Windows Analysis Report fel.com.html

AV Detection:

Antivirus detection for URL or domain

Source: http://www.ciplla.com/uploads/send/pics/Stifel_bg_image.png	Avira URL Cloud: Label: phishing
Source: https://www.ciplla.com/uploads/send/send.php/check.php	Avira URL Cloud: Label: phishing
Source: http://www.ciplla.com/uploads/send/pics/Stifel_lg_image.pngD	Avira URL Cloud: Label: phishing
Source: https://www.ciplla.com/uploads/send/pics/favicon_24.ico	Avira URL Cloud: Label: phishing
Source: https://www.ciplla.com/uploads/send/pics/download_35.jpeg	Avira URL Cloud: Label: phishing
Source: http://www.ciplla.com/uploads/send/pics/Stifel_lg_image.png	Avira URL Cloud: Label: phishing
Source: https://www.ciplla.com/uploads/send/pics/download02.png	Avira URL Cloud: Label: phishing

Phishing:

Phishing site detected (based on favicon image match)

Source: file:///C:/Users/user/Desktop/fel.com.html

Matcher: Template: microsoft matched with high similarity

Yara detected HtmlPhish44

Source: Yara match

File source: fel.com.html, type: SAMPLE

HTML body contains low number of good links

Source: file:///C:/Users/user/Desktop/fel.com.html	HTTP Parser: Number of links: 0
Source: file:///C:/Users/user/Desktop/fel.com.html	HTTP Parser: Number of links: 0

None HTTPS page querying sensitive user data (password, username or email)

Source: file:///C:/Users/user/Desktop/fel.com.html	HTTP Parser: Has password / email / username input fields
Source: file:///C:/Users/user/Desktop/fel.com.html	HTTP Parser: Has password / email / username input fields

No HTML title found

Source: file:///C:/Users/user/Desktop/fel.com.html	HTTP Parser: HTML title missing
Source: file:///C:/Users/user/Desktop/fel.com.html	HTTP Parser: HTML title missing

META author tag missing

Source: file:///C:/Users/user/Desktop/fel.com.html	HTTP Parser: No <meta name="author".. found
Source: file:///C:/Users/user/Desktop/fel.com.html	HTTP Parser: No <meta name="author".. found

META copyright tag missing

Source: file:///C:/Users/user/Desktop/fel.com.html	HTTP Parser: No <meta name="copyright".. found
Source: file:///C:/Users/user/Desktop/fel.com.html	HTTP Parser: No <meta name="copyright".. found

Compliance:

Creates a directory in C:\Program Files

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\Google\Chrome\Application\Dictionaries			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\Google\Chrome\Application\Dictionaries\en-US-9-0.bdic			Jump to behavior

Uses secure TLS version for HTTPS connections

Source: unknown	HTTPS traffic detected: 35.228.118.158:443 -> 192.168.2.6:49781 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.49.157.6:443 -> 192.168.2.6:49807 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.49.157.6:443 -> 192.168.2.6:49808 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.199.120.85:443 -> 192.168.2.6:49814 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.50.102.62:443 -> 192.168.2.6:49815 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.50.102.62:443 -> 192.168.2.6:49816 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.199.120.85:443 -> 192.168.2.6:49817 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.199.120.151:443 -> 192.168.2.6:49821 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 80.67.82.211:443 -> 192.168.2.6:49823 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 80.67.82.211:443 -> 192.168.2.6:49822 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 80.67.82.211:443 -> 192.168.2.6:49825 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 80.67.82.211:443 -> 192.168.2.6:49824 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 80.67.82.211:443 -> 192.168.2.6:49826 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.35.236.56:443 -> 192.168.2.6:49831 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.199.120.85:443 -> 192.168.2.6:49837 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.199.120.85:443 -> 192.168.2.6:49840 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.91.112.76:443 -> 192.168.2.6:49841 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.91.112.76:443 -> 192.168.2.6:49843 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.54.110.249:443 -> 192.168.2.6:49845 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.54.110.249:443 -> 192.168.2.6:49847 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.112.88.60:443 -> 192.168.2.6:49849 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.54.110.249:443 -> 192.168.2.6:49848 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.54.110.249:443 -> 192.168.2.6:49852 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.54.110.249:443 -> 192.168.2.6:49855 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.199.120.85:443 -> 192.168.2.6:49881 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.199.120.151:443 -> 192.168.2.6:49883 version: TLS 1.2

Networking:

JA3 SSL client fingerprint seen in connection with other malware

Source: Joe Sandbox View	JA3 fingerprint: bd0bf25947d4a37404f0424edf4db9ad
Source: Joe Sandbox View	JA3 fingerprint: 9e10692f1b7f78228b2d4e424db3a98c

IP address seen in connection with other malware

Source: Joe Sandbox View	IP Address: 152.228.223.13 152.228.223.13
Source: Joe Sandbox View	IP Address: 239.255.255.250 239.255.255.250

Performs DNS lookups

Source: unknown

DNS traffic detected: queries for: accounts.google.com

Uses HTTPS

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49878 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 49881 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 49866 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49697
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49855 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49700 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49697 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49679
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49856 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 49867 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown	Network traffic detected: HTTP traffic on port 49865 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49833 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 49845 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 49868 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 49679 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49879 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49876 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49808
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 49821 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49881
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 49857 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49877 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49854 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49875
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49843 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49880 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49832 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49846 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49868
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49867
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49866

Connects to IPs without corresponding DNS lookups

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 20.49.157.6
Source: unknown	TCP traffic detected without corresponding DNS query: 20.49.157.6
Source: unknown	TCP traffic detected without corresponding DNS query: 20.49.157.6
Source: unknown	TCP traffic detected without corresponding DNS query: 20.49.157.6
Source: unknown	TCP traffic detected without corresponding DNS query: 20.49.157.6
Source: unknown	TCP traffic detected without corresponding DNS query: 20.49.157.6
Source: unknown	TCP traffic detected without corresponding DNS query: 20.49.157.6
Source: unknown	TCP traffic detected without corresponding DNS query: 20.49.157.6
Source: unknown	TCP traffic detected without corresponding DNS query: 20.49.157.6
Source: unknown	TCP traffic detected without corresponding DNS query: 20.49.157.6
Source: unknown	TCP traffic detected without corresponding DNS query: 20.49.157.6
Source: unknown	TCP traffic detected without corresponding DNS query: 20.49.157.6
Source: unknown	TCP traffic detected without corresponding DNS query: 20.49.157.6
Source: unknown	TCP traffic detected without corresponding DNS query: 20.49.157.6
Source: unknown	TCP traffic detected without corresponding DNS query: 20.49.157.6
Source: unknown	TCP traffic detected without corresponding DNS query: 20.49.157.6
Source: unknown	TCP traffic detected without corresponding DNS query: 20.49.157.6
Source: unknown	TCP traffic detected without corresponding DNS query: 20.49.157.6
Source: unknown	TCP traffic detected without corresponding DNS query: 20.49.157.6
Source: unknown	TCP traffic detected without corresponding DNS query: 20.49.157.6
Source: unknown	TCP traffic detected without corresponding DNS query: 23.203.67.116
Source: unknown	TCP traffic detected without corresponding DNS query: 23.203.67.116
Source: unknown	TCP traffic detected without corresponding DNS query: 23.203.67.116
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.108.226
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.108.226
Source: unknown	TCP traffic detected without corresponding DNS query: 93.184.220.29
Source: unknown	TCP traffic detected without corresponding DNS query: 20.199.120.85
Source: unknown	TCP traffic detected without corresponding DNS query: 20.199.120.85
Source: unknown	TCP traffic detected without corresponding DNS query: 20.199.120.85
Source: unknown	TCP traffic detected without corresponding DNS query: 20.199.120.85
Source: unknown	TCP traffic detected without corresponding DNS query: 20.199.120.85
Source: unknown	TCP traffic detected without corresponding DNS query: 20.199.120.85
Source: unknown	TCP traffic detected without corresponding DNS query: 20.199.120.85
Source: unknown	TCP traffic detected without corresponding DNS query: 20.199.120.85
Source: unknown	TCP traffic detected without corresponding DNS query: 20.199.120.85
Source: unknown	TCP traffic detected without corresponding DNS query: 20.199.120.85
Source: unknown	TCP traffic detected without corresponding DNS query: 93.184.220.29

