Edit tour

Windows Analysis Report
http://icloud.com

Overview

General Information

Sample URL:	http://icloud.com
Analysis ID:	1356425
Infos:

Detection

Score:	1
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Creates files inside the system directory

HTML page contains hidden URLs or javascript code

Uses insecure TLS / SSL version for HTTPS connection

Classification

Process Tree

System is w10x64

chrome.exe (PID: 5552 cmdline: C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 4232 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2244 --field-trial-handle=1712,i,11458534097342901050,5237557838706718646,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 6772 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5644 --field-trial-handle=1712,i,11458534097342901050,5237557838706718646,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 1468 cmdline: C:\Program Files\Google\Chrome\Application\chrome.exe" "http://icloud.com MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: https://www.icloud.com/

HTTP Parser: Base64 decoded: .cloudos-alert .alert-main-content .alert-icon{background-image:url("blob:https://www.icloud.com/dd9c1a9e-10bf-416f-a091-cd6bb083e72a")}.cloudos-alert .alert-main-content .alert-icon.icloud-icon{background-image:url("blob:https://www.icloud.com/5e125083-...

Source: https://www.apple.com/icloud/	HTTP Parser: No favicon
Source: https://www.apple.com/icloud/	HTTP Parser: No favicon
Source: https://www.apple.com/icloud/	HTTP Parser: No favicon
Source: https://www.apple.com/	HTTP Parser: No favicon
Source: https://www.apple.com/	HTTP Parser: No favicon
Source: https://www.apple.com/	HTTP Parser: No favicon
Source: https://www.apple.com/store	HTTP Parser: No favicon
Source: https://www.apple.com/store	HTTP Parser: No favicon
Source: https://www.apple.com/store	HTTP Parser: No favicon
Source: https://www.apple.com/shop/buy-mac	HTTP Parser: No favicon
Source: https://www.apple.com/shop/buy-mac	HTTP Parser: No favicon
Source: https://www.apple.com/shop/buy-mac	HTTP Parser: No favicon
Source: https://www.apple.com/shop/buy-mac	HTTP Parser: No favicon

Source: unknown

HTTPS traffic detected: 173.222.162.64:443 -> 192.168.2.6:49769 version: TLS 1.0

Source: unknown	HTTPS traffic detected: 52.159.126.152:443 -> 192.168.2.6:49725 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.204.76.112:443 -> 192.168.2.6:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.204.76.112:443 -> 192.168.2.6:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.159.126.152:443 -> 192.168.2.6:49743 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.68.123.157:443 -> 192.168.2.6:49758 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.159.126.152:443 -> 192.168.2.6:49781 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.159.126.152:443 -> 192.168.2.6:49868 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.68.123.157:443 -> 192.168.2.6:49926 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.159.126.152:443 -> 192.168.2.6:50178 version: TLS 1.2

Source: unknown

HTTPS traffic detected: 173.222.162.64:443 -> 192.168.2.6:49769 version: TLS 1.0

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 52.159.126.152
Source: unknown	TCP traffic detected without corresponding DNS query: 52.159.126.152
Source: unknown	TCP traffic detected without corresponding DNS query: 52.159.126.152
Source: unknown	TCP traffic detected without corresponding DNS query: 52.159.126.152
Source: unknown	TCP traffic detected without corresponding DNS query: 52.159.126.152
Source: unknown	TCP traffic detected without corresponding DNS query: 52.159.126.152
Source: unknown	TCP traffic detected without corresponding DNS query: 52.159.126.152
Source: unknown	TCP traffic detected without corresponding DNS query: 52.159.126.152
Source: unknown	TCP traffic detected without corresponding DNS query: 52.159.126.152
Source: unknown	TCP traffic detected without corresponding DNS query: 52.159.126.152
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 23.204.76.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.204.76.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.204.76.112
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 23.204.76.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.204.76.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.204.76.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.204.76.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.204.76.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.204.76.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.204.76.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.204.76.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.204.76.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.204.76.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.204.76.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.204.76.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.204.76.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.204.76.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.204.76.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.204.76.112
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 52.159.126.152
Source: unknown	TCP traffic detected without corresponding DNS query: 52.159.126.152
Source: unknown	TCP traffic detected without corresponding DNS query: 52.159.126.152
Source: unknown	TCP traffic detected without corresponding DNS query: 52.159.126.152
Source: unknown	TCP traffic detected without corresponding DNS query: 52.159.126.152
Source: unknown	TCP traffic detected without corresponding DNS query: 52.159.126.152
Source: unknown	TCP traffic detected without corresponding DNS query: 52.159.126.152
Source: unknown	TCP traffic detected without corresponding DNS query: 52.159.126.152
Source: unknown	TCP traffic detected without corresponding DNS query: 52.159.126.152
Source: unknown	TCP traffic detected without corresponding DNS query: 52.159.126.152
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157

Source: global traffic	HTTP traffic detected: GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=117.0.5938.134&lang=en-US&acceptformat=crx3,puff&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26brand%3DONGR%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1Host: clients2.google.comConnection: keep-aliveX-Goog-Update-Interactivity: fgX-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmiedaX-Goog-Update-Updater: chromecrx-117.0.5938.134Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=X5Fpu24E9+Nkwva&MD=ooKkDlRy HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /reportStats HTTP/1.1Host: feedbackws.icloud.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=X5Fpu24E9+Nkwva&MD=ooKkDlRy HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /tools/pso/ping?as=chrome&brand=ONGR&pid=&hl=en&events=C1I,C2I,C7I,C1S,C7S&rep=2&rlz=C1:,C2:,C7:&id=00000000000000000000000000000000000000000F108E50F2 HTTP/1.1Host: clients1.google.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, br

Source: chromecache_552.2.dr, chromecache_307.2.dr	String found in binary or memory: "https://www.facebook.com/Apple", equals www.facebook.com (Facebook)
Source: chromecache_552.2.dr, chromecache_307.2.dr	String found in binary or memory: "https://www.linkedin.com/company/apple", equals www.linkedin.com (Linkedin)
Source: chromecache_552.2.dr, chromecache_307.2.dr	String found in binary or memory: "https://www.twitter.com/Apple" equals www.twitter.com (Twitter)
Source: chromecache_552.2.dr, chromecache_307.2.dr	String found in binary or memory: "https://www.youtube.com/user/Apple", equals www.youtube.com (Youtube)

Source: unknown

DNS traffic detected: queries for: clients2.google.com

Source: unknown

HTTP traffic detected: POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1Host: accounts.google.comConnection: keep-aliveContent-Length: 1Origin: https://www.google.comContent-Type: application/x-www-form-urlencodedSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=UBeNCkZ3L8yXcx8qh4JFUXkwkNC9IrdiRdbjSTjqSiFh8WrRcbKr_rOJbgHY6TA4RT-6ps0bhemfwCPBsLMgPT7-gTcWqHvZvZbafOpkqRy0dLyYG9AjP2vbUBomarnc9pcZVlhHkUeUaWMurD0GGXyW05_B_1IyUNYEELmyqRg

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50178
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49868 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50028
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50265
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49926
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50265 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50028 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50178 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49868

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2244 --field-trial-handle=1712,i,11458534097342901050,5237557838706718646,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe" "http://icloud.com
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5644 --field-trial-handle=1712,i,11458534097342901050,5237557838706718646,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2244 --field-trial-handle=1712,i,11458534097342901050,5237557838706718646,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5644 --field-trial-handle=1712,i,11458534097342901050,5237557838706718646,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact	Resource Development	Reconnaissance
Valid Accounts	Windows Management Instrumentation	Path Interception	1 Process Injection	1 Masquerading	OS Credential Dumping	1 Security Software Discovery	Remote Services	Data from Local System	Exfiltration Over Other Network Medium	1 Encrypted Channel	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Abuse Accessibility Features	Acquire Infrastructure	Gather Victim Identity Information
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	3 Non-Application Layer Protocol	SIM Card Swap	Obtain Device Cloud Backups	Network Denial of Service	Domains	Credentials
Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	4 Application Layer Protocol			Data Encrypted for Impact	DNS Server	Email Addresses
Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Traffic Duplication	1 Ingress Tool Transfer			Data Destruction	Virtual Private Server	Employee Names

Source	Detection	Scanner	Label
https://openjsf.org/	0%	URL Reputation	safe
http://jedwatson.github.io/classnames	0%	URL Reputation	safe
https://setup.$	0%	Avira URL Cloud	safe
https://facebook.github.io/react/docs/top-level-api.html#react.cloneelement	0%	Avira URL Cloud	safe
https://facebook.github.io/react/docs/top-level-api.html#reactdom.finddomnode	0%	Avira URL Cloud	safe
http://www.andismith.com/blog/2012/02/modernizr-prefixed/)	0%	Avira URL Cloud	safe
https://facebook.github.io/react/docs/top-level-api.html#react.children.only	0%	Avira URL Cloud	safe
https://cdn.apple-cloudkit.com/ck/2/acknowledgements.txt	0%	Avira URL Cloud	safe
https://facebook.github.io/react/docs/top-level-api.html#react.children.count	0%	Avira URL Cloud	safe
https://facebook.github.io/react/docs/top-level-api.html#react.children.map	0%	Avira URL Cloud	safe
https://facebook.github.io/react/docs/top-level-api.html#react.children.foreach	0%	Avira URL Cloud	safe
http://www.thespanner.co.uk/2007/11/26/ultimate-xss-css-injection/	0%	Avira URL Cloud	safe
https://facebook.github.io/react/docs/top-level-api.html#react.createelement	0%	Avira URL Cloud	safe
http://facebook.github.io/react/docs/error-decoder.html?invariant=	0%	Avira URL Cloud	safe
https://facebook.github.io/react/docs/top-level-api.html#react.isvalidelement	0%	Avira URL Cloud	safe
https://facebook.github.io/react/docs/top-level-api.html#react.children.toarray	0%	Avira URL Cloud	safe
https://facebook.github.io/react/docs/top-level-api.html#react.createclass	0%	Avira URL Cloud	safe
https://facebook.github.io/react/docs/top-level-api.html#react.createfactory	0%	Avira URL Cloud	safe

