Windows Analysis Report
7F95320763FDCB0F731CE91FB8E178D4110E10A1D56836F442BA34C6F2A631F6.exe

Machine Learning detection for sample

Source: Yara match	File source: 7F95320763FDCB0F731CE91FB8E178D4110E10A1D56836F442BA34C6F2A631F6.exe, type: SAMPLE
Source: Yara match	File source: 0.0.7F95320763FDCB0F731CE91FB8E178D4110E10A1D56836F442BA34C6F2A631F6.exe.680000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.2056954933.0000000000682000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 7F95320763FDCB0F731CE91FB8E178D4110E10A1D56836F442BA34C6F2A631F6.exe PID: 5352, type: MEMORYSTR

Source: 7F95320763FDCB0F731CE91FB8E178D4110E10A1D56836F442BA34C6F2A631F6.exe

Joe Sandbox ML: detected

Source: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=7F95320763FDCB0F731CE91FB8E178D4110E10A1D56836F442BA34C6F2A631F6.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	HTTP Parser: No favicon
Source: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=7F95320763FDCB0F731CE91FB8E178D4110E10A1D56836F442BA34C6F2A631F6.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	HTTP Parser: No favicon
Source: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=7F95320763FDCB0F731CE91FB8E178D4110E10A1D56836F442BA34C6F2A631F6.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	HTTP Parser: No favicon

Source: 7F95320763FDCB0F731CE91FB8E178D4110E10A1D56836F442BA34C6F2A631F6.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 23.1.237.91:443 -> 192.168.2.5:49756 version: TLS 1.0

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.5:49726 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.5:49727 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.85.23.86:443 -> 192.168.2.5:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.85.23.86:443 -> 192.168.2.5:63959 version: TLS 1.2

Source: 7F95320763FDCB0F731CE91FB8E178D4110E10A1D56836F442BA34C6F2A631F6.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: 7F95320763FDCB0F731CE91FB8E178D4110E10A1D56836F442BA34C6F2A631F6.exe, 00000000.00000000.2056954933.0000000000682000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: autorun.inf
Source: 7F95320763FDCB0F731CE91FB8E178D4110E10A1D56836F442BA34C6F2A631F6.exe, 00000000.00000000.2056954933.0000000000682000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: [autorun]
Source: 7F95320763FDCB0F731CE91FB8E178D4110E10A1D56836F442BA34C6F2A631F6.exe	Binary or memory string: autorun.inf
Source: 7F95320763FDCB0F731CE91FB8E178D4110E10A1D56836F442BA34C6F2A631F6.exe	Binary or memory string: [autorun]

Source: global traffic

TCP traffic: 192.168.2.5:63957 -> 1.1.1.1:53

Source: Joe Sandbox View	IP Address: 13.107.246.42 13.107.246.42
Source: Joe Sandbox View	IP Address: 13.107.246.60 13.107.246.60
Source: Joe Sandbox View	IP Address: 239.255.255.250 239.255.255.250

Source: Joe Sandbox View	JA3 fingerprint: 1138de370e523e824bbca92d049a3777
Source: Joe Sandbox View	JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4

Source: unknown

HTTPS traffic detected: 23.1.237.91:443 -> 192.168.2.5:49756 version: TLS 1.0

Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /mscc/lib/v2/wcp-consent.js HTTP/1.1Host: wcpstatic.microsoft.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://learn.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /scripts/c/ms.jsll-4.min.js HTTP/1.1Host: js.monitor.azure.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://learn.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /mscc/lib/v2/wcp-consent.js HTTP/1.1Host: wcpstatic.microsoft.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /scripts/c/ms.jsll-4.min.js HTTP/1.1Host: js.monitor.azure.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=S8+5YrXKhXghv93&MD=EDNDSfnb HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=S8+5YrXKhXghv93&MD=EDNDSfnb HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com

Source: chromecache_180.4.dr, chromecache_187.4.dr	String found in binary or memory: href="https://www.facebook.com/sharer/sharer.php?u=${s}" equals www.facebook.com (Facebook)
Source: chromecache_180.4.dr, chromecache_187.4.dr	String found in binary or memory: href="https://www.linkedin.com/cws/share?url=${s}" equals www.linkedin.com (Linkedin)
Source: chromecache_180.4.dr, chromecache_187.4.dr	String found in binary or memory: </section>`}function Ise(e=hT,t=Gd){return Ha(UB,e,t)}function Pse(e=TT,t=yT){return Ha(aB,e,t)}var yI=(s=>(s.facebook="facebook",s.twitter="twitter",s.linkedin="linkedin",s.email="email",s.weibo="weibo",s))(yI\|\|{}),xke={facebook:"https://www.facebook.com/sharer/sharer.php?u={url}",twitter:"https://twitter.com/intent/tweet?original_referer={url}&text={achievementCopy}&tw_p=tweetbutton&url={url}",linkedin:"https://www.linkedin.com/feed/?shareActive=true&text={body}",email:"mailto:?subject={subject}&body={body}",weibo:"http://service.weibo.com/share/share.php?title={title}&url={url}"};function ex(e,t,n){let o=encodeURIComponent(t),r=new URL(e);r.hostname="learn.microsoft.com";let s=r.href+=(e.indexOf("?")!==-1?"&":"?")+"WT.mc_id=",i=R.sharingId?`&sharingId=${R.sharingId}`:"";return Object.values(yI).reduce((l,c)=>{if(_.data.isPermissioned)return l[c]="#",l;let u=encodeURIComponent(s+c+i),d=n?.achievementCopyTitle?.overrideTitle??t,p=encodeURIComponent(c8.replace("{achievementTitle}",n?.achievementCopyTitle?.isUnquoted?`${d}`:`"${d}"`)),g={achievementCopy:p,url:u,title:o,body:`${p}${encodeURIComponent(` equals www.facebook.com (Facebook)
Source: chromecache_180.4.dr, chromecache_187.4.dr	String found in binary or memory: </section>`}function Ise(e=hT,t=Gd){return Ha(UB,e,t)}function Pse(e=TT,t=yT){return Ha(aB,e,t)}var yI=(s=>(s.facebook="facebook",s.twitter="twitter",s.linkedin="linkedin",s.email="email",s.weibo="weibo",s))(yI\|\|{}),xke={facebook:"https://www.facebook.com/sharer/sharer.php?u={url}",twitter:"https://twitter.com/intent/tweet?original_referer={url}&text={achievementCopy}&tw_p=tweetbutton&url={url}",linkedin:"https://www.linkedin.com/feed/?shareActive=true&text={body}",email:"mailto:?subject={subject}&body={body}",weibo:"http://service.weibo.com/share/share.php?title={title}&url={url}"};function ex(e,t,n){let o=encodeURIComponent(t),r=new URL(e);r.hostname="learn.microsoft.com";let s=r.href+=(e.indexOf("?")!==-1?"&":"?")+"WT.mc_id=",i=R.sharingId?`&sharingId=${R.sharingId}`:"";return Object.values(yI).reduce((l,c)=>{if(_.data.isPermissioned)return l[c]="#",l;let u=encodeURIComponent(s+c+i),d=n?.achievementCopyTitle?.overrideTitle??t,p=encodeURIComponent(c8.replace("{achievementTitle}",n?.achievementCopyTitle?.isUnquoted?`${d}`:`"${d}"`)),g={achievementCopy:p,url:u,title:o,body:`${p}${encodeURIComponent(` equals www.linkedin.com (Linkedin)
Source: chromecache_180.4.dr, chromecache_187.4.dr	String found in binary or memory: </section>`}function Ise(e=hT,t=Gd){return Ha(UB,e,t)}function Pse(e=TT,t=yT){return Ha(aB,e,t)}var yI=(s=>(s.facebook="facebook",s.twitter="twitter",s.linkedin="linkedin",s.email="email",s.weibo="weibo",s))(yI\|\|{}),xke={facebook:"https://www.facebook.com/sharer/sharer.php?u={url}",twitter:"https://twitter.com/intent/tweet?original_referer={url}&text={achievementCopy}&tw_p=tweetbutton&url={url}",linkedin:"https://www.linkedin.com/feed/?shareActive=true&text={body}",email:"mailto:?subject={subject}&body={body}",weibo:"http://service.weibo.com/share/share.php?title={title}&url={url}"};function ex(e,t,n){let o=encodeURIComponent(t),r=new URL(e);r.hostname="learn.microsoft.com";let s=r.href+=(e.indexOf("?")!==-1?"&":"?")+"WT.mc_id=",i=R.sharingId?`&sharingId=${R.sharingId}`:"";return Object.values(yI).reduce((l,c)=>{if(_.data.isPermissioned)return l[c]="#",l;let u=encodeURIComponent(s+c+i),d=n?.achievementCopyTitle?.overrideTitle??t,p=encodeURIComponent(c8.replace("{achievementTitle}",n?.achievementCopyTitle?.isUnquoted?`${d}`:`"${d}"`)),g={achievementCopy:p,url:u,title:o,body:`${p}${encodeURIComponent(` equals www.twitter.com (Twitter)

Source: global traffic	DNS traffic detected: DNS query: js.monitor.azure.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: mdec.nelreports.net

Source: chromecache_180.4.dr, chromecache_187.4.dr	String found in binary or memory: http://polymer.github.io/AUTHORS.txt
Source: chromecache_180.4.dr, chromecache_187.4.dr	String found in binary or memory: http://polymer.github.io/CONTRIBUTORS.txt
Source: chromecache_180.4.dr, chromecache_187.4.dr	String found in binary or memory: http://polymer.github.io/LICENSE.txt
Source: chromecache_180.4.dr, chromecache_187.4.dr	String found in binary or memory: http://polymer.github.io/PATENTS.txt
Source: chromecache_179.4.dr	String found in binary or memory: http://schema.org/Organization
Source: chromecache_179.4.dr	String found in binary or memory: https://aka.ms/ContentUserFeedback
Source: chromecache_161.4.dr, chromecache_159.4.dr	String found in binary or memory: https://aka.ms/DP600/Plan/LearnT2?ocid=fabric24-dp600plan_learnpromo_T2_ad
Source: chromecache_161.4.dr, chromecache_159.4.dr	String found in binary or memory: https://aka.ms/LFO_Events?wt.mc_id=esi_lfobannerevents_webpage_wwl
Source: chromecache_180.4.dr, chromecache_187.4.dr	String found in binary or memory: https://aka.ms/certhelp
Source: chromecache_179.4.dr, chromecache_154.4.dr, chromecache_188.4.dr	String found in binary or memory: https://aka.ms/feedback/report?space=61
Source: chromecache_180.4.dr, chromecache_187.4.dr	String found in binary or memory: https://aka.ms/pshelpmechoose
Source: chromecache_179.4.dr	String found in binary or memory: https://aka.ms/yourcaliforniaprivacychoices
Source: chromecache_179.4.dr	String found in binary or memory: https://authoring-docs-microsoft.poolparty.biz/devrel/69c76c32-967e-4c65-b89a-74cc527db725
Source: chromecache_179.4.dr	String found in binary or memory: https://authoring-docs-microsoft.poolparty.biz/devrel/7696cda6-0510-47f6-8302-71bb5d2e28cf
Source: chromecache_180.4.dr, chromecache_187.4.dr	String found in binary or memory: https://aznb-ame-prod.azureedge.net/component/$
Source: chromecache_187.4.dr	String found in binary or memory: https://channel9.msdn.com/
Source: chromecache_180.4.dr, chromecache_187.4.dr	String found in binary or memory: https://client-api.arkoselabs.com/v2/api.js
Source: 7F95320763FDCB0F731CE91FB8E178D4110E10A1D56836F442BA34C6F2A631F6.exe	String found in binary or memory: https://dl.dropbox.com/s/p84aaz28t0hepul/Pass.exe?dl=0
Source: chromecache_180.4.dr, chromecache_187.4.dr	String found in binary or memory: https://github.com/$
Source: chromecache_179.4.dr	String found in binary or memory: https://github.com/Thraka
Source: chromecache_179.4.dr	String found in binary or memory: https://github.com/Youssef1313
Source: chromecache_179.4.dr	String found in binary or memory: https://github.com/adegeo
Source: chromecache_179.4.dr	String found in binary or memory: https://github.com/dotnet/docs/blob/17c4acca45e573a92878a44a2cce57d699fe9c7c/docs/framework/install/
Source: chromecache_179.4.dr	String found in binary or memory: https://github.com/dotnet/docs/blob/live/docs/framework/install/application-not-started.md
Source: chromecache_179.4.dr	String found in binary or memory: https://github.com/dotnet/docs/blob/main/docs/framework/install/application-not-started.md
Source: chromecache_179.4.dr	String found in binary or memory: https://github.com/dotnet/docs/issues
Source: chromecache_179.4.dr	String found in binary or memory: https://github.com/dotnet/docs/issues/new?template=z-customer-feedback.yml
Source: chromecache_180.4.dr, chromecache_187.4.dr	String found in binary or memory: https://github.com/dotnet/try
Source: chromecache_179.4.dr	String found in binary or memory: https://github.com/gewarren
Source: chromecache_180.4.dr, chromecache_187.4.dr	String found in binary or memory: https://github.com/jonschlinkert/is-plain-object
Source: chromecache_180.4.dr, chromecache_187.4.dr	String found in binary or memory: https://github.com/js-cookie/js-cookie
Source: chromecache_179.4.dr	String found in binary or memory: https://github.com/mairaw
Source: chromecache_179.4.dr	String found in binary or memory: https://github.com/nschonni
Source: chromecache_179.4.dr	String found in binary or memory: https://js.monitor.azure.com/scripts/c/ms.jsll-4.min.js
Source: chromecache_180.4.dr, chromecache_187.4.dr	String found in binary or memory: https://learn-video.azurefd.net/
Source: chromecache_180.4.dr, chromecache_187.4.dr	String found in binary or memory: https://learn-video.azurefd.net/vod/player
Source: chromecache_180.4.dr, chromecache_187.4.dr	String found in binary or memory: https://management.azure.com/providers/Microsoft.Portal/consoles/default?api-version=2017-12-01-prev
Source: chromecache_180.4.dr, chromecache_187.4.dr	String found in binary or memory: https://management.azure.com/providers/Microsoft.Portal/userSettings/cloudconsole?api-version=2017-0
Source: chromecache_180.4.dr, chromecache_187.4.dr	String found in binary or memory: https://management.azure.com/subscriptions?api-version=2016-06-01
Source: chromecache_180.4.dr, chromecache_187.4.dr	String found in binary or memory: https://octokit.github.io/rest.js/#throttling
Source: chromecache_187.4.dr	String found in binary or memory: https://schema.org
Source: chromecache_180.4.dr, chromecache_187.4.dr	String found in binary or memory: https://twitter.com/intent/tweet?original_referer=$
Source: chromecache_180.4.dr, chromecache_187.4.dr	String found in binary or memory: https://www.linkedin.com/cws/share?url=$

Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63961 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63959 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63961
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63959
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.5:49726 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.5:49727 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.85.23.86:443 -> 192.168.2.5:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.85.23.86:443 -> 192.168.2.5:63959 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to log keystrokes (.Net Source)

Source: 7F95320763FDCB0F731CE91FB8E178D4110E10A1D56836F442BA34C6F2A631F6.exe, kl.cs

.Net Code: VKCodeToUnicode

E-Banking Fraud

Malicious sample detected (through community Yara rule)

Source: Yara match	File source: 7F95320763FDCB0F731CE91FB8E178D4110E10A1D56836F442BA34C6F2A631F6.exe, type: SAMPLE
Source: Yara match	File source: 0.0.7F95320763FDCB0F731CE91FB8E178D4110E10A1D56836F442BA34C6F2A631F6.exe.680000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.2056954933.0000000000682000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 7F95320763FDCB0F731CE91FB8E178D4110E10A1D56836F442BA34C6F2A631F6.exe PID: 5352, type: MEMORYSTR

System Summary

Source: 7F95320763FDCB0F731CE91FB8E178D4110E10A1D56836F442BA34C6F2A631F6.exe, type: SAMPLE	Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 7F95320763FDCB0F731CE91FB8E178D4110E10A1D56836F442BA34C6F2A631F6.exe, type: SAMPLE	Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 7F95320763FDCB0F731CE91FB8E178D4110E10A1D56836F442BA34C6F2A631F6.exe, type: SAMPLE	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: 0.0.7F95320763FDCB0F731CE91FB8E178D4110E10A1D56836F442BA34C6F2A631F6.exe.680000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 0.0.7F95320763FDCB0F731CE91FB8E178D4110E10A1D56836F442BA34C6F2A631F6.exe.680000.0.unpack, type: UNPACKEDPE	Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 0.0.7F95320763FDCB0F731CE91FB8E178D4110E10A1D56836F442BA34C6F2A631F6.exe.680000.0.unpack, type: UNPACKEDPE	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: 00000000.00000000.2056954933.0000000000682000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 00000000.00000000.2056954933.0000000000682000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter

Source: 7F95320763FDCB0F731CE91FB8E178D4110E10A1D56836F442BA34C6F2A631F6.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 7F95320763FDCB0F731CE91FB8E178D4110E10A1D56836F442BA34C6F2A631F6.exe, type: SAMPLE	Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: 7F95320763FDCB0F731CE91FB8E178D4110E10A1D56836F442BA34C6F2A631F6.exe, type: SAMPLE	Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 7F95320763FDCB0F731CE91FB8E178D4110E10A1D56836F442BA34C6F2A631F6.exe, type: SAMPLE	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: 0.0.7F95320763FDCB0F731CE91FB8E178D4110E10A1D56836F442BA34C6F2A631F6.exe.680000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: 0.0.7F95320763FDCB0F731CE91FB8E178D4110E10A1D56836F442BA34C6F2A631F6.exe.680000.0.unpack, type: UNPACKEDPE	Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 0.0.7F95320763FDCB0F731CE91FB8E178D4110E10A1D56836F442BA34C6F2A631F6.exe.680000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: 00000000.00000000.2056954933.0000000000682000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: 00000000.00000000.2056954933.0000000000682000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net

Source: classification engine

Classification label: mal96.troj.spyw.evad.winEXE@30/67@12/6

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Jump to behavior

Source: 7F95320763FDCB0F731CE91FB8E178D4110E10A1D56836F442BA34C6F2A631F6.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 50.01%

Source: C:\Users\user\Desktop\7F95320763FDCB0F731CE91FB8E178D4110E10A1D56836F442BA34C6F2A631F6.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 7F95320763FDCB0F731CE91FB8E178D4110E10A1D56836F442BA34C6F2A631F6.exe

ReversingLabs: Detection: 97%

Source: unknown	Process created: C:\Users\user\Desktop\7F95320763FDCB0F731CE91FB8E178D4110E10A1D56836F442BA34C6F2A631F6.exe "C:\Users\user\Desktop\7F95320763FDCB0F731CE91FB8E178D4110E10A1D56836F442BA34C6F2A631F6.exe"
Source: C:\Users\user\Desktop\7F95320763FDCB0F731CE91FB8E178D4110E10A1D56836F442BA34C6F2A631F6.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=7F95320763FDCB0F731CE91FB8E178D4110E10A1D56836F442BA34C6F2A631F6.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1700 --field-trial-handle=1884,i,637461877397389753,4389975086437105104,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Users\user\Desktop\7F95320763FDCB0F731CE91FB8E178D4110E10A1D56836F442BA34C6F2A631F6.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=7F95320763FDCB0F731CE91FB8E178D4110E10A1D56836F442BA34C6F2A631F6.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2144 --field-trial-handle=1936,i,10713725616331725220,8343982404964030147,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Users\user\Desktop\7F95320763FDCB0F731CE91FB8E178D4110E10A1D56836F442BA34C6F2A631F6.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=7F95320763FDCB0F731CE91FB8E178D4110E10A1D56836F442BA34C6F2A631F6.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	Jump to behavior
Source: C:\Users\user\Desktop\7F95320763FDCB0F731CE91FB8E178D4110E10A1D56836F442BA34C6F2A631F6.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=7F95320763FDCB0F731CE91FB8E178D4110E10A1D56836F442BA34C6F2A631F6.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1700 --field-trial-handle=1884,i,637461877397389753,4389975086437105104,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2144 --field-trial-handle=1936,i,10713725616331725220,8343982404964030147,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior

