3143c5b061c177d49dd2fa0e3cee5aac087c2c22
SHA256:	ba759e8d9fd45a6c67741ca480413e9405caea520f72b538db3ed8b4b6380430
SHA512:	07a557bbfcce808f429095d625eed1474265a0eccfee59137e9e96332bf855e32a3f5b62deb222da3bba4afcd8c5c3b0b819d382a6ff44b3591876ec6c2f5b4f
SSDEEP:	384:Ca5VuUvUN4tOi30+718s/TPwjC62yoomLjhsbVfGH2+RX1dGWKWFWjWMmE5z8UOM:X1MG3/LvXtv1dlKefA4UO0aTd1dod
TLSH:	6A03F166938DA9A9C7F1877863CE8F70F52ED4C3D735A4166EDB52C03891526C3AB003
File Content Preview:	PK.........(xW....^...........[Content_Types].xml.TKN.0..J.-J..@.5...B%z......G..w6...+0IJ...A..D...f.....h..e....5).&....6S.H.....M....A..jB...... ..EH..C..z-....N.wQ.........`...... .....-]7.......Xy.L8W*)..\|m...x.......r...,...u.....3..Q.......t......J

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Proposal From PipelinerSales Inc.docx

Overview

General Information

Detection

Signatures

Classification

Analysis Advice

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

Compliance

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Errors

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

(copy)

C:\Users\user\AppData\Local\Microsoft\FontCache\4\Catalog\ListAll.Json

C:\Users\user\AppData\Local\Microsoft\FontCache\4\PreviewFont\flat_officeFontsPreview_4_38.ttf

C:\Users\user\AppData\Local\Microsoft\Office\16.0\UsageMetricsStore\FileActivityStore\Word\1380790193167760279.C4

C:\Users\user\AppData\Local\Microsoft\Office\16.0\UsageMetricsStore\FileActivityStore\Word\ASkwMDAwMDAwMC0wMDAwLTAwMDAtMDAwMC0wMDAwMDAwMDAwMDBfTnVsbAA.S

C:\Users\user\AppData\Local\Microsoft\Office\16.0\UsageMetricsStore\FileActivityStore\Word\ASkwMDAwMDAwMC0wMDAwLTAwMDAtMDAwMC0wMDAwMDAwMDAwMDBfTnVsbAM.S

C:\Users\user\AppData\Local\Microsoft\Office\16.0\UsageMetricsStore\FileActivityStore\Word\ASkwMDAwMDAwMC0wMDAwLTAwMDAtMDAwMC0wMDAwMDAwMDAwMDBfTnVsbAQ.S

C:\Users\user\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\17ACEF52-4111-45FD-8780-2A6A264BA30A

C:\Users\user\AppData\Local\Microsoft\Office\OTele\winword.exe.db

C:\Users\user\AppData\Local\Microsoft\Office\OTele\winword.exe.db-journal

C:\Users\user\AppData\Local\Microsoft\Office\OTele\winword.exe.db-shm

C:\Users\user\AppData\Local\Microsoft\Office\OTele\winword.exe.db-wal

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\089d66ba04a8cec4bdc5267f42f39cf84278bb67.tbres

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\56a61aeb75d8f5be186c26607f4bb213abe7c5ec.tbres

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\C23A59D1.png

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\E228D59E.png

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRF{3776E5C8-62FC-4362-886D-86C7F61A6353}.tmp

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{167B60C9-5A05-4CD8-8AF1-E55AAE73B690}.tmp

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{5531EDE0-F271-4FAB-9982-3E2D76BE462B}.tmp

C:\Users\user\AppData\Local\Temp\Diagnostics\WINWORD\App1702043007932456500_F07F6EB1-B030-47D7-B01C-C502C34F4874.log

C:\Users\user\AppData\Local\Temp\TCD389C.tmp\Content.inf

C:\Users\user\AppData\Local\Temp\TCD389C.tmp\ThemePictureAccent.glox

C:\Users\user\AppData\Local\Temp\TCD38AE.tmp\Content.inf

C:\Users\user\AppData\Local\Temp\TCD38AE.tmp\HexagonRadial.glox

C:\Users\user\AppData\Local\Temp\TCD38BE.tmp\Content.inf

Windows Analysis Report
Proposal From PipelinerSales Inc.docx

Has Summary Info:
Application Name:
Encrypted Document:	False
Contains Word Document Stream:	True
Contains Workbook/Book Stream:	False
Contains PowerPoint Document Stream:	False
Contains Visio Document Stream:	False
Contains ObjectPool Stream:	False
Flash Objects Count:	0
Contains VBA Macros:	False