Name	IP	Active	Malicious	Reputation
accounts.google.com	192.178.50.45	true	false	high
gateway.fe.apple-dns.net	17.248.201.68	true	false	unknown
icloud.com	17.253.144.10	true	false	high
www.google.com	172.217.15.196	true	false	high
setup.fe.apple-dns.net	17.248.201.64	true	false	unknown
ckdatabasews.fe.apple-dns.net	17.248.201.64	true	false	unknown
clients.l.google.com	192.178.50.46	true	false	high
feedbackws.fe.apple-dns.net	17.248.201.66	true	false	unknown
cvws.apple-dns.net	17.248.201.40	true	false	unknown
setup.icloud.com	unknown	unknown	false	high
clients1.google.com	unknown	unknown	false	high
feedbackws.icloud.com	unknown	unknown	false	high
store.storevideos.cdn-apple.com	unknown	unknown	false	high
cdn.apple-cloudkit.com	unknown	unknown	false	unknown
appleid.cdn-apple.com	unknown	unknown	false	high
clients2.google.com	unknown	unknown	false	high
is1-ssl.mzstatic.com	unknown	unknown	false	high
store.storeimages.cdn-apple.com	unknown	unknown	false	high
cvws.icloud-content.com	unknown	unknown	false	high
ckdatabasews.icloud.com	unknown	unknown	false	high

Name	Malicious	Reputation
https://clients2.google.com/service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=117.0.5938.134&lang=en-US&acceptformat=crx3,puff&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26brand%3DONGR%26ping%3Dr%253D-1%2526e%253D1	false	high
https://setup.icloud.com/setup/ws/1/validate?clientBuildNumber=2404Project47&clientMasteringNumber=2404B20&clientId=a9fd8cd9-f162-40eb-988d-ebea97d8939c	false	high
about:blank	false	low
https://clients1.google.com/tools/pso/ping?as=chrome&brand=ONGR&pid=&hl=en&events=C1I,C2I,C7I,C1S,C7S&rep=2&rlz=C1:,C2:,C7:&id=00000000000000000000000000000000000000000F108E50F2	false	high
https://feedbackws.icloud.com/reportStats	false	high

Name	Source	Malicious	Antivirus Detection	Reputation
https://cdn.apple-cloudkit.com/ck/2/acknowledgements.txt	chromecache_223.2.dr	false	Avira URL Cloud: safe	unknown
https://facebook.github.io/react/docs/top-level-api.html#reactdom.finddomnode	chromecache_264.2.dr	false	Avira URL Cloud: safe	unknown
https://facebook.github.io/react/docs/top-level-api.html#react.cloneelement	chromecache_264.2.dr	false	Avira URL Cloud: safe	unknown
https://bugs.chromium.org/p/v8/issues/detail?id=3443	chromecache_264.2.dr	false		high
https://html.spec.whatwg.org/multipage/syntax.html#generate-implied-end-tags	chromecache_264.2.dr	false		high
http://www.quirksmode.org/dom/events/tests/scroll.html	chromecache_264.2.dr	false		high
https://github.com/mishoo/UglifyJS2/blob/v2.4.20/lib/parse.js#L216	chromecache_264.2.dr	false		high
https://www.youtube.com/user/Apple	chromecache_552.2.dr, chromecache_307.2.dr	false		high
https://github.com/facebook/react/issues/6887	chromecache_264.2.dr	false		high
https://html.spec.whatwg.org/multipage/syntax.html#special	chromecache_264.2.dr	false		high
http://schema.org/docs/gs.html	chromecache_264.2.dr	false		high
https://html.spec.whatwg.org/multipage/syntax.html#parsing-main-intable	chromecache_264.2.dr	false		high
https://www.linkedin.com/company/apple	chromecache_552.2.dr, chromecache_307.2.dr	false		high
http://www.andismith.com/blog/2012/02/modernizr-prefixed/)	chromecache_264.2.dr	false	Avira URL Cloud: safe	unknown
https://setup.$	chromecache_350.2.dr	false	Avira URL Cloud: safe	low
https://github.com/w3c/IntersectionObserver.	chromecache_583.2.dr	false		high
https://fb.me/react-warning-polyfills	chromecache_264.2.dr	false		high
http://www.videolan.org/x264.html	chromecache_224.2.dr	false		high
https://fb.me/react-warning-dont-call-proptypes	chromecache_264.2.dr	false		high
https://fb.me/react-legacyfactory	chromecache_264.2.dr	false		high
http://jsperf.com/key-missing	chromecache_264.2.dr	false		high
http://dom.spec.whatwg.org/#dom-domimplementation-hasfeature	chromecache_264.2.dr	false		high
https://github.com/spicyj/innerhtml-vs-createelement-vs-clonenode.	chromecache_264.2.dr	false		high
http://jsperf.com/obj-vs-arr-iteration	chromecache_264.2.dr	false		high
https://bugs.chromium.org/p/v8/issues/detail?id=4118	chromecache_264.2.dr	false		high
https://openjsf.org/	chromecache_238.2.dr, chromecache_599.2.dr	false	URL Reputation: safe	unknown
https://facebook.github.io/react/docs/top-level-api.html#react.children.only	chromecache_264.2.dr	false	Avira URL Cloud: safe	unknown
https://fb.me/react-refs-must-have-owner).	chromecache_264.2.dr	false		high
https://www.twitter.com/Apple	chromecache_552.2.dr, chromecache_307.2.dr	false		high
http://bugs.jquery.com/ticket/12385.	chromecache_264.2.dr	false		high
https://fb.me/prop-types-docs	chromecache_264.2.dr	false		high
https://bugzilla.mozilla.org/show_bug.cgi?id=208427	chromecache_264.2.dr	false		high
https://developer.mozilla.org/en-US/docs/Web/API/AnimationEvent	chromecache_264.2.dr	false		high
https://fb.me/react-devtools	chromecache_264.2.dr	false		high
https://github.com/facebook/react/issues/7240	chromecache_264.2.dr	false		high
https://fb.me/react-minification	chromecache_264.2.dr	false		high
https://fb.me/react-unknown-prop%s	chromecache_264.2.dr	false		high
http://jsperf.com/key-exists	chromecache_264.2.dr	false		high
https://fb.me/react-controlled-components	chromecache_264.2.dr	false		high
https://facebook.github.io/react/docs/top-level-api.html#react.children.count	chromecache_264.2.dr	false	Avira URL Cloud: safe	unknown
https://github.com/facebook/react/issues/708.	chromecache_264.2.dr	false		high
https://assets.adobedtm.com/extensions/EP308220a2a4c4403f97fc1960100db40f/AppMeasurement.js	chromecache_545.2.dr	false		high
http://jsperf.com/emptying-a-node	chromecache_264.2.dr	false		high
https://bugzilla.mozilla.org/show_bug.cgi?id=1276240	chromecache_264.2.dr	false		high
https://developer.mozilla.org/en-US/docs/Web/API/KeyboardEvent#Key_names	chromecache_264.2.dr	false		high
https://schema.org	chromecache_552.2.dr, chromecache_543.2.dr, chromecache_609.2.dr	false		high
https://fb.me/react-dom-factories	chromecache_264.2.dr	false		high
https://github.com/facebook/react/issues/7233	chromecache_264.2.dr	false		high
http://underscorejs.org/LICENSE	chromecache_238.2.dr, chromecache_599.2.dr	false		high
https://html.spec.whatwg.org/multipage/syntax.html#parsing-main-inhead	chromecache_264.2.dr	false		high
https://fb.me/createmixin-was-never-implemented	chromecache_264.2.dr	false		high
https://fb.me/react-special-props)	chromecache_264.2.dr	false		high
https://github.com/facebook/react/issues/3236).	chromecache_264.2.dr	false		high
http://www.quirksmode.org/blog/archives/2008/04/delegating_the.html	chromecache_264.2.dr	false		high
https://facebook.github.io/react/docs/top-level-api.html#react.children.foreach	chromecache_264.2.dr	false	Avira URL Cloud: safe	unknown
https://html.spec.whatwg.org/multipage/semantics.html#the-html-element	chromecache_264.2.dr	false		high
https://fb.me/react-create-class	chromecache_264.2.dr	false		high
https://facebook.github.io/react/docs/top-level-api.html#react.children.map	chromecache_264.2.dr	false	Avira URL Cloud: safe	unknown
http://www.quirksmode.org/dom/events/scroll.html	chromecache_264.2.dr	false		high
https://fb.me/react-event-pooling	chromecache_264.2.dr	false		high
https://github.com/facebook/fbjs/blob/e66ba20ad5be433eb54423f2b097d829324d9de6/packages/fbjs/src/__f	chromecache_264.2.dr	false		high
https://npms.io/search?q=ponyfill.	chromecache_238.2.dr	false		high
http://www.thespanner.co.uk/2007/11/26/ultimate-xss-css-injection/	chromecache_264.2.dr	false	Avira URL Cloud: safe	unknown
https://facebook.github.io/react/docs/top-level-api.html#react.createelement	chromecache_264.2.dr	false	Avira URL Cloud: safe	unknown
https://github.com/facebook/react/pull/7232	chromecache_264.2.dr	false		high
https://code.google.com/p/v8/issues/detail?id=687	chromecache_264.2.dr	false		high
http://www.wikidata.org/entity/Q312	chromecache_552.2.dr, chromecache_307.2.dr	false		high
https://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet	chromecache_264.2.dr	false		high
https://facebook.github.io/react/docs/top-level-api.html#react.children.toarray	chromecache_264.2.dr	false	Avira URL Cloud: safe	unknown
https://www.goldmansachs.com/terms-and-conditions/Apple-Card-Customer-Agreement.pdf	chromecache_543.2.dr, chromecache_609.2.dr	false		high
https://html.spec.whatwg.org/multipage/syntax.html#parsing-main-intr	chromecache_264.2.dr	false		high
https://reactjs.org/link/react-polyfills	chromecache_349.2.dr	false		high
https://github.com/facebook/react/issues/7253	chromecache_264.2.dr	false		high
https://github.com/facebook/react/pull/6896	chromecache_264.2.dr	false		high
https://html.spec.whatwg.org/multipage/syntax.html#parsing-main-inselect	chromecache_264.2.dr	false		high
http://schema.org	chromecache_552.2.dr, chromecache_307.2.dr	false		high
https://github.com/facebook/react/issues/6731#issuecomment-254874553	chromecache_264.2.dr	false		high
https://html.spec.whatwg.org/multipage/syntax.html#parsing-main-inbody	chromecache_264.2.dr	false		high
https://github.com/facebook/react/issues/7253#issuecomment-236074326	chromecache_264.2.dr	false		high
https://facebook.github.io/react/docs/top-level-api.html#react.isvalidelement	chromecache_264.2.dr	false	Avira URL Cloud: safe	unknown
https://github.com/facebook/react/pull/7101	chromecache_264.2.dr	false		high
https://html.spec.whatwg.org/multipage/syntax.html#parsing-main-incaption	chromecache_264.2.dr	false		high
http://facebook.github.io/react/docs/error-decoder.html?invariant=	chromecache_264.2.dr	false	Avira URL Cloud: safe	unknown
https://github.com/zloirock/core-js/issues/173	chromecache_264.2.dr	false		high
https://facebook.github.io/react/docs/top-level-api.html#react.createfactory	chromecache_264.2.dr	false	Avira URL Cloud: safe	unknown
https://html.spec.whatwg.org/multipage/microdata.html#microdata-dom-api	chromecache_264.2.dr	false		high
http://jedwatson.github.io/classnames	chromecache_322.2.dr, chromecache_441.2.dr, chromecache_394.2.dr, chromecache_599.2.dr, chromecache_479.2.dr	false	URL Reputation: safe	unknown
https://bugs.chromium.org/p/chromium/issues/detail?id=640652	chromecache_264.2.dr	false		high
https://facebook.github.io/react/docs/top-level-api.html#react.createclass	chromecache_264.2.dr	false	Avira URL Cloud: safe	unknown
https://fb.me/invalid-aria-prop%s	chromecache_264.2.dr	false		high
https://html.spec.whatwg.org/multipage/syntax.html#has-an-element-in-scope	chromecache_264.2.dr	false		high
https://fb.me/react-invariant-dangerously-set-inner-html	chromecache_264.2.dr	false		high
https://icq.icloud.com/?context=ZXh0ZXJuYWxBcHBfY29tLmFwcGxlLm1vYmlsZXNhZmFyaV9hcHBsZS5jb20&#x3	chromecache_552.2.dr	false		high
http://www.goldmansachs.com/terms-and-conditions/Apple-Card-Customer-Agreement.pdf	chromecache_514.2.dr, chromecache_377.2.dr, chromecache_543.2.dr, chromecache_609.2.dr	false		high
https://html.spec.whatwg.org/multipage/syntax.html#parsing-main-incolgroup	chromecache_264.2.dr	false		high

