Edit tour

Windows Analysis Report
https://eccfo1.eu/1f34fac4-2ab4-4dfb-8248-a8cdec56b8f9/bS5iYWtrZXJAYnBkLm5s

Overview

General Information

Sample URL:	https://eccfo1.eu/1f34fac4-2ab4-4dfb-8248-a8cdec56b8f9/bS5iYWtrZXJAYnBkLm5s
Analysis ID:	612086
Infos:

Detection

Score:	52
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Phishing site detected (based on image similarity)

No HTML title found

Classification

Process Tree

System is w10x64

chrome.exe (PID: 1944 cmdline: C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --enable-automation "https://eccfo1.eu/1f34fac4-2ab4-4dfb-8248-a8cdec56b8f9/bS5iYWtrZXJAYnBkLm5s MD5: C139654B5C1438A95B321BB01AD63EF6)

chrome.exe (PID: 5644 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1588,15692047485436063496,8923512637063361634,131072 --lang=en-US --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1944 /prefetch:8 MD5: C139654B5C1438A95B321BB01AD63EF6)

cleanup

HTTP traffic detected: POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1Host: accounts.google.comConnection: keep-aliveContent-Length: 1Origin: https://www.google.comContent-Type: application/x-www-form-urlencodedSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: https://www.office.com/	HTTP Parser: HTML title missing
Source: https://www.office.com/	HTTP Parser: HTML title missing

Source: https://www.office.com/	HTTP Parser: No <meta name="author".. found
Source: https://www.office.com/	HTTP Parser: No <meta name="author".. found

Source: https://www.office.com/	HTTP Parser: No <meta name="copyright".. found
Source: https://www.office.com/	HTTP Parser: No <meta name="copyright".. found

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\Google\Chrome\Application\Dictionaries			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\Google\Chrome\Application\Dictionaries\en-US-9-0.bdic			Jump to behavior

Source: unknown	HTTPS traffic detected: 185.163.85.65:443 -> 192.168.2.3:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.163.85.65:443 -> 192.168.2.3:49742 version: TLS 1.2

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50414
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 50414 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50054
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50029
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49698
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 50165 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50185
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 50029 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50843 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49803
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 50040 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50752
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50842 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50040
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 50752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49698 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50842
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50054 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50165
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50185 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747

Source: global traffic	HTTP traffic detected: GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=85.0.4183.121&lang=en-US&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1&x=id%3Dpkedcjkdefgpdelpbcmbmeomcjbeemfm%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1Host: clients2.google.comConnection: keep-aliveX-Goog-Update-Interactivity: fgX-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmieda,pkedcjkdefgpdelpbcmbmeomcjbeemfmX-Goog-Update-Updater: chromecrx-85.0.4183.121Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /1f34fac4-2ab4-4dfb-8248-a8cdec56b8f9/bS5iYWtrZXJAYnBkLm5s HTTP/1.1Host: eccfo1.euConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/windows_logo.png HTTP/1.1Host: eccfo1.euConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://eccfo1.eu/1f34fac4-2ab4-4dfb-8248-a8cdec56b8f9/bS5iYWtrZXJAYnBkLm5sAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/icon_check.png HTTP/1.1Host: eccfo1.euConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://eccfo1.eu/1f34fac4-2ab4-4dfb-8248-a8cdec56b8f9/bS5iYWtrZXJAYnBkLm5sAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/Background.jpg HTTP/1.1Host: eccfo1.euConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://eccfo1.eu/1f34fac4-2ab4-4dfb-8248-a8cdec56b8f9/bS5iYWtrZXJAYnBkLm5sAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: eccfo1.euConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://eccfo1.eu/1f34fac4-2ab4-4dfb-8248-a8cdec56b8f9/bS5iYWtrZXJAYnBkLm5sAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/Background.jpg HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: eccfo1.eu
Source: global traffic	HTTP traffic detected: GET /static/windows_logo.png HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: eccfo1.eu
Source: global traffic	HTTP traffic detected: GET /static/icon_check.png HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: eccfo1.eu
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: www.office.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /meversion?partner=office&market=en-us&uhf=1 HTTP/1.1Host: mem.gfx.msConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.office.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /mscc/lib/v2/wcp-consent.js HTTP/1.1Host: wcpstatic.microsoft.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.office.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /scripts/me/MeControl/10.21162.3/en-US/meBoot.min.js HTTP/1.1Host: mem.gfx.msConnection: keep-aliveOrigin: https://www.office.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.office.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /sw?cdnDomain=res.cdn.office.net/officehub&workload=officehome HTTP/1.1Host: www.office.comConnection: keep-aliveCache-Control: max-age=0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: /Service-Worker: scriptSec-Fetch-Site: same-originSec-Fetch-Mode: same-originSec-Fetch-Dest: serviceworkerReferer: https://www.office.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: OH.SID=f0c36293-6b4d-4da0-acec-3188508b41e6; OH.DCAffinity=OH-weu; OH.FLID=dcc9a78d-5ce4-4bf8-bc2c-2745c3d2072c; MUID=0AB22FE83C71638E10A33E643D0A6238; MSFPC=GUID=587d50bfc2a149aca238a67d4b7ec83d&HASH=587d&LV=202204&V=4&LU=1650459569395
Source: global traffic	HTTP traffic detected: GET /scripts/me/MeControl/10.21162.3/en-US/meCore.min.js HTTP/1.1Host: mem.gfx.msConnection: keep-aliveOrigin: https://www.office.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.office.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /c.gif?DI=4050&did=1&t=&CtsSyncId=B1BED8FFFBD34A5C951B4273A8E67A1D&RedC=c1.microsoft.com&MXFR=376D41D8FED76C0E172E5054FAD76A18 HTTP/1.1Host: c.bing.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.office.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /crx/blobs/Acy1k0bLIjHsvnKaKN_oRpVaYYvFs25d7GKYF1WXrT6yizCMksBO0c_ggE0B6tx6HPRHe6q1GOEe3_NcIbSiGG8kXeLMUY0sAKVvC6R89zvKM13s5VqoAMZSmuUgjQL5vlygJuArQghXXE_qTL7NlQ/extension_8520_615_0_5.crx HTTP/1.1Host: clients2.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /meversion?partner=MSHomePage&market=de-ch&uhf=1 HTTP/1.1Host: mem.gfx.msConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.microsoft.com/de-ch/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /scripts/me/MeControl/10.21162.3/de-DE/meBoot.min.js HTTP/1.1Host: mem.gfx.msConnection: keep-aliveOrigin: https://www.microsoft.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.microsoft.com/de-ch/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /scripts/me/MeControl/10.21162.3/de-DE/meCore.min.js HTTP/1.1Host: mem.gfx.msConnection: keep-aliveOrigin: https://www.microsoft.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.microsoft.com/de-ch/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /meversion?partner=officetemplates&market=en-us&uhf=1 HTTP/1.1Host: mem.gfx.msConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://templates.office.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /meversion?partner=SMCConvergence&market=en-us&uhf=1 HTTP/1.1Host: mem.gfx.msConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://support.microsoft.com/en-us/office?ui=en-us&rs=en-us&ad=usAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: 1c24b8db-b3a5-4ee8-bec0-cf737a423ed5.tmp.1.dr, b549085d-74d3-46da-a233-cd98b3b9bbd4.tmp.1.dr	String found in binary or memory: https://accounts.google.com
Source: 2cc80dabc69f58b6_1.0.dr	String found in binary or memory: https://api.onedrive.com/v1.0/drive/root
Source: 1c24b8db-b3a5-4ee8-bec0-cf737a423ed5.tmp.1.dr, b549085d-74d3-46da-a233-cd98b3b9bbd4.tmp.1.dr	String found in binary or memory: https://apis.google.com
Source: 1c24b8db-b3a5-4ee8-bec0-cf737a423ed5.tmp.1.dr, b549085d-74d3-46da-a233-cd98b3b9bbd4.tmp.1.dr	String found in binary or memory: https://clients2.google.com
Source: manifest.json.0.dr	String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: 1c24b8db-b3a5-4ee8-bec0-cf737a423ed5.tmp.1.dr, b549085d-74d3-46da-a233-cd98b3b9bbd4.tmp.1.dr	String found in binary or memory: https://clients2.googleusercontent.com
Source: 1c24b8db-b3a5-4ee8-bec0-cf737a423ed5.tmp.1.dr, c7ba09d0-7de1-45fe-8a56-3a1f445c67f0.tmp.1.dr, b549085d-74d3-46da-a233-cd98b3b9bbd4.tmp.1.dr	String found in binary or memory: https://dns.google
Source: History Provider Cache.0.dr	String found in binary or memory: https://eccfo1.eu/1f34fac4-2ab4-4dfb-8248-a8cdec56b8f9/bS5iYWtrZXJAYnBkLm5s2
Source: 1c24b8db-b3a5-4ee8-bec0-cf737a423ed5.tmp.1.dr	String found in binary or memory: https://fonts.googleapis.com
Source: 1c24b8db-b3a5-4ee8-bec0-cf737a423ed5.tmp.1.dr, b549085d-74d3-46da-a233-cd98b3b9bbd4.tmp.1.dr	String found in binary or memory: https://fonts.gstatic.com
Source: 1c24b8db-b3a5-4ee8-bec0-cf737a423ed5.tmp.1.dr, b549085d-74d3-46da-a233-cd98b3b9bbd4.tmp.1.dr	String found in binary or memory: https://ogs.google.com
Source: manifest.json.0.dr	String found in binary or memory: https://payments.google.com/payments/v4/js/integrator.js
Source: 1c24b8db-b3a5-4ee8-bec0-cf737a423ed5.tmp.1.dr, b549085d-74d3-46da-a233-cd98b3b9bbd4.tmp.1.dr	String found in binary or memory: https://play.google.com
Source: b549085d-74d3-46da-a233-cd98b3b9bbd4.tmp.1.dr	String found in binary or memory: https://r5---sn-4g5edn6r.gvt1.com
Source: b549085d-74d3-46da-a233-cd98b3b9bbd4.tmp.1.dr	String found in binary or memory: https://redirector.gvt1.com
Source: c4cda97bb6908608_0.0.dr	String found in binary or memory: https://res.cdn.office.net/officehub/bundles/0.1084f963ccf1e5efe263.chunk.v6.jsH
Source: c4cda97bb6908608_0.0.dr	String found in binary or memory: https://res.cdn.office.net/officehub/bundles/0.1084f963ccf1e5efe263.chunk.v6.jsHP
Source: 1e33ede7037c06b6_0.0.dr	String found in binary or memory: https://res.cdn.office.net/officehub/bundles/1.fd278158fa9d8b20bceb.chunk.v6.jsH
Source: 1e33ede7037c06b6_0.0.dr	String found in binary or memory: https://res.cdn.office.net/officehub/bundles/1.fd278158fa9d8b20bceb.chunk.v6.jsHP
Source: ef132878ad19e2a9_0.0.dr	String found in binary or memory: https://res.cdn.office.net/officehub/bundles/11.798076ff0c72108d10d9.chunk.v6.js/
Source: ef132878ad19e2a9_0.0.dr	String found in binary or memory: https://res.cdn.office.net/officehub/bundles/11.798076ff0c72108d10d9.chunk.v6.jsH
Source: ef132878ad19e2a9_0.0.dr	String found in binary or memory: https://res.cdn.office.net/officehub/bundles/11.798076ff0c72108d10d9.chunk.v6.jsHP
Source: d2ec45260bc56989_0.0.dr	String found in binary or memory: https://res.cdn.office.net/officehub/bundles/2.56c3466450fa3caeadef.chunk.v6.js(window.officehome_we
Source: d2ec45260bc56989_0.0.dr	String found in binary or memory: https://res.cdn.office.net/officehub/bundles/2.56c3466450fa3caeadef.chunk.v6.jsH
Source: d2ec45260bc56989_0.0.dr	String found in binary or memory: https://res.cdn.office.net/officehub/bundles/2.56c3466450fa3caeadef.chunk.v6.jsHP
Source: a550abe32264d142_0.0.dr	String found in binary or memory: https://res.cdn.office.net/officehub/bundles/3.ea9cbde63ad89ac51218.chunk.v6.jsH
Source: a550abe32264d142_0.0.dr	String found in binary or memory: https://res.cdn.office.net/officehub/bundles/3.ea9cbde63ad89ac51218.chunk.v6.jsHP
Source: 78f8433443804b69_0.0.dr	String found in binary or memory: https://res.cdn.office.net/officehub/bundles/4.34c0ddb1f9655892d176.chunk.v6.js(window.officehome_we
Source: 78f8433443804b69_0.0.dr	String found in binary or memory: https://res.cdn.office.net/officehub/bundles/4.34c0ddb1f9655892d176.chunk.v6.jsH
Source: 78f8433443804b69_0.0.dr	String found in binary or memory: https://res.cdn.office.net/officehub/bundles/4.34c0ddb1f9655892d176.chunk.v6.jsHP
Source: 3a82c52a9f5c535e_0.0.dr	String found in binary or memory: https://res.cdn.office.net/officehub/bundles/6.bb3c64a464eb6c7e03fb.chunk.v6.jsH
Source: 3a82c52a9f5c535e_0.0.dr	String found in binary or memory: https://res.cdn.office.net/officehub/bundles/6.bb3c64a464eb6c7e03fb.chunk.v6.jsHP
Source: d41d89949079b45d_0.0.dr	String found in binary or memory: https://res.cdn.office.net/officehub/bundles/7.9525c69adf30ccb6bbe7.chunk.v6.jsH
Source: d41d89949079b45d_0.0.dr	String found in binary or memory: https://res.cdn.office.net/officehub/bundles/7.9525c69adf30ccb6bbe7.chunk.v6.jsHP
Source: 2cd1b97aa306dd0f_0.0.dr	String found in binary or memory: https://res.cdn.office.net/officehub/bundles/officehome-async-styles.905b2cdbf3c642aad946.chunk.v6.j
Source: 3e87be93f887937a_0.0.dr	String found in binary or memory: https://res.cdn.office.net/officehub/bundles/officehome-async-styles.c8a41d69674f50299790.chunk.v6.c
Source: 9bb2c13ad1549e8b_1.0.dr	String found in binary or memory: https://res.cdn.office.net/officehub/bundles/otel-logger-2b087f173d4bf7a684cc.js
Source: 9bb2c13ad1549e8b_0.0.dr	String found in binary or memory: https://res.cdn.office.net/officehub/bundles/otel-logger-2b087f173d4bf7a684cc.js/
Source: 9bb2c13ad1549e8b_0.0.dr	String found in binary or memory: https://res.cdn.office.net/officehub/bundles/otel-logger-2b087f173d4bf7a684cc.jsH
Source: 9bb2c13ad1549e8b_0.0.dr	String found in binary or memory: https://res.cdn.office.net/officehub/bundles/otel-logger-2b087f173d4bf7a684cc.jsHP
Source: 9bb2c13ad1549e8b_1.0.dr	String found in binary or memory: https://res.cdn.office.net/officehub/bundles/otel-logger-2b087f173d4bf7a684cc.jsa
Source: 9bb2c13ad1549e8b_1.0.dr	String found in binary or memory: https://res.cdn.office.net/officehub/bundles/otel-logger-2b087f173d4bf7a684cc.jsaD
Source: 35e53ccd3cabf975_0.0.dr	String found in binary or memory: https://res.cdn.office.net/officehub/bundles/vendors~action-context-menu-rc~app-gallery-rc~appbar~cc
Source: 0e751cd85ef9bf6a_0.0.dr	String found in binary or memory: https://res.cdn.office.net/officehub/bundles/vendors~action-context-menu-rc~app-host-component~appba
Source: 52ee4db59ff83c5f_0.0.dr	String found in binary or memory: https://res.cdn.office.net/officehub/bundles/vendors~app-host-component~appbar~cc~confirmation-dialo
Source: fa813c9ad67834ac_1.0.dr	String found in binary or memory: https://res.cdn.office.net/officehub/versionless/workbox-v3.6.2/workbox-cache-expiration.prod.jsa
Source: fa813c9ad67834ac_1.0.dr	String found in binary or memory: https://res.cdn.office.net/officehub/versionless/workbox-v3.6.2/workbox-cache-expiration.prod.jsaD
Source: f1cdccba37924bda_1.0.dr	String found in binary or memory: https://res.cdn.office.net/officehub/versionless/workbox-v3.6.2/workbox-core.prod.jsa
Source: f1cdccba37924bda_1.0.dr	String found in binary or memory: https://res.cdn.office.net/officehub/versionless/workbox-v3.6.2/workbox-core.prod.jsaD
Source: ba23d8ecda68de77_1.0.dr	String found in binary or memory: https://res.cdn.office.net/officehub/versionless/workbox-v3.6.2/workbox-routing.prod.js
Source: ba23d8ecda68de77_1.0.dr	String found in binary or memory: https://res.cdn.office.net/officehub/versionless/workbox-v3.6.2/workbox-routing.prod.jsaD
Source: 67a473248953641b_1.0.dr	String found in binary or memory: https://res.cdn.office.net/officehub/versionless/workbox-v3.6.2/workbox-strategies.prod.js
Source: 67a473248953641b_1.0.dr	String found in binary or memory: https://res.cdn.office.net/officehub/versionless/workbox-v3.6.2/workbox-strategies.prod.jsaD
Source: 4cb013792b196a35_1.0.dr	String found in binary or memory: https://res.cdn.office.net/officehub/versionless/workbox-v3.6.2/workbox-sw.js
Source: 4cb013792b196a35_1.0.dr	String found in binary or memory: https://res.cdn.office.net/officehub/versionless/workbox-v3.6.2/workbox-sw.jsaD
Source: manifest.json.0.dr	String found in binary or memory: https://sandbox.google.com/payments/v4/js/integrator.js
Source: 1c24b8db-b3a5-4ee8-bec0-cf737a423ed5.tmp.1.dr, b549085d-74d3-46da-a233-cd98b3b9bbd4.tmp.1.dr	String found in binary or memory: https://ssl.gstatic.com
Source: 4cb013792b196a35_1.0.dr	String found in binary or memory: https://storage.googleapis.com/workbox-cdn/releases/3.6.3
Source: 1c24b8db-b3a5-4ee8-bec0-cf737a423ed5.tmp.1.dr, b549085d-74d3-46da-a233-cd98b3b9bbd4.tmp.1.dr	String found in binary or memory: https://www.google.com
Source: manifest.json.0.dr	String found in binary or memory: https://www.google.com/
Source: 1c24b8db-b3a5-4ee8-bec0-cf737a423ed5.tmp.1.dr, b549085d-74d3-46da-a233-cd98b3b9bbd4.tmp.1.dr	String found in binary or memory: https://www.googleapis.com
Source: manifest.json.0.dr	String found in binary or memory: https://www.googleapis.com/
Source: manifest.json.0.dr	String found in binary or memory: https://www.googleapis.com/auth/chromewebstore
Source: manifest.json.0.dr	String found in binary or memory: https://www.googleapis.com/auth/chromewebstore.readonly
Source: manifest.json.0.dr	String found in binary or memory: https://www.googleapis.com/auth/sierra
Source: manifest.json.0.dr	String found in binary or memory: https://www.googleapis.com/auth/sierrasandbox
Source: 1c24b8db-b3a5-4ee8-bec0-cf737a423ed5.tmp.1.dr, b549085d-74d3-46da-a233-cd98b3b9bbd4.tmp.1.dr	String found in binary or memory: https://www.gstatic.com
Source: index.txt.tmp.0.dr	String found in binary or memory: https://www.office.com/
Source: History Provider Cache.0.dr	String found in binary or memory: https://www.office.com/2#Office
Source: 2cc80dabc69f58b6_1.0.dr	String found in binary or memory: https://www.office.com/sw?cdnDomain=res.cdn.office.net/officehub&workload=officehomea
Source: 2cc80dabc69f58b6_1.0.dr	String found in binary or memory: https://www.office.com/sw?cdnDomain=res.cdn.office.net/officehub&workload=officehomeaD