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 8, 2023 14:43:23.004122972 CET	49671	443	192.168.2.7	204.79.197.203
Dec 8, 2023 14:43:25.614451885 CET	49675	443	192.168.2.7	104.98.116.138
Dec 8, 2023 14:43:25.614456892 CET	49674	443	192.168.2.7	104.98.116.138
Dec 8, 2023 14:43:25.726339102 CET	49672	443	192.168.2.7	104.98.116.138
Dec 8, 2023 14:43:27.020975113 CET	49677	443	192.168.2.7	20.50.201.200
Dec 8, 2023 14:43:27.394774914 CET	49677	443	192.168.2.7	20.50.201.200
Dec 8, 2023 14:43:27.816648960 CET	49671	443	192.168.2.7	204.79.197.203
Dec 8, 2023 14:43:28.144750118 CET	49677	443	192.168.2.7	20.50.201.200
Dec 8, 2023 14:43:29.644742966 CET	49677	443	192.168.2.7	20.50.201.200
Dec 8, 2023 14:43:32.629180908 CET	49677	443	192.168.2.7	20.50.201.200
Dec 8, 2023 14:43:34.788430929 CET	49708	443	192.168.2.7	40.126.28.19
Dec 8, 2023 14:43:34.788477898 CET	443	49708	40.126.28.19	192.168.2.7
Dec 8, 2023 14:43:34.788558960 CET	49708	443	192.168.2.7	40.126.28.19
Dec 8, 2023 14:43:34.790461063 CET	49708	443	192.168.2.7	40.126.28.19
Dec 8, 2023 14:43:34.790493011 CET	443	49708	40.126.28.19	192.168.2.7
Dec 8, 2023 14:43:35.222898006 CET	49674	443	192.168.2.7	104.98.116.138
Dec 8, 2023 14:43:35.222906113 CET	49675	443	192.168.2.7	104.98.116.138
Dec 8, 2023 14:43:35.276278973 CET	443	49708	40.126.28.19	192.168.2.7
Dec 8, 2023 14:43:35.276356936 CET	49708	443	192.168.2.7	40.126.28.19
Dec 8, 2023 14:43:35.332288027 CET	49672	443	192.168.2.7	104.98.116.138
Dec 8, 2023 14:43:35.753562927 CET	49708	443	192.168.2.7	40.126.28.19
Dec 8, 2023 14:43:35.753597021 CET	443	49708	40.126.28.19	192.168.2.7
Dec 8, 2023 14:43:35.754061937 CET	443	49708	40.126.28.19	192.168.2.7
Dec 8, 2023 14:43:35.755979061 CET	49708	443	192.168.2.7	40.126.28.19
Dec 8, 2023 14:43:35.756026030 CET	49708	443	192.168.2.7	40.126.28.19
Dec 8, 2023 14:43:35.756061077 CET	443	49708	40.126.28.19	192.168.2.7
Dec 8, 2023 14:43:36.118431091 CET	443	49708	40.126.28.19	192.168.2.7
Dec 8, 2023 14:43:36.118460894 CET	443	49708	40.126.28.19	192.168.2.7
Dec 8, 2023 14:43:36.118499994 CET	443	49708	40.126.28.19	192.168.2.7
Dec 8, 2023 14:43:36.118555069 CET	443	49708	40.126.28.19	192.168.2.7
Dec 8, 2023 14:43:36.118594885 CET	49708	443	192.168.2.7	40.126.28.19
Dec 8, 2023 14:43:36.118633986 CET	49708	443	192.168.2.7	40.126.28.19
Dec 8, 2023 14:43:36.123799086 CET	49708	443	192.168.2.7	40.126.28.19
Dec 8, 2023 14:43:36.123825073 CET	443	49708	40.126.28.19	192.168.2.7
Dec 8, 2023 14:43:36.123843908 CET	49708	443	192.168.2.7	40.126.28.19
Dec 8, 2023 14:43:36.123851061 CET	443	49708	40.126.28.19	192.168.2.7
Dec 8, 2023 14:43:36.786042929 CET	443	49699	104.98.116.138	192.168.2.7
Dec 8, 2023 14:43:36.786171913 CET	49699	443	192.168.2.7	104.98.116.138
Dec 8, 2023 14:43:37.426086903 CET	49671	443	192.168.2.7	204.79.197.203
Dec 8, 2023 14:43:38.582410097 CET	49677	443	192.168.2.7	20.50.201.200
Dec 8, 2023 14:43:46.085689068 CET	49768	443	192.168.2.7	20.12.23.50
Dec 8, 2023 14:43:46.085745096 CET	443	49768	20.12.23.50	192.168.2.7
Dec 8, 2023 14:43:46.085830927 CET	49768	443	192.168.2.7	20.12.23.50
Dec 8, 2023 14:43:46.088145971 CET	49768	443	192.168.2.7	20.12.23.50
Dec 8, 2023 14:43:46.088175058 CET	443	49768	20.12.23.50	192.168.2.7
Dec 8, 2023 14:43:46.896202087 CET	443	49768	20.12.23.50	192.168.2.7
Dec 8, 2023 14:43:46.896265984 CET	49768	443	192.168.2.7	20.12.23.50
Dec 8, 2023 14:43:46.901905060 CET	49768	443	192.168.2.7	20.12.23.50
Dec 8, 2023 14:43:46.901912928 CET	443	49768	20.12.23.50	192.168.2.7
Dec 8, 2023 14:43:46.902204990 CET	443	49768	20.12.23.50	192.168.2.7
Dec 8, 2023 14:43:46.957294941 CET	49768	443	192.168.2.7	20.12.23.50
Dec 8, 2023 14:43:47.940560102 CET	49768	443	192.168.2.7	20.12.23.50
Dec 8, 2023 14:43:47.980734110 CET	443	49768	20.12.23.50	192.168.2.7
Dec 8, 2023 14:43:48.053170919 CET	49699	443	192.168.2.7	104.98.116.138
Dec 8, 2023 14:43:48.053170919 CET	49699	443	192.168.2.7	104.98.116.138
Dec 8, 2023 14:43:48.055258989 CET	49771	443	192.168.2.7	104.98.116.138
Dec 8, 2023 14:43:48.055301905 CET	443	49771	104.98.116.138	192.168.2.7
Dec 8, 2023 14:43:48.055526972 CET	49771	443	192.168.2.7	104.98.116.138
Dec 8, 2023 14:43:48.062357903 CET	49771	443	192.168.2.7	104.98.116.138
Dec 8, 2023 14:43:48.062381983 CET	443	49771	104.98.116.138	192.168.2.7
Dec 8, 2023 14:43:48.241262913 CET	443	49699	104.98.116.138	192.168.2.7
Dec 8, 2023 14:43:48.241280079 CET	443	49699	104.98.116.138	192.168.2.7
Dec 8, 2023 14:43:48.248209000 CET	443	49768	20.12.23.50	192.168.2.7
Dec 8, 2023 14:43:48.248229980 CET	443	49768	20.12.23.50	192.168.2.7
Dec 8, 2023 14:43:48.248236895 CET	443	49768	20.12.23.50	192.168.2.7
Dec 8, 2023 14:43:48.248264074 CET	443	49768	20.12.23.50	192.168.2.7
Dec 8, 2023 14:43:48.248281956 CET	443	49768	20.12.23.50	192.168.2.7
Dec 8, 2023 14:43:48.248291016 CET	443	49768	20.12.23.50	192.168.2.7
Dec 8, 2023 14:43:48.248385906 CET	49768	443	192.168.2.7	20.12.23.50
Dec 8, 2023 14:43:48.248423100 CET	443	49768	20.12.23.50	192.168.2.7
Dec 8, 2023 14:43:48.248435020 CET	443	49768	20.12.23.50	192.168.2.7
Dec 8, 2023 14:43:48.248481035 CET	49768	443	192.168.2.7	20.12.23.50
Dec 8, 2023 14:43:48.248537064 CET	49768	443	192.168.2.7	20.12.23.50
Dec 8, 2023 14:43:48.248537064 CET	49768	443	192.168.2.7	20.12.23.50
Dec 8, 2023 14:43:48.303503036 CET	49768	443	192.168.2.7	20.12.23.50
Dec 8, 2023 14:43:48.303535938 CET	443	49768	20.12.23.50	192.168.2.7
Dec 8, 2023 14:43:48.303899050 CET	49768	443	192.168.2.7	20.12.23.50
Dec 8, 2023 14:43:48.303905964 CET	443	49768	20.12.23.50	192.168.2.7
Dec 8, 2023 14:43:48.452347040 CET	443	49771	104.98.116.138	192.168.2.7
Dec 8, 2023 14:43:48.457355022 CET	49771	443	192.168.2.7	104.98.116.138
Dec 8, 2023 14:43:48.534302950 CET	49771	443	192.168.2.7	104.98.116.138
Dec 8, 2023 14:43:48.534337044 CET	443	49771	104.98.116.138	192.168.2.7
Dec 8, 2023 14:43:48.534868002 CET	443	49771	104.98.116.138	192.168.2.7
Dec 8, 2023 14:43:48.536293983 CET	49771	443	192.168.2.7	104.98.116.138
Dec 8, 2023 14:43:48.536998034 CET	49771	443	192.168.2.7	104.98.116.138
Dec 8, 2023 14:43:48.536998034 CET	49771	443	192.168.2.7	104.98.116.138
Dec 8, 2023 14:43:48.537036896 CET	443	49771	104.98.116.138	192.168.2.7
Dec 8, 2023 14:43:48.856292963 CET	443	49771	104.98.116.138	192.168.2.7
Dec 8, 2023 14:43:48.856391907 CET	49771	443	192.168.2.7	104.98.116.138
Dec 8, 2023 14:43:48.856796980 CET	443	49771	104.98.116.138	192.168.2.7
Dec 8, 2023 14:43:48.856858969 CET	49771	443	192.168.2.7	104.98.116.138
Dec 8, 2023 14:43:48.856859922 CET	443	49771	104.98.116.138	192.168.2.7
Dec 8, 2023 14:43:48.857086897 CET	49771	443	192.168.2.7	104.98.116.138
Dec 8, 2023 14:43:50.488702059 CET	49677	443	192.168.2.7	20.50.201.200
Dec 8, 2023 14:44:02.123800993 CET	49774	443	192.168.2.7	142.250.217.173
