Edit tour

Windows Analysis Report
StepXpress - New interface - Requesting Enablement Data.pptx

Overview

General Information

Sample name:	StepXpress - New interface - Requesting Enablement Data.pptx
Analysis ID:	1427724
MD5:	4cd049db018a29a4948930df13b3d9b4
SHA1:	1dbedbbdc2c03bf6fd9a1de1eab2151a0dd850b3
SHA256:	f97bb92aff65923b2a969526a54170d67cf5b90c6759876bf307c5f181d88f00
Infos:

Detection

Score:	2
Range:	0 - 100
Whitelisted:	false
Confidence:	60%

Signatures

Document contains embedded VBA macros

Document misses a certain OLE stream usually present in this Microsoft Office document type

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

Queries the volume information (name, serial number etc) of a device

Classification

Analysis Advice

No malicious behavior found, analyze the document also on other version of Office / Acrobat

Sample tries to load a library which is not present or installed on the analysis machine, adding the library might reveal more behavior

Process Tree

System is w10x64

POWERPNT.EXE (PID: 7468 cmdline: "C:\Program Files (x86)\Microsoft Office\Root\Office16\POWERPNT.EXE" /AUTOMATION -Embedding MD5: 2A43FE7F9F699F7F53FEBC254F68F46D)

ai.exe (PID: 7652 cmdline: "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "E82CBA33-6107-4D2B-8659-11EDEFE888BB" "321144BA-FF65-4E93-BF42-03EEDECDC422" "7468" "C:\Program Files (x86)\Microsoft Office\Root\Office16\POWERPNT.EXE" "PowerPointCombinedFloatieLreOnline.onnx" MD5: EC652BEDD90E089D9406AFED89A8A8BD)

chrome.exe (PID: 8036 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 7240 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2068 --field-trial-handle=2032,i,13813057511665179787,3489492556640179065,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 8288 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "http://www.google.com/imgres?imgurl=http://www.testedgeinc.com/images/wafer.gif&imgrefurl=http://www.testedgeinc.com/wafersort.html&usg=__-3Z4I2oN99yJOMvLJcc5ES309Nk=&h=284&w=290&sz=43&hl=en&start=53&zoom=1&tbnid=s24hxS3vSW33KM:&tbnh=113&tbnw=115&ei=FOc7T96UKM6bOpD0lN8C&prev=/search?q=wafer&start=42&hl=en&sa=N&gbv=2&tbm=isch&itbs=1" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: https://www.google.com/imgres?imgurl=http://www.testedgeinc.com/images/wafer.gif&imgrefurl=http://www.testedgeinc.com/wafersort.html&usg=__-3Z4I2oN99yJOMvLJcc5ES309Nk=&h=284&w=290&sz=43&hl=en&start=53&zoom=1&tbnid=s24hxS3vSW33KM:&tbnh=113&tbnw=115&ei=FOc7T96UKM6bOpD0lN8C&prev=/search?q=wafer&start=42&hl=en&sa=N&gbv=2&tbm=isch&itbs=1	HTTP Parser: No favicon
Source: http://www.testedgeinc.com/images/wafer.gif	HTTP Parser: No favicon

Source: unknown	HTTPS traffic detected: 40.126.29.8:443 -> 192.168.2.4:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.127.169.103:443 -> 192.168.2.4:49800 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.127.169.103:443 -> 192.168.2.4:49822 version: TLS 1.2

Source: powerpnt.exe

Memory has grown: Private usage: 1MB later: 152MB

Source: Joe Sandbox View	IP Address: 239.255.255.250 239.255.255.250
Source: Joe Sandbox View	IP Address: 64.29.151.221 64.29.151.221

Source: Joe Sandbox View

JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4

Source: unknown	TCP traffic detected without corresponding DNS query: 104.46.162.224
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.29.8
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.29.8
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.29.8
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.29.8
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.29.8
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.29.8
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.29.8
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.29.8
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.29.8
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.29.8
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.29.8
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.29.8
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.29.8
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.29.8
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.29.8
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.29.8
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.29.8
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.29.8
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.29.8
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.29.8
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.29.8
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.29.8
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.29.8
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.29.8
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.29.8
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.29.8
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.29.8
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.29.8
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.29.8
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.29.8
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.29.8
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.29.8
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.29.8
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.29.8
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.29.8
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.29.8
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.29.8
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.29.8
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.29.8
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.29.8
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.29.8
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.29.8
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.29.8
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.29.8
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.29.8
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.29.8
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.29.8

Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=XpBNggYG9gZRtcY&MD=Z8lc1aDv HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /imgres?imgurl=http://www.testedgeinc.com/images/wafer.gif&imgrefurl=http://www.testedgeinc.com/wafersort.html&usg=__-3Z4I2oN99yJOMvLJcc5ES309Nk=&h=284&w=290&sz=43&hl=en&start=53&zoom=1&tbnid=s24hxS3vSW33KM:&tbnh=113&tbnw=115&ei=FOc7T96UKM6bOpD0lN8C&prev=/search?q=wafer&start=42&hl=en&sa=N&gbv=2&tbm=isch&itbs=1 HTTP/1.1Host: www.google.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiVocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=513=YnUuQrDaoaBEUA2bXiLdH2dYj28flSXSLiFewk1TkOsrmjPhuWebS5mOXWKacdDYybT6CWMI9gjteSTwR3vl3vPUiJA9QF0uYP6UtuzJ6_7_w70fpCKLgEjdIvtnImm9wI0v1wMmmE2-0_lNbQfFjrA3pgJ078lxpT5DkE0aUIU; 1P_JAR=2024-4-18-0
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: www.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiVocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=513=YnUuQrDaoaBEUA2bXiLdH2dYj28flSXSLiFewk1TkOsrmjPhuWebS5mOXWKacdDYybT6CWMI9gjteSTwR3vl3vPUiJA9QF0uYP6UtuzJ6_7_w70fpCKLgEjdIvtnImm9wI0v1wMmmE2-0_lNbQfFjrA3pgJ078lxpT5DkE0aUIU; 1P_JAR=2024-4-18-0
Source: global traffic	HTTP traffic detected: GET /_/VisualFrontendUi/browserinfo?f.sid=7167826289586990384&bl=boq_visualfrontendserver_20240412.05_p2&hl=en&authuser&opi=89978449&soc-app=162&soc-platform=1&soc-device=1&_reqid=7608&rt=j HTTP/1.1Host: www.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiVocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=513=YnUuQrDaoaBEUA2bXiLdH2dYj28flSXSLiFewk1TkOsrmjPhuWebS5mOXWKacdDYybT6CWMI9gjteSTwR3vl3vPUiJA9QF0uYP6UtuzJ6_7_w70fpCKLgEjdIvtnImm9wI0v1wMmmE2-0_lNbQfFjrA3pgJ078lxpT5DkE0aUIU; 1P_JAR=2024-4-18-0; OTZ=7518247_48_52_123900_48_436380
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=XpBNggYG9gZRtcY&MD=Z8lc1aDv HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /_/VisualFrontendUi/gen204/?tmambps=0.0001982758620689655&rtembps=-1&rttms=104&ct=undefined HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiVocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=513=YnUuQrDaoaBEUA2bXiLdH2dYj28flSXSLiFewk1TkOsrmjPhuWebS5mOXWKacdDYybT6CWMI9gjteSTwR3vl3vPUiJA9QF0uYP6UtuzJ6_7_w70fpCKLgEjdIvtnImm9wI0v1wMmmE2-0_lNbQfFjrA3pgJ078lxpT5DkE0aUIU; 1P_JAR=2024-4-18-0; OTZ=7518247_48_52_123900_48_436380
Source: global traffic	HTTP traffic detected: GET /images/wafer.gif HTTP/1.1Host: www.testedgeinc.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: www.testedgeinc.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://www.testedgeinc.com/images/wafer.gifAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: www.testedgeinc.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9

Source: unknown

DNS traffic detected: queries for: www.google.com

Source: unknown

HTTP traffic detected: POST /RST2.srf HTTP/1.0Connection: Keep-AliveContent-Type: application/soap+xmlAccept: */*User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68})Content-Length: 3592Host: login.live.com

Source: 57C8EDB95DF3F0AD4EE2DC2B8CFD4157.0.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab
Source: chromecache_216.10.dr	String found in binary or memory: http://www.testedgeinc.com/images/wafer.gif
Source: chromecache_216.10.dr	String found in binary or memory: http://www.testedgeinc.com/wafersort.html
Source: chromecache_223.10.dr	String found in binary or memory: https://play.google.com/log?format=json&hasfast=true
Source: chromecache_223.10.dr	String found in binary or memory: https://support.google.com/
Source: chromecache_223.10.dr	String found in binary or memory: https://translate.google.com/translate?u=
Source: chromecache_216.10.dr	String found in binary or memory: https://www.google.com/imgres?imgurl=http://www.testedgeinc.com/images/wafer.gif&imgrefurl=http:
Source: chromecache_223.10.dr	String found in binary or memory: https://www.google.com/tools/feedback
Source: chromecache_223.10.dr	String found in binary or memory: https://www.gstatic.com/uservoice/feedback/client/web/

Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49808
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49804
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49800
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822

Source: unknown	HTTPS traffic detected: 40.126.29.8:443 -> 192.168.2.4:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.127.169.103:443 -> 192.168.2.4:49800 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.127.169.103:443 -> 192.168.2.4:49822 version: TLS 1.2

Source: E782ACB3-D4FC-4778-B25D-58DB141EDE32.0.dr

OLE indicator, VBA macros: true

Source: E782ACB3-D4FC-4778-B25D-58DB141EDE32.0.dr

OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false

Source: classification engine

Classification label: clean2.winPPTX@23/230@12/6

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE

File created: C:\Users\user\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\E782ACB3-D4FC-4778-B25D-58DB141EDE32

Source: unknown	Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\POWERPNT.EXE" /AUTOMATION -Embedding
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Process created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "E82CBA33-6107-4D2B-8659-11EDEFE888BB" "321144BA-FF65-4E93-BF42-03EEDECDC422" "7468" "C:\Program Files (x86)\Microsoft Office\Root\Office16\POWERPNT.EXE" "PowerPointCombinedFloatieLreOnline.onnx"
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2068 --field-trial-handle=2032,i,13813057511665179787,3489492556640179065,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "http://www.google.com/imgres?imgurl=http://www.testedgeinc.com/images/wafer.gif&imgrefurl=http://www.testedgeinc.com/wafersort.html&usg=__-3Z4I2oN99yJOMvLJcc5ES309Nk=&h=284&w=290&sz=43&hl=en&start=53&zoom=1&tbnid=s24hxS3vSW33KM:&tbnh=113&tbnw=115&ei=FOc7T96UKM6bOpD0lN8C&prev=/search?q=wafer&start=42&hl=en&sa=N&gbv=2&tbm=isch&itbs=1"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Process created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "E82CBA33-6107-4D2B-8659-11EDEFE888BB" "321144BA-FF65-4E93-BF42-03EEDECDC422" "7468" "C:\Program Files (x86)\Microsoft Office\Root\Office16\POWERPNT.EXE" "PowerPointCombinedFloatieLreOnline.onnx"	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2068 --field-trial-handle=2032,i,13813057511665179787,3489492556640179065,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: c2r64.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: gpapi.dll	Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	Windows Management Instrumentation	1 Scripting	1 Process Injection	1 Masquerading	OS Credential Dumping	1 Process Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 DLL Side-Loading	1 DLL Side-Loading	1 Process Injection	LSASS Memory	1 File and Directory Discovery	Remote Desktop Protocol	Data from Removable Media	3 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 Extra Window Memory Injection	1 DLL Side-Loading	Security Account Manager	12 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	4 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Extra Window Memory Injection	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Source	Detection	Scanner	Label	Link
http://www.testedgeinc.com/wafersort.html	0%	Virustotal		Browse
http://www.testedgeinc.com/favicon.ico	0%	Virustotal		Browse

Name	IP	Active	Malicious	Antivirus Detection	Reputation
www.testedgeinc.com	64.29.151.221	true	false	0%, Virustotal, Browse	unknown
www.google.com	108.177.122.104	true	false		high

Name	Malicious	Antivirus Detection	Reputation
https://www.google.com/gen_204?s=images_vfe&t=aft&atyp=csi&ei=EmQgZvqIBaefiLMPme2E2A0&rt=wsrt.719	false		high
https://www.google.com/_/VisualFrontendUi/jserror?script=https%3A%2F%2Fwww.google.com%2Fimgres%3Fimgurl%3Dhttp%3A%2F%2Fwww.testedgeinc.com%2Fimages%2Fwafer.gif%26imgrefurl%3Dhttp%3A%2F%2Fwww.testedgeinc.com%2Fwafersort.html%26usg%3D__-3Z4I2oN99yJOMvLJcc5ES309Nk%3D%26h%3D284%26w%3D290%26sz%3D43%26hl%3Den%26start%3D53%26zoom%3D1%26tbnid%3Ds24hxS3vSW33KM%3A%26tbnh%3D113%26tbnw%3D115%26ei%3DFOc7T96UKM6bOpD0lN8C%26prev%3D%2Fsearch%3Fq%3Dwafer%26start%3D42%26hl%3Den%26sa%3DN%26gbv%3D2%26tbm%3Disch%26itbs%3D1&error=Failed%20to%20retrieve%20dependencies%20of%20service%20XLSavd%3A%20Oc%60Z9MBEf%60context%3AXLSavd&line=Not%20available&ei=EmQgZvqIBaefiLMPme2E2A0&authuser	false		high
https://www.google.com/gen_204?atyp=i&ct=slh&cad=&v=t1&ei=EmQgZvqIBaefiLMPme2E2A0&m=H&pv=0.7978148006256842&me=1:1713398804181,x:7,V,0,0,1280,907:0,B,907:0,N,1,EmQgZvqIBaefiLMPme2E2A0:9329,e,B&zx=1713398813518&opi=89978449	false		high
https://www.google.com/_/VisualFrontendUi/gen204/?tmambps=0.0001982758620689655&rtembps=-1&rttms=104&ct=undefined	false		high
http://www.testedgeinc.com/favicon.ico	false	0%, Virustotal, Browse	unknown
https://www.google.com/imgres?imgurl=http://www.testedgeinc.com/images/wafer.gif&imgrefurl=http://www.testedgeinc.com/wafersort.html&usg=__-3Z4I2oN99yJOMvLJcc5ES309Nk=&h=284&w=290&sz=43&hl=en&start=53&zoom=1&tbnid=s24hxS3vSW33KM:&tbnh=113&tbnw=115&ei=FOc7T96UKM6bOpD0lN8C&prev=/search?q=wafer&start=42&hl=en&sa=N&gbv=2&tbm=isch&itbs=1	false		high
https://www.google.com/_/VisualFrontendUi/browserinfo?f.sid=7167826289586990384&bl=boq_visualfrontendserver_20240412.05_p2&hl=en&authuser&opi=89978449&soc-app=162&soc-platform=1&soc-device=1&_reqid=7608&rt=j	false		high
http://www.testedgeinc.com/images/wafer.gif	false		unknown
https://www.google.com/favicon.ico	false		high