Source: C:\Users\user\Desktop\7F95320763FDCB0F731CE91FB8E178D4110E10A1D56836F442BA34C6F2A631F6.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\7F95320763FDCB0F731CE91FB8E178D4110E10A1D56836F442BA34C6F2A631F6.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\7F95320763FDCB0F731CE91FB8E178D4110E10A1D56836F442BA34C6F2A631F6.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\7F95320763FDCB0F731CE91FB8E178D4110E10A1D56836F442BA34C6F2A631F6.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\7F95320763FDCB0F731CE91FB8E178D4110E10A1D56836F442BA34C6F2A631F6.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\7F95320763FDCB0F731CE91FB8E178D4110E10A1D56836F442BA34C6F2A631F6.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\7F95320763FDCB0F731CE91FB8E178D4110E10A1D56836F442BA34C6F2A631F6.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\7F95320763FDCB0F731CE91FB8E178D4110E10A1D56836F442BA34C6F2A631F6.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\7F95320763FDCB0F731CE91FB8E178D4110E10A1D56836F442BA34C6F2A631F6.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\7F95320763FDCB0F731CE91FB8E178D4110E10A1D56836F442BA34C6F2A631F6.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\7F95320763FDCB0F731CE91FB8E178D4110E10A1D56836F442BA34C6F2A631F6.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\7F95320763FDCB0F731CE91FB8E178D4110E10A1D56836F442BA34C6F2A631F6.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\7F95320763FDCB0F731CE91FB8E178D4110E10A1D56836F442BA34C6F2A631F6.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\7F95320763FDCB0F731CE91FB8E178D4110E10A1D56836F442BA34C6F2A631F6.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\7F95320763FDCB0F731CE91FB8E178D4110E10A1D56836F442BA34C6F2A631F6.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\7F95320763FDCB0F731CE91FB8E178D4110E10A1D56836F442BA34C6F2A631F6.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\7F95320763FDCB0F731CE91FB8E178D4110E10A1D56836F442BA34C6F2A631F6.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\7F95320763FDCB0F731CE91FB8E178D4110E10A1D56836F442BA34C6F2A631F6.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\7F95320763FDCB0F731CE91FB8E178D4110E10A1D56836F442BA34C6F2A631F6.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\7F95320763FDCB0F731CE91FB8E178D4110E10A1D56836F442BA34C6F2A631F6.exe	Section loaded: windows.shell.servicehostbuilder.dll	Jump to behavior
Source: C:\Users\user\Desktop\7F95320763FDCB0F731CE91FB8E178D4110E10A1D56836F442BA34C6F2A631F6.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\7F95320763FDCB0F731CE91FB8E178D4110E10A1D56836F442BA34C6F2A631F6.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\7F95320763FDCB0F731CE91FB8E178D4110E10A1D56836F442BA34C6F2A631F6.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\7F95320763FDCB0F731CE91FB8E178D4110E10A1D56836F442BA34C6F2A631F6.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\7F95320763FDCB0F731CE91FB8E178D4110E10A1D56836F442BA34C6F2A631F6.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\7F95320763FDCB0F731CE91FB8E178D4110E10A1D56836F442BA34C6F2A631F6.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\7F95320763FDCB0F731CE91FB8E178D4110E10A1D56836F442BA34C6F2A631F6.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\Desktop\7F95320763FDCB0F731CE91FB8E178D4110E10A1D56836F442BA34C6F2A631F6.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\7F95320763FDCB0F731CE91FB8E178D4110E10A1D56836F442BA34C6F2A631F6.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\7F95320763FDCB0F731CE91FB8E178D4110E10A1D56836F442BA34C6F2A631F6.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\7F95320763FDCB0F731CE91FB8E178D4110E10A1D56836F442BA34C6F2A631F6.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\7F95320763FDCB0F731CE91FB8E178D4110E10A1D56836F442BA34C6F2A631F6.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Users\user\Desktop\7F95320763FDCB0F731CE91FB8E178D4110E10A1D56836F442BA34C6F2A631F6.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\7F95320763FDCB0F731CE91FB8E178D4110E10A1D56836F442BA34C6F2A631F6.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\7F95320763FDCB0F731CE91FB8E178D4110E10A1D56836F442BA34C6F2A631F6.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Users\user\Desktop\7F95320763FDCB0F731CE91FB8E178D4110E10A1D56836F442BA34C6F2A631F6.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Users\user\Desktop\7F95320763FDCB0F731CE91FB8E178D4110E10A1D56836F442BA34C6F2A631F6.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\7F95320763FDCB0F731CE91FB8E178D4110E10A1D56836F442BA34C6F2A631F6.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\7F95320763FDCB0F731CE91FB8E178D4110E10A1D56836F442BA34C6F2A631F6.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\7F95320763FDCB0F731CE91FB8E178D4110E10A1D56836F442BA34C6F2A631F6.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\7F95320763FDCB0F731CE91FB8E178D4110E10A1D56836F442BA34C6F2A631F6.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\7F95320763FDCB0F731CE91FB8E178D4110E10A1D56836F442BA34C6F2A631F6.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\7F95320763FDCB0F731CE91FB8E178D4110E10A1D56836F442BA34C6F2A631F6.exe	Section loaded: wkscli.dll	Jump to behavior

Source: C:\Users\user\Desktop\7F95320763FDCB0F731CE91FB8E178D4110E10A1D56836F442BA34C6F2A631F6.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\InProcServer32

Jump to behavior

Source: Google Drive.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: 7F95320763FDCB0F731CE91FB8E178D4110E10A1D56836F442BA34C6F2A631F6.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: 7F95320763FDCB0F731CE91FB8E178D4110E10A1D56836F442BA34C6F2A631F6.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Data Obfuscation

.NET source code contains potential unpacker

Source: 7F95320763FDCB0F731CE91FB8E178D4110E10A1D56836F442BA34C6F2A631F6.exe, OK.cs

.Net Code: Plugin System.Reflection.Assembly.Load(byte[])

Source: initial sample

Static PE information: section where entry point is pointing to: u

Source: 7F95320763FDCB0F731CE91FB8E178D4110E10A1D56836F442BA34C6F2A631F6.exe

Static PE information: section name: u

Source: 7F95320763FDCB0F731CE91FB8E178D4110E10A1D56836F442BA34C6F2A631F6.exe

Static PE information: section name: u entropy: 6.933656811505602

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Source: 7F95320763FDCB0F731CE91FB8E178D4110E10A1D56836F442BA34C6F2A631F6.exe, 00000000.00000002.2144372870.0000000000C2D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: 7F95320763FDCB0F731CE91FB8E178D4110E10A1D56836F442BA34C6F2A631F6.exe, 00000000.00000002.2144372870.0000000000C2D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\

HIPS / PFW / Operating System Protection Evasion

.NET source code references suspicious native API functions

Source: 7F95320763FDCB0F731CE91FB8E178D4110E10A1D56836F442BA34C6F2A631F6.exe, kl.cs	Reference to suspicious API methods: MapVirtualKey(a, 0u)
Source: 7F95320763FDCB0F731CE91FB8E178D4110E10A1D56836F442BA34C6F2A631F6.exe, kl.cs	Reference to suspicious API methods: GetAsyncKeyState(num2)
Source: 7F95320763FDCB0F731CE91FB8E178D4110E10A1D56836F442BA34C6F2A631F6.exe, OK.cs	Reference to suspicious API methods: capGetDriverDescriptionA(wDriver, ref lpszName, 100, ref lpszVer, 100)

Source: C:\Users\user\Desktop\7F95320763FDCB0F731CE91FB8E178D4110E10A1D56836F442BA34C6F2A631F6.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=7F95320763FDCB0F731CE91FB8E178D4110E10A1D56836F442BA34C6F2A631F6.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0			Jump to behavior
Source: C:\Users\user\Desktop\7F95320763FDCB0F731CE91FB8E178D4110E10A1D56836F442BA34C6F2A631F6.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=7F95320763FDCB0F731CE91FB8E178D4110E10A1D56836F442BA34C6F2A631F6.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0			Jump to behavior

Stealing of Sensitive Information

Source: Yara match	File source: 7F95320763FDCB0F731CE91FB8E178D4110E10A1D56836F442BA34C6F2A631F6.exe, type: SAMPLE
Source: Yara match	File source: 0.0.7F95320763FDCB0F731CE91FB8E178D4110E10A1D56836F442BA34C6F2A631F6.exe.680000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.2056954933.0000000000682000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 7F95320763FDCB0F731CE91FB8E178D4110E10A1D56836F442BA34C6F2A631F6.exe PID: 5352, type: MEMORYSTR

Remote Access Functionality

Source: Yara match	File source: 7F95320763FDCB0F731CE91FB8E178D4110E10A1D56836F442BA34C6F2A631F6.exe, type: SAMPLE
Source: Yara match	File source: 0.0.7F95320763FDCB0F731CE91FB8E178D4110E10A1D56836F442BA34C6F2A631F6.exe.680000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.2056954933.0000000000682000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 7F95320763FDCB0F731CE91FB8E178D4110E10A1D56836F442BA34C6F2A631F6.exe PID: 5352, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Replication Through Removable Media	1 Native API	1 Registry Run Keys / Startup Folder	11 Process Injection	1 Masquerading	1 Input Capture	1 Security Software Discovery	Remote Services	1 Input Capture	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 DLL Side-Loading	1 Registry Run Keys / Startup Folder	11 Process Injection	LSASS Memory	1 Peripheral Device Discovery	Remote Desktop Protocol	Data from Removable Media	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	1 Obfuscated Files or Information	Security Account Manager	1 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	11 Software Packing	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	3 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label
7F95320763FDCB0F731CE91FB8E178D4110E10A1D56836F442BA34C6F2A631F6.exe	97%	ReversingLabs	Win32.Virus.Jadtre
7F95320763FDCB0F731CE91FB8E178D4110E10A1D56836F442BA34C6F2A631F6.exe	100%	Avira	W32/Jadtre.B
7F95320763FDCB0F731CE91FB8E178D4110E10A1D56836F442BA34C6F2A631F6.exe	100%	Joe Sandbox ML

URLs

Source	Detection	Scanner	Label
http://polymer.github.io/PATENTS.txt	0%	URL Reputation	safe
https://schema.org	0%	URL Reputation	safe
http://polymer.github.io/LICENSE.txt	0%	URL Reputation	safe
http://polymer.github.io/AUTHORS.txt	0%	URL Reputation	safe
https://aka.ms/yourcaliforniaprivacychoices	0%	URL Reputation	safe
http://schema.org/Organization	0%	URL Reputation	safe
http://polymer.github.io/CONTRIBUTORS.txt	0%	URL Reputation	safe
https://client-api.arkoselabs.com/v2/api.js	0%	Avira URL Cloud	safe
https://github.com/dotnet/docs/blob/live/docs/framework/install/application-not-started.md	0%	Avira URL Cloud	safe
https://aka.ms/LFO_Events?wt.mc_id=esi_lfobannerevents_webpage_wwl	0%	Avira URL Cloud	safe
https://authoring-docs-microsoft.poolparty.biz/devrel/7696cda6-0510-47f6-8302-71bb5d2e28cf	0%	Avira URL Cloud	safe
https://management.azure.com/providers/Microsoft.Portal/consoles/default?api-version=2017-12-01-prev	0%	Avira URL Cloud	safe
https://aka.ms/certhelp	0%	Avira URL Cloud	safe
https://authoring-docs-microsoft.poolparty.biz/devrel/69c76c32-967e-4c65-b89a-74cc527db725	0%	Avira URL Cloud	safe
https://github.com/Thraka	0%	Avira URL Cloud	safe
https://github.com/dotnet/docs/issues	0%	Avira URL Cloud	safe
https://github.com/dotnet/docs/blob/17c4acca45e573a92878a44a2cce57d699fe9c7c/docs/framework/install/	0%	Avira URL Cloud	safe
https://www.linkedin.com/cws/share?url=$	0%	Avira URL Cloud	safe
https://github.com/dotnet/docs/issues/new?template=z-customer-feedback.yml	0%	Avira URL Cloud	safe
https://github.com/nschonni	0%	Avira URL Cloud	safe
https://js.monitor.azure.com/scripts/c/ms.jsll-4.min.js	0%	Avira URL Cloud	safe
https://github.com/mairaw	0%	Avira URL Cloud	safe
https://management.azure.com/subscriptions?api-version=2016-06-01	0%	Avira URL Cloud	safe
https://aka.ms/DP600/Plan/LearnT2?ocid=fabric24-dp600plan_learnpromo_T2_ad	0%	Avira URL Cloud	safe
https://github.com/Youssef1313	0%	Avira URL Cloud	safe
https://aka.ms/ContentUserFeedback	0%	Avira URL Cloud	safe
https://dl.dropbox.com/s/p84aaz28t0hepul/Pass.exe?dl=0	0%	Avira URL Cloud	safe
https://github.com/adegeo	0%	Avira URL Cloud	safe
https://github.com/jonschlinkert/is-plain-object	0%	Avira URL Cloud	safe
https://aka.ms/pshelpmechoose	0%	Avira URL Cloud	safe
https://github.com/$	0%	Avira URL Cloud	safe
https://github.com/dotnet/docs/blob/main/docs/framework/install/application-not-started.md	0%	Avira URL Cloud	safe
https://github.com/js-cookie/js-cookie	0%	Avira URL Cloud	safe
https://aka.ms/feedback/report?space=61	0%	Avira URL Cloud	safe
https://octokit.github.io/rest.js/#throttling	0%	Avira URL Cloud	safe
https://management.azure.com/providers/Microsoft.Portal/userSettings/cloudconsole?api-version=2017-0	0%	Avira URL Cloud	safe
https://learn-video.azurefd.net/vod/player	0%	Avira URL Cloud	safe
https://twitter.com/intent/tweet?original_referer=$	0%	Avira URL Cloud	safe
https://learn-video.azurefd.net/	0%	Avira URL Cloud	safe
https://github.com/gewarren	0%	Avira URL Cloud	safe
https://channel9.msdn.com/	0%	Avira URL Cloud	safe
https://github.com/dotnet/try	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
s-part-0014.t-0009.t-msedge.net	13.107.246.42	true	false	unknown
www.google.com	142.250.185.132	true	false	unknown
s-part-0032.t-0009.t-msedge.net	13.107.246.60	true	false	unknown
js.monitor.azure.com	unknown	unknown	true	unknown
mdec.nelreports.net	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://js.monitor.azure.com/scripts/c/ms.jsll-4.min.js	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://authoring-docs-microsoft.poolparty.biz/devrel/7696cda6-0510-47f6-8302-71bb5d2e28cf	chromecache_179.4.dr	false	Avira URL Cloud: safe	unknown
https://github.com/dotnet/docs/blob/live/docs/framework/install/application-not-started.md	chromecache_179.4.dr	false	Avira URL Cloud: safe	unknown
https://authoring-docs-microsoft.poolparty.biz/devrel/69c76c32-967e-4c65-b89a-74cc527db725	chromecache_179.4.dr	false	Avira URL Cloud: safe	unknown
https://client-api.arkoselabs.com/v2/api.js	chromecache_180.4.dr, chromecache_187.4.dr	false	Avira URL Cloud: safe	unknown
https://management.azure.com/providers/Microsoft.Portal/consoles/default?api-version=2017-12-01-prev	chromecache_180.4.dr, chromecache_187.4.dr	false	Avira URL Cloud: safe	unknown
https://github.com/Thraka	chromecache_179.4.dr	false	Avira URL Cloud: safe	unknown
https://github.com/dotnet/docs/issues	chromecache_179.4.dr	false	Avira URL Cloud: safe	unknown
http://polymer.github.io/PATENTS.txt	chromecache_180.4.dr, chromecache_187.4.dr	false	URL Reputation: safe	unknown
https://aka.ms/LFO_Events?wt.mc_id=esi_lfobannerevents_webpage_wwl	chromecache_161.4.dr, chromecache_159.4.dr	false	Avira URL Cloud: safe	unknown
https://aka.ms/certhelp	chromecache_180.4.dr, chromecache_187.4.dr	false	Avira URL Cloud: safe	unknown
https://github.com/dotnet/docs/blob/17c4acca45e573a92878a44a2cce57d699fe9c7c/docs/framework/install/	chromecache_179.4.dr	false	Avira URL Cloud: safe	unknown
https://www.linkedin.com/cws/share?url=$	chromecache_180.4.dr, chromecache_187.4.dr	false	Avira URL Cloud: safe	unknown
https://aka.ms/ContentUserFeedback	chromecache_179.4.dr	false	Avira URL Cloud: safe	unknown
https://github.com/mairaw	chromecache_179.4.dr	false	Avira URL Cloud: safe	unknown
https://schema.org	chromecache_187.4.dr	false	URL Reputation: safe	unknown
http://polymer.github.io/LICENSE.txt	chromecache_180.4.dr, chromecache_187.4.dr	false	URL Reputation: safe	unknown
https://github.com/Youssef1313	chromecache_179.4.dr	false	Avira URL Cloud: safe	unknown
http://polymer.github.io/AUTHORS.txt	chromecache_180.4.dr, chromecache_187.4.dr	false	URL Reputation: safe	unknown
https://aka.ms/yourcaliforniaprivacychoices	chromecache_179.4.dr	false	URL Reputation: safe	unknown
https://github.com/dotnet/docs/issues/new?template=z-customer-feedback.yml	chromecache_179.4.dr	false	Avira URL Cloud: safe	unknown
https://github.com/nschonni	chromecache_179.4.dr	false	Avira URL Cloud: safe	unknown
https://aka.ms/DP600/Plan/LearnT2?ocid=fabric24-dp600plan_learnpromo_T2_ad	chromecache_161.4.dr, chromecache_159.4.dr	false	Avira URL Cloud: safe	unknown
https://management.azure.com/subscriptions?api-version=2016-06-01	chromecache_180.4.dr, chromecache_187.4.dr	false	Avira URL Cloud: safe	unknown
https://dl.dropbox.com/s/p84aaz28t0hepul/Pass.exe?dl=0	7F95320763FDCB0F731CE91FB8E178D4110E10A1D56836F442BA34C6F2A631F6.exe	false	Avira URL Cloud: safe	unknown
https://github.com/adegeo	chromecache_179.4.dr	false	Avira URL Cloud: safe	unknown
https://github.com/dotnet/docs/blob/main/docs/framework/install/application-not-started.md	chromecache_179.4.dr	false	Avira URL Cloud: safe	unknown
https://aka.ms/pshelpmechoose	chromecache_180.4.dr, chromecache_187.4.dr	false	Avira URL Cloud: safe	unknown
https://aka.ms/feedback/report?space=61	chromecache_179.4.dr, chromecache_154.4.dr, chromecache_188.4.dr	false	Avira URL Cloud: safe	unknown
https://github.com/jonschlinkert/is-plain-object	chromecache_180.4.dr, chromecache_187.4.dr	false	Avira URL Cloud: safe	unknown
https://octokit.github.io/rest.js/#throttling	chromecache_180.4.dr, chromecache_187.4.dr	false	Avira URL Cloud: safe	unknown
https://management.azure.com/providers/Microsoft.Portal/userSettings/cloudconsole?api-version=2017-0	chromecache_180.4.dr, chromecache_187.4.dr	false	Avira URL Cloud: safe	unknown
https://github.com/js-cookie/js-cookie	chromecache_180.4.dr, chromecache_187.4.dr	false	Avira URL Cloud: safe	unknown
https://learn-video.azurefd.net/vod/player	chromecache_180.4.dr, chromecache_187.4.dr	false	Avira URL Cloud: safe	unknown
https://twitter.com/intent/tweet?original_referer=$	chromecache_180.4.dr, chromecache_187.4.dr	false	Avira URL Cloud: safe	unknown
https://github.com/$	chromecache_180.4.dr, chromecache_187.4.dr	false	Avira URL Cloud: safe	unknown
https://github.com/gewarren	chromecache_179.4.dr	false	Avira URL Cloud: safe	unknown
http://schema.org/Organization	chromecache_179.4.dr	false	URL Reputation: safe	unknown
http://polymer.github.io/CONTRIBUTORS.txt	chromecache_180.4.dr, chromecache_187.4.dr	false	URL Reputation: safe	unknown
https://channel9.msdn.com/	chromecache_187.4.dr	false	Avira URL Cloud: safe	unknown
https://learn-video.azurefd.net/	chromecache_180.4.dr, chromecache_187.4.dr	false	Avira URL Cloud: safe	unknown
https://github.com/dotnet/try	chromecache_180.4.dr, chromecache_187.4.dr	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
13.107.246.42	s-part-0014.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
142.250.185.132	www.google.com	United States	15169	GOOGLEUS	false
142.250.185.100	unknown	United States	15169	GOOGLEUS	false
13.107.246.60	s-part-0032.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false

Private

IP
192.168.2.5

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1480419
Start date and time:	2024-07-24 18:52:07 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 45s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	11
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	7F95320763FDCB0F731CE91FB8E178D4110E10A1D56836F442BA34C6F2A631F6.exe
Detection:	MAL
Classification:	mal96.troj.spyw.evad.winEXE@30/67@12/6
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 184.28.89.167, 142.250.185.163, 74.125.133.84, 142.250.185.238, 95.101.150.2, 34.104.35.123, 199.232.214.172, 192.229.221.95, 142.250.185.170, 216.58.206.74, 216.58.212.138, 142.250.185.234, 142.250.184.202, 142.250.185.74, 142.250.186.138, 142.250.185.106, 216.58.206.42, 172.217.16.138, 142.250.186.74, 142.250.186.42, 142.250.185.202, 142.250.186.170, 172.217.18.106, 142.250.181.234, 2.19.126.137, 2.19.126.156, 20.189.173.18, 13.74.129.1, 204.79.197.237, 13.107.21.237, 52.182.141.63, 142.250.181.227, 216.58.206.46
Excluded domains from analysis (whitelisted): aijscdn2.afd.azureedge.net, slscr.update.microsoft.com, c-msn-com-nsatc.trafficmanager.net, clientservices.googleapis.com, browser.events.data.trafficmanager.net, learn.microsoft.com, onedscolprdwus15.westus.cloudapp.azure.com, e11290.dspg.akamaiedge.net, mdec.nelreports.net.akamaized.net, go.microsoft.com, clients2.google.com, ocsp.digicert.com, a1883.dscd.akamai.net, learn.microsoft.com.edgekey.net, update.googleapis.com, clients1.google.com, fs.microsoft.com, accounts.google.com, content-autofill.googleapis.com, c-bing-com.dual-a-0034.a-msedge.net, ctldl.windowsupdate.com, learn.microsoft.com.edgekey.net.globalredir.akadns.net, firstparty-azurefd-prod.trafficmanager.net, fe3cr.delivery.mp.microsoft.com, aijscdn2.azureedge.net, browser.events.data.microsoft.com, edgedl.me.gvt1.com, e13636.dscb.akamaiedge.net, c.bing.com, learn-public.trafficmanager.net, go.microsoft.com.edgekey.net, dual-a-0034.a-msedge.net, clients.l.google.com, c1.microsoft.com, wcpstatic.micr
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: 7F95320763FDCB0F731CE91FB8E178D4110E10A1D56836F442BA34C6F2A631F6.exe