Dec 8, 2023 14:44:02.123847961 CET	443	49774	142.250.217.173	192.168.2.7
Dec 8, 2023 14:44:02.123928070 CET	49774	443	192.168.2.7	142.250.217.173
Dec 8, 2023 14:44:02.124459982 CET	49775	443	192.168.2.7	142.250.64.174
Dec 8, 2023 14:44:02.124511957 CET	443	49775	142.250.64.174	192.168.2.7
Dec 8, 2023 14:44:02.124576092 CET	49775	443	192.168.2.7	142.250.64.174
Dec 8, 2023 14:44:02.125576973 CET	49774	443	192.168.2.7	142.250.217.173
Dec 8, 2023 14:44:02.125591040 CET	443	49774	142.250.217.173	192.168.2.7
Dec 8, 2023 14:44:02.125833988 CET	49775	443	192.168.2.7	142.250.64.174
Dec 8, 2023 14:44:02.125849009 CET	443	49775	142.250.64.174	192.168.2.7
Dec 8, 2023 14:44:02.447525978 CET	443	49774	142.250.217.173	192.168.2.7
Dec 8, 2023 14:44:02.447985888 CET	49774	443	192.168.2.7	142.250.217.173
Dec 8, 2023 14:44:02.448013067 CET	443	49774	142.250.217.173	192.168.2.7
Dec 8, 2023 14:44:02.449054956 CET	443	49774	142.250.217.173	192.168.2.7
Dec 8, 2023 14:44:02.449141979 CET	49774	443	192.168.2.7	142.250.217.173
Dec 8, 2023 14:44:02.451539993 CET	49774	443	192.168.2.7	142.250.217.173
Dec 8, 2023 14:44:02.451786995 CET	443	49774	142.250.217.173	192.168.2.7
Dec 8, 2023 14:44:02.452245951 CET	49774	443	192.168.2.7	142.250.217.173
Dec 8, 2023 14:44:02.452260017 CET	443	49774	142.250.217.173	192.168.2.7
Dec 8, 2023 14:44:02.454551935 CET	443	49775	142.250.64.174	192.168.2.7
Dec 8, 2023 14:44:02.454721928 CET	49775	443	192.168.2.7	142.250.64.174
Dec 8, 2023 14:44:02.454749107 CET	443	49775	142.250.64.174	192.168.2.7
Dec 8, 2023 14:44:02.455137968 CET	443	49775	142.250.64.174	192.168.2.7
Dec 8, 2023 14:44:02.455199957 CET	49775	443	192.168.2.7	142.250.64.174
Dec 8, 2023 14:44:02.455853939 CET	443	49775	142.250.64.174	192.168.2.7
Dec 8, 2023 14:44:02.455934048 CET	49775	443	192.168.2.7	142.250.64.174
Dec 8, 2023 14:44:02.456862926 CET	49775	443	192.168.2.7	142.250.64.174
Dec 8, 2023 14:44:02.456928968 CET	443	49775	142.250.64.174	192.168.2.7
Dec 8, 2023 14:44:02.457150936 CET	49775	443	192.168.2.7	142.250.64.174
Dec 8, 2023 14:44:02.457159996 CET	443	49775	142.250.64.174	192.168.2.7
Dec 8, 2023 14:44:02.504317999 CET	49775	443	192.168.2.7	142.250.64.174
Dec 8, 2023 14:44:02.504323959 CET	49774	443	192.168.2.7	142.250.217.173
Dec 8, 2023 14:44:02.731528044 CET	443	49774	142.250.217.173	192.168.2.7
Dec 8, 2023 14:44:02.731755972 CET	443	49775	142.250.64.174	192.168.2.7
Dec 8, 2023 14:44:02.731873989 CET	443	49774	142.250.217.173	192.168.2.7
Dec 8, 2023 14:44:02.731951952 CET	49774	443	192.168.2.7	142.250.217.173
Dec 8, 2023 14:44:02.732012033 CET	443	49775	142.250.64.174	192.168.2.7
Dec 8, 2023 14:44:02.732070923 CET	49775	443	192.168.2.7	142.250.64.174
Dec 8, 2023 14:44:02.733182907 CET	49775	443	192.168.2.7	142.250.64.174
Dec 8, 2023 14:44:02.733200073 CET	443	49775	142.250.64.174	192.168.2.7
Dec 8, 2023 14:44:02.733632088 CET	49774	443	192.168.2.7	142.250.217.173
Dec 8, 2023 14:44:02.733653069 CET	443	49774	142.250.217.173	192.168.2.7
Dec 8, 2023 14:44:04.035804987 CET	49777	443	192.168.2.7	76.223.67.189
Dec 8, 2023 14:44:04.035845041 CET	443	49777	76.223.67.189	192.168.2.7
Dec 8, 2023 14:44:04.035957098 CET	49777	443	192.168.2.7	76.223.67.189
Dec 8, 2023 14:44:04.036369085 CET	49778	443	192.168.2.7	76.223.67.189
Dec 8, 2023 14:44:04.036412954 CET	443	49778	76.223.67.189	192.168.2.7
Dec 8, 2023 14:44:04.036499023 CET	49778	443	192.168.2.7	76.223.67.189
Dec 8, 2023 14:44:04.036608934 CET	49777	443	192.168.2.7	76.223.67.189
Dec 8, 2023 14:44:04.036621094 CET	443	49777	76.223.67.189	192.168.2.7
Dec 8, 2023 14:44:04.036873102 CET	49778	443	192.168.2.7	76.223.67.189
Dec 8, 2023 14:44:04.036890030 CET	443	49778	76.223.67.189	192.168.2.7
Dec 8, 2023 14:44:04.601010084 CET	443	49777	76.223.67.189	192.168.2.7
Dec 8, 2023 14:44:04.601035118 CET	443	49777	76.223.67.189	192.168.2.7
Dec 8, 2023 14:44:04.601171970 CET	49777	443	192.168.2.7	76.223.67.189
Dec 8, 2023 14:44:04.601428032 CET	49777	443	192.168.2.7	76.223.67.189
Dec 8, 2023 14:44:04.601444006 CET	443	49777	76.223.67.189	192.168.2.7
Dec 8, 2023 14:44:04.601855040 CET	49780	443	192.168.2.7	76.223.67.189
Dec 8, 2023 14:44:04.601896048 CET	443	49780	76.223.67.189	192.168.2.7
Dec 8, 2023 14:44:04.602039099 CET	49780	443	192.168.2.7	76.223.67.189
Dec 8, 2023 14:44:04.602395058 CET	49780	443	192.168.2.7	76.223.67.189
Dec 8, 2023 14:44:04.602407932 CET	443	49780	76.223.67.189	192.168.2.7
Dec 8, 2023 14:44:05.157257080 CET	443	49780	76.223.67.189	192.168.2.7
Dec 8, 2023 14:44:05.157438993 CET	443	49780	76.223.67.189	192.168.2.7
Dec 8, 2023 14:44:05.157532930 CET	49780	443	192.168.2.7	76.223.67.189
Dec 8, 2023 14:44:05.157569885 CET	49780	443	192.168.2.7	76.223.67.189
Dec 8, 2023 14:44:05.157588959 CET	443	49780	76.223.67.189	192.168.2.7
Dec 8, 2023 14:44:05.535068035 CET	443	49778	76.223.67.189	192.168.2.7
Dec 8, 2023 14:44:05.535099983 CET	443	49778	76.223.67.189	192.168.2.7
Dec 8, 2023 14:44:05.535164118 CET	49778	443	192.168.2.7	76.223.67.189
Dec 8, 2023 14:44:05.535362005 CET	49778	443	192.168.2.7	76.223.67.189
Dec 8, 2023 14:44:05.535378933 CET	443	49778	76.223.67.189	192.168.2.7
Dec 8, 2023 14:44:05.535933971 CET	49783	443	192.168.2.7	76.223.67.189
Dec 8, 2023 14:44:05.535974979 CET	443	49783	76.223.67.189	192.168.2.7
Dec 8, 2023 14:44:05.536133051 CET	49783	443	192.168.2.7	76.223.67.189
Dec 8, 2023 14:44:05.536339998 CET	49783	443	192.168.2.7	76.223.67.189
Dec 8, 2023 14:44:05.536350965 CET	443	49783	76.223.67.189	192.168.2.7
Dec 8, 2023 14:44:06.093399048 CET	443	49783	76.223.67.189	192.168.2.7
Dec 8, 2023 14:44:06.093422890 CET	443	49783	76.223.67.189	192.168.2.7
Dec 8, 2023 14:44:06.093560934 CET	49783	443	192.168.2.7	76.223.67.189
Dec 8, 2023 14:44:06.093789101 CET	49783	443	192.168.2.7	76.223.67.189
Dec 8, 2023 14:44:06.093802929 CET	443	49783	76.223.67.189	192.168.2.7
Dec 8, 2023 14:44:06.617372990 CET	49784	443	192.168.2.7	142.250.189.132
Dec 8, 2023 14:44:06.617418051 CET	443	49784	142.250.189.132	192.168.2.7
Dec 8, 2023 14:44:06.617480993 CET	49784	443	192.168.2.7	142.250.189.132
Dec 8, 2023 14:44:06.618109941 CET	49784	443	192.168.2.7	142.250.189.132
Dec 8, 2023 14:44:06.618125916 CET	443	49784	142.250.189.132	192.168.2.7
Dec 8, 2023 14:44:06.900480032 CET	443	49784	142.250.189.132	192.168.2.7
Dec 8, 2023 14:44:06.900891066 CET	49784	443	192.168.2.7	142.250.189.132
Dec 8, 2023 14:44:06.900906086 CET	443	49784	142.250.189.132	192.168.2.7
Dec 8, 2023 14:44:06.902060986 CET	443	49784	142.250.189.132	192.168.2.7
Dec 8, 2023 14:44:06.902234077 CET	49784	443	192.168.2.7	142.250.189.132
Dec 8, 2023 14:44:06.903283119 CET	49784	443	192.168.2.7	142.250.189.132
Dec 8, 2023 14:44:06.903417110 CET	443	49784	142.250.189.132	192.168.2.7