Name	Source	Malicious	Antivirus Detection	Reputation
https://support.google.com/	chromecache_223.10.dr	false		high
https://www.google.com/tools/feedback	chromecache_223.10.dr	false		high
https://play.google.com/log?format=json&hasfast=true	chromecache_223.10.dr	false		high
http://www.testedgeinc.com/wafersort.html	chromecache_216.10.dr	false	0%, Virustotal, Browse	unknown
https://translate.google.com/translate?u=	chromecache_223.10.dr	false		high
https://www.google.com/imgres?imgurl=http://www.testedgeinc.com/images/wafer.gif&imgrefurl=http:	chromecache_216.10.dr	false		high

IP	Domain	Country	ASN	ASN Name	Malicious
74.125.138.105	unknown	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
108.177.122.105	unknown	United States	15169	GOOGLEUS	false
64.233.185.104	unknown	United States	15169	GOOGLEUS	false
64.29.151.221	www.testedgeinc.com	United States	30447	INFB2-ASUS	false

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1427724
Start date and time:	2024-04-18 02:05:23 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 55s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsofficecookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Run name:	Potential for more IOCs and behavior
Number of analysed new started processes analysed:	13
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	StepXpress - New interface - Requesting Enablement Data.pptx
Detection:	CLEAN
Classification:	clean2.winPPTX@23/230@12/6
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .pptx Found Word or Excel or PowerPoint or XPS Viewer Attach to Office via COM Browse link: http://www.google.com/imgres?imgurl=http://www.testedgeinc.com/images/wafer.gif&imgrefurl=http://www.testedgeinc.com/wafersort.html&usg=__-3Z4I2oN99yJOMvLJcc5ES309Nk=&h=284&w=290&sz=43&hl=en&start=53&zoom=1&tbnid=s24hxS3vSW33KM:&tbnh=113&tbnw=115&ei=FOc7T96UKM6bOpD0lN8C&prev=/search?q=wafer&start=42&hl=en&sa=N&gbv=2&tbm=isch&itbs=1 Browse: http://www.testedgeinc.com/images/wafer.gif Scroll down Close Viewer Browse: http://www.testedgeinc.com/images/wafer.gif

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
239.255.255.250	https://windowdefalerts-error0x21906-alert-virus-detected.pages.dev/	Get hash	malicious	TechSupportScam	Browse
	https://windowdefalerts-error0x21903-alert-virus-detected.pages.dev/	Get hash	malicious	TechSupportScam	Browse
	https://windowdefalerts-error0x21905-alert-virus-detected.pages.dev/	Get hash	malicious	TechSupportScam	Browse
	https://windowdefalerts-error0x21908-alert-virus-detected.pages.dev/	Get hash	malicious	TechSupportScam	Browse
	https://windowdefalerts-error0x21904-alert-virus-detected.pages.dev/	Get hash	malicious	TechSupportScam	Browse
	https://windowdefalerts-error0x21902-alert-virus-detected.pages.dev/	Get hash	malicious	TechSupportScam	Browse
	https://www.applelswlqod.top/all/login.php?idsmt=10123005600&nextfunck=10130550000	Get hash	malicious	Unknown	Browse
	https://groun-93ed.ehajdranrsuw.workers.dev/	Get hash	malicious	HTMLPhisher	Browse
	https://pub-ac902c48ff244e4fbf44f3e3296d093d.r2.dev/updatemypassword.html	Get hash	malicious	HTMLPhisher	Browse
	https://17.104-168-101-28.cprapid.com/PayPal/	Get hash	malicious	Unknown	Browse
64.29.151.221	82YWwkVfIS.exe	Get hash	malicious	Glupteba, LummaC Stealer, Petite Virus, RedLine, SmokeLoader	Browse	gomberg.com/admin/
	http://lacondesaarthouse.com/wp-admin/linkedin/index.php?email=salem.dhouib@dot.state.fl.us	Get hash	malicious	HTMLPhisher	Browse	lacondesaarthouse.com/wp-admin/linkedin/images/apple.jpg
	PM8963.doc	Get hash	malicious	Unknown	Browse	golfstructures.com/556/455.exe
	WJJKxcSc00.exe	Get hash	malicious	FormBook	Browse	www.michaelcourtois.com/nogs/?aPYXPL=woxmvUKyXUq5VlkjDoboE5hIem9S4GN91ZQeq2O/hqdkWFscfrO1RgrmsEPURuQBegf1RAbMHFOtK1lnz/uLeBhweyZFkR2Xv6qDwGQjlzqm&C6zh=s6bXuB6p
	TNM81BhN5P.xlsx	Get hash	malicious	Unknown	Browse	varafood.com/Ajax/cnM91G/
	Form - Feb 04, 2022.xls	Get hash	malicious	Emotet	Browse	varafood.com/Ajax/cnM91G/
	2022-02-04_1714.xls	Get hash	malicious	Unknown	Browse	varafood.com/Ajax/cnM91G/
	Important COVID-19 Vaccine Information.xls	Get hash	malicious	Unknown	Browse	varafood.com/Ajax/cnM91G/
	Important COVID-19 Vaccine Information.xls	Get hash	malicious	Unknown	Browse	varafood.com/Ajax/cnM91G/
	11034485939234.exe	Get hash	malicious	FormBook	Browse	www.africandreambigcorporation.net/hno9/?BZ_TRvg=vlRnTEOc02UU+MI5vhSs5mx/nbE4QxczLZHatLH9cfiPxErFnKBegioCkGMJ0uEFvXEH&8pfXx=8pSDffXPd8S0

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
INFB2-ASUS	VRRoiuUVMq.elf	Get hash	malicious	Unknown	Browse	64.29.147.158
	letter.bat.exe	Get hash	malicious	MyDoom	Browse	64.29.151.236
	G0hFe9p4Zh.elf	Get hash	malicious	Mirai	Browse	66.175.25.252
	sorteado!!.com.exe	Get hash	malicious	Unknown	Browse	64.29.151.236
	SecuriteInfo.com.Linux.Siggen.9999.634.18850.elf	Get hash	malicious	Mirai	Browse	74.116.91.185
	file.exe	Get hash	malicious	Phorpiex	Browse	64.29.151.41
	file.exe	Get hash	malicious	Phorpiex	Browse	64.29.145.48
	file.exe	Get hash	malicious	Glupteba, Petite Virus, SmokeLoader, Socks5Systemz, Stealc	Browse	216.55.149.44
	Message.scr.exe	Get hash	malicious	MyDoom	Browse	64.29.151.236
	sCzFNAYGKI.exe	Get hash	malicious	Glupteba, LummaC Stealer, Petite Virus, RedLine, SmokeLoader	Browse	66.175.58.9

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	https://windowdefalerts-error0x21906-alert-virus-detected.pages.dev/	Get hash	malicious	TechSupportScam	Browse	40.126.29.8 40.127.169.103
	https://windowdefalerts-error0x21903-alert-virus-detected.pages.dev/	Get hash	malicious	TechSupportScam	Browse	40.126.29.8 40.127.169.103
	https://windowdefalerts-error0x21905-alert-virus-detected.pages.dev/	Get hash	malicious	TechSupportScam	Browse	40.126.29.8 40.127.169.103
	https://windowdefalerts-error0x21908-alert-virus-detected.pages.dev/	Get hash	malicious	TechSupportScam	Browse	40.126.29.8 40.127.169.103
	https://windowdefalerts-error0x21904-alert-virus-detected.pages.dev/	Get hash	malicious	TechSupportScam	Browse	40.126.29.8 40.127.169.103
	https://windowdefalerts-error0x21902-alert-virus-detected.pages.dev/	Get hash	malicious	TechSupportScam	Browse	40.126.29.8 40.127.169.103
	https://www.applelswlqod.top/all/login.php?idsmt=10123005600&nextfunck=10130550000	Get hash	malicious	Unknown	Browse	40.126.29.8 40.127.169.103
	https://groun-93ed.ehajdranrsuw.workers.dev/	Get hash	malicious	HTMLPhisher	Browse	40.126.29.8 40.127.169.103
	https://pub-ac902c48ff244e4fbf44f3e3296d093d.r2.dev/updatemypassword.html	Get hash	malicious	HTMLPhisher	Browse	40.126.29.8 40.127.169.103
	https://17.104-168-101-28.cprapid.com/PayPal/	Get hash	malicious	Unknown	Browse	40.126.29.8 40.127.169.103

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
File Type:	data
Category:	dropped
Size (bytes):	338
Entropy (8bit):	3.4420534553898867
Encrypted:	false
SSDEEP:	6:kKpT8GtlvJFN+SkQlPlEGYRMY9z+s3Ql2DUevat:VkkPlE99SCQl2DUevat
MD5:	94CF9AAE21583EF7749D37E9D57CB7FE
SHA1:	EDAE42C3937D82624DA9F022DB781805D05F107A
SHA-256:	F5E5D6790EA85CA65DFC76D3E68E885CBBADFDE607BCB83FFCA40145CA5BFD5A
SHA-512:	CA4BAE1F1F48691F0321CD308B9E9E57771DB1DC123CAA03E5AEA272165BC239497654BE23D7224C9AB471C04996E797F1C16D9C139C50E7AD173A235545C073
Malicious:	false
Reputation:	low
Preview:	p...... ........Y..:$...(...................................................@... .........p.........$...............h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.d.i.s.a.l.l.o.w.e.d.c.e.r.t.s.t.l...c.a.b...".7.4.6.7.8.7.a.3.f.0.d.9.1.:.0."...

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (555)
Category:	downloaded
Size (bytes):	465035
Entropy (8bit):	5.656575872518974
Encrypted:	false
SSDEEP:	6144:bN34YSBeW0yMp6+HxA/wvSPWRJ+5rPsBbwG:q4rp6gLvSMJ+NPsBbp
MD5:	FD5B7652708CA9E82DCF57085F26AF76
SHA1:	D5A7BBE20CCCBB298E1165403DF8EA3E0880AD11
SHA-256:	17F107CF638882BD8045476D2E708205561671F784F364D32CAD83B959917601
SHA-512:	0296017D2FA47DDC478D5775AC0E2C09C815ACDC11E8C1C9075A423BFD85D5D3A797A02E04EF9B1E5A4BF4657B7900C64BEB169CAF3757974277ABC07B68DE73
Malicious:	false
URL:	"https://www.gstatic.com/_/mss/boq-search/_/js/k=boq-search.VisualFrontendUi.en.3CyfeTb8xEI.es5.O/am=IBAAAAsEAAAAAAAAAAAAAAAAAAAAAPjA_g_AnhgAAuDQC_______fxQBAvtE78C-WhAgNgBCgzEGABAAAoDjQBwdQAAgAApdIAgAsNQg6G4VAIQAZMCjBBAAOgAAATSAAD0kQAAAPQAAABiAUMBAAHCNBZAEAAAAAJzmAQMCAAAAAAAAAAAAAACCKgYAAAAAAAAAAAAAgAB0Eg/d=1/excm=_b,_tp,standaloneimageview/ed=1/dg=0/wt=2/ujg=1/rs=AH7-fg78BvArsjtA_eKSx29D4kL9O0OBZA/m=_b,_tp"
Preview:	"use strict";this.default_VisualFrontendUi=this.default_VisualFrontendUi\|\|{};(function(_){var window=this;.try{._._F_toggles_initialize=function(a){("undefined"!==typeof globalThis?globalThis:"undefined"!==typeof self?self:this)._F_toggles=a\|\|[]};(0,_._F_toggles_initialize)([0x1020, 0x102c, 0x0, 0x0, 0x0, 0x20000000, 0xffec0f, 0x627b0, 0xbd0e002, 0x3ffffffc, 0x1147ffff, 0x113ec080, 0x1abec0ef, 0xd88041, 0x23183420, 0x40001, 0xe38002, 0x1007471, 0x10a00200, 0x20817, 0x2820d4b0, 0x100055bb, 0x3c064008, 0x40128, 0x100003a, 0x340200d0, 0x40243, 0xf40, 0x10801800, 0x10301, 0x90058d7, 0x1, 0x1e69c00, 0x80c, 0x0, 0x0, 0x2a820000, 0x18, 0x0, 0x0, 0x12740080, 0x0, ]);./.. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0././.. SPDX-License-Identifier: Apache-2.0././. SPDX-License-Identifier: Apache-2.0././.. SPDX-License-Identifier: MIT././. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0./.var daa,iaa,maa,raa,taa,uaa,vaa,xaa,yaa,z

File type:	Microsoft PowerPoint 2007+
Entropy (8bit):	7.912940049817828
TrID:	PowerPoint Microsoft Office Open XML Format document (133004/1) 76.66% Microsoft PowerPoint Macro-enabled Open XML add-in (32504/1) 18.73% ZIP compressed archive (8000/1) 4.61%
File name:	StepXpress - New interface - Requesting Enablement Data.pptx
File size:	1'186'556 bytes
MD5:	4cd049db018a29a4948930df13b3d9b4
SHA1:	1dbedbbdc2c03bf6fd9a1de1eab2151a0dd850b3
SHA256:	f97bb92aff65923b2a969526a54170d67cf5b90c6759876bf307c5f181d88f00
SHA512:	227b6fb2baa5d1493d93bdf67102675fa4352a7bd55d7785895be8185baee694d424aa1727bd6cae3a43d3cca61f099cfe55f6d283567d458720831d7a559ed4
SSDEEP:	24576:xmj9BFStmKnTXUhx4gNQY6Edh6OTOVtrHuJ:x+0tmKnTkhFep66uOTDuJ
TLSH:	0A45CF23C0993817C635033D39D3664174A7ABFE163FA5369F833844639DADBBBA0664
File Content Preview:	PK..........!....8n...Q.......[Content_Types].xml ...(.........................................................................................................................................................................................................