URL: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=7F95320763FDCB0F731CE91FB8E178D4110E10A1D56836F442BA34C6F2A631F6.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 Model: Perplexity: mixtral-8x7b-instruct

{"loginform": false,"urgency": false,"captcha": false,"reasons": ["The webpage does not contain a login form, as there is no explicit request for sensitive information such as passwords, email addresses, usernames, phone numbers, or credit card numbers.","The text of the webpage does not create a sense of urgency, as there are no phrases that encourage immediate action such as 'Click here to view document' or 'To view secured document click here'.","The webpage does not contain a CAPTCHA or any other anti-robot detection mechanism."]}

Title: Fix .NET Framework 'This application could not be started' - .NET Framework | Microsoft Learn OCR: Learn Q Sign in Discover v Product documentation Development languages v Topics v .NET Languages Features v Workloads Troubleshooting Resources v Download .NET APIs v Filter by title .NET / .NET Framework / Learn / .NET Framework documentation "This application could not be Overview of .NET Framework started" error when running a .NET Get started v Installation guide Framework application Overview For developers Article  02/16/2023  6 contributors Feedback > By OS version Repair .NET framework In this article v TroubleshcHJt How to fix the error Troubleshoot install end uninstall See also Troubleshoot 'This application could not started' When you attempt to run a .NET Framework application, you may receive the "This .NET Framework 3.5 on Windows 8 application could not be started" error message. When this error is caused by an installed through Windows 11 version of .NET Framework not being detected, or by .NET Framework being corrupted, use this article to try to solve that problem. .NET Framework 1.1 on Windows 8 through Windows 11 mt.exe - This application could not be started. > Migration guide Development guide This application could not be started, > Tools Do you want to view information about this issue? > Additional APIs > What's new and obsolete Code analysis Yes No Download PDF

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
13.107.246.42	https://protect-us.mimecast.com/s/FVibCzpzxLsxEMXAhgAOBC	Get hash	malicious	Unknown	Browse	www.mimecast.com/Customers/Support/Contact-support/
	http://border-fd.smartertechnologies.com/	Get hash	malicious	Unknown	Browse	border-fd.smartertechnologies.com/
	https://protect-us.mimecast.com/s/4MrPCrkvgotDWxrNCzxa8p	Get hash	malicious	Unknown	Browse	www.mimecast.com/
239.255.255.250	K-Lite_Codec_Pack_1848_Basic.exe	Get hash	malicious	Unknown	Browse
	7EE182A4E061B93EAA096B87B0914D115F5C49D2812A6C81C62A836892ADC359.exe	Get hash	malicious	Unknown	Browse
	https://forms.office.com/Pages/ResponsePage.aspx?id=OLE8nwnwvUGeQ8SAAnPcLaQBldauQopOpJ-jSe9_NVZUNlkxVjJDS1Q3REs1UURGM0hCWExBUE5KQS4u	Get hash	malicious	Unknown	Browse
	7CB92356A0170028FABC20F0CB9736B149EFAB01824AB1173B3277340A6A2EC4.exe	Get hash	malicious	Unknown	Browse
	https://assets-usa.mkt.dynamics.com/95689b1f-9545-ef11-bfdf-00224825570b/digitalassets/standaloneforms/40bb8d8b-d049-ef11-a317-6045bdd83a8b	Get hash	malicious	Outlook Phishing, HTMLPhisher	Browse
	https://forestnet.com.br/FFUmVuYWkuV2FycmVuQG5scmIuZ292	Get hash	malicious	Unknown	Browse
	7886ceadafacdaaa0118c8412eda7b48db1f65f798a05ec6bf962b6463f10fd2.exe	Get hash	malicious	Unknown	Browse
	ulHQcdJULU.exe	Get hash	malicious	Unknown	Browse
	ulHQcdJULU.exe	Get hash	malicious	Unknown	Browse
	https://repodex11.github.io/post/	Get hash	malicious	HTMLPhisher, Tycoon2FA	Browse
13.107.246.60	https://protect-us.mimecast.com/s/wFHoCqxrAnt7V914iZaD1v	Get hash	malicious	Unknown	Browse	www.mimecast.com/Customers/Support/Contact-support/
13.107.246.60	http://wellsfargo.dealogic.com/clientportal/Conferences/Registration/Form/368?menuItemId=5	Get hash	malicious	Unknown	Browse	wellsfargo.dealogic.com/clientportal/Conferences/Registration/Form/368?menuItemId=5

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
s-part-0014.t-0009.t-msedge.net	7EE182A4E061B93EAA096B87B0914D115F5C49D2812A6C81C62A836892ADC359.exe	Get hash	malicious	Unknown	Browse	13.107.246.42
	7CB92356A0170028FABC20F0CB9736B149EFAB01824AB1173B3277340A6A2EC4.exe	Get hash	malicious	Unknown	Browse	13.107.246.42
	https://assets-usa.mkt.dynamics.com/95689b1f-9545-ef11-bfdf-00224825570b/digitalassets/standaloneforms/40bb8d8b-d049-ef11-a317-6045bdd83a8b	Get hash	malicious	Outlook Phishing, HTMLPhisher	Browse	13.107.246.42
	7886ceadafacdaaa0118c8412eda7b48db1f65f798a05ec6bf962b6463f10fd2.exe	Get hash	malicious	Unknown	Browse	13.107.246.42
	73503980443062d80f82cb75fa021a3be6b8f09785c39efbaff963589c82863a.exe	Get hash	malicious	Unknown	Browse	13.107.246.42
	6d4d1cf893010134d60cef12d228da180680a1d4433d143ab80477df00e6fbd8.exe	Get hash	malicious	Unknown	Browse	13.107.246.42
	645ecd4cf092b3f03180291a311ad540fe2542486d08e648f6f0ac23de4344d0.exe	Get hash	malicious	Unknown	Browse	13.107.246.42
	https://forms.office.com/r/MbTXnrrxDY	Get hash	malicious	HTMLPhisher	Browse	13.107.246.42
	qGJBgGtR7e.exe	Get hash	malicious	Gh0stCringe, GhostRat, Mimikatz, RunningRAT	Browse	13.107.246.42
	VaajyQsbTV.exe	Get hash	malicious	GhostRat, Nitol	Browse	13.107.246.42
s-part-0032.t-0009.t-msedge.net	7EE182A4E061B93EAA096B87B0914D115F5C49D2812A6C81C62A836892ADC359.exe	Get hash	malicious	Unknown	Browse	13.107.246.60
	https://assets-usa.mkt.dynamics.com/95689b1f-9545-ef11-bfdf-00224825570b/digitalassets/standaloneforms/40bb8d8b-d049-ef11-a317-6045bdd83a8b	Get hash	malicious	Outlook Phishing, HTMLPhisher	Browse	13.107.246.60
	7886ceadafacdaaa0118c8412eda7b48db1f65f798a05ec6bf962b6463f10fd2.exe	Get hash	malicious	Unknown	Browse	13.107.246.60
	Ahxjl36V4o.exe	Get hash	malicious	Unknown	Browse	13.107.246.60
	73503980443062d80f82cb75fa021a3be6b8f09785c39efbaff963589c82863a.exe	Get hash	malicious	Unknown	Browse	13.107.246.60
	6d4d1cf893010134d60cef12d228da180680a1d4433d143ab80477df00e6fbd8.exe	Get hash	malicious	Unknown	Browse	13.107.246.60
	645ecd4cf092b3f03180291a311ad540fe2542486d08e648f6f0ac23de4344d0.exe	Get hash	malicious	Unknown	Browse	13.107.246.60
	https://forms.office.com/r/MbTXnrrxDY	Get hash	malicious	HTMLPhisher	Browse	13.107.246.60
	59cd053dd976f2d92ef879e92ce937786eb286efdceb62823096ae71cc291311.exe	Get hash	malicious	Unknown	Browse	13.107.246.60
	4E20A72F2791A602F8EE9999765A9365729FF929DA4D5FA6BE7BFB4C20E9989E.exe	Get hash	malicious	Unknown	Browse	13.107.246.60

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
MICROSOFT-CORP-MSN-AS-BLOCKUS	7EE182A4E061B93EAA096B87B0914D115F5C49D2812A6C81C62A836892ADC359.exe	Get hash	malicious	Unknown	Browse	13.107.246.60
	7CB92356A0170028FABC20F0CB9736B149EFAB01824AB1173B3277340A6A2EC4.exe	Get hash	malicious	Unknown	Browse	13.107.246.45
	https://assets-usa.mkt.dynamics.com/95689b1f-9545-ef11-bfdf-00224825570b/digitalassets/standaloneforms/40bb8d8b-d049-ef11-a317-6045bdd83a8b	Get hash	malicious	Outlook Phishing, HTMLPhisher	Browse	13.107.246.60
	7886ceadafacdaaa0118c8412eda7b48db1f65f798a05ec6bf962b6463f10fd2.exe	Get hash	malicious	Unknown	Browse	13.107.246.60
	73503980443062d80f82cb75fa021a3be6b8f09785c39efbaff963589c82863a.exe	Get hash	malicious	Unknown	Browse	13.107.246.60
	6d4d1cf893010134d60cef12d228da180680a1d4433d143ab80477df00e6fbd8.exe	Get hash	malicious	Unknown	Browse	13.107.246.60
	XEV5ucEWu7.exe	Get hash	malicious	Unknown	Browse	13.107.246.45
	645ecd4cf092b3f03180291a311ad540fe2542486d08e648f6f0ac23de4344d0.exe	Get hash	malicious	Unknown	Browse	13.107.246.60
	https://forms.office.com/r/MbTXnrrxDY	Get hash	malicious	HTMLPhisher	Browse	13.107.246.60
	qGJBgGtR7e.exe	Get hash	malicious	Gh0stCringe, GhostRat, Mimikatz, RunningRAT	Browse	13.107.246.42
MICROSOFT-CORP-MSN-AS-BLOCKUS	7EE182A4E061B93EAA096B87B0914D115F5C49D2812A6C81C62A836892ADC359.exe	Get hash	malicious	Unknown	Browse	13.107.246.60
	7CB92356A0170028FABC20F0CB9736B149EFAB01824AB1173B3277340A6A2EC4.exe	Get hash	malicious	Unknown	Browse	13.107.246.45
	https://assets-usa.mkt.dynamics.com/95689b1f-9545-ef11-bfdf-00224825570b/digitalassets/standaloneforms/40bb8d8b-d049-ef11-a317-6045bdd83a8b	Get hash	malicious	Outlook Phishing, HTMLPhisher	Browse	13.107.246.60
	7886ceadafacdaaa0118c8412eda7b48db1f65f798a05ec6bf962b6463f10fd2.exe	Get hash	malicious	Unknown	Browse	13.107.246.60
	73503980443062d80f82cb75fa021a3be6b8f09785c39efbaff963589c82863a.exe	Get hash	malicious	Unknown	Browse	13.107.246.60
	6d4d1cf893010134d60cef12d228da180680a1d4433d143ab80477df00e6fbd8.exe	Get hash	malicious	Unknown	Browse	13.107.246.60
	XEV5ucEWu7.exe	Get hash	malicious	Unknown	Browse	13.107.246.45
	645ecd4cf092b3f03180291a311ad540fe2542486d08e648f6f0ac23de4344d0.exe	Get hash	malicious	Unknown	Browse	13.107.246.60
	https://forms.office.com/r/MbTXnrrxDY	Get hash	malicious	HTMLPhisher	Browse	13.107.246.60
	qGJBgGtR7e.exe	Get hash	malicious	Gh0stCringe, GhostRat, Mimikatz, RunningRAT	Browse	13.107.246.42

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
1138de370e523e824bbca92d049a3777	7EE182A4E061B93EAA096B87B0914D115F5C49D2812A6C81C62A836892ADC359.exe	Get hash	malicious	Unknown	Browse	23.1.237.91
	7CB92356A0170028FABC20F0CB9736B149EFAB01824AB1173B3277340A6A2EC4.exe	Get hash	malicious	Unknown	Browse	23.1.237.91
	7886ceadafacdaaa0118c8412eda7b48db1f65f798a05ec6bf962b6463f10fd2.exe	Get hash	malicious	Unknown	Browse	23.1.237.91
	http://pub-18c0b230f8f2453bbc80499dbfd675b4.r2.dev	Get hash	malicious	Unknown	Browse	23.1.237.91
	https://ram-coza.com/NowPay	Get hash	malicious	Unknown	Browse	23.1.237.91
	4FE08CC381F8F4EA6E3D8E34FDDF094193CCBBCC1CAE7217F0233893B9C566A2.exe	Get hash	malicious	Babadeda, Bdaejec	Browse	23.1.237.91
	4D8B9771E44C71F5D5442559FAD0B99581C6E33B339AF9ECEC54095A18AAFE82.exe	Get hash	malicious	Unknown	Browse	23.1.237.91
	af0b876a436452a6e998fc622493aaa4553bcc53864d66a6a6d5d476a85902eb_dump1.exe	Get hash	malicious	Nanocore, Remcos	Browse	23.1.237.91
	https://url.us.m.mimecastprotect.com/s/UkmpCmZgG1h5BO2ghBi2tR8UWK?domain=forms.office.com	Get hash	malicious	HTMLPhisher	Browse	23.1.237.91
	https://pub-47b15c982a8d495da7002fa629c6f9a0.r2.dev/www.outlook.office365.cozsidAAQkADZiMjRkdgdMm0000dgdfZDktNGEzNS04ZW000000000000ftekjsguwmgde000000.html	Get hash	malicious	Unknown	Browse	23.1.237.91
28a2c9bd18a11de089ef85a160da29e4	K-Lite_Codec_Pack_1848_Basic.exe	Get hash	malicious	Unknown	Browse	13.85.23.86 184.28.90.27
	7EE182A4E061B93EAA096B87B0914D115F5C49D2812A6C81C62A836892ADC359.exe	Get hash	malicious	Unknown	Browse	13.85.23.86 184.28.90.27
	https://forms.office.com/Pages/ResponsePage.aspx?id=OLE8nwnwvUGeQ8SAAnPcLaQBldauQopOpJ-jSe9_NVZUNlkxVjJDS1Q3REs1UURGM0hCWExBUE5KQS4u	Get hash	malicious	Unknown	Browse	13.85.23.86 184.28.90.27
	7CB92356A0170028FABC20F0CB9736B149EFAB01824AB1173B3277340A6A2EC4.exe	Get hash	malicious	Unknown	Browse	13.85.23.86 184.28.90.27
	https://assets-usa.mkt.dynamics.com/95689b1f-9545-ef11-bfdf-00224825570b/digitalassets/standaloneforms/40bb8d8b-d049-ef11-a317-6045bdd83a8b	Get hash	malicious	Outlook Phishing, HTMLPhisher	Browse	13.85.23.86 184.28.90.27
	7886ceadafacdaaa0118c8412eda7b48db1f65f798a05ec6bf962b6463f10fd2.exe	Get hash	malicious	Unknown	Browse	13.85.23.86 184.28.90.27
	ulHQcdJULU.exe	Get hash	malicious	Unknown	Browse	13.85.23.86 184.28.90.27
	ulHQcdJULU.exe	Get hash	malicious	Unknown	Browse	13.85.23.86 184.28.90.27
	https://repodex11.github.io/post/	Get hash	malicious	HTMLPhisher, Tycoon2FA	Browse	13.85.23.86 184.28.90.27
	73503980443062d80f82cb75fa021a3be6b8f09785c39efbaff963589c82863a.exe	Get hash	malicious	Unknown	Browse	13.85.23.86 184.28.90.27

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Jul 24 15:53:07 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.9906343788664382
Encrypted:	false
SSDEEP:	48:8TkdXcT3AwrHvidAKZdA19ehwiZUklqehNy+3:87/dqy
MD5:	C75E546CF28C5965862FB4EEE66FB4C9
SHA1:	687D4587F33F14AD29231D3548BD0C3D79963FD1
SHA-256:	69ED82B5B529E82DE43836D296F01A3ACF2340DB2052E606DD141AAE7EE66190
SHA-512:	A984B458E123495825D21BF6CCF88E4EA6362F0C758CAB3484CE715D12CA1E9C269529C00872B9451DB5E861E8A5D6F49E68825869D9DECB9F4FF117751B11AA
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,...........N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.X......B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.X.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............y.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Jul 24 15:53:07 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	4.002771462719263
Encrypted:	false
SSDEEP:	48:8rdXcT3AwrHvidAKZdA1weh/iZUkAQkqehay+2:8S/X9Q3y
MD5:	9E643BBBE0D188DBFA5ADF0A08D13324
SHA1:	2A3512F8761848853F7DD10AE6B198C0CA072F5E
SHA-256:	B63FA94ABE6E4FF9B328A0D923A011465887B5B1CD5CA91726F91F7BDDDF1B83
SHA-512:	5259AC1D5180617482AA73C5DC6679CE589E0432621105044E6F0A935EDE2FF48B138A8545B4B5EA9313A3B781E6888F37011109406A5FC713DF3E77C52E7F0E
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,...../......N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.X......B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.X.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............y.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 4 12:54:07 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2693
Entropy (8bit):	4.012432562210788
Encrypted:	false
SSDEEP:	48:8xBdXcT3AwsHvidAKZdA14tseh7sFiZUkmgqeh7sUy+BX:8xo/inWy
MD5:	EFE3C11132EDD0CFE2FF02B7C3D59F1B
SHA1:	160029E6344CEB7EB2751C3486DAA597B780268A
SHA-256:	50961B06DC0A8612B9614F778FC6D9FD22E483848FB3FA425D10D3A48AFE9CE8
SHA-512:	81CC4F9EE130103AD3AFF27E0D756E86EC9C64F1FED55BD0DA8E544645E221F5518624CC7B181AE45F16F491630B7756AC66FB67440BE64017103D9D7BD3BB44
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,......e>....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.X......B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VDW.n...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............y.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Jul 24 15:53:07 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	4.002585926688041
Encrypted:	false
SSDEEP:	48:8RdXcT3AwrHvidAKZdA1vehDiZUkwqehOy+R:84/UMy
MD5:	B5E3F02640EB88468114BCE721D253C9
SHA1:	FFB3A85ED70D16416F94F6A5DC7EB2596F14CA2F
SHA-256:	C7CC38EE4FA16034A7275A2AE278C1391C0A9D59AEA31578EB04A6E5A66A597B
SHA-512:	CBB21E75D98E75EEC210C276E251CF350961C4D361EFB41A6B0E82BA709D89AE87861249520E3F7FD08EA42FFC7D61F4DFBBCCA3DDBBF7487D2A809BB9DB92D9
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,......~.....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.X......B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.X.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............y.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Jul 24 15:53:07 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.9929293933309764
Encrypted:	false
SSDEEP:	48:8OdXcT3AwrHvidAKZdA1hehBiZUk1W1qehQy+C:8J/09wy
MD5:	0AE573A7ED06611E1EFFCB89711B0FD9
SHA1:	A1316A9442E063DB2FE7C1F2C91BD0229CD9F2CC
SHA-256:	0E44C0AEA123EFF6994496AFF24D89A8DC5D6D2A81CAE44E2FFF07ED68F123A2
SHA-512:	CDAF60C4F7E6C00052A725FF6D992CDF70039B40D5A36066B7CFF9CF1D53A88B8EB0C9C1EF8ACA63CCCC824EFE01058E93ED73EBB760B00393E518912875350F
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,....v'......N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.X......B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.X.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............y.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Jul 24 15:53:07 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2683
Entropy (8bit):	4.000354585510586
Encrypted:	false
SSDEEP:	48:8TdXcT3AwrHvidAKZdA1duT+ehOuTbbiZUk5OjqehOuTbWy+yT+:8q/aT/TbxWOvTbWy7T
MD5:	CAF7D757CC1FA81121878DB06025202A
SHA1:	18F127533B756CB87774A2E23C5B63DFD6664446
SHA-256:	8885C4F5C55F9C0E0C054E214DE5088B293198725F3F301D3E4F58169B95266D
SHA-512:	8CBC270DE0E6580B25AF845AC90B2B165DE443B8FFD248CE53F6C164486600BA93AE813D1B935B8D0CC4C38BADF87BB420079A4883858F341343CD3C874F36E6
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,....4.g.....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.X......B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.X.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............y.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Chrome Cache Entry: 150