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --enable-automation "https://eccfo1.eu/1f34fac4-2ab4-4dfb-8248-a8cdec56b8f9/bS5iYWtrZXJAYnBkLm5s
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1588,15692047485436063496,8923512637063361634,131072 --lang=en-US --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1944 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1588,15692047485436063496,8923512637063361634,131072 --lang=en-US --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1944 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Automated click: Accept
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Automated click: Accept
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Automated click: Accept

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation	Path Interception	1 Process Injection	3 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	Exfiltration Over Other Network Medium	1 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	4 Non-Application Layer Protocol	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	5 Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	3 Ingress Tool Transfer	SIM Card Swap		Carrier Billing Fraud

Source	Detection	Scanner	Label	Link
https://eccfo1.eu/1f34fac4-2ab4-4dfb-8248-a8cdec56b8f9/bS5iYWtrZXJAYnBkLm5s	0%	Avira URL Cloud	safe
https://eccfo1.eu/1f34fac4-2ab4-4dfb-8248-a8cdec56b8f9/bS5iYWtrZXJAYnBkLm5s	100%	SlashNext	Credential Stealing type: Phishing & Social Engineering

Source	Detection	Scanner	Label
https://dns.google	0%	URL Reputation	safe
https://mem.gfx.ms/meversion?partner=office&market=en-us&uhf=1	0%	Avira URL Cloud	safe
https://eccfo1.eu/static/icon_check.png	0%	Avira URL Cloud	safe
https://eccfo1.eu/favicon.ico	0%	Avira URL Cloud	safe
https://mem.gfx.ms/meversion?partner=officetemplates&market=en-us&uhf=1	0%	Avira URL Cloud	safe
https://mem.gfx.ms/meversion?partner=SMCConvergence&market=en-us&uhf=1	0%	URL Reputation	safe
https://eccfo1.eu/1f34fac4-2ab4-4dfb-8248-a8cdec56b8f9/bS5iYWtrZXJAYnBkLm5s2	0%	Avira URL Cloud	safe
https://mem.gfx.ms/scripts/me/MeControl/10.21162.3/de-DE/meBoot.min.js	0%	URL Reputation	safe
https://mem.gfx.ms/scripts/me/MeControl/10.21162.3/de-DE/meCore.min.js	0%	URL Reputation	safe
https://eccfo1.eu/static/Background.jpg	0%	Avira URL Cloud	safe
https://mem.gfx.ms/scripts/me/MeControl/10.21162.3/en-US/meBoot.min.js	0%	URL Reputation	safe
https://eccfo1.eu/static/windows_logo.png	0%	Avira URL Cloud	safe
https://mem.gfx.ms/scripts/me/MeControl/10.21162.3/en-US/meCore.min.js	0%	URL Reputation	safe
https://mem.gfx.ms/meversion?partner=MSHomePage&market=de-ch&uhf=1	0%	URL Reputation	safe

Name	IP	Active	Malicious	Reputation
sni1gl.wpc.gammacdn.net	152.199.21.175	true	false	unknown
accounts.google.com	142.250.185.205	true	false	high
eccfo1.eu	185.163.85.65	true	false	unknown
dual-a-0001.a-msedge.net	204.79.197.200	true	false	unknown
microsoftwindows.112.2o7.net	15.236.176.210	true	false	high
sni1gl.wpc.alphacdn.net	152.199.21.175	true	false	unknown
part-0017.t-0009.fbs1-t-msedge.net	13.107.219.45	true	false	unknown
b-0004.b-msedge.net	13.107.6.156	true	false	unknown
part-0032.t-0009.t-msedge.net	13.107.246.60	true	false	unknown
HHN-efz.ms-acdc.office.com	52.98.175.2	true	false	high
part-0032.t-0009.fbs1-t-msedge.net	13.107.219.60	true	false	unknown
cs1227.wpc.alphacdn.net	192.229.221.185	true	false	unknown
clients.l.google.com	142.250.184.238	true	false	high
FRA-efz.ms-acdc.office.com	52.98.207.226	true	false	high
googlehosted.l.googleusercontent.com	142.250.185.65	true	false	high
consentreceiverfd-prod.azurefd.net	unknown	unknown	false	unknown
www.office.com	unknown	unknown	false	high
support.office.com	unknown	unknown	false	high
outlook.office.com	unknown	unknown	false	high
substrate.office.com	unknown	unknown	false	high
assets.onestore.ms	unknown	unknown	false	unknown
ajax.aspnetcdn.com	unknown	unknown	false	high
mem.gfx.ms	unknown	unknown	false	unknown
clients2.googleusercontent.com	unknown	unknown	false	high
static2.sharepointonline.com	unknown	unknown	false	unknown
c.s-microsoft.com	unknown	unknown	false	high
clients2.google.com	unknown	unknown	false	high
templates.office.com	unknown	unknown	false	high
support.content.office.net	unknown	unknown	false	high
login.microsoftonline.com	unknown	unknown	false	high
portal.office.com	unknown	unknown	false	high
acctcdn.msftauth.net	unknown	unknown	false	unknown

Name	Malicious	Antivirus Detection	Reputation
https://www.office.com/	false		high
https://mem.gfx.ms/meversion?partner=office&market=en-us&uhf=1	false	Avira URL Cloud: safe	unknown
https://eccfo1.eu/static/icon_check.png	false	Avira URL Cloud: safe	unknown
https://www.office.com/	false		high
https://clients2.google.com/service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=85.0.4183.121&lang=en-US&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1&x=id%3Dpkedcjkdefgpdelpbcmbmeomcjbeemfm%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1	false		high
https://eccfo1.eu/favicon.ico	false	Avira URL Cloud: safe	unknown
https://accounts.google.com/ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard	false		high
https://mem.gfx.ms/meversion?partner=officetemplates&market=en-us&uhf=1	false	Avira URL Cloud: safe	unknown
https://eccfo1.eu/1f34fac4-2ab4-4dfb-8248-a8cdec56b8f9/bS5iYWtrZXJAYnBkLm5s	true		unknown
https://mem.gfx.ms/meversion?partner=SMCConvergence&market=en-us&uhf=1	false	URL Reputation: safe	unknown
https://mem.gfx.ms/scripts/me/MeControl/10.21162.3/de-DE/meBoot.min.js	false	URL Reputation: safe	unknown
https://templates.office.com/	false		high
https://mem.gfx.ms/scripts/me/MeControl/10.21162.3/de-DE/meCore.min.js	false	URL Reputation: safe	unknown
https://clients2.googleusercontent.com/crx/blobs/Acy1k0bLIjHsvnKaKN_oRpVaYYvFs25d7GKYF1WXrT6yizCMksBO0c_ggE0B6tx6HPRHe6q1GOEe3_NcIbSiGG8kXeLMUY0sAKVvC6R89zvKM13s5VqoAMZSmuUgjQL5vlygJuArQghXXE_qTL7NlQ/extension_8520_615_0_5.crx	false		high
https://eccfo1.eu/static/Background.jpg	false	Avira URL Cloud: safe	unknown
https://mem.gfx.ms/scripts/me/MeControl/10.21162.3/en-US/meBoot.min.js	false	URL Reputation: safe	unknown
https://eccfo1.eu/static/windows_logo.png	false	Avira URL Cloud: safe	unknown
https://mem.gfx.ms/scripts/me/MeControl/10.21162.3/en-US/meCore.min.js	false	URL Reputation: safe	unknown
https://eccfo1.eu/1f34fac4-2ab4-4dfb-8248-a8cdec56b8f9/bS5iYWtrZXJAYnBkLm5s	true		unknown
https://mem.gfx.ms/meversion?partner=MSHomePage&market=de-ch&uhf=1	false	URL Reputation: safe	unknown

Name	Source	Malicious	Antivirus Detection	Reputation
https://dns.google	1c24b8db-b3a5-4ee8-bec0-cf737a423ed5.tmp.1.dr, c7ba09d0-7de1-45fe-8a56-3a1f445c67f0.tmp.1.dr, b549085d-74d3-46da-a233-cd98b3b9bbd4.tmp.1.dr	false	URL Reputation: safe	unknown
https://ogs.google.com	1c24b8db-b3a5-4ee8-bec0-cf737a423ed5.tmp.1.dr, b549085d-74d3-46da-a233-cd98b3b9bbd4.tmp.1.dr	false		high
https://play.google.com	1c24b8db-b3a5-4ee8-bec0-cf737a423ed5.tmp.1.dr, b549085d-74d3-46da-a233-cd98b3b9bbd4.tmp.1.dr	false		high
https://payments.google.com/payments/v4/js/integrator.js	manifest.json.0.dr	false		high
https://www.office.com/2#Office	History Provider Cache.0.dr	false		high
https://eccfo1.eu/1f34fac4-2ab4-4dfb-8248-a8cdec56b8f9/bS5iYWtrZXJAYnBkLm5s2	History Provider Cache.0.dr	true	Avira URL Cloud: safe	unknown
https://sandbox.google.com/payments/v4/js/integrator.js	manifest.json.0.dr	false		high
https://www.google.com	1c24b8db-b3a5-4ee8-bec0-cf737a423ed5.tmp.1.dr, b549085d-74d3-46da-a233-cd98b3b9bbd4.tmp.1.dr	false		high
https://accounts.google.com	1c24b8db-b3a5-4ee8-bec0-cf737a423ed5.tmp.1.dr, b549085d-74d3-46da-a233-cd98b3b9bbd4.tmp.1.dr	false		high
https://clients2.googleusercontent.com	1c24b8db-b3a5-4ee8-bec0-cf737a423ed5.tmp.1.dr, b549085d-74d3-46da-a233-cd98b3b9bbd4.tmp.1.dr	false		high
https://apis.google.com	1c24b8db-b3a5-4ee8-bec0-cf737a423ed5.tmp.1.dr, b549085d-74d3-46da-a233-cd98b3b9bbd4.tmp.1.dr	false		high
https://www.google.com/	manifest.json.0.dr	false		high
https://clients2.google.com	1c24b8db-b3a5-4ee8-bec0-cf737a423ed5.tmp.1.dr, b549085d-74d3-46da-a233-cd98b3b9bbd4.tmp.1.dr	false		high
https://api.onedrive.com/v1.0/drive/root	2cc80dabc69f58b6_1.0.dr	false		high
https://clients2.google.com/service/update2/crx	manifest.json.0.dr	false		high

IP	Domain	Country	ASN	ASN Name	Malicious
13.107.6.156	b-0004.b-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
13.107.219.60	part-0032.t-0009.fbs1-t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
204.79.197.200	dual-a-0001.a-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
142.250.185.205	accounts.google.com	United States	15169	GOOGLEUS	false
13.107.246.60	part-0032.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
185.163.85.65	eccfo1.eu	Sweden	12552	IPO-EUSE	false
142.250.185.65	googlehosted.l.googleusercontent.com	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
142.250.184.238	clients.l.google.com	United States	15169	GOOGLEUS	false
15.236.176.210	microsoftwindows.112.2o7.net	United States	16509	AMAZON-02US	false

Joe Sandbox Version:	34.0.0 Boulder Opal
Analysis ID:	612086
Start date and time: 20/04/202214:58:07	2022-04-20 14:58:07 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 6m 27s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	https://eccfo1.eu/1f34fac4-2ab4-4dfb-8248-a8cdec56b8f9/bS5iYWtrZXJAYnBkLm5s
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	10
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal52.phis.win@32/110@24/12
EGA Information:	Failed
HDC Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Adjust boot time Enable AMSI Browse: https://www.office.com/ Browse: https://www.microsoft.com/ Browse: https://templates.office.com/ Browse: https://support.office.com/

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	data
Category:	dropped
Size (bytes):	451603
Entropy (8bit):	5.009711072558331
Encrypted:	false
SSDEEP:	12288:ZHfRTyGZ6lup8Cfrvq4JBPKh+FBlESBw4p6:NfOCzvRKhGvwJ
MD5:	A78AD14E77147E7DE3647E61964C0335
SHA1:	CECC3DD41F4CEA0192B24300C71E1911BD4FCE45
SHA-256:	0D6803758FF8F87081FAFD62E90F0950DFB2DD7991E9607FE76A8F92D0E893FA
SHA-512:	DDE24D5AD50D68FC91E9E325D31E66EF8F624B6BB3A07D14FFED1104D3AB5F4EF1D7969A5CDE0DFBB19CB31C506F7DE97AF67C2F244F7E7E8E10648EA8321101
Malicious:	false
Reputation:	low
Preview:	BDic.... ....6...."..Z..4g....6.2...{/...3...5....AF 1363.AF nm.AF pt.AF n1.AF p.AF tc.AF SM.AF M.AF S.AF MS.AF MNR.AF GDS.AF MNT.AF MH.AF MR.AF SZMR.AF MJ.AF MT.AF MY.AF MRZ.AF MN.AF MG.AF RM.AF N.AF MV.AF XM.AF DSM.AF SD.AF G.AF R.AF MNX.AF MRS.AF MD.AF MNRB.AF B.AF ZSMR.AF PM.AF SMNGJ.AF SMN.AF ZMR.AF SMGB.AF MZR.AF GM.AF SMR.AF SMDG.AF RMZ.AF ZM.AF MDG.AF MDT.AF SMNXT.AF SDY.AF LSDG.AF LGDS.AF GLDS.AF UY.AF U.AF DSGNX.AF GNDSX.AF DSG.AF Y.AF GS.AF IEMS.AF YP.AF ZGDRS.AF XGNVDS.AF UT.AF GNDS.AF GVDS.AF MYPS.AF XGNDS.AF TPRY.AF MDSG.AF ZGSDR.AF DYSG.AF PMYTNS.AF AGDS.AF DRZGS.AF PY.AF GSPMDY.AF EGVDS.AF SL.AF GNXDS.AF DSBG.AF IM.AF I.AF MDGS.AF SMY.AF DSGN.AF DSLG.AF GMDS.AF MDSBG.AF SGD.AF IY.AF P.AF DSMG.AF BLZGDRS.AF TR.AF AGSD.AF ZGBDRSL.AF PTRY.AF ASDGV.AF ASM.AF ICANGSD.AF ICAM.AF IKY.AF AMS.AF PMYTRS.AF BZGVDRS.AF SDRBZG.AF GVMDS.AF PSM.AF DGLS.AF GNVXDS.AF AGDSL.AF DGS.AF XDSGNV.AF BZGDRS.AF AM.AF AS.AF A.AF LDSG.AF AGVDS.AF SDG.AF LDSMG.AF EDSMG.AF EY.AF DRSMZG.AF PRYT.AF LZ