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 18, 2024 02:06:36.368211031 CEST	138	138	192.168.2.4	192.168.2.255
Apr 18, 2024 02:06:39.623759985 CEST	53	52426	1.1.1.1	192.168.2.4
Apr 18, 2024 02:06:39.737426996 CEST	53	50123	1.1.1.1	192.168.2.4
Apr 18, 2024 02:06:40.327929020 CEST	53	65449	1.1.1.1	192.168.2.4
Apr 18, 2024 02:06:41.544584036 CEST	62295	53	192.168.2.4	1.1.1.1
Apr 18, 2024 02:06:41.544750929 CEST	51815	53	192.168.2.4	1.1.1.1
Apr 18, 2024 02:06:41.556969881 CEST	64982	53	192.168.2.4	1.1.1.1
Apr 18, 2024 02:06:41.557116985 CEST	59023	53	192.168.2.4	1.1.1.1
Apr 18, 2024 02:06:41.648881912 CEST	53	62295	1.1.1.1	192.168.2.4
Apr 18, 2024 02:06:41.649223089 CEST	53	51815	1.1.1.1	192.168.2.4
Apr 18, 2024 02:06:41.661540031 CEST	53	64982	1.1.1.1	192.168.2.4
Apr 18, 2024 02:06:41.661765099 CEST	53	59023	1.1.1.1	192.168.2.4
Apr 18, 2024 02:06:42.634641886 CEST	53	61751	1.1.1.1	192.168.2.4
Apr 18, 2024 02:06:42.634835958 CEST	53	49323	1.1.1.1	192.168.2.4
Apr 18, 2024 02:06:45.107217073 CEST	52044	53	192.168.2.4	1.1.1.1
Apr 18, 2024 02:06:45.107348919 CEST	54094	53	192.168.2.4	1.1.1.1
Apr 18, 2024 02:06:45.211478949 CEST	53	54094	1.1.1.1	192.168.2.4
Apr 18, 2024 02:06:45.212042093 CEST	53	52044	1.1.1.1	192.168.2.4
Apr 18, 2024 02:06:53.957617998 CEST	53718	53	192.168.2.4	1.1.1.1
Apr 18, 2024 02:06:53.957706928 CEST	56016	53	192.168.2.4	1.1.1.1
Apr 18, 2024 02:06:54.095467091 CEST	53	53718	1.1.1.1	192.168.2.4
Apr 18, 2024 02:06:54.111593962 CEST	53	56016	1.1.1.1	192.168.2.4
Apr 18, 2024 02:06:54.969875097 CEST	61104	53	192.168.2.4	1.1.1.1
Apr 18, 2024 02:06:54.969875097 CEST	62323	53	192.168.2.4	1.1.1.1
Apr 18, 2024 02:06:55.075000048 CEST	53	61104	1.1.1.1	192.168.2.4
Apr 18, 2024 02:06:55.124720097 CEST	53	62323	1.1.1.1	192.168.2.4
Apr 18, 2024 02:06:57.296256065 CEST	53	56616	1.1.1.1	192.168.2.4
Apr 18, 2024 02:07:16.204720020 CEST	53	65269	1.1.1.1	192.168.2.4
Apr 18, 2024 02:07:39.123614073 CEST	53	55044	1.1.1.1	192.168.2.4
Apr 18, 2024 02:07:39.343585968 CEST	53	53120	1.1.1.1	192.168.2.4
Apr 18, 2024 02:08:07.592581034 CEST	53	54788	1.1.1.1	192.168.2.4
Apr 18, 2024 02:08:44.064058065 CEST	61806	53	192.168.2.4	1.1.1.1
Apr 18, 2024 02:08:44.064232111 CEST	57410	53	192.168.2.4	1.1.1.1
Apr 18, 2024 02:08:44.169056892 CEST	53	57410	1.1.1.1	192.168.2.4
Apr 18, 2024 02:08:44.169713974 CEST	53	61806	1.1.1.1	192.168.2.4
Apr 18, 2024 02:08:52.107222080 CEST	53	54123	1.1.1.1	192.168.2.4

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Apr 18, 2024 02:06:28.340526104 CEST	1.1.1.1	192.168.2.4	0x4610	No error (0)	templatesmetadata.office.net	templatesmetadata.office.net.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 02:06:41.648881912 CEST	1.1.1.1	192.168.2.4	0xa73c	No error (0)	www.google.com		108.177.122.104	A (IP address)	IN (0x0001)	false
Apr 18, 2024 02:06:41.648881912 CEST	1.1.1.1	192.168.2.4	0xa73c	No error (0)	www.google.com		108.177.122.106	A (IP address)	IN (0x0001)	false
Apr 18, 2024 02:06:41.648881912 CEST	1.1.1.1	192.168.2.4	0xa73c	No error (0)	www.google.com		108.177.122.103	A (IP address)	IN (0x0001)	false
Apr 18, 2024 02:06:41.648881912 CEST	1.1.1.1	192.168.2.4	0xa73c	No error (0)	www.google.com		108.177.122.147	A (IP address)	IN (0x0001)	false
Apr 18, 2024 02:06:41.648881912 CEST	1.1.1.1	192.168.2.4	0xa73c	No error (0)	www.google.com		108.177.122.105	A (IP address)	IN (0x0001)	false
Apr 18, 2024 02:06:41.648881912 CEST	1.1.1.1	192.168.2.4	0xa73c	No error (0)	www.google.com		108.177.122.99	A (IP address)	IN (0x0001)	false
Apr 18, 2024 02:06:41.649223089 CEST	1.1.1.1	192.168.2.4	0x7ae4	No error (0)	www.google.com			65	IN (0x0001)	false
Apr 18, 2024 02:06:41.661540031 CEST	1.1.1.1	192.168.2.4	0xab7c	No error (0)	www.google.com		108.177.122.105	A (IP address)	IN (0x0001)	false
Apr 18, 2024 02:06:41.661540031 CEST	1.1.1.1	192.168.2.4	0xab7c	No error (0)	www.google.com		108.177.122.147	A (IP address)	IN (0x0001)	false
Apr 18, 2024 02:06:41.661540031 CEST	1.1.1.1	192.168.2.4	0xab7c	No error (0)	www.google.com		108.177.122.104	A (IP address)	IN (0x0001)	false
Apr 18, 2024 02:06:41.661540031 CEST	1.1.1.1	192.168.2.4	0xab7c	No error (0)	www.google.com		108.177.122.103	A (IP address)	IN (0x0001)	false
Apr 18, 2024 02:06:41.661540031 CEST	1.1.1.1	192.168.2.4	0xab7c	No error (0)	www.google.com		108.177.122.99	A (IP address)	IN (0x0001)	false
Apr 18, 2024 02:06:41.661540031 CEST	1.1.1.1	192.168.2.4	0xab7c	No error (0)	www.google.com		108.177.122.106	A (IP address)	IN (0x0001)	false
Apr 18, 2024 02:06:41.661765099 CEST	1.1.1.1	192.168.2.4	0x980d	No error (0)	www.google.com			65	IN (0x0001)	false
Apr 18, 2024 02:06:45.211478949 CEST	1.1.1.1	192.168.2.4	0x3e08	No error (0)	www.google.com			65	IN (0x0001)	false
Apr 18, 2024 02:06:45.212042093 CEST	1.1.1.1	192.168.2.4	0x1e2b	No error (0)	www.google.com		74.125.138.105	A (IP address)	IN (0x0001)	false
Apr 18, 2024 02:06:45.212042093 CEST	1.1.1.1	192.168.2.4	0x1e2b	No error (0)	www.google.com		74.125.138.104	A (IP address)	IN (0x0001)	false
Apr 18, 2024 02:06:45.212042093 CEST	1.1.1.1	192.168.2.4	0x1e2b	No error (0)	www.google.com		74.125.138.106	A (IP address)	IN (0x0001)	false
Apr 18, 2024 02:06:45.212042093 CEST	1.1.1.1	192.168.2.4	0x1e2b	No error (0)	www.google.com		74.125.138.99	A (IP address)	IN (0x0001)	false
Apr 18, 2024 02:06:45.212042093 CEST	1.1.1.1	192.168.2.4	0x1e2b	No error (0)	www.google.com		74.125.138.103	A (IP address)	IN (0x0001)	false
Apr 18, 2024 02:06:45.212042093 CEST	1.1.1.1	192.168.2.4	0x1e2b	No error (0)	www.google.com		74.125.138.147	A (IP address)	IN (0x0001)	false
Apr 18, 2024 02:06:54.095467091 CEST	1.1.1.1	192.168.2.4	0xca4a	No error (0)	www.testedgeinc.com		64.29.151.221	A (IP address)	IN (0x0001)	false
Apr 18, 2024 02:06:55.075000048 CEST	1.1.1.1	192.168.2.4	0xfd63	No error (0)	www.testedgeinc.com		64.29.151.221	A (IP address)	IN (0x0001)	false
Apr 18, 2024 02:08:44.169056892 CEST	1.1.1.1	192.168.2.4	0x3bc1	No error (0)	www.google.com			65	IN (0x0001)	false
Apr 18, 2024 02:08:44.169713974 CEST	1.1.1.1	192.168.2.4	0xd3f0	No error (0)	www.google.com		64.233.185.104	A (IP address)	IN (0x0001)	false
Apr 18, 2024 02:08:44.169713974 CEST	1.1.1.1	192.168.2.4	0xd3f0	No error (0)	www.google.com		64.233.185.99	A (IP address)	IN (0x0001)	false
Apr 18, 2024 02:08:44.169713974 CEST	1.1.1.1	192.168.2.4	0xd3f0	No error (0)	www.google.com		64.233.185.103	A (IP address)	IN (0x0001)	false
Apr 18, 2024 02:08:44.169713974 CEST	1.1.1.1	192.168.2.4	0xd3f0	No error (0)	www.google.com		64.233.185.105	A (IP address)	IN (0x0001)	false
Apr 18, 2024 02:08:44.169713974 CEST	1.1.1.1	192.168.2.4	0xd3f0	No error (0)	www.google.com		64.233.185.106	A (IP address)	IN (0x0001)	false
Apr 18, 2024 02:08:44.169713974 CEST	1.1.1.1	192.168.2.4	0xd3f0	No error (0)	www.google.com		64.233.185.147	A (IP address)	IN (0x0001)	false