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 533 x 478, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	13339
Entropy (8bit):	7.683569563478597
Encrypted:	false
SSDEEP:	192:zjSKAj04ndWb6OuzZjk6TsEaJS0/bJur2Gz4Imm3MhE4NfM:zutfW69XTspsG3G0TfhEQM
MD5:	512625CF8F40021445D74253DC7C28C0
SHA1:	F6B27CE0F7D4E48E34FDDCA8A96337F07CFFE730
SHA-256:	1D4DCEE8511D5371FEC911660D6049782E12901C662B409A5C675772E9B87369
SHA-512:	AE02319D03884D758A86C286B6F593BDFFD067885D56D82EEB8215FDCB41637C7BB9109039E7FBC93AD246D030C368FB285B3161976ED485ABC5A8DF6DF9A38C
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	.PNG........IHDR.............,#......sRGB.........gAMA......a.....pHYs..........o.d..3.IDATx^..].5Y...C.$..tH .NF.I&A0..;.r.fF.#..!7...'..3.0.../..s....."!.y...~....4....om.g.3.BTP......j..g.zVU....u...a.Z..j..U....y......$.....I...pAR...\.T....$.....I...pAR...\.T..p....5O>.d...}Rg.$....@.4....fb1.o.I...7..<.P.....n0.D.P.....n..L.P.....n8.......P.~......n(+..'. ......J.vM,H......W...h.T....$.....I...pAR...\.T....$.....I...pAR...\.T....$.....I...pAR...\.T....$......'....w....g....\|../5_.......T...~.y.'.'.\|...W..[...C.)......\|.[.[WK...w...w..y.{..\|.#.n>...5....5...h>..O6O>.Xx....o.B........g?.........~....?o...w.......}..-_k^........l....\|.D.TH.....o..B'..(.W-%...?...W.......E?h..........~.......?...~,..}...o^...5ox..bI.mo{[s.}.5.<.L.......<......Y.W......K..Q._...Iu...2...e)d]4.}Y..............k.%k..s.'..L(..o4...g...z............N.X.....W.O.^.4.....7......i~._7..~,bI......3.0RRq..\|.Mk..?.{.K_...t.........SYG.W^#).N^..._W...(.8.7.....W....7...m

Chrome Cache Entry: 151

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 533 x 478, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	18367
Entropy (8bit):	7.7772261735974215
Encrypted:	false
SSDEEP:	384:4qqZYz7CAda2Qmd6VWWNg9h8XvdkRbdi2nki:1qZYz7Cma2hYNMh8XvdObdi2nX
MD5:	240C4CC15D9FD65405BB642AB81BE615
SHA1:	5A66783FE5DD932082F40811AE0769526874BFD3
SHA-256:	030272CE6BA1BECA700EC83FDED9DBDC89296FBDE0633A7F5943EF5831876C07
SHA-512:	267FE31BC25944DD7B6071C2C2C271CCC188AE1F6A0D7E587DCF9198B81598DA6B058D1B413F228DF0CB37C8304329E808089388359651E81B5F3DEC566D0EE0
Malicious:	false
Reputation:	moderate, very likely benign file
URL:	https://learn.microsoft.com/en-us/dotnet/framework/install/media/application-not-started/repair-tool-no-resolution.png
Preview:	.PNG........IHDR.............,#......sRGB.........gAMA......a.....pHYs..........o.d..GTIDATx^._.}.U.7..BkB.......!E......b.Ej.K...Z...iK.$..h..B`..T.?5.7.I..16$.E.......c...c...Q_V.k...k..g.y.9..G.g..g.9.Z{..Z{.nv....@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...<@v.].../.1R'm.....x..h.....]a1U7........s.......x.h.q.A! ....8IL\GP..............M...W.............D.....dJ<.+,.........W...pgAT...@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...@......P.;/..G....O~..O~...'?......h.....}.y..4/....S..........Y......?..?.g7...G...............x{..w..y.~.9.~.y....y.#.c....<.E.............^..7G.._.u.nv/..f........5.....5?.;...w.....i~.?\|..H+Dd.....Y%....r~.$Q...7.v..._hv..r.O_.4..7M.6....o..=..?....3....?.....xE...O..7....^......D.W....m...6........O..Ob.4.9J........6.;..>.,.....o.l..>%J.V......%k..0.bQqIA..O..y.{.....7.......4_..Za...4.o.....h..........k...M...i....G.4...h.L.#...&.'%...~j..W.*Kx......o.%s.m

Chrome Cache Entry: 152

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	1154
Entropy (8bit):	4.59126408969148
Encrypted:	false
SSDEEP:	24:txFRuJpzYeGK+VS6ckNL2091JP/UcHc8oQJ1sUWMLc/jH6GbKqjHJIOHA:JsfcU6ckNL2091Z/U/YsUDM+GhS
MD5:	37258A983459AE1C2E4F1E551665F388
SHA1:	603A4E9115E613CC827206CF792C62AEB606C941
SHA-256:	8E34F3807B4BF495D8954E7229681DA8D0DD101DD6DDC2AD7F90CD2983802B44
SHA-512:	184CB63EF510143B0AF013F506411C917D68BB63F2CFA47EA2A42688FD4F55F3B820AF94F87083C24F48AACEE6A692199E185FC5C5CFBED5D70790454EED7F5C
Malicious:	false
Preview:	<svg width="456" height="456" viewBox="0 0 456 456" fill="none" xmlns="http://www.w3.org/2000/svg">..<rect width="456" height="456" fill="#512BD4"/>..<path d="M81.2738 291.333C78.0496 291.333 75.309 290.259 73.052 288.11C70.795 285.906 69.6665 283.289 69.6665 280.259C69.6665 277.173 70.795 274.529 73.052 272.325C75.309 270.121 78.0496 269.019 81.2738 269.019C84.5518 269.019 87.3193 270.121 89.5763 272.325C91.887 274.529 93.0424 277.173 93.0424 280.259C93.0424 283.289 91.887 285.906 89.5763 288.11C87.3193 290.259 84.5518 291.333 81.2738 291.333Z" fill="white"/>..<path d="M210.167 289.515H189.209L133.994 202.406C132.597 200.202 131.441 197.915 130.528 195.546H130.044C130.474 198.081 130.689 203.508 130.689 211.827V289.515H112.149V171H134.477L187.839 256.043C190.096 259.57 191.547 261.994 192.192 263.316H192.514C191.977 260.176 191.708 254.859 191.708 247.365V171H210.167V289.515Z" fill="white"/>..<path d="M300.449 289.515H235.561V171H297.87V187.695H254.746V221.249H294.485V237.861H254.746V

Chrome Cache Entry: 153

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	443348
Entropy (8bit):	5.079350267097991
Encrypted:	false
SSDEEP:	6144:Fe43jzKCey05dPjZkYh6BFPDxZYX04GK7MI:NKCeyQPjj
MD5:	DBAAB65D35238246BEAF5AA34B9736CF
SHA1:	DFA25539F60B3A4F60B933515309E97DA379C2C5
SHA-256:	564E1C96899DDBC5692257CC9F2EEB8F615220E23466BF333FD26FE28BEACF78
SHA-512:	16EEA9018AD102EEEE67CE940A992EF610EF99BE36F803957B47FD0EF4F65B15FF23A39AF5D931E23A39D89BC68DB1026E904F5B172A7374B69A8AC76E466225
Malicious:	false
URL:	https://learn.microsoft.com/static/assets/0.4.027605576/styles/site-ltr.css
Preview:	.CodeMirror{height:300px;color:#000;direction:ltr;font-family:monospace}.CodeMirror-lines{padding:4px 0}.CodeMirror pre.CodeMirror-line,.CodeMirror pre.CodeMirror-line-like{padding:0 4px}.CodeMirror-scrollbar-filler,.CodeMirror-gutter-filler{background-color:#fff}.CodeMirror-gutters{white-space:nowrap;background-color:#f7f7f7;border-right:1px solid #ddd}.CodeMirror-linenumber{min-width:20px;text-align:right;color:#999;white-space:nowrap;padding:0 3px 0 5px}.CodeMirror-guttermarker{color:#000}.CodeMirror-guttermarker-subtle{color:#999}.CodeMirror-cursor{width:0;border-left:1px solid #000;border-right:none}.CodeMirror div.CodeMirror-secondarycursor{border-left:1px solid silver}.cm-fat-cursor .CodeMirror-cursor{width:auto;background:#7e7;border:0!important}.cm-fat-cursor div.CodeMirror-cursors{z-index:1}.cm-fat-cursor .CodeMirror-line::selection,.cm-fat-cursor .CodeMirror-line>span::selection,.cm-fat-cursor .CodeMirror-line>span>span::selection{background:0 0}.cm-fat-cursor{caret-color:#0

Chrome Cache Entry: 154

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3130
Entropy (8bit):	4.790069981348324
Encrypted:	false
SSDEEP:	48:YWuGl640ynAqgDJ9OJWuO6Z3Db8VgK/ni47ttbtlSlA37ERw7II77Aj5M1:Nv0ynAhD3CO5t5lNEYIOEjc
MD5:	EBA6E81304F2F555E1D2EA3126A18A41
SHA1:	61429C3FE837FD4DD68E7B26678F131F2E00070D
SHA-256:	F309CCCE17B2B4706E7110F6C76F81761F0A44168D12C358AC4D120776907F81
SHA-512:	3BE0466794E7BDDC8565758DBF5553E89ED0003271F07695F09283F242BB65C1978ED79A38D5E589A99F68C0130E1E4B52576D7CD655EE272EE104BE0378E72E
Malicious:	false
Preview:	{"items":[{"children":[{"children":[{"homepage":"/dotnet/api/index","href":"/dotnet/api/","toc_title":"API browser"},{"homepage":"/dotnet/csharp/index","href":"/dotnet/csharp/","toc_title":"C#"},{"homepage":"/dotnet/fsharp/index","href":"/dotnet/fsharp/","toc_title":"F#"},{"homepage":"/dotnet/visual-basic/index","href":"/dotnet/visual-basic/","toc_title":"Visual Basic"},{"homepage":"/dotnet/ai/index","href":"/dotnet/ai/","toc_title":"AI"},{"homepage":"/dotnet/azure/index","href":"/dotnet/azure/","toc_title":"Azure"},{"homepage":"/dotnet/aspire/index","href":"/dotnet/aspire/","toc_title":".NET Aspire"},{"homepage":"/dotnet/orleans/index","href":"/dotnet/orleans/","toc_title":"Orleans"},{"children":[{"homepage":"/dotnet/framework/unmanaged-api/","href":"/dotnet/framework/unmanaged-api/","toc_title":"Unmanaged API reference"}],"homepage":"/dotnet/framework/index","href":"/dotnet/framework/","toc_title":".NET Framework"},{"children":[{"homepage":"/dotnet/architecture/modern-web-apps-azure/

Chrome Cache Entry: 155

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 533 x 478, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	15427
Entropy (8bit):	7.784472070227724
Encrypted:	false
SSDEEP:	384:CKKdvwj3SJMpKKKKKKKKikCyKwqHILyPGQV4ykihKKKKKKKCm:CKKdvMMgKKKKKKKKiqB3yPVXkihKKKKI
MD5:	3062488F9D119C0D79448BE06ED140D8
SHA1:	8A148951C894FC9E968D3E46589A2E978267650E
SHA-256:	C47A383DE6DD60149B37DD24825D42D83CB48BE0ED094E3FC3B228D0A7BB9332
SHA-512:	00BBA6BCBFBF44B977129594A47F732809DCE7D4E2D22D050338E4EEA91FCC02A9B333C45EEB4C9024DF076CBDA0B46B621BF48309C0D037D19BBEAE0367F5ED
Malicious:	false
Preview:	.PNG........IHDR.............,#......sRGB.........gAMA......a.....pHYs..........o.d..;.IDATx^..].u.Y..M....B.X...".......@.ZzSys..,H{.Rz!... .......WM.IN..9n..I....g...p<P.0-....\|...X..s...Z.Y{....w..5.._s..x...E.......... ..................... ..................{....2. ...`.$h.......)....,T-x.5......,.."..(.A.......>.. ...`......4..G.\|.....,T-..'. ...`....]........?~.....A...pAP...\.T..........A...pAP...\.T..........A...pAP...\.T..........A...pAP...\.}P../}....TJ...'.O...'?......XH...K..>.b..K/t...o.......T.._.E.....q.$.x..qJ......mo...ww.}.{....W..._...._.^z...........(^x..C..P.../.........U..]../u.....w..{.O.N..o.l........_.^...2.....*....<...iP.W...o......]..+.?}c...t!.....p.=..._x..._yo....?....~u.c?.c1'.....{.^.}.S...5.yMx./.>.lwqq.}.....g..g1wZ..%......h.i[..%ul.&..U.k..";7-.9.6...s..s..0.......}.s..?...c..X...\|..........>.x..o.?.?..{........n..o....]?....Ej..yuu5...A.}....5...^...f........s.qJ..SYF.V...'..q.......T..'..z.....

Chrome Cache Entry: 156

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	16
Entropy (8bit):	3.875
Encrypted:	false
SSDEEP:	3:HMB:k
MD5:	0B04EA412F8FC88B51398B1CBF38110E
SHA1:	E073BCC5A03E7BBA2A16CF201A3CED1BE7533FBF
SHA-256:	7562254FF78FD854F0A8808E75A406F5C6058B57B71514481DAE490FC7B8F4C3
SHA-512:	6D516068C3F3CBFC1500032E600BFF5542EE30C0EAC11A929EE002C707810BBF614A5586C2673EE959AFDF19C08F6EAEFA18193AD6CEDC839BDF249CF95E8079
Malicious:	false
URL:	https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzISEAkEurwx6c-nJBIFDb_mJfI=?alt=proto
Preview:	CgkKBw2/5iXyGgA=

Chrome Cache Entry: 157

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65410)
Category:	dropped
Size (bytes):	206998
Entropy (8bit):	5.418793847287795
Encrypted:	false
SSDEEP:	3072:X/9cGgmjXCGzE0ploS6MeaUpyd57vUDgg4+RT7:XlcGxxsfMe3pyPvkB4cT7
MD5:	DEAA16321132C38272BDA251563F48A1
SHA1:	0209A287D78181B0A8FC3644E8E99BE2105F46F0
SHA-256:	80934D21B5493C94EE3AA1F35745543326CF6C9D695C85C635BAD9C19CE0D84F
SHA-512:	0473BF532047268B569B54B23C1B0117FB25A21058C2E985E9D245E695A523ABC983DF4D64A2420D635A02FFF6A83E5393A75608FB8EC10DB2834D54456DDA91
Malicious:	false
Preview:	/!. 1DS JSLL SKU, 4.3.0. * Copyright (c) Microsoft and contributors. All rights reserved.. * (Microsoft Internal Only). */.!function(e,t){var n="undefined";if("object"==typeof exports&&typeof module!=n)t(exports);else if("function"==typeof define&&define.amd)define(["exports"],t);else{var r,i,e=typeof globalThis!=n?globalThis:e\|\|self,a={},o="__ms$mod__",c={},u=c.es5_ms_jsll_4_3_0={},s="4.3.0",l="oneDS4",f=(f=e)[l]=f[l]\|\|{},d=(d=e)[l="oneDS"]=d[l]\|\|{},e=f[o]=f[o]\|\|{},p=e.v=e.v\|\|[],l=d[o]=d[o]\|\|{},g=l.v=l.v\|\|[];for(i in(l.o=l.o\|\|[]).push(c),t(a),a)r="x",f[i]=a[i],p[i]=s,typeof d[i]==n?(r="n",(d[i]=a[i])&&(g[i]=s)):g[i]\|\|(g[i]="---"),(u[r]=u[r]\|\|[]).push(i)}}(this,function(f){"use strict";var d="function",p="object",se="undefined",Ce="prototype",g=Object,h=g[Ce];function m(e,t){return e\|\|t}var y,be=undefined,C=null,b="",T="function",I="object",_="prototype",S="__proto__",x="undefined",N="constructor",D="Symbol",A="_polyfill",w="length",k="name",Te="call",P="toString",O=m(Object),R=O[_]

Chrome Cache Entry: 158

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 18768, version 1.0
Category:	downloaded
Size (bytes):	18768
Entropy (8bit):	7.987865266610692
Encrypted:	false
SSDEEP:	384:Jg8I5VXe4fT0sr9WHEzMrMk7OF+IkXpFlhwOFKepi9L6hOz:JRyVnpr8MeOFwpFbgZx6ha
MD5:	870B357C3BAE1178740236D64790E444
SHA1:	5FA06435D0ECF28CBD005773F8C335C44D7DF522
SHA-256:	0227BD6A0408946E9B4DF6F1A340E3713759A42A7677BDB8CB34698E4EDF541E
SHA-512:	7FC902E787B1F51B86D967354C0F2987EA9FD582FEF2959831EA6DBC5E7BF998A8F24BA906F0EE99AE8493AEB0C53AF06BEE106D60B448AC50B827C63B1ED169
Malicious:	false
URL:	https://learn.microsoft.com/static/assets/0.4.027605576/styles/docons.aa8255ca.woff2
Preview:	wOF2......IP..........H..........................T.V..&......9.6.$..h..v.. ..y..{.^y'd^K....w^77..<.B..{..d...Jr2D.N.D...?..bxj+.nP.U.......X...sg.!..{B...r.).......t.JT.Rs.t..u.%.[.....p.......&.'z../......E......q...\|.8...g..%.?...O..:9$). .-.{LMK....=\3D.y...y ..0...vX3.\|..$...(.. Z..b...p.u.q,:$VP...ZG[GEp.I..P..1.}.Y..........F...m#.....`w.FA..\|7.\| .Od..R.&.......wK..@....\..t........j9Dv.j.....V..A...\.q..[...g.!....(.....JQ.,.9[..o..6.p.....v...........E ,ap{..Z..ms.y..B.gH.a...?....]... .@....o.....8.@.......Vf<.CX.(...c..$.t.....=..(...w.....d...xOvr.<.uj{.I...`.!E...r......yE...}...".e>A ...q._Um%..Y...VR...a.2.F... .B..B.E.E $?....*.%.HL...e...<....t.u%.....a.).x.x...vq.h..[.'.$......i..3....8>....1...!AK9%...(..cGM{....$.Y4:...}.U...3D..)E.j.....%..+......Q..p....D.!.`..E..E....o.c.M-.......L,...mg.A. .V....G....t$..T......D/.T..mQ.......#CA4.dQA=.hc..d..6j.....+......M4.....6V{.....c..?...(t....qw\|....0..`....^.^g..y...