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 20, 2022 14:59:19.803092957 CEST	55923	53	192.168.2.3	8.8.8.8
Apr 20, 2022 14:59:19.821445942 CEST	53	55923	8.8.8.8	192.168.2.3
Apr 20, 2022 14:59:20.032567024 CEST	57723	53	192.168.2.3	8.8.8.8
Apr 20, 2022 14:59:20.037761927 CEST	58116	53	192.168.2.3	8.8.8.8
Apr 20, 2022 14:59:20.048815966 CEST	53	57723	8.8.8.8	192.168.2.3
Apr 20, 2022 14:59:20.060498953 CEST	53	58116	8.8.8.8	192.168.2.3
Apr 20, 2022 14:59:23.513899088 CEST	63332	53	192.168.2.3	8.8.8.8
Apr 20, 2022 14:59:23.541886091 CEST	53	63332	8.8.8.8	192.168.2.3
Apr 20, 2022 14:59:26.605572939 CEST	58981	53	192.168.2.3	8.8.8.8
Apr 20, 2022 14:59:26.623337030 CEST	53	58981	8.8.8.8	192.168.2.3
Apr 20, 2022 14:59:27.145688057 CEST	58625	53	192.168.2.3	8.8.8.8
Apr 20, 2022 14:59:27.162659883 CEST	59795	53	192.168.2.3	8.8.8.8
Apr 20, 2022 14:59:27.277278900 CEST	64816	53	192.168.2.3	8.8.8.8
Apr 20, 2022 14:59:27.294857979 CEST	53	64816	8.8.8.8	192.168.2.3
Apr 20, 2022 14:59:27.388256073 CEST	64996	53	192.168.2.3	8.8.8.8
Apr 20, 2022 14:59:27.406160116 CEST	53	64996	8.8.8.8	192.168.2.3
Apr 20, 2022 14:59:27.406938076 CEST	52096	53	192.168.2.3	8.8.8.8
Apr 20, 2022 14:59:27.425201893 CEST	53	52096	8.8.8.8	192.168.2.3
Apr 20, 2022 14:59:28.691057920 CEST	49846	443	192.168.2.3	142.250.184.238
Apr 20, 2022 14:59:28.715985060 CEST	443	49846	142.250.184.238	192.168.2.3
Apr 20, 2022 14:59:28.716526985 CEST	49846	443	192.168.2.3	142.250.184.238
Apr 20, 2022 14:59:28.741272926 CEST	443	49846	142.250.184.238	192.168.2.3
Apr 20, 2022 14:59:28.741309881 CEST	443	49846	142.250.184.238	192.168.2.3
Apr 20, 2022 14:59:28.741334915 CEST	443	49846	142.250.184.238	192.168.2.3
Apr 20, 2022 14:59:28.741362095 CEST	443	49846	142.250.184.238	192.168.2.3
Apr 20, 2022 14:59:28.777285099 CEST	49846	443	192.168.2.3	142.250.184.238
Apr 20, 2022 14:59:28.779921055 CEST	49846	443	192.168.2.3	142.250.184.238
Apr 20, 2022 14:59:28.795054913 CEST	443	49846	142.250.184.238	192.168.2.3
Apr 20, 2022 14:59:28.795094013 CEST	443	49846	142.250.184.238	192.168.2.3
Apr 20, 2022 14:59:28.795917988 CEST	49846	443	192.168.2.3	142.250.184.238
Apr 20, 2022 14:59:28.808691978 CEST	49846	443	192.168.2.3	142.250.184.238
Apr 20, 2022 14:59:28.809070110 CEST	49846	443	192.168.2.3	142.250.184.238
Apr 20, 2022 14:59:28.840521097 CEST	443	49846	142.250.184.238	192.168.2.3
Apr 20, 2022 14:59:28.841195107 CEST	49846	443	192.168.2.3	142.250.184.238
Apr 20, 2022 14:59:28.852107048 CEST	443	49846	142.250.184.238	192.168.2.3
Apr 20, 2022 14:59:28.852147102 CEST	443	49846	142.250.184.238	192.168.2.3
Apr 20, 2022 14:59:28.852688074 CEST	49846	443	192.168.2.3	142.250.184.238
Apr 20, 2022 14:59:43.810574055 CEST	49846	443	192.168.2.3	142.250.184.238
Apr 20, 2022 14:59:43.853533030 CEST	443	49846	142.250.184.238	192.168.2.3
Apr 20, 2022 14:59:46.148425102 CEST	62724	53	192.168.2.3	8.8.8.8
Apr 20, 2022 14:59:46.174988985 CEST	53	62724	8.8.8.8	192.168.2.3
Apr 20, 2022 14:59:46.541438103 CEST	64941	53	192.168.2.3	8.8.8.8
Apr 20, 2022 14:59:46.544646025 CEST	55403	53	192.168.2.3	8.8.8.8
Apr 20, 2022 14:59:46.564630985 CEST	53	55403	8.8.8.8	192.168.2.3
Apr 20, 2022 14:59:52.184146881 CEST	51779	53	192.168.2.3	8.8.8.8
Apr 20, 2022 14:59:52.740148067 CEST	53524	53	192.168.2.3	8.8.8.8
Apr 20, 2022 14:59:54.788223982 CEST	58561	53	192.168.2.3	8.8.8.8
Apr 20, 2022 14:59:55.255403042 CEST	64433	53	192.168.2.3	8.8.8.8
Apr 20, 2022 14:59:55.696602106 CEST	62547	53	192.168.2.3	8.8.8.8
Apr 20, 2022 14:59:56.999528885 CEST	63326	53	192.168.2.3	8.8.8.8
Apr 20, 2022 15:00:02.578416109 CEST	57442	53	192.168.2.3	8.8.8.8
Apr 20, 2022 15:00:10.057560921 CEST	51557	53	192.168.2.3	8.8.8.8
Apr 20, 2022 15:00:12.634948969 CEST	52487	53	192.168.2.3	8.8.8.8
Apr 20, 2022 15:00:19.644912004 CEST	55686	53	192.168.2.3	8.8.8.8
Apr 20, 2022 15:00:29.722927094 CEST	55795	53	192.168.2.3	8.8.8.8

Timestamp	kBytes transferred	Direction	Data
2022-04-20 12:59:20 UTC	0	OUT	POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1 Host: accounts.google.com Connection: keep-alive Content-Length: 1 Origin: https://www.google.com Content-Type: application/x-www-form-urlencoded Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2022-04-20 12:59:20 UTC	0	OUT	Data Raw: 20 Data Ascii:
2022-04-20 12:59:20 UTC	4	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=utf-8 Access-Control-Allow-Origin: https://www.google.com Access-Control-Allow-Credentials: true X-Content-Type-Options: nosniff Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Wed, 20 Apr 2022 12:59:20 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains Content-Security-Policy: script-src 'report-sample' 'nonce-jXWIpnt3d8PCN6ebNil8qQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/IdentityListAccountsHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'nonce-jXWIpnt3d8PCN6ebNil8qQ' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/IdentityListAccountsHttp/cspreport Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/IdentityListAccountsHttp/cspreport Report-To: {"group":"IdentityListAccountsHttp","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/IdentityListAccountsHttp/external"}]} Cross-Origin-Opener-Policy: same-origin; report-to="IdentityListAccountsHttp" Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" Accept-Ranges: none Vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site,Accept-Encoding Connection: close Transfer-Encoding: chunked
2022-04-20 12:59:20 UTC	5	IN	Data Raw: 31 31 0d 0a 5b 22 67 61 69 61 2e 6c 2e 61 2e 72 22 2c 5b 5d 5d 0d 0a Data Ascii: 11["gaia.l.a.r",[]]
2022-04-20 12:59:20 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	kBytes transferred	Direction	Data
2022-04-20 12:59:20 UTC	0	OUT	GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=85.0.4183.121&lang=en-US&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1&x=id%3Dpkedcjkdefgpdelpbcmbmeomcjbeemfm%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1 Host: clients2.google.com Connection: keep-alive X-Goog-Update-Interactivity: fg X-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmieda,pkedcjkdefgpdelpbcmbmeomcjbeemfm X-Goog-Update-Updater: chromecrx-85.0.4183.121 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2022-04-20 12:59:20 UTC	1	IN	HTTP/1.1 200 OK Content-Security-Policy: script-src 'report-sample' 'nonce-fJTuKdSxWZxhEnhMyOr4ew' 'unsafe-inline' 'strict-dynamic' https: http:;object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/clientupdate-aus/1 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Wed, 20 Apr 2022 12:59:20 GMT Content-Type: text/xml; charset=UTF-8 X-Daynum: 5588 X-Daystart: 21560 X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block Server: GSE Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2022-04-20 12:59:20 UTC	2	IN	Data Raw: 35 31 65 0d 0a 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 67 75 70 64 61 74 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 75 70 64 61 74 65 32 2f 72 65 73 70 6f 6e 73 65 22 20 70 72 6f 74 6f 63 6f 6c 3d 22 32 2e 30 22 20 73 65 72 76 65 72 3d 22 70 72 6f 64 22 3e 3c 64 61 79 73 74 61 72 74 20 65 6c 61 70 73 65 64 5f 64 61 79 73 3d 22 35 35 38 38 22 20 65 6c 61 70 73 65 64 5f 73 65 63 6f 6e 64 73 3d 22 32 31 35 36 30 22 2f 3e 3c 61 70 70 20 61 70 70 69 64 3d 22 6e 6d 6d 68 6b 6b 65 67 63 63 61 67 64 6c 64 67 69 69 6d 65 64 70 69 63 63 6d 67 6d 69 65 64 61 22 20 63 6f 68 6f 72 74 3d 22 31 3a 3a 22 20 63 6f 68 6f 72 74 6e 61 6d 65 3d 22 22 Data Ascii: 51e<?xml version="1.0" encoding="UTF-8"?><gupdate xmlns="http://www.google.com/update2/response" protocol="2.0" server="prod"><daystart elapsed_days="5588" elapsed_seconds="21560"/><app appid="nmmhkkegccagdldgiimedpiccmgmieda" cohort="1::" cohortname=""
2022-04-20 12:59:20 UTC	3	IN	Data Raw: 6d 68 6b 6b 65 67 63 63 61 67 64 6c 64 67 69 69 6d 65 64 70 69 63 63 6d 67 6d 69 65 64 61 2e 63 72 78 22 20 66 70 3d 22 31 2e 38 31 65 33 61 34 64 34 33 61 37 33 36 39 39 65 31 62 37 37 38 31 37 32 33 66 35 36 62 38 37 31 37 31 37 35 63 35 33 36 36 38 35 63 35 34 35 30 31 32 32 62 33 30 37 38 39 34 36 34 61 64 38 32 22 20 68 61 73 68 5f 73 68 61 32 35 36 3d 22 38 31 65 33 61 34 64 34 33 61 37 33 36 39 39 65 31 62 37 37 38 31 37 32 33 66 35 36 62 38 37 31 37 31 37 35 63 35 33 36 36 38 35 63 35 34 35 30 31 32 32 62 33 30 37 38 39 34 36 34 61 64 38 32 22 20 70 72 6f 74 65 63 74 65 64 3d 22 30 22 20 73 69 7a 65 3d 22 32 34 38 35 33 31 22 20 73 74 61 74 75 73 3d 22 6f 6b 22 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 2e 30 2e 36 22 2f 3e 3c 2f 61 70 70 3e 3c 61 70 Data Ascii: mhkkegccagdldgiimedpiccmgmieda.crx" fp="1.81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82" hash_sha256="81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82" protected="0" size="248531" status="ok" version="1.0.0.6"/></app><ap
2022-04-20 12:59:20 UTC	4	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	kBytes transferred	Direction	Data
2022-04-20 12:59:27 UTC	689	OUT	GET /meversion?partner=office&market=en-us&uhf=1 HTTP/1.1 Host: mem.gfx.ms Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.office.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2022-04-20 12:59:27 UTC	690	IN	HTTP/1.1 200 OK Cache-Control: public, no-transform, max-age=43200 Content-Length: 28743 Content-Type: application/javascript Expires: Wed, 20 Apr 2022 16:55:33 GMT X-Cache: TCP_HIT X-Content-Type-Options: nosniff Access-Control-Allow-Origin: * X-UA-Compatible: IE=edge Strict-Transport-Security: max-age=31536000; includeSubDomains X-Azure-Ref-OriginShield: 0wbVfYgAAAADebQZNR2FISLUgTNIXBH3mQU1TMDRFREdFMTkxOQBlYWM1ZjQ5Zi1lMDJkLTRmNDEtYjBhNi0yZDUwZjlmY2Y4NGE= X-Azure-Ref: 0rwNgYgAAAAC562YUnsBqS5YyNIJYEYjURlJBMjMxMDUwNDIwMDI5AGVhYzVmNDlmLWUwMmQtNGY0MS1iMGE2LTJkNTBmOWZjZjg0YQ== Date: Wed, 20 Apr 2022 12:59:27 GMT Connection: close
2022-04-20 12:59:27 UTC	691	IN	Data Raw: 77 69 6e 64 6f 77 2e 4d 53 41 3d 77 69 6e 64 6f 77 2e 4d 53 41 7c 7c 7b 7d 3b 77 69 6e 64 6f 77 2e 4d 53 41 2e 4d 65 43 6f 6e 74 72 6f 6c 3d 77 69 6e 64 6f 77 2e 4d 53 41 2e 4d 65 43 6f 6e 74 72 6f 6c 7c 7c 7b 7d 3b 77 69 6e 64 6f 77 2e 4d 53 41 2e 4d 65 43 6f 6e 74 72 6f 6c 2e 43 6f 6e 66 69 67 3d 7b 22 76 65 72 22 3a 22 31 30 2e 32 31 31 36 32 2e 33 22 2c 22 6d 6b 74 22 3a 22 65 6e 2d 55 53 22 2c 22 70 74 6e 22 3a 22 6f 66 66 69 63 65 22 2c 22 67 66 78 22 3a 22 68 74 74 70 73 3a 2f 2f 6d 65 6d 2e 67 66 78 2e 6d 73 22 2c 22 64 62 67 22 3a 66 61 6c 73 65 2c 22 61 61 64 22 3a 74 72 75 65 2c 22 69 6e 74 22 3a 66 61 6c 73 65 2c 22 70 78 79 22 3a 74 72 75 65 2c 22 6d 73 54 78 74 22 3a 66 61 6c 73 65 2c 22 72 77 64 22 3a 74 72 75 65 2c 22 74 65 6c 45 76 73 22 Data Ascii: window.MSA=window.MSA\|\|{};window.MSA.MeControl=window.MSA.MeControl\|\|{};window.MSA.MeControl.Config={"ver":"10.21162.3","mkt":"en-US","ptn":"office","gfx":"https://mem.gfx.ms","dbg":false,"aad":true,"int":false,"pxy":true,"msTxt":false,"rwd":true,"telEvs"
2022-04-20 12:59:27 UTC	770	IN	Data Raw: 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 6e 3d 65 2e 6d 63 49 73 54 69 6d 65 6f 75 74 3f 22 52 65 73 6f 6c 76 69 6e 67 20 64 65 70 73 20 61 6e 64 20 65 78 70 6f 72 74 73 20 74 69 6d 65 64 20 6f 75 74 22 3a 22 52 65 73 6f 6c 76 69 6e 67 20 64 65 70 73 20 61 6e 64 20 65 78 70 6f 72 74 73 20 66 61 69 6c 65 64 22 3b 7a 65 28 73 2c 74 2c 63 2c 21 30 2c 6e 29 2c 61 28 41 28 6e 2b 22 3a 20 22 2b 73 2b 22 20 28 22 2b 63 2b 22 29 2e 20 49 6e 6e 65 72 20 65 72 72 6f 72 3a 20 22 2b 65 2e 6d 65 73 73 61 67 65 2c 65 2e 6d 63 49 73 54 69 6d 65 6f 75 74 29 29 7d 29 3b 65 6c 73 65 7b 76 61 72 20 6f 3d 76 6f 69 64 20 30 3b 6f 3d 70 2e 4d 65 43 6f 6e 74 72 6f 6c 44 65 66 69 6e 65 21 3d 57 65 3f 22 77 69 6e 64 6f 77 2e 4d 65 43 6f 6e 74 72 6f 6c 44 65 66 69 6e 65 20 64 6f 65 Data Ascii: ction(e){var n=e.mcIsTimeout?"Resolving deps and exports timed out":"Resolving deps and exports failed";ze(s,t,c,!0,n),a(A(n+": "+s+" ("+c+"). Inner error: "+e.message,e.mcIsTimeout))});else{var o=void 0;o=p.MeControlDefine!=We?"window.MeControlDefine doe