IP	Domain	Country	ASN	ASN Name	Malicious
172.217.15.196	www.google.com	United States	15169	GOOGLEUS	false
17.248.201.40	cvws.apple-dns.net	United States	714	APPLE-ENGINEERINGUS	false
17.248.201.66	feedbackws.fe.apple-dns.net	United States	714	APPLE-ENGINEERINGUS	false
17.248.201.64	setup.fe.apple-dns.net	United States	714	APPLE-ENGINEERINGUS	false
17.248.201.68	gateway.fe.apple-dns.net	United States	714	APPLE-ENGINEERINGUS	false
192.178.50.45	accounts.google.com	United States	15169	GOOGLEUS	false
192.178.50.46	clients.l.google.com	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false

Joe Sandbox version:	38.0.0 Ammolite
Analysis ID:	1356425
Start date and time:	2023-12-08 18:36:19 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 13s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	http://icloud.com
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	10
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	CLEAN
Classification:	clean1.win@24/447@38/9
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Browse: https://apple.com/icloud Browse: https://www.apple.com/support/systemstatus/ Browse: https://www.apple.com/ Browse: https://www.apple.com/us/shop/goto/store Browse: https://www.apple.com/us/shop/goto/buy_mac

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	724
Entropy (8bit):	7.552070114635461
Encrypted:	false
SSDEEP:	12:6v/7m/6Tpcf+5KwlJw0ZNTH14dqPNWAVfBUEXLwy/+aXZk9EesZvEDGZJUxKatt5:b/6uNwlJVNOAVfaE7H/+aJkCepSZ299X
MD5:	80BAB208999659D497BD2DDC9C8996A3
SHA1:	945FF99ED169B3CC682D4FAEE5D5CC9F111D58DC
SHA-256:	3194EA6DCCF9F4D0E59BABF2197580278D9CC566CB6A0D5F87B6F0EA0FC6D8EE
SHA-512:	5F93BF45F0D154F51836A93E296B1AE952EBD18F08E0F015351875126C55AD9F8C0D7BB91F413837D287C28287232924EE9344CED76A3520D9603026C171E43E
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR................a....pHYs.................IDAT8...9L.Q..g....pWV.lT.5.X`...6T..P`.4.X.X......@Gcl..%1H..".\.......}o.l.b..y..d..........j.......o...j".H......i...m..W.s...L_Nu..\..O......u.!......[...T.lw.}.l$.I.....p".l.}..m.......U[x...^..........+...t41....M.....$. .A@........dW.}..."...!...F..y\|6........x...V.dG\|.......f.......Do..l...`.F....I...........R.2}#.H\|..t..@.....$.HJ......zC.......h..$n.\|.!.44^..B..u.q..Z..@.#...D...5.R.,.OoRLXMJ..B/!..P.....)...xNj..H.H..N..F...K.ri.fS .........%&.-Z...^.`...x.f[.mf9........%f.R,ZaR.D^g.../.....E4&.....d.g>.>.m....`.Y$..~u.._LA....Z.=.....B.Gu.5j...5...x.../.`)..x..0X....i.*..a....C.4......k..r.2.q.....ofY..?Tu.#.b......IEND.B`.

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (12216), with no line terminators
Category:	downloaded
Size (bytes):	12216
Entropy (8bit):	5.262666002801903
Encrypted:	false
SSDEEP:	96:7Rs4yNQVj5bYJGpvv7Oy/Gpj8G9behnY6OujXo4xEnw9sWit17H6PlVmpnbXflZe:dsr8bfYkohwaWa7H6P2R0WAt8jrLs
MD5:	B0908FBDD49C18B9EB0AFB9A43F99B70
SHA1:	2472D9C27C9BB506278CEAA4E6F3782C0D6700AC
SHA-256:	A3A7688B8F623B1FF0AEAF6ABDF634732BCABF987506BDDC8FDE7E6CB199E7A6
SHA-512:	4B0C5CD62D0B2AF54876B9707E4CB6C1E49783ABB5C93887A5F3FCB3471525D31F70E29FB173DBE24DBE301035E45FE279D7F136D69489B5481235CBF5B447EC
Malicious:	false
Reputation:	low
URL:	https://www.apple.com/v/home/bh/built/scripts/head.built.js
Preview:	!function t(e,n,r){function o(s,u){if(!n[s]){if(!e[s]){var a="function"==typeof require&&require;if(!u&&a)return a(s,!0);if(i)return i(s,!0);var c=new Error("Cannot find module '"+s+"'");throw c.code="MODULE_NOT_FOUND",c}var d=n[s]={exports:{}};e[s][0].call(d.exports,(function(t){return o(e[s][1][t]\|\|t)}),d,d.exports,t,e,n,r)}return n[s].exports}for(var i="function"==typeof require&&require,s=0;s<r.length;s++)o(r[s]);return o}({1:[function(t,e,n){"use strict";var r=t(3)("mask-image","linear-gradient(#000, #fff)");e.exports=r},{3:3}],2:[function(t,e,n){"use strict";var r={"css-mask":t(1)};e.exports=r},{1:1}],3:[function(t,e,n){"use strict";var r=t(15),o=t(14),i=t(6);function s(t,e){return void 0!==e?!!r(t,e):!!o(t)}e.exports=i(s),e.exports.original=s},{14:14,15:15,6:6}],4:[function(t,e,n){"use strict";e.exports={getWindow:function(){return window},getDocument:function(){return document},getNavigator:function(){return navigator}}},{}],5:[function(t,e,n){"use strict";var r=t(4),o=t(7);fun