Chrome Cache Entry: 159

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2945
Entropy (8bit):	5.11559629166894
Encrypted:	false
SSDEEP:	48:YJckl90I99HHJ3PSC/HCcTxdB4H0CrsfSMrxMZuv15C/h1/8iHd0MBToe1xrvAKB:gjlJFSCVxd7wsfSMrxguv+/h1P0MBToE
MD5:	16A9A2CEBAEBD81D7E24D9D73988CFDB
SHA1:	C28CD7B14A019A7A800EC5CC4315BCD27DB00A16
SHA-256:	115DAC6DD805A8F85C48218C1292D9633E63131FE8907DA7ED4730197C4E6AAF
SHA-512:	468BEB586F938ED8A2F22D26D20A43ED3C1F77C014EAC5EE9BD16965AF2AE1723FCDD2D42D37BE8AF1911B2F44382BF16B7FE0C71AE856537C444DDABFDCA466
Malicious:	false
Preview:	{"banners":[{"content":{"text":"You may experience reduced functionality with empty pages and broken links. Development is in progress to improve your experience."},"dismissable":false,"location":"sectional","scope":{"accessLevels":["isolated"],"endDate":"2030-01-01T00:00:00-00:00","paths":["/samples/browse/","/lifecycle/products/","/dotnet/api/","/javascript/api/","/java/api/","/powershell/module/","/python/api/","/rest/api/","/assessments/"],"startDate":"2020-10-01T05:00:00-04:00"},"uid":"development-in-progress-isolated"},{"content":{"link":{"href":"/en-us/answers/questions/1657059/the-subscription-is-not-allowed-to-create-or-updat","title":"View discussion"},"text":"App Service deployment: subscription \u0027xxxxxxxx\u0027 is not allowed to create or update the server farm."},"dismissable":true,"location":"sectional","scope":{"accessLevels":["online"],"endDate":"2024-05-24T07:34:00.000Z","paths":["/answers/tags/436/azure-app-service"],"startDate":"2024-04-22T07:34:00.000Z"},"uid":"

Chrome Cache Entry: 160

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65410)
Category:	downloaded
Size (bytes):	206998
Entropy (8bit):	5.418793847287795
Encrypted:	false
SSDEEP:	3072:X/9cGgmjXCGzE0ploS6MeaUpyd57vUDgg4+RT7:XlcGxxsfMe3pyPvkB4cT7
MD5:	DEAA16321132C38272BDA251563F48A1
SHA1:	0209A287D78181B0A8FC3644E8E99BE2105F46F0
SHA-256:	80934D21B5493C94EE3AA1F35745543326CF6C9D695C85C635BAD9C19CE0D84F
SHA-512:	0473BF532047268B569B54B23C1B0117FB25A21058C2E985E9D245E695A523ABC983DF4D64A2420D635A02FFF6A83E5393A75608FB8EC10DB2834D54456DDA91
Malicious:	false
URL:	https://js.monitor.azure.com/scripts/c/ms.jsll-4.min.js
Preview:	/!. 1DS JSLL SKU, 4.3.0. * Copyright (c) Microsoft and contributors. All rights reserved.. * (Microsoft Internal Only). */.!function(e,t){var n="undefined";if("object"==typeof exports&&typeof module!=n)t(exports);else if("function"==typeof define&&define.amd)define(["exports"],t);else{var r,i,e=typeof globalThis!=n?globalThis:e\|\|self,a={},o="__ms$mod__",c={},u=c.es5_ms_jsll_4_3_0={},s="4.3.0",l="oneDS4",f=(f=e)[l]=f[l]\|\|{},d=(d=e)[l="oneDS"]=d[l]\|\|{},e=f[o]=f[o]\|\|{},p=e.v=e.v\|\|[],l=d[o]=d[o]\|\|{},g=l.v=l.v\|\|[];for(i in(l.o=l.o\|\|[]).push(c),t(a),a)r="x",f[i]=a[i],p[i]=s,typeof d[i]==n?(r="n",(d[i]=a[i])&&(g[i]=s)):g[i]\|\|(g[i]="---"),(u[r]=u[r]\|\|[]).push(i)}}(this,function(f){"use strict";var d="function",p="object",se="undefined",Ce="prototype",g=Object,h=g[Ce];function m(e,t){return e\|\|t}var y,be=undefined,C=null,b="",T="function",I="object",_="prototype",S="__proto__",x="undefined",N="constructor",D="Symbol",A="_polyfill",w="length",k="name",Te="call",P="toString",O=m(Object),R=O[_]

Chrome Cache Entry: 161

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	2945
Entropy (8bit):	5.11559629166894
Encrypted:	false
SSDEEP:	48:YJckl90I99HHJ3PSC/HCcTxdB4H0CrsfSMrxMZuv15C/h1/8iHd0MBToe1xrvAKB:gjlJFSCVxd7wsfSMrxguv+/h1P0MBToE
MD5:	16A9A2CEBAEBD81D7E24D9D73988CFDB
SHA1:	C28CD7B14A019A7A800EC5CC4315BCD27DB00A16
SHA-256:	115DAC6DD805A8F85C48218C1292D9633E63131FE8907DA7ED4730197C4E6AAF
SHA-512:	468BEB586F938ED8A2F22D26D20A43ED3C1F77C014EAC5EE9BD16965AF2AE1723FCDD2D42D37BE8AF1911B2F44382BF16B7FE0C71AE856537C444DDABFDCA466
Malicious:	false
URL:	https://learn.microsoft.com/en-us/banners/index.json
Preview:	{"banners":[{"content":{"text":"You may experience reduced functionality with empty pages and broken links. Development is in progress to improve your experience."},"dismissable":false,"location":"sectional","scope":{"accessLevels":["isolated"],"endDate":"2030-01-01T00:00:00-00:00","paths":["/samples/browse/","/lifecycle/products/","/dotnet/api/","/javascript/api/","/java/api/","/powershell/module/","/python/api/","/rest/api/","/assessments/"],"startDate":"2020-10-01T05:00:00-04:00"},"uid":"development-in-progress-isolated"},{"content":{"link":{"href":"/en-us/answers/questions/1657059/the-subscription-is-not-allowed-to-create-or-updat","title":"View discussion"},"text":"App Service deployment: subscription \u0027xxxxxxxx\u0027 is not allowed to create or update the server farm."},"dismissable":true,"location":"sectional","scope":{"accessLevels":["online"],"endDate":"2024-05-24T07:34:00.000Z","paths":["/answers/tags/436/azure-app-service"],"startDate":"2024-04-22T07:34:00.000Z"},"uid":"

Chrome Cache Entry: 162

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 533 x 478, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	15427
Entropy (8bit):	7.784472070227724
Encrypted:	false
SSDEEP:	384:CKKdvwj3SJMpKKKKKKKKikCyKwqHILyPGQV4ykihKKKKKKKCm:CKKdvMMgKKKKKKKKiqB3yPVXkihKKKKI
MD5:	3062488F9D119C0D79448BE06ED140D8
SHA1:	8A148951C894FC9E968D3E46589A2E978267650E
SHA-256:	C47A383DE6DD60149B37DD24825D42D83CB48BE0ED094E3FC3B228D0A7BB9332
SHA-512:	00BBA6BCBFBF44B977129594A47F732809DCE7D4E2D22D050338E4EEA91FCC02A9B333C45EEB4C9024DF076CBDA0B46B621BF48309C0D037D19BBEAE0367F5ED
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/install/media/application-not-started/repair-tool-recommended-changes.png
Preview:	.PNG........IHDR.............,#......sRGB.........gAMA......a.....pHYs..........o.d..;.IDATx^..].u.Y..M....B.X...".......@.ZzSys..,H{.Rz!... .......WM.IN..9n..I....g...p<P.0-....\|...X..s...Z.Y{....w..5.._s..x...E.......... ..................... ..................{....2. ...`.$h.......)....,T-x.5......,.."..(.A.......>.. ...`......4..G.\|.....,T-..'. ...`....]........?~.....A...pAP...\.T..........A...pAP...\.T..........A...pAP...\.T..........A...pAP...\.}P../}....TJ...'.O...'?......XH...K..>.b..K/t...o.......T.._.E.....q.$.x..qJ......mo...ww.}.{....W..._...._.^z...........(^x..C..P.../.........U..]../u.....w..{.O.N..o.l........_.^...2.....*....<...iP.W...o......]..+.?}c...t!.....p.=..._x..._yo....?....~u.c?.c1'.....{.^.}.S...5.yMx./.>.lwqq.}.....g..g1wZ..%......h.i[..%ul.&..U.k..";7-.9.6...s..s..0.......}.s..?...c..X...\|..........>.x..o.?.?..{........n..o....]?....Ej..yuu5...A.}....5...^...f........s.qJ..SYF.V...'..q.......T..'..z.....

Chrome Cache Entry: 163

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (52717), with no line terminators
Category:	dropped
Size (bytes):	52717
Entropy (8bit):	5.462668685745912
Encrypted:	false
SSDEEP:	1536:tjspYRrxlhd0fq3agV3IcgPPPI3r7DAQHCloIB3Tj7xHw:tjZLCtxQ
MD5:	413FCC759CC19821B61B6941808B29B5
SHA1:	1AD23B8A202043539C20681B1B3E9F3BC5D55133
SHA-256:	DAF7759FEDD9AF6C4D7E374B0D056547AE7CB245EC24A1C4ACF02932F30DC536
SHA-512:	E9BF8A74FEF494990AAFD15A0F21E0398DC28B4939C8F9F8AA1F3FFBD18056C8D1AB282B081F5C56F0928C48E30E768F7E347929304B55547F9CA8C1AABD80B8
Malicious:	false
Preview:	var WcpConsent;!function(){var e={229:function(e){window,e.exports=function(e){var t={};function o(n){if(t[n])return t[n].exports;var r=t[n]={i:n,l:!1,exports:{}};return e[n].call(r.exports,r,r.exports,o),r.l=!0,r.exports}return o.m=e,o.c=t,o.d=function(e,t,n){o.o(e,t)\|\|Object.defineProperty(e,t,{enumerable:!0,get:n})},o.r=function(e){"undefined"!=typeof Symbol&&Symbol.toStringTag&&Object.defineProperty(e,Symbol.toStringTag,{value:"Module"}),Object.defineProperty(e,"__esModule",{value:!0})},o.t=function(e,t){if(1&t&&(e=o(e)),8&t)return e;if(4&t&&"object"==typeof e&&e&&e.__esModule)return e;var n=Object.create(null);if(o.r(n),Object.defineProperty(n,"default",{enumerable:!0,value:e}),2&t&&"string"!=typeof e)for(var r in e)o.d(n,r,function(t){return e[t]}.bind(null,r));return n},o.n=function(e){var t=e&&e.__esModule?function(){return e.default}:function(){return e};return o.d(t,"a",t),t},o.o=function(e,t){return Object.prototype.hasOwnProperty.call(e,t)},o.p="",o(o.s=3)}([function(e,t,o)

Chrome Cache Entry: 164

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (52717), with no line terminators
Category:	downloaded
Size (bytes):	52717
Entropy (8bit):	5.462668685745912
Encrypted:	false
SSDEEP:	1536:tjspYRrxlhd0fq3agV3IcgPPPI3r7DAQHCloIB3Tj7xHw:tjZLCtxQ
MD5:	413FCC759CC19821B61B6941808B29B5
SHA1:	1AD23B8A202043539C20681B1B3E9F3BC5D55133
SHA-256:	DAF7759FEDD9AF6C4D7E374B0D056547AE7CB245EC24A1C4ACF02932F30DC536
SHA-512:	E9BF8A74FEF494990AAFD15A0F21E0398DC28B4939C8F9F8AA1F3FFBD18056C8D1AB282B081F5C56F0928C48E30E768F7E347929304B55547F9CA8C1AABD80B8
Malicious:	false
URL:	https://wcpstatic.microsoft.com/mscc/lib/v2/wcp-consent.js
Preview:	var WcpConsent;!function(){var e={229:function(e){window,e.exports=function(e){var t={};function o(n){if(t[n])return t[n].exports;var r=t[n]={i:n,l:!1,exports:{}};return e[n].call(r.exports,r,r.exports,o),r.l=!0,r.exports}return o.m=e,o.c=t,o.d=function(e,t,n){o.o(e,t)\|\|Object.defineProperty(e,t,{enumerable:!0,get:n})},o.r=function(e){"undefined"!=typeof Symbol&&Symbol.toStringTag&&Object.defineProperty(e,Symbol.toStringTag,{value:"Module"}),Object.defineProperty(e,"__esModule",{value:!0})},o.t=function(e,t){if(1&t&&(e=o(e)),8&t)return e;if(4&t&&"object"==typeof e&&e&&e.__esModule)return e;var n=Object.create(null);if(o.r(n),Object.defineProperty(n,"default",{enumerable:!0,value:e}),2&t&&"string"!=typeof e)for(var r in e)o.d(n,r,function(t){return e[t]}.bind(null,r));return n},o.n=function(e){var t=e&&e.__esModule?function(){return e.default}:function(){return e};return o.d(t,"a",t),t},o.o=function(e,t){return Object.prototype.hasOwnProperty.call(e,t)},o.p="",o(o.s=3)}([function(e,t,o)

Chrome Cache Entry: 165

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	exported SGML document, ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	1173007
Entropy (8bit):	5.503893944397598
Encrypted:	false
SSDEEP:	24576:VMga+4IVzOjS1Jho1WXQFjTEr39/jHXzT:VMcVzOjS1Jho1WXQar39/bXzT
MD5:	2E00D51C98DBB338E81054F240E1DEB2
SHA1:	D33BAC6B041064AE4330DCC2D958EBE4C28EBE58
SHA-256:	300480069078B5892D2363A2B65E2DFBBF30FE5C80F83EDBFECF4610FD093862
SHA-512:	B6268D980CE9CB729C82DBA22F04FD592952B2A1AAB43079CA5330C68A86E72B0D232CE4070DB893A5054EE5C68325C92C9F1A33F868D61EBB35129E74FC7EF9
Malicious:	false
URL:	https://learn.microsoft.com/static/third-party/MathJax/3.2.2/tex-mml-chtml.js
Preview:	(function(){"use strict";var __webpack_modules__={351:function(t,e,r){var n,o=this&&this.__extends\|\|(n=function(t,e){return n=Object.setPrototypeOf\|\|{__proto__:[]}instanceof Array&&function(t,e){t.__proto__=e}\|\|function(t,e){for(var r in e)Object.prototype.hasOwnProperty.call(e,r)&&(t[r]=e[r])},n(t,e)},function(t,e){if("function"!=typeof e&&null!==e)throw new TypeError("Class extends value "+String(e)+" is not a constructor or null");function r(){this.constructor=t}n(t,e),t.prototype=null===e?Object.create(e):(r.prototype=e.prototype,new r)}),i=this&&this.__assign\|\|function(){return i=Object.assign\|\|function(t){for(var e,r=1,n=arguments.length;r<n;r++)for(var o in e=arguments[r])Object.prototype.hasOwnProperty.call(e,o)&&(t[o]=e[o]);return t},i.apply(this,arguments)},s=this&&this.__read\|\|function(t,e){var r="function"==typeof Symbol&&t[Symbol.iterator];if(!r)return t;var n,o,i=r.call(t),s=[];try{for(;(void 0===e\|\|e-- >0)&&!(n=i.next()).done;)s.push(n.value)}catch(t){o={error:t}}finally

Chrome Cache Entry: 166

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 533 x 478, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	13339
Entropy (8bit):	7.683569563478597
Encrypted:	false
SSDEEP:	192:zjSKAj04ndWb6OuzZjk6TsEaJS0/bJur2Gz4Imm3MhE4NfM:zutfW69XTspsG3G0TfhEQM
MD5:	512625CF8F40021445D74253DC7C28C0
SHA1:	F6B27CE0F7D4E48E34FDDCA8A96337F07CFFE730
SHA-256:	1D4DCEE8511D5371FEC911660D6049782E12901C662B409A5C675772E9B87369
SHA-512:	AE02319D03884D758A86C286B6F593BDFFD067885D56D82EEB8215FDCB41637C7BB9109039E7FBC93AD246D030C368FB285B3161976ED485ABC5A8DF6DF9A38C
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/install/media/application-not-started/repair-tool-changes-complete.png
Preview:	.PNG........IHDR.............,#......sRGB.........gAMA......a.....pHYs..........o.d..3.IDATx^..].5Y...C.$..tH .NF.I&A0..;.r.fF.#..!7...'..3.0.../..s....."!.y...~....4....om.g.3.BTP......j..g.zVU....u...a.Z..j..U....y......$.....I...pAR...\.T....$.....I...pAR...\.T..p....5O>.d...}Rg.$....@.4....fb1.o.I...7..<.P.....n0.D.P.....n..L.P.....n8.......P.~......n(+..'. ......J.vM,H......W...h.T....$.....I...pAR...\.T....$.....I...pAR...\.T....$.....I...pAR...\.T....$......'....w....g....\|../5_.......T...~.y.'.'.\|...W..[...C.)......\|.[.[WK...w...w..y.{..\|.#.n>...5....5...h>..O6O>.Xx....o.B........g?.........~....?o...w.......}..-_k^........l....\|.D.TH.....o..B'..(.W-%...?...W.......E?h..........~.......?...~,..}...o^...5ox..bI.mo{[s.}.5.<.L.......<......Y.W......K..Q._...Iu...2...e)d]4.}Y..............k.%k..s.'..L(..o4...g...z............N.X.....W.O.^.4.....7......i~._7..~,bI......3.0RRq..\|.Mk..?.{.K_...t.........SYG.W^#).N^..._W...(.8.7.....W....7...m

Chrome Cache Entry: 167

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors
Category:	downloaded
Size (bytes):	17174
Entropy (8bit):	2.9129715116732746
Encrypted:	false
SSDEEP:	24:QSNTmTFxg4lyyyyyyyyyyyyyio7eeeeeeeeekzgsLsLsLsLsLsQZp:nfgyyyyyyyyyyyyynzQQQQQO
MD5:	12E3DAC858061D088023B2BD48E2FA96
SHA1:	E08CE1A144ECEAE0C3C2EA7A9D6FBC5658F24CE5
SHA-256:	90CDAF487716184E4034000935C605D1633926D348116D198F355A98B8C6CD21
SHA-512:	C5030C55A855E7A9E20E22F4C70BF1E0F3C558A9B7D501CFAB6992AC2656AE5E41B050CCAC541EFA55F9603E0D349B247EB4912EE169D44044271789C719CD01
Malicious:	false
URL:	https://learn.microsoft.com/favicon.ico
Preview:	..............h(..f...HH...........(..00......h....6.. ...........=...............@..........(....A..(....................(....................................."P.........................................."""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333""""""""""""""""""""""""""

Chrome Cache Entry: 168

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	5655
Entropy (8bit):	4.790648170893192
Encrypted:	false
SSDEEP:	96:ogVOjPWccI3aDNjExAjfWQpL0dpwmWMv7BRevy8RJNjvZPyJ2tlh7RewZUZSeZV1:og2cUaDNjESLWQN0dpwm99qllVR7pUZF
MD5:	D3383426D3B6D3B34CFE726209647339
SHA1:	E656FAA1B2A5235C9E745C534BC7FB10396484D7
SHA-256:	6B7B929D611665A1F5EC015EB590FC70BA1F2C6D0D131F5796A53874C0ADFDE2
SHA-512:	F39A67F02165DB08D31B50FDB21667A286C15B774D3E31FA0ED727DA29BFE7C5C50F691367AC19511660BB38EA9B9F3395C27865AF9A1FB3EA8DD90C15004669
Malicious:	false
Preview:	{"brandLink":{"biName":"learn","displayName":"Learn","href":"/"},"featuredContent":[{"biName":"1-microsoft-learn-for-organizations","description":"Access curated resources to upskill your team and close skills gaps.","href":"/training/organizations/","supertitle":"Microsoft Learn for Organizations","title":"Boost your team\u0027s technical skills"}],"metadata":{"git_commit_id":"fc6a701829ff5069dcb2f756662cd778bf45c3a3"},"navCategories":[{"biName":"1-discover","panel":{"panelContent":[{"biName":"1-documentation","componentType":"header-panel-card","description":"In-depth articles on Microsoft developer tools and technologies","href":"/docs/","title":"Documentation"},{"biName":"2-training","componentType":"header-panel-card","description":"Personalized learning paths and courses","href":"/training/","title":"Training"},{"biName":"3-credentials","componentType":"header-panel-card","description":"Globally recognized, industry-endorsed credentials","href":"/credentials/","title":"Credential

Chrome Cache Entry: 169

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors
Category:	dropped
Size (bytes):	17174
Entropy (8bit):	2.9129715116732746
Encrypted:	false
SSDEEP:	24:QSNTmTFxg4lyyyyyyyyyyyyyio7eeeeeeeeekzgsLsLsLsLsLsQZp:nfgyyyyyyyyyyyyynzQQQQQO
MD5:	12E3DAC858061D088023B2BD48E2FA96
SHA1:	E08CE1A144ECEAE0C3C2EA7A9D6FBC5658F24CE5
SHA-256:	90CDAF487716184E4034000935C605D1633926D348116D198F355A98B8C6CD21
SHA-512:	C5030C55A855E7A9E20E22F4C70BF1E0F3C558A9B7D501CFAB6992AC2656AE5E41B050CCAC541EFA55F9603E0D349B247EB4912EE169D44044271789C719CD01
Malicious:	false
Preview:	..............h(..f...HH...........(..00......h....6.. ...........=...............@..........(....A..(....................(....................................."P.........................................."""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333""""""""""""""""""""""""""

Chrome Cache Entry: 170

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 658 x 480, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	13842
Entropy (8bit):	7.802399161550213
Encrypted:	false
SSDEEP:	192:NLNf+jBQsDHg7av3EEondO8PuRu2mIYXEIiDm42NpsHFMHfgnJ4K2DVwv:NLt+1jDmY+ndXwjLUpiDwpzfwoDVk
MD5:	F6EC97C43480D41695065AD55A97B382
SHA1:	D9C3D0895A5ED1A3951B8774B519B8217F0A54C5
SHA-256:	07A599FAB1E66BABC430E5FED3029F25FF3F4EA2DD0EC8968FFBA71EF1872F68
SHA-512:	22462763178409D60609761A2AF734F97B35B9A818EC1FD9046AFAB489AAD83CE34896EE8586EFE402EA7739ECF088BC2DB5C1C8E4FB39E6A0FC5B3ADC6B4A9B
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/install/media/application-not-started/install-3-5.png
Preview:	.PNG........IHDR................1....sRGB.........gAMA......a.....pHYs..........o.d..5.IDATx^..[.,.]...../<.!.B(/y..).F\r...!(.H..a ..B.~..A..KXA.M...6..8...!1....l./.X.1....2.`.y"l..R...V.....{...}._gWW.Z.VUw.N...U..P@..... ..@.A...".$..E.I.........$..("H..PD..... ..p....U.}.{.....l..A.....A........s.......D.0...@....E..x........L. /.".A.....$...Y."...%.I..["../.&.I..[`.0..IA.........p4.I.........$..("H..PD..... ..@.A...".$..E.I.........$..("H..PD..... ..@.A...".$..E.>H...O.................?.~.......].7.....a?....(H....m.G..G..a.P..?yo......f?...o. .B.....mo{[....:9<].....7.....a.....S..Cd.5,.R....#....>......._g.....Wo\|.....z.g.........w.T...]x.>.....y(.........6....[..px...U....~.~hu...}H.......~.L... ....r...iY.$..Id..Ax"../....._..U....OTo\|.Mh.km..A.k..k....n.C`\|._\=...o...a.e.. ...&.A2..k.. ....X.+...C..P....y..>.{._..(H....8(.?...w.}M.........:s_!.m.........BY..T..z.5{.W.~..6.....F....bq....m.....?.......v....o..o...ki...iX.$......\]V...V...