Timestamp	kBytes transferred	Direction	Data
2022-04-20 12:59:30 UTC	992	OUT	GET /scripts/me/MeControl/10.21162.3/en-US/meBoot.min.js HTTP/1.1 Host: mem.gfx.ms Connection: keep-alive Origin: https://www.office.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://www.office.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2022-04-20 12:59:30 UTC	993	IN	HTTP/1.1 200 OK Content-Length: 158902 Content-Type: application/javascript Last-Modified: Thu, 20 Jan 2022 20:37:20 GMT ETag: "1d80e809377acb6" X-Cache: TCP_HIT X-Content-Type-Options: nosniff Access-Control-Allow-Origin: * X-UA-Compatible: IE=edge Strict-Transport-Security: max-age=31536000; includeSubDomains X-Azure-Ref-OriginShield: 0QkFdYgAAAAAM/tFF0yp2QrOoqHmz9SwWQU1TMDRFREdFMTkxNgBlYWM1ZjQ5Zi1lMDJkLTRmNDEtYjBhNi0yZDUwZjlmY2Y4NGE= X-Azure-Ref: 0sgNgYgAAAAC9azZESVw1SaW1wGj8pwaCRlJBMjMxMDUwNDE5MDMxAGVhYzVmNDlmLWUwMmQtNGY0MS1iMGE2LTJkNTBmOWZjZjg0YQ== Date: Wed, 20 Apr 2022 12:59:30 GMT Connection: close
2022-04-20 12:59:30 UTC	993	IN	Data Raw: 4d 65 43 6f 6e 74 72 6f 6c 44 65 66 69 6e 65 28 22 6d 65 42 6f 6f 74 22 2c 5b 22 65 78 70 6f 72 74 73 22 2c 22 40 6d 65 63 6f 6e 74 72 6f 6c 2f 77 65 62 2d 69 6e 6c 69 6e 65 22 5d 2c 66 75 6e 63 74 69 6f 6e 28 74 2c 77 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 63 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 7d 2c 69 3d 7b 7d 2c 75 3d 5b 5d 2c 70 3d 5b 5d 3b 66 75 6e 63 74 69 6f 6e 20 53 28 74 2c 65 29 7b 76 61 72 20 72 2c 6e 2c 6f 2c 69 2c 61 3d 70 3b 66 6f 72 28 69 3d 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3b 32 3c 69 2d 2d 3b 29 75 2e 70 75 73 68 28 61 72 67 75 6d 65 6e 74 73 5b 69 5d 29 3b 66 6f 72 28 65 26 26 6e 75 6c 6c 21 3d 65 2e 63 68 69 6c 64 72 65 6e 26 26 28 75 2e 6c 65 6e 67 74 68 7c 7c 75 2e 70 75 73 68 28 65 2e 63 68 69 6c 64 Data Ascii: MeControlDefine("meBoot",["exports","@mecontrol/web-inline"],function(t,w){"use strict";var c=function(){},i={},u=[],p=[];function S(t,e){var r,n,o,i,a=p;for(i=arguments.length;2<i--;)u.push(arguments[i]);for(e&&null!=e.children&&(u.length\|\|u.push(e.child
2022-04-20 12:59:30 UTC	1009	IN	Data Raw: 6e 2e 64 69 73 70 61 74 63 68 29 2c 72 7d 7d 7d 76 61 72 20 65 74 2c 72 74 3d 28 4f 28 6e 74 2c 65 74 3d 76 29 2c 6e 74 2e 70 72 6f 74 6f 74 79 70 65 2e 67 65 74 4c 6f 61 64 65 72 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 76 6f 69 64 20 30 3d 3d 3d 74 68 69 73 2e 6c 6f 61 64 65 72 29 74 72 79 7b 74 68 69 73 2e 6c 6f 61 64 65 72 3d 77 2e 50 72 6f 6d 69 73 65 2e 72 65 73 6f 6c 76 65 28 74 68 69 73 2e 70 72 6f 70 73 2e 6c 6f 61 64 65 72 28 29 29 7d 63 61 74 63 68 28 74 29 7b 74 68 69 73 2e 6c 6f 61 64 65 72 3d 77 2e 50 72 6f 6d 69 73 65 2e 72 65 6a 65 63 74 28 74 29 7d 72 65 74 75 72 6e 20 74 68 69 73 2e 6c 6f 61 64 65 72 7d 2c 6e 74 2e 70 72 6f 74 6f 74 79 70 65 2e 63 6f 6d 70 6f 6e 65 6e 74 44 69 64 4d 6f 75 6e 74 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 76 Data Ascii: n.dispatch),r}}}var et,rt=(O(nt,et=v),nt.prototype.getLoader=function(){if(void 0===this.loader)try{this.loader=w.Promise.resolve(this.props.loader())}catch(t){this.loader=w.Promise.reject(t)}return this.loader},nt.prototype.componentDidMount=function(){v
2022-04-20 12:59:30 UTC	1025	IN	Data Raw: 74 54 69 6d 65 6f 75 74 28 66 75 6e 63 74 69 6f 6e 28 29 7b 57 74 28 66 75 6e 63 74 69 6f 6e 28 29 7b 64 74 28 72 2e 65 6c 65 6d 65 6e 74 29 26 26 64 74 28 72 2e 62 61 73 65 29 26 26 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 76 61 72 20 72 3d 56 74 28 74 29 2c 6e 3d 56 74 28 65 29 2c 6f 3d 47 74 28 29 2c 69 3d 6e 2e 74 6f 70 3e 3d 72 2e 68 65 69 67 68 74 2b 37 3f 6e 2e 74 6f 70 2d 37 2d 72 2e 68 65 69 67 68 74 3a 6e 2e 62 6f 74 74 6f 6d 2b 37 2c 61 3d 6e 2e 77 69 64 74 68 2f 32 2b 6e 2e 6c 65 66 74 2d 72 2e 77 69 64 74 68 2f 32 3b 61 2b 72 2e 77 69 64 74 68 3e 6f 2e 72 69 67 68 74 26 26 28 61 3d 6f 2e 72 69 67 68 74 2d 72 2e 77 69 64 74 68 29 2c 61 3c 30 26 26 28 61 3d 30 29 2c 74 26 26 74 2e 73 74 79 6c 65 26 26 28 74 2e 73 74 79 6c 65 2e 6c 65 66 74 3d Data Ascii: tTimeout(function(){Wt(function(){dt(r.element)&&dt(r.base)&&function(t,e){var r=Vt(t),n=Vt(e),o=Gt(),i=n.top>=r.height+7?n.top-7-r.height:n.bottom+7,a=n.width/2+n.left-r.width/2;a+r.width>o.right&&(a=o.right-r.width),a<0&&(a=0),t&&t.style&&(t.style.left=
2022-04-20 12:59:30 UTC	1041	IN	Data Raw: 65 28 29 7d 7d 2c 79 72 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 7b 6e 61 6d 65 3a 22 53 69 67 6e 4f 75 74 41 6e 64 46 6f 72 67 65 74 46 72 6f 6d 49 64 70 22 2c 6f 70 65 72 61 74 69 6f 6e 3a 22 53 69 67 6e 4f 75 74 22 2c 73 65 72 76 69 63 65 3a 74 2e 74 6f 55 70 70 65 72 43 61 73 65 28 29 7d 7d 2c 76 72 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 7b 6e 61 6d 65 3a 22 46 6f 72 67 65 74 46 72 6f 6d 49 64 70 22 2c 6f 70 65 72 61 74 69 6f 6e 3a 22 46 6f 72 67 65 74 41 63 63 6f 75 6e 74 22 2c 73 65 72 76 69 63 65 3a 74 2e 74 6f 55 70 70 65 72 43 61 73 65 28 29 7d 7d 3b 66 75 6e 63 74 69 6f 6e 20 49 72 28 74 2c 65 29 7b 72 65 74 75 72 6e 20 74 2e 69 73 4f 70 65 72 61 74 69 6f 6e 53 75 70 70 6f 72 74 65 64 28 22 73 77 69 74 63 68 54 Data Ascii: e()}},yr=function(t){return{name:"SignOutAndForgetFromIdp",operation:"SignOut",service:t.toUpperCase()}},vr=function(t){return{name:"ForgetFromIdp",operation:"ForgetAccount",service:t.toUpperCase()}};function Ir(t,e){return t.isOperationSupported("switchT
2022-04-20 12:59:30 UTC	1057	IN	Data Raw: 73 74 65 64 20 66 6f 72 20 61 6e 20 61 63 63 6f 75 6e 74 20 6f 66 20 74 79 70 65 20 4d 53 41 20 62 75 74 20 56 31 20 63 6f 6e 66 69 67 20 64 69 64 6e 27 74 20 70 72 6f 76 69 64 65 20 61 6e 79 20 75 73 61 62 6c 65 20 73 75 70 70 6f 72 74 69 6e 67 20 64 65 74 61 69 6c 73 20 69 6e 20 74 68 65 20 27 72 70 44 61 74 61 27 20 70 72 6f 70 65 72 74 79 20 66 6f 72 20 4d 53 41 20 61 63 63 6f 75 6e 74 73 2e 22 29 7d 7d 2c 42 72 2e 70 72 6f 74 6f 74 79 70 65 2e 73 69 67 6e 4f 75 74 41 6e 64 46 6f 72 67 65 74 46 72 6f 6d 49 64 70 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 73 77 69 74 63 68 28 74 2e 61 63 63 6f 75 6e 74 2e 74 79 70 65 29 7b 63 61 73 65 22 61 61 64 22 3a 63 61 73 65 22 6d 73 61 46 65 64 22 3a 72 65 74 75 72 6e 20 74 68 69 73 2e 61 61 64 41 63 63 6f 75 6e 74 Data Ascii: sted for an account of type MSA but V1 config didn't provide any usable supporting details in the 'rpData' property for MSA accounts.")}},Br.prototype.signOutAndForgetFromIdp=function(t){switch(t.account.type){case"aad":case"msaFed":return this.aadAccount
2022-04-20 12:59:30 UTC	1073	IN	Data Raw: 31 22 3a 22 73 69 67 6e 6f 75 74 61 6e 64 66 6f 72 67 65 74 73 75 63 63 65 73 73 61 31 31 79 66 6f 72 6d 61 74 31 22 2c 4e 74 28 67 74 28 77 2e 67 65 74 53 74 72 69 6e 67 28 6e 29 2c 53 74 28 65 29 29 29 7d 66 75 6e 63 74 69 6f 6e 20 70 6e 28 74 2c 65 2c 72 2c 6e 29 7b 74 28 7b 74 79 70 65 3a 22 53 49 47 4e 4f 55 54 5f 41 43 43 4f 55 4e 54 5f 46 41 49 4c 45 44 22 2c 65 72 72 6f 72 3a 21 30 2c 70 61 79 6c 6f 61 64 3a 6e 2c 6d 65 74 61 3a 7b 61 63 63 6f 75 6e 74 49 64 3a 41 74 28 65 29 2c 66 6f 72 67 65 74 3a 72 7d 7d 29 3b 76 61 72 20 6f 3d 22 6e 6f 74 53 69 67 6e 65 64 49 6e 22 3d 3d 65 2e 61 75 74 68 65 6e 74 69 63 61 74 65 64 53 74 61 74 65 3f 22 66 6f 72 67 65 74 65 72 72 6f 72 61 31 31 79 66 6f 72 6d 61 74 31 22 3a 22 73 69 67 6e 6f 75 74 65 72 72 6f Data Ascii: 1":"signoutandforgetsuccessa11yformat1",Nt(gt(w.getString(n),St(e)))}function pn(t,e,r,n){t({type:"SIGNOUT_ACCOUNT_FAILED",error:!0,payload:n,meta:{accountId:At(e),forget:r}});var o="notSignedIn"==e.authenticatedState?"forgeterrora11yformat1":"signouterro
2022-04-20 12:59:30 UTC	1089	IN	Data Raw: 3d 65 2b 31 29 3a 28 72 2e 63 3d 2d 31 2c 6e 3d 21 30 29 7d 72 65 74 75 72 6e 21 6e 7d 28 72 2c 65 2c 6e 29 3f 5b 22 26 23 22 2c 6e 2e 63 2c 22 3b 22 5d 2e 6a 6f 69 6e 28 22 22 29 3a 22 22 7d 29 7d 2c 74 2e 66 69 6c 74 65 72 4f 62 6a 65 63 74 3d 59 74 2c 74 2e 66 69 6e 64 41 63 63 6f 75 6e 74 3d 54 74 2c 74 2e 66 6f 72 6d 61 74 3d 67 74 2c 74 2e 67 65 74 41 63 63 6f 75 6e 74 49 64 3d 41 74 2c 74 2e 67 65 74 41 63 63 6f 75 6e 74 4c 69 73 74 44 69 73 70 6c 61 79 4e 61 6d 65 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 69 66 28 74 2e 70 72 6f 66 69 6c 65 26 26 74 2e 70 72 6f 66 69 6c 65 2e 70 72 6f 66 69 6c 65 4e 61 6d 65 29 72 65 74 75 72 6e 20 74 2e 70 72 6f 66 69 6c 65 2e 70 72 6f 66 69 6c 65 4e 61 6d 65 3b 73 77 69 74 63 68 28 74 2e 74 79 70 65 29 7b 63 61 73 Data Ascii: =e+1):(r.c=-1,n=!0)}return!n}(r,e,n)?["&#",n.c,";"].join(""):""})},t.filterObject=Yt,t.findAccount=Tt,t.format=gt,t.getAccountId=At,t.getAccountListDisplayName=function(t){if(t.profile&&t.profile.profileName)return t.profile.profileName;switch(t.type){cas
2022-04-20 12:59:30 UTC	1105	IN	Data Raw: 20 30 20 30 30 32 2e 30 31 32 2e 38 31 38 20 32 2e 33 34 34 20 32 2e 33 34 34 20 30 20 30 30 31 2e 39 33 34 2d 2e 38 31 38 20 33 2e 37 38 20 33 2e 37 38 20 30 20 30 30 2e 36 36 34 2d 32 2e 34 32 35 20 33 2e 36 34 39 20 33 2e 36 34 39 20 30 20 30 30 2d 2e 36 38 38 2d 32 2e 34 31 31 20 32 2e 33 39 31 20 32 2e 33 39 31 20 30 20 30 30 2d 31 2e 39 33 2d 2e 38 31 33 20 32 2e 34 34 20 32 2e 34 34 20 30 20 30 30 2d 31 2e 39 38 37 2e 38 35 32 20 33 2e 37 30 37 20 33 2e 37 30 37 20 30 20 30 30 2d 2e 37 30 37 20 32 2e 34 33 6d 31 35 2e 34 36 34 2d 33 2e 31 30 39 48 39 39 2e 37 56 31 38 2e 34 68 2d 32 2e 33 35 39 76 2d 37 2e 39 38 38 68 2d 31 2e 36 35 35 56 38 2e 35 30 37 68 31 2e 36 35 35 56 37 2e 31 33 61 33 2e 34 32 35 20 33 2e 34 32 35 20 30 20 30 31 31 2e 30 31 Data Ascii: 0 002.012.818 2.344 2.344 0 001.934-.818 3.78 3.78 0 00.664-2.425 3.649 3.649 0 00-.688-2.411 2.391 2.391 0 00-1.93-.813 2.44 2.44 0 00-1.987.852 3.707 3.707 0 00-.707 2.43m15.464-3.109H99.7V18.4h-2.359v-7.988h-1.655V8.507h1.655V7.13a3.425 3.425 0 011.01
2022-04-20 12:59:30 UTC	1120	IN	Data Raw: 35 2d 2e 32 35 35 20 32 2e 36 34 39 20 32 2e 36 34 39 20 30 20 30 30 2d 2e 38 35 31 2d 2e 31 32 20 31 2e 38 31 31 20 31 2e 38 31 31 20 30 20 30 30 2d 31 2e 34 34 39 2e 37 32 32 20 33 2e 34 37 20 33 2e 34 37 20 30 20 30 30 2d 2e 35 39 32 20 32 2e 32 32 33 56 31 38 2e 34 68 2d 32 2e 33 33 35 56 38 2e 35 30 37 68 32 2e 33 32 39 76 31 2e 35 35 39 68 2e 30 33 39 61 32 2e 37 33 31 20 32 2e 37 33 31 20 30 20 30 31 2e 39 36 32 2d 31 2e 32 36 36 20 32 2e 36 31 35 20 32 2e 36 31 35 20 30 20 30 31 31 2e 35 35 2d 2e 34 35 37 6d 31 20 35 2e 32 35 34 61 35 2e 33 35 35 20 35 2e 33 35 35 20 30 20 30 31 31 2e 33 38 37 2d 33 2e 38 38 37 20 35 2e 31 20 35 2e 31 20 30 20 30 31 33 2e 38 35 2d 31 2e 34 33 34 20 34 2e 37 34 31 20 34 2e 37 34 31 20 30 20 30 31 33 2e 36 32 33 20 Data Ascii: 5-.255 2.649 2.649 0 00-.851-.12 1.811 1.811 0 00-1.449.722 3.47 3.47 0 00-.592 2.223V18.4h-2.335V8.507h2.329v1.559h.039a2.731 2.731 0 01.962-1.266 2.615 2.615 0 011.55-.457m1 5.254a5.355 5.355 0 011.387-3.887 5.1 5.1 0 013.85-1.434 4.741 4.741 0 013.623
2022-04-20 12:59:30 UTC	1136	IN	Data Raw: 5c 78 33 64 5c 78 32 37 33 32 5c 78 32 37 20 72 5c 78 33 64 5c 78 32 37 33 30 2e 32 35 5c 78 32 37 20 73 74 72 6f 6b 65 2d 77 69 64 74 68 5c 78 33 64 5c 78 32 37 31 2e 35 5c 78 32 37 5c 78 32 66 5c 78 32 35 33 45 5c 78 32 35 33 43 67 20 74 72 61 6e 73 66 6f 72 6d 5c 78 33 64 5c 78 32 37 6d 61 74 72 69 78 5c 78 32 38 2e 39 20 30 20 30 20 2e 39 20 31 30 2e 34 33 31 20 31 30 2e 34 33 31 5c 78 32 39 5c 78 32 37 20 73 74 72 6f 6b 65 2d 77 69 64 74 68 5c 78 33 64 5c 78 32 37 32 5c 78 32 37 5c 78 32 35 33 45 5c 78 32 35 33 43 63 69 72 63 6c 65 20 63 78 5c 78 33 64 5c 78 32 37 32 34 2e 32 35 5c 78 32 37 20 63 79 5c 78 33 64 5c 78 32 37 31 38 5c 78 32 37 20 72 5c 78 33 64 5c 78 32 37 39 5c 78 32 37 5c 78 32 66 5c 78 32 35 33 45 5c 78 32 35 33 43 70 61 74 68 20 64 Data Ascii: \x3d\x2732\x27 r\x3d\x2730.25\x27 stroke-width\x3d\x271.5\x27\x2f\x253E\x253Cg transform\x3d\x27matrix\x28.9 0 0 .9 10.431 10.431\x29\x27 stroke-width\x3d\x272\x27\x253E\x253Ccircle cx\x3d\x2724.25\x27 cy\x3d\x2718\x27 r\x3d\x279\x27\x2f\x253E\x253Cpath d

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://eccfo1.eu/1f34fac4-2ab4-4dfb-8248-a8cdec56b8f9/bS5iYWtrZXJAYnBkLm5s

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Compliance

Networking

System Summary

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Program Files\Google\Chrome\Application\Dictionaries\en-US-9-0.bdic

C:\Users\user\AppData\Local\Google\Chrome\User Data\4fe305bd-4cd5-48ac-b3dc-991f8423fdbc.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\61e17c56-b10f-4dfa-9a50-44046654a80c.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\6323971a-2b81-4c64-8465-44468cb28825.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\94b3f03e-7aaa-43fb-8305-d87175143b7d.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\145cb28e-b790-4936-855b-40d3ed8d2289.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\1c24b8db-b3a5-4ee8-bec0-cf737a423ed5.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\1dd6d89e-a1f2-456e-be89-f2845c3e964b.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\5b8cf716-36a7-485d-89e2-91de2f670f6b.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\78666485-5444-4616-bd84-43a9137943c4.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\93c1721e-d7bf-41cb-828d-55de63d123b1.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\94528073-bfb7-4e0f-a64c-3c3f1024fd08.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB\000003.log

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB\LOG

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB\LOG.old (copy)