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 8, 2023 18:37:10.612319946 CET	50255	53	192.168.2.6	1.1.1.1
Dec 8, 2023 18:37:10.612610102 CET	55772	53	192.168.2.6	1.1.1.1
Dec 8, 2023 18:37:10.613152981 CET	61904	53	192.168.2.6	1.1.1.1
Dec 8, 2023 18:37:10.613495111 CET	53417	53	192.168.2.6	1.1.1.1
Dec 8, 2023 18:37:10.736763954 CET	53	56273	1.1.1.1	192.168.2.6
Dec 8, 2023 18:37:10.737565994 CET	53	55772	1.1.1.1	192.168.2.6
Dec 8, 2023 18:37:10.737797976 CET	53	50255	1.1.1.1	192.168.2.6
Dec 8, 2023 18:37:10.738528013 CET	53	53417	1.1.1.1	192.168.2.6
Dec 8, 2023 18:37:10.738658905 CET	53	61904	1.1.1.1	192.168.2.6
Dec 8, 2023 18:37:11.541313887 CET	53	51411	1.1.1.1	192.168.2.6
Dec 8, 2023 18:37:12.311712027 CET	57577	53	192.168.2.6	1.1.1.1
Dec 8, 2023 18:37:12.313899040 CET	64949	53	192.168.2.6	1.1.1.1
Dec 8, 2023 18:37:12.437316895 CET	53	57577	1.1.1.1	192.168.2.6
Dec 8, 2023 18:37:12.438864946 CET	53	64949	1.1.1.1	192.168.2.6
Dec 8, 2023 18:37:12.744853973 CET	54689	53	192.168.2.6	1.1.1.1
Dec 8, 2023 18:37:12.745235920 CET	62939	53	192.168.2.6	1.1.1.1
Dec 8, 2023 18:37:12.870364904 CET	53	54689	1.1.1.1	192.168.2.6
Dec 8, 2023 18:37:12.870400906 CET	53	62939	1.1.1.1	192.168.2.6
Dec 8, 2023 18:37:15.095844030 CET	57223	53	192.168.2.6	1.1.1.1
Dec 8, 2023 18:37:15.096415997 CET	64014	53	192.168.2.6	1.1.1.1
Dec 8, 2023 18:37:15.123116016 CET	65099	53	192.168.2.6	1.1.1.1
Dec 8, 2023 18:37:15.123584986 CET	53272	53	192.168.2.6	1.1.1.1
Dec 8, 2023 18:37:15.221081972 CET	53	57223	1.1.1.1	192.168.2.6
Dec 8, 2023 18:37:15.221685886 CET	53	64014	1.1.1.1	192.168.2.6
Dec 8, 2023 18:37:15.250977993 CET	53	65099	1.1.1.1	192.168.2.6
Dec 8, 2023 18:37:15.250997066 CET	53	53272	1.1.1.1	192.168.2.6
Dec 8, 2023 18:37:15.255153894 CET	62867	53	192.168.2.6	1.1.1.1
Dec 8, 2023 18:37:15.255780935 CET	53820	53	192.168.2.6	1.1.1.1
Dec 8, 2023 18:37:15.262068033 CET	59184	53	192.168.2.6	1.1.1.1
Dec 8, 2023 18:37:15.262640953 CET	57693	53	192.168.2.6	1.1.1.1
Dec 8, 2023 18:37:15.383105993 CET	53	53820	1.1.1.1	192.168.2.6
Dec 8, 2023 18:37:15.388451099 CET	53	57693	1.1.1.1	192.168.2.6
Dec 8, 2023 18:37:15.390595913 CET	53	59184	1.1.1.1	192.168.2.6
Dec 8, 2023 18:37:15.397427082 CET	53	62867	1.1.1.1	192.168.2.6
Dec 8, 2023 18:37:21.721513987 CET	62401	53	192.168.2.6	1.1.1.1
Dec 8, 2023 18:37:21.721961975 CET	64370	53	192.168.2.6	1.1.1.1
Dec 8, 2023 18:37:23.262552023 CET	59736	53	192.168.2.6	1.1.1.1
Dec 8, 2023 18:37:23.262824059 CET	50693	53	192.168.2.6	1.1.1.1
Dec 8, 2023 18:37:25.424742937 CET	56537	53	192.168.2.6	1.1.1.1
Dec 8, 2023 18:37:25.425215960 CET	49595	53	192.168.2.6	1.1.1.1
Dec 8, 2023 18:37:29.335346937 CET	53	59673	1.1.1.1	192.168.2.6
Dec 8, 2023 18:37:29.500276089 CET	56630	53	192.168.2.6	1.1.1.1
Dec 8, 2023 18:37:29.500559092 CET	65179	53	192.168.2.6	1.1.1.1
Dec 8, 2023 18:37:29.632360935 CET	53	56630	1.1.1.1	192.168.2.6
Dec 8, 2023 18:37:29.632802010 CET	53	65179	1.1.1.1	192.168.2.6
Dec 8, 2023 18:37:30.289975882 CET	53119	53	192.168.2.6	1.1.1.1
Dec 8, 2023 18:37:30.290235996 CET	62960	53	192.168.2.6	1.1.1.1
Dec 8, 2023 18:37:30.415555954 CET	53	53119	1.1.1.1	192.168.2.6
Dec 8, 2023 18:37:30.416924000 CET	53	62960	1.1.1.1	192.168.2.6
Dec 8, 2023 18:37:33.159437895 CET	53	52741	1.1.1.1	192.168.2.6
Dec 8, 2023 18:37:50.037609100 CET	53	59083	1.1.1.1	192.168.2.6
Dec 8, 2023 18:38:02.248697996 CET	55115	53	192.168.2.6	1.1.1.1
Dec 8, 2023 18:38:02.249034882 CET	65352	53	192.168.2.6	1.1.1.1
Dec 8, 2023 18:38:03.443840981 CET	57723	53	192.168.2.6	1.1.1.1
Dec 8, 2023 18:38:03.444050074 CET	58356	53	192.168.2.6	1.1.1.1
Dec 8, 2023 18:38:08.565099955 CET	53834	53	192.168.2.6	1.1.1.1
Dec 8, 2023 18:38:08.565738916 CET	60765	53	192.168.2.6	1.1.1.1
Dec 8, 2023 18:38:10.635139942 CET	53	50247	1.1.1.1	192.168.2.6
Dec 8, 2023 18:38:12.143225908 CET	55615	53	192.168.2.6	1.1.1.1
Dec 8, 2023 18:38:12.143644094 CET	53020	53	192.168.2.6	1.1.1.1
Dec 8, 2023 18:38:14.621701002 CET	53	60960	1.1.1.1	192.168.2.6
Dec 8, 2023 18:38:26.028803110 CET	56849	53	192.168.2.6	1.1.1.1
Dec 8, 2023 18:38:26.029134035 CET	65049	53	192.168.2.6	1.1.1.1
Dec 8, 2023 18:38:39.889600992 CET	51307	53	192.168.2.6	1.1.1.1
Dec 8, 2023 18:38:39.889813900 CET	50903	53	192.168.2.6	1.1.1.1
Dec 8, 2023 18:38:40.015039921 CET	53	50903	1.1.1.1	192.168.2.6
Dec 8, 2023 18:38:40.015398979 CET	53	51307	1.1.1.1	192.168.2.6
Dec 8, 2023 18:38:40.229943037 CET	53	50327	1.1.1.1	192.168.2.6