Downloads files from webservers via HTTP

Source: global traffic	HTTP traffic detected: GET /client/config?cc=US&setlang=en-US HTTP/1.1X-Search-CortanaAvailableCapabilities: CortanaExperience,SpeechLanguageX-Search-SafeSearch: ModerateAccept-Encoding: gzip, deflateX-Device-MachineId: {A2AB526A-D38D-4FC9-8BA0-E34B8D6354E8}X-UserAgeClass: UnknownX-BM-Market: USX-BM-DateFormat: M/d/yyyyX-CortanaAccessAboveLock: falseX-Device-OSSKU: 48X-BM-DTZ: -480X-BM-FirstEnabledTime: 132061387448759736X-DeviceID: 0100748C09001CEAX-Search-TimeZone: Bias=480; StandardBias=0; TimeZoneKeyName=Pacific Standard TimeX-BM-Theme: 000000;0078d7X-Search-RPSToken: t%3DEwDYAkR8BAAUW3WS0TDKGu2jEbBhB%2BXls4oNzBQAAQ/VOeTcS8sPmIVIWz5Wj1njY4UuZGboQmOu2GMfBA6NJkEqA8qdIXqrMAzVUf9VI9/Ei2fbnAb64usyDB7ytba2IELRY3FzfI2RkcjoeWU5pHcbYleTRwsAbfuN4l%2BV4SBQ%2BYsWwONJIvPSIRvBy82G/vcpvX71C68xXCHr8R0ThbYkq4hxQgZG6sUhA7u/g3ZeH3ngT64BJYekr8Qh6tLMtEfHk6iiPPds1Le0fn1Ym/UE4rlTLDDpaiio3IQnuGac20neNuGFu61JzWFayTm7Z2XGSrR%2B1X7tRSwZ7fA1xuiT4VLKldQP3S504O67PZEhUuIuPl/pbJwHb/x4spMDZgAACH5oTfXXFwkDqAFMBsfDcsqKiE1PdNib9Z73nQxzw5Dg9J82sgB2RRc/0PVfmvXFHKagb85Dat7lYd5N07ogILLTu0EUC0Fj7Z6K/CaRzvkDaL4KGuvbXtRBq8fLfFbbuttzrZ/F5pU0HAhrscU9Q34hX%2BN7WFF60hfV2oKbXC2Nnish5JkDRVQ3Sp/OkngXx/b9fDl12sQ9scdn/l4TsVPQkytqhfss2%2BdentFWqoolv0AoaHcFbingQpPSeYAirl%2BZI4hTDSsT3%2BCwEEkynLBijJeDzrOJqWpwsql3FJtTZaXwVyYB0N2LL1s5yNCh6/HNnKXE3ZwI7U44YuRWT36cjO/VHapEvzjU91qPGwnOQQ0qmf9Nv5XAYjwtizahsOVEvzyN44CT2hSIbFiecW1fuIsKeAEJQMxqEbExZe/0QRL0FXKsDneinEdXkJyWkRgJhf9CbvmYYXFh5iTSoQk3j2%2BMhOXJrOHRwRaxiMVTvZknnMyuN%2BcVpk7bkMeSKly5fLRnta5R4BlKSem5RBe%2BFjtMwD0o4KdEf6VcDtnKXg5cKcpgPEl1FYdEPhUlogvB1QE%3D%26p%3DX-Agent-DeviceId: 0100748C09001CEAX-BM-CBT: 1638495805User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.10.7.17134; 10.0.0.0.17134.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134X-Device-isOptin: trueAccept-language: en-US, enX-Device-Touch: falseX-Device-ClientSession: 47959F20FB2F486C953D16B811CC5090X-Search-AppId: Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUIX-BM-ClientFeatures: pbitcpdisabled,AmbientWidescreen,rs1musicprod,CortanaSPAXamlHeaderHost: www.bing.comConnection: Keep-AliveCookie: MUID=54AD14FB4D1E4A6C815A867991009454
Source: global traffic	HTTP traffic detected: GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=310091&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:BE8AB8DF-DCD1-3523-4A95-3A04EAFF1CBA&ctry=US&time=20211203T014325Z&lc=en-US&pl=en-US&idtp=mid&uid=b029da70-c67b-4a7e-9bd5-517f7e302ed9&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=74393b7cb2ac4c759a7b98469d45a6c3&ctmode=MultiSession&arch=x64&cdm=1&cdmver=10.0.17134.1&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.17134.1&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=1280511&metered=false&nettype=ethernet&npid=sc-310091&oemName=VMware%2C%20Inc.&oemid=VMware%2C%20Inc.&ossku=Professional&rver=2&smBiosDm=VMware7%2C1&tl=2&tsu=1280511&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing= HTTP/1.1Accept-Encoding: gzip, deflateX-SDK-CACHE: chs=0&imp=0&chf=0&ds=50583&fs=32345&sc=6X-SDK-HW-TOKEN: t=EwDgAppeBAAU+CVBfQcFvEv2DZI9cfqZBAbEzGMAAfA0VHhm7qezK4APppZ3iEIrEBslo2/7IEIq+JqOnNH93HDJTKoc0nYwCdKi9D5XEhMUJU9EmxK1c+tLkWzT6zXtH6WFUqgLXiwZbQTRr3n8KfSAkqrkH729yF12O69xwiMPYkPAI4xaIMTqFalpUAouDkaEVooRxlgAn9R6idvjYJMkpjgbzI54dxRFAeUxWTuShmx1HMXDbKzAVvGzdyP1orR7aA1kl4IP7TzYXnQG6tafhKsoqlCgXlrctshfqNT7WHD04e2L5IsYMbP92bwWyURBTPneeGT8ju2A8P00rYh/kcTCL0QpVLAZv4Ga7CVysLyfHWlQPxmRy/Y0Xi8DZgAACJEdmioOl7tJsAGjB+h3rNJS+K7usK2UqSPOmrh94da2dwf0KTOmzLX6byQsFWEwKeLpw9FmN5aeteInKovL0RNO8lMJMnvuVpr+iElRfI2Ac2/aBIi+l/dE9jkgM8lysAgeMT4GmxlOtp/4Js47f6gEQy8EQyq8bc35/3rmi5po+yQHWZoVc7+zkfeHGrsiOfldewKc9JQQtNGyWBMIDzitxt1987w8L6xF8d9B1JWtlYxJqds3JtvTw4tuO26vGyYKIFvGB2hX254xWlbM7QPEhg+ZvuMiY9w9+UqRIr1mC4xrsX8Yk0zIFgOsazyTk5R3ToavLQNOXzSBSLdvUvD1k8qU2ExUqH5MrOmfSKTaaEWL87YMSg3Si3wSIBSdcVoz1JUC8t0bbUGcMWD/B7ZnQxwyepINrDs/bbiA0+49YQyx1c1JNKBE8ueZaMJAnSZMTTicsl/H8uqkB2ZY1p8BVXAHg93WuW0AEGTBXn1drvT8e/cwmUVOov9U5qsxvNC6DRlioZDQjqfM/xODABxyEfBy9N7GBfuDu41bAA1Qw6o7EyzxTTYRI7okdLlokyhiAf5xLuSJbTrVAQ==&p=Cache-Control: no-cacheMS-CV: cEItpuLFf0mAEaSQ.0User-Agent: WindowsShellClient/9.0.40929.0 (Windows)X-SDK-HWF: tch0,m301,m751,mA01,mT01Host: arc.msn.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=314559&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:BE8AB8DF-DCD1-3523-4A95-3A04EAFF1CBA&ctry=US&time=20211203T014325Z&lc=en-US&pl=en-US&idtp=mid&uid=b029da70-c67b-4a7e-9bd5-517f7e302ed9&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=4f980497967741d4aef55219fc69de00&ctmode=MultiSession&arch=x64&cdm=1&cdmver=10.0.17134.1&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.17134.1&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=1280511&metered=false&nettype=ethernet&npid=sc-314559&oemName=VMware%2C%20Inc.&oemid=VMware%2C%20Inc.&ossku=Professional&smBiosDm=VMware7%2C1&tl=2&tsu=1280511&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing= HTTP/1.1Accept-Encoding: gzip, deflateX-SDK-CACHE: chs=0&imp=0&chf=0&ds=50583&fs=32345&sc=6X-SDK-HW-TOKEN: t=EwDYAppeBAAU+CVBfQcFvEv2DZI9cfqZBAbEzGMAAZx/18YzNvH5+abdFMbqNBJbbwyi7s9wPhUSLwJn+aPkoddJanNXNfl97MPHL/FiLKNvSZq0guPU8ZxsKl0MRgVneJi9sM+sCYrwJcjOKNgPL1aWzJj9M9BcOFYSEBH28xAc9a1lsqqdq489Dj0tSxjaD+6Bb5nWHkSLXG//f/oS/E0crczMkrPkhK0BN02Nss7uRE2cikw4Tl7eAJRfwPvV9gbuht+V/eZX+brvM9vUx0dh/jsE2NWbYpxE9OaejdWKNXDoiX/CIjT6IPQSAfKaLrnO3ulokgXuejAUa1uRK2lozV73dgDv4ENf0w6HJ2LLGcnzdCMfcMGs/q5irooDZgAACGwFT4qYFVOlqAGo/qn9I1HZaGcUOqF0jCPSBADzzGvKCQRZycjb8KG8tD/8KgvF+4R58RS4l36U7eMSgjZMH5+lGQeHG16GAa1WtEMCjgK5KxGIXyP4AjXao3ikqP67KVtx6zUa/mnFj6IRsiYYkVfigzLGYZ8JnRwex3ZyUlWWyTmgrH/i2SKVygonWojrY2eTPlZP8aHChhFLzmgRaffHicLyONibXuKBfZ6dz5LYz76EokGpcyr1cVf0Gv0u7pJUyyF1ZjoHWIWrc4PkL/0mqawHkkHFuq6VSCDruzwiaYi8cWd0Nk0UnOVjDDOL+AozF5Lj0qE3fNj4AyT4eZHgKYXKgLPt054ilwUG64hN9aNKRGvpxmDwTNcPk9GtiVqVPSOl28xGU+7JlRb1iTc4EH3c6oFZEyq3EzIAcJY+ZGST7ltg/P5v0zD++JMcX6VS1HwNbjyOMP+Z1SBHb2beXKV5hwNqf1/DUFwnQ1TjN7EK5xylM2YuFb2XMO0r2xg6gNu4a7IGZSMSUar4csJsDupoUrkH+nqxjckNN4nukW5SAIY/kwcKEidnTupweoWM1QE=&p=Cache-Control: no-cacheMS-CV: cEItpuLFf0mAEaSQ.0User-Agent: WindowsShellClient/9.0.40929.0 (Windows)X-SDK-HWF: tch0,m301,m751,mA01,mT01Host: arc.msn.