Timestamp	Bytes transferred	Direction	Data
Apr 18, 2024 02:06:54.229517937 CEST	450	OUT	GET /images/wafer.gif HTTP/1.1 Host: www.testedgeinc.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Apr 18, 2024 02:06:54.359916925 CEST	1289	IN	HTTP/1.1 200 OK Date: Thu, 18 Apr 2024 00:06:54 GMT Content-Type: image/gif Content-Length: 43186 Connection: keep-alive Last-Modified: Fri, 04 Nov 2005 18:00:51 GMT ETag: "a8b2-404c115fddac0" Expires: Thu, 31 Dec 2037 23:55:55 GMT Cache-Control: max-age=315360000 Accept-Ranges: bytes Data Raw: 47 49 46 38 39 61 22 01 1c 01 e6 00 00 72 94 4c 8b 73 2b d1 cd 70 94 8a 4d 73 69 2f ad 8f 2e 71 67 4b b3 b0 6c b3 ac 50 d1 d4 8e 6b 4f 0e b1 d0 93 a9 95 4b fe fe f7 48 35 0c ac b0 8e 68 57 2b 94 89 2f d2 aa 2e fd f7 4c 55 45 0f 87 77 4b b1 cc 6b 8c 6b 10 cc b3 4e 57 4b 28 ef d4 4e fe ff eb 90 91 69 fd fe ca d1 cb 51 c7 ba 6b e9 d9 6e fe ff da ce d4 ad c6 98 29 fd fd b9 fd f5 2f d6 ea ae b3 8a 15 fd fc a9 75 65 16 b3 ab 30 f3 d1 30 fe fc 98 95 ab 6f fe fc 88 a8 9a 66 fd fc 78 39 29 07 a6 cf 2a fb f5 0c a6 76 0f c8 97 12 d5 aa 11 93 a9 4e d9 e5 95 f4 d1 0c e7 b7 2f a5 78 2c e7 db 8c d4 f1 ca fe fd 64 c4 bc 92 83 58 0f eb ec a9 eb eb 98 92 a9 2f e8 b7 48 8d 8b 16 d1 d6 c9 d3 c9 32 af e4 cb fa eb 77 d3 e7 6f eb ed b9 c6 96 47 fb eb 61 7a ac 88 eb ec 77 eb ea 88 59 67 2c e6 b7 0d cf 76 12 ec f9 ca cd ea 4b ea ec c9 e4 db ae fa ec 88 eb e8 61 b0 aa 0f ea f8 b9 f1 f8 da e8 ea d9 f9 ee 97 85 5d 26 56 6d 14 d0 f8 ec ed ee e8 cd d0 0c 40 4e 16 89 ae 0f f1 f8 e9 eb f8 a9 ad ba ca d0 f4 34 ac 5c 0d f8 ed b9 ed f8 78 f8 ef a8 ed fc fb f7 ee c9 e3 8e 2c e5 bb 66 c9 ef 0c ed f8 87 e5 94 47 eb f9 98 e8 90 06 e1 de cf f9 ef db 71 61 a7 c6 a0 66 a2 81 be ea fb 65 f7 f5 ee 49 3e 44 ff ff ff 21 f9 04 00 00 00 00 00 2c 00 00 00 00 22 01 1c 01 00 07 ff 80 7f 82 83 84 85 86 87 88 89 8a 8b 8c 8d 8e 8f 8f 0d 90 93 94 95 96 97 98 99 9a 9b 9c 9d 9e 88 0d 0d 66 92 84 a1 9f a7 a8 a9 aa ab ac ad 86 7d 62 77 46 22 3f 0f b6 0f 2f 2f 03 15 15 06 15 22 82 7d 1c be 1c c5 b7 3f 3f 46 77 5d a4 ae ce cf d0 d1 d2 88 66 5d b3 b5 1c 03 da 03 37 37 08 df 0c 51 14 e3 19 10 e6 1c 2d 04 19 04 01 04 ea 19 14 64 19 f3 10 51 c4 0f 68 ca cc d3 fc fd fe ff 8a 1a dc 11 d1 c2 40 94 83 51 2a 00 68 d1 a2 18 00 00 15 dc 41 28 07 af 1c 19 0a 0e 1c c4 cb c8 b1 63 0c 07 31 42 7e cc 18 2f 83 81 07 3f ee f4 01 c8 b2 a5 4b 4f 7d ee 3c 28 66 00 a4 01 0e 00 0c 1a 3c 28 4f 1e bc 8b 1f e1 51 a8 a8 40 41 86 28 10 14 98 1b 4a 6e dc 45 8e 22 a3 7e 24 73 13 e5 be 97 58 b3 6a 15 24 46 c4 4c 0e 10 46 8a 34 40 16 29 04 77 04 8a 44 20 27 54 23 46 8d 6e ff c7 29 a0 50 f4 6d 47 b8 43 7d 92 d9 0b 52 aa 83 75 15 38 3c 30 b2 72 50 b3 ad 88 13 a3 12 53 ab 17 2f 5e 42 e9 52 98 58 2e 85 02 32 ee 8a 00 20 09 0f ef dd 71 1a 8b 42 00 79 77 64 c6 18 7b 8f 82 01 03 00 8c bc be a6 ff 56 78 20 42 8c e2 db b8 33 f5 31 f2 a0 82 c9 c0 c5 2a 98 4b 5a 74 2e 47 02 29 52 10 58 bd 9a 82 d4 90 76 33 46 8e f7 f6 a3 f5 d2 0e f6 6a 5f cd d7 ae df 72 1c 7e 5c cd 4d be bc a1 2e 0f 6a c6 98 5c 61 97 44 08 40 8a d7 a5 f0 a5 a8 f2 22 01 c0 58 c6 18 99 e4 c7 b7 e4 5c 04 9a 47 21 11 88 1a 5f d6 45 c5 19 68 22 0d 05 c1 00 3f d8 66 98 79 14 6e 25 c6 4c 10 d0 47 19 04 f5 c9 e7 e1 7c e3 50 90 02 05 e2 08 c8 51 5b 77 91 14 22 5c 29 b6 38 55 8b a7 89 14 5a 5d a7 91 44 40 78 5d 54 a8 a3 4b 8c f5 42 46 0c 49 45 f4 e1 90 c5 8d f3 1f 46 cf 25 e9 11 ff 54 49 fa c5 24 19 b0 35 29 23 5d 1e da 35 14 01 2f 44 b8 e3 96 d1 08 94 1e 94 e5 38 50 c1 17 5f a4 00 84 65 f1 c5 57 94 9a f2 85 38 ce 88 b1 89 a5 60 47 2b c6 06 23 54 19 41 99 60 94 0a Data Ascii: GIF89a"rLs+pMsi/.qgKlPkOKH5hW+/.LUEwKkkNWK(NiQkn)/ue00ofx9)vN/x,dX/H2woGazwYg,vKa]&Vm@N4\x,fGqafeI>D!,"f}bwF"?//"}??Fw]f]77Q-dQh@QhA(c1B~/?KO}<(f<(OQ@A(JnE"~$sXj$FLF4@)wD 'T#Fn)PmGC}Ru8<0rPS/^BRX.2 qBywd{Vx B31*KZt.G)RXv3Fj_r~\M.j\aD@"X\G!_Eh"?fyn%LG\|PQ[w"\)8UZ]D@x]TKBFIEF%TI$5)#]5/D8P_eW8`G+#TA`
Apr 18, 2024 02:06:54.359935045 CEST	171	IN	Data Raw: 52 f9 e1 80 0e 40 90 02 84 77 70 69 a8 2a 5d 19 20 54 39 1c 2a c0 e6 9a 8e 2a 60 19 a4 6a 02 21 57 51 01 4c 3a d7 5c 6e 82 06 a0 5c 9d 86 0a e8 48 2b 02 a8 62 8a 7e 6e fa 27 49 0a 60 29 42 61 87 c6 8a 49 1f 0f 64 10 15 5d 67 16 a7 29 91 ba 16 e9 Data Ascii: R@wpi] T9`j!WQL:\n\H+b~n'I`)BaId]g)V_L;1Y,iPE@?ts$7_QB[';)Fd@<1te~H !i
Apr 18, 2024 02:06:54.359946966 CEST	1289	IN	Data Raw: c9 a9 64 7d 05 3a 9b 84 7f 98 82 ed c3 82 18 01 96 46 e5 a0 35 dc ff 64 18 29 10 81 07 1e 1c d1 b1 07 32 1c 21 83 0a 18 a8 a0 c2 10 fb 61 c4 41 2f c5 0c d3 6e 2f ed c6 6c 80 bd 32 d7 6c b3 a2 7e dc dc 2e 04 37 93 ca e2 9d 75 52 8c 65 a1 10 43 2c Data Ascii: d}:F5d)2!aA/n/l2l~.7uReC,SA&DPjb/&/ko<cgR5=%\c${ZXW*QZ(\\iTOv(G&i-807sR7bO)\r"g
Apr 18, 2024 02:06:54.359958887 CEST	1289	IN	Data Raw: 59 0e 42 68 f0 5e af 1e d2 2b 5b d9 48 ff 38 8f 51 f6 e4 2f 4f 31 dd 68 f2 ea 93 d2 fd ec 2e c5 95 b2 60 81 ba 6d f6 51 69 d3 0a e0 c0 fc 3c 0d 09 23 a8 27 06 0a c8 d4 a8 53 00 66 76 a7 80 90 17 a0 c1 09 2e 40 27 3c a1 46 23 04 48 22 05 22 00 02 Data Ascii: YBh^+[H8Q/O1h.`mQi<#'Sfv.@'<F#H"",YfeZ@kzFHi!0p1mnn4mdTc@lsaiC8;e9l<F-DaV[pi?C~a7Le
Apr 18, 2024 02:06:54.476475954 CEST	1289	IN	Data Raw: 88 3d 4d 11 ff 22 dc a3 46 eb 89 53 e6 34 5c 31 12 46 76 92 22 9a 93 33 40 52 7f 31 d8 6d f8 a9 6d ef 03 12 f3 50 01 f1 e7 37 77 10 82 f0 13 4f fa c6 14 05 0a a1 04 87 26 e1 02 04 6a 40 03 67 f9 05 7a b0 72 c5 64 48 e4 c2 00 2a 90 1c 99 d5 0e cf Data Ascii: =M"FS4\1Fv"3@R1mmP7wO&j@gzrdH*X k@!k m@HlQ`U)HS1?i_tJ7 iO}%x'&`UB"Xh\0v%)rhv&o`+8RD@$ A0g\$ <Wp
Apr 18, 2024 02:06:54.476495028 CEST	513	IN	Data Raw: 1e b0 0b 14 30 40 75 f9 c1 81 31 87 47 11 7e f0 82 93 df 17 2f d2 53 0f f5 78 79 c1 a3 0e f0 24 a0 60 23 94 01 26 57 d2 76 74 9d 51 3a fd 55 74 fd a5 8f 73 ec 3e 3f 46 c7 10 29 95 b7 02 d2 f1 91 1c 4e 4a 21 06 85 11 97 27 80 75 c1 b7 74 51 72 ec Data Ascii: 0@u1G~/Sxy$`#&WvtQ:Uts>?F)NJ!'utQrV{E8z`//`Oaqopz)0P-caW+dq_0exy13l3nQ#j%$&v@+* Qwn%*zzp\|{]X&\|W A(
Apr 18, 2024 02:06:54.476505995 CEST	1289	IN	Data Raw: fd 78 ed 22 c1 8e 77 df 5d 23 ee e2 3e 79 de 67 7d fd bd 86 b8 37 c1 bd fd 2e 74 45 8b a2 5e 1c f1 21 22 5f d0 69 89 f1 03 d1 e2 0e 86 f6 72 ce a2 49 4b 18 e2 22 be ed 5d f8 02 3f fc 02 bc 8e 01 18 10 89 98 48 8e 8f b7 0b 06 d0 ca ce f7 01 58 f0 Data Ascii: x"w]#>yg}7.tE^!"_irIK"]?HX yy8huytK1:QmsBQ~]3?d(<?Z%ah)e'BHaPH1}px0s6t&jF%)x
Apr 18, 2024 02:06:54.476519108 CEST	1289	IN	Data Raw: 89 5b de 79 b3 c4 3b 90 9f 02 ca c6 ef da f3 24 18 43 06 c6 2a 30 f0 14 8c fe 73 81 02 01 7e 16 95 c2 23 1b 00 80 01 80 57 d0 61 87 15 6d 16 81 29 7a bc 50 00 0f 08 7c 74 2a 11 1c 8f 40 b8 20 29 44 71 48 00 3f 20 00 45 07 4f a8 dc 72 ae 2f 67 c1 Data Ascii: [y;$C0s~#Wam)zP\|t@ )DqH? EOr/gD+Dt[d*p"Lt)Q0t{+N2C6t&\|imN]}&eel-4\`Yj?:DAh^PdIhn,4W,@I9DR@
Apr 18, 2024 02:06:54.476530075 CEST	1289	IN	Data Raw: 55 50 9c d4 5d b2 8a c6 33 5e 14 8e db ee e3 bc 68 4b 74 b9 da f1 b2 42 e0 0b d7 e3 e8 d9 d4 21 59 11 7d 74 d7 f2 b8 03 8a c9 70 46 93 c6 ed 69 5f e8 4c 67 0c 6e f0 27 9d f1 8c 7b f1 05 07 54 a2 12 43 18 42 10 0c 20 6a 4b 8c ae 87 2f 84 16 03 71 Data Ascii: UP]3^hKtB!Y}tpFi_Lgn'{TCB jK/qUo\|@m !xTw,lO \-HF3xS\|< ssdc> <QX'Kg/X
Apr 18, 2024 02:06:54.476541042 CEST	1289	IN	Data Raw: 22 17 bc d0 0f ac f0 2d f9 b1 52 00 a3 0c 45 39 9c 6a 82 64 24 8a 0c 50 43 95 cc 87 17 66 82 10 b3 f0 18 a0 57 4c 76 20 05 2f 0a 82 4e c6 4b 51 86 15 19 75 94 f5 47 0d 79 80 5e d6 52 14 12 17 93 73 49 19 aa 59 0a c8 c8 3a 84 23 54 0c 10 07 34 a0 Data Ascii: "-RE9jd$PCfWLv /NKQuGy^RsIY:#T4*pLtygZ$u0P08mj6p4r)P/ou%BPPK-42#UPkEB\/W@Rc.H3LRK.zXv0SHcV3c S2M
Apr 18, 2024 02:06:54.592855930 CEST	1289	IN	Data Raw: c3 a7 d8 02 3c e2 41 1e c5 b0 0a c2 51 17 b5 59 0c df 92 50 da 91 9b fe da 1e a9 70 27 b4 47 cb c4 60 70 78 83 0e 21 fd 79 b9 6c 3e 27 20 d9 26 85 2f 2f b0 36 87 72 7f 42 5c de 08 a1 a1 75 61 1d 83 ab 06 a3 2d b5 c9 c2 a7 98 35 46 8d 57 01 d1 04 Data Ascii: <AQYPp'G`px!yl>' &//6rB\ua-5FW5ZPN Vu+TC@$8pl YPk3BcU%AX{f`\|IH6_C%$a']Y$5`R4Dee<da;\!!d#[p
Apr 18, 2024 02:06:54.844944000 CEST	398	OUT	GET /favicon.ico HTTP/1.1 Host: www.testedgeinc.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Referer: http://www.testedgeinc.com/images/wafer.gif Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Apr 18, 2024 02:06:54.964075089 CEST	1289	IN	HTTP/1.1 200 OK Date: Thu, 18 Apr 2024 00:06:54 GMT Content-Type: image/vnd.microsoft.icon Content-Length: 2550 Connection: keep-alive Last-Modified: Tue, 08 Nov 2005 16:12:45 GMT ETag: "9f6-405100ac2d940" Expires: Thu, 31 Dec 2037 23:55:55 GMT Cache-Control: max-age=315360000 Accept-Ranges: bytes Data Raw: 00 00 01 00 02 00 10 10 00 00 01 00 08 00 68 05 00 00 26 00 00 00 10 10 00 00 01 00 20 00 68 04 00 00 8e 05 00 00 28 00 00 00 10 00 00 00 20 00 00 00 01 00 08 00 00 00 00 00 40 01 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 ff ff ff 00 09 03 b4 00 93 00 d6 00 ff ec cc 00 c6 d6 ef 00 d6 e7 e7 00 90 a9 ad 00 00 ff 33 00 00 00 66 00 00 00 99 00 00 00 cc 00 00 33 00 00 00 33 33 00 00 33 66 00 00 33 99 00 00 33 cc 00 00 33 ff 00 00 66 00 00 00 66 33 00 00 66 66 00 00 66 99 00 00 66 cc 00 00 66 ff 00 00 99 00 00 00 99 33 00 00 99 66 00 00 99 99 00 00 99 cc 00 00 99 ff 00 00 cc 00 00 00 cc 33 00 00 cc 66 00 00 cc 99 00 00 cc cc 00 00 cc ff 00 00 ff 66 00 00 ff 99 00 00 ff cc 00 33 ff 00 00 ff 00 33 00 33 00 66 00 33 00 99 00 33 00 cc 00 33 00 ff 00 ff 33 00 00 33 33 33 00 33 33 66 00 33 33 99 00 33 33 cc 00 33 33 ff 00 33 66 00 00 33 66 33 00 33 66 66 00 33 66 99 00 33 66 cc 00 33 66 ff 00 33 99 00 00 33 99 33 00 33 99 66 00 33 99 99 00 33 99 cc 00 33 99 ff 00 33 cc 00 00 33 cc 33 00 33 cc 66 00 33 cc 99 00 33 cc cc 00 33 cc ff 00 33 ff 33 00 33 ff 66 00 33 ff 99 00 33 ff cc 00 33 ff ff 00 66 00 00 00 66 00 33 00 66 00 66 00 66 00 99 00 66 00 cc 00 66 00 ff 00 66 33 00 00 66 33 33 00 66 33 66 00 66 33 99 00 66 33 cc 00 66 33 ff 00 66 66 00 00 66 66 33 00 66 66 66 00 66 66 99 00 66 66 cc 00 66 99 00 00 66 99 33 00 66 99 66 00 66 99 99 00 66 99 cc 00 66 99 ff 00 66 cc 00 00 66 cc 33 00 66 cc 99 00 66 cc cc 00 66 cc ff 00 66 ff 00 00 66 ff 33 00 66 ff 99 00 66 ff cc 00 cc 00 ff 00 ff 00 cc 00 99 99 00 00 99 33 99 00 99 00 99 00 99 00 cc 00 99 00 00 00 99 33 33 00 99 00 66 00 99 33 cc 00 99 00 ff 00 99 66 00 00 99 66 33 00 99 33 66 00 99 66 99 00 99 66 cc 00 99 33 ff 00 99 99 33 00 99 99 66 00 99 99 99 00 99 99 cc 00 99 99 ff 00 99 cc 00 00 99 cc 33 00 66 cc 66 00 99 cc 99 00 99 cc cc 00 99 cc ff 00 99 ff 00 00 99 ff 33 00 99 cc 66 00 99 ff 99 00 99 ff cc 00 99 ff ff 00 cc 00 00 00 99 00 33 00 cc 00 66 00 cc 00 99 00 cc 00 cc 00 99 33 00 00 cc 33 33 00 cc 33 66 00 cc 33 99 00 cc 33 cc 00 cc 33 ff 00 cc 66 00 00 cc 66 33 00 99 66 66 00 cc 66 99 00 cc 66 cc 00 99 66 ff 00 cc 99 00 00 cc 99 33 00 cc 99 66 00 cc 99 99 00 cc 99 cc 00 cc 99 ff 00 cc cc 00 00 cc cc 33 00 cc cc 66 00 cc cc 99 00 cc cc cc 00 cc cc ff 00 cc ff 00 00 cc ff 33 00 99 ff 66 00 cc ff 99 00 cc ff cc 00 cc ff ff 00 cc 00 33 00 ff 00 66 00 ff 00 99 00 cc 33 00 00 ff 33 33 00 ff 33 66 00 ff 33 99 00 ff 33 cc 00 ff 33 ff 00 ff 66 00 00 ff 66 33 00 cc 66 66 00 ff 66 99 00 ff 66 cc 00 cc 66 ff 00 ff 99 00 00 ff 99 33 00 ff 99 66 00 ff 99 99 00 ff 99 cc 00 ff 99 ff 00 ff cc 00 00 ff cc 33 00 ff cc 66 00 ff cc 99 00 ff cc cc 00 ff cc ff 00 ff ff 33 00 cc ff 66 00 ff ff 99 00 ff ff cc 00 66 66 ff 00 66 ff 66 00 66 ff ff 00 ff 66 66 00 ff 66 ff 00 ff ff 66 00 21 00 a5 00 5f 5f 5f 00 77 77 77 00 86 86 86 00 96 96 96 00 cb cb cb 00 b2 b2 b2 00 d7 d7 d7 00 dd dd dd 00 e3 e3 e3 00 ea ea ea 00 f1 f1 f1 00 f8 f8 f8 00 Data Ascii: h& h( @3f3333f333ff3fffff3f3ff333f333333333f3333333f3f33ff3f3f3f3333f3333333f333333f333ff3ffffff3f33f3ff3f3f3ffff3fffffffff3fffffff3fffff3ff333f3ff33fff33f3ff3f3f3333f333ff3fffff3f3f3f3f3333f333ff3fffff3f3f3ffffffffff!___www