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History Provider Cache

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.office.com_0.indexeddb.leveldb\000001.dbtmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.office.com_0.indexeddb.leveldb\000003.log

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.office.com_0.indexeddb.leveldb\000005.ldb

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.office.com_0.indexeddb.leveldb\CURRENT (copy)

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.office.com_0.indexeddb.leveldb\LOG

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.office.com_0.indexeddb.leveldb\MANIFEST-000001

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network Persistent State (copy)

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Preferences (copy)

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences (copy)

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\29eb5eacb05363703a494bbad16a2cdd1da1fb81\0d0342b3-e754-4bee-ab63-7f38f579838f\0e751cd85ef9bf6a_0

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\29eb5eacb05363703a494bbad16a2cdd1da1fb81\0d0342b3-e754-4bee-ab63-7f38f579838f\1e33ede7037c06b6_0

Windows Analysis Report
https://eccfo1.eu/1f34fac4-2ab4-4dfb-8248-a8cdec56b8f9/bS5iYWtrZXJAYnBkLm5s

Timestamp	kBytes transferred	Direction	Data
2022-04-20 12:59:34 UTC	1149	OUT	GET /scripts/me/MeControl/10.21162.3/en-US/meCore.min.js HTTP/1.1 Host: mem.gfx.ms Connection: keep-alive Origin: https://www.office.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://www.office.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2022-04-20 12:59:34 UTC	1174	IN	HTTP/1.1 200 OK Content-Length: 101952 Content-Type: application/javascript Last-Modified: Thu, 20 Jan 2022 20:37:26 GMT ETag: "1d80e809708c940" X-Cache: TCP_HIT X-Content-Type-Options: nosniff Access-Control-Allow-Origin: * X-UA-Compatible: IE=edge Strict-Transport-Security: max-age=31536000; includeSubDomains X-Azure-Ref-OriginShield: 0ikReYgAAAADBHwNuGvLWQZDeSP6QMr9GQU1TMDRFREdFMTkxOQBlYWM1ZjQ5Zi1lMDJkLTRmNDEtYjBhNi0yZDUwZjlmY2Y4NGE= X-Azure-Ref: 0tgNgYgAAAADE1LSAwmsFSpSzPNUWZKKBRlJBMjMxMDUwNDE3MDMzAGVhYzVmNDlmLWUwMmQtNGY0MS1iMGE2LTJkNTBmOWZjZjg0YQ== Date: Wed, 20 Apr 2022 12:59:34 GMT Connection: close
2022-04-20 12:59:34 UTC	1175	IN	Data Raw: 4d 65 43 6f 6e 74 72 6f 6c 44 65 66 69 6e 65 28 22 6d 65 43 6f 72 65 22 2c 5b 22 65 78 70 6f 72 74 73 22 2c 22 40 6d 65 63 6f 6e 74 72 6f 6c 2f 77 65 62 2d 69 6e 6c 69 6e 65 22 2c 22 40 6d 65 63 6f 6e 74 72 6f 6c 2f 77 65 62 2d 62 6f 6f 74 22 5d 2c 66 75 6e 63 74 69 6f 6e 28 74 2c 66 2c 68 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 72 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 72 65 74 75 72 6e 28 72 3d 4f 62 6a 65 63 74 2e 73 65 74 50 72 6f 74 6f 74 79 70 65 4f 66 7c 7c 7b 5f 5f 70 72 6f 74 6f 5f 5f 3a 5b 5d 7d 69 6e 73 74 61 6e 63 65 6f 66 20 41 72 72 61 79 26 26 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 74 2e 5f 5f 70 72 6f 74 6f 5f 5f 3d 65 7d 7c 7c 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 66 6f 72 28 76 61 72 20 6e 20 69 6e 20 65 29 Data Ascii: MeControlDefine("meCore",["exports","@mecontrol/web-inline","@mecontrol/web-boot"],function(t,f,h){"use strict";var r=function(t,e){return(r=Object.setPrototypeOf\|\|{__proto__:[]}instanceof Array&&function(t,e){t.__proto__=e}\|\|function(t,e){for(var n in e)
2022-04-20 12:59:34 UTC	1190	IN	Data Raw: 2e 73 63 72 6f 6c 6c 48 61 6e 64 6c 65 72 3d 68 2e 64 65 62 6f 75 6e 63 65 28 65 2e 65 78 70 61 6e 64 65 64 53 63 72 6f 6c 6c 48 61 6e 64 6c 65 72 2e 62 69 6e 64 28 65 29 29 2c 65 2e 73 74 61 74 65 3d 7b 65 78 70 61 6e 64 65 64 3a 21 31 7d 2c 65 7d 66 75 6e 63 74 69 6f 6e 20 51 28 74 2c 65 2c 6e 29 7b 76 61 72 20 72 3d 6e 65 77 20 66 2e 53 79 6e 74 68 65 74 69 63 45 76 65 6e 74 28 22 63 6f 6d 6d 61 6e 64 63 6c 69 63 6b 22 2c 7b 63 6f 6d 6d 61 6e 64 49 64 3a 65 2e 69 64 2c 63 75 72 72 65 6e 74 41 63 63 6f 75 6e 74 3a 6e 7d 29 2c 6f 3d 66 2e 67 65 74 4f 70 74 69 6f 6e 73 28 29 3b 6f 26 26 28 6f 2e 73 79 6e 74 68 65 74 69 63 45 76 65 6e 74 54 61 72 67 65 74 2e 64 69 73 70 61 74 63 68 45 76 65 6e 74 28 72 29 7c 7c 74 2e 70 72 65 76 65 6e 74 44 65 66 61 75 6c Data Ascii: .scrollHandler=h.debounce(e.expandedScrollHandler.bind(e)),e.state={expanded:!1},e}function Q(t,e,n){var r=new f.SyntheticEvent("commandclick",{commandId:e.id,currentAccount:n}),o=f.getOptions();o&&(o.syntheticEventTarget.dispatchEvent(r)\|\|t.preventDefaul
2022-04-20 12:59:34 UTC	1206	IN	Data Raw: 74 61 3a 66 2e 61 73 73 69 67 6e 28 7b 7d 2c 74 2e 70 61 72 74 43 2c 7b 62 61 73 65 44 61 74 61 3a 74 2e 70 61 72 74 42 26 26 66 2e 61 73 73 69 67 6e 28 7b 7d 2c 74 2e 70 61 72 74 42 29 7d 29 7d 2c 7b 65 78 74 3a 66 2e 61 73 73 69 67 6e 28 7b 7d 2c 74 2e 70 61 72 74 41 2e 65 78 74 29 7d 5d 2e 6d 61 70 28 55 74 29 2e 6a 6f 69 6e 28 22 2c 22 29 2b 22 7d 22 7d 66 75 6e 63 74 69 6f 6e 20 55 74 28 6e 29 7b 72 65 74 75 72 6e 20 6e 3f 4f 62 6a 65 63 74 2e 67 65 74 4f 77 6e 50 72 6f 70 65 72 74 79 4e 61 6d 65 73 28 6e 29 2e 6d 61 70 28 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 61 72 20 65 3d 6e 5b 74 5d 3b 73 77 69 74 63 68 28 74 79 70 65 6f 66 20 65 29 7b 63 61 73 65 22 6f 62 6a 65 63 74 22 3a 72 65 74 75 72 6e 20 6e 75 6c 6c 21 3d 3d 65 3f 27 22 27 2b 74 2b 27 22 Data Ascii: ta:f.assign({},t.partC,{baseData:t.partB&&f.assign({},t.partB)})},{ext:f.assign({},t.partA.ext)}].map(Ut).join(",")+"}"}function Ut(n){return n?Object.getOwnPropertyNames(n).map(function(t){var e=n[t];switch(typeof e){case"object":return null!==e?'"'+t+'"
2022-04-20 12:59:34 UTC	1222	IN	Data Raw: 63 75 72 72 65 6e 74 41 63 63 6f 75 6e 74 20 2e 6d 65 63 74 72 6c 5f 61 63 63 6f 75 6e 74 49 6e 66 6f 20 2e 6d 65 63 74 72 6c 5f 61 63 63 6f 75 6e 74 44 65 74 61 69 6c 73 20 2e 6d 65 63 74 72 6c 5f 6c 69 6e 6b 5c 78 37 62 63 6f 6c 6f 72 5c 78 33 61 5c 78 32 33 30 30 30 30 63 64 5c 78 32 31 69 6d 70 6f 72 74 61 6e 74 5c 78 33 62 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 5c 78 33 61 5c 78 32 33 30 30 30 30 63 64 5c 78 32 31 69 6d 70 6f 72 74 61 6e 74 5c 78 33 62 6f 75 74 6c 69 6e 65 2d 63 6f 6c 6f 72 5c 78 33 61 5c 78 32 33 30 30 30 30 63 64 5c 78 32 31 69 6d 70 6f 72 74 61 6e 74 5c 78 33 62 66 69 6c 6c 5c 78 33 61 5c 78 32 33 30 30 30 30 63 64 5c 78 32 31 69 6d 70 6f 72 74 61 6e 74 5c 78 33 62 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 5c 78 33 61 5c 78 32 Data Ascii: currentAccount .mectrl_accountInfo .mectrl_accountDetails .mectrl_link\x7bcolor\x3a\x230000cd\x21important\x3bborder-color\x3a\x230000cd\x21important\x3boutline-color\x3a\x230000cd\x21important\x3bfill\x3a\x230000cd\x21important\x3bbackground-color\x3a\x2
2022-04-20 12:59:34 UTC	1286	IN	Data Raw: 5c 78 37 64 2e 6d 65 63 74 72 6c 5f 6d 65 6e 75 5c 78 37 62 70 6f 73 69 74 69 6f 6e 5c 78 33 61 72 65 6c 61 74 69 76 65 5c 78 37 64 2e 6d 65 63 74 72 6c 5f 6d 65 6e 75 20 75 6c 5c 78 37 62 6c 69 73 74 2d 73 74 79 6c 65 5c 78 33 61 6e 6f 6e 65 5c 78 33 62 70 6f 73 69 74 69 6f 6e 5c 78 33 61 61 62 73 6f 6c 75 74 65 5c 78 33 62 62 6f 74 74 6f 6d 5c 78 33 61 30 5c 78 33 62 72 69 67 68 74 5c 78 33 61 30 5c 78 33 62 7a 2d 69 6e 64 65 78 5c 78 33 61 31 5c 78 33 62 6f 70 61 63 69 74 79 5c 78 33 61 30 5c 78 33 62 76 69 73 69 62 69 6c 69 74 79 5c 78 33 61 68 69 64 64 65 6e 5c 78 33 62 2d 77 65 62 6b 69 74 2d 74 72 61 6e 73 69 74 69 6f 6e 5c 78 33 61 76 69 73 69 62 69 6c 69 74 79 20 30 73 20 6c 69 6e 65 61 72 20 31 33 30 6d 73 2c 6f 70 61 63 69 74 79 20 31 33 30 6d Data Ascii: \x7d.mectrl_menu\x7bposition\x3arelative\x7d.mectrl_menu ul\x7blist-style\x3anone\x3bposition\x3aabsolute\x3bbottom\x3a0\x3bright\x3a0\x3bz-index\x3a1\x3bopacity\x3a0\x3bvisibility\x3ahidden\x3b-webkit-transition\x3avisibility 0s linear 130ms,opacity 130m
2022-04-20 12:59:34 UTC	1302	IN	Data Raw: 5f 61 63 63 6f 75 6e 74 49 74 65 6d 20 2e 70 72 69 6d 61 72 79 41 63 74 69 6f 6e 5c 78 33 61 68 6f 76 65 72 5c 78 37 62 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 5c 78 33 61 69 6e 64 69 67 6f 5c 78 37 64 5c 78 37 64 2e 6d 65 63 74 72 6c 5f 61 63 63 6f 75 6e 74 49 74 65 6d 20 2e 70 72 69 6d 61 72 79 41 63 74 69 6f 6e 20 2e 6d 65 63 74 72 6c 5f 61 63 63 6f 75 6e 74 49 74 65 6d 49 6e 66 6f 5c 78 37 62 70 61 64 64 69 6e 67 2d 74 6f 70 5c 78 33 61 31 30 70 78 5c 78 33 62 70 61 64 64 69 6e 67 2d 62 6f 74 74 6f 6d 5c 78 33 61 31 30 70 78 5c 78 33 62 70 61 64 64 69 6e 67 2d 72 69 67 68 74 5c 78 33 61 34 38 70 78 5c 78 33 62 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 66 6c 65 78 5c 78 33 61 31 5c 78 33 62 2d 6d 73 2d 66 6c 65 78 2d 70 6f 73 69 74 69 76 65 5c 78 33 Data Ascii: _accountItem .primaryAction\x3ahover\x7bbackground-color\x3aindigo\x7d\x7d.mectrl_accountItem .primaryAction .mectrl_accountItemInfo\x7bpadding-top\x3a10px\x3bpadding-bottom\x3a10px\x3bpadding-right\x3a48px\x3b-webkit-box-flex\x3a1\x3b-ms-flex-positive\x3
2022-04-20 12:59:34 UTC	1318	IN	Data Raw: 72 69 67 67 65 72 2c 2e 63 2d 75 68 66 68 5c 78 33 65 2e 74 68 65 6d 65 2d 64 61 72 6b 20 2e 63 2d 6d 65 20 2e 6d 65 63 74 72 6c 5f 61 63 63 6f 75 6e 74 41 63 74 69 6f 6e 73 20 2e 6d 65 63 74 72 6c 5f 74 72 69 67 67 65 72 5c 78 33 61 66 6f 63 75 73 2c 2e 6d 65 63 74 72 6c 5f 74 68 65 6d 65 5f 64 61 72 6b 20 2e 6d 65 63 74 72 6c 5f 61 63 63 6f 75 6e 74 41 63 74 69 6f 6e 73 20 2e 6d 65 63 74 72 6c 5f 74 72 69 67 67 65 72 2c 2e 6d 65 63 74 72 6c 5f 74 68 65 6d 65 5f 64 61 72 6b 20 2e 6d 65 63 74 72 6c 5f 61 63 63 6f 75 6e 74 41 63 74 69 6f 6e 73 20 2e 6d 65 63 74 72 6c 5f 74 72 69 67 67 65 72 5c 78 33 61 66 6f 63 75 73 5c 78 37 62 63 6f 6c 6f 72 5c 78 33 61 69 6e 68 65 72 69 74 5c 78 33 62 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 5c 78 33 61 69 6e 68 Data Ascii: rigger,.c-uhfh\x3e.theme-dark .c-me .mectrl_accountActions .mectrl_trigger\x3afocus,.mectrl_theme_dark .mectrl_accountActions .mectrl_trigger,.mectrl_theme_dark .mectrl_accountActions .mectrl_trigger\x3afocus\x7bcolor\x3ainherit\x3bbackground-color\x3ainh

Timestamp	kBytes transferred	Direction	Data
2022-04-20 12:59:35 UTC	1394	OUT	GET /c.gif?DI=4050&did=1&t=&CtsSyncId=B1BED8FFFBD34A5C951B4273A8E67A1D&RedC=c1.microsoft.com&MXFR=376D41D8FED76C0E172E5054FAD76A18 HTTP/1.1 Host: c.bing.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept: image/avif,image/webp,image/apng,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.office.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2022-04-20 12:59:35 UTC	1394	IN	HTTP/1.1 302 Redirect Cache-Control: private, no-cache, proxy-revalidate, no-store Pragma: no-cache Location: https://c1.microsoft.com/c.gif?DI=4050&did=1&t=&CtsSyncId=B1BED8FFFBD34A5C951B4273A8E67A1D&MUID=376D41D8FED76C0E172E5054FAD76A18 P3P: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" Set-Cookie: MUID=376D41D8FED76C0E172E5054FAD76A18; domain=.bing.com; expires=Mon, 15-May-2023 12:59:35 GMT; path=/; SameSite=None; Secure; Priority=High; Set-Cookie: SRM_B=376D41D8FED76C0E172E5054FAD76A18; domain=c.bing.com; expires=Mon, 15-May-2023 12:59:35 GMT; path=/; SameSite=None; Secure; Set-Cookie: SRM_I=376D41D8FED76C0E172E5054FAD76A18; domain=c.bing.com; expires=Mon, 15-May-2023 12:59:35 GMT; path=/; SameSite=None; Secure; X-Powered-By: ASP.NET X-Cache: CONFIG_NOCACHE Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: 4A6F76ABCDF84FF69267B7B1B3F96EDF Ref B: FRA31EDGE0610 Ref C: 2022-04-20T12:59:35Z Date: Wed, 20 Apr 2022 12:59:35 GMT Connection: close Content-Length: 0