Dec 8, 2023 14:44:06.957621098 CET	49784	443	192.168.2.7	142.250.189.132
Dec 8, 2023 14:44:06.957632065 CET	443	49784	142.250.189.132	192.168.2.7
Dec 8, 2023 14:44:07.004458904 CET	49784	443	192.168.2.7	142.250.189.132
Dec 8, 2023 14:44:16.890928030 CET	443	49784	142.250.189.132	192.168.2.7
Dec 8, 2023 14:44:16.891004086 CET	443	49784	142.250.189.132	192.168.2.7
Dec 8, 2023 14:44:16.891067028 CET	49784	443	192.168.2.7	142.250.189.132
Dec 8, 2023 14:44:18.303189039 CET	49784	443	192.168.2.7	142.250.189.132
Dec 8, 2023 14:44:18.303225994 CET	443	49784	142.250.189.132	192.168.2.7
Dec 8, 2023 14:44:25.399815083 CET	49785	443	192.168.2.7	52.165.165.26
Dec 8, 2023 14:44:25.399846077 CET	443	49785	52.165.165.26	192.168.2.7
Dec 8, 2023 14:44:25.399916887 CET	49785	443	192.168.2.7	52.165.165.26
Dec 8, 2023 14:44:25.400625944 CET	49785	443	192.168.2.7	52.165.165.26
Dec 8, 2023 14:44:25.400636911 CET	443	49785	52.165.165.26	192.168.2.7
Dec 8, 2023 14:44:25.921092033 CET	443	49785	52.165.165.26	192.168.2.7
Dec 8, 2023 14:44:25.921202898 CET	49785	443	192.168.2.7	52.165.165.26
Dec 8, 2023 14:44:25.925101995 CET	49785	443	192.168.2.7	52.165.165.26
Dec 8, 2023 14:44:25.925122976 CET	443	49785	52.165.165.26	192.168.2.7
Dec 8, 2023 14:44:25.925502062 CET	443	49785	52.165.165.26	192.168.2.7
Dec 8, 2023 14:44:25.937433004 CET	49785	443	192.168.2.7	52.165.165.26
Dec 8, 2023 14:44:25.984750986 CET	443	49785	52.165.165.26	192.168.2.7
Dec 8, 2023 14:44:26.429619074 CET	443	49785	52.165.165.26	192.168.2.7
Dec 8, 2023 14:44:26.429663897 CET	443	49785	52.165.165.26	192.168.2.7
Dec 8, 2023 14:44:26.429688931 CET	443	49785	52.165.165.26	192.168.2.7
Dec 8, 2023 14:44:26.429725885 CET	49785	443	192.168.2.7	52.165.165.26
Dec 8, 2023 14:44:26.429737091 CET	443	49785	52.165.165.26	192.168.2.7
Dec 8, 2023 14:44:26.429781914 CET	49785	443	192.168.2.7	52.165.165.26
Dec 8, 2023 14:44:26.430224895 CET	443	49785	52.165.165.26	192.168.2.7
Dec 8, 2023 14:44:26.430263042 CET	443	49785	52.165.165.26	192.168.2.7
Dec 8, 2023 14:44:26.430282116 CET	49785	443	192.168.2.7	52.165.165.26
Dec 8, 2023 14:44:26.430291891 CET	443	49785	52.165.165.26	192.168.2.7
Dec 8, 2023 14:44:26.430330992 CET	49785	443	192.168.2.7	52.165.165.26
Dec 8, 2023 14:44:26.430358887 CET	443	49785	52.165.165.26	192.168.2.7
Dec 8, 2023 14:44:26.430409908 CET	49785	443	192.168.2.7	52.165.165.26
Dec 8, 2023 14:44:26.438787937 CET	49785	443	192.168.2.7	52.165.165.26
Dec 8, 2023 14:44:26.438807011 CET	443	49785	52.165.165.26	192.168.2.7
Dec 8, 2023 14:44:26.438833952 CET	49785	443	192.168.2.7	52.165.165.26
Dec 8, 2023 14:44:26.438842058 CET	443	49785	52.165.165.26	192.168.2.7
Dec 8, 2023 14:45:06.552730083 CET	49788	443	192.168.2.7	142.250.189.132
Dec 8, 2023 14:45:06.552772045 CET	443	49788	142.250.189.132	192.168.2.7
Dec 8, 2023 14:45:06.552845001 CET	49788	443	192.168.2.7	142.250.189.132
Dec 8, 2023 14:45:06.553132057 CET	49788	443	192.168.2.7	142.250.189.132
Dec 8, 2023 14:45:06.553143978 CET	443	49788	142.250.189.132	192.168.2.7
Dec 8, 2023 14:45:06.831001043 CET	443	49788	142.250.189.132	192.168.2.7
Dec 8, 2023 14:45:06.831283092 CET	49788	443	192.168.2.7	142.250.189.132
Dec 8, 2023 14:45:06.831295013 CET	443	49788	142.250.189.132	192.168.2.7
Dec 8, 2023 14:45:06.831646919 CET	443	49788	142.250.189.132	192.168.2.7
Dec 8, 2023 14:45:06.831990957 CET	49788	443	192.168.2.7	142.250.189.132
Dec 8, 2023 14:45:06.832053900 CET	443	49788	142.250.189.132	192.168.2.7
Dec 8, 2023 14:45:06.879597902 CET	49788	443	192.168.2.7	142.250.189.132
Dec 8, 2023 14:45:16.809633017 CET	443	49788	142.250.189.132	192.168.2.7
Dec 8, 2023 14:45:16.809725046 CET	443	49788	142.250.189.132	192.168.2.7
Dec 8, 2023 14:45:16.809781075 CET	49788	443	192.168.2.7	142.250.189.132
Dec 8, 2023 14:45:18.304572105 CET	49788	443	192.168.2.7	142.250.189.132
Dec 8, 2023 14:45:18.304598093 CET	443	49788	142.250.189.132	192.168.2.7
Dec 8, 2023 14:45:31.835500956 CET	49789	443	192.168.2.7	142.250.217.206
Dec 8, 2023 14:45:31.835534096 CET	443	49789	142.250.217.206	192.168.2.7
Dec 8, 2023 14:45:31.835624933 CET	49789	443	192.168.2.7	142.250.217.206
Dec 8, 2023 14:45:31.835804939 CET	49789	443	192.168.2.7	142.250.217.206
Dec 8, 2023 14:45:31.835813999 CET	443	49789	142.250.217.206	192.168.2.7
Dec 8, 2023 14:45:32.116921902 CET	443	49789	142.250.217.206	192.168.2.7
Dec 8, 2023 14:45:32.117249012 CET	49789	443	192.168.2.7	142.250.217.206
Dec 8, 2023 14:45:32.117258072 CET	443	49789	142.250.217.206	192.168.2.7
Dec 8, 2023 14:45:32.117779970 CET	443	49789	142.250.217.206	192.168.2.7
Dec 8, 2023 14:45:32.117861986 CET	49789	443	192.168.2.7	142.250.217.206
Dec 8, 2023 14:45:32.118793011 CET	443	49789	142.250.217.206	192.168.2.7
Dec 8, 2023 14:45:32.118846893 CET	49789	443	192.168.2.7	142.250.217.206
Dec 8, 2023 14:45:32.119791031 CET	49789	443	192.168.2.7	142.250.217.206
Dec 8, 2023 14:45:32.119863033 CET	443	49789	142.250.217.206	192.168.2.7
Dec 8, 2023 14:45:32.119997025 CET	49789	443	192.168.2.7	142.250.217.206
Dec 8, 2023 14:45:32.120004892 CET	443	49789	142.250.217.206	192.168.2.7
Dec 8, 2023 14:45:32.160797119 CET	49789	443	192.168.2.7	142.250.217.206
Dec 8, 2023 14:45:32.387406111 CET	443	49789	142.250.217.206	192.168.2.7
Dec 8, 2023 14:45:32.388535023 CET	443	49789	142.250.217.206	192.168.2.7
Dec 8, 2023 14:45:32.388597012 CET	49789	443	192.168.2.7	142.250.217.206
Dec 8, 2023 14:45:32.388748884 CET	49789	443	192.168.2.7	142.250.217.206
Dec 8, 2023 14:45:32.388761997 CET	443	49789	142.250.217.206	192.168.2.7
Dec 8, 2023 14:46:06.615624905 CET	49790	443	192.168.2.7	142.250.189.132
Dec 8, 2023 14:46:06.615678072 CET	443	49790	142.250.189.132	192.168.2.7
Dec 8, 2023 14:46:06.615750074 CET	49790	443	192.168.2.7	142.250.189.132
Dec 8, 2023 14:46:06.616277933 CET	49790	443	192.168.2.7	142.250.189.132
Dec 8, 2023 14:46:06.616292953 CET	443	49790	142.250.189.132	192.168.2.7
Dec 8, 2023 14:46:06.894378901 CET	443	49790	142.250.189.132	192.168.2.7
Dec 8, 2023 14:46:06.894809961 CET	49790	443	192.168.2.7	142.250.189.132
Dec 8, 2023 14:46:06.894843102 CET	443	49790	142.250.189.132	192.168.2.7
Dec 8, 2023 14:46:06.895251989 CET	443	49790	142.250.189.132	192.168.2.7
Dec 8, 2023 14:46:06.895592928 CET	49790	443	192.168.2.7	142.250.189.132
Dec 8, 2023 14:46:06.895699024 CET	443	49790	142.250.189.132	192.168.2.7
Dec 8, 2023 14:46:06.942128897 CET	49790	443	192.168.2.7	142.250.189.132
Dec 8, 2023 14:46:16.880105019 CET	443	49790	142.250.189.132	192.168.2.7
Dec 8, 2023 14:46:16.880213976 CET	443	49790	142.250.189.132	192.168.2.7
Dec 8, 2023 14:46:16.880264044 CET	49790	443	192.168.2.7	142.250.189.132
Dec 8, 2023 14:46:18.304485083 CET	49790	443	192.168.2.7	142.250.189.132
Dec 8, 2023 14:46:18.304517984 CET	443	49790	142.250.189.132	192.168.2.7