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /newantibot.js?PvsoX4b7Hz=a2l0dHJlZGdla0BzdGlmZWwuY29t&WcupjXToVuiP8je=YmlnYmFuZ2Jnc0B5YW5kZXguY29tLCBiaWdzYmFuZ2Jnc0BnbWFpbC5jb20- HTTP/1.1Host: baddogand.co.ukConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=85.0.4183.121&lang=en-US&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1&x=id%3Dpkedcjkdefgpdelpbcmbmeomcjbeemfm%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1Host: clients2.google.comConnection: keep-aliveX-Goog-Update-Interactivity: fgX-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmieda,pkedcjkdefgpdelpbcmbmeomcjbeemfmX-Goog-Update-Updater: chromecrx-85.0.4183.121Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /3C2ZWFn/download01.gif HTTP/1.1Host: i.ibb.coConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /uploads/send/pics/download_35.jpeg HTTP/1.1Host: www.ciplla.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /uploads/send/pics/download02.png HTTP/1.1Host: www.ciplla.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /uploads/send/pics/favicon_24.ico HTTP/1.1Host: www.ciplla.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /uploads/send/pics/favicon_24.ico HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: www.ciplla.com
Source: global traffic	HTTP traffic detected: GET /crx/blobs/Acy1k0bLIjHsvnKaKN_oRpVaYYvFs25d7GKYF1WXrT6yizCMksBO0c_ggE0B6tx6HPRHe6q1GOEe3_NcIbSiGG8kXeLMUY0sAKVvC6R89zvKM13s5VqoAMZSmuUgjQL5vlygJuArQghXXE_qTL7NlQ/extension_8520_615_0_5.crx HTTP/1.1Host: clients2.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=280815&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:BE8AB8DF-DCD1-3523-4A95-3A04EAFF1CBA&ctry=US&time=20211203T014406Z&lc=en-US&pl=en-US&idtp=mid&uid=b029da70-c67b-4a7e-9bd5-517f7e302ed9&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=2620bda73c744b939b564f9b1e1a0f2c&ctmode=MultiSession&arch=x64&cdm=1&cdmver=10.0.17134.1&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.17134.1&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=1280511&metered=false&nettype=ethernet&npid=sc-280815&oemName=dymuax%2C%20Inc.&oemid=dymuax%2C%20Inc.&ossku=Professional&smBiosDm=dymuax7%2C1&tl=2&tsu=1280511&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing= HTTP/1.1Accept-Encoding: gzip, deflateX-SDK-CACHE: chs=0&imp=0&chf=0&ds=50583&fs=32345&sc=6X-SDK-HW-TOKEN: t=EwDgAppeBAAU+CVBfQcFvEv2DZI9cfqZBAbEzGMAAfA0VHhm7qezK4APppZ3iEIrEBslo2/7IEIq+JqOnNH93HDJTKoc0nYwCdKi9D5XEhMUJU9EmxK1c+tLkWzT6zXtH6WFUqgLXiwZbQTRr3n8KfSAkqrkH729yF12O69xwiMPYkPAI4xaIMTqFalpUAouDkaEVooRxlgAn9R6idvjYJMkpjgbzI54dxRFAeUxWTuShmx1HMXDbKzAVvGzdyP1orR7aA1kl4IP7TzYXnQG6tafhKsoqlCgXlrctshfqNT7WHD04e2L5IsYMbP92bwWyURBTPneeGT8ju2A8P00rYh/kcTCL0QpVLAZv4Ga7CVysLyfHWlQPxmRy/Y0Xi8DZgAACJEdmioOl7tJsAGjB+h3rNJS+K7usK2UqSPOmrh94da2dwf0KTOmzLX6byQsFWEwKeLpw9FmN5aeteInKovL0RNO8lMJMnvuVpr+iElRfI2Ac2/aBIi+l/dE9jkgM8lysAgeMT4GmxlOtp/4Js47f6gEQy8EQyq8bc35/3rmi5po+yQHWZoVc7+zkfeHGrsiOfldewKc9JQQtNGyWBMIDzitxt1987w8L6xF8d9B1JWtlYxJqds3JtvTw4tuO26vGyYKIFvGB2hX254xWlbM7QPEhg+ZvuMiY9w9+UqRIr1mC4xrsX8Yk0zIFgOsazyTk5R3ToavLQNOXzSBSLdvUvD1k8qU2ExUqH5MrOmfSKTaaEWL87YMSg3Si3wSIBSdcVoz1JUC8t0bbUGcMWD/B7ZnQxwyepINrDs/bbiA0+49YQyx1c1JNKBE8ueZaMJAnSZMTTicsl/H8uqkB2ZY1p8BVXAHg93WuW0AEGTBXn1drvT8e/cwmUVOov9U5qsxvNC6DRlioZDQjqfM/xODABxyEfBy9N7GBfuDu41bAA1Qw6o7EyzxTTYRI7okdLlokyhiAf5xLuSJbTrVAQ==&p=Cache-Control: no-cacheMS-CV: xV0tQLG/fEi8W8Uf.0User-Agent: WindowsShellClient/9.0.40929.0 (Windows)X-SDK-HWF: tch0,m301,m751,mA01,mT01Host: arc.msn.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=338389&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:BE8AB8DF-DCD1-3523-4A95-3A04EAFF1CBA&ctry=US&time=20211203T014407Z&lc=en-US&pl=en-US&idtp=mid&uid=b029da70-c67b-4a7e-9bd5-517f7e302ed9&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=c9b9ed74f6c54b5cbda66706f462ea8e&ctmode=MultiSession&arch=x64&cdm=1&cdmver=10.0.17134.1&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.17134.1&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=1280511&metered=false&nettype=ethernet&npid=sc-338389&oemName=dymuax%2C%20Inc.&oemid=dymuax%2C%20Inc.&ossku=Professional&smBiosDm=dymuax7%2C1&tl=2&tsu=1280511&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing= HTTP/1.1Accept-Encoding: gzip, deflateX-SDK-CACHE: chs=0&imp=0&chf=0&ds=50583&fs=32345&sc=6X-SDK-HW-TOKEN: t=EwDgAppeBAAU+CVBfQcFvEv2DZI9cfqZBAbEzGMAAfA0VHhm7qezK4APppZ3iEIrEBslo2/7IEIq+JqOnNH93HDJTKoc0nYwCdKi9D5XEhMUJU9EmxK1c+tLkWzT6zXtH6WFUqgLXiwZbQTRr3n8KfSAkqrkH729yF12O69xwiMPYkPAI4xaIMTqFalpUAouDkaEVooRxlgAn9R6idvjYJMkpjgbzI54dxRFAeUxWTuShmx1HMXDbKzAVvGzdyP1orR7aA1kl4IP7TzYXnQG6tafhKsoqlCgXlrctshfqNT7WHD04e2L5IsYMbP92bwWyURBTPneeGT8ju2A8P00rYh/kcTCL0QpVLAZv4Ga7CVysLyfHWlQPxmRy/Y0Xi8DZgAACJEdmioOl7tJsAGjB+h3rNJS+K7usK2UqSPOmrh94da2dwf0KTOmzLX6byQsFWEwKeLpw9FmN5aeteInKovL0RNO8lMJMnvuVpr+iElRfI2Ac2/aBIi+l/dE9jkgM8lysAgeMT4GmxlOtp/4Js47f6gEQy8EQyq8bc35/3rmi5po+yQHWZoVc7+zkfeHGrsiOfldewKc9JQQtNGyWBMIDzitxt1987w8L6xF8d9B1JWtlYxJqds3JtvTw4tuO26vGyYKIFvGB2hX254xWlbM7QPEhg+ZvuMiY9w9+UqRIr1mC4xrsX8Yk0zIFgOsazyTk5R3ToavLQNOXzSBSLdvUvD1k8qU2ExUqH5MrOmfSKTaaEWL87YMSg3Si3wSIBSdcVoz1JUC8t0bbUGcMWD/B7ZnQxwyepINrDs/bbiA0+49YQyx1c1JNKBE8ueZaMJAnSZMTTicsl/H8uqkB2ZY1p8BVXAHg93WuW0AEGTBXn1drvT8e/cwmUVOov9U5qsxvNC6DRlioZDQjqfM/xODABxyEfBy9N7GBfuDu41bAA1Qw6o7EyzxTTYRI7okdLlokyhiAf5xLuSJbTrVAQ==&p=Cache-Control: no-cacheMS-CV: xV0tQLG/fEi8W8Uf.0User-Agent: WindowsShellClient/9.0.40929.0 (Windows)X-SDK-HWF: tch0,m301,m751,mA01,mT01Host: arc.msn.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=338387&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:BE8AB8DF-DCD1-3523-4A95-3A04EAFF1CBA&ctry=US&time=20211203T014432Z&lc=en-US&pl=en-US&idtp=mid&uid=b029da70-c67b-4a7e-9bd5-517f7e302ed9&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=c396c97ebac943d882d992f0afe9d5f1&ctmode=MultiSession&arch=x64&cdm=1&cdmver=10.0.17134.1&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.17134.1&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=1280512&metered=false&nettype=ethernet&npid=sc-338387&oemName=dymuax%2C%20Inc.&oemid=dymuax%2C%20Inc.