Timestamp	Bytes transferred	Direction	Data
Apr 18, 2024 02:06:55.219316959 CEST	283	OUT	GET /favicon.ico HTTP/1.1 Host: www.testedgeinc.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Apr 18, 2024 02:06:55.339417934 CEST	1289	IN	HTTP/1.1 200 OK Date: Thu, 18 Apr 2024 00:06:55 GMT Content-Type: image/vnd.microsoft.icon Content-Length: 2550 Connection: keep-alive Last-Modified: Tue, 08 Nov 2005 16:12:45 GMT ETag: "9f6-405100ac2d940" Expires: Thu, 31 Dec 2037 23:55:55 GMT Cache-Control: max-age=315360000 Accept-Ranges: bytes Data Raw: 00 00 01 00 02 00 10 10 00 00 01 00 08 00 68 05 00 00 26 00 00 00 10 10 00 00 01 00 20 00 68 04 00 00 8e 05 00 00 28 00 00 00 10 00 00 00 20 00 00 00 01 00 08 00 00 00 00 00 40 01 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 ff ff ff 00 09 03 b4 00 93 00 d6 00 ff ec cc 00 c6 d6 ef 00 d6 e7 e7 00 90 a9 ad 00 00 ff 33 00 00 00 66 00 00 00 99 00 00 00 cc 00 00 33 00 00 00 33 33 00 00 33 66 00 00 33 99 00 00 33 cc 00 00 33 ff 00 00 66 00 00 00 66 33 00 00 66 66 00 00 66 99 00 00 66 cc 00 00 66 ff 00 00 99 00 00 00 99 33 00 00 99 66 00 00 99 99 00 00 99 cc 00 00 99 ff 00 00 cc 00 00 00 cc 33 00 00 cc 66 00 00 cc 99 00 00 cc cc 00 00 cc ff 00 00 ff 66 00 00 ff 99 00 00 ff cc 00 33 ff 00 00 ff 00 33 00 33 00 66 00 33 00 99 00 33 00 cc 00 33 00 ff 00 ff 33 00 00 33 33 33 00 33 33 66 00 33 33 99 00 33 33 cc 00 33 33 ff 00 33 66 00 00 33 66 33 00 33 66 66 00 33 66 99 00 33 66 cc 00 33 66 ff 00 33 99 00 00 33 99 33 00 33 99 66 00 33 99 99 00 33 99 cc 00 33 99 ff 00 33 cc 00 00 33 cc 33 00 33 cc 66 00 33 cc 99 00 33 cc cc 00 33 cc ff 00 33 ff 33 00 33 ff 66 00 33 ff 99 00 33 ff cc 00 33 ff ff 00 66 00 00 00 66 00 33 00 66 00 66 00 66 00 99 00 66 00 cc 00 66 00 ff 00 66 33 00 00 66 33 33 00 66 33 66 00 66 33 99 00 66 33 cc 00 66 33 ff 00 66 66 00 00 66 66 33 00 66 66 66 00 66 66 99 00 66 66 cc 00 66 99 00 00 66 99 33 00 66 99 66 00 66 99 99 00 66 99 cc 00 66 99 ff 00 66 cc 00 00 66 cc 33 00 66 cc 99 00 66 cc cc 00 66 cc ff 00 66 ff 00 00 66 ff 33 00 66 ff 99 00 66 ff cc 00 cc 00 ff 00 ff 00 cc 00 99 99 00 00 99 33 99 00 99 00 99 00 99 00 cc 00 99 00 00 00 99 33 33 00 99 00 66 00 99 33 cc 00 99 00 ff 00 99 66 00 00 99 66 33 00 99 33 66 00 99 66 99 00 99 66 cc 00 99 33 ff 00 99 99 33 00 99 99 66 00 99 99 99 00 99 99 cc 00 99 99 ff 00 99 cc 00 00 99 cc 33 00 66 cc 66 00 99 cc 99 00 99 cc cc 00 99 cc ff 00 99 ff 00 00 99 ff 33 00 99 cc 66 00 99 ff 99 00 99 ff cc 00 99 ff ff 00 cc 00 00 00 99 00 33 00 cc 00 66 00 cc 00 99 00 cc 00 cc 00 99 33 00 00 cc 33 33 00 cc 33 66 00 cc 33 99 00 cc 33 cc 00 cc 33 ff 00 cc 66 00 00 cc 66 33 00 99 66 66 00 cc 66 99 00 cc 66 cc 00 99 66 ff 00 cc 99 00 00 cc 99 33 00 cc 99 66 00 cc 99 99 00 cc 99 cc 00 cc 99 ff 00 cc cc 00 00 cc cc 33 00 cc cc 66 00 cc cc 99 00 cc cc cc 00 cc cc ff 00 cc ff 00 00 cc ff 33 00 99 ff 66 00 cc ff 99 00 cc ff cc 00 cc ff ff 00 cc 00 33 00 ff 00 66 00 ff 00 99 00 cc 33 00 00 ff 33 33 00 ff 33 66 00 ff 33 99 00 ff 33 cc 00 ff 33 ff 00 ff 66 00 00 ff 66 33 00 cc 66 66 00 ff 66 99 00 ff 66 cc 00 cc 66 ff 00 ff 99 00 00 ff 99 33 00 ff 99 66 00 ff 99 99 00 ff 99 cc 00 ff 99 ff 00 ff cc 00 00 ff cc 33 00 ff cc 66 00 ff cc 99 00 ff cc cc 00 ff cc ff 00 ff ff 33 00 cc ff 66 00 ff ff 99 00 ff ff cc 00 66 66 ff 00 66 ff 66 00 66 ff ff 00 ff 66 66 00 ff 66 ff 00 ff ff 66 00 21 00 a5 00 5f 5f 5f 00 77 77 77 00 86 86 86 00 96 96 96 00 cb cb cb 00 b2 b2 b2 00 d7 d7 d7 00 dd dd dd 00 e3 e3 e3 00 ea ea ea 00 f1 f1 f1 00 f8 f8 f8 00 Data Ascii: h& h( @3f3333f333ff3fffff3f3ff333f333333333f3333333f3f33ff3f3f3f3333f3333333f333333f333ff3ffffff3f33f3ff3f3f3ffff3fffffffff3fffffff3fffff3ff333f3ff33fff33f3ff3f3f3333f333ff3fffff3f3f3f3f3333f333ff3fffff3f3f3ffffffffff!___www
Apr 18, 2024 02:06:55.339435101 CEST	171	IN	Data Raw: f0 fb ff 00 a4 a0 a0 00 80 80 80 00 00 00 ff 00 00 ff 00 00 00 ff ff 00 ff 00 00 00 ff 00 ff 00 ff ff 00 00 ff ff ff 00 00 00 00 00 78 34 60 00 d8 6f 45 00 a4 29 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: x4`oE)
Apr 18, 2024 02:06:55.339446068 CEST	1289	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 02 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 02 02 02 02 00 00 00 00 00 00 00 00 00 00 00 00 02 02 02 02 02 00 00 00 00 00 00 02 02 00 00 00 02 02 02 00 00 00 00 00 00 00 00 02 02 00 00 00 02 02 00 00 00 00 00 00 Data Ascii:
Apr 18, 2024 02:06:55.339456081 CEST	112	IN	Data Raw: 09 03 b4 ff 09 03 b4 ff 09 03 b4 ff 09 03 b4 ff 09 03 b4 ff 09 03 b4 ff 09 03 b4 61 09 03 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff 83 00 00 ff 81 00 00 ff 81 00 00 ff 9f 00 00 ff 87 00 00 ff 83 00 00 f3 8f 00 00 f3 9f 00 00 f3 83 Data Ascii: a?

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report StepXpress - New interface - Requesting Enablement Data.pptx

Overview

General Information

Detection

Signatures

Classification

Analysis Advice

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

Phishing

Compliance

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157

C:\Users\user\AppData\Local\Microsoft\FontCache\4\Catalog\ListAll.Json

C:\Users\user\AppData\Local\Microsoft\FontCache\4\PreviewFont\flat_officeFontsPreview_4_39.ttf

C:\Users\user\AppData\Local\Microsoft\Office\16.0\UsageMetricsStore\FileActivityStore\PowerPoint\1380790193167760279.C4

C:\Users\user\AppData\Local\Microsoft\Office\16.0\UsageMetricsStore\FileActivityStore\PowerPoint\ASkwMDAwMDAwMC0wMDAwLTAwMDAtMDAwMC0wMDAwMDAwMDAwMDBfTnVsbAA.S

C:\Users\user\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\E782ACB3-D4FC-4778-B25D-58DB141EDE32

C:\Users\user\AppData\Local\Microsoft\Office\OTele\powerpnt.exe.db

C:\Users\user\AppData\Local\Microsoft\Office\OTele\powerpnt.exe.db-journal

C:\Users\user\AppData\Local\Microsoft\Office\OTele\powerpnt.exe.db-shm

C:\Users\user\AppData\Local\Microsoft\Office\OTele\powerpnt.exe.db-wal

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\089d66ba04a8cec4bdc5267f42f39cf84278bb67.tbres

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\56a61aeb75d8f5be186c26607f4bb213abe7c5ec.tbres

C:\Users\user\AppData\Local\Microsoft\Windows\2057\StructuredQuerySchema.bin

C:\Users\user\AppData\Local\Temp\Diagnostics\POWERPNT\App1713398771441735400_9DBF3E90-693A-4937-A5F4-0C6D75B5D083.log

C:\Users\user\AppData\Local\Temp\Diagnostics\POWERPNT\App1713398771442427300_9DBF3E90-693A-4937-A5F4-0C6D75B5D083.log

C:\Users\user\AppData\Local\Temp\TCDC557.tmp\Content.inf

C:\Users\user\AppData\Local\Temp\TCDC557.tmp\chevronaccent.glox

C:\Users\user\AppData\Local\Temp\TCDC567.tmp\Content.inf

C:\Users\user\AppData\Local\Temp\TCDC567.tmp\pictureorgchart.glox

C:\Users\user\AppData\Local\Temp\TCDC568.tmp\Content.inf

C:\Users\user\AppData\Local\Temp\TCDC568.tmp\rings.glox

C:\Users\user\AppData\Local\Temp\TCDC57A.tmp\BracketList.glox

C:\Users\user\AppData\Local\Temp\TCDC57A.tmp\Content.inf

C:\Users\user\AppData\Local\Temp\TCDC57E.tmp\Content.inf

Windows Analysis Report
StepXpress - New interface - Requesting Enablement Data.pptx