Timestamp	kBytes transferred	Direction	Data
2022-04-20 12:59:47 UTC	2148	OUT	GET /meversion?partner=MSHomePage&market=de-ch&uhf=1 HTTP/1.1 Host: mem.gfx.ms Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.microsoft.com/de-ch/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2022-04-20 12:59:47 UTC	2148	IN	HTTP/1.1 200 OK Cache-Control: public, no-transform, max-age=43200 Content-Length: 28751 Content-Type: application/javascript Expires: Wed, 20 Apr 2022 15:52:13 GMT X-Cache: TCP_REMOTE_HIT X-Content-Type-Options: nosniff Access-Control-Allow-Origin: * X-UA-Compatible: IE=edge Strict-Transport-Security: max-age=31536000; includeSubDomains X-Azure-Ref-OriginShield: 0wwNgYgAAAADqzo6+a9hlTroSd1ly5NxyQU1TMDRFREdFMTgxMQBlYWM1ZjQ5Zi1lMDJkLTRmNDEtYjBhNi0yZDUwZjlmY2Y4NGE= X-Azure-Ref: 0wwNgYgAAAAD6YWCyYOBGTbDJz827sBrMRlJBMjMxMDUwNDE3MDIxAGVhYzVmNDlmLWUwMmQtNGY0MS1iMGE2LTJkNTBmOWZjZjg0YQ== Date: Wed, 20 Apr 2022 12:59:46 GMT Connection: close
2022-04-20 12:59:47 UTC	2149	IN	Data Raw: 77 69 6e 64 6f 77 2e 4d 53 41 3d 77 69 6e 64 6f 77 2e 4d 53 41 7c 7c 7b 7d 3b 77 69 6e 64 6f 77 2e 4d 53 41 2e 4d 65 43 6f 6e 74 72 6f 6c 3d 77 69 6e 64 6f 77 2e 4d 53 41 2e 4d 65 43 6f 6e 74 72 6f 6c 7c 7c 7b 7d 3b 77 69 6e 64 6f 77 2e 4d 53 41 2e 4d 65 43 6f 6e 74 72 6f 6c 2e 43 6f 6e 66 69 67 3d 7b 22 76 65 72 22 3a 22 31 30 2e 32 31 31 36 32 2e 33 22 2c 22 6d 6b 74 22 3a 22 64 65 2d 44 45 22 2c 22 70 74 6e 22 3a 22 6d 73 68 6f 6d 65 70 61 67 65 22 2c 22 67 66 78 22 3a 22 68 74 74 70 73 3a 2f 2f 6d 65 6d 2e 67 66 78 2e 6d 73 22 2c 22 64 62 67 22 3a 66 61 6c 73 65 2c 22 61 61 64 22 3a 74 72 75 65 2c 22 69 6e 74 22 3a 66 61 6c 73 65 2c 22 70 78 79 22 3a 74 72 75 65 2c 22 6d 73 54 78 74 22 3a 66 61 6c 73 65 2c 22 72 77 64 22 3a 74 72 75 65 2c 22 74 65 6c Data Ascii: window.MSA=window.MSA\|\|{};window.MSA.MeControl=window.MSA.MeControl\|\|{};window.MSA.MeControl.Config={"ver":"10.21162.3","mkt":"de-DE","ptn":"mshomepage","gfx":"https://mem.gfx.ms","dbg":false,"aad":true,"int":false,"pxy":true,"msTxt":false,"rwd":true,"tel
2022-04-20 12:59:47 UTC	2164	IN	Data Raw: 28 65 29 7d 29 2e 63 61 74 63 68 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 6e 3d 65 2e 6d 63 49 73 54 69 6d 65 6f 75 74 3f 22 52 65 73 6f 6c 76 69 6e 67 20 64 65 70 73 20 61 6e 64 20 65 78 70 6f 72 74 73 20 74 69 6d 65 64 20 6f 75 74 22 3a 22 52 65 73 6f 6c 76 69 6e 67 20 64 65 70 73 20 61 6e 64 20 65 78 70 6f 72 74 73 20 66 61 69 6c 65 64 22 3b 7a 65 28 73 2c 74 2c 63 2c 21 30 2c 6e 29 2c 61 28 41 28 6e 2b 22 3a 20 22 2b 73 2b 22 20 28 22 2b 63 2b 22 29 2e 20 49 6e 6e 65 72 20 65 72 72 6f 72 3a 20 22 2b 65 2e 6d 65 73 73 61 67 65 2c 65 2e 6d 63 49 73 54 69 6d 65 6f 75 74 29 29 7d 29 3b 65 6c 73 65 7b 76 61 72 20 6f 3d 76 6f 69 64 20 30 3b 6f 3d 70 2e 4d 65 43 6f 6e 74 72 6f 6c 44 65 66 69 6e 65 21 3d 57 65 3f 22 77 69 6e 64 6f 77 2e 4d 65 43 6f Data Ascii: (e)}).catch(function(e){var n=e.mcIsTimeout?"Resolving deps and exports timed out":"Resolving deps and exports failed";ze(s,t,c,!0,n),a(A(n+": "+s+" ("+c+"). Inner error: "+e.message,e.mcIsTimeout))});else{var o=void 0;o=p.MeControlDefine!=We?"window.MeCo

Timestamp	kBytes transferred	Direction	Data
2022-04-20 12:59:51 UTC	2177	OUT	GET /scripts/me/MeControl/10.21162.3/de-DE/meBoot.min.js HTTP/1.1 Host: mem.gfx.ms Connection: keep-alive Origin: https://www.microsoft.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://www.microsoft.com/de-ch/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2022-04-20 12:59:51 UTC	2177	IN	HTTP/1.1 200 OK Content-Length: 158941 Content-Type: application/javascript Last-Modified: Thu, 20 Jan 2022 20:37:20 GMT ETag: "1d80e809377acdd" X-Cache: TCP_HIT X-Content-Type-Options: nosniff Access-Control-Allow-Origin: * X-UA-Compatible: IE=edge Strict-Transport-Security: max-age=31536000; includeSubDomains X-Azure-Ref-OriginShield: 0aedfYgAAAABV4XBj0L8XT665pIc3Ue+5QU1TMDRFREdFMTgxMABlYWM1ZjQ5Zi1lMDJkLTRmNDEtYjBhNi0yZDUwZjlmY2Y4NGE= X-Azure-Ref: 0xwNgYgAAAADLFroggyTyTJCET8BJijPSRlJBMjMxMDUwNDE5MDI5AGVhYzVmNDlmLWUwMmQtNGY0MS1iMGE2LTJkNTBmOWZjZjg0YQ== Date: Wed, 20 Apr 2022 12:59:51 GMT Connection: close
2022-04-20 12:59:51 UTC	2178	IN	Data Raw: 4d 65 43 6f 6e 74 72 6f 6c 44 65 66 69 6e 65 28 22 6d 65 42 6f 6f 74 22 2c 5b 22 65 78 70 6f 72 74 73 22 2c 22 40 6d 65 63 6f 6e 74 72 6f 6c 2f 77 65 62 2d 69 6e 6c 69 6e 65 22 5d 2c 66 75 6e 63 74 69 6f 6e 28 74 2c 77 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 63 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 7d 2c 69 3d 7b 7d 2c 75 3d 5b 5d 2c 70 3d 5b 5d 3b 66 75 6e 63 74 69 6f 6e 20 53 28 74 2c 65 29 7b 76 61 72 20 72 2c 6e 2c 6f 2c 69 2c 61 3d 70 3b 66 6f 72 28 69 3d 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3b 32 3c 69 2d 2d 3b 29 75 2e 70 75 73 68 28 61 72 67 75 6d 65 6e 74 73 5b 69 5d 29 3b 66 6f 72 28 65 26 26 6e 75 6c 6c 21 3d 65 2e 63 68 69 6c 64 72 65 6e 26 26 28 75 2e 6c 65 6e 67 74 68 7c 7c 75 2e 70 75 73 68 28 65 2e 63 68 69 6c 64 Data Ascii: MeControlDefine("meBoot",["exports","@mecontrol/web-inline"],function(t,w){"use strict";var c=function(){},i={},u=[],p=[];function S(t,e){var r,n,o,i,a=p;for(i=arguments.length;2<i--;)u.push(arguments[i]);for(e&&null!=e.children&&(u.length\|\|u.push(e.child
2022-04-20 12:59:51 UTC	2193	IN	Data Raw: 6e 2e 64 69 73 70 61 74 63 68 29 2c 72 7d 7d 7d 76 61 72 20 65 74 2c 72 74 3d 28 4f 28 6e 74 2c 65 74 3d 76 29 2c 6e 74 2e 70 72 6f 74 6f 74 79 70 65 2e 67 65 74 4c 6f 61 64 65 72 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 76 6f 69 64 20 30 3d 3d 3d 74 68 69 73 2e 6c 6f 61 64 65 72 29 74 72 79 7b 74 68 69 73 2e 6c 6f 61 64 65 72 3d 77 2e 50 72 6f 6d 69 73 65 2e 72 65 73 6f 6c 76 65 28 74 68 69 73 2e 70 72 6f 70 73 2e 6c 6f 61 64 65 72 28 29 29 7d 63 61 74 63 68 28 74 29 7b 74 68 69 73 2e 6c 6f 61 64 65 72 3d 77 2e 50 72 6f 6d 69 73 65 2e 72 65 6a 65 63 74 28 74 29 7d 72 65 74 75 72 6e 20 74 68 69 73 2e 6c 6f 61 64 65 72 7d 2c 6e 74 2e 70 72 6f 74 6f 74 79 70 65 2e 63 6f 6d 70 6f 6e 65 6e 74 44 69 64 4d 6f 75 6e 74 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 76 Data Ascii: n.dispatch),r}}}var et,rt=(O(nt,et=v),nt.prototype.getLoader=function(){if(void 0===this.loader)try{this.loader=w.Promise.resolve(this.props.loader())}catch(t){this.loader=w.Promise.reject(t)}return this.loader},nt.prototype.componentDidMount=function(){v
2022-04-20 12:59:51 UTC	2209	IN	Data Raw: 74 54 69 6d 65 6f 75 74 28 66 75 6e 63 74 69 6f 6e 28 29 7b 57 74 28 66 75 6e 63 74 69 6f 6e 28 29 7b 64 74 28 72 2e 65 6c 65 6d 65 6e 74 29 26 26 64 74 28 72 2e 62 61 73 65 29 26 26 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 76 61 72 20 72 3d 56 74 28 74 29 2c 6e 3d 56 74 28 65 29 2c 6f 3d 47 74 28 29 2c 69 3d 6e 2e 74 6f 70 3e 3d 72 2e 68 65 69 67 68 74 2b 37 3f 6e 2e 74 6f 70 2d 37 2d 72 2e 68 65 69 67 68 74 3a 6e 2e 62 6f 74 74 6f 6d 2b 37 2c 61 3d 6e 2e 77 69 64 74 68 2f 32 2b 6e 2e 6c 65 66 74 2d 72 2e 77 69 64 74 68 2f 32 3b 61 2b 72 2e 77 69 64 74 68 3e 6f 2e 72 69 67 68 74 26 26 28 61 3d 6f 2e 72 69 67 68 74 2d 72 2e 77 69 64 74 68 29 2c 61 3c 30 26 26 28 61 3d 30 29 2c 74 26 26 74 2e 73 74 79 6c 65 26 26 28 74 2e 73 74 79 6c 65 2e 6c 65 66 74 3d Data Ascii: tTimeout(function(){Wt(function(){dt(r.element)&&dt(r.base)&&function(t,e){var r=Vt(t),n=Vt(e),o=Gt(),i=n.top>=r.height+7?n.top-7-r.height:n.bottom+7,a=n.width/2+n.left-r.width/2;a+r.width>o.right&&(a=o.right-r.width),a<0&&(a=0),t&&t.style&&(t.style.left=
2022-04-20 12:59:51 UTC	2225	IN	Data Raw: 65 28 29 7d 7d 2c 79 72 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 7b 6e 61 6d 65 3a 22 53 69 67 6e 4f 75 74 41 6e 64 46 6f 72 67 65 74 46 72 6f 6d 49 64 70 22 2c 6f 70 65 72 61 74 69 6f 6e 3a 22 53 69 67 6e 4f 75 74 22 2c 73 65 72 76 69 63 65 3a 74 2e 74 6f 55 70 70 65 72 43 61 73 65 28 29 7d 7d 2c 76 72 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 7b 6e 61 6d 65 3a 22 46 6f 72 67 65 74 46 72 6f 6d 49 64 70 22 2c 6f 70 65 72 61 74 69 6f 6e 3a 22 46 6f 72 67 65 74 41 63 63 6f 75 6e 74 22 2c 73 65 72 76 69 63 65 3a 74 2e 74 6f 55 70 70 65 72 43 61 73 65 28 29 7d 7d 3b 66 75 6e 63 74 69 6f 6e 20 49 72 28 74 2c 65 29 7b 72 65 74 75 72 6e 20 74 2e 69 73 4f 70 65 72 61 74 69 6f 6e 53 75 70 70 6f 72 74 65 64 28 22 73 77 69 74 63 68 54 Data Ascii: e()}},yr=function(t){return{name:"SignOutAndForgetFromIdp",operation:"SignOut",service:t.toUpperCase()}},vr=function(t){return{name:"ForgetFromIdp",operation:"ForgetAccount",service:t.toUpperCase()}};function Ir(t,e){return t.isOperationSupported("switchT
2022-04-20 12:59:51 UTC	2241	IN	Data Raw: 73 74 65 64 20 66 6f 72 20 61 6e 20 61 63 63 6f 75 6e 74 20 6f 66 20 74 79 70 65 20 4d 53 41 20 62 75 74 20 56 31 20 63 6f 6e 66 69 67 20 64 69 64 6e 27 74 20 70 72 6f 76 69 64 65 20 61 6e 79 20 75 73 61 62 6c 65 20 73 75 70 70 6f 72 74 69 6e 67 20 64 65 74 61 69 6c 73 20 69 6e 20 74 68 65 20 27 72 70 44 61 74 61 27 20 70 72 6f 70 65 72 74 79 20 66 6f 72 20 4d 53 41 20 61 63 63 6f 75 6e 74 73 2e 22 29 7d 7d 2c 42 72 2e 70 72 6f 74 6f 74 79 70 65 2e 73 69 67 6e 4f 75 74 41 6e 64 46 6f 72 67 65 74 46 72 6f 6d 49 64 70 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 73 77 69 74 63 68 28 74 2e 61 63 63 6f 75 6e 74 2e 74 79 70 65 29 7b 63 61 73 65 22 61 61 64 22 3a 63 61 73 65 22 6d 73 61 46 65 64 22 3a 72 65 74 75 72 6e 20 74 68 69 73 2e 61 61 64 41 63 63 6f 75 6e 74 Data Ascii: sted for an account of type MSA but V1 config didn't provide any usable supporting details in the 'rpData' property for MSA accounts.")}},Br.prototype.signOutAndForgetFromIdp=function(t){switch(t.account.type){case"aad":case"msaFed":return this.aadAccount
2022-04-20 12:59:51 UTC	2257	IN	Data Raw: 31 22 3a 22 73 69 67 6e 6f 75 74 61 6e 64 66 6f 72 67 65 74 73 75 63 63 65 73 73 61 31 31 79 66 6f 72 6d 61 74 31 22 2c 4e 74 28 67 74 28 77 2e 67 65 74 53 74 72 69 6e 67 28 6e 29 2c 53 74 28 65 29 29 29 7d 66 75 6e 63 74 69 6f 6e 20 70 6e 28 74 2c 65 2c 72 2c 6e 29 7b 74 28 7b 74 79 70 65 3a 22 53 49 47 4e 4f 55 54 5f 41 43 43 4f 55 4e 54 5f 46 41 49 4c 45 44 22 2c 65 72 72 6f 72 3a 21 30 2c 70 61 79 6c 6f 61 64 3a 6e 2c 6d 65 74 61 3a 7b 61 63 63 6f 75 6e 74 49 64 3a 41 74 28 65 29 2c 66 6f 72 67 65 74 3a 72 7d 7d 29 3b 76 61 72 20 6f 3d 22 6e 6f 74 53 69 67 6e 65 64 49 6e 22 3d 3d 65 2e 61 75 74 68 65 6e 74 69 63 61 74 65 64 53 74 61 74 65 3f 22 66 6f 72 67 65 74 65 72 72 6f 72 61 31 31 79 66 6f 72 6d 61 74 31 22 3a 22 73 69 67 6e 6f 75 74 65 72 72 6f Data Ascii: 1":"signoutandforgetsuccessa11yformat1",Nt(gt(w.getString(n),St(e)))}function pn(t,e,r,n){t({type:"SIGNOUT_ACCOUNT_FAILED",error:!0,payload:n,meta:{accountId:At(e),forget:r}});var o="notSignedIn"==e.authenticatedState?"forgeterrora11yformat1":"signouterro
2022-04-20 12:59:51 UTC	2273	IN	Data Raw: 3d 65 2b 31 29 3a 28 72 2e 63 3d 2d 31 2c 6e 3d 21 30 29 7d 72 65 74 75 72 6e 21 6e 7d 28 72 2c 65 2c 6e 29 3f 5b 22 26 23 22 2c 6e 2e 63 2c 22 3b 22 5d 2e 6a 6f 69 6e 28 22 22 29 3a 22 22 7d 29 7d 2c 74 2e 66 69 6c 74 65 72 4f 62 6a 65 63 74 3d 59 74 2c 74 2e 66 69 6e 64 41 63 63 6f 75 6e 74 3d 54 74 2c 74 2e 66 6f 72 6d 61 74 3d 67 74 2c 74 2e 67 65 74 41 63 63 6f 75 6e 74 49 64 3d 41 74 2c 74 2e 67 65 74 41 63 63 6f 75 6e 74 4c 69 73 74 44 69 73 70 6c 61 79 4e 61 6d 65 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 69 66 28 74 2e 70 72 6f 66 69 6c 65 26 26 74 2e 70 72 6f 66 69 6c 65 2e 70 72 6f 66 69 6c 65 4e 61 6d 65 29 72 65 74 75 72 6e 20 74 2e 70 72 6f 66 69 6c 65 2e 70 72 6f 66 69 6c 65 4e 61 6d 65 3b 73 77 69 74 63 68 28 74 2e 74 79 70 65 29 7b 63 61 73 Data Ascii: =e+1):(r.c=-1,n=!0)}return!n}(r,e,n)?["&#",n.c,";"].join(""):""})},t.filterObject=Yt,t.findAccount=Tt,t.format=gt,t.getAccountId=At,t.getAccountListDisplayName=function(t){if(t.profile&&t.profile.profileName)return t.profile.profileName;switch(t.type){cas
2022-04-20 12:59:51 UTC	2289	IN	Data Raw: 37 36 61 33 2e 35 33 35 20 33 2e 35 33 35 20 30 20 30 30 2e 37 20 32 2e 33 36 37 20 32 2e 35 30 36 20 32 2e 35 30 36 20 30 20 30 30 32 2e 30 31 32 2e 38 31 38 20 32 2e 33 34 34 20 32 2e 33 34 34 20 30 20 30 30 31 2e 39 33 34 2d 2e 38 31 38 20 33 2e 37 38 20 33 2e 37 38 20 30 20 30 30 2e 36 36 34 2d 32 2e 34 32 35 20 33 2e 36 34 39 20 33 2e 36 34 39 20 30 20 30 30 2d 2e 36 38 38 2d 32 2e 34 31 31 20 32 2e 33 39 31 20 32 2e 33 39 31 20 30 20 30 30 2d 31 2e 39 33 2d 2e 38 31 33 20 32 2e 34 34 20 32 2e 34 34 20 30 20 30 30 2d 31 2e 39 38 37 2e 38 35 32 20 33 2e 37 30 37 20 33 2e 37 30 37 20 30 20 30 30 2d 2e 37 30 37 20 32 2e 34 33 6d 31 35 2e 34 36 34 2d 33 2e 31 30 39 48 39 39 2e 37 56 31 38 2e 34 68 2d 32 2e 33 35 39 76 2d 37 2e 39 38 38 68 2d 31 2e 36 35 Data Ascii: 76a3.535 3.535 0 00.7 2.367 2.506 2.506 0 002.012.818 2.344 2.344 0 001.934-.818 3.78 3.78 0 00.664-2.425 3.649 3.649 0 00-.688-2.411 2.391 2.391 0 00-1.93-.813 2.44 2.44 0 00-1.987.852 3.707 3.707 0 00-.707 2.43m15.464-3.109H99.7V18.4h-2.359v-7.988h-1.65
2022-04-20 12:59:51 UTC	2304	IN	Data Raw: 32 35 20 30 20 30 31 2e 33 37 36 2e 31 76 32 2e 33 35 37 61 32 2e 30 37 35 20 32 2e 30 37 35 20 30 20 30 30 2d 2e 35 33 35 2d 2e 32 35 35 20 32 2e 36 34 39 20 32 2e 36 34 39 20 30 20 30 30 2d 2e 38 35 31 2d 2e 31 32 20 31 2e 38 31 31 20 31 2e 38 31 31 20 30 20 30 30 2d 31 2e 34 34 39 2e 37 32 32 20 33 2e 34 37 20 33 2e 34 37 20 30 20 30 30 2d 2e 35 39 32 20 32 2e 32 32 33 56 31 38 2e 34 68 2d 32 2e 33 33 35 56 38 2e 35 30 37 68 32 2e 33 32 39 76 31 2e 35 35 39 68 2e 30 33 39 61 32 2e 37 33 31 20 32 2e 37 33 31 20 30 20 30 31 2e 39 36 32 2d 31 2e 32 36 36 20 32 2e 36 31 35 20 32 2e 36 31 35 20 30 20 30 31 31 2e 35 35 2d 2e 34 35 37 6d 31 20 35 2e 32 35 34 61 35 2e 33 35 35 20 35 2e 33 35 35 20 30 20 30 31 31 2e 33 38 37 2d 33 2e 38 38 37 20 35 2e 31 20 35 Data Ascii: 25 0 01.376.1v2.357a2.075 2.075 0 00-.535-.255 2.649 2.649 0 00-.851-.12 1.811 1.811 0 00-1.449.722 3.47 3.47 0 00-.592 2.223V18.4h-2.335V8.507h2.329v1.559h.039a2.731 2.731 0 01.962-1.266 2.615 2.615 0 011.55-.457m1 5.254a5.355 5.355 0 011.387-3.887 5.1 5
2022-04-20 12:59:51 UTC	2320	IN	Data Raw: 32 37 5c 78 32 35 33 45 5c 78 32 35 33 43 63 69 72 63 6c 65 20 63 78 5c 78 33 64 5c 78 32 37 33 32 5c 78 32 37 20 63 79 5c 78 33 64 5c 78 32 37 33 32 5c 78 32 37 20 72 5c 78 33 64 5c 78 32 37 33 30 2e 32 35 5c 78 32 37 20 73 74 72 6f 6b 65 2d 77 69 64 74 68 5c 78 33 64 5c 78 32 37 31 2e 35 5c 78 32 37 5c 78 32 66 5c 78 32 35 33 45 5c 78 32 35 33 43 67 20 74 72 61 6e 73 66 6f 72 6d 5c 78 33 64 5c 78 32 37 6d 61 74 72 69 78 5c 78 32 38 2e 39 20 30 20 30 20 2e 39 20 31 30 2e 34 33 31 20 31 30 2e 34 33 31 5c 78 32 39 5c 78 32 37 20 73 74 72 6f 6b 65 2d 77 69 64 74 68 5c 78 33 64 5c 78 32 37 32 5c 78 32 37 5c 78 32 35 33 45 5c 78 32 35 33 43 63 69 72 63 6c 65 20 63 78 5c 78 33 64 5c 78 32 37 32 34 2e 32 35 5c 78 32 37 20 63 79 5c 78 33 64 5c 78 32 37 31 38 5c Data Ascii: 27\x253E\x253Ccircle cx\x3d\x2732\x27 cy\x3d\x2732\x27 r\x3d\x2730.25\x27 stroke-width\x3d\x271.5\x27\x2f\x253E\x253Cg transform\x3d\x27matrix\x28.9 0 0 .9 10.431 10.431\x29\x27 stroke-width\x3d\x272\x27\x253E\x253Ccircle cx\x3d\x2724.25\x27 cy\x3d\x2718\