Timestamp	Bytes transferred	Direction	Data
2023-12-08 17:37:11 UTC	752	OUT	GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=117.0.5938.134&lang=en-US&acceptformat=crx3,puff&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26brand%3DONGR%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1 Host: clients2.google.com Connection: keep-alive X-Goog-Update-Interactivity: fg X-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmieda X-Goog-Update-Updater: chromecrx-117.0.5938.134 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-08 17:37:11 UTC	732	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 53 65 63 75 72 69 74 79 2d 50 6f 6c 69 63 79 3a 20 73 63 72 69 70 74 2d 73 72 63 20 27 72 65 70 6f 72 74 2d 73 61 6d 70 6c 65 27 20 27 6e 6f 6e 63 65 2d 47 74 2d 79 6a 5a 66 5f 5f 7a 54 73 56 31 6a 31 54 55 6b 74 5f 67 27 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 20 27 73 74 72 69 63 74 2d 64 79 6e 61 6d 69 63 27 20 68 74 74 70 73 3a 20 68 74 74 70 3a 3b 6f 62 6a 65 63 74 2d 73 72 63 20 27 6e 6f 6e 65 27 3b 62 61 73 65 2d 75 72 69 20 27 73 65 6c 66 27 3b 72 65 70 6f 72 74 2d 75 72 69 20 68 74 74 70 73 3a 2f 2f 63 73 70 2e 77 69 74 68 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 63 73 70 2f 63 6c 69 65 6e 74 75 70 64 61 74 65 2d 61 75 73 2f 31 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f 6c Data Ascii: HTTP/1.1 200 OKContent-Security-Policy: script-src 'report-sample' 'nonce-Gt-yjZf__zTsV1j1TUkt_g' 'unsafe-inline' 'strict-dynamic' https: http:;object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/clientupdate-aus/1Cache-Control
2023-12-08 17:37:11 UTC	520	IN	Data Raw: 32 63 39 0d 0a 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 67 75 70 64 61 74 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 75 70 64 61 74 65 32 2f 72 65 73 70 6f 6e 73 65 22 20 70 72 6f 74 6f 63 6f 6c 3d 22 32 2e 30 22 20 73 65 72 76 65 72 3d 22 70 72 6f 64 22 3e 3c 64 61 79 73 74 61 72 74 20 65 6c 61 70 73 65 64 5f 64 61 79 73 3d 22 36 31 38 35 22 20 65 6c 61 70 73 65 64 5f 73 65 63 6f 6e 64 73 3d 22 33 34 36 33 31 22 2f 3e 3c 61 70 70 20 61 70 70 69 64 3d 22 6e 6d 6d 68 6b 6b 65 67 63 63 61 67 64 6c 64 67 69 69 6d 65 64 70 69 63 63 6d 67 6d 69 65 64 61 22 20 63 6f 68 6f 72 74 3d 22 31 3a 3a 22 20 63 6f 68 6f 72 74 6e 61 6d 65 3d 22 22 Data Ascii: 2c9<?xml version="1.0" encoding="UTF-8"?><gupdate xmlns="http://www.google.com/update2/response" protocol="2.0" server="prod"><daystart elapsed_days="6185" elapsed_seconds="34631"/><app appid="nmmhkkegccagdldgiimedpiccmgmieda" cohort="1::" cohortname=""
2023-12-08 17:37:11 UTC	200	IN	Data Raw: 37 32 33 66 35 36 62 38 37 31 37 31 37 35 63 35 33 36 36 38 35 63 35 34 35 30 31 32 32 62 33 30 37 38 39 34 36 34 61 64 38 32 22 20 68 61 73 68 5f 73 68 61 32 35 36 3d 22 38 31 65 33 61 34 64 34 33 61 37 33 36 39 39 65 31 62 37 37 38 31 37 32 33 66 35 36 62 38 37 31 37 31 37 35 63 35 33 36 36 38 35 63 35 34 35 30 31 32 32 62 33 30 37 38 39 34 36 34 61 64 38 32 22 20 70 72 6f 74 65 63 74 65 64 3d 22 30 22 20 73 69 7a 65 3d 22 32 34 38 35 33 31 22 20 73 74 61 74 75 73 3d 22 6f 6b 22 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 2e 30 2e 36 22 2f 3e 3c 2f 61 70 70 3e 3c 2f 67 75 70 64 61 74 65 3e 0d 0a Data Ascii: 723f56b8717175c536685c5450122b30789464ad82" hash_sha256="81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82" protected="0" size="248531" status="ok" version="1.0.0.6"/></app></gupdate>
2023-12-08 17:37:11 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2023-12-08 17:37:11 UTC	680	OUT	POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1 Host: accounts.google.com Connection: keep-alive Content-Length: 1 Origin: https://www.google.com Content-Type: application/x-www-form-urlencoded Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=UBeNCkZ3L8yXcx8qh4JFUXkwkNC9IrdiRdbjSTjqSiFh8WrRcbKr_rOJbgHY6TA4RT-6ps0bhemfwCPBsLMgPT7-gTcWqHvZvZbafOpkqRy0dLyYG9AjP2vbUBomarnc9pcZVlhHkUeUaWMurD0GGXyW05_B_1IyUNYEELmyqRg
2023-12-08 17:37:11 UTC	1	OUT	Data Raw: 20 Data Ascii:
2023-12-08 17:37:11 UTC	1627	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6a 73 6f 6e 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 0d 0a 41 63 63 65 73 73 2d 43 6f 6e 74 72 6f 6c 2d 41 6c 6c 6f 77 2d 4f 72 69 67 69 6e 3a 20 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0d 0a 41 63 63 65 73 73 2d 43 6f 6e 74 72 6f 6c 2d 41 6c 6c 6f 77 2d 43 72 65 64 65 6e 74 69 61 6c 73 3a 20 74 72 75 65 0d 0a 58 2d 43 6f 6e 74 65 6e 74 2d 54 79 70 65 2d 4f 70 74 69 6f 6e 73 3a 20 6e 6f 73 6e 69 66 66 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f 6c 3a 20 6e 6f 2d 63 61 63 68 65 2c 20 6e 6f 2d 73 74 6f 72 65 2c 20 6d 61 78 2d 61 67 65 3d 30 2c 20 6d 75 73 74 2d 72 65 76 61 6c 69 64 61 74 65 0d 0a 50 72 Data Ascii: HTTP/1.1 200 OKContent-Type: application/json; charset=utf-8Access-Control-Allow-Origin: https://www.google.comAccess-Control-Allow-Credentials: trueX-Content-Type-Options: nosniffCache-Control: no-cache, no-store, max-age=0, must-revalidatePr
2023-12-08 17:37:11 UTC	23	IN	Data Raw: 31 31 0d 0a 5b 22 67 61 69 61 2e 6c 2e 61 2e 72 22 2c 5b 5d 5d 0d 0a Data Ascii: 11["gaia.l.a.r",[]]
2023-12-08 17:37:11 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2023-12-08 17:37:14 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 39 34 65 4c 4b 48 6e 43 66 45 75 36 2b 55 5a 72 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 37 35 33 36 62 33 36 62 64 37 30 30 39 66 33 32 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: 94eLKHnCfEu6+UZr.1Context: 7536b36bd7009f32
2023-12-08 17:37:14 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2023-12-08 17:37:14 UTC	1076	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 35 33 0d 0a 4d 53 2d 43 56 3a 20 39 34 65 4c 4b 48 6e 43 66 45 75 36 2b 55 5a 72 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 37 35 33 36 62 33 36 62 64 37 30 30 39 66 33 32 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 77 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 62 71 7a 36 6f 64 74 4f 66 68 72 44 49 7a 39 46 71 46 6c 30 37 7a 62 67 4d 78 70 7a 47 4c 63 73 75 43 35 48 76 72 71 67 70 31 59 6b 76 54 52 2f 30 48 74 33 57 38 5a 69 50 56 79 65 54 72 65 36 64 50 63 31 4a 72 63 76 47 69 66 46 50 30 53 34 2b 41 46 31 63 63 4f 32 66 77 35 4d 72 53 4c 41 59 4d 51 42 78 35 70 2b 46 57 2f 51 4c Data Ascii: ATH 2 CON\DEVICE 1053MS-CV: 94eLKHnCfEu6+UZr.2Context: 7536b36bd7009f32<device><compact-ticket>t=EwCwAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAbqz6odtOfhrDIz9FqFl07zbgMxpzGLcsuC5Hvrqgp1YkvTR/0Ht3W8ZiPVyeTre6dPc1JrcvGifFP0S4+AF1ccO2fw5MrSLAYMQBx5p+FW/QL
2023-12-08 17:37:14 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 39 34 65 4c 4b 48 6e 43 66 45 75 36 2b 55 5a 72 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 37 35 33 36 62 33 36 62 64 37 30 30 39 66 33 32 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: 94eLKHnCfEu6+UZr.3Context: 7536b36bd7009f32<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2023-12-08 17:37:15 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2023-12-08 17:37:15 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 4c 41 69 55 44 74 73 61 76 6b 4f 68 55 7a 6f 6e 35 61 46 50 6b 67 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: LAiUDtsavkOhUzon5aFPkg.0Payload parsing failed.

Timestamp	Bytes transferred	Direction	Data
2023-12-08 17:37:15 UTC	688	OUT	POST /setup/ws/1/validate?clientBuildNumber=2404Project47&clientMasteringNumber=2404B20&clientId=a9fd8cd9-f162-40eb-988d-ebea97d8939c HTTP/1.1 Host: setup.icloud.com Connection: keep-alive Content-Length: 0 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.icloud.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.icloud.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-08 17:37:15 UTC	752	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 34 32 31 20 4d 69 73 64 69 72 65 63 74 65 64 20 52 65 71 75 65 73 74 0d 0a 53 65 72 76 65 72 3a 20 41 70 70 6c 65 48 74 74 70 53 65 72 76 65 72 2f 37 38 36 38 39 61 66 62 34 34 37 39 0d 0a 44 61 74 65 3a 20 46 72 69 2c 20 30 38 20 44 65 63 20 32 30 32 33 20 31 37 3a 33 37 3a 31 35 20 47 4d 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6a 73 6f 6e 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 31 32 35 35 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 58 2d 52 65 73 70 6f 6e 64 69 6e 67 2d 49 6e 73 74 61 6e 63 65 3a 20 73 65 74 75 70 73 65 72 76 69 63 65 3a 33 32 34 30 30 34 30 31 3a 6d 72 31 31 70 32 34 69 63 2d 71 75 61 Data Ascii: HTTP/1.1 421 Misdirected RequestServer: AppleHttpServer/78689afb4479Date: Fri, 08 Dec 2023 17:37:15 GMTContent-Type: application/json; charset=UTF-8Content-Length: 1255Connection: closeX-Responding-Instance: setupservice:32400401:mr11p24ic-qua
2023-12-08 17:37:15 UTC	1255	IN	Data Raw: 7b 22 73 75 63 63 65 73 73 22 3a 66 61 6c 73 65 2c 22 72 65 71 75 65 73 74 49 6e 66 6f 22 3a 5b 7b 22 63 6f 75 6e 74 72 79 22 3a 22 55 53 22 2c 22 74 69 6d 65 5a 6f 6e 65 22 3a 22 45 53 54 22 2c 22 72 65 67 69 6f 6e 22 3a 22 46 4c 22 7d 5d 2c 22 63 6f 6e 66 69 67 42 61 67 22 3a 7b 22 75 72 6c 73 22 3a 7b 22 61 63 63 6f 75 6e 74 43 72 65 61 74 65 55 49 22 3a 22 68 74 74 70 73 3a 2f 2f 61 70 70 6c 65 69 64 2e 61 70 70 6c 65 2e 63 6f 6d 2f 77 69 64 67 65 74 2f 61 63 63 6f 75 6e 74 2f 3f 77 69 64 67 65 74 4b 65 79 3d 64 33 39 62 61 39 39 31 36 62 37 32 35 31 30 35 35 62 32 32 63 37 66 39 31 30 65 32 65 61 37 39 36 65 65 36 35 65 39 38 62 32 64 64 65 63 65 61 38 66 35 64 64 65 38 64 39 64 31 61 38 31 35 64 23 21 63 72 65 61 74 65 22 2c 22 61 63 63 6f 75 6e 74 Data Ascii: {"success":false,"requestInfo":[{"country":"US","timeZone":"EST","region":"FL"}],"configBag":{"urls":{"accountCreateUI":"https://appleid.apple.com/widget/account/?widgetKey=d39ba9916b7251055b22c7f910e2ea796ee65e98b2ddecea8f5dde8d9d1a815d#!create","account