Timestamp	Bytes transferred	Direction	Data
2024-04-18 00:06:16 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-04-18 00:06:16 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-04-18 00:06:17 UTC	568	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Thu, 18 Apr 2024 00:05:17 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C533_SN1 x-ms-request-id: f9ec9cba-b3ee-476d-8508-698e6d01cc92 PPServer: PPV: 30 H: SN1PEPF0002FAA7 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Thu, 18 Apr 2024 00:06:16 GMT Connection: close Content-Length: 1276
2024-04-18 00:06:17 UTC	1276	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Timestamp	Bytes transferred	Direction	Data
2024-04-18 00:06:17 UTC	446	OUT	POST /ppsecure/deviceaddcredential.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 7642 Host: login.live.com
2024-04-18 00:06:17 UTC	7642	OUT	Data Raw: 3c 44 65 76 69 63 65 41 64 64 52 65 71 75 65 73 74 3e 3c 43 6c 69 65 6e 74 49 6e 66 6f 20 6e 61 6d 65 3d 22 49 44 43 52 4c 22 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 3e 3c 42 69 6e 61 72 79 56 65 72 73 69 6f 6e 3e 32 34 3c 2f 42 69 6e 61 72 79 56 65 72 73 69 6f 6e 3e 3c 2f 43 6c 69 65 6e 74 49 6e 66 6f 3e 3c 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 3e 3c 4d 65 6d 62 65 72 6e 61 6d 65 3e 30 32 79 71 68 75 71 66 7a 61 65 61 61 6a 6a 78 3c 2f 4d 65 6d 62 65 72 6e 61 6d 65 3e 3c 50 61 73 73 77 6f 72 64 3e 6b 38 4a 69 53 5f 2c 71 64 79 3a 67 70 51 55 63 41 71 72 75 3c 2f 50 61 73 73 77 6f 72 64 3e 3c 2f 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 3e 3c 4f 6c 64 4d 65 6d 62 65 72 6e 61 6d 65 3e 30 32 61 6b 71 72 6c 66 67 75 6b 69 6a 65 76 6c 3c 2f 4f 6c 64 4d Data Ascii: <DeviceAddRequest><ClientInfo name="IDCRL" version="1.0"><BinaryVersion>24</BinaryVersion></ClientInfo><Authentication><Membername>02yqhuqfzaeaajjx</Membername><Password>k8JiS_,qdy:gpQUcAqru</Password></Authentication><OldMembername>02akqrlfgukijevl</OldM
2024-04-18 00:06:19 UTC	542	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: text/xml Expires: Thu, 18 Apr 2024 00:05:17 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C528_SN1 x-ms-request-id: 536b515b-acbc-4496-80bd-ccb3b37de6f1 PPServer: PPV: 30 H: SN1PEPF0002F0F5 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Thu, 18 Apr 2024 00:06:18 GMT Connection: close Content-Length: 17166
2024-04-18 00:06:19 UTC	15842	IN	Data Raw: 3c 44 65 76 69 63 65 41 64 64 52 65 73 70 6f 6e 73 65 20 53 75 63 63 65 73 73 3d 22 74 72 75 65 22 3e 3c 73 75 63 63 65 73 73 3e 74 72 75 65 3c 2f 73 75 63 63 65 73 73 3e 3c 70 75 69 64 3e 30 30 31 38 43 30 30 44 41 35 34 39 43 39 43 44 3c 2f 70 75 69 64 3e 3c 44 65 76 69 63 65 54 70 6d 4b 65 79 53 74 61 74 65 3e 33 3c 2f 44 65 76 69 63 65 54 70 6d 4b 65 79 53 74 61 74 65 3e 3c 4c 69 63 65 6e 73 65 20 43 6f 6e 74 65 6e 74 49 44 3d 22 33 32 35 32 62 32 30 63 2d 64 34 32 35 2d 34 37 31 31 2d 38 63 63 35 2d 62 32 66 35 33 63 38 33 30 62 37 36 22 20 49 44 3d 22 32 30 35 66 35 64 64 64 2d 34 33 31 34 2d 34 33 31 30 2d 61 62 32 37 2d 34 35 36 64 39 33 62 34 64 32 62 63 22 20 4c 69 63 65 6e 73 65 49 44 3d 22 33 32 35 32 62 32 30 63 2d 64 34 32 35 2d 34 37 31 31 Data Ascii: <DeviceAddResponse Success="true"><success>true</success><puid>0018C00DA549C9CD</puid><DeviceTpmKeyState>3</DeviceTpmKeyState><License ContentID="3252b20c-d425-4711-8cc5-b2f53c830b76" ID="205f5ddd-4314-4310-ab27-456d93b4d2bc" LicenseID="3252b20c-d425-4711
2024-04-18 00:06:19 UTC	1324	IN	Data Raw: 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 30 39 2f 78 6d 6c 64 73 69 67 23 65 6e 76 65 6c 6f 70 65 64 2d 73 69 67 6e 61 74 75 72 65 22 2f 3e 3c 2f 54 72 61 6e 73 66 6f 72 6d 73 3e 3c 44 69 67 65 73 74 4d 65 74 68 6f 64 20 41 6c 67 6f 72 69 74 68 6d 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 30 34 2f 78 6d 6c 65 6e 63 23 73 68 61 32 35 36 22 2f 3e 3c 44 69 67 65 73 74 56 61 6c 75 65 3e 67 74 71 77 70 52 35 66 47 44 61 6f 48 73 4d 37 49 57 47 4b 5a 67 61 77 58 61 30 42 50 69 47 61 65 35 62 49 75 6e 2f 52 51 4a 41 3d 3c 2f 44 69 67 65 73 74 56 61 6c 75 65 3e 3c 2f 52 65 66 65 72 65 6e 63 65 3e 3c 2f 53 69 67 6e 65 64 49 6e 66 6f 3e 3c 53 69 67 6e 61 74 75 72 65 56 61 6c 75 65 3e 41 46 38 6f 46 52 2b 47 66 Data Ascii: tp://www.w3.org/2000/09/xmldsig#enveloped-signature"/></Transforms><DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/><DigestValue>gtqwpR5fGDaoHsM7IWGKZgawXa0BPiGae5bIun/RQJA=</DigestValue></Reference></SignedInfo><SignatureValue>AF8oFR+Gf