Timestamp	kBytes transferred	Direction	Data
2022-04-20 12:59:20 UTC	1	OUT	GET /1f34fac4-2ab4-4dfb-8248-a8cdec56b8f9/bS5iYWtrZXJAYnBkLm5s HTTP/1.1 Host: eccfo1.eu Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2022-04-20 12:59:20 UTC	5	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 20 Apr 2022 12:59:20 GMT Content-Type: text/html; charset=utf-8 Content-Length: 2152 Connection: close Vary: Accept-Encoding X-Frame-Options: SAMEORIGIN
2022-04-20 12:59:20 UTC	6	IN	Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 4f 66 66 69 63 65 20 33 36 35 20 2d 20 62 65 6c 61 6e 67 72 69 6a 6b 65 20 75 70 64 61 74 65 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2f 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 20 41 20 43 4c 41 53 53 45 53 20 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2f 0a 20 20 20 20 41 2e 42 75 74 74 6f 6e 4c 69 6e 6b 3a 6c 69 6e 6b 2c 20 41 2e 42 75 74 74 6f 6e 4c 69 6e 6b 3a 61 63 74 69 76 65 2c 20 41 2e 42 75 74 74 6f 6e 4c 69 6e 6b 3a 76 69 73 69 74 65 64 2c 20 41 2e 42 75 74 74 6f 6e 4c 69 6e 6b 3a 68 6f 76 65 72 20 7b 0a 20 20 20 20 20 20 20 20 46 4f 4e 54 2d 57 45 49 47 48 54 3a 20 6e 6f 72 6d 61 6c 3b 0a 20 20 20 20 Data Ascii: <html><head> <title>Office 365 - belangrijke update</title> <style> /****************** A CLASSES ******************/ A.ButtonLink:link, A.ButtonLink:active, A.ButtonLink:visited, A.ButtonLink:hover { FONT-WEIGHT: normal;

Timestamp	kBytes transferred	Direction	Data
2022-04-20 12:59:51 UTC	2333	OUT	GET /scripts/me/MeControl/10.21162.3/de-DE/meCore.min.js HTTP/1.1 Host: mem.gfx.ms Connection: keep-alive Origin: https://www.microsoft.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://www.microsoft.com/de-ch/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2022-04-20 12:59:51 UTC	2333	IN	HTTP/1.1 200 OK Content-Length: 102402 Content-Type: application/javascript Last-Modified: Thu, 20 Jan 2022 20:37:26 GMT ETag: "1d80e809708d702" X-Cache: TCP_HIT X-Content-Type-Options: nosniff Access-Control-Allow-Origin: * X-UA-Compatible: IE=edge Strict-Transport-Security: max-age=31536000; includeSubDomains X-Azure-Ref-OriginShield: 0Va5fYgAAAACLtwX0Is9iT5o2GTESHEQuQU1TMDRFREdFMTgxNABlYWM1ZjQ5Zi1lMDJkLTRmNDEtYjBhNi0yZDUwZjlmY2Y4NGE= X-Azure-Ref: 0xwNgYgAAAACRF/YGuJZMRpW8pPtbCJS1RlJBMjMxMDUwNDE5MDE3AGVhYzVmNDlmLWUwMmQtNGY0MS1iMGE2LTJkNTBmOWZjZjg0YQ== Date: Wed, 20 Apr 2022 12:59:51 GMT Connection: close
2022-04-20 12:59:51 UTC	2334	IN	Data Raw: 4d 65 43 6f 6e 74 72 6f 6c 44 65 66 69 6e 65 28 22 6d 65 43 6f 72 65 22 2c 5b 22 65 78 70 6f 72 74 73 22 2c 22 40 6d 65 63 6f 6e 74 72 6f 6c 2f 77 65 62 2d 69 6e 6c 69 6e 65 22 2c 22 40 6d 65 63 6f 6e 74 72 6f 6c 2f 77 65 62 2d 62 6f 6f 74 22 5d 2c 66 75 6e 63 74 69 6f 6e 28 74 2c 66 2c 68 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 72 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 72 65 74 75 72 6e 28 72 3d 4f 62 6a 65 63 74 2e 73 65 74 50 72 6f 74 6f 74 79 70 65 4f 66 7c 7c 7b 5f 5f 70 72 6f 74 6f 5f 5f 3a 5b 5d 7d 69 6e 73 74 61 6e 63 65 6f 66 20 41 72 72 61 79 26 26 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 74 2e 5f 5f 70 72 6f 74 6f 5f 5f 3d 65 7d 7c 7c 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 66 6f 72 28 76 61 72 20 6e 20 69 6e 20 65 29 Data Ascii: MeControlDefine("meCore",["exports","@mecontrol/web-inline","@mecontrol/web-boot"],function(t,f,h){"use strict";var r=function(t,e){return(r=Object.setPrototypeOf\|\|{__proto__:[]}instanceof Array&&function(t,e){t.__proto__=e}\|\|function(t,e){for(var n in e)
2022-04-20 12:59:51 UTC	2349	IN	Data Raw: 2e 73 63 72 6f 6c 6c 48 61 6e 64 6c 65 72 3d 68 2e 64 65 62 6f 75 6e 63 65 28 65 2e 65 78 70 61 6e 64 65 64 53 63 72 6f 6c 6c 48 61 6e 64 6c 65 72 2e 62 69 6e 64 28 65 29 29 2c 65 2e 73 74 61 74 65 3d 7b 65 78 70 61 6e 64 65 64 3a 21 31 7d 2c 65 7d 66 75 6e 63 74 69 6f 6e 20 51 28 74 2c 65 2c 6e 29 7b 76 61 72 20 72 3d 6e 65 77 20 66 2e 53 79 6e 74 68 65 74 69 63 45 76 65 6e 74 28 22 63 6f 6d 6d 61 6e 64 63 6c 69 63 6b 22 2c 7b 63 6f 6d 6d 61 6e 64 49 64 3a 65 2e 69 64 2c 63 75 72 72 65 6e 74 41 63 63 6f 75 6e 74 3a 6e 7d 29 2c 6f 3d 66 2e 67 65 74 4f 70 74 69 6f 6e 73 28 29 3b 6f 26 26 28 6f 2e 73 79 6e 74 68 65 74 69 63 45 76 65 6e 74 54 61 72 67 65 74 2e 64 69 73 70 61 74 63 68 45 76 65 6e 74 28 72 29 7c 7c 74 2e 70 72 65 76 65 6e 74 44 65 66 61 75 6c Data Ascii: .scrollHandler=h.debounce(e.expandedScrollHandler.bind(e)),e.state={expanded:!1},e}function Q(t,e,n){var r=new f.SyntheticEvent("commandclick",{commandId:e.id,currentAccount:n}),o=f.getOptions();o&&(o.syntheticEventTarget.dispatchEvent(r)\|\|t.preventDefaul
2022-04-20 12:59:51 UTC	2365	IN	Data Raw: 74 61 3a 66 2e 61 73 73 69 67 6e 28 7b 7d 2c 74 2e 70 61 72 74 43 2c 7b 62 61 73 65 44 61 74 61 3a 74 2e 70 61 72 74 42 26 26 66 2e 61 73 73 69 67 6e 28 7b 7d 2c 74 2e 70 61 72 74 42 29 7d 29 7d 2c 7b 65 78 74 3a 66 2e 61 73 73 69 67 6e 28 7b 7d 2c 74 2e 70 61 72 74 41 2e 65 78 74 29 7d 5d 2e 6d 61 70 28 55 74 29 2e 6a 6f 69 6e 28 22 2c 22 29 2b 22 7d 22 7d 66 75 6e 63 74 69 6f 6e 20 55 74 28 6e 29 7b 72 65 74 75 72 6e 20 6e 3f 4f 62 6a 65 63 74 2e 67 65 74 4f 77 6e 50 72 6f 70 65 72 74 79 4e 61 6d 65 73 28 6e 29 2e 6d 61 70 28 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 61 72 20 65 3d 6e 5b 74 5d 3b 73 77 69 74 63 68 28 74 79 70 65 6f 66 20 65 29 7b 63 61 73 65 22 6f 62 6a 65 63 74 22 3a 72 65 74 75 72 6e 20 6e 75 6c 6c 21 3d 3d 65 3f 27 22 27 2b 74 2b 27 22 Data Ascii: ta:f.assign({},t.partC,{baseData:t.partB&&f.assign({},t.partB)})},{ext:f.assign({},t.partA.ext)}].map(Ut).join(",")+"}"}function Ut(n){return n?Object.getOwnPropertyNames(n).map(function(t){var e=n[t];switch(typeof e){case"object":return null!==e?'"'+t+'"
2022-04-20 12:59:51 UTC	2381	IN	Data Raw: 78 33 61 72 67 62 61 5c 78 32 38 32 35 35 2c 32 35 35 2c 32 35 35 2c 2e 31 36 5c 78 32 39 5c 78 37 64 2e 63 2d 75 68 66 68 5c 78 33 65 2e 74 68 65 6d 65 2d 64 61 72 6b 20 2e 63 2d 6d 65 20 2e 6d 65 63 74 72 6c 5f 63 75 72 72 65 6e 74 41 63 63 6f 75 6e 74 20 61 2e 6d 65 63 74 72 6c 5f 73 69 67 6e 6f 75 74 5c 78 33 61 61 63 74 69 76 65 2c 2e 63 2d 75 68 66 68 5c 78 33 65 2e 74 68 65 6d 65 2d 64 61 72 6b 20 2e 63 2d 6d 65 20 2e 6d 65 63 74 72 6c 5f 63 75 72 72 65 6e 74 41 63 63 6f 75 6e 74 20 62 75 74 74 6f 6e 2e 6d 65 63 74 72 6c 5f 73 69 67 6e 6f 75 74 5c 78 33 61 61 63 74 69 76 65 2c 2e 6d 65 63 74 72 6c 5f 74 68 65 6d 65 5f 64 61 72 6b 20 2e 6d 65 63 74 72 6c 5f 63 75 72 72 65 6e 74 41 63 63 6f 75 6e 74 20 61 2e 6d 65 63 74 72 6c 5f 73 69 67 6e 6f 75 74 Data Ascii: x3argba\x28255,255,255,.16\x29\x7d.c-uhfh\x3e.theme-dark .c-me .mectrl_currentAccount a.mectrl_signout\x3aactive,.c-uhfh\x3e.theme-dark .c-me .mectrl_currentAccount button.mectrl_signout\x3aactive,.mectrl_theme_dark .mectrl_currentAccount a.mectrl_signout
2022-04-20 12:59:51 UTC	2397	IN	Data Raw: 6d 65 63 74 72 6c 5f 74 72 69 67 67 65 72 2e 65 78 70 61 6e 64 65 64 2c 2e 6d 65 63 74 72 6c 5f 74 68 65 6d 65 5f 6f 66 66 5f 62 6c 61 63 6b 20 2e 6d 65 63 74 72 6c 5f 63 6f 6d 6d 61 6e 64 73 20 2e 6d 6f 72 65 43 6f 6d 6d 61 6e 64 73 20 2e 6d 65 63 74 72 6c 5f 74 72 69 67 67 65 72 5c 78 33 61 68 6f 76 65 72 5c 78 37 62 63 6f 6c 6f 72 5c 78 33 61 69 6e 68 65 72 69 74 5c 78 33 62 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 5c 78 33 61 5c 78 32 33 35 30 35 30 35 30 5c 78 37 64 2e 6d 65 63 74 72 6c 5f 74 68 65 6d 65 5f 6f 66 66 5f 62 6c 61 63 6b 20 2e 6d 65 63 74 72 6c 5f 63 6f 6d 6d 61 6e 64 73 20 2e 6d 6f 72 65 43 6f 6d 6d 61 6e 64 73 20 2e 6d 65 63 74 72 6c 5f 74 72 69 67 67 65 72 5c 78 33 61 61 63 74 69 76 65 5c 78 37 62 63 6f 6c 6f 72 5c 78 33 61 69 Data Ascii: mectrl_trigger.expanded,.mectrl_theme_off_black .mectrl_commands .moreCommands .mectrl_trigger\x3ahover\x7bcolor\x3ainherit\x3bbackground-color\x3a\x23505050\x7d.mectrl_theme_off_black .mectrl_commands .moreCommands .mectrl_trigger\x3aactive\x7bcolor\x3ai
2022-04-20 12:59:51 UTC	2413	IN	Data Raw: 74 69 6f 6e 5c 78 33 61 66 6f 63 75 73 5c 78 37 62 6f 75 74 6c 69 6e 65 2d 6f 66 66 73 65 74 5c 78 33 61 2d 33 70 78 5c 78 37 64 5c 78 37 64 5c 78 34 30 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 5c 78 32 38 2d 6d 73 2d 68 69 67 68 2d 63 6f 6e 74 72 61 73 74 5c 78 33 61 77 68 69 74 65 2d 6f 6e 2d 62 6c 61 63 6b 5c 78 32 39 5c 78 37 62 2e 6d 65 63 74 72 6c 5f 61 63 63 6f 75 6e 74 49 74 65 6d 20 2e 70 72 69 6d 61 72 79 41 63 74 69 6f 6e 5c 78 33 61 61 63 74 69 76 65 2c 2e 6d 65 63 74 72 6c 5f 61 63 63 6f 75 6e 74 49 74 65 6d 20 2e 70 72 69 6d 61 72 79 41 63 74 69 6f 6e 5c 78 33 61 66 6f 63 75 73 2c 2e 6d 65 63 74 72 6c 5f 61 63 63 6f 75 6e 74 49 74 65 6d 20 2e 70 72 69 6d 61 72 79 41 63 74 69 6f 6e 5c 78 33 61 68 6f 76 65 72 5c 78 37 62 62 61 63 6b Data Ascii: tion\x3afocus\x7boutline-offset\x3a-3px\x7d\x7d\x40media screen and \x28-ms-high-contrast\x3awhite-on-black\x29\x7b.mectrl_accountItem .primaryAction\x3aactive,.mectrl_accountItem .primaryAction\x3afocus,.mectrl_accountItem .primaryAction\x3ahover\x7bback
2022-04-20 12:59:51 UTC	2429	IN	Data Raw: 78 33 61 64 65 66 61 75 6c 74 5c 78 37 64 2e 6d 65 63 74 72 6c 5f 61 63 63 6f 75 6e 74 41 63 74 69 6f 6e 73 20 2e 6d 65 63 74 72 6c 5f 74 72 69 67 67 65 72 2c 2e 6d 65 63 74 72 6c 5f 61 63 63 6f 75 6e 74 41 63 74 69 6f 6e 73 20 2e 6d 65 63 74 72 6c 5f 74 72 69 67 67 65 72 5c 78 33 61 66 6f 63 75 73 5c 78 37 62 63 6f 6c 6f 72 5c 78 33 61 69 6e 68 65 72 69 74 5c 78 33 62 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 5c 78 33 61 69 6e 68 65 72 69 74 5c 78 37 64 2e 6d 65 63 74 72 6c 5f 61 63 63 6f 75 6e 74 41 63 74 69 6f 6e 73 20 2e 6d 65 63 74 72 6c 5f 74 72 69 67 67 65 72 2e 65 78 70 61 6e 64 65 64 2c 2e 6d 65 63 74 72 6c 5f 61 63 63 6f 75 6e 74 41 63 74 69 6f 6e 73 20 2e 6d 65 63 74 72 6c 5f 74 72 69 67 67 65 72 5c 78 33 61 68 6f 76 65 72 5c 78 37 62 62 Data Ascii: x3adefault\x7d.mectrl_accountActions .mectrl_trigger,.mectrl_accountActions .mectrl_trigger\x3afocus\x7bcolor\x3ainherit\x3bbackground-color\x3ainherit\x7d.mectrl_accountActions .mectrl_trigger.expanded,.mectrl_accountActions .mectrl_trigger\x3ahover\x7bb