Timestamp	Bytes transferred	Direction	Data
2023-12-08 17:37:15 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2023-12-08 17:37:16 UTC	496	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 41 70 69 56 65 72 73 69 6f 6e 3a 20 44 69 73 74 72 69 62 75 74 65 20 31 2e 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 61 74 74 61 63 68 6d 65 6e 74 3b 20 66 69 6c 65 6e 61 6d 65 3d 63 6f 6e 66 69 67 2e 6a 73 6f 6e 3b 20 66 69 6c 65 6e 61 6d 65 2a 3d 55 54 46 2d 38 27 27 63 6f 6e 66 69 67 2e 6a 73 6f 6e 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 45 54 61 67 3a 20 22 30 78 36 34 36 36 37 46 37 30 37 46 46 30 37 44 36 32 42 37 33 33 44 42 43 42 37 39 45 46 45 33 38 35 35 45 36 38 38 36 43 39 39 37 35 42 30 43 30 42 34 36 37 44 34 36 32 33 31 42 33 46 41 35 45 37 22 0d 0a 4c 61 73 74 2d 4d 6f 64 69 Data Ascii: HTTP/1.1 200 OKApiVersion: Distribute 1.1Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.jsonContent-Type: application/octet-streamETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7"Last-Modi

Timestamp	Bytes transferred	Direction	Data
2023-12-08 17:37:16 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2023-12-08 17:37:16 UTC	531	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 4c 61 73 74 2d 4d 6f 64 69 66 69 65 64 3a 20 54 75 65 2c 20 31 36 20 4d 61 79 20 32 30 31 37 20 32 32 3a 35 38 3a 30 30 20 47 4d 54 0d 0a 45 54 61 67 3a 20 22 30 78 36 34 36 36 37 46 37 30 37 46 46 30 37 44 36 32 42 37 33 33 44 42 43 42 37 39 45 46 45 33 38 35 35 45 36 38 38 36 43 39 39 37 35 42 30 43 30 42 34 36 37 44 34 36 32 33 31 42 33 46 41 35 45 37 22 0d 0a 41 70 69 56 65 72 73 69 6f 6e 3a 20 44 69 73 74 72 69 62 75 74 65 20 31 2e 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 61 74 74 61 63 68 6d 65 6e 74 3b 20 66 69 6c 65 6e 61 6d 65 3d 63 6f 6e 66 69 67 Data Ascii: HTTP/1.1 200 OKContent-Type: application/octet-streamLast-Modified: Tue, 16 May 2017 22:58:00 GMTETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7"ApiVersion: Distribute 1.1Content-Disposition: attachment; filename=config
2023-12-08 17:37:16 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Timestamp	Bytes transferred	Direction	Data
2023-12-08 17:37:24 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 51 4d 68 58 51 47 45 36 6d 45 65 47 6b 4d 49 2f 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 37 33 30 34 64 36 61 35 65 63 61 35 30 35 30 37 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: QMhXQGE6mEeGkMI/.1Context: 7304d6a5eca50507
2023-12-08 17:37:24 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2023-12-08 17:37:24 UTC	1076	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 35 33 0d 0a 4d 53 2d 43 56 3a 20 51 4d 68 58 51 47 45 36 6d 45 65 47 6b 4d 49 2f 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 37 33 30 34 64 36 61 35 65 63 61 35 30 35 30 37 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 77 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 62 71 7a 36 6f 64 74 4f 66 68 72 44 49 7a 39 46 71 46 6c 30 37 7a 62 67 4d 78 70 7a 47 4c 63 73 75 43 35 48 76 72 71 67 70 31 59 6b 76 54 52 2f 30 48 74 33 57 38 5a 69 50 56 79 65 54 72 65 36 64 50 63 31 4a 72 63 76 47 69 66 46 50 30 53 34 2b 41 46 31 63 63 4f 32 66 77 35 4d 72 53 4c 41 59 4d 51 42 78 35 70 2b 46 57 2f 51 4c Data Ascii: ATH 2 CON\DEVICE 1053MS-CV: QMhXQGE6mEeGkMI/.2Context: 7304d6a5eca50507<device><compact-ticket>t=EwCwAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAbqz6odtOfhrDIz9FqFl07zbgMxpzGLcsuC5Hvrqgp1YkvTR/0Ht3W8ZiPVyeTre6dPc1JrcvGifFP0S4+AF1ccO2fw5MrSLAYMQBx5p+FW/QL
2023-12-08 17:37:24 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 51 4d 68 58 51 47 45 36 6d 45 65 47 6b 4d 49 2f 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 37 33 30 34 64 36 61 35 65 63 61 35 30 35 30 37 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: QMhXQGE6mEeGkMI/.3Context: 7304d6a5eca50507<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2023-12-08 17:37:24 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2023-12-08 17:37:24 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 36 4e 64 51 2f 45 63 76 49 30 69 39 65 55 42 75 63 39 6d 30 50 77 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: 6NdQ/EcvI0i9eUBuc9m0Pw.0Payload parsing failed.

Timestamp	Bytes transferred	Direction	Data
2023-12-08 17:37:27 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=X5Fpu24E9+Nkwva&MD=ooKkDlRy HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2023-12-08 17:37:28 UTC	560	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 50 72 61 67 6d 61 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 45 78 70 69 72 65 73 3a 20 2d 31 0d 0a 4c 61 73 74 2d 4d 6f 64 69 66 69 65 64 3a 20 4d 6f 6e 2c 20 30 31 20 4a 61 6e 20 30 30 30 31 20 30 30 3a 30 30 3a 30 30 20 47 4d 54 0d 0a 45 54 61 67 3a 20 22 58 41 6f 70 61 7a 56 30 30 58 44 57 6e 4a 43 77 6b 6d 45 57 52 76 36 4a 6b 62 6a 52 41 39 51 53 53 5a 32 2b 65 2f 33 4d 7a 45 6b 3d 5f 32 38 38 30 22 0d 0a 4d 53 2d 43 6f 72 72 65 6c 61 74 69 6f 6e 49 64 3a 20 36 66 30 39 38 38 66 32 2d 62 37 30 30 2d 34 33 61 62 2d Data Ascii: HTTP/1.1 200 OKCache-Control: no-cachePragma: no-cacheContent-Type: application/octet-streamExpires: -1Last-Modified: Mon, 01 Jan 0001 00:00:00 GMTETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880"MS-CorrelationId: 6f0988f2-b700-43ab-
2023-12-08 17:37:28 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2023-12-08 17:37:28 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Timestamp	Bytes transferred	Direction	Data
2023-12-08 17:37:29 UTC	620	OUT	POST /reportStats HTTP/1.1 Host: feedbackws.icloud.com Connection: keep-alive Content-Length: 8165 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://www.icloud.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.icloud.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-08 17:37:29 UTC	8165	OUT	Data Raw: 7b 22 73 74 61 74 73 22 3a 5b 7b 22 63 6f 6e 66 69 67 42 61 67 22 3a 7b 22 75 72 6c 73 22 3a 7b 22 61 63 63 6f 75 6e 74 43 72 65 61 74 65 55 49 22 3a 22 68 74 74 70 73 3a 2f 2f 61 70 70 6c 65 69 64 2e 61 70 70 6c 65 2e 63 6f 6d 2f 77 69 64 67 65 74 2f 61 63 63 6f 75 6e 74 2f 3f 77 69 64 67 65 74 4b 65 79 3d 64 33 39 62 61 39 39 31 36 62 37 32 35 31 30 35 35 62 32 32 63 37 66 39 31 30 65 32 65 61 37 39 36 65 65 36 35 65 39 38 62 32 64 64 65 63 65 61 38 66 35 64 64 65 38 64 39 64 31 61 38 31 35 64 23 21 63 72 65 61 74 65 22 2c 22 61 63 63 6f 75 6e 74 4c 6f 67 69 6e 55 49 22 3a 22 68 74 74 70 73 3a 2f 2f 69 64 6d 73 61 2e 61 70 70 6c 65 2e 63 6f 6d 2f 61 70 70 6c 65 61 75 74 68 2f 61 75 74 68 2f 73 69 67 6e 69 6e 3f 77 69 64 67 65 74 4b 65 79 3d 64 33 39 62 Data Ascii: {"stats":[{"configBag":{"urls":{"accountCreateUI":"https://appleid.apple.com/widget/account/?widgetKey=d39ba9916b7251055b22c7f910e2ea796ee65e98b2ddecea8f5dde8d9d1a815d#!create","accountLoginUI":"https://idmsa.apple.com/appleauth/auth/signin?widgetKey=d39b
2023-12-08 17:37:30 UTC	846	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 53 65 72 76 65 72 3a 20 41 70 70 6c 65 48 74 74 70 53 65 72 76 65 72 2f 37 38 36 38 39 61 66 62 34 34 37 39 0d 0a 44 61 74 65 3a 20 46 72 69 2c 20 30 38 20 44 65 63 20 32 30 32 33 20 31 37 3a 33 37 3a 33 30 20 47 4d 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6a 73 6f 6e 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 0d 0a 54 72 61 6e 73 66 65 72 2d 45 6e 63 6f 64 69 6e 67 3a 20 63 68 75 6e 6b 65 64 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 58 2d 52 65 73 70 6f 6e 64 69 6e 67 2d 49 6e 73 74 61 6e 63 65 3a 20 66 65 65 64 62 61 63 6b 77 73 3a 70 72 6f 64 2d 70 31 32 30 2d 66 65 65 64 62 61 63 6b 77 73 2d 35 64 37 34 62 62 63 39 62 62 2d 62 70 70 Data Ascii: HTTP/1.1 200 OKServer: AppleHttpServer/78689afb4479Date: Fri, 08 Dec 2023 17:37:30 GMTContent-Type: application/json; charset=UTF-8Transfer-Encoding: chunkedConnection: closeX-Responding-Instance: feedbackws:prod-p120-feedbackws-5d74bbc9bb-bpp
2023-12-08 17:37:30 UTC	12	IN	Data Raw: 32 0d 0a 7b 7d 0d 0a 30 0d 0a 0d 0a Data Ascii: 2{}0