Timestamp	Bytes transferred	Direction	Data
2024-04-18 00:06:20 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4775 Host: login.live.com
2024-04-18 00:06:20 UTC	4775	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-04-18 00:06:21 UTC	568	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Thu, 18 Apr 2024 00:05:21 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C533_SN1 x-ms-request-id: 2e873cfa-fd3a-4f69-8039-99a07edd02a0 PPServer: PPV: 30 H: SN1PEPF0002F900 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Thu, 18 Apr 2024 00:06:20 GMT Connection: close Content-Length: 1918
2024-04-18 00:06:21 UTC	1918	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Timestamp	Bytes transferred	Direction	Data
2024-04-18 00:06:22 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4775 Host: login.live.com
2024-04-18 00:06:22 UTC	4775	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-04-18 00:06:22 UTC	653	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Thu, 18 Apr 2024 00:05:22 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" FdrTelemetry: &481=21&59=33&213=10&215=0&315=1&215=0&315=1&214=56&288=16.0.30171.7 Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C517_SN1 x-ms-request-id: 6d41fa7d-1e71-4fe4-9007-44341fd593f5 PPServer: PPV: 30 H: SN1PEPF0002F0F5 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Thu, 18 Apr 2024 00:06:22 GMT Connection: close Content-Length: 11390
2024-04-18 00:06:22 UTC	11390	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Timestamp	Bytes transferred	Direction	Data
2024-04-18 00:06:23 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4742 Host: login.live.com
2024-04-18 00:06:23 UTC	4742	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-04-18 00:06:23 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Thu, 18 Apr 2024 00:05:23 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C517_SN1 x-ms-request-id: c8e4cf25-a6b9-4f77-8efd-0b31d402bd30 PPServer: PPV: 30 H: SN1PEPF0002F0F3 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Thu, 18 Apr 2024 00:06:22 GMT Connection: close Content-Length: 10197
2024-04-18 00:06:23 UTC	10197	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Timestamp	Bytes transferred	Direction	Data
2024-04-18 00:06:32 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=XpBNggYG9gZRtcY&MD=Z8lc1aDv HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-04-18 00:06:33 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: c27a7cf3-e1da-42b5-b0a9-4f0b0921338a MS-RequestId: 32308773-98c2-48f8-abca-523120fba6ae MS-CV: UnGNgfJToEm5/bL4.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Thu, 18 Apr 2024 00:06:32 GMT Connection: close Content-Length: 24490
2024-04-18 00:06:33 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-04-18 00:06:33 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Timestamp	Bytes transferred	Direction	Data
2024-04-18 00:06:41 UTC	968	OUT	GET /imgres?imgurl=http://www.testedgeinc.com/images/wafer.gif&imgrefurl=http://www.testedgeinc.com/wafersort.html&usg=__-3Z4I2oN99yJOMvLJcc5ES309Nk=&h=284&w=290&sz=43&hl=en&start=53&zoom=1&tbnid=s24hxS3vSW33KM:&tbnh=113&tbnw=115&ei=FOc7T96UKM6bOpD0lN8C&prev=/search?q=wafer&start=42&hl=en&sa=N&gbv=2&tbm=isch&itbs=1 HTTP/1.1 Host: www.google.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-18 00:06:42 UTC	3235	IN	HTTP/1.1 200 OK Content-Type: text/html; charset=utf-8 x-ua-compatible: IE=edge Expires: Thu, 18 Apr 2024 00:06:42 GMT Date: Thu, 18 Apr 2024 00:06:42 GMT Cache-Control: private, max-age=0 P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Cross-Origin-Opener-Policy: unsafe-none Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factor=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: script-src 'report-sample' 'nonce-YKGCBD3EWDocESymjYDGgQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/VisualFrontendUi/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com https://graphviz.corp.google.com https://static.corp.google.com https://cse.google.com https://cdn.ampproject.org https://maps.google.com https://maps.googleapis.com https://pagead2.googlesyndication.com https://www.youtube.com https://translate.google.com https://translate.googleapis.com https://translate.google.cn https://ajax.googleapis.com https://www.googletagservices.com https://ssl.google-analytics.com https://www.googleapis.com/appsmarket/v2/installedApps/;report-uri /_/VisualFrontendUi/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/VisualFrontendUi/cspreport reporting-endpoints: default="/_/VisualFrontendUi/web-reports?context=eJwNzmlIVHEUBfB_r_OkMlRc0xTakBQic2IMCVrHLEbn3fvECiqzaC8RbSppF6wIq0kERVokK4wwMxXb1Aoti2oKWtBMjNSczDa1veh--MH5cDnnjjrhFT0qTNknh6kP08OUb_hYtcEaqYLiIlXEDovqiLGp1tk25fpkU3fLEpRzMEHlhy5Q6TMTVcqeRPXwyiIVG2JXaVF2tS_eroJn2dXriMJhR5sfaQfC27SA7DataWubFj2jXfvn6tKeLuvWYj3dWkFuj-b-1KuNGfJo0SJpYzI2v09GzYdktJc68KPdgV8i_Z0Dp3sd6B904M03B86ONlARbKAm1EBngoGhbQaydhn4W2tANRuY-8rAYm-Cvx-hQdgDJIcTcqYRdopAC6EriZC3lDBlDeHwBkK-CMwgXMomnMohdIrM_YS0Y4SVovG43JYQzonAM4SSSsLJasLnJsJX4fOYkOQmOES5GHhOuPiCcKud8EV4vybUegh14nIfwWuQMPU7wfWTsOY3IfovwSqORDLuRDGeiJdWhkdMnM0w1zIWi-UiXQyuZ2RsZGSJik2M_C2MnAxGYSbjipNh2c6YLlaJo-KY8Ijzuxjl4vNuxoDozGVsOcjwO8RoKmWkljGWiIIqRlA1I1iEiDAxTowXE8Qk8aCWUV_HeHtT-u7Jxn2GS8Q-Yfg8ZcwT3a0M3w6G_Q1jSo_8I66J66JkgOEcYtAfhnW4iTiROdKEzddEX4iJxlAT_VYTH0VlvIkqUSvqxA3RIBrFd1E_y8Rt0SQC55gIFuPnm8gSxxNNpD4r0i0xxfrcdcV6irDvLdZXiIGrxXpe62O9SLQEuPU58W79wh63XvfDra_-59adwt97REHL_iovv87-_oX_AQ1qIIU" Server: ESF X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Set-Cookie: NID=513=YnUuQrDaoaBEUA2bXiLdH2dYj28flSXSLiFewk1TkOsrmjPhuWebS5mOXWKacdDYybT6CWMI9gjteSTwR3vl3vPUiJA9QF0uYP6UtuzJ6_7_w70fpCKLgEjdIvtnImm9wI0v1wMmmE2-0_lNbQfFjrA3pgJ078lxpT5DkE0aUIU; expires=Fri, 18-Oct-2024 00:06:42 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-04-18 00:06:42 UTC	3235	IN	Data Raw: 38 30 30 30 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 22 6c 74 72 22 3e 3c 68 65 61 64 3e 3c 62 61 73 65 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 65 66 65 72 72 65 72 22 20 63 6f 6e 74 65 6e 74 3d 22 6f 72 69 67 69 6e 22 3e 3c 73 63 72 69 70 74 20 64 61 74 61 2d 69 64 3d 22 5f 67 64 22 20 6e 6f 6e 63 65 3d 22 59 4b 47 43 42 44 33 45 57 44 6f 63 45 53 79 6d 6a 59 44 47 67 51 22 3e 77 69 6e 64 6f 77 2e 57 49 5a 5f 67 6c 6f 62 61 6c 5f 64 61 74 61 20 3d 20 7b 22 41 4c 67 6e 78 65 22 3a 5b 37 32 35 34 35 36 35 33 2c 37 32 35 31 36 33 32 30 2c 37 32 35 35 32 32 36 31 2c 37 32 35 34 31 37 39 34 2c 34 Data Ascii: 8000<!doctype html><html lang="en" dir="ltr"><head><base href="https://www.google.com/"><meta name="referrer" content="origin"><script data-id="_gd" nonce="YKGCBD3EWDocESymjYDGgQ">window.WIZ_global_data = {"ALgnxe":[72545653,72516320,72552261,72541794,4
2024-04-18 00:06:42 UTC	3235	IN	Data Raw: 2f 41 4c 4c 5f 61 74 2f 72 65 74 61 69 6c 22 2c 22 2f 69 6e 74 6c 2f 41 4c 4c 5f 61 74 2f 72 65 74 61 69 6c 2f 2a 22 2c 22 2f 69 6e 74 6c 2f 41 4c 4c 5f 61 75 2f 62 75 73 69 6e 65 73 73 22 2c 22 2f 69 6e 74 6c 2f 41 4c 4c 5f 61 75 2f 62 75 73 69 6e 65 73 73 2f 2a 22 2c 22 2f 69 6e 74 6c 2f 41 4c 4c 5f 61 75 2f 72 65 74 61 69 6c 22 2c 22 2f 69 6e 74 6c 2f 41 4c 4c 5f 61 75 2f 72 65 74 61 69 6c 2f 2a 22 2c 22 2f 69 6e 74 6c 2f 41 4c 4c 5f 62 65 2f 62 75 73 69 6e 65 73 73 22 2c 22 2f 69 6e 74 6c 2f 41 4c 4c 5f 62 65 2f 62 75 73 69 6e 65 73 73 2f 2a 22 2c 22 2f 69 6e 74 6c 2f 41 4c 4c 5f 62 65 2f 72 65 74 61 69 6c 22 2c 22 2f 69 6e 74 6c 2f 41 4c 4c 5f 62 65 2f 72 65 74 61 69 6c 2f 2a 22 2c 22 2f 69 6e 74 6c 2f 41 4c 4c 5f 62 67 2f 62 75 73 69 6e 65 73 73 22 Data Ascii: /ALL_at/retail","/intl/ALL_at/retail/","/intl/ALL_au/business","/intl/ALL_au/business/","/intl/ALL_au/retail","/intl/ALL_au/retail/","/intl/ALL_be/business","/intl/ALL_be/business/","/intl/ALL_be/retail","/intl/ALL_be/retail/*","/intl/ALL_bg/business"
2024-04-18 00:06:42 UTC	3235	IN	Data Raw: 2f 62 75 73 69 6e 65 73 73 2f 2a 22 2c 22 2f 69 6e 74 6c 2f 41 4c 4c 5f 6e 6f 2f 72 65 74 61 69 6c 22 2c 22 2f 69 6e 74 6c 2f 41 4c 4c 5f 6e 6f 2f 72 65 74 61 69 6c 2f 2a 22 2c 22 2f 69 6e 74 6c 2f 41 4c 4c 5f 6e 7a 2f 62 75 73 69 6e 65 73 73 22 2c 22 2f 69 6e 74 6c 2f 41 4c 4c 5f 6e 7a 2f 62 75 73 69 6e 65 73 73 2f 2a 22 2c 22 2f 69 6e 74 6c 2f 41 4c 4c 5f 6e 7a 2f 72 65 74 61 69 6c 22 2c 22 2f 69 6e 74 6c 2f 41 4c 4c 5f 6e 7a 2f 72 65 74 61 69 6c 2f 2a 22 2c 22 2f 69 6e 74 6c 2f 41 4c 4c 5f 70 61 2f 62 75 73 69 6e 65 73 73 22 2c 22 2f 69 6e 74 6c 2f 41 4c 4c 5f 70 61 2f 62 75 73 69 6e 65 73 73 2f 2a 22 2c 22 2f 69 6e 74 6c 2f 41 4c 4c 5f 70 65 2f 62 75 73 69 6e 65 73 73 22 2c 22 2f 69 6e 74 6c 2f 41 4c 4c 5f 70 65 2f 62 75 73 69 6e 65 73 73 2f 2a 22 2c Data Ascii: /business/","/intl/ALL_no/retail","/intl/ALL_no/retail/","/intl/ALL_nz/business","/intl/ALL_nz/business/","/intl/ALL_nz/retail","/intl/ALL_nz/retail/","/intl/ALL_pa/business","/intl/ALL_pa/business/","/intl/ALL_pe/business","/intl/ALL_pe/business/",
2024-04-18 00:06:42 UTC	3235	IN	Data Raw: 74 6c 2f 64 61 2f 72 65 74 61 69 6c 22 2c 22 2f 69 6e 74 6c 2f 64 61 2f 72 65 74 61 69 6c 2f 2a 22 2c 22 2f 69 6e 74 6c 2f 64 61 5f 64 6b 2f 62 75 73 69 6e 65 73 73 22 2c 22 2f 69 6e 74 6c 2f 64 61 5f 64 6b 2f 62 75 73 69 6e 65 73 73 2f 2a 22 2c 22 2f 69 6e 74 6c 2f 64 61 5f 64 6b 2f 72 65 74 61 69 6c 22 2c 22 2f 69 6e 74 6c 2f 64 61 5f 64 6b 2f 72 65 74 61 69 6c 2f 2a 22 2c 22 2f 69 6e 74 6c 2f 64 65 2f 62 75 73 69 6e 65 73 73 22 2c 22 2f 69 6e 74 6c 2f 64 65 2f 62 75 73 69 6e 65 73 73 2f 2a 22 2c 22 2f 69 6e 74 6c 2f 64 65 2f 72 65 74 61 69 6c 22 2c 22 2f 69 6e 74 6c 2f 64 65 2f 72 65 74 61 69 6c 2f 2a 22 2c 22 2f 69 6e 74 6c 2f 64 65 5f 41 4c 4c 2f 72 65 74 61 69 6c 22 2c 22 2f 69 6e 74 6c 2f 64 65 5f 41 4c 4c 2f 72 65 74 61 69 6c 2f 2a 22 2c 22 2f 69 Data Ascii: tl/da/retail","/intl/da/retail/","/intl/da_dk/business","/intl/da_dk/business/","/intl/da_dk/retail","/intl/da_dk/retail/","/intl/de/business","/intl/de/business/","/intl/de/retail","/intl/de/retail/","/intl/de_ALL/retail","/intl/de_ALL/retail/","/i
2024-04-18 00:06:42 UTC	3235	IN	Data Raw: 6c 2f 65 73 2d 34 31 39 5f 65 63 2f 62 75 73 69 6e 65 73 73 22 2c 22 2f 69 6e 74 6c 2f 65 73 2d 34 31 39 5f 65 63 2f 62 75 73 69 6e 65 73 73 2f 2a 22 2c 22 2f 69 6e 74 6c 2f 65 73 2d 34 31 39 5f 67 74 2f 62 75 73 69 6e 65 73 73 22 2c 22 2f 69 6e 74 6c 2f 65 73 2d 34 31 39 5f 67 74 2f 62 75 73 69 6e 65 73 73 2f 2a 22 2c 22 2f 69 6e 74 6c 2f 65 73 2d 34 31 39 5f 68 6e 2f 62 75 73 69 6e 65 73 73 22 2c 22 2f 69 6e 74 6c 2f 65 73 2d 34 31 39 5f 68 6e 2f 62 75 73 69 6e 65 73 73 2f 2a 22 2c 22 2f 69 6e 74 6c 2f 65 73 2d 34 31 39 5f 6d 78 2f 62 75 73 69 6e 65 73 73 22 2c 22 2f 69 6e 74 6c 2f 65 73 2d 34 31 39 5f 6d 78 2f 62 75 73 69 6e 65 73 73 2f 2a 22 2c 22 2f 69 6e 74 6c 2f 65 73 2d 34 31 39 5f 6d 78 2f 72 65 74 61 69 6c 22 2c 22 2f 69 6e 74 6c 2f 65 73 2d 34 Data Ascii: l/es-419_ec/business","/intl/es-419_ec/business/","/intl/es-419_gt/business","/intl/es-419_gt/business/","/intl/es-419_hn/business","/intl/es-419_hn/business/","/intl/es-419_mx/business","/intl/es-419_mx/business/","/intl/es-419_mx/retail","/intl/es-4
2024-04-18 00:06:42 UTC	3235	IN	Data Raw: 68 75 5f 68 75 2f 72 65 74 61 69 6c 2f 2a 22 2c 22 2f 69 6e 74 6c 2f 69 64 2f 62 75 73 69 6e 65 73 73 22 2c 22 2f 69 6e 74 6c 2f 69 64 2f 62 75 73 69 6e 65 73 73 2f 2a 22 2c 22 2f 69 6e 74 6c 2f 69 64 5f 69 64 2f 62 75 73 69 6e 65 73 73 22 2c 22 2f 69 6e 74 6c 2f 69 64 5f 69 64 2f 62 75 73 69 6e 65 73 73 2f 2a 22 2c 22 2f 69 6e 74 6c 2f 69 64 5f 69 64 2f 72 65 74 61 69 6c 22 2c 22 2f 69 6e 74 6c 2f 69 64 5f 69 64 2f 72 65 74 61 69 6c 2f 2a 22 2c 22 2f 69 6e 74 6c 2f 69 74 2f 62 75 73 69 6e 65 73 73 22 2c 22 2f 69 6e 74 6c 2f 69 74 2f 62 75 73 69 6e 65 73 73 2f 2a 22 2c 22 2f 69 6e 74 6c 2f 69 74 2f 72 65 74 61 69 6c 22 2c 22 2f 69 6e 74 6c 2f 69 74 2f 72 65 74 61 69 6c 2f 2a 22 2c 22 2f 69 6e 74 6c 2f 69 74 5f 41 4c 4c 2f 72 65 74 61 69 6c 22 2c 22 2f 69 Data Ascii: hu_hu/retail/","/intl/id/business","/intl/id/business/","/intl/id_id/business","/intl/id_id/business/","/intl/id_id/retail","/intl/id_id/retail/","/intl/it/business","/intl/it/business/","/intl/it/retail","/intl/it/retail/","/intl/it_ALL/retail","/i
2024-04-18 00:06:42 UTC	3235	IN	Data Raw: 6c 2f 72 75 5f 6b 7a 2f 62 75 73 69 6e 65 73 73 22 2c 22 2f 69 6e 74 6c 2f 72 75 5f 6b 7a 2f 62 75 73 69 6e 65 73 73 2f 2a 22 2c 22 2f 69 6e 74 6c 2f 72 75 5f 72 75 2f 62 75 73 69 6e 65 73 73 22 2c 22 2f 69 6e 74 6c 2f 72 75 5f 72 75 2f 62 75 73 69 6e 65 73 73 2f 2a 22 2c 22 2f 69 6e 74 6c 2f 72 75 5f 72 75 2f 72 65 74 61 69 6c 22 2c 22 2f 69 6e 74 6c 2f 72 75 5f 72 75 2f 72 65 74 61 69 6c 2f 2a 22 2c 22 2f 69 6e 74 6c 2f 73 6b 2f 62 75 73 69 6e 65 73 73 22 2c 22 2f 69 6e 74 6c 2f 73 6b 2f 62 75 73 69 6e 65 73 73 2f 2a 22 2c 22 2f 69 6e 74 6c 2f 73 6b 2f 72 65 74 61 69 6c 22 2c 22 2f 69 6e 74 6c 2f 73 6b 2f 72 65 74 61 69 6c 2f 2a 22 2c 22 2f 69 6e 74 6c 2f 73 6b 5f 73 6b 2f 62 75 73 69 6e 65 73 73 22 2c 22 2f 69 6e 74 6c 2f 73 6b 5f 73 6b 2f 62 75 73 69 Data Ascii: l/ru_kz/business","/intl/ru_kz/business/","/intl/ru_ru/business","/intl/ru_ru/business/","/intl/ru_ru/retail","/intl/ru_ru/retail/","/intl/sk/business","/intl/sk/business/","/intl/sk/retail","/intl/sk/retail/*","/intl/sk_sk/business","/intl/sk_sk/busi
2024-04-18 00:06:42 UTC	3235	IN	Data Raw: 73 65 2f 2a 22 2c 22 2f 73 68 6f 70 70 69 6e 67 2f 72 61 74 69 6e 67 73 22 2c 22 2f 73 68 6f 70 70 69 6e 67 2f 72 61 74 69 6e 67 73 2f 2a 22 2c 22 2f 74 72 61 76 65 6c 2f 61 63 74 69 76 69 74 69 65 73 22 2c 22 2f 74 72 61 76 65 6c 2f 61 63 74 69 76 69 74 69 65 73 2f 2a 22 2c 22 2f 74 72 61 76 65 6c 2f 66 6c 69 67 68 74 73 2f 73 22 2c 22 2f 74 72 61 76 65 6c 2f 66 6c 69 67 68 74 73 2f 73 2f 2a 22 2c 22 2f 74 72 61 76 65 6c 2f 68 6f 74 65 6c 73 2f 73 22 2c 22 2f 74 72 61 76 65 6c 2f 68 6f 74 65 6c 73 2f 73 2f 2a 22 2c 22 2f 75 76 69 65 77 65 72 32 22 2c 22 2f 75 76 69 65 77 65 72 32 2f 2a 22 2c 22 2f 76 69 65 77 65 72 22 2c 22 2f 76 69 65 77 65 72 2f 2a 22 2c 22 2f 77 69 7a 72 70 63 75 69 22 2c 22 2f 77 69 7a 72 70 63 75 69 2f 2a 22 5d 2c 22 45 70 77 41 73 Data Ascii: se/","/shopping/ratings","/shopping/ratings/","/travel/activities","/travel/activities/","/travel/flights/s","/travel/flights/s/","/travel/hotels/s","/travel/hotels/s/","/uviewer2","/uviewer2/","/viewer","/viewer/","/wizrpcui","/wizrpcui/"],"EpwAs
2024-04-18 00:06:42 UTC	3235	IN	Data Raw: 6c 65 2e 6e 72 22 2c 22 2e 67 6f 6f 67 6c 65 2e 6e 75 22 2c 22 2e 67 6f 6f 67 6c 65 2e 63 6f 2e 6e 7a 22 2c 22 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2e 6f 6d 22 2c 22 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2e 70 61 22 2c 22 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2e 70 65 22 2c 22 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2e 70 67 22 2c 22 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2e 70 68 22 2c 22 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2e 70 6b 22 2c 22 2e 67 6f 6f 67 6c 65 2e 70 6c 22 2c 22 2e 67 6f 6f 67 6c 65 2e 70 6e 22 2c 22 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2e 70 72 22 2c 22 2e 67 6f 6f 67 6c 65 2e 70 73 22 2c 22 2e 67 6f 6f 67 6c 65 2e 70 74 22 2c 22 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2e 70 79 22 2c 22 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2e 71 61 22 2c 22 2e 67 6f 6f 67 6c 65 2e 72 6f 22 2c 22 Data Ascii: le.nr",".google.nu",".google.co.nz",".google.com.om",".google.com.pa",".google.com.pe",".google.com.pg",".google.com.ph",".google.com.pk",".google.pl",".google.pn",".google.com.pr",".google.ps",".google.pt",".google.com.py",".google.com.qa",".google.ro","
2024-04-18 00:06:42 UTC	3235	IN	Data Raw: 5d 2c 5b 34 35 34 35 32 30 31 33 2c 33 32 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5c 22 71 61 62 45 76 66 5c 22 5d 2c 5b 34 35 34 35 33 35 36 32 2c 6e 75 6c 6c 2c 74 72 75 65 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5c 22 48 51 35 76 57 65 5c 22 5d 2c 5b 34 35 34 35 32 30 31 32 2c 6e 75 6c 6c 2c 66 61 6c 73 65 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5c 22 5a 6c 53 72 75 64 5c 22 5d 2c 5b 34 35 36 32 37 31 38 33 2c 6e 75 6c 6c 2c 66 61 6c 73 65 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5c 22 58 56 67 4e 6a 64 5c 22 5d 2c 5b 34 35 34 35 32 30 30 36 2c 6e 75 6c 6c 2c 66 61 6c 73 65 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5c 22 48 6a 58 62 46 66 5c 22 5d 2c 5b 34 35 34 35 32 30 32 32 2c 31 33 30 2c 6e 75 6c Data Ascii: ],[45452013,32,null,null,null,null,\"qabEvf\"],[45453562,null,true,null,null,null,\"HQ5vWe\"],[45452012,null,false,null,null,null,\"ZlSrud\"],[45627183,null,false,null,null,null,\"XVgNjd\"],[45452006,null,false,null,null,null,\"HjXbFf\"],[45452022,130,nul