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 8, 2023 14:43:33.536784887 CET	123	123	192.168.2.7	40.119.6.228
Dec 8, 2023 14:43:33.698760033 CET	123	123	40.119.6.228	192.168.2.7
Dec 8, 2023 14:44:01.893567085 CET	65169	53	192.168.2.7	1.1.1.1
Dec 8, 2023 14:44:01.893764019 CET	62263	53	192.168.2.7	1.1.1.1
Dec 8, 2023 14:44:01.894452095 CET	53776	53	192.168.2.7	1.1.1.1
Dec 8, 2023 14:44:01.894866943 CET	57850	53	192.168.2.7	1.1.1.1
Dec 8, 2023 14:44:02.011547089 CET	53	50206	1.1.1.1	192.168.2.7
Dec 8, 2023 14:44:02.018794060 CET	53	65169	1.1.1.1	192.168.2.7
Dec 8, 2023 14:44:02.019015074 CET	53	62263	1.1.1.1	192.168.2.7
Dec 8, 2023 14:44:02.019450903 CET	53	53776	1.1.1.1	192.168.2.7
Dec 8, 2023 14:44:02.019795895 CET	53	57850	1.1.1.1	192.168.2.7
Dec 8, 2023 14:44:02.908581018 CET	53	64187	1.1.1.1	192.168.2.7
Dec 8, 2023 14:44:03.903140068 CET	51703	53	192.168.2.7	1.1.1.1
Dec 8, 2023 14:44:03.903445005 CET	53476	53	192.168.2.7	1.1.1.1
Dec 8, 2023 14:44:04.032609940 CET	53	51703	1.1.1.1	192.168.2.7
Dec 8, 2023 14:44:04.035211086 CET	53	53476	1.1.1.1	192.168.2.7
Dec 8, 2023 14:44:05.319855928 CET	53	60095	1.1.1.1	192.168.2.7
Dec 8, 2023 14:44:06.489881039 CET	50551	53	192.168.2.7	1.1.1.1
Dec 8, 2023 14:44:06.490060091 CET	59298	53	192.168.2.7	1.1.1.1
Dec 8, 2023 14:44:06.615890980 CET	53	59298	1.1.1.1	192.168.2.7
Dec 8, 2023 14:44:06.615950108 CET	53	50551	1.1.1.1	192.168.2.7
Dec 8, 2023 14:44:19.818526030 CET	53	59577	1.1.1.1	192.168.2.7
Dec 8, 2023 14:44:27.510176897 CET	138	138	192.168.2.7	192.168.2.255
Dec 8, 2023 14:44:38.583693981 CET	53	52335	1.1.1.1	192.168.2.7
Dec 8, 2023 14:45:01.115261078 CET	53	53776	1.1.1.1	192.168.2.7
Dec 8, 2023 14:45:01.906164885 CET	53	52057	1.1.1.1	192.168.2.7
Dec 8, 2023 14:45:30.334841967 CET	53	57351	1.1.1.1	192.168.2.7
Dec 8, 2023 14:45:31.708548069 CET	64406	53	192.168.2.7	1.1.1.1
Dec 8, 2023 14:45:31.708981991 CET	59509	53	192.168.2.7	1.1.1.1
Dec 8, 2023 14:45:31.834445000 CET	53	64406	1.1.1.1	192.168.2.7
Dec 8, 2023 14:45:31.834924936 CET	53	59509	1.1.1.1	192.168.2.7
Dec 8, 2023 14:46:16.460042000 CET	53	55293	1.1.1.1	192.168.2.7