&ossku=Professional&rver=2&sc-mode=0&smBiosDm=dymuax7%2C1&tl=2&tsu=1280512&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing= HTTP/1.1Accept-Encoding: gzip, deflateX-SDK-CACHE: chs=0&imp=0&chf=0&ds=50583&fs=32345&sc=6X-SDK-HW-TOKEN: t=EwDgAppeBAAU+CVBfQcFvEv2DZI9cfqZBAbEzGMAAfA0VHhm7qezK4APppZ3iEIrEBslo2/7IEIq+JqOnNH93HDJTKoc0nYwCdKi9D5XEhMUJU9EmxK1c+tLkWzT6zXtH6WFUqgLXiwZbQTRr3n8KfSAkqrkH729yF12O69xwiMPYkPAI4xaIMTqFalpUAouDkaEVooRxlgAn9R6idvjYJMkpjgbzI54dxRFAeUxWTuShmx1HMXDbKzAVvGzdyP1orR7aA1kl4IP7TzYXnQG6tafhKsoqlCgXlrctshfqNT7WHD04e2L5IsYMbP92bwWyURBTPneeGT8ju2A8P00rYh/kcTCL0QpVLAZv4Ga7CVysLyfHWlQPxmRy/Y0Xi8DZgAACJEdmioOl7tJsAGjB+h3rNJS+K7usK2UqSPOmrh94da2dwf0KTOmzLX6byQsFWEwKeLpw9FmN5aeteInKovL0RNO8lMJMnvuVpr+iElRfI2Ac2/aBIi+l/dE9jkgM8lysAgeMT4GmxlOtp/4Js47f6gEQy8EQyq8bc35/3rmi5po+yQHWZoVc7+zkfeHGrsiOfldewKc9JQQtNGyWBMIDzitxt1987w8L6xF8d9B1JWtlYxJqds3JtvTw4tuO26vGyYKIFvGB2hX254xWlbM7QPEhg+ZvuMiY9w9+UqRIr1mC4xrsX8Yk0zIFgOsazyTk5R3ToavLQNOXzSBSLdvUvD1k8qU2ExUqH5MrOmfSKTaaEWL87YMSg3Si3wSIBSdcVoz1JUC8t0bbUGcMWD/B7ZnQxwyepINrDs/bbiA0+49YQyx1c1JNKBE8ueZaMJAnSZMTTicsl/H8uqkB2ZY1p8BVXAHg93WuW0AEGTBXn1drvT8e/cwmUVOov9U5qsxvNC6DRlioZDQjqfM/xODABxyEfBy9N7GBfuDu41bAA1Qw6o7EyzxTTYRI7okdLlokyhiAf5xLuSJbTrVAQ==&p=Cache-Control: no-cacheMS-CV: foeyWRrb202ym1fh.0User-Agent: WindowsShellClient/9.0.40929.0 (Windows)X-SDK-HWF: tch0,m301,m751,mA01,mT01Host: arc.msn.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=338388&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:BE8AB8DF-DCD1-3523-4A95-3A04EAFF1CBA&ctry=US&time=20211203T014431Z&lc=en-US&pl=en-US&idtp=mid&uid=b029da70-c67b-4a7e-9bd5-517f7e302ed9&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=549b88afd3214dfe8c36eff657adc64d&ctmode=MultiSession&arch=x64&cdm=1&cdmver=10.0.17134.1&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.17134.1&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=1280512&metered=false&nettype=ethernet&npid=sc-338388&oemName=dymuax%2C%20Inc.&oemid=dymuax%2C%20Inc.&ossku=Professional&rver=2&smBiosDm=dymuax7%2C1&tl=2&tsu=1280512&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing= HTTP/1.1Accept-Encoding: gzip, deflateX-SDK-CACHE: chs=0&imp=0&chf=0&ds=50583&fs=32345&sc=6X-SDK-HW-TOKEN: t=EwDgAppeBAAU+CVBfQcFvEv2DZI9cfqZBAbEzGMAAfA0VHhm7qezK4APppZ3iEIrEBslo2/7IEIq+JqOnNH93HDJTKoc0nYwCdKi9D5XEhMUJU9EmxK1c+tLkWzT6zXtH6WFUqgLXiwZbQTRr3n8KfSAkqrkH729yF12O69xwiMPYkPAI4xaIMTqFalpUAouDkaEVooRxlgAn9R6idvjYJMkpjgbzI54dxRFAeUxWTuShmx1HMXDbKzAVvGzdyP1orR7aA1kl4IP7TzYXnQG6tafhKsoqlCgXlrctshfqNT7WHD04e2L5IsYMbP92bwWyURBTPneeGT8ju2A8P00rYh/kcTCL0QpVLAZv4Ga7CVysLyfHWlQPxmRy/Y0Xi8DZgAACJEdmioOl7tJsAGjB+h3rNJS+K7usK2UqSPOmrh94da2dwf0KTOmzLX6byQsFWEwKeLpw9FmN5aeteInKovL0RNO8lMJMnvuVpr+iElRfI2Ac2/aBIi+l/dE9jkgM8lysAgeMT4GmxlOtp/4Js47f6gEQy8EQyq8bc35/3rmi5po+yQHWZoVc7+zkfeHGrsiOfldewKc9JQQtNGyWBMIDzitxt1987w8L6xF8d9B1JWtlYxJqds3JtvTw4tuO26vGyYKIFvGB2hX254xWlbM7QPEhg+ZvuMiY9w9+UqRIr1mC4xrsX8Yk0zIFgOsazyTk5R3ToavLQNOXzSBSLdvUvD1k8qU2ExUqH5MrOmfSKTaaEWL87YMSg3Si3wSIBSdcVoz1JUC8t0bbUGcMWD/B7ZnQxwyepINrDs/bbiA0+49YQyx1c1JNKBE8ueZaMJAnSZMTTicsl/H8uqkB2ZY1p8BVXAHg93WuW0AEGTBXn1drvT8e/cwmUVOov9U5qsxvNC6DRlioZDQjqfM/xODABxyEfBy9N7GBfuDu41bAA1Qw6o7EyzxTTYRI7okdLlokyhiAf5xLuSJbTrVAQ==&p=Cache-Control: no-cacheMS-CV: foeyWRrb202ym1fh.0User-Agent: WindowsShellClient/9.0.40929.0 (Windows)X-SDK-HWF: tch0,m301,m751,mA01,mT01Host: arc.msn.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=338388&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:BE8AB8DF-DCD1-3523-4A95-3A04EAFF1CBA&ctry=US&time=20211203T014440Z&lc=en-US&pl=en-US&idtp=mid&uid=b029da70-c67b-4a7e-9bd5-517f7e302ed9&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=0088226d1bd8482e8a4c1abcb6187f15&ctmode=MultiSession&arch=x64&cdm=1&cdmver=10.0.17134.1&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.17134.1&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=1280512&metered=false&nettype=ethernet&npid=sc-338388&oemName=dymuax%2C%20Inc.&oemid=dymuax%2C%20Inc.&ossku=Professional&rver=2&smBiosDm=dymuax7%2C1&tl=2&tsu=1280512&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing= HTTP/1.1Accept-Encoding: gzip, deflateX-SDK-CACHE: chs=0&imp=0&chf=0&ds=50583&fs=32345&sc=6X-SDK-HW-TOKEN: t=EwDgAppeBAAU+CVBfQcFvEv2DZI9cfqZBAbEzGMAAfA0VHhm7qezK4APppZ3iEIrEBslo2/7IEIq+JqOnNH93HDJTKoc0nYwCdKi9D5XEhMUJU9EmxK1c+tLkWzT6zXtH6WFUqgLXiwZbQTRr3n8KfSAkqrkH729yF12O69xwiMPYkPAI4xaIMTqFalpUAouDkaEVooRxlgAn9R6idvjYJMkpjgbzI54dxRFAeUxWTuShmx1HMXDbKzAVvGzdyP1orR7aA1kl4IP7TzYXnQG6tafhKsoqlCgXlrctshfqNT7WHD04e2L5IsYMbP92bwWyURBTPneeGT8ju2A8P00rYh/kcTCL0QpVLAZv4Ga7CVysLyfHWlQPxmRy/Y0Xi8DZgAACJEdmioOl7tJsAGjB+h3rNJS+K7usK2UqSPOmrh94da2dwf0KTOmzLX6byQsFWEwKeLpw9FmN5aeteInKovL0RNO8lMJMnvuVpr+iElRfI2Ac2/aBIi+l/dE9jkgM8lysAgeMT4GmxlOtp/4Js47f6gEQy8EQyq8bc35/3rmi5po+yQHWZoVc7+zkfeHGrsiOfldewKc9JQQtNGyWBMIDzitxt1987w8L6xF8d9B1JWtlYxJqds3JtvTw4tuO26vGyYKIFvGB2hX254xWlbM7QPEhg+ZvuMiY9w9+UqRIr1mC4xrsX8Yk0zIFgOsazyTk5R3ToavLQNOXzSBSLdvUvD1k8qU2ExUqH5MrOmfSKTaaEWL87YMSg3Si3wSIBSdcVoz1JUC8t0bbUGcMWD/B7ZnQxwyepINrDs/bbiA0+49YQyx1c1JNKBE8ueZaMJAnSZMTTicsl/H8uqkB2ZY1p8BVXAHg93WuW0AEGTBXn1drvT8e/cwmUVOov9U5qsxvNC6DRlioZDQjqfM/xODABxyEfBy9N7GBfuDu41bAA1Qw6o7EyzxTTYRI7okdLlokyhiAf5xLuSJbTrVAQ==&p=Cache-Control: no-cacheMS-CV: foeyWRrb202ym1fh.0User-Agent: WindowsShellClient/9.0.40929.0 (Windows)X-SDK-HWF: tch0,m301,m751,mA01,mT01Host: arc.msn.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cms/api/am/imageFileData/RWLKvV?ver=91c3 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: img-prod-cms-rt-microsoft-com.akamaized.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cms/api/am/imageFileData/RWzFJS?ver=b46e HTTP/1.1Accept: */*Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: img-prod-cms-rt-microsoft-com.akamaized.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cms/api/am/imageFileData/RWLPK6?ver=c0e1 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: img-prod-cms-rt-microsoft-com.akamaized.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cms/api/am/imageFileData/RWEBbB?ver=df38 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: img-prod-cms-rt-microsoft-com.akamaized.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cms/api/am/imageFileData/RWzDhe?ver=237d HTTP/1.1Accept: */*Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: img-prod-cms-rt-microsoft-com.akamaized.