Chrome Cache Entry: 171

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (32029), with no line terminators
Category:	dropped
Size (bytes):	32029
Entropy (8bit):	4.903574747591743
Encrypted:	false
SSDEEP:	384:FnvJOb4OLIch+KCnMet7NPXlJl+HjZjBTRdE0zIwHdZjV8din4ELi:5hOEO8chkMet7pCjBfnWOLi
MD5:	178A496645B67ABCE799D62DB8095CAB
SHA1:	0C264AFE3DB13E5B00A0E497FB6AB8556EB97939
SHA-256:	70A34968E8715CF14074EA089B66896A9BC10AF79352DB8A40DA83467891F92D
SHA-512:	EF7CDA8F433A47BABCBB74A57C3B4A20251A6D52E5C9CBEC33B5889A110760719180776BD9C7D7964CF140F950CAB8BC2AD08EAB5FA650FE7744FD9242C67E23
Malicious:	false
Preview:	{"items":[{"href":"./","toc_title":".NET Framework documentation"},{"href":"get-started/overview","toc_title":"Overview of .NET Framework"},{"children":[{"href":"get-started/","toc_title":"Overview"},{"href":"get-started/out-of-band-releases","toc_title":"Out-of-band releases"},{"href":"get-started/system-requirements","toc_title":"System requirements"}],"toc_title":"Get started"},{"children":[{"href":"install/","toc_title":"Overview"},{"href":"install/guide-for-developers","toc_title":"For developers"},{"children":[{"href":"install/on-windows-11","toc_title":"Windows 11"},{"href":"install/on-windows-10","toc_title":"Windows 10 and Windows Server 2016"},{"href":"install/on-windows-8-1","toc_title":"Windows 8.1 and Windows Server 2012 R2"},{"href":"install/on-windows-8","toc_title":"Windows 8 and Windows Server 2012"},{"href":"install/on-server-2022","toc_title":"Windows Server 2022"},{"href":"install/on-server-2019","toc_title":"Windows Server 2019"}],"toc_title":"By OS version"},{"hre

Chrome Cache Entry: 172

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	5655
Entropy (8bit):	4.790648170893192
Encrypted:	false
SSDEEP:	96:ogVOjPWccI3aDNjExAjfWQpL0dpwmWMv7BRevy8RJNjvZPyJ2tlh7RewZUZSeZV1:og2cUaDNjESLWQN0dpwm99qllVR7pUZF
MD5:	D3383426D3B6D3B34CFE726209647339
SHA1:	E656FAA1B2A5235C9E745C534BC7FB10396484D7
SHA-256:	6B7B929D611665A1F5EC015EB590FC70BA1F2C6D0D131F5796A53874C0ADFDE2
SHA-512:	F39A67F02165DB08D31B50FDB21667A286C15B774D3E31FA0ED727DA29BFE7C5C50F691367AC19511660BB38EA9B9F3395C27865AF9A1FB3EA8DD90C15004669
Malicious:	false
URL:	https://learn.microsoft.com/en-us/content-nav/site-header/site-header.json?
Preview:	{"brandLink":{"biName":"learn","displayName":"Learn","href":"/"},"featuredContent":[{"biName":"1-microsoft-learn-for-organizations","description":"Access curated resources to upskill your team and close skills gaps.","href":"/training/organizations/","supertitle":"Microsoft Learn for Organizations","title":"Boost your team\u0027s technical skills"}],"metadata":{"git_commit_id":"fc6a701829ff5069dcb2f756662cd778bf45c3a3"},"navCategories":[{"biName":"1-discover","panel":{"panelContent":[{"biName":"1-documentation","componentType":"header-panel-card","description":"In-depth articles on Microsoft developer tools and technologies","href":"/docs/","title":"Documentation"},{"biName":"2-training","componentType":"header-panel-card","description":"Personalized learning paths and courses","href":"/training/","title":"Training"},{"biName":"3-credentials","componentType":"header-panel-card","description":"Globally recognized, industry-endorsed credentials","href":"/credentials/","title":"Credential

Chrome Cache Entry: 173

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 475 x 212, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	35005
Entropy (8bit):	7.980061050467981
Encrypted:	false
SSDEEP:	768:aHBEr/QXnbCgWotMq4AZZivq2/Qu0cEv1FjHBep6U0Z/68R:ahWqbTWiM7ACvdIdldhep4rR
MD5:	522037F008E03C9448AE0AAAF09E93CB
SHA1:	8A32997EAB79246BEED5A37DB0C92FBFB006BEF2
SHA-256:	983C35607C4FB0B529CA732BE42115D3FCAAC947CEE9C9632F7CACDBDECAF5A7
SHA-512:	643EC613B2E7BDBB2F61E1799C189B0E3392EA5AE10845EB0B1F1542A03569E886F4B54D5B38AF10E78DB49C71357108C94589474B181F6A4573B86CF2D6F0D8
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/install/media/application-not-started/app-could-not-be-started.png
Preview:	.PNG........IHDR..............[.U....sRGB.........gAMA......a.....pHYs..........+.....RIDATx^..`........B hpwww(PJ....R.B.....K[j....@ H ..r:...].P._.`...K.ffg.v.ygf.TM.4.m...`.D".H$......"##..2e.X.t..Y".H$...d..PK.V".H$..uVm.,.H$.....b+.H$.I-#.V".H$.ZF..D".H$...[.D".Hj.)...D"..2Rl%..D".e..J$..DR.H..H$.....b+.H$..9..Neee.X,.B.\/.....o.b+.H$..9...q...EHU....p.....=z....b.7.q..........N.. ....cUAX.9...m'_...2.`.g{...4.H.9.p.4...K ^.....`.\|.n..]..m..`W..W.H.~..\|.^.a..K.6......_....K..w....9......^.....&...R....[...w..Ix=.:..^/..Epp0.5.....QRR...l....S.b.5.c.6...5..8.\....z...I......&.>....../.{.=...]'c......[.E`@Cg......Z.....c.f..,.y\|,.{.o@.j..2..:.&l4.{.]Ll.N.0..b:b...g.n.........I...Ewc....[..,i`v......F...il\|.c,{.-.....%BP.U........y.x....6..E2..n.W...J .*..`..r....F....#BCC......\|.L&........O...'........\.....;...q.n$...7...ga..x....)..A...0.{1..'1../...+yRC...W.-..b..c0dDG...U[po....2eG.G.../.@........h.:.k?.......Q...

Chrome Cache Entry: 174

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1478
Entropy (8bit):	5.030941252322257
Encrypted:	false
SSDEEP:	24:TGAg3Efef6tfTf/fffCfxfdffW4N5f0f8fK8zyRWmmkYRWDKslbzP3LTPv4NUhqI:TK0W6bXnq512ysUbkfKCvUjeGxbu
MD5:	020629EBA820F2E09D8CDA1A753C032B
SHA1:	D91A65036E4C36B07AE3641E32F23F8DD616BD17
SHA-256:	F8AE8A1DC7CE7877B9FB9299183D2EBB3BEFAD0B6489AE785D99047EC2EB92D1
SHA-512:	EF5A5C7A301DE55D103B1BE375D988970D9C4ECD62CE464F730C49E622128F431761D641E1DFAA32CA03F8280B435AE909486806DF62A538B48337725EB63CE1
Malicious:	false
Preview:	// ES5 script for back compat with unsupported browsers...!(function () {...'use strict';...// Keep in sync with environment/browser.ts...var supportedBrowser =....typeof Blob === 'function' &&....typeof PerformanceObserver === 'function' &&....typeof Intl === 'object' &&....typeof MutationObserver === 'function' &&....typeof URLSearchParams === 'function' &&....typeof WebSocket === 'function' &&....typeof IntersectionObserver === 'function' &&....typeof queueMicrotask === 'function' &&....typeof TextEncoder === 'function' &&....typeof TextDecoder === 'function' &&....typeof customElements === 'object' &&....typeof HTMLDetailsElement === 'function' &&....typeof AbortController === 'function' &&....typeof AbortSignal === 'function' &&....'entries' in FormData.prototype &&....'toggleAttribute' in Element.prototype &&....'replaceChildren' in Element.prototype &&....// ES2019....'fromEntries' in Object &&....'flatMap' in Array.prototype &&....'trimEnd' in String.prototype &&....// ES2020..

Chrome Cache Entry: 175

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	4897
Entropy (8bit):	4.794639101874543
Encrypted:	false
SSDEEP:	96:A0AIvEQ+KfZcbhaW9dp45qtAdflfDOFnymoLByzVqrpCvJ4QG63JjJ+do88HxbqP:dgQ+KfZcbhaWjp45qtAdflfDOFnNgBy4
MD5:	84E6C95F0E5378BDA94FA965C4692FAF
SHA1:	7C1D6572906509B08F8CD7B7A33EB9F9697EE6D1
SHA-256:	88A4A7B4F1160F8CAD3EB835116C29AC39659D586D4DADC54D9E40AC7E1BC610
SHA-512:	D34BFF37F8402B4A1FEE3C26F247A86D72666647A10E83D711A1BED1D24C6FC13674D65DCC037C22811B227FEC34B5DE20442191A42F9D78FC79D55FD5792761
Malicious:	false
URL:	https://learn.microsoft.com/en-us/content-nav/MSDocsHeader-DotNet.json?
Preview:	{"callToAction":{"primary":{"biName":"download-dotnet","href":"https://dotnet.microsoft.com/download","kind":"link","title":"Download .NET"}},"category":{"biName":"dotnet","href":"/dotnet/","kind":"link","title":".NET"},"items":[{"biName":"1-languages","items":[{"biName":"1-c-sharp","href":"/dotnet/csharp/","kind":"link","title":"C#"},{"biName":"2-f-sharp","href":"/dotnet/fsharp/","kind":"link","title":"F#"},{"biName":"3-visual-basic","href":"/dotnet/visual-basic/","kind":"link","title":"Visual Basic"}],"kind":"menu","title":"Languages"},{"biName":"2-features","items":[{"biName":"1-fundamental","href":"/dotnet/fundamentals/","kind":"link","title":"Fundamentals"},{"biName":"2-tools-and-diagnostics","href":"/dotnet/navigate/tools-diagnostics/","kind":"link","title":"Tools and diagnostics"},{"biName":"3-ai","items":[{"biName":"1-generative-ai","href":"/dotnet/ai/","kind":"link","title":"Generative AI"},{"biName":"2-mlnet","href":"/dotnet/machine-learning/","kind":"link","title":"ML.NET"}]

Chrome Cache Entry: 176

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	4.241202481433726
Encrypted:	false
SSDEEP:	3:YozDD/RNgQJzRWWlKFiFD3e4xCzY:YovtNgmzR/wYFDxkY
MD5:	9E576E34B18E986347909C29AE6A82C6
SHA1:	532C767978DC2B55854B3CA2D2DF5B4DB221C934
SHA-256:	88BDF5AF090328963973990DE427779F9C4DF3B8E1F5BADC3D972BAC3087006D
SHA-512:	5EF6DCFFD93434D45760888BF4B95FF134D53F34DA9DC904AD3C5EBEDC58409073483F531FEA4233869ED3EC75F38B022A70B2E179A5D3A13BDB10AB5C46B124
Malicious:	false
Preview:	{"Message":"The requested resource does not support http method 'GET'."}

Chrome Cache Entry: 177

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	4.241202481433726
Encrypted:	false
SSDEEP:	3:YozDD/RNgQJzRWWlKFiFD3e4xCzY:YovtNgmzR/wYFDxkY
MD5:	9E576E34B18E986347909C29AE6A82C6
SHA1:	532C767978DC2B55854B3CA2D2DF5B4DB221C934
SHA-256:	88BDF5AF090328963973990DE427779F9C4DF3B8E1F5BADC3D972BAC3087006D
SHA-512:	5EF6DCFFD93434D45760888BF4B95FF134D53F34DA9DC904AD3C5EBEDC58409073483F531FEA4233869ED3EC75F38B022A70B2E179A5D3A13BDB10AB5C46B124
Malicious:	false
Preview:	{"Message":"The requested resource does not support http method 'GET'."}

Chrome Cache Entry: 178

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	exported SGML document, ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	1173007
Entropy (8bit):	5.503893944397598
Encrypted:	false
SSDEEP:	24576:VMga+4IVzOjS1Jho1WXQFjTEr39/jHXzT:VMcVzOjS1Jho1WXQar39/bXzT
MD5:	2E00D51C98DBB338E81054F240E1DEB2
SHA1:	D33BAC6B041064AE4330DCC2D958EBE4C28EBE58
SHA-256:	300480069078B5892D2363A2B65E2DFBBF30FE5C80F83EDBFECF4610FD093862
SHA-512:	B6268D980CE9CB729C82DBA22F04FD592952B2A1AAB43079CA5330C68A86E72B0D232CE4070DB893A5054EE5C68325C92C9F1A33F868D61EBB35129E74FC7EF9
Malicious:	false
Preview:	(function(){"use strict";var __webpack_modules__={351:function(t,e,r){var n,o=this&&this.__extends\|\|(n=function(t,e){return n=Object.setPrototypeOf\|\|{__proto__:[]}instanceof Array&&function(t,e){t.__proto__=e}\|\|function(t,e){for(var r in e)Object.prototype.hasOwnProperty.call(e,r)&&(t[r]=e[r])},n(t,e)},function(t,e){if("function"!=typeof e&&null!==e)throw new TypeError("Class extends value "+String(e)+" is not a constructor or null");function r(){this.constructor=t}n(t,e),t.prototype=null===e?Object.create(e):(r.prototype=e.prototype,new r)}),i=this&&this.__assign\|\|function(){return i=Object.assign\|\|function(t){for(var e,r=1,n=arguments.length;r<n;r++)for(var o in e=arguments[r])Object.prototype.hasOwnProperty.call(e,o)&&(t[o]=e[o]);return t},i.apply(this,arguments)},s=this&&this.__read\|\|function(t,e){var r="function"==typeof Symbol&&t[Symbol.iterator];if(!r)return t;var n,o,i=r.call(t),s=[];try{for(;(void 0===e\|\|e-- >0)&&!(n=i.next()).done;)s.push(n.value)}catch(t){o={error:t}}finally

Chrome Cache Entry: 179

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (639), with CRLF, LF line terminators
Category:	downloaded
Size (bytes):	49783
Entropy (8bit):	5.052270079620471
Encrypted:	false
SSDEEP:	768:6DcycfvwcwOffIYswsuKJmQT1Yn4/1ggM6F5F30leYUS99AG:6Y/ovOff9swsu+mQTO4/1BzRUhUe95
MD5:	E77FFFD507B64085DDC6B99DE2B03710
SHA1:	5FE0D5E7BBD6E36A8215629E09D0F57BDAE2E32A
SHA-256:	3AA4ED6C1B3CC8940116D35D0AFF1B519675236ABFD1D7720D68E1833AF6BDD1
SHA-512:	D4FBE712574D558FD2238B5FA0F5D9F2D9495B1DF65B81FACEB53ED8E9C2D4770F98CF870E67425D752A6726477E2E9B855D148FFB6E1169A1D4121451F615BA
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=7F95320763FDCB0F731CE91FB8E178D4110E10A1D56836F442BA34C6F2A631F6.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Preview:	<!DOCTYPE html><html...class="hasSidebar hasPageActions hasBreadcrumb conceptual has-default-focus theme-light"...lang="en-us"...dir="ltr"...data-authenticated="false"...data-auth-status-determined="false"...data-target="docs"...x-ms-format-detection="none">....<head>...<meta charset="utf-8" />...<meta name="viewport" content="width=device-width, initial-scale=1.0" />...<meta property="og:title" content="Fix .NET Framework 'This application could not be started' - .NET Framework" />...<meta property="og:type" content="website" />...<meta property="og:url" content="https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started" /><meta property="og:description" content="Learn what to do if you see a 'This application could not be started' dialog box when running a .NET Framework application." /><meta property="og:image" content="https://learn.microsoft.com/dotnet/media/dotnet-logo.png" />.....<meta property="og:image:alt" content="Fix .NET Framework 'This application

Chrome Cache Entry: 180

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (46884)
Category:	dropped
Size (bytes):	1729946
Entropy (8bit):	5.506784610641439
Encrypted:	false
SSDEEP:	24576:BBweqomwDtVnoZlsG3QO/GFGVgTvjC10wCTOWIzE+0RlMVSB1DkCXWEea87ZGxnJ:BiwDbotVSB1DkCXWEe57ZGxnS+Vh2xDg
MD5:	95DE4EB9C18E800B4E68761D99845561
SHA1:	8CD61A75D8E9D5A1EB894284850AAB6C1E547D6D
SHA-256:	15163779156DA543DEFAAFC12F7C1A850C91411FE7495F03C3BFE0231D5057E3
SHA-512:	86BDE4F52A505FAC4BC49A30C0BDB145D88F568917E8EC89C26CFAA7E7DF85E9744291470E3587312196D93FB6BAA6F75B29D88CB722B7969C284C9A31886DBE
Malicious:	false
Preview:	"use strict";(()=>{var qge=Object.create;var Mx=Object.defineProperty;var OU=Object.getOwnPropertyDescriptor;var Fge=Object.getOwnPropertyNames;var Uge=Object.getPrototypeOf,Oge=Object.prototype.hasOwnProperty;var Hge=(e,t,n)=>t in e?Mx(e,t,{enumerable:!0,configurable:!0,writable:!0,value:n}):e[t]=n;var Ie=(e,t)=>()=>(t\|\|e((t={exports:{}}).exports,t),t.exports);var Bge=(e,t,n,o)=>{if(t&&typeof t=="object"\|\|typeof t=="function")for(let r of Fge(t))!Oge.call(e,r)&&r!==n&&Mx(e,r,{get:()=>t[r],enumerable:!(o=OU(t,r))\|\|o.enumerable});return e};var Rd=(e,t,n)=>(n=e!=null?qge(Uge(e)):{},Bge(t\|\|!e\|\|!e.__esModule?Mx(n,"default",{value:e,enumerable:!0}):n,e));var U=(e,t,n,o)=>{for(var r=o>1?void 0:o?OU(t,n):t,s=e.length-1,i;s>=0;s--)(i=e[s])&&(r=(o?i(t,n,r):i(r))\|\|r);return o&&r&&Mx(t,n,r),r};var Ni=(e,t,n)=>(Hge(e,typeof t!="symbol"?t+"":t,n),n),lL=(e,t,n)=>{if(!t.has(e))throw TypeError("Cannot "+n)};var xt=(e,t,n)=>(lL(e,t,"read from private field"),n?n.call(e):t.get(e)),On=(e,t,n)=>{if(t.has(

Chrome Cache Entry: 181

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1154
Entropy (8bit):	4.59126408969148
Encrypted:	false
SSDEEP:	24:txFRuJpzYeGK+VS6ckNL2091JP/UcHc8oQJ1sUWMLc/jH6GbKqjHJIOHA:JsfcU6ckNL2091Z/U/YsUDM+GhS
MD5:	37258A983459AE1C2E4F1E551665F388
SHA1:	603A4E9115E613CC827206CF792C62AEB606C941
SHA-256:	8E34F3807B4BF495D8954E7229681DA8D0DD101DD6DDC2AD7F90CD2983802B44
SHA-512:	184CB63EF510143B0AF013F506411C917D68BB63F2CFA47EA2A42688FD4F55F3B820AF94F87083C24F48AACEE6A692199E185FC5C5CFBED5D70790454EED7F5C
Malicious:	false
URL:	https://learn.microsoft.com/en-us/media/logos/logo_net.svg
Preview:	<svg width="456" height="456" viewBox="0 0 456 456" fill="none" xmlns="http://www.w3.org/2000/svg">..<rect width="456" height="456" fill="#512BD4"/>..<path d="M81.2738 291.333C78.0496 291.333 75.309 290.259 73.052 288.11C70.795 285.906 69.6665 283.289 69.6665 280.259C69.6665 277.173 70.795 274.529 73.052 272.325C75.309 270.121 78.0496 269.019 81.2738 269.019C84.5518 269.019 87.3193 270.121 89.5763 272.325C91.887 274.529 93.0424 277.173 93.0424 280.259C93.0424 283.289 91.887 285.906 89.5763 288.11C87.3193 290.259 84.5518 291.333 81.2738 291.333Z" fill="white"/>..<path d="M210.167 289.515H189.209L133.994 202.406C132.597 200.202 131.441 197.915 130.528 195.546H130.044C130.474 198.081 130.689 203.508 130.689 211.827V289.515H112.149V171H134.477L187.839 256.043C190.096 259.57 191.547 261.994 192.192 263.316H192.514C191.977 260.176 191.708 254.859 191.708 247.365V171H210.167V289.515Z" fill="white"/>..<path d="M300.449 289.515H235.561V171H297.87V187.695H254.746V221.249H294.485V237.861H254.746V