Timestamp	kBytes transferred	Direction	Data
2022-04-20 12:59:56 UTC	2434	OUT	GET /meversion?partner=officetemplates&market=en-us&uhf=1 HTTP/1.1 Host: mem.gfx.ms Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://templates.office.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2022-04-20 12:59:56 UTC	2434	IN	HTTP/1.1 200 OK Cache-Control: public, no-transform, max-age=43200 Content-Length: 28761 Content-Type: application/javascript Expires: Wed, 20 Apr 2022 18:55:57 GMT X-Cache: TCP_HIT X-Content-Type-Options: nosniff Access-Control-Allow-Origin: * X-UA-Compatible: IE=edge Strict-Transport-Security: max-age=31536000; includeSubDomains X-Azure-Ref-OriginShield: 0crVfYgAAAACjCKlkTxHrQo5KmfSa5E0oQU1TMDRFREdFMTkwOQBlYWM1ZjQ5Zi1lMDJkLTRmNDEtYjBhNi0yZDUwZjlmY2Y4NGE= X-Azure-Ref: 0zANgYgAAAACSNq0wirfBT4/QYWdjH3mSRlJBMjMxMDUwNDE3MDMzAGVhYzVmNDlmLWUwMmQtNGY0MS1iMGE2LTJkNTBmOWZjZjg0YQ== Date: Wed, 20 Apr 2022 12:59:55 GMT Connection: close
2022-04-20 12:59:56 UTC	2435	IN	Data Raw: 77 69 6e 64 6f 77 2e 4d 53 41 3d 77 69 6e 64 6f 77 2e 4d 53 41 7c 7c 7b 7d 3b 77 69 6e 64 6f 77 2e 4d 53 41 2e 4d 65 43 6f 6e 74 72 6f 6c 3d 77 69 6e 64 6f 77 2e 4d 53 41 2e 4d 65 43 6f 6e 74 72 6f 6c 7c 7c 7b 7d 3b 77 69 6e 64 6f 77 2e 4d 53 41 2e 4d 65 43 6f 6e 74 72 6f 6c 2e 43 6f 6e 66 69 67 3d 7b 22 76 65 72 22 3a 22 31 30 2e 32 31 31 36 32 2e 33 22 2c 22 6d 6b 74 22 3a 22 65 6e 2d 55 53 22 2c 22 70 74 6e 22 3a 22 6f 66 66 69 63 65 74 65 6d 70 6c 61 74 65 73 22 2c 22 67 66 78 22 3a 22 68 74 74 70 73 3a 2f 2f 6d 65 6d 2e 67 66 78 2e 6d 73 22 2c 22 64 62 67 22 3a 66 61 6c 73 65 2c 22 61 61 64 22 3a 74 72 75 65 2c 22 69 6e 74 22 3a 66 61 6c 73 65 2c 22 70 78 79 22 3a 74 72 75 65 2c 22 6d 73 54 78 74 22 3a 66 61 6c 73 65 2c 22 72 77 64 22 3a 74 72 75 65 Data Ascii: window.MSA=window.MSA\|\|{};window.MSA.MeControl=window.MSA.MeControl\|\|{};window.MSA.MeControl.Config={"ver":"10.21162.3","mkt":"en-US","ptn":"officetemplates","gfx":"https://mem.gfx.ms","dbg":false,"aad":true,"int":false,"pxy":true,"msTxt":false,"rwd":true
2022-04-20 12:59:56 UTC	2450	IN	Data Raw: 29 2c 69 28 65 29 7d 29 2e 63 61 74 63 68 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 6e 3d 65 2e 6d 63 49 73 54 69 6d 65 6f 75 74 3f 22 52 65 73 6f 6c 76 69 6e 67 20 64 65 70 73 20 61 6e 64 20 65 78 70 6f 72 74 73 20 74 69 6d 65 64 20 6f 75 74 22 3a 22 52 65 73 6f 6c 76 69 6e 67 20 64 65 70 73 20 61 6e 64 20 65 78 70 6f 72 74 73 20 66 61 69 6c 65 64 22 3b 7a 65 28 73 2c 74 2c 63 2c 21 30 2c 6e 29 2c 61 28 41 28 6e 2b 22 3a 20 22 2b 73 2b 22 20 28 22 2b 63 2b 22 29 2e 20 49 6e 6e 65 72 20 65 72 72 6f 72 3a 20 22 2b 65 2e 6d 65 73 73 61 67 65 2c 65 2e 6d 63 49 73 54 69 6d 65 6f 75 74 29 29 7d 29 3b 65 6c 73 65 7b 76 61 72 20 6f 3d 76 6f 69 64 20 30 3b 6f 3d 70 2e 4d 65 43 6f 6e 74 72 6f 6c 44 65 66 69 6e 65 21 3d 57 65 3f 22 77 69 6e 64 6f 77 2e 4d Data Ascii: ),i(e)}).catch(function(e){var n=e.mcIsTimeout?"Resolving deps and exports timed out":"Resolving deps and exports failed";ze(s,t,c,!0,n),a(A(n+": "+s+" ("+c+"). Inner error: "+e.message,e.mcIsTimeout))});else{var o=void 0;o=p.MeControlDefine!=We?"window.M

Timestamp	kBytes transferred	Direction	Data
2022-04-20 13:00:13 UTC	2463	OUT	GET /meversion?partner=SMCConvergence&market=en-us&uhf=1 HTTP/1.1 Host: mem.gfx.ms Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://support.microsoft.com/en-us/office?ui=en-us&rs=en-us&ad=us Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2022-04-20 13:00:13 UTC	2464	IN	HTTP/1.1 200 OK Cache-Control: public, no-transform, max-age=43200 Content-Length: 28759 Content-Type: application/javascript Expires: Wed, 20 Apr 2022 11:17:28 GMT X-Cache: TCP_HIT X-Content-Type-Options: nosniff Access-Control-Allow-Origin: * X-UA-Compatible: IE=edge Strict-Transport-Security: max-age=31536000; includeSubDomains X-Azure-Ref-OriginShield: 0B6RfYgAAAAC32wDaD4imTK5UEJtrLcI/QU1TMDRFREdFMTkxNgBlYWM1ZjQ5Zi1lMDJkLTRmNDEtYjBhNi0yZDUwZjlmY2Y4NGE= X-Azure-Ref: 03QNgYgAAAADq6NHwuM0qRoqLYBFUPBIORlJBMjMxMDUwNDE5MDIxAGVhYzVmNDlmLWUwMmQtNGY0MS1iMGE2LTJkNTBmOWZjZjg0YQ== Date: Wed, 20 Apr 2022 13:00:12 GMT Connection: close
2022-04-20 13:00:13 UTC	2464	IN	Data Raw: 77 69 6e 64 6f 77 2e 4d 53 41 3d 77 69 6e 64 6f 77 2e 4d 53 41 7c 7c 7b 7d 3b 77 69 6e 64 6f 77 2e 4d 53 41 2e 4d 65 43 6f 6e 74 72 6f 6c 3d 77 69 6e 64 6f 77 2e 4d 53 41 2e 4d 65 43 6f 6e 74 72 6f 6c 7c 7c 7b 7d 3b 77 69 6e 64 6f 77 2e 4d 53 41 2e 4d 65 43 6f 6e 74 72 6f 6c 2e 43 6f 6e 66 69 67 3d 7b 22 76 65 72 22 3a 22 31 30 2e 32 31 31 36 32 2e 33 22 2c 22 6d 6b 74 22 3a 22 65 6e 2d 55 53 22 2c 22 70 74 6e 22 3a 22 73 6d 63 63 6f 6e 76 65 72 67 65 6e 63 65 22 2c 22 67 66 78 22 3a 22 68 74 74 70 73 3a 2f 2f 6d 65 6d 2e 67 66 78 2e 6d 73 22 2c 22 64 62 67 22 3a 66 61 6c 73 65 2c 22 61 61 64 22 3a 74 72 75 65 2c 22 69 6e 74 22 3a 66 61 6c 73 65 2c 22 70 78 79 22 3a 74 72 75 65 2c 22 6d 73 54 78 74 22 3a 66 61 6c 73 65 2c 22 72 77 64 22 3a 74 72 75 65 2c Data Ascii: window.MSA=window.MSA\|\|{};window.MSA.MeControl=window.MSA.MeControl\|\|{};window.MSA.MeControl.Config={"ver":"10.21162.3","mkt":"en-US","ptn":"smcconvergence","gfx":"https://mem.gfx.ms","dbg":false,"aad":true,"int":false,"pxy":true,"msTxt":false,"rwd":true,
2022-04-20 13:00:13 UTC	2480	IN	Data Raw: 69 28 65 29 7d 29 2e 63 61 74 63 68 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 6e 3d 65 2e 6d 63 49 73 54 69 6d 65 6f 75 74 3f 22 52 65 73 6f 6c 76 69 6e 67 20 64 65 70 73 20 61 6e 64 20 65 78 70 6f 72 74 73 20 74 69 6d 65 64 20 6f 75 74 22 3a 22 52 65 73 6f 6c 76 69 6e 67 20 64 65 70 73 20 61 6e 64 20 65 78 70 6f 72 74 73 20 66 61 69 6c 65 64 22 3b 7a 65 28 73 2c 74 2c 63 2c 21 30 2c 6e 29 2c 61 28 41 28 6e 2b 22 3a 20 22 2b 73 2b 22 20 28 22 2b 63 2b 22 29 2e 20 49 6e 6e 65 72 20 65 72 72 6f 72 3a 20 22 2b 65 2e 6d 65 73 73 61 67 65 2c 65 2e 6d 63 49 73 54 69 6d 65 6f 75 74 29 29 7d 29 3b 65 6c 73 65 7b 76 61 72 20 6f 3d 76 6f 69 64 20 30 3b 6f 3d 70 2e 4d 65 43 6f 6e 74 72 6f 6c 44 65 66 69 6e 65 21 3d 57 65 3f 22 77 69 6e 64 6f 77 2e 4d 65 43 Data Ascii: i(e)}).catch(function(e){var n=e.mcIsTimeout?"Resolving deps and exports timed out":"Resolving deps and exports failed";ze(s,t,c,!0,n),a(A(n+": "+s+" ("+c+"). Inner error: "+e.message,e.mcIsTimeout))});else{var o=void 0;o=p.MeControlDefine!=We?"window.MeC

Timestamp	kBytes transferred	Direction	Data
2022-04-20 12:59:20 UTC	8	OUT	GET /static/windows_logo.png HTTP/1.1 Host: eccfo1.eu Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept: image/avif,image/webp,image/apng,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://eccfo1.eu/1f34fac4-2ab4-4dfb-8248-a8cdec56b8f9/bS5iYWtrZXJAYnBkLm5s Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2022-04-20 12:59:20 UTC	8	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 20 Apr 2022 12:59:20 GMT Content-Type: image/png Content-Length: 2038 Last-Modified: Tue, 03 Nov 2020 16:38:35 GMT Connection: close ETag: "5fa1878b-7f6" Accept-Ranges: bytes
2022-04-20 12:59:20 UTC	8	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 7d 00 00 00 1b 08 02 00 00 00 de 4f 17 35 00 00 00 07 74 49 4d 45 07 e2 0a 14 0e 20 34 bc 3d 35 5d 00 00 00 09 70 48 59 73 00 00 0e c3 00 00 0e c3 01 c7 6f a8 64 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 07 85 49 44 41 54 78 da ed 98 4b 4c 94 57 14 c7 47 d3 34 5d b8 e9 d6 26 35 69 dc b4 89 26 35 6d d2 34 ba 69 d2 45 17 75 a1 91 74 d5 36 69 77 8d 2b 45 c0 37 a0 88 a2 02 be c5 fa 40 19 1e 2a 8f aa 51 18 06 14 10 11 ad f8 7e c6 b7 08 68 41 66 60 be 19 1e 2a fd 39 ff 70 fd 32 2f d8 94 e9 62 4e 6e c8 7c e7 9e 7b ee b9 ff 7b 5e 17 87 f5 f3 37 56 d2 cc 58 63 c1 0c ef af b3 fd 5e 6f 61 e3 2f 6b eb 3e 58 e7 9e 12 6d 64 b9 3f ca ab ff dc f2 fb 46 12 34 16 39 7c 49 33 7c 73 a7 c7 18 d6 dc e9 9e 9f Data Ascii: PNGIHDR}O5tIME 4=5]pHYsodgAMAaIDATxKLWG4]&5i&5m4iEut6iw+E7@Q~hAf`9p2/bNn\|{{^7VXc^oa/k>Xmd?F49\|I3\|s

Timestamp	kBytes transferred	Direction	Data
2022-04-20 12:59:20 UTC	10	OUT	GET /static/icon_check.png HTTP/1.1 Host: eccfo1.eu Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept: image/avif,image/webp,image/apng,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://eccfo1.eu/1f34fac4-2ab4-4dfb-8248-a8cdec56b8f9/bS5iYWtrZXJAYnBkLm5s Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2022-04-20 12:59:20 UTC	11	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 20 Apr 2022 12:59:20 GMT Content-Type: image/png Content-Length: 1307 Last-Modified: Tue, 03 Nov 2020 16:37:09 GMT Connection: close ETag: "5fa18735-51b" Accept-Ranges: bytes
2022-04-20 12:59:20 UTC	12	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 25 00 00 00 25 08 02 00 00 00 4a fc b7 54 00 00 00 2d 74 45 58 74 43 72 65 61 74 69 6f 6e 20 54 69 6d 65 00 73 c3 b6 6e 20 32 31 20 6f 6b 74 20 32 30 31 38 20 32 32 3a 30 39 3a 32 30 20 2b 30 31 30 30 7c cb 73 fe 00 00 00 07 74 49 4d 45 07 e2 0a 15 14 09 2e ac 14 12 0f 00 00 00 09 70 48 59 73 00 00 0b 12 00 00 0b 12 01 d2 dd 7e fc 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 04 71 49 44 41 54 78 da ad 57 87 4f 53 41 18 7f ff 85 23 1a f7 48 10 45 05 11 8d 46 c4 1d e3 de 8b 18 d0 44 c5 19 f7 c6 81 db e0 88 31 18 24 04 17 31 c4 8d 18 b7 40 6b a9 22 b4 14 84 d2 01 94 32 ca 2e d2 81 15 7f f0 e1 51 4a fb de 2b 72 b9 bc dc bb fb ee fb dd f8 c6 ef b8 16 11 c5 f1 e7 b7 a4 f6 d3 cd a2 8b 7b f2 c2 43 Data Ascii: PNGIHDR%%JT-tEXtCreation Timesn 21 okt 2018 22:09:20 +0100\|stIME.pHYs~gAMAaqIDATxWOSA#HEFD1$1@k"2.QJ+r{C