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=338387&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:BE8AB8DF-DCD1-3523-4A95-3A04EAFF1CBA&ctry=US&time=20211203T014451Z&lc=en-US&pl=en-US&idtp=mid&uid=b029da70-c67b-4a7e-9bd5-517f7e302ed9&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=623e048209aa4d0795353826aa68129b&ctmode=MultiSession&arch=x64&cdm=1&cdmver=10.0.17134.1&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.17134.1&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=1280512&metered=false&nettype=ethernet&npid=sc-338387&oemName=dymuax%2C%20Inc.&oemid=dymuax%2C%20Inc.&ossku=Professional&rver=2&sc-mode=0&smBiosDm=dymuax7%2C1&tl=2&tsu=1280512&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing= HTTP/1.1Accept-Encoding: gzip, deflateX-SDK-CACHE: cid=WW_128000000002643969_EN-US,WW_128000000002971129_EN-US,WW_128000000002759809_EN-US&chs=0&imp=0&chf=0&ds=50583&fs=32345&sc=6X-SDK-HW-TOKEN: t=EwDgAppeBAAU+CVBfQcFvEv2DZI9cfqZBAbEzGMAAfA0VHhm7qezK4APppZ3iEIrEBslo2/7IEIq+JqOnNH93HDJTKoc0nYwCdKi9D5XEhMUJU9EmxK1c+tLkWzT6zXtH6WFUqgLXiwZbQTRr3n8KfSAkqrkH729yF12O69xwiMPYkPAI4xaIMTqFalpUAouDkaEVooRxlgAn9R6idvjYJMkpjgbzI54dxRFAeUxWTuShmx1HMXDbKzAVvGzdyP1orR7aA1kl4IP7TzYXnQG6tafhKsoqlCgXlrctshfqNT7WHD04e2L5IsYMbP92bwWyURBTPneeGT8ju2A8P00rYh/kcTCL0QpVLAZv4Ga7CVysLyfHWlQPxmRy/Y0Xi8DZgAACJEdmioOl7tJsAGjB+h3rNJS+K7usK2UqSPOmrh94da2dwf0KTOmzLX6byQsFWEwKeLpw9FmN5aeteInKovL0RNO8lMJMnvuVpr+iElRfI2Ac2/aBIi+l/dE9jkgM8lysAgeMT4GmxlOtp/4Js47f6gEQy8EQyq8bc35/3rmi5po+yQHWZoVc7+zkfeHGrsiOfldewKc9JQQtNGyWBMIDzitxt1987w8L6xF8d9B1JWtlYxJqds3JtvTw4tuO26vGyYKIFvGB2hX254xWlbM7QPEhg+ZvuMiY9w9+UqRIr1mC4xrsX8Yk0zIFgOsazyTk5R3ToavLQNOXzSBSLdvUvD1k8qU2ExUqH5MrOmfSKTaaEWL87YMSg3Si3wSIBSdcVoz1JUC8t0bbUGcMWD/B7ZnQxwyepINrDs/bbiA0+49YQyx1c1JNKBE8ueZaMJAnSZMTTicsl/H8uqkB2ZY1p8BVXAHg93WuW0AEGTBXn1drvT8e/cwmUVOov9U5qsxvNC6DRlioZDQjqfM/xODABxyEfBy9N7GBfuDu41bAA1Qw6o7EyzxTTYRI7okdLlokyhiAf5xLuSJbTrVAQ==&p=Cache-Control: no-cacheMS-CV: foeyWRrb202ym1fh.0User-Agent: WindowsShellClient/9.0.40929.0 (Windows)X-SDK-HWF: tch0,m301,m751,mA01,mT01Host: arc.msn.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: */*Accept-Encoding: identityIf-Unmodified-Since: Thu, 20 Apr 2017 16:10:39 GMTUser-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /cms/api/am/imageFileData/RWLFlz?ver=ac37 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: img-prod-cms-rt-microsoft-com.akamaized.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cms/api/am/imageFileData/RE4CJ3o?ver=76ff HTTP/1.1Accept: */*Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: img-prod-cms-rt-microsoft-com.akamaized.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cms/api/am/imageFileData/RWLNbZ?ver=0be1 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: img-prod-cms-rt-microsoft-com.akamaized.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cms/api/am/imageFileData/RWEyJR?ver=4dcc HTTP/1.1Accept: */*Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: img-prod-cms-rt-microsoft-com.akamaized.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cms/api/am/imageFileData/RE4CSNq?ver=e631 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: img-prod-cms-rt-microsoft-com.akamaized.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=310091&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:BE8AB8DF-DCD1-3523-4A95-3A04EAFF1CBA&ctry=US&time=20211203T014519Z&lc=en-US&pl=en-US&idtp=mid&uid=b029da70-c67b-4a7e-9bd5-517f7e302ed9&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=94311f8779894eb9b6792d4efd2328d9&ctmode=MultiSession&arch=x64&cdm=1&cdmver=10.0.17134.1&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.17134.1&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=1280512&metered=false&nettype=ethernet&npid=sc-310091&oemName=dymuax%2C%20Inc.&oemid=dymuax%2C%20Inc.&ossku=Professional&rver=2&smBiosDm=dymuax7%2C1&tl=2&tsu=1280512&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing= HTTP/1.1Accept-Encoding: gzip, deflateX-SDK-CACHE: chs=0&imp=0&chf=0&ds=50583&fs=32345&sc=6X-SDK-HW-TOKEN: t=EwDgAppeBAAU+CVBfQcFvEv2DZI9cfqZBAbEzGMAAfA0VHhm7qezK4APppZ3iEIrEBslo2/7IEIq+JqOnNH93HDJTKoc0nYwCdKi9D5XEhMUJU9EmxK1c+tLkWzT6zXtH6WFUqgLXiwZbQTRr3n8KfSAkqrkH729yF12O69xwiMPYkPAI4xaIMTqFalpUAouDkaEVooRxlgAn9R6idvjYJMkpjgbzI54dxRFAeUxWTuShmx1HMXDbKzAVvGzdyP1orR7aA1kl4IP7TzYXnQG6tafhKsoqlCgXlrctshfqNT7WHD04e2L5IsYMbP92bwWyURBTPneeGT8ju2A8P00rYh/kcTCL0QpVLAZv4Ga7CVysLyfHWlQPxmRy/Y0Xi8DZgAACJEdmioOl7tJsAGjB+h3rNJS+K7usK2UqSPOmrh94da2dwf0KTOmzLX6byQsFWEwKeLpw9FmN5aeteInKovL0RNO8lMJMnvuVpr+iElRfI2Ac2/aBIi+l/dE9jkgM8lysAgeMT4GmxlOtp/4Js47f6gEQy8EQyq8bc35/3rmi5po+yQHWZoVc7+zkfeHGrsiOfldewKc9JQQtNGyWBMIDzitxt1987w8L6xF8d9B1JWtlYxJqds3JtvTw4tuO26vGyYKIFvGB2hX254xWlbM7QPEhg+ZvuMiY9w9+UqRIr1mC4xrsX8Yk0zIFgOsazyTk5R3ToavLQNOXzSBSLdvUvD1k8qU2ExUqH5MrOmfSKTaaEWL87YMSg3Si3wSIBSdcVoz1JUC8t0bbUGcMWD/B7ZnQxwyepINrDs/bbiA0+49YQyx1c1JNKBE8ueZaMJAnSZMTTicsl/H8uqkB2ZY1p8BVXAHg93WuW0AEGTBXn1drvT8e/cwmUVOov9U5qsxvNC6DRlioZDQjqfM/xODABxyEfBy9N7GBfuDu41bAA1Qw6o7EyzxTTYRI7okdLlokyhiAf5xLuSJbTrVAQ==&p=Cache-Control: no-cacheMS-CV: foeyWRrb202ym1fh.0User-Agent: WindowsShellClient/9.0.40929.0 (Windows)X-SDK-HWF: tch0,m301,m751,mA01,mT01Host: arc.msn.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v7.0/products/lookup?alternateId=PackageFamilyName&value=Disney.37853FC22B2CE_6rarf9sa4v8jt&market=US&languages=en-US%2Cen%2Cneutral&fieldsTemplate=InstallAgent&moId=Public&oemId=Public&scmId=Public HTTP/1.1Connection: Keep-AliveContent-Type: application/jsonUser-Agent: Install ServiceMS-CV: 4yBlBzYB50W/D4DA.0.2.4Host: displaycatalog.mp.microsoft.com
Source: global traffic	HTTP traffic detected: GET /v7.0/products/lookup?alternateId=PackageFamilyName&value=BytedancePte.Ltd.TikTok_6yccndn6064se&market=US&languages=en-US%2Cen%2Cneutral&fieldsTemplate=InstallAgent&moId=Public&oemId=Public&scmId=Public HTTP/1.1Connection: Keep-AliveContent-Type: application/jsonUser-Agent: Install ServiceMS-CV: J5fDZ3dp/E6NlhLQ.0.2.4Host: displaycatalog.mp.microsoft.com
Source: global traffic	HTTP traffic detected: GET /v7.0/products/lookup?alternateId=PackageFamilyName&value=AdobeSystemsIncorporated.AdobePhotoshopExpress_ynb6jyjzte8ga&market=US&languages=en-US%2Cen%2Cneutral&fieldsTemplate=InstallAgent&moId=Public&oemId=Public&scmId=Public HTTP/1.1Connection: Keep-AliveContent-Type: application/jsonUser-Agent: Install ServiceMS-CV: cZ3yMEfwOU6CVCq2.0.2.4Host: displaycatalog.mp.microsoft.com