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report http://icloud.com

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

Phishing

Compliance

Networking

System Summary

Malware Analysis System Evasion

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Chrome Cache Entry: 193

Chrome Cache Entry: 194

Chrome Cache Entry: 195

Chrome Cache Entry: 196

Chrome Cache Entry: 197

Chrome Cache Entry: 198

Chrome Cache Entry: 199

Chrome Cache Entry: 200

Chrome Cache Entry: 201

Chrome Cache Entry: 202

Chrome Cache Entry: 203

Chrome Cache Entry: 204

Chrome Cache Entry: 205

Chrome Cache Entry: 206

Chrome Cache Entry: 207

Chrome Cache Entry: 208

Chrome Cache Entry: 209

Chrome Cache Entry: 210

Chrome Cache Entry: 211

Chrome Cache Entry: 212

Chrome Cache Entry: 213

Chrome Cache Entry: 214

Chrome Cache Entry: 215

Chrome Cache Entry: 216

Chrome Cache Entry: 217

Chrome Cache Entry: 218

Chrome Cache Entry: 219

Chrome Cache Entry: 220

Windows Analysis Report
http://icloud.com

Timestamp	Bytes transferred	Direction	Data
2023-12-08 17:37:30 UTC	356	OUT	GET /reportStats HTTP/1.1 Host: feedbackws.icloud.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-08 17:37:31 UTC	707	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 34 30 35 20 4d 65 74 68 6f 64 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 0d 0a 53 65 72 76 65 72 3a 20 41 70 70 6c 65 48 74 74 70 53 65 72 76 65 72 2f 37 38 36 38 39 61 66 62 34 34 37 39 0d 0a 44 61 74 65 3a 20 46 72 69 2c 20 30 38 20 44 65 63 20 32 30 32 33 20 31 37 3a 33 37 3a 33 31 20 47 4d 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 70 6c 61 69 6e 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 32 30 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 58 2d 52 65 73 70 6f 6e 64 69 6e 67 2d 49 6e 73 74 61 6e 63 65 3a 20 66 65 65 64 62 61 63 6b 77 73 3a 70 72 6f 64 2d 70 33 39 2d 66 65 65 64 62 61 63 6b 77 73 2d 36 64 37 37 62 38 63 37 62 2d 6a 77 6e Data Ascii: HTTP/1.1 405 Method Not AllowedServer: AppleHttpServer/78689afb4479Date: Fri, 08 Dec 2023 17:37:31 GMTContent-Type: text/plain; charset=UTF-8Content-Length: 20Connection: closeX-Responding-Instance: feedbackws:prod-p39-feedbackws-6d77b8c7b-jwn
2023-12-08 17:37:31 UTC	20	IN	Data Raw: 4d 65 74 68 6f 64 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 0d 0a Data Ascii: Method Not Allowed

Timestamp	Bytes transferred	Direction	Data
2023-12-08 17:37:36 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 38 50 4b 6a 37 31 39 6e 46 45 53 4b 75 6b 44 78 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 62 38 37 61 61 34 64 36 63 32 32 36 36 31 66 32 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: 8PKj719nFESKukDx.1Context: b87aa4d6c22661f2
2023-12-08 17:37:36 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2023-12-08 17:37:36 UTC	1076	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 35 33 0d 0a 4d 53 2d 43 56 3a 20 38 50 4b 6a 37 31 39 6e 46 45 53 4b 75 6b 44 78 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 62 38 37 61 61 34 64 36 63 32 32 36 36 31 66 32 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 77 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 62 71 7a 36 6f 64 74 4f 66 68 72 44 49 7a 39 46 71 46 6c 30 37 7a 62 67 4d 78 70 7a 47 4c 63 73 75 43 35 48 76 72 71 67 70 31 59 6b 76 54 52 2f 30 48 74 33 57 38 5a 69 50 56 79 65 54 72 65 36 64 50 63 31 4a 72 63 76 47 69 66 46 50 30 53 34 2b 41 46 31 63 63 4f 32 66 77 35 4d 72 53 4c 41 59 4d 51 42 78 35 70 2b 46 57 2f 51 4c Data Ascii: ATH 2 CON\DEVICE 1053MS-CV: 8PKj719nFESKukDx.2Context: b87aa4d6c22661f2<device><compact-ticket>t=EwCwAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAbqz6odtOfhrDIz9FqFl07zbgMxpzGLcsuC5Hvrqgp1YkvTR/0Ht3W8ZiPVyeTre6dPc1JrcvGifFP0S4+AF1ccO2fw5MrSLAYMQBx5p+FW/QL
2023-12-08 17:37:36 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 38 50 4b 6a 37 31 39 6e 46 45 53 4b 75 6b 44 78 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 62 38 37 61 61 34 64 36 63 32 32 36 36 31 66 32 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: 8PKj719nFESKukDx.3Context: b87aa4d6c22661f2<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2023-12-08 17:37:36 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2023-12-08 17:37:36 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 47 71 51 4d 6d 59 4d 72 72 45 75 43 70 34 35 74 2b 61 6a 77 64 51 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: GqQMmYMrrEuCp45t+ajwdQ.0Payload parsing failed.

Timestamp	Bytes transferred	Direction	Data
2023-12-08 17:37:57 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 6e 4b 4e 78 4d 45 38 52 49 30 47 32 75 35 34 65 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 39 30 31 30 64 35 65 36 31 33 36 63 62 33 36 38 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: nKNxME8RI0G2u54e.1Context: 9010d5e6136cb368
2023-12-08 17:37:57 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2023-12-08 17:37:57 UTC	1076	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 35 33 0d 0a 4d 53 2d 43 56 3a 20 6e 4b 4e 78 4d 45 38 52 49 30 47 32 75 35 34 65 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 39 30 31 30 64 35 65 36 31 33 36 63 62 33 36 38 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 77 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 62 71 7a 36 6f 64 74 4f 66 68 72 44 49 7a 39 46 71 46 6c 30 37 7a 62 67 4d 78 70 7a 47 4c 63 73 75 43 35 48 76 72 71 67 70 31 59 6b 76 54 52 2f 30 48 74 33 57 38 5a 69 50 56 79 65 54 72 65 36 64 50 63 31 4a 72 63 76 47 69 66 46 50 30 53 34 2b 41 46 31 63 63 4f 32 66 77 35 4d 72 53 4c 41 59 4d 51 42 78 35 70 2b 46 57 2f 51 4c Data Ascii: ATH 2 CON\DEVICE 1053MS-CV: nKNxME8RI0G2u54e.2Context: 9010d5e6136cb368<device><compact-ticket>t=EwCwAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAbqz6odtOfhrDIz9FqFl07zbgMxpzGLcsuC5Hvrqgp1YkvTR/0Ht3W8ZiPVyeTre6dPc1JrcvGifFP0S4+AF1ccO2fw5MrSLAYMQBx5p+FW/QL
2023-12-08 17:37:57 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 6e 4b 4e 78 4d 45 38 52 49 30 47 32 75 35 34 65 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 39 30 31 30 64 35 65 36 31 33 36 63 62 33 36 38 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: nKNxME8RI0G2u54e.3Context: 9010d5e6136cb368<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2023-12-08 17:37:57 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2023-12-08 17:37:57 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 71 67 69 76 6a 2b 6d 39 73 6b 43 74 34 6b 4a 74 66 43 34 44 66 51 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: qgivj+m9skCt4kJtfC4DfQ.0Payload parsing failed.