Chrome Cache Entry: 182

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (32029), with no line terminators
Category:	downloaded
Size (bytes):	32029
Entropy (8bit):	4.903574747591743
Encrypted:	false
SSDEEP:	384:FnvJOb4OLIch+KCnMet7NPXlJl+HjZjBTRdE0zIwHdZjV8din4ELi:5hOEO8chkMet7pCjBfnWOLi
MD5:	178A496645B67ABCE799D62DB8095CAB
SHA1:	0C264AFE3DB13E5B00A0E497FB6AB8556EB97939
SHA-256:	70A34968E8715CF14074EA089B66896A9BC10AF79352DB8A40DA83467891F92D
SHA-512:	EF7CDA8F433A47BABCBB74A57C3B4A20251A6D52E5C9CBEC33B5889A110760719180776BD9C7D7964CF140F950CAB8BC2AD08EAB5FA650FE7744FD9242C67E23
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/toc.json
Preview:	{"items":[{"href":"./","toc_title":".NET Framework documentation"},{"href":"get-started/overview","toc_title":"Overview of .NET Framework"},{"children":[{"href":"get-started/","toc_title":"Overview"},{"href":"get-started/out-of-band-releases","toc_title":"Out-of-band releases"},{"href":"get-started/system-requirements","toc_title":"System requirements"}],"toc_title":"Get started"},{"children":[{"href":"install/","toc_title":"Overview"},{"href":"install/guide-for-developers","toc_title":"For developers"},{"children":[{"href":"install/on-windows-11","toc_title":"Windows 11"},{"href":"install/on-windows-10","toc_title":"Windows 10 and Windows Server 2016"},{"href":"install/on-windows-8-1","toc_title":"Windows 8.1 and Windows Server 2012 R2"},{"href":"install/on-windows-8","toc_title":"Windows 8 and Windows Server 2012"},{"href":"install/on-server-2022","toc_title":"Windows Server 2022"},{"href":"install/on-server-2019","toc_title":"Windows Server 2019"}],"toc_title":"By OS version"},{"hre

Chrome Cache Entry: 183

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with CRLF line terminators
Category:	downloaded
Size (bytes):	1478
Entropy (8bit):	5.030941252322257
Encrypted:	false
SSDEEP:	24:TGAg3Efef6tfTf/fffCfxfdffW4N5f0f8fK8zyRWmmkYRWDKslbzP3LTPv4NUhqI:TK0W6bXnq512ysUbkfKCvUjeGxbu
MD5:	020629EBA820F2E09D8CDA1A753C032B
SHA1:	D91A65036E4C36B07AE3641E32F23F8DD616BD17
SHA-256:	F8AE8A1DC7CE7877B9FB9299183D2EBB3BEFAD0B6489AE785D99047EC2EB92D1
SHA-512:	EF5A5C7A301DE55D103B1BE375D988970D9C4ECD62CE464F730C49E622128F431761D641E1DFAA32CA03F8280B435AE909486806DF62A538B48337725EB63CE1
Malicious:	false
URL:	https://learn.microsoft.com/static/assets/0.4.027605576/global/deprecation.js
Preview:	// ES5 script for back compat with unsupported browsers...!(function () {...'use strict';...// Keep in sync with environment/browser.ts...var supportedBrowser =....typeof Blob === 'function' &&....typeof PerformanceObserver === 'function' &&....typeof Intl === 'object' &&....typeof MutationObserver === 'function' &&....typeof URLSearchParams === 'function' &&....typeof WebSocket === 'function' &&....typeof IntersectionObserver === 'function' &&....typeof queueMicrotask === 'function' &&....typeof TextEncoder === 'function' &&....typeof TextDecoder === 'function' &&....typeof customElements === 'object' &&....typeof HTMLDetailsElement === 'function' &&....typeof AbortController === 'function' &&....typeof AbortSignal === 'function' &&....'entries' in FormData.prototype &&....'toggleAttribute' in Element.prototype &&....'replaceChildren' in Element.prototype &&....// ES2019....'fromEntries' in Object &&....'flatMap' in Array.prototype &&....'trimEnd' in String.prototype &&....// ES2020..

Chrome Cache Entry: 184

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 475 x 212, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	35005
Entropy (8bit):	7.980061050467981
Encrypted:	false
SSDEEP:	768:aHBEr/QXnbCgWotMq4AZZivq2/Qu0cEv1FjHBep6U0Z/68R:ahWqbTWiM7ACvdIdldhep4rR
MD5:	522037F008E03C9448AE0AAAF09E93CB
SHA1:	8A32997EAB79246BEED5A37DB0C92FBFB006BEF2
SHA-256:	983C35607C4FB0B529CA732BE42115D3FCAAC947CEE9C9632F7CACDBDECAF5A7
SHA-512:	643EC613B2E7BDBB2F61E1799C189B0E3392EA5AE10845EB0B1F1542A03569E886F4B54D5B38AF10E78DB49C71357108C94589474B181F6A4573B86CF2D6F0D8
Malicious:	false
Preview:	.PNG........IHDR..............[.U....sRGB.........gAMA......a.....pHYs..........+.....RIDATx^..`........B hpwww(PJ....R.B.....K[j....@ H ..r:...].P._.`...K.ffg.v.ygf.TM.4.m...`.D".H$......"##..2e.X.t..Y".H$...d..PK.V".H$..uVm.,.H$.....b+.H$.I-#.V".H$.ZF..D".H$...[.D".Hj.)...D"..2Rl%..D".e..J$..DR.H..H$.....b+.H$..9..Neee.X,.B.\/.....o.b+.H$..9...q...EHU....p.....=z....b.7.q..........N.. ....cUAX.9...m'_...2.`.g{...4.H.9.p.4...K ^.....`.\|.n..]..m..`W..W.H.~..\|.^.a..K.6......_....K..w....9......^.....&...R....[...w..Ix=.:..^/..Epp0.5.....QRR...l....S.b.5.c.6...5..8.\....z...I......&.>....../.{.=...]'c......[.E`@Cg......Z.....c.f..,.y\|,.{.o@.j..2..:.&l4.{.]Ll.N.0..b:b...g.n.........I...Ewc....[..,i`v......F...il\|.c,{.-.....%BP.U........y.x....6..E2..n.W...J .*..`..r....F....#BCC......\|.L&........O...'........\.....;...q.n$...7...ga..x....)..A...0.{1..'1../...+yRC...W.-..b..c0dDG...U[po....2eG.G.../.@........h.:.k?.......Q...

Chrome Cache Entry: 185

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 658 x 480, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	13842
Entropy (8bit):	7.802399161550213
Encrypted:	false
SSDEEP:	192:NLNf+jBQsDHg7av3EEondO8PuRu2mIYXEIiDm42NpsHFMHfgnJ4K2DVwv:NLt+1jDmY+ndXwjLUpiDwpzfwoDVk
MD5:	F6EC97C43480D41695065AD55A97B382
SHA1:	D9C3D0895A5ED1A3951B8774B519B8217F0A54C5
SHA-256:	07A599FAB1E66BABC430E5FED3029F25FF3F4EA2DD0EC8968FFBA71EF1872F68
SHA-512:	22462763178409D60609761A2AF734F97B35B9A818EC1FD9046AFAB489AAD83CE34896EE8586EFE402EA7739ECF088BC2DB5C1C8E4FB39E6A0FC5B3ADC6B4A9B
Malicious:	false
Preview:	.PNG........IHDR................1....sRGB.........gAMA......a.....pHYs..........o.d..5.IDATx^..[.,.]...../<.!.B(/y..).F\r...!(.H..a ..B.~..A..KXA.M...6..8...!1....l./.X.1....2.`.y"l..R...V.....{...}._gWW.Z.VUw.N...U..P@..... ..@.A...".$..E.I.........$..("H..PD..... ..p....U.}.{.....l..A.....A........s.......D.0...@....E..x........L. /.".A.....$...Y."...%.I..["../.&.I..[`.0..IA.........p4.I.........$..("H..PD..... ..@.A...".$..E.I.........$..("H..PD..... ..@.A...".$..E.>H...O.................?.~.......].7.....a?....(H....m.G..G..a.P..?yo......f?...o. .B.....mo{[....:9<].....7.....a.....S..Cd.5,.R....#....>......._g.....Wo\|.....z.g.........w.T...]x.>.....y(.........6....[..px...U....~.~hu...}H.......~.L... ....r...iY.$..Id..Ax"../....._..U....OTo\|.Mh.km..A.k..k....n.C`\|._\=...o...a.e.. ...&.A2..k.. ....X.+...C..P....y..>.{._..(H....8(.?...w.}M.........:s_!.m.........BY..T..z.5{.W.~..6.....F....bq....m.....?.......v....o..o...ki...iX.$......\]V...V...

Chrome Cache Entry: 186

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	4897
Entropy (8bit):	4.794639101874543
Encrypted:	false
SSDEEP:	96:A0AIvEQ+KfZcbhaW9dp45qtAdflfDOFnymoLByzVqrpCvJ4QG63JjJ+do88HxbqP:dgQ+KfZcbhaWjp45qtAdflfDOFnNgBy4
MD5:	84E6C95F0E5378BDA94FA965C4692FAF
SHA1:	7C1D6572906509B08F8CD7B7A33EB9F9697EE6D1
SHA-256:	88A4A7B4F1160F8CAD3EB835116C29AC39659D586D4DADC54D9E40AC7E1BC610
SHA-512:	D34BFF37F8402B4A1FEE3C26F247A86D72666647A10E83D711A1BED1D24C6FC13674D65DCC037C22811B227FEC34B5DE20442191A42F9D78FC79D55FD5792761
Malicious:	false
Preview:	{"callToAction":{"primary":{"biName":"download-dotnet","href":"https://dotnet.microsoft.com/download","kind":"link","title":"Download .NET"}},"category":{"biName":"dotnet","href":"/dotnet/","kind":"link","title":".NET"},"items":[{"biName":"1-languages","items":[{"biName":"1-c-sharp","href":"/dotnet/csharp/","kind":"link","title":"C#"},{"biName":"2-f-sharp","href":"/dotnet/fsharp/","kind":"link","title":"F#"},{"biName":"3-visual-basic","href":"/dotnet/visual-basic/","kind":"link","title":"Visual Basic"}],"kind":"menu","title":"Languages"},{"biName":"2-features","items":[{"biName":"1-fundamental","href":"/dotnet/fundamentals/","kind":"link","title":"Fundamentals"},{"biName":"2-tools-and-diagnostics","href":"/dotnet/navigate/tools-diagnostics/","kind":"link","title":"Tools and diagnostics"},{"biName":"3-ai","items":[{"biName":"1-generative-ai","href":"/dotnet/ai/","kind":"link","title":"Generative AI"},{"biName":"2-mlnet","href":"/dotnet/machine-learning/","kind":"link","title":"ML.NET"}]

Chrome Cache Entry: 187

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (46884)
Category:	downloaded
Size (bytes):	1729946
Entropy (8bit):	5.506784610641439
Encrypted:	false
SSDEEP:	24576:BBweqomwDtVnoZlsG3QO/GFGVgTvjC10wCTOWIzE+0RlMVSB1DkCXWEea87ZGxnJ:BiwDbotVSB1DkCXWEe57ZGxnS+Vh2xDg
MD5:	95DE4EB9C18E800B4E68761D99845561
SHA1:	8CD61A75D8E9D5A1EB894284850AAB6C1E547D6D
SHA-256:	15163779156DA543DEFAAFC12F7C1A850C91411FE7495F03C3BFE0231D5057E3
SHA-512:	86BDE4F52A505FAC4BC49A30C0BDB145D88F568917E8EC89C26CFAA7E7DF85E9744291470E3587312196D93FB6BAA6F75B29D88CB722B7969C284C9A31886DBE
Malicious:	false
URL:	https://learn.microsoft.com/static/assets/0.4.027605576/scripts/en-us/index-docs.js
Preview:	"use strict";(()=>{var qge=Object.create;var Mx=Object.defineProperty;var OU=Object.getOwnPropertyDescriptor;var Fge=Object.getOwnPropertyNames;var Uge=Object.getPrototypeOf,Oge=Object.prototype.hasOwnProperty;var Hge=(e,t,n)=>t in e?Mx(e,t,{enumerable:!0,configurable:!0,writable:!0,value:n}):e[t]=n;var Ie=(e,t)=>()=>(t\|\|e((t={exports:{}}).exports,t),t.exports);var Bge=(e,t,n,o)=>{if(t&&typeof t=="object"\|\|typeof t=="function")for(let r of Fge(t))!Oge.call(e,r)&&r!==n&&Mx(e,r,{get:()=>t[r],enumerable:!(o=OU(t,r))\|\|o.enumerable});return e};var Rd=(e,t,n)=>(n=e!=null?qge(Uge(e)):{},Bge(t\|\|!e\|\|!e.__esModule?Mx(n,"default",{value:e,enumerable:!0}):n,e));var U=(e,t,n,o)=>{for(var r=o>1?void 0:o?OU(t,n):t,s=e.length-1,i;s>=0;s--)(i=e[s])&&(r=(o?i(t,n,r):i(r))\|\|r);return o&&r&&Mx(t,n,r),r};var Ni=(e,t,n)=>(Hge(e,typeof t!="symbol"?t+"":t,n),n),lL=(e,t,n)=>{if(!t.has(e))throw TypeError("Cannot "+n)};var xt=(e,t,n)=>(lL(e,t,"read from private field"),n?n.call(e):t.get(e)),On=(e,t,n)=>{if(t.has(

Chrome Cache Entry: 188

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	3130
Entropy (8bit):	4.790069981348324
Encrypted:	false
SSDEEP:	48:YWuGl640ynAqgDJ9OJWuO6Z3Db8VgK/ni47ttbtlSlA37ERw7II77Aj5M1:Nv0ynAhD3CO5t5lNEYIOEjc
MD5:	EBA6E81304F2F555E1D2EA3126A18A41
SHA1:	61429C3FE837FD4DD68E7B26678F131F2E00070D
SHA-256:	F309CCCE17B2B4706E7110F6C76F81761F0A44168D12C358AC4D120776907F81
SHA-512:	3BE0466794E7BDDC8565758DBF5553E89ED0003271F07695F09283F242BB65C1978ED79A38D5E589A99F68C0130E1E4B52576D7CD655EE272EE104BE0378E72E
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/breadcrumb/toc.json
Preview:	{"items":[{"children":[{"children":[{"homepage":"/dotnet/api/index","href":"/dotnet/api/","toc_title":"API browser"},{"homepage":"/dotnet/csharp/index","href":"/dotnet/csharp/","toc_title":"C#"},{"homepage":"/dotnet/fsharp/index","href":"/dotnet/fsharp/","toc_title":"F#"},{"homepage":"/dotnet/visual-basic/index","href":"/dotnet/visual-basic/","toc_title":"Visual Basic"},{"homepage":"/dotnet/ai/index","href":"/dotnet/ai/","toc_title":"AI"},{"homepage":"/dotnet/azure/index","href":"/dotnet/azure/","toc_title":"Azure"},{"homepage":"/dotnet/aspire/index","href":"/dotnet/aspire/","toc_title":".NET Aspire"},{"homepage":"/dotnet/orleans/index","href":"/dotnet/orleans/","toc_title":"Orleans"},{"children":[{"homepage":"/dotnet/framework/unmanaged-api/","href":"/dotnet/framework/unmanaged-api/","toc_title":"Unmanaged API reference"}],"homepage":"/dotnet/framework/index","href":"/dotnet/framework/","toc_title":".NET Framework"},{"children":[{"homepage":"/dotnet/architecture/modern-web-apps-azure/

Chrome Cache Entry: 189

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 533 x 478, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	18367
Entropy (8bit):	7.7772261735974215
Encrypted:	false
SSDEEP:	384:4qqZYz7CAda2Qmd6VWWNg9h8XvdkRbdi2nki:1qZYz7Cma2hYNMh8XvdObdi2nX
MD5:	240C4CC15D9FD65405BB642AB81BE615
SHA1:	5A66783FE5DD932082F40811AE0769526874BFD3
SHA-256:	030272CE6BA1BECA700EC83FDED9DBDC89296FBDE0633A7F5943EF5831876C07
SHA-512:	267FE31BC25944DD7B6071C2C2C271CCC188AE1F6A0D7E587DCF9198B81598DA6B058D1B413F228DF0CB37C8304329E808089388359651E81B5F3DEC566D0EE0
Malicious:	false
Preview:	.PNG........IHDR.............,#......sRGB.........gAMA......a.....pHYs..........o.d..GTIDATx^._.}.U.7..BkB.......!E......b.Ej.K...Z...iK.$..h..B`..T.?5.7.I..16$.E.......c...c...Q_V.k...k..g.y.9..G.g..g.9.Z{..Z{.nv....@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...<@v.].../.1R'm.....x..h.....]a1U7........s.......x.h.q.A! ....8IL\GP..............M...W.............D.....dJ<.+,.........W...pgAT...@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...@......P.;/..G....O~..O~...'?......h.....}.y..4/....S..........Y......?..?.g7...G...............x{..w..y.~.9.~.y....y.#.c....<.E.............^..7G.._.u.nv/..f........5.....5?.;...w.....i~.?\|..H+Dd.....Y%....r~.$Q...7.v..._hv..r.O_.4..7M.6....o..=..?....3....?.....xE...O..7....^......D.W....m...6........O..Ob.4.9J........6.;..>.,.....o.l..>%J.V......%k..0.bQqIA..O..y.{.....7.......4_..Za...4.o.....h..........k...M...i....G.4...h.L.#...&.'%...~j..W.*Kx......o.%s.m

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	6.149551414799612
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 50.01% Win32 Executable (generic) a (10002005/4) 49.97% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	7F95320763FDCB0F731CE91FB8E178D4110E10A1D56836F442BA34C6F2A631F6.exe
File size:	53'760 bytes
MD5:	1a4ac0f78511c028b51e0b302b080946
SHA1:	cf5d9e076aabb18759dfeabf59f4328f3fe30088
SHA256:	d59c7ccf805724c5a8704e0ed9e457bfe33b61e150d646c1da2703e30c22da9e
SHA512:	c38e8742bdfc93aa4b6ffc4789e4e1b844c276bc61eff07729df70781d30ad9f2aab2b2d0290235d828bc556be996f53ded0441440c93b1249abc6e03c855bbf
SSDEEP:	768:PKXTZ38f7CTv8FwKrM+rMRa8NujBtUmQGPL4vzZq2o9W7GsxBbPr:PiTZsTCTv8u1+gRJNA49GCq2iW7z
TLSH:	F6336D8D7FE084ACC4FD157B05B2E4130777E05B5E23D91E8EF294AA36636818F54AE1
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....:b................................. ........@.. .......................@............@................................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x40e000
Entrypoint Section:	u
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x623ADEC4 [Wed Mar 23 08:48:04 2022 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
sub esp, 0000016Ch
xor eax, eax
push ebx
push esi
push edi
mov dword ptr [ebp-24h], eax
mov dword ptr [ebp-10h], eax
mov dword ptr [ebp-14h], eax
mov dword ptr [ebp-08h], eax
mov dword ptr [ebp-0Ch], eax
mov dword ptr [ebp-20h], eax
mov dword ptr [ebp-18h], eax
mov dword ptr [ebp-48h], 4F445374h
mov dword ptr [ebp-44h], 6578652Eh
mov dword ptr [ebp-40h], 00000000h
mov dword ptr [ebp-3Ch], 00000000h
call 00007FF850938A65h
pop eax
add eax, 00000225h
mov dword ptr [ebp-04h], eax
mov eax, dword ptr fs:[00000030h]
mov dword ptr [ebp-28h], eax
mov eax, dword ptr [ebp-04h]
mov dword ptr [eax], E904C483h
mov eax, dword ptr [ebp-04h]
mov dword ptr [eax+04h], FFFFC94Dh
mov eax, dword ptr [ebp-28h]
mov eax, dword ptr [eax+0Ch]
mov eax, dword ptr [eax+1Ch]
mov eax, dword ptr [eax]
mov eax, dword ptr [eax+08h]
mov ecx, dword ptr [eax+3Ch]
mov ecx, dword ptr [ecx+eax+78h]
add ecx, eax
mov edi, dword ptr [ecx+1Ch]
mov ebx, dword ptr [ecx+20h]
mov esi, dword ptr [ecx+24h]
mov ecx, dword ptr [ecx+18h]
add esi, eax
add edi, eax
add ebx, eax
xor edx, edx
mov dword ptr [ebp-30h], esi
mov dword ptr [ebp-1Ch], edx
mov dword ptr [ebp-34h], ecx
cmp edx, dword ptr [ebp-34h]
jnc 00007FF850938BAEh
movzx ecx, word ptr [esi+edx*2]
mov edx, dword ptr [ebx+edx*4]
mov esi, dword ptr [edi+ecx*4]
add edx, eax
mov ecx, dword ptr [edx]
add esi, eax
cmp ecx, 4D746547h
jne 00007FF850938AB4h
cmp dword ptr [edx+04h], 6C75646Fh
jne 00007FF850938AABh