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 8, 2023 14:43:44.847156048 CET	1.1.1.1	192.168.2.7	0xbff6	No error (0)	templatesmetadata.office.net	templatesmetadata.office.net.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 8, 2023 14:44:02.018794060 CET	1.1.1.1	192.168.2.7	0xc68	No error (0)	clients2.google.com	clients.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 8, 2023 14:44:02.018794060 CET	1.1.1.1	192.168.2.7	0xc68	No error (0)	clients.l.google.com		142.250.64.174	A (IP address)	IN (0x0001)	false
Dec 8, 2023 14:44:02.019015074 CET	1.1.1.1	192.168.2.7	0x15a8	No error (0)	clients2.google.com	clients.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 8, 2023 14:44:02.019450903 CET	1.1.1.1	192.168.2.7	0x237	No error (0)	accounts.google.com		142.250.217.173	A (IP address)	IN (0x0001)	false
Dec 8, 2023 14:44:04.032609940 CET	1.1.1.1	192.168.2.7	0x82de	No error (0)	0245524080.hartis9.com		76.223.67.189	A (IP address)	IN (0x0001)	false
Dec 8, 2023 14:44:04.032609940 CET	1.1.1.1	192.168.2.7	0x82de	No error (0)	0245524080.hartis9.com		13.248.213.45	A (IP address)	IN (0x0001)	false
Dec 8, 2023 14:44:06.615890980 CET	1.1.1.1	192.168.2.7	0xdbd4	No error (0)	www.google.com			65	IN (0x0001)	false
Dec 8, 2023 14:44:06.615950108 CET	1.1.1.1	192.168.2.7	0x3130	No error (0)	www.google.com		142.250.189.132	A (IP address)	IN (0x0001)	false
Dec 8, 2023 14:45:31.834445000 CET	1.1.1.1	192.168.2.7	0xc6d6	No error (0)	clients1.google.com	clients.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 8, 2023 14:45:31.834445000 CET	1.1.1.1	192.168.2.7	0xc6d6	No error (0)	clients.l.google.com		142.250.217.206	A (IP address)	IN (0x0001)	false
Dec 8, 2023 14:45:31.834924936 CET	1.1.1.1	192.168.2.7	0x2342	No error (0)	clients1.google.com	clients.l.google.com		CNAME (Canonical name)	IN (0x0001)	false