Timestamp	Bytes transferred	Direction	Data
2023-12-08 17:38:06 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=X5Fpu24E9+Nkwva&MD=ooKkDlRy HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2023-12-08 17:38:07 UTC	560	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 50 72 61 67 6d 61 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 45 78 70 69 72 65 73 3a 20 2d 31 0d 0a 4c 61 73 74 2d 4d 6f 64 69 66 69 65 64 3a 20 4d 6f 6e 2c 20 30 31 20 4a 61 6e 20 30 30 30 31 20 30 30 3a 30 30 3a 30 30 20 47 4d 54 0d 0a 45 54 61 67 3a 20 22 4d 78 31 52 6f 4a 48 2f 71 45 77 70 57 66 4b 6c 6c 78 37 73 62 73 6c 32 38 41 75 45 52 7a 35 49 59 64 63 73 76 74 54 4a 63 67 4d 3d 5f 32 31 36 30 22 0d 0a 4d 53 2d 43 6f 72 72 65 6c 61 74 69 6f 6e 49 64 3a 20 65 66 66 63 38 65 61 65 2d 39 64 34 31 2d 34 62 36 61 2d Data Ascii: HTTP/1.1 200 OKCache-Control: no-cachePragma: no-cacheContent-Type: application/octet-streamExpires: -1Last-Modified: Mon, 01 Jan 0001 00:00:00 GMTETag: "Mx1RoJH/qEwpWfKllx7sbsl28AuERz5IYdcsvtTJcgM=_2160"MS-CorrelationId: effc8eae-9d41-4b6a-
2023-12-08 17:38:07 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 51 22 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 db 8e 00 00 14 00 00 00 00 00 10 00 51 22 00 00 20 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 f3 43 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 0d 92 6f db e5 21 f3 43 43 4b ed 5a 09 38 55 5b df 3f 93 99 90 29 99 e7 29 ec 73 cc 4a 66 32 cf 84 32 64 c8 31 c7 11 52 38 87 90 42 66 09 99 87 32 0f 19 0a 09 51 a6 a8 08 29 53 86 4a 52 84 50 df 46 83 ba dd 7b df fb 7e ef 7d ee 7d bf ef 9e e7 d9 67 ef 35 ee b5 fe eb 3f ff b6 96 81 a2 0a 04 fc 31 40 21 5b 3f a5 ed 1b 04 0e 85 42 a0 10 04 64 12 6c a5 de aa a1 d8 ea f3 58 01 f2 f5 67 0b 5e 9b bd e8 a0 90 1d bf 40 88 9d eb 49 b4 87 9b ab 8b 9d 2b 46 c8 c7 c5 19 92 Data Ascii: MSCFQ"DQ" AdCenvironment.cabo!CCKZ8U[?))sJf22d1R8Bf2Q)SJRPF{~}}g5?1@![?BdlXg^@I+F
2023-12-08 17:38:07 UTC	9633	IN	Data Raw: 21 6f b3 eb a6 cc f5 31 be cf 05 e2 a9 fe fa 57 6d 19 30 b3 c2 c5 66 c9 6a df f5 e7 f0 78 bd c7 a8 9e 25 e3 f9 bc ed 6b 54 57 08 2b 51 82 44 12 fb b9 53 8c cc f4 60 12 8a 76 cc 40 40 41 9b dc 5c 17 ff 5c f9 5e 17 35 98 24 56 4b 74 ef 42 10 c8 af bf 7f c6 7f f2 37 7d 5a 3f 1c f2 99 79 4a 91 52 00 af 38 0f 17 f5 2f 79 81 65 d9 a9 b5 6b e4 c7 ce f6 ca 7a 00 6f 4b 30 44 24 22 3c cf ed 03 a5 96 8f 59 29 bc b6 fd 04 e1 70 9f 32 4a 27 fd 55 af 2f fe b6 e5 8e 33 bb 62 5f 9a db 57 40 e9 f1 ce 99 66 90 8c ff 6a 62 7f dd c5 4a 0b 91 26 e2 39 ec 19 4a 71 63 9d 7b 21 6d c3 9c a3 a2 3c fa 7f 7d 96 6a 90 78 a6 6d d2 e1 9c f9 1d fc 38 d8 94 f4 c6 a5 0a 96 86 a4 bd 9e 1a ae 04 42 83 b8 b5 80 9b 22 38 20 b5 25 e5 64 ec f7 f4 bf 7e 63 59 25 0f 7a 2e 39 57 76 a2 71 aa 06 8a Data Ascii: !o1Wm0fjx%kTW+QDS`v@@A\\^5$VKtB7}Z?yJR8/yekzoK0D$"<Y)p2J'U/3b_W@fjbJ&9Jqc{!m<}jxm8B"8 %d~cY%z.9Wvq

Timestamp	Bytes transferred	Direction	Data
2023-12-08 17:38:27 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 53 30 67 69 49 50 48 6e 37 30 61 7a 74 67 75 4f 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 66 35 63 30 65 38 65 63 61 33 61 36 66 30 39 38 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: S0giIPHn70aztguO.1Context: f5c0e8eca3a6f098
2023-12-08 17:38:27 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2023-12-08 17:38:27 UTC	1076	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 35 33 0d 0a 4d 53 2d 43 56 3a 20 53 30 67 69 49 50 48 6e 37 30 61 7a 74 67 75 4f 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 66 35 63 30 65 38 65 63 61 33 61 36 66 30 39 38 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 77 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 62 71 7a 36 6f 64 74 4f 66 68 72 44 49 7a 39 46 71 46 6c 30 37 7a 62 67 4d 78 70 7a 47 4c 63 73 75 43 35 48 76 72 71 67 70 31 59 6b 76 54 52 2f 30 48 74 33 57 38 5a 69 50 56 79 65 54 72 65 36 64 50 63 31 4a 72 63 76 47 69 66 46 50 30 53 34 2b 41 46 31 63 63 4f 32 66 77 35 4d 72 53 4c 41 59 4d 51 42 78 35 70 2b 46 57 2f 51 4c Data Ascii: ATH 2 CON\DEVICE 1053MS-CV: S0giIPHn70aztguO.2Context: f5c0e8eca3a6f098<device><compact-ticket>t=EwCwAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAbqz6odtOfhrDIz9FqFl07zbgMxpzGLcsuC5Hvrqgp1YkvTR/0Ht3W8ZiPVyeTre6dPc1JrcvGifFP0S4+AF1ccO2fw5MrSLAYMQBx5p+FW/QL
2023-12-08 17:38:27 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2023-12-08 17:38:27 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 68 7a 45 76 65 38 48 6c 64 6b 61 41 59 76 4c 4b 62 70 45 59 55 77 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: hzEve8HldkaAYvLKbpEYUw.0Payload parsing failed.

Timestamp	Bytes transferred	Direction	Data
2023-12-08 17:38:40 UTC	449	OUT	GET /tools/pso/ping?as=chrome&brand=ONGR&pid=&hl=en&events=C1I,C2I,C7I,C1S,C7S&rep=2&rlz=C1:,C2:,C7:&id=00000000000000000000000000000000000000000F108E50F2 HTTP/1.1 Host: clients1.google.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br
2023-12-08 17:38:40 UTC	817	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 53 65 63 75 72 69 74 79 2d 50 6f 6c 69 63 79 3a 20 73 63 72 69 70 74 2d 73 72 63 20 27 72 65 70 6f 72 74 2d 73 61 6d 70 6c 65 27 20 27 6e 6f 6e 63 65 2d 7a 66 5a 65 56 75 62 69 41 59 49 7a 42 71 54 4d 4e 4d 63 38 4f 51 27 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 20 27 73 74 72 69 63 74 2d 64 79 6e 61 6d 69 63 27 20 68 74 74 70 73 3a 20 68 74 74 70 3a 3b 6f 62 6a 65 63 74 2d 73 72 63 20 27 6e 6f 6e 65 27 3b 62 61 73 65 2d 75 72 69 20 27 73 65 6c 66 27 3b 72 65 70 6f 72 74 2d 75 72 69 20 68 74 74 70 73 3a 2f 2f 63 73 70 2e 77 69 74 68 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 63 73 70 2f 64 6f 77 6e 6c 6f 61 64 2d 64 74 2f 31 0d 0a 43 6f 6e 74 65 6e 74 2d 53 65 63 75 72 69 74 79 2d 50 Data Ascii: HTTP/1.1 200 OKContent-Security-Policy: script-src 'report-sample' 'nonce-zfZeVubiAYIzBqTMNMc8OQ' 'unsafe-inline' 'strict-dynamic' https: http:;object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/download-dt/1Content-Security-P
2023-12-08 17:38:40 UTC	219	IN	Data Raw: 72 6c 7a 43 31 3a 20 31 43 31 4f 4e 47 52 5f 65 6e 55 53 31 30 38 37 0a 72 6c 7a 43 32 3a 20 31 43 32 4f 4e 47 52 5f 65 6e 55 53 31 30 38 37 0a 72 6c 7a 43 37 3a 20 31 43 37 4f 4e 47 52 5f 65 6e 55 53 31 30 38 37 0a 64 63 63 3a 20 0a 73 65 74 5f 64 63 63 3a 20 43 31 3a 31 43 31 4f 4e 47 52 5f 65 6e 55 53 31 30 38 37 2c 43 32 3a 31 43 32 4f 4e 47 52 5f 65 6e 55 53 31 30 38 37 2c 43 37 3a 31 43 37 4f 4e 47 52 5f 65 6e 55 53 31 30 38 37 0a 65 76 65 6e 74 73 3a 20 43 31 49 2c 43 32 49 2c 43 37 49 2c 43 31 53 2c 43 37 53 0a 73 74 61 74 65 66 75 6c 2d 65 76 65 6e 74 73 3a 20 43 31 49 2c 43 32 49 2c 43 37 49 0a 63 72 63 33 32 3a 20 32 65 31 35 66 38 39 0a Data Ascii: rlzC1: 1C1ONGR_enUS1087rlzC2: 1C2ONGR_enUS1087rlzC7: 1C7ONGR_enUS1087dcc: set_dcc: C1:1C1ONGR_enUS1087,C2:1C2ONGR_enUS1087,C7:1C7ONGR_enUS1087events: C1I,C2I,C7I,C1S,C7Sstateful-events: C1I,C2I,C7Icrc32: 2e15f89

Target ID:	0
Start time:	18:37:06
Start date:	08/12/2023
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Target ID:	2
Start time:	18:37:09
Start date:	08/12/2023
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2244 --field-trial-handle=1712,i,11458534097342901050,5237557838706718646,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Target ID:	3
Start time:	18:37:11
Start date:	08/12/2023
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	C:\Program Files\Google\Chrome\Application\chrome.exe" "http://icloud.com
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Target ID:	4
Start time:	18:37:23
Start date:	08/12/2023
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5644 --field-trial-handle=1712,i,11458534097342901050,5237557838706718646,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false