Source: global traffic	HTTP traffic detected: GET /v7.0/products/lookup?alternateId=PackageFamilyName&value=AmazonVideo.PrimeVideo_pwbj9vvecjh7j&market=US&languages=en-US%2Cen%2Cneutral&fieldsTemplate=InstallAgent&moId=Public&oemId=Public&scmId=Public HTTP/1.1Connection: Keep-AliveContent-Type: application/jsonUser-Agent: Install ServiceMS-CV: toq2qvkdN02gSx45.0.2.4Host: displaycatalog.mp.microsoft.com
Source: global traffic	HTTP traffic detected: GET /v1/a/installComplete?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=7bea9c6752e64f029ce685c8c542b0ea&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=EDFEDF218D9D45DCFCE6280761E5CCC8&itemId=9WZDNCRFHWD2&skuId=0010&installKind=RedirectTile&ctid=store-curated-postoobe&bSrc=i.t&asid=63974762d02840d7974462f69b914a26&time=20211203T014439Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v7.0/products/lookup?alternateId=PackageFamilyName&value=SpotifyAB.SpotifyMusic_zpdnekdrzrea0&market=US&languages=en-US%2Cen%2Cneutral&fieldsTemplate=InstallAgent&moId=Public&oemId=Public&scmId=Public HTTP/1.1Connection: Keep-AliveContent-Type: application/jsonUser-Agent: Install ServiceMS-CV: ukCKqs+hgkCInH3j.0.2.4Host: displaycatalog.mp.microsoft.com
Source: global traffic	HTTP traffic detected: GET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=7bea9c6752e64f029ce685c8c542b0ea&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=EDFEDF218D9D45DCFCE6280761E5CCC8&itemId=9NBLGGGZM6WM&skuId=0010&installKind=RedirectTile&ctid=store-curated-postoobe&bSrc=i.t&asid=63974762d02840d7974462f69b914a26&time=20211203T014442Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=7bea9c6752e64f029ce685c8c542b0ea&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=EDFEDF218D9D45DCFCE6280761E5CCC8&itemId=9WZDNCRFHWD2&skuId=0010&installKind=RedirectTile&ctid=store-curated-postoobe&bSrc=i.t&asid=63974762d02840d7974462f69b914a26&time=20211203T014444Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v7.0/products/lookup?alternateId=PackageFamilyName&value=Microsoft.YourPhone_8wekyb3d8bbwe&market=US&languages=en-US%2Cen%2Cneutral&fieldsTemplate=InstallAgent&moId=Public&oemId=Public&scmId=Public HTTP/1.1Connection: Keep-AliveContent-Type: application/jsonUser-Agent: Install ServiceMS-CV: N8Uz2puroUCbAy9r.0.2.4Host: displaycatalog.mp.microsoft.com
Source: global traffic	HTTP traffic detected: GET /v1/a/installComplete?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=7bea9c6752e64f029ce685c8c542b0ea&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=EDFEDF218D9D45DCFCE6280761E5CCC8&itemId=9WZDNCRFHWD2&skuId=0010&installKind=RedirectTile&ctid=store-curated-postoobe&bSrc=i.t&asid=63974762d02840d7974462f69b914a26&time=20211203T014439Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v7.0/products/lookup?alternateId=PackageFamilyName&value=Microsoft.BingNews_8wekyb3d8bbwe&market=US&languages=en-US%2Cen%2Cneutral&fieldsTemplate=InstallAgent&moId=Public&oemId=Public&scmId=Public HTTP/1.1Connection: Keep-AliveContent-Type: application/jsonUser-Agent: Install ServiceMS-CV: ir6V+0W8BUW4j7HY.0.2.4Host: displaycatalog.mp.microsoft.com
Source: global traffic	HTTP traffic detected: GET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=7bea9c6752e64f029ce685c8c542b0ea&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=EDFEDF218D9D45DCFCE6280761E5CCC8&itemId=9NBLGGGZM6WM&skuId=0010&installKind=RedirectTile&ctid=store-curated-postoobe&bSrc=i.t&asid=63974762d02840d7974462f69b914a26&time=20211203T014442Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=7bea9c6752e64f029ce685c8c542b0ea&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=EDFEDF218D9D45DCFCE6280761E5CCC8&itemId=9WZDNCRFHWD2&skuId=0010&installKind=RedirectTile&ctid=store-curated-postoobe&bSrc=i.t&asid=63974762d02840d7974462f69b914a26&time=20211203T014444Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v1/a/impression?CID=128000000000402926&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&EID=&&PID=400089837&UIT=P-&TargetID=700129702&AN=1711748416&PG=PC000P0FR5.0000000IRT&REQASID=0088226D1BD8482E8A4C1ABCB6187F15&UNID=338388&ASID=74f1cc51a0624529807e60d8b128a273&PERSID=EDFEDF218D9D45DCFCE6280761E5CCC8&GLOBALDEVICEID=6966522972481462&LOCALID=w:BE8AB8DF-DCD1-3523-4A95-3A04EAFF1CBA&DS_APPID=iris-startmenu-1&DS_RESULT=2&DS_EVTID=67bb770ab37e4817864f0c5a17e52389&DEVOSVER=10.0.17134.1&REQT=20211202T164442&TIME=20211203T014520Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=7bea9c6752e64f029ce685c8c542b0ea&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=EDFEDF218D9D45DCFCE6280761E5CCC8&itemId=9NH2GPH4JZS4&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=63974762d02840d7974462f69b914a26&time=20211203T014445Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v1/a/impression?CID=128000000000402926&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&EID=&&PID=400089837&UIT=P-&TargetID=700129702&AN=1711748416&PG=PC000P0FR5.0000000IRT&REQASID=0088226D1BD8482E8A4C1ABCB6187F15&UNID=338388&ASID=74f1cc51a0624529807e60d8b128a273&PERSID=EDFEDF218D9D45DCFCE6280761E5CCC8&GLOBALDEVICEID=6966522972481462&LOCALID=w:BE8AB8DF-DCD1-3523-4A95-3A04EAFF1CBA&DS_APPID=iris-startmenu-1&DS_RESULT=2&DS_EVTID=67bb770ab37e4817864f0c5a17e52389&DEVOSVER=10.0.17134.1&REQT=20211202T164442&TIME=20211203T014524Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=7bea9c6752e64f029ce685c8c542b0ea&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=EDFEDF218D9D45DCFCE6280761E5CCC8&itemId=9NBLGGH6J6VK&skuId=0010&installKind=RedirectTile&ctid=store-curated-postoobe&bSrc=i.t&asid=63974762d02840d7974462f69b914a26&time=20211203T014446Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=7bea9c6752e64f029ce685c8c542b0ea&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=EDFEDF218D9D45DCFCE6280761E5CCC8&itemId=9P6RC76MSMMJ&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=63974762d02840d7974462f69b914a26&time=20211203T014450Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=7bea9c6752e64f029ce685c8c542b0ea&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=EDFEDF218D9D45DCFCE6280761E5CCC8&itemId=9WZDNCRFJ27N&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=63974762d02840d7974462f69b914a26&time=20211203T014450Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=7bea9c6752e64f029ce685c8c542b0ea&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