Timestamp	Bytes transferred	Direction	Data
2023-12-08 13:43:35 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4718 Host: login.live.com
2023-12-08 13:43:35 UTC	4718	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2023-12-08 13:43:36 UTC	569	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f 6c 3a 20 6e 6f 2d 73 74 6f 72 65 2c 20 6e 6f 2d 63 61 63 68 65 0d 0a 50 72 61 67 6d 61 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 73 6f 61 70 2b 78 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 0d 0a 45 78 70 69 72 65 73 3a 20 46 72 69 2c 20 30 38 20 44 65 63 20 32 30 32 33 20 31 33 3a 34 32 3a 33 35 20 47 4d 54 0d 0a 50 33 50 3a 20 43 50 3d 22 44 53 50 20 43 55 52 20 4f 54 50 69 20 49 4e 44 20 4f 54 52 69 20 4f 4e 4c 20 46 49 4e 22 0d 0a 52 65 66 65 72 72 65 72 2d 50 6f 6c 69 63 79 3a 20 73 74 72 69 63 74 2d 6f 72 69 67 69 6e 2d 77 68 65 6e 2d 63 72 6f 73 73 2d 6f 72 69 67 69 6e 0d 0a 78 2d 6d Data Ascii: HTTP/1.1 200 OKCache-Control: no-store, no-cachePragma: no-cacheContent-Type: application/soap+xml; charset=utf-8Expires: Fri, 08 Dec 2023 13:42:35 GMTP3P: CP="DSP CUR OTPi IND OTRi ONL FIN"Referrer-Policy: strict-origin-when-cross-originx-m
2023-12-08 13:43:36 UTC	10197	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Timestamp	Bytes transferred	Direction	Data
2023-12-08 13:43:47 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=GfuoSMC4nRfmxZD&MD=1ltm755w HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2023-12-08 13:43:48 UTC	560	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 50 72 61 67 6d 61 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 45 78 70 69 72 65 73 3a 20 2d 31 0d 0a 4c 61 73 74 2d 4d 6f 64 69 66 69 65 64 3a 20 4d 6f 6e 2c 20 30 31 20 4a 61 6e 20 30 30 30 31 20 30 30 3a 30 30 3a 30 30 20 47 4d 54 0d 0a 45 54 61 67 3a 20 22 58 41 6f 70 61 7a 56 30 30 58 44 57 6e 4a 43 77 6b 6d 45 57 52 76 36 4a 6b 62 6a 52 41 39 51 53 53 5a 32 2b 65 2f 33 4d 7a 45 6b 3d 5f 32 38 38 30 22 0d 0a 4d 53 2d 43 6f 72 72 65 6c 61 74 69 6f 6e 49 64 3a 20 65 35 66 39 32 66 36 63 2d 66 64 34 31 2d 34 65 35 61 2d Data Ascii: HTTP/1.1 200 OKCache-Control: no-cachePragma: no-cacheContent-Type: application/octet-streamExpires: -1Last-Modified: Mon, 01 Jan 0001 00:00:00 GMTETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880"MS-CorrelationId: e5f92f6c-fd41-4e5a-
2023-12-08 13:43:48 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2023-12-08 13:43:48 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Timestamp	Bytes transferred	Direction	Data
2023-12-08 13:43:48 UTC	2205	OUT	POST /threshold/xls.aspx HTTP/1.1 Origin: https://www.bing.com Referer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/Init Accept: / Accept-Language: en-CH Content-type: text/xml X-Agent-DeviceId: 01000A4109005EFE X-BM-CBT: 1696492382 X-BM-DateFormat: dd/MM/yyyy X-BM-DeviceDimensions: 784x984 X-BM-DeviceDimensionsLogical: 784x984 X-BM-DeviceScale: 100 X-BM-DTZ: 60 X-BM-Market: CH X-BM-Theme: 000000;0078d7 X-BM-WindowsFlights: FX:117B9872,FX:119E26AD,FX:11C0E96C,FX:11C6E5C2,FX:11C7EB6A,FX:11C9408A,FX:11C940DB,FX:11CB9A9F,FX:11CB9AC1,FX:11CC111C,FX:11D5BFCD,FX:11DF5B12,FX:11DF5B75,FX:1240931B,FX:124B38D0,FX:127FC878,FX:1283FFE8,FX:12840617,FX:128979F9,FX:128EBD7E,FX:129135BB,FX:129E053F,FX:12A74DB5,FX:12AB734D,FX:12B8450E,FX:12BD6E73,FX:12C3331B,FX:12C7D66E X-Device-ClientSession: 7964DE11F2244989AF4CA95A808EA94C X-Device-isOptin: false X-Device-MachineId: {92C86F7C-DB2B-4F6A-95AD-98B4A2AE008A} X-Device-OSSKU: 48 X-Device-Touch: false X-DeviceID: 01000A4109005EFE X-MSEdge-ExternalExp: bfbwsbcm0921cf,d-thshld42,websuganno_t2,wsbmsaqfuxt3,wsbqfasmsall_t,wsbqfminiserp500,wsbref-t,wsbuacf X-MSEdge-ExternalExpType: JointCoord X-PositionerType: Desktop X-Search-AppId: Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUI X-Search-CortanaAvailableCapabilities: None X-Search-SafeSearch: Moderate X-Search-TimeZone: Bias=0; DaylightBias=-60; TimeZoneKeyName=GMT Standard Time X-UserAgeClass: Unknown Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: www.bing.com Content-Length: 516 Connection: Keep-Alive Cache-Control: no-cache Cookie: SRCHUID=V=2&GUID=19565074ACE142FCABAF0CDCC0DFAAEB&dmnchg=1; SRCHD=AF=NOFORM; SRCHUSR=DOB=20231005; SRCHHPGUSR=SRCHLANG=en&LUT=1696492216762&IPMH=45187fb8&IPMID=1696492382078&HV=1696492289; CortanaAppUID=FE52A12E95B5DF3DB5902D0602A16B66; MUID=A92BA4E78D2946A0AFDA5029FA43D7A8; _SS=SID=21E2F496C67F672E2F62E737C76966EF&CPID=1696492383022&AC=1&CPH=644b7eae; _EDGE_S=SID=21E2F496C67F672E2F62E737C76966EF; MUIDB=A92BA4E78D2946A0AFDA5029FA43D7A8
2023-12-08 13:43:48 UTC	1	OUT	Data Raw: 3c Data Ascii: <
2023-12-08 13:43:48 UTC	515	OUT	Data Raw: 43 6c 69 65 6e 74 49 6e 73 74 52 65 71 75 65 73 74 3e 3c 43 49 44 3e 41 39 32 42 41 34 45 37 38 44 32 39 34 36 41 30 41 46 44 41 35 30 32 39 46 41 34 33 44 37 41 38 3c 2f 43 49 44 3e 3c 45 76 65 6e 74 73 3e 3c 45 3e 3c 54 3e 45 76 65 6e 74 2e 43 6c 69 65 6e 74 49 6e 73 74 3c 2f 54 3e 3c 49 47 3e 37 35 31 45 39 44 31 37 45 34 43 44 34 32 45 42 41 41 36 41 45 35 39 41 36 45 44 35 43 32 32 41 3c 2f 49 47 3e 3c 44 3e 3c 21 5b 43 44 41 54 41 5b 7b 22 43 75 72 55 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 62 69 6e 67 2e 63 6f 6d 2f 41 53 2f 41 50 49 2f 57 69 6e 64 6f 77 73 43 6f 72 74 61 6e 61 50 61 6e 65 2f 56 32 2f 49 6e 69 74 22 2c 22 50 69 76 6f 74 22 3a 22 51 46 22 2c 22 54 22 3a 22 43 49 2e 42 6f 78 4d 6f 64 65 6c 22 2c 22 46 49 44 22 3a 22 43 49 Data Ascii: ClientInstRequest><CID>A92BA4E78D2946A0AFDA5029FA43D7A8</CID><Events><E><T>Event.ClientInst</T><IG>751E9D17E4CD42EBAA6AE59A6ED5C22A</IG><D><![CDATA[{"CurUrl":"https://www.bing.com/AS/API/WindowsCortanaPane/V2/Init","Pivot":"QF","T":"CI.BoxModel","FID":"CI
2023-12-08 13:43:48 UTC	475	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 34 20 4e 6f 20 43 6f 6e 74 65 6e 74 0d 0a 41 63 63 65 73 73 2d 43 6f 6e 74 72 6f 6c 2d 41 6c 6c 6f 77 2d 4f 72 69 67 69 6e 3a 20 2a 0d 0a 41 63 63 65 70 74 2d 43 48 3a 20 53 65 63 2d 43 48 2d 55 41 2d 41 72 63 68 2c 20 53 65 63 2d 43 48 2d 55 41 2d 42 69 74 6e 65 73 73 2c 20 53 65 63 2d 43 48 2d 55 41 2d 46 75 6c 6c 2d 56 65 72 73 69 6f 6e 2c 20 53 65 63 2d 43 48 2d 55 41 2d 46 75 6c 6c 2d 56 65 72 73 69 6f 6e 2d 4c 69 73 74 2c 20 53 65 63 2d 43 48 2d 55 41 2d 4d 6f 62 69 6c 65 2c 20 53 65 63 2d 43 48 2d 55 41 2d 4d 6f 64 65 6c 2c 20 53 65 63 2d 43 48 2d 55 41 2d 50 6c 61 74 66 6f 72 6d 2c 20 53 65 63 2d 43 48 2d 55 41 2d 50 6c 61 74 66 6f 72 6d 2d 56 65 72 73 69 6f 6e 0d 0a 58 2d 4d 53 45 64 67 65 2d 52 65 66 3a 20 52 65 Data Ascii: HTTP/1.1 204 No ContentAccess-Control-Allow-Origin: *Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionX-MSEdge-Ref: Re

