Moderator, please move this post to correct forum, if this is not it...

My Windows 8.1.1 is running in VMware player as a virtual machine on a Windows 7 desktop. With Wireshark, I've captured the network traffic flowing through VMware network adapter. Couple of questions related to this capture...

When W8 is starting up, the traffic is just broadcast that's trying to resolve some of the names. When a user account logs in, there are number of connections made to the internet, such as MS, apps, and virus update check. One connection to the internet was made to Facebook, starting out as HTTP and turning into an HTTPS connection. This is how the information exchange looks in Wireshark:

Click image for larger version

Following the TCP stream shows this, partial display:

Click image for larger version

The Facebook connection to their server in Ireland is a one time deal, well, at least I did not monitor it for hours. Nonetheless, the facabook connection takes place every time when the user account logs in. To verify that my user ID didn't unknowingly had Facebook app installed, created a new user account. After logging in with the new account, the very same connection to Facebook was made. Any subsequent login had the same results...

Since I do not have Facebook app, nor did I accessed Facebook from this virtual W8 box, I started to wonder what's the purpose of this connection?

A quick search in the registry, under the HKEY_CURRENT_USER hive, showed lot's of entries for Facebook. So, it seems to be called from somewhere there.

Would anyone know how to disable the Facebook connection in the registry, or whatever other location?
TIA...