Timestamp	Bytes transferred	Direction	Data
2024-04-18 00:06:43 UTC	1297	OUT	POST /gen_204?s=images_vfe&t=aft&atyp=csi&ei=EmQgZvqIBaefiLMPme2E2A0&rt=wsrt.719 HTTP/1.1 Host: www.google.com Connection: keep-alive Content-Length: 0 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-arch: "x86" sec-ch-ua-full-version: "117.0.5938.132" Content-Type: text/plain;charset=UTF-8 sec-ch-ua-platform-version: "10.0.0" sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-wow64: ?0 sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.google.com X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiVocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUX Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://www.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=513=YnUuQrDaoaBEUA2bXiLdH2dYj28flSXSLiFewk1TkOsrmjPhuWebS5mOXWKacdDYybT6CWMI9gjteSTwR3vl3vPUiJA9QF0uYP6UtuzJ6_7_w70fpCKLgEjdIvtnImm9wI0v1wMmmE2-0_lNbQfFjrA3pgJ078lxpT5DkE0aUIU
2024-04-18 00:06:43 UTC	1227	IN	HTTP/1.1 204 No Content Content-Type: text/html; charset=UTF-8 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-FcdcKYArd_8YOKuyEpNIXQ' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/other Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/other"}]} Permissions-Policy: unload=() Origin-Trial: Ap+qNlnLzJDKSmEHjzM5ilaa908GuehlLqGb6ezME5lkhelj20qVzfv06zPmQ3LodoeujZuphAolrnhnPA8w4AIAAABfeyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJQZXJtaXNzaW9uc1BvbGljeVVubG9hZCIsImV4cGlyeSI6MTY4NTY2Mzk5OX0= Origin-Trial: AvudrjMZqL7335p1KLV2lHo1kxdMeIN0dUI15d0CPz9dovVLCcXk8OAqjho1DX4s6NbHbA/AGobuGvcZv0drGgQAAAB9eyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJCYWNrRm9yd2FyZENhY2hlTm90UmVzdG9yZWRSZWFzb25zIiwiZXhwaXJ5IjoxNjkxNTM5MTk5LCJpc1N1YmRvbWFpbiI6dHJ1ZX0= Date: Thu, 18 Apr 2024 00:06:43 GMT Server: gws Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Timestamp	Bytes transferred	Direction	Data
2024-04-18 00:06:44 UTC	1912	OUT	POST /_/VisualFrontendUi/jserror?script=https%3A%2F%2Fwww.google.com%2Fimgres%3Fimgurl%3Dhttp%3A%2F%2Fwww.testedgeinc.com%2Fimages%2Fwafer.gif%26imgrefurl%3Dhttp%3A%2F%2Fwww.testedgeinc.com%2Fwafersort.html%26usg%3D__-3Z4I2oN99yJOMvLJcc5ES309Nk%3D%26h%3D284%26w%3D290%26sz%3D43%26hl%3Den%26start%3D53%26zoom%3D1%26tbnid%3Ds24hxS3vSW33KM%3A%26tbnh%3D113%26tbnw%3D115%26ei%3DFOc7T96UKM6bOpD0lN8C%26prev%3D%2Fsearch%3Fq%3Dwafer%26start%3D42%26hl%3Den%26sa%3DN%26gbv%3D2%26tbm%3Disch%26itbs%3D1&error=Failed%20to%20retrieve%20dependencies%20of%20service%20XLSavd%3A%20Oc%60Z9MBEf%60context%3AXLSavd&line=Not%20available&ei=EmQgZvqIBaefiLMPme2E2A0&authuser HTTP/1.1 Host: www.google.com Connection: keep-alive Content-Length: 18721 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-arch: "x86" sec-ch-ua-full-version: "117.0.5938.132" Content-Type: application/x-www-form-urlencoded;charset=UTF-8 sec-ch-ua-platform-version: "10.0.0" sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-wow64: ?0 sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.google.com X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiVocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUX Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=513=YnUuQrDaoaBEUA2bXiLdH2dYj28flSXSLiFewk1TkOsrmjPhuWebS5mOXWKacdDYybT6CWMI9gjteSTwR3vl3vPUiJA9QF0uYP6UtuzJ6_7_w70fpCKLgEjdIvtnImm9wI0v1wMmmE2-0_lNbQfFjrA3pgJ078lxpT5DkE0aUIU; 1P_JAR=2024-4-18-0
2024-04-18 00:06:44 UTC	16384	OUT	Data Raw: 74 72 61 63 65 3d 45 72 72 6f 72 25 33 41 25 32 30 46 61 69 6c 65 64 25 32 30 74 6f 25 32 30 72 65 74 72 69 65 76 65 25 32 30 64 65 70 65 6e 64 65 6e 63 69 65 73 25 32 30 6f 66 25 32 30 73 65 72 76 69 63 65 25 32 30 58 4c 53 61 76 64 25 33 41 25 32 30 4f 63 25 36 30 5a 39 4d 42 45 66 25 36 30 63 6f 6e 74 65 78 74 25 33 41 58 4c 53 61 76 64 25 30 41 25 32 30 25 32 30 25 32 30 25 32 30 61 74 25 32 30 5f 2e 4d 30 61 2e 25 33 43 61 6e 6f 6e 79 6d 6f 75 73 25 33 45 25 32 30 28 68 74 74 70 73 25 33 41 25 32 46 25 32 46 77 77 77 2e 67 73 74 61 74 69 63 2e 63 6f 6d 25 32 46 5f 25 32 46 6d 73 73 25 32 46 62 6f 71 2d 73 65 61 72 63 68 25 32 46 5f 25 32 46 6a 73 25 32 46 6b 25 33 44 62 6f 71 2d 73 65 61 72 63 68 2e 56 69 73 75 61 6c 46 72 6f 6e 74 65 6e 64 55 69 2e Data Ascii: trace=Error%3A%20Failed%20to%20retrieve%20dependencies%20of%20service%20XLSavd%3A%20Oc%60Z9MBEf%60context%3AXLSavd%0A%20%20%20%20at%20_.M0a.%3Canonymous%3E%20(https%3A%2F%2Fwww.gstatic.com%2F_%2Fmss%2Fboq-search%2F_%2Fjs%2Fk%3Dboq-search.VisualFrontendUi.
2024-04-18 00:06:44 UTC	2337	OUT	Data Raw: 43 6a 42 42 41 41 4f 67 41 41 41 54 53 41 41 44 30 6b 51 41 41 41 50 51 41 41 41 42 69 41 55 4d 42 41 41 48 43 4e 42 5a 41 45 41 41 41 41 41 4a 7a 6d 41 51 4d 43 41 41 41 41 41 41 41 41 41 41 41 41 41 41 43 43 4b 67 59 41 41 41 41 41 41 41 41 41 41 41 41 41 67 41 42 30 45 67 25 32 46 64 25 33 44 31 25 32 46 65 78 63 6d 25 33 44 5f 62 25 32 43 5f 74 70 25 32 43 73 74 61 6e 64 61 6c 6f 6e 65 69 6d 61 67 65 76 69 65 77 25 32 46 65 64 25 33 44 31 25 32 46 64 67 25 33 44 30 25 32 46 77 74 25 33 44 32 25 32 46 75 6a 67 25 33 44 31 25 32 46 72 73 25 33 44 41 48 37 2d 66 67 37 38 42 76 41 72 73 6a 74 41 5f 65 4b 53 78 32 39 44 34 6b 4c 39 4f 30 4f 42 5a 41 25 32 46 6d 25 33 44 5f 62 25 32 43 5f 74 70 25 33 41 34 35 32 25 33 41 32 33 31 33 29 25 30 41 25 32 30 25 Data Ascii: CjBBAAOgAAATSAAD0kQAAAPQAAABiAUMBAAHCNBZAEAAAAAJzmAQMCAAAAAAAAAAAAAACCKgYAAAAAAAAAAAAAgAB0Eg%2Fd%3D1%2Fexcm%3D_b%2C_tp%2Cstandaloneimageview%2Fed%3D1%2Fdg%3D0%2Fwt%3D2%2Fujg%3D1%2Frs%3DAH7-fg78BvArsjtA_eKSx29D4kL9O0OBZA%2Fm%3D_b%2C_tp%3A452%3A2313)%0A%20%
2024-04-18 00:06:45 UTC	1981	IN	HTTP/1.1 204 No Content Content-Type: text/html; charset=utf-8 Access-Control-Allow-Origin: * Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 18 Apr 2024 00:06:44 GMT Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/VisualFrontendUi/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-tF95KybwIvABMt7fqsJJvA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/VisualFrontendUi/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com https://graphviz.corp.google.com https://static.corp.google.com https://cse.google.com https://cdn.ampproject.org https://maps.google.com https://maps.googleapis.com https://pagead2.googlesyndication.com https://www.youtube.com https://translate.google.com https://translate.googleapis.com https://translate.google.cn https://ajax.googleapis.com https://www.googletagservices.com https://ssl.google-analytics.com https://www.googleapis.com/appsmarket/v2/installedApps/;report-uri /_/VisualFrontendUi/cspreport/allowlist Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin-allow-popups Cross-Origin-Resource-Policy: cross-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factor=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Timestamp	Bytes transferred	Direction	Data
2024-04-18 00:06:44 UTC	1223	OUT	GET /favicon.ico HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-arch: "x86" sec-ch-ua-full-version: "117.0.5938.132" sec-ch-ua-platform-version: "10.0.0" sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-wow64: ?0 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiVocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUX Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=513=YnUuQrDaoaBEUA2bXiLdH2dYj28flSXSLiFewk1TkOsrmjPhuWebS5mOXWKacdDYybT6CWMI9gjteSTwR3vl3vPUiJA9QF0uYP6UtuzJ6_7_w70fpCKLgEjdIvtnImm9wI0v1wMmmE2-0_lNbQfFjrA3pgJ078lxpT5DkE0aUIU; 1P_JAR=2024-4-18-0
2024-04-18 00:06:45 UTC	707	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="static-on-bigtable" Report-To: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]} Content-Length: 5430 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Sun, 14 Apr 2024 00:58:37 GMT Expires: Mon, 22 Apr 2024 00:58:37 GMT Cache-Control: public, max-age=691200 Last-Modified: Tue, 22 Oct 2019 18:30:00 GMT Content-Type: image/x-icon Vary: Accept-Encoding Age: 342488 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-18 00:06:45 UTC	548	IN	Data Raw: 00 00 01 00 02 00 10 10 00 00 01 00 20 00 68 04 00 00 26 00 00 00 20 20 00 00 01 00 20 00 a8 10 00 00 8e 04 00 00 28 00 00 00 10 00 00 00 20 00 00 00 01 00 20 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 30 fd fd fd 96 fd fd fd d8 fd fd fd f9 fd fd fd f9 fd fd fd d7 fd fd fd 94 fe fe fe 2e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 09 fd fd fd 99 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd 95 ff ff ff 08 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 09 fd fd fd c1 ff ff ff ff fa fd f9 ff b4 d9 a7 ff 76 ba 5d ff 58 ab 3a ff 58 aa 3a ff 72 b8 59 ff ac d5 9d ff f8 fb f6 ff ff Data Ascii: h& ( 0.v]X:X:rY
2024-04-18 00:06:45 UTC	1255	IN	Data Raw: ff ff ff ff ff ff ff ff ff ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f7 a6 75 ff ff ff ff ff fd fd fd f9 fd fd fd fa ff ff ff ff 0b be fb ff 05 bc fb ff b6 ec fe ff ff ff ff ff ff ff ff ff ff ff ff ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f7 aa 7b ff ff ff ff ff fd fd fd f9 fd fd fd db ff ff ff ff 35 c9 fc ff 0a b2 f9 ff 6b a4 f6 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd d8 fd fd fd 99 ff ff ff ff 92 cf fb ff 37 52 ec ff 38 46 ea ff d0 d4 fa ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd 96 fe fe fe 32 ff ff ff ff f9 f9 fe ff 56 62 ed ff 35 43 ea ff 3b Data Ascii: BBBBBuBBBBB{5k7R8F2Vb5C;
2024-04-18 00:06:45 UTC	1255	IN	Data Raw: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd e8 fe fe fe 2f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 24 fd fd fd ea ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff eb f5 e7 ff 8f c6 7b ff 54 a9 36 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 7e be 67 ff dd ee d7 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd e8 ff ff ff 22 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 0a fd fd fd d3 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff c4 e1 b9 ff 5c ac 3e ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff Data Ascii: /${T6S4S4S4S4S4S4S4S4S4~g"\>S4S4S4S4S4S4S4S4S4S4S4
2024-04-18 00:06:45 UTC	1255	IN	Data Raw: ff ff ff ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff fa c8 aa ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd ea fd fd fd fa ff ff ff ff ff ff ff ff ff ff ff ff 07 bd fb ff 05 bc fb ff 05 bc fb ff 05 bc fb ff 7d dc fd ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f9 c1 9f ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd f9 fd fd fd fa ff ff ff ff ff ff ff ff ff ff ff ff 07 bd fb ff 05 bc fb ff 05 bc fb ff 05 bc fb ff 7d dc fd ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff Data Ascii: BBBBBBBBBBB}BBBBBBBBBBB}
2024-04-18 00:06:45 UTC	1117	IN	Data Raw: ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 81 8a f2 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd 8a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 0b fd fd fd d5 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff b5 ba f7 ff 3e 4b eb ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 3f 4c eb ff ba bf f8 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd d2 fe fe fe 09 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 26 fd fd fd eb ff ff ff ff ff ff ff ff ff ff ff ff ff ff Data Ascii: 5C5C5C5C5C5C5C5C5C5C5C5C5C5C>K5C5C5C5C5C5C5C5C5C5C5C5C?L&