Timestamp	Bytes transferred	Direction	Data
2023-12-08 13:44:02 UTC	680	OUT	POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1 Host: accounts.google.com Connection: keep-alive Content-Length: 1 Origin: https://www.google.com Content-Type: application/x-www-form-urlencoded Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=nNadqW9uTcY0OP6I3afnr71o6EzaYLsdpW4UEYN3vYq_rbRrNFxM1jozPGuhjORBZKKMz2tdDpVe7dNuTWp4CyK-zt5Is6wVElveWAfKQgwNJiKKtXHCCCmrlgzZTl5CiKjTeA2iQqf6zlRK2h8wg1hVpIsWsaKqaWJyHMPF3JA
2023-12-08 13:44:02 UTC	1	OUT	Data Raw: 20 Data Ascii:
2023-12-08 13:44:02 UTC	1627	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6a 73 6f 6e 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 0d 0a 41 63 63 65 73 73 2d 43 6f 6e 74 72 6f 6c 2d 41 6c 6c 6f 77 2d 4f 72 69 67 69 6e 3a 20 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0d 0a 41 63 63 65 73 73 2d 43 6f 6e 74 72 6f 6c 2d 41 6c 6c 6f 77 2d 43 72 65 64 65 6e 74 69 61 6c 73 3a 20 74 72 75 65 0d 0a 58 2d 43 6f 6e 74 65 6e 74 2d 54 79 70 65 2d 4f 70 74 69 6f 6e 73 3a 20 6e 6f 73 6e 69 66 66 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f 6c 3a 20 6e 6f 2d 63 61 63 68 65 2c 20 6e 6f 2d 73 74 6f 72 65 2c 20 6d 61 78 2d 61 67 65 3d 30 2c 20 6d 75 73 74 2d 72 65 76 61 6c 69 64 61 74 65 0d 0a 50 72 Data Ascii: HTTP/1.1 200 OKContent-Type: application/json; charset=utf-8Access-Control-Allow-Origin: https://www.google.comAccess-Control-Allow-Credentials: trueX-Content-Type-Options: nosniffCache-Control: no-cache, no-store, max-age=0, must-revalidatePr
2023-12-08 13:44:02 UTC	23	IN	Data Raw: 31 31 0d 0a 5b 22 67 61 69 61 2e 6c 2e 61 2e 72 22 2c 5b 5d 5d 0d 0a Data Ascii: 11["gaia.l.a.r",[]]
2023-12-08 13:44:02 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2023-12-08 13:44:02 UTC	752	OUT	GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=117.0.5938.134&lang=en-US&acceptformat=crx3,puff&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26brand%3DONGR%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1 Host: clients2.google.com Connection: keep-alive X-Goog-Update-Interactivity: fg X-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmieda X-Goog-Update-Updater: chromecrx-117.0.5938.134 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-08 13:44:02 UTC	732	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 53 65 63 75 72 69 74 79 2d 50 6f 6c 69 63 79 3a 20 73 63 72 69 70 74 2d 73 72 63 20 27 72 65 70 6f 72 74 2d 73 61 6d 70 6c 65 27 20 27 6e 6f 6e 63 65 2d 65 2d 43 36 6f 34 38 6a 6b 58 46 6b 6e 78 35 38 73 38 5a 62 4c 51 27 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 20 27 73 74 72 69 63 74 2d 64 79 6e 61 6d 69 63 27 20 68 74 74 70 73 3a 20 68 74 74 70 3a 3b 6f 62 6a 65 63 74 2d 73 72 63 20 27 6e 6f 6e 65 27 3b 62 61 73 65 2d 75 72 69 20 27 73 65 6c 66 27 3b 72 65 70 6f 72 74 2d 75 72 69 20 68 74 74 70 73 3a 2f 2f 63 73 70 2e 77 69 74 68 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 63 73 70 2f 63 6c 69 65 6e 74 75 70 64 61 74 65 2d 61 75 73 2f 31 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f 6c Data Ascii: HTTP/1.1 200 OKContent-Security-Policy: script-src 'report-sample' 'nonce-e-C6o48jkXFknx58s8ZbLQ' 'unsafe-inline' 'strict-dynamic' https: http:;object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/clientupdate-aus/1Cache-Control
2023-12-08 13:44:02 UTC	520	IN	Data Raw: 32 63 39 0d 0a 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 67 75 70 64 61 74 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 75 70 64 61 74 65 32 2f 72 65 73 70 6f 6e 73 65 22 20 70 72 6f 74 6f 63 6f 6c 3d 22 32 2e 30 22 20 73 65 72 76 65 72 3d 22 70 72 6f 64 22 3e 3c 64 61 79 73 74 61 72 74 20 65 6c 61 70 73 65 64 5f 64 61 79 73 3d 22 36 31 38 35 22 20 65 6c 61 70 73 65 64 5f 73 65 63 6f 6e 64 73 3d 22 32 30 36 34 32 22 2f 3e 3c 61 70 70 20 61 70 70 69 64 3d 22 6e 6d 6d 68 6b 6b 65 67 63 63 61 67 64 6c 64 67 69 69 6d 65 64 70 69 63 63 6d 67 6d 69 65 64 61 22 20 63 6f 68 6f 72 74 3d 22 31 3a 3a 22 20 63 6f 68 6f 72 74 6e 61 6d 65 3d 22 22 Data Ascii: 2c9<?xml version="1.0" encoding="UTF-8"?><gupdate xmlns="http://www.google.com/update2/response" protocol="2.0" server="prod"><daystart elapsed_days="6185" elapsed_seconds="20642"/><app appid="nmmhkkegccagdldgiimedpiccmgmieda" cohort="1::" cohortname=""
2023-12-08 13:44:02 UTC	200	IN	Data Raw: 37 32 33 66 35 36 62 38 37 31 37 31 37 35 63 35 33 36 36 38 35 63 35 34 35 30 31 32 32 62 33 30 37 38 39 34 36 34 61 64 38 32 22 20 68 61 73 68 5f 73 68 61 32 35 36 3d 22 38 31 65 33 61 34 64 34 33 61 37 33 36 39 39 65 31 62 37 37 38 31 37 32 33 66 35 36 62 38 37 31 37 31 37 35 63 35 33 36 36 38 35 63 35 34 35 30 31 32 32 62 33 30 37 38 39 34 36 34 61 64 38 32 22 20 70 72 6f 74 65 63 74 65 64 3d 22 30 22 20 73 69 7a 65 3d 22 32 34 38 35 33 31 22 20 73 74 61 74 75 73 3d 22 6f 6b 22 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 2e 30 2e 36 22 2f 3e 3c 2f 61 70 70 3e 3c 2f 67 75 70 64 61 74 65 3e 0d 0a Data Ascii: 723f56b8717175c536685c5450122b30789464ad82" hash_sha256="81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82" protected="0" size="248531" status="ok" version="1.0.0.6"/></app></gupdate>
2023-12-08 13:44:02 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2023-12-08 13:44:25 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=GfuoSMC4nRfmxZD&MD=1ltm755w HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2023-12-08 13:44:26 UTC	560	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 50 72 61 67 6d 61 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 45 78 70 69 72 65 73 3a 20 2d 31 0d 0a 4c 61 73 74 2d 4d 6f 64 69 66 69 65 64 3a 20 4d 6f 6e 2c 20 30 31 20 4a 61 6e 20 30 30 30 31 20 30 30 3a 30 30 3a 30 30 20 47 4d 54 0d 0a 45 54 61 67 3a 20 22 4d 78 31 52 6f 4a 48 2f 71 45 77 70 57 66 4b 6c 6c 78 37 73 62 73 6c 32 38 41 75 45 52 7a 35 49 59 64 63 73 76 74 54 4a 63 67 4d 3d 5f 32 31 36 30 22 0d 0a 4d 53 2d 43 6f 72 72 65 6c 61 74 69 6f 6e 49 64 3a 20 62 61 35 33 38 32 64 39 2d 37 36 37 36 2d 34 65 33 32 2d Data Ascii: HTTP/1.1 200 OKCache-Control: no-cachePragma: no-cacheContent-Type: application/octet-streamExpires: -1Last-Modified: Mon, 01 Jan 0001 00:00:00 GMTETag: "Mx1RoJH/qEwpWfKllx7sbsl28AuERz5IYdcsvtTJcgM=_2160"MS-CorrelationId: ba5382d9-7676-4e32-
2023-12-08 13:44:26 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 51 22 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 db 8e 00 00 14 00 00 00 00 00 10 00 51 22 00 00 20 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 f3 43 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 0d 92 6f db e5 21 f3 43 43 4b ed 5a 09 38 55 5b df 3f 93 99 90 29 99 e7 29 ec 73 cc 4a 66 32 cf 84 32 64 c8 31 c7 11 52 38 87 90 42 66 09 99 87 32 0f 19 0a 09 51 a6 a8 08 29 53 86 4a 52 84 50 df 46 83 ba dd 7b df fb 7e ef 7d ee 7d bf ef 9e e7 d9 67 ef 35 ee b5 fe eb 3f ff b6 96 81 a2 0a 04 fc 31 40 21 5b 3f a5 ed 1b 04 0e 85 42 a0 10 04 64 12 6c a5 de aa a1 d8 ea f3 58 01 f2 f5 67 0b 5e 9b bd e8 a0 90 1d bf 40 88 9d eb 49 b4 87 9b ab 8b 9d 2b 46 c8 c7 c5 19 92 Data Ascii: MSCFQ"DQ" AdCenvironment.cabo!CCKZ8U[?))sJf22d1R8Bf2Q)SJRPF{~}}g5?1@![?BdlXg^@I+F
2023-12-08 13:44:26 UTC	9633	IN	Data Raw: 21 6f b3 eb a6 cc f5 31 be cf 05 e2 a9 fe fa 57 6d 19 30 b3 c2 c5 66 c9 6a df f5 e7 f0 78 bd c7 a8 9e 25 e3 f9 bc ed 6b 54 57 08 2b 51 82 44 12 fb b9 53 8c cc f4 60 12 8a 76 cc 40 40 41 9b dc 5c 17 ff 5c f9 5e 17 35 98 24 56 4b 74 ef 42 10 c8 af bf 7f c6 7f f2 37 7d 5a 3f 1c f2 99 79 4a 91 52 00 af 38 0f 17 f5 2f 79 81 65 d9 a9 b5 6b e4 c7 ce f6 ca 7a 00 6f 4b 30 44 24 22 3c cf ed 03 a5 96 8f 59 29 bc b6 fd 04 e1 70 9f 32 4a 27 fd 55 af 2f fe b6 e5 8e 33 bb 62 5f 9a db 57 40 e9 f1 ce 99 66 90 8c ff 6a 62 7f dd c5 4a 0b 91 26 e2 39 ec 19 4a 71 63 9d 7b 21 6d c3 9c a3 a2 3c fa 7f 7d 96 6a 90 78 a6 6d d2 e1 9c f9 1d fc 38 d8 94 f4 c6 a5 0a 96 86 a4 bd 9e 1a ae 04 42 83 b8 b5 80 9b 22 38 20 b5 25 e5 64 ec f7 f4 bf 7e 63 59 25 0f 7a 2e 39 57 76 a2 71 aa 06 8a Data Ascii: !o1Wm0fjx%kTW+QDS`v@@A\\^5$VKtB7}Z?yJR8/yekzoK0D$"<Y)p2J'U/3b_W@fjbJ&9Jqc{!m<}jxm8B"8 %d~cY%z.9Wvq