=EDFEDF218D9D45DCFCE6280761E5CCC8&itemId=9N0866FS04W8&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=63974762d02840d7974462f69b914a26&time=20211203T014452Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=7bea9c6752e64f029ce685c8c542b0ea&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=EDFEDF218D9D45DCFCE6280761E5CCC8&itemId=9WZDNCRFJ10M&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=63974762d02840d7974462f69b914a26&time=20211203T014454Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=7bea9c6752e64f029ce685c8c542b0ea&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=EDFEDF218D9D45DCFCE6280761E5CCC8&itemId=9WZDNCRFJ140&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=63974762d02840d7974462f69b914a26&time=20211203T014456Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=7bea9c6752e64f029ce685c8c542b0ea&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=EDFEDF218D9D45DCFCE6280761E5CCC8&itemId=9NC2FBTHCJV8&skuId=0010&installKind=RedirectTile&ctid=store-curated-postoobe&bSrc=i.t&asid=63974762d02840d7974462f69b914a26&time=20211203T014458Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=7bea9c6752e64f029ce685c8c542b0ea&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=EDFEDF218D9D45DCFCE6280761E5CCC8&itemId=9NBLGGH1CQ7L&skuId=0010&installKind=RedirectTile&ctid=store-curated-postoobe&bSrc=i.t&asid=63974762d02840d7974462f69b914a26&time=20211203T014459Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v1/a/impression?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=7bea9c6752e64f029ce685c8c542b0ea&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=EDFEDF218D9D45DCFCE6280761E5CCC8&bSrc=i.t&time=20211203T014500Z&asid=63974762d02840d7974462f69b914a26&eid= HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v1/a/installComplete?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106554&cid=128000000001392709&tid=700342084&reqasid=1c8afb3a5db64f4e90c9067d7d98fa05&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=EDFEDF218D9D45DCFCE6280761E5CCC8&itemId=9WZDNCRFJ3Q2&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=12abbb80fe114444b71363aa8dbddb7a&time=20211203T014507Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v1/a/installComplete?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106554&cid=128000000001392709&tid=700342084&reqasid=1c8afb3a5db64f4e90c9067d7d98fa05&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=EDFEDF218D9D45DCFCE6280761E5CCC8&itemId=9WZDNCRFJ3P2&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=12abbb80fe114444b71363aa8dbddb7a&time=20211203T014508Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v1/a/installComplete?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106554&cid=128000000001392709&tid=700342084&reqasid=1c8afb3a5db64f4e90c9067d7d98fa05&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=EDFEDF218D9D45DCFCE6280761E5CCC8&itemId=9NBLGGH5FV99&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=12abbb80fe114444b71363aa8dbddb7a&time=20211203T014512Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106554&cid=128000000001392709&tid=700342084&reqasid=1c8afb3a5db64f4e90c9067d7d98fa05&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=EDFEDF218D9D45DCFCE6280761E5CCC8&itemId=9NXQXXLFST89&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=12abbb80fe114444b71363aa8dbddb7a&time=20211203T014513Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106554&cid=128000000001392709&tid=700342084&reqasid=1c8afb3a5db64f4e90c9067d7d98fa05&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=EDFEDF218D9D45DCFCE6280761E5CCC8&itemId=9WZDNCRFJ3Q2&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=12abbb80fe114444b71363aa8dbddb7a&time=20211203T014514Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106554&cid=128000000001392709&tid=700342084&reqasid=1c8afb3a5db64f4e90c9067d7d98fa05&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=EDFEDF218D9D45DCFCE6280761E5CCC8&itemId=9WZDNCRFHVFW&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=12abbb80fe114444b71363aa8dbddb7a&time=20211203T014518Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106554&cid=128000000001392709&tid=700342084&reqasid=1c8afb3a5db64f4e90c9067d7d98fa05&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=EDFEDF218D9D45DCFCE6280761E5CCC8&itemId=9NCBCSZSJRSB&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=12abbb80fe114444b71363aa8dbddb7a&time=20211203T014519Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106554&cid=128000000001392709&tid=700342084&reqasid=1c8afb3a5db64f4e90c9067d7d98fa05&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=EDFEDF218D9D45DCFCE6280761E5CCC8&itemId=9NMPJ99VJBWV&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=12abbb80fe114444b71363aa8dbddb7a&time=20211203T014520Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106554&cid=128000000001392709&tid=700342084&reqasid=1c8afb3a5db64f4e90c9067d7d98fa05&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=EDFEDF218D9D45DCFCE6280761E5CCC8&itemId=9NBLGGH5FV99&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=12abbb80fe114444b71363aa8dbddb7a&time=20211203T014524Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106554&cid=128000000001392709&tid=700342084&reqasid=1c8afb3a5db64f4e90c9067d7d98fa05&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=EDFEDF218D9D45DCFCE6280761E5CCC8&itemId=9WZDNCRDFNG7&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=12abbb80fe114444b71363aa8dbddb7a&time=20211203T014525Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v1/a/impression?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106554&cid=128000000001392709&tid=700342084&reqasid=1c8afb3a5db64f4e90c9067d7d98fa05&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=EDFEDF218D9D45DCFCE6280761E5CCC8&bSrc=i.t&time=20211203T014526Z&asid=12abbb80fe114444b71363aa8dbddb7a&eid= HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /uploads/send/pics/Stifel_bg_image.png HTTP/1.1Host: www.ciplla.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/*,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /uploads/send/pics/Stifel_lg_image.png HTTP/1.1Host: www.ciplla.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/*,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9

URLs found in memory or binary data

Source: angular.js.0.dr	String found in binary or memory: http://angularjs.org
Source: angular.js.0.dr	String found in binary or memory: http://errors.angularjs.org/1.6.4-local
Source: pnacl_public_x86_64_pnacl_sz_nexe.0.dr, pnacl_public_x86_64_pnacl_llc_nexe.0.dr	String found in binary or memory: http://llvm.org/):
Source: mirroring_hangouts.js.0.dr	String found in binary or memory: http://tools.ietf.org/html/rfc1950
Source: mirroring_hangouts.js.0.dr	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: data_1.1.dr	String found in binary or memory: http://www.ciplla.com/uploads/send/pics/Stifel_bg_image.png
Source: data_1.1.dr	String found in binary or memory: http://www.ciplla.com/uploads/send/pics/Stifel_lg_image.png
Source: data_1.1.dr	String found in binary or memory: http://www.ciplla.com/uploads/send/pics/Stifel_lg_image.pngD
Source: mirroring_hangouts.js.0.dr	String found in binary or memory: http://www.ietf.org/id/draft-holmer-rmcat-transport-wide-cc-extensions
Source: mirroring_hangouts.js.0.dr	String found in binary or memory: http://www.ietf.org/id/draft-holmer-rmcat-transport-wide-cc-extensions-01
Source: manifest.json0.0.dr	String found in binary or memory: https://accounts.google.com
Source: craw_window.js.0.dr	String found in binary or memory: https://accounts.google.com/MergeSession
Source: data_1.1.dr	String found in binary or memory: https://ajax.googleapis.com/ajax/libs/jquery/3.5.1/jquery.min.js
Source: data_1.1.dr	String found in binary or memory: https://ajax.googleapis.com/ajax/libs/jquery/3.5.1/jquery.min.jsW
Source: manifest.json0.0.dr	String found in binary or memory: https://apis.google.com
Source: data_1.1.dr	String found in binary or memory: https://baddogand.co.uk/newantibot.js?PvsoX4b7Hz=a2l0dHJlZGdla0BzdGlmZWwuY29t&WcupjXToVuiP8je=YmlnYm
Source: pnacl_public_x86_64_crtend_o.0.dr, pnacl_public_x86_64_ld_nexe.0.dr	String found in binary or memory: https://chromium.googlesource.com/a/native_client/pnacl-clang.git
Source: pnacl_public_x86_64_crtend_o.0.dr, pnacl_public_x86_64_ld_nexe.0.dr	String found in binary or memory: https://chromium.googlesource.com/a/native_client/pnacl-llvm.git
Source: mirroring_hangouts.js.0.dr	String found in binary or memory: https://clients2.google.com/cr/report
Source: manifest.json1.0.dr, manifest.json0.0.dr, manifest.json.0.dr	String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: mirroring_hangouts.js.0.dr	String found in binary or memory: https://clients6.google.com
Source: pnacl_public_x86_64_ld_nexe.0.dr	String found in binary or memory: https://code.google.com/p/nativeclient/issues/entry
Source: pnacl_public_x86_64_ld_nexe.0.dr	String found in binary or memory: https://code.google.com/p/nativeclient/issues/entry%s:
Source: manifest.json0.0.dr	String found in binary or memory: https://content.googleapis.com
Source: mirroring_hangouts.js.0.dr	String found in binary or memory: https://creativecommons.org/publicdomain/zero/1.0/.
Source: Reporting and NEL.1.dr	String found in binary or memory: https://csp.withgoogle.com/csp/report-to/IdentityListAccountsHttp/external
Source: Reporting and NEL.1.dr	String found in binary or memory: https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers
Source: 23c12036-5bb8-470c-a800-ddfd8bf50d8d.tmp.1.dr	String found in binary or memory: https://dns.google
Source: manifest.json0.0.dr	String found in binary or memory: https://feedback.googleusercontent.com
Source: manifest.json0.0.dr	String found in binary or memory: https://fonts.googleapis.com;
Source: manifest.json0.0.dr	String found in binary or memory: https://fonts.gstatic.com;
Source: material_css_min.css.0.dr, angular.js.0.dr	String found in binary or memory: https://github.com/angular/material
Source: craw_window.js.0.dr, craw_background.js.0.dr	String found in binary or memory: https://github.com/google/closure-library/wiki/goog.module:-an-ES6-module-like-alternative-to-goog.p
Source: mirroring_hangouts.js.0.dr	String found in binary or memory: https://github.com/madler/zlib/blob/master/zlib.h
Source: mirroring_hangouts.js.0.dr	String found in binary or memory: https://hangouts.clients6.google.com
Source: manifest.json0.0.dr	String found in binary or memory: https://hangouts.google.com/
Source: mirroring_hangouts.js.0.dr	String found in binary or memory: https://hangouts.google.com/hangouts/_/logpref
Source: data_1.1.dr	String found in binary or memory: https://i.ibb.co/3C2ZWFn/download01.gif
Source: mirroring_hangouts.js.0.dr	String found in binary or memory: https://meetings.clients6.google.com
Source: craw_window.js.0.dr, manifest.json.0.dr	String found in binary or memory: https://payments.google.com/payments/v4/js/integrator.js
Source: mirroring_hangouts.js.0.dr	String found in binary or memory: https://play.google.com/log?format=json&hasfast=true
Source: mirroring_hangouts.js.0.dr	String found in binary or memory: https://preprod-hangouts-googleapis.sandbox.google.com
Source: data_1.1.dr	String found in binary or memory: https://r4---sn-h0jelnes.gvt1.com/edgedl/chrome/dict/en-us-9-0.bdic?cms_redirect=yes&mh=I2&mip=84.17
Source: data_1.1.dr	String found in binary or memory: https://redirector.gvt1.com/edgedl/chrome/dict/en-us-9-0.bdic
Source: data_1.1.dr	String found in binary or memory: https://redirector.gvt1.com/edgedl/chrome/dict/en-us-9-0.bdicn
Source: craw_window.js.0.dr, manifest.json.0.dr	String found in binary or memory: https://sandbox.google.com/payments/v4/js/integrator.js
Source: messages.json66.0.dr, messages.json5.0.dr, messages.json7.0.dr, messages.json37.0.dr, feedback.html.0.dr, messages.json23.0.dr, messages.json69.0.dr, messages.json75.0.dr, messages.json71.0.dr, messages.json83.0.dr, messages.json79.0.dr, messages.json25.0.dr, messages.json82.0.dr, messages.json54.0.dr, messages.json70.0.dr, messages.json74.0.dr, messages.json39.0.dr, messages.json85.0.dr, messages.json88.0.dr, messages.json87.0.dr, messages.json18.0.dr, messages.json76.0.dr, messages.json80.0.dr, messages.json68.0.dr, messages.json67.0.dr, messages.json9.0.dr, messages.json8.0.dr, messages.json78.0.dr, messages.json2.0.dr, messages.json52.0.dr, messages.json81.0.dr	String found in binary or memory: https://support.google.com/chromecast/answer/2998456
Source: messages.json66.0.dr, messages.json5.0.dr, messages.json7.0.dr, messages.json37.0.dr, feedback.html.0.dr, messages.json23.0.dr, messages.json69.0.dr, messages.json75.0.dr, messages.json71.0.dr, messages.json83.0.dr, messages.json79.0.dr, messages.json25.0.dr, messages.json82.0.dr, messages.json54.0.dr, messages.json70.0.dr, messages.json74.0.dr, messages.json39.0.dr, messages.json85.0.dr, messages.json88.0.dr, messages.json87.0.dr, messages.json18.0.dr, messages.json76.0.dr, messages.json80.0.dr, messages.json68.0.dr, messages.json67.0.dr, messages.json9.0.dr, messages.json8.0.dr, messages.json78.0.dr, messages.json2.0.dr, messages.json52.0.dr, messages.json81.0.dr	String found in binary or memory: https://support.google.com/chromecast/troubleshooter/2995236
Source: craw_window.js.0.dr, craw_background.js.0.dr	String found in binary or memory: https://www-googleapis-staging.sandbox.google.com
Source: data_1.1.dr	String found in binary or memory: https://www.ciplla.com/uploads/send/pics/download02.png
Source: data_1.1.dr	String found in binary or memory: https://www.ciplla.com/uploads/send/pics/download_35.jpeg
Source: data_1.1.dr	String found in binary or memory: https://www.ciplla.com/uploads/send/pics/favicon_24.ico
Source: manifest.json0.0.dr	String found in binary or memory: https://www.google.com
Source: manifest.json.0.dr	String found in binary or memory: https://www.google.com/
Source: craw_window.js.0.dr	String found in binary or memory: https://www.google.com/accounts/OAuthLogin?issueuberauth=1
Source: craw_window.js.0.dr	String found in binary or memory: https://www.google.com/images/cleardot.gif
Source: craw_window.js.0.dr	String found in binary or memory: https://www.google.com/images/dot2.gif
Source: craw_window.js.0.dr	String found in binary or memory: https://www.google.com/images/x2.gif
Source: craw_background.js.0.dr	String found in binary or memory: https://www.google.com/intl/en-US/chrome/blank.html
Source: mirroring_hangouts.js.0.dr	String found in binary or memory: https://www.google.com/log?format=json&hasfast=true
Source: manifest.json0.0.dr	String found in binary or memory: https://www.google.com;
Source: craw_window.js.0.dr, craw_background.js.0.dr	String found in binary or memory: https://www.googleapis.com
Source: manifest.json.0.dr	String found in binary or memory: https://www.googleapis.com/
Source: manifest.json0.0.dr	String found in binary or memory: https://www.googleapis.com/auth/calendar.readonly
Source: manifest.json0.0.dr	String found in binary or memory: https://www.googleapis.com/auth/cast-edu-messaging
Source: manifest.json.0.dr	String found in binary or memory: https://www.googleapis.com/auth/chromewebstore
Source: manifest.json.0.dr	String found in binary or memory: https://www.googleapis.com/auth/chromewebstore.readonly
Source: manifest.json0.0.dr	String found in binary or memory: https://www.googleapis.com/auth/clouddevices
Source: manifest.json0.0.dr	String found in binary or memory: https://www.googleapis.com/auth/hangouts
Source: manifest.json0.0.dr	String found in binary or memory: https://www.googleapis.com/auth/hangouts.readonly
Source: manifest.json0.0.dr	String found in binary or memory: https://www.googleapis.com/auth/meetings
Source: manifest.json0.0.dr	String found in binary or memory: https://www.googleapis.com/auth/plus.peopleapi.readwrite
Source: manifest.json.0.dr	String found in binary or memory: https://www.googleapis.com/auth/sierra
Source: manifest.json.0.dr	String found in binary or memory: https://www.googleapis.com/auth/sierrasandbox
Source: manifest.json0.0.dr	String found in binary or memory: https://www.googleapis.com/auth/userinfo.email
Source: manifest.json0.0.dr	String found in binary or memory: https://www.gstatic.com;

Posts data to webserver

Source: unknown

HTTP traffic detected: POST /RST2.srf HTTP/1.0Connection: Keep-AliveContent-Type: application/soap+xmlAccept: */*User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 18.10.0.17134.0.0; IDCRL-cfg 16.000.27716.00; App svchost.exe, 10.0.17134.1, {DF60E2DF-88AD-4526-AE21-83D130EF0F68})Content-Length: 4740Host: login.live.com

Uses secure TLS version for HTTPS connections

Source: unknown	HTTPS traffic detected: 35.228.118.158:443 -> 192.168.2.6:49781 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.49.157.6:443 -> 192.168.2.6:49807 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.49.157.6:443 -> 192.168.2.6:49808 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.199.120.85:443 -> 192.168.2.6:49814 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.50.102.62:443 -> 192.168.2.6:49815 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.50.102.62:443 -> 192.168.2.6:49816 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.199.120.85:443 -> 192.168.2.6:49817 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.199.120.151:443 -> 192.168.2.6:49821 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 80.67.82.211:443 -> 192.168.2.6:49823 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 80.67.82.211:443 -> 192.168.2.6:49822 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 80.67.82.211:443 -> 192.168.2.6:49825 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 80.67.82.211:443 -> 192.168.2.6:49824 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 80.67.82.211:443 -> 192.168.2.6:49826 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.35.236.56:443 -> 192.168.2.6:49831 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.199.120.85:443 -> 192.168.2.6:49837 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.199.120.85:443 -> 192.168.2.6:49840 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.91.112.76:443 -> 192.168.2.6:49841 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.91.112.76:443 -> 192.168.2.6:49843 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.54.110.249:443 -> 192.168.2.6:49845 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.54.110.249:443 -> 192.168.2.6:49847 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.112.88.60:443 -> 192.168.2.6:49849 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.54.110.249:443 -> 192.168.2.6:49848 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.54.110.249:443 -> 192.168.2.6:49852 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.54.110.249:443 -> 192.168.2.6:49855 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.199.120.85:443 -> 192.168.2.6:49881 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.199.120.151:443 -> 192.168.2.6:49883 version: TLS 1.2

System Summary:

HTML document with suspicious title

Source: file:///C:/Users/user/Desktop/fel.com.html

Tab title: Sign in to continue

Creates temporary files

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Local\Temp\ac185d13-520b-45ca-a4c3-df35daa8695b.tmp

Jump to behavior

Classification label

Source: classification engine

Classification label: mal68.phis.winHTML@32/263@7/11

Spawns processes

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --enable-automation "C:\Users\user\Desktop\fel.com.html
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1520,12419171399883482259,7756949574487736782,131072 --lang=en-US --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1904 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1520,12419171399883482259,7756949574487736782,131072 --lang=en-US --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1904 /prefetch:8			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior

Creates files inside the program directory

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Program Files\Google\Chrome\Application\Dictionaries

Jump to behavior

Creates files inside the user directory

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\BrowserMetrics\BrowserMetrics-61A9764C-1BC8.pma

Jump to behavior

Creates a directory in C:\Program Files

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\Google\Chrome\Application\Dictionaries			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\Google\Chrome\Application\Dictionaries\en-US-9-0.bdic			Jump to behavior