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xab6c	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xc000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x8bc4	0x8c00	0d11b688183f010f66c54d2fe3761477	False	0.463671875	data	5.6066747364381095	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.reloc	0xc000	0xc	0x200	163d66697186c0743c0da6f82247a39a	False	0.044921875	data	0.08153941234324169	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
u	0xe000	0x6000	0x4200	564045a36507f78af300dae49ffbca5a	False	0.77734375	data	6.933656811505602	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
mscoree.dll	_CorExeMain

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 24, 2024 18:52:58.523701906 CEST	49675	443	192.168.2.5	23.1.237.91
Jul 24, 2024 18:52:58.523690939 CEST	49674	443	192.168.2.5	23.1.237.91
Jul 24, 2024 18:52:58.679857016 CEST	49673	443	192.168.2.5	23.1.237.91
Jul 24, 2024 18:53:08.126465082 CEST	49675	443	192.168.2.5	23.1.237.91
Jul 24, 2024 18:53:08.133759022 CEST	49674	443	192.168.2.5	23.1.237.91
Jul 24, 2024 18:53:08.288155079 CEST	49673	443	192.168.2.5	23.1.237.91
Jul 24, 2024 18:53:10.031723976 CEST	49717	443	192.168.2.5	13.107.246.42
Jul 24, 2024 18:53:10.031761885 CEST	443	49717	13.107.246.42	192.168.2.5
Jul 24, 2024 18:53:10.032032013 CEST	49717	443	192.168.2.5	13.107.246.42
Jul 24, 2024 18:53:10.032150984 CEST	49718	443	192.168.2.5	13.107.246.42
Jul 24, 2024 18:53:10.032159090 CEST	443	49718	13.107.246.42	192.168.2.5
Jul 24, 2024 18:53:10.032221079 CEST	49718	443	192.168.2.5	13.107.246.42
Jul 24, 2024 18:53:10.032639980 CEST	49717	443	192.168.2.5	13.107.246.42
Jul 24, 2024 18:53:10.032656908 CEST	443	49717	13.107.246.42	192.168.2.5
Jul 24, 2024 18:53:10.032970905 CEST	49718	443	192.168.2.5	13.107.246.42
Jul 24, 2024 18:53:10.032988071 CEST	443	49718	13.107.246.42	192.168.2.5
Jul 24, 2024 18:53:10.420368910 CEST	443	49703	23.1.237.91	192.168.2.5
Jul 24, 2024 18:53:10.420485973 CEST	49703	443	192.168.2.5	23.1.237.91
Jul 24, 2024 18:53:10.422282934 CEST	443	49703	23.1.237.91	192.168.2.5
Jul 24, 2024 18:53:10.422334909 CEST	49703	443	192.168.2.5	23.1.237.91
Jul 24, 2024 18:53:10.694550037 CEST	443	49718	13.107.246.42	192.168.2.5
Jul 24, 2024 18:53:10.694906950 CEST	49718	443	192.168.2.5	13.107.246.42
Jul 24, 2024 18:53:10.694932938 CEST	443	49718	13.107.246.42	192.168.2.5
Jul 24, 2024 18:53:10.695858002 CEST	443	49718	13.107.246.42	192.168.2.5
Jul 24, 2024 18:53:10.695935965 CEST	49718	443	192.168.2.5	13.107.246.42
Jul 24, 2024 18:53:10.697036982 CEST	49718	443	192.168.2.5	13.107.246.42
Jul 24, 2024 18:53:10.697092056 CEST	443	49718	13.107.246.42	192.168.2.5
Jul 24, 2024 18:53:10.697302103 CEST	49718	443	192.168.2.5	13.107.246.42
Jul 24, 2024 18:53:10.697309017 CEST	443	49718	13.107.246.42	192.168.2.5
Jul 24, 2024 18:53:10.753691912 CEST	443	49717	13.107.246.42	192.168.2.5
Jul 24, 2024 18:53:10.754487038 CEST	49717	443	192.168.2.5	13.107.246.42
Jul 24, 2024 18:53:10.754503965 CEST	443	49717	13.107.246.42	192.168.2.5
Jul 24, 2024 18:53:10.755552053 CEST	443	49717	13.107.246.42	192.168.2.5
Jul 24, 2024 18:53:10.755616903 CEST	49717	443	192.168.2.5	13.107.246.42
Jul 24, 2024 18:53:10.757770061 CEST	49717	443	192.168.2.5	13.107.246.42
Jul 24, 2024 18:53:10.757889032 CEST	443	49717	13.107.246.42	192.168.2.5
Jul 24, 2024 18:53:10.757983923 CEST	49717	443	192.168.2.5	13.107.246.42
Jul 24, 2024 18:53:10.757992029 CEST	443	49717	13.107.246.42	192.168.2.5
Jul 24, 2024 18:53:10.769747019 CEST	49718	443	192.168.2.5	13.107.246.42
Jul 24, 2024 18:53:10.820749044 CEST	443	49718	13.107.246.42	192.168.2.5
Jul 24, 2024 18:53:10.820772886 CEST	443	49718	13.107.246.42	192.168.2.5
Jul 24, 2024 18:53:10.820784092 CEST	443	49718	13.107.246.42	192.168.2.5
Jul 24, 2024 18:53:10.820801020 CEST	443	49718	13.107.246.42	192.168.2.5
Jul 24, 2024 18:53:10.820808887 CEST	443	49718	13.107.246.42	192.168.2.5
Jul 24, 2024 18:53:10.820816040 CEST	443	49718	13.107.246.42	192.168.2.5
Jul 24, 2024 18:53:10.820832968 CEST	49718	443	192.168.2.5	13.107.246.42
Jul 24, 2024 18:53:10.820863962 CEST	443	49718	13.107.246.42	192.168.2.5
Jul 24, 2024 18:53:10.820883036 CEST	49718	443	192.168.2.5	13.107.246.42
Jul 24, 2024 18:53:10.820915937 CEST	49718	443	192.168.2.5	13.107.246.42
Jul 24, 2024 18:53:10.883415937 CEST	443	49717	13.107.246.42	192.168.2.5
Jul 24, 2024 18:53:10.883471012 CEST	443	49717	13.107.246.42	192.168.2.5
Jul 24, 2024 18:53:10.883518934 CEST	49717	443	192.168.2.5	13.107.246.42
Jul 24, 2024 18:53:10.883537054 CEST	443	49717	13.107.246.42	192.168.2.5
Jul 24, 2024 18:53:10.883562088 CEST	49717	443	192.168.2.5	13.107.246.42
Jul 24, 2024 18:53:10.883568048 CEST	443	49717	13.107.246.42	192.168.2.5
Jul 24, 2024 18:53:10.883589983 CEST	49717	443	192.168.2.5	13.107.246.42
Jul 24, 2024 18:53:10.887698889 CEST	49719	443	192.168.2.5	142.250.185.132
Jul 24, 2024 18:53:10.887738943 CEST	443	49719	142.250.185.132	192.168.2.5
Jul 24, 2024 18:53:10.887809038 CEST	49719	443	192.168.2.5	142.250.185.132
Jul 24, 2024 18:53:10.888087988 CEST	49719	443	192.168.2.5	142.250.185.132
Jul 24, 2024 18:53:10.888098001 CEST	443	49719	142.250.185.132	192.168.2.5
Jul 24, 2024 18:53:10.897825956 CEST	443	49718	13.107.246.42	192.168.2.5
Jul 24, 2024 18:53:10.897893906 CEST	443	49718	13.107.246.42	192.168.2.5
Jul 24, 2024 18:53:10.897898912 CEST	49718	443	192.168.2.5	13.107.246.42
Jul 24, 2024 18:53:10.897906065 CEST	443	49718	13.107.246.42	192.168.2.5
Jul 24, 2024 18:53:10.897964001 CEST	49718	443	192.168.2.5	13.107.246.42
Jul 24, 2024 18:53:10.899844885 CEST	443	49718	13.107.246.42	192.168.2.5
Jul 24, 2024 18:53:10.908315897 CEST	443	49718	13.107.246.42	192.168.2.5
Jul 24, 2024 18:53:10.908338070 CEST	443	49718	13.107.246.42	192.168.2.5
Jul 24, 2024 18:53:10.908371925 CEST	49718	443	192.168.2.5	13.107.246.42
Jul 24, 2024 18:53:10.908381939 CEST	443	49718	13.107.246.42	192.168.2.5
Jul 24, 2024 18:53:10.908412933 CEST	49718	443	192.168.2.5	13.107.246.42
Jul 24, 2024 18:53:10.937200069 CEST	443	49718	13.107.246.42	192.168.2.5
Jul 24, 2024 18:53:10.937252045 CEST	49718	443	192.168.2.5	13.107.246.42
Jul 24, 2024 18:53:10.937262058 CEST	443	49718	13.107.246.42	192.168.2.5
Jul 24, 2024 18:53:10.937308073 CEST	49718	443	192.168.2.5	13.107.246.42
Jul 24, 2024 18:53:10.937418938 CEST	443	49718	13.107.246.42	192.168.2.5
Jul 24, 2024 18:53:10.937465906 CEST	49718	443	192.168.2.5	13.107.246.42
Jul 24, 2024 18:53:10.937489033 CEST	49718	443	192.168.2.5	13.107.246.42
Jul 24, 2024 18:53:10.937505960 CEST	443	49718	13.107.246.42	192.168.2.5
Jul 24, 2024 18:53:10.974349976 CEST	443	49717	13.107.246.42	192.168.2.5
Jul 24, 2024 18:53:10.974386930 CEST	443	49717	13.107.246.42	192.168.2.5
Jul 24, 2024 18:53:10.974428892 CEST	49717	443	192.168.2.5	13.107.246.42
Jul 24, 2024 18:53:10.974448919 CEST	443	49717	13.107.246.42	192.168.2.5
Jul 24, 2024 18:53:10.974472046 CEST	443	49717	13.107.246.42	192.168.2.5
Jul 24, 2024 18:53:10.974478960 CEST	49717	443	192.168.2.5	13.107.246.42
Jul 24, 2024 18:53:10.974508047 CEST	49717	443	192.168.2.5	13.107.246.42
Jul 24, 2024 18:53:10.974510908 CEST	443	49717	13.107.246.42	192.168.2.5
Jul 24, 2024 18:53:10.974525928 CEST	49717	443	192.168.2.5	13.107.246.42
Jul 24, 2024 18:53:10.979643106 CEST	49721	443	192.168.2.5	13.107.246.60
Jul 24, 2024 18:53:10.979692936 CEST	443	49721	13.107.246.60	192.168.2.5
Jul 24, 2024 18:53:10.979767084 CEST	49721	443	192.168.2.5	13.107.246.60
Jul 24, 2024 18:53:10.980071068 CEST	49721	443	192.168.2.5	13.107.246.60
Jul 24, 2024 18:53:10.980086088 CEST	443	49721	13.107.246.60	192.168.2.5
Jul 24, 2024 18:53:10.982553005 CEST	443	49717	13.107.246.42	192.168.2.5
Jul 24, 2024 18:53:10.982575893 CEST	443	49717	13.107.246.42	192.168.2.5
Jul 24, 2024 18:53:10.982616901 CEST	443	49717	13.107.246.42	192.168.2.5
Jul 24, 2024 18:53:10.982619047 CEST	49717	443	192.168.2.5	13.107.246.42
Jul 24, 2024 18:53:10.982636929 CEST	443	49717	13.107.246.42	192.168.2.5
Jul 24, 2024 18:53:10.982661963 CEST	49717	443	192.168.2.5	13.107.246.42
Jul 24, 2024 18:53:10.982669115 CEST	443	49717	13.107.246.42	192.168.2.5
Jul 24, 2024 18:53:10.982685089 CEST	49717	443	192.168.2.5	13.107.246.42
Jul 24, 2024 18:53:11.066543102 CEST	443	49717	13.107.246.42	192.168.2.5
Jul 24, 2024 18:53:11.066610098 CEST	443	49717	13.107.246.42	192.168.2.5
Jul 24, 2024 18:53:11.066629887 CEST	443	49717	13.107.246.42	192.168.2.5
Jul 24, 2024 18:53:11.066649914 CEST	443	49717	13.107.246.42	192.168.2.5
Jul 24, 2024 18:53:11.066651106 CEST	49717	443	192.168.2.5	13.107.246.42
Jul 24, 2024 18:53:11.066684961 CEST	443	49717	13.107.246.42	192.168.2.5
Jul 24, 2024 18:53:11.066685915 CEST	49717	443	192.168.2.5	13.107.246.42
Jul 24, 2024 18:53:11.066715002 CEST	49717	443	192.168.2.5	13.107.246.42
Jul 24, 2024 18:53:11.072711945 CEST	443	49717	13.107.246.42	192.168.2.5
Jul 24, 2024 18:53:11.072732925 CEST	443	49717	13.107.246.42	192.168.2.5
Jul 24, 2024 18:53:11.072772026 CEST	443	49717	13.107.246.42	192.168.2.5
Jul 24, 2024 18:53:11.072777987 CEST	49717	443	192.168.2.5	13.107.246.42
Jul 24, 2024 18:53:11.072791100 CEST	443	49717	13.107.246.42	192.168.2.5
Jul 24, 2024 18:53:11.072813988 CEST	49717	443	192.168.2.5	13.107.246.42
Jul 24, 2024 18:53:11.072823048 CEST	443	49717	13.107.246.42	192.168.2.5
Jul 24, 2024 18:53:11.072835922 CEST	49717	443	192.168.2.5	13.107.246.42
Jul 24, 2024 18:53:11.078295946 CEST	443	49717	13.107.246.42	192.168.2.5
Jul 24, 2024 18:53:11.078334093 CEST	443	49717	13.107.246.42	192.168.2.5
Jul 24, 2024 18:53:11.078360081 CEST	443	49717	13.107.246.42	192.168.2.5
Jul 24, 2024 18:53:11.078363895 CEST	49717	443	192.168.2.5	13.107.246.42
Jul 24, 2024 18:53:11.078392982 CEST	443	49717	13.107.246.42	192.168.2.5
Jul 24, 2024 18:53:11.078397036 CEST	49717	443	192.168.2.5	13.107.246.42
Jul 24, 2024 18:53:11.078404903 CEST	443	49717	13.107.246.42	192.168.2.5
Jul 24, 2024 18:53:11.078416109 CEST	49717	443	192.168.2.5	13.107.246.42
Jul 24, 2024 18:53:11.078447104 CEST	49717	443	192.168.2.5	13.107.246.42
Jul 24, 2024 18:53:11.159635067 CEST	443	49717	13.107.246.42	192.168.2.5
Jul 24, 2024 18:53:11.159682035 CEST	443	49717	13.107.246.42	192.168.2.5
Jul 24, 2024 18:53:11.159709930 CEST	49717	443	192.168.2.5	13.107.246.42
Jul 24, 2024 18:53:11.159723043 CEST	443	49717	13.107.246.42	192.168.2.5
Jul 24, 2024 18:53:11.159754038 CEST	49717	443	192.168.2.5	13.107.246.42
Jul 24, 2024 18:53:11.165004969 CEST	443	49717	13.107.246.42	192.168.2.5
Jul 24, 2024 18:53:11.165054083 CEST	443	49717	13.107.246.42	192.168.2.5
Jul 24, 2024 18:53:11.165071964 CEST	49717	443	192.168.2.5	13.107.246.42
Jul 24, 2024 18:53:11.165081978 CEST	443	49717	13.107.246.42	192.168.2.5
Jul 24, 2024 18:53:11.165117979 CEST	49717	443	192.168.2.5	13.107.246.42
Jul 24, 2024 18:53:11.169362068 CEST	443	49717	13.107.246.42	192.168.2.5
Jul 24, 2024 18:53:11.169401884 CEST	443	49717	13.107.246.42	192.168.2.5
Jul 24, 2024 18:53:11.169430971 CEST	49717	443	192.168.2.5	13.107.246.42
Jul 24, 2024 18:53:11.169440985 CEST	443	49717	13.107.246.42	192.168.2.5
Jul 24, 2024 18:53:11.169471979 CEST	49717	443	192.168.2.5	13.107.246.42
Jul 24, 2024 18:53:11.173224926 CEST	443	49717	13.107.246.42	192.168.2.5
Jul 24, 2024 18:53:11.173270941 CEST	443	49717	13.107.246.42	192.168.2.5
Jul 24, 2024 18:53:11.173286915 CEST	49717	443	192.168.2.5	13.107.246.42
Jul 24, 2024 18:53:11.173295975 CEST	443	49717	13.107.246.42	192.168.2.5
Jul 24, 2024 18:53:11.173343897 CEST	49717	443	192.168.2.5	13.107.246.42
Jul 24, 2024 18:53:11.177273989 CEST	443	49717	13.107.246.42	192.168.2.5
Jul 24, 2024 18:53:11.177314043 CEST	443	49717	13.107.246.42	192.168.2.5
Jul 24, 2024 18:53:11.177347898 CEST	49717	443	192.168.2.5	13.107.246.42
Jul 24, 2024 18:53:11.177356005 CEST	443	49717	13.107.246.42	192.168.2.5
Jul 24, 2024 18:53:11.177386999 CEST	49717	443	192.168.2.5	13.107.246.42
Jul 24, 2024 18:53:11.180730104 CEST	443	49717	13.107.246.42	192.168.2.5
Jul 24, 2024 18:53:11.180775881 CEST	443	49717	13.107.246.42	192.168.2.5
Jul 24, 2024 18:53:11.180797100 CEST	49717	443	192.168.2.5	13.107.246.42
Jul 24, 2024 18:53:11.180804968 CEST	443	49717	13.107.246.42	192.168.2.5
Jul 24, 2024 18:53:11.180840015 CEST	49717	443	192.168.2.5	13.107.246.42
Jul 24, 2024 18:53:11.183026075 CEST	443	49717	13.107.246.42	192.168.2.5
Jul 24, 2024 18:53:11.183079004 CEST	443	49717	13.107.246.42	192.168.2.5
Jul 24, 2024 18:53:11.183094978 CEST	49717	443	192.168.2.5	13.107.246.42
Jul 24, 2024 18:53:11.183103085 CEST	443	49717	13.107.246.42	192.168.2.5
Jul 24, 2024 18:53:11.183134079 CEST	49717	443	192.168.2.5	13.107.246.42
Jul 24, 2024 18:53:11.183208942 CEST	443	49717	13.107.246.42	192.168.2.5
Jul 24, 2024 18:53:11.183262110 CEST	49717	443	192.168.2.5	13.107.246.42
Jul 24, 2024 18:53:11.183465004 CEST	49717	443	192.168.2.5	13.107.246.42
Jul 24, 2024 18:53:11.183480978 CEST	443	49717	13.107.246.42	192.168.2.5
Jul 24, 2024 18:53:11.372353077 CEST	49725	443	192.168.2.5	13.107.246.60
Jul 24, 2024 18:53:11.372400999 CEST	443	49725	13.107.246.60	192.168.2.5
Jul 24, 2024 18:53:11.372644901 CEST	49725	443	192.168.2.5	13.107.246.60
Jul 24, 2024 18:53:11.372920990 CEST	49725	443	192.168.2.5	13.107.246.60
Jul 24, 2024 18:53:11.372941017 CEST	443	49725	13.107.246.60	192.168.2.5
Jul 24, 2024 18:53:11.576864004 CEST	443	49719	142.250.185.132	192.168.2.5
Jul 24, 2024 18:53:11.577115059 CEST	49719	443	192.168.2.5	142.250.185.132
Jul 24, 2024 18:53:11.577155113 CEST	443	49719	142.250.185.132	192.168.2.5
Jul 24, 2024 18:53:11.578597069 CEST	443	49719	142.250.185.132	192.168.2.5
Jul 24, 2024 18:53:11.578659058 CEST	49719	443	192.168.2.5	142.250.185.132
Jul 24, 2024 18:53:11.625484943 CEST	49719	443	192.168.2.5	142.250.185.132
Jul 24, 2024 18:53:11.625727892 CEST	443	49719	142.250.185.132	192.168.2.5
Jul 24, 2024 18:53:11.666373014 CEST	443	49721	13.107.246.60	192.168.2.5
Jul 24, 2024 18:53:11.770498991 CEST	49719	443	192.168.2.5	142.250.185.132
Jul 24, 2024 18:53:11.770509958 CEST	49721	443	192.168.2.5	13.107.246.60
Jul 24, 2024 18:53:11.770534039 CEST	443	49719	142.250.185.132	192.168.2.5
Jul 24, 2024 18:53:11.805725098 CEST	49721	443	192.168.2.5	13.107.246.60
Jul 24, 2024 18:53:11.805757046 CEST	443	49721	13.107.246.60	192.168.2.5
Jul 24, 2024 18:53:11.809039116 CEST	443	49721	13.107.246.60	192.168.2.5
Jul 24, 2024 18:53:11.809056044 CEST	443	49721	13.107.246.60	192.168.2.5
Jul 24, 2024 18:53:11.809102058 CEST	49721	443	192.168.2.5	13.107.246.60
Jul 24, 2024 18:53:11.814985037 CEST	49721	443	192.168.2.5	13.107.246.60
Jul 24, 2024 18:53:11.815083027 CEST	443	49721	13.107.246.60	192.168.2.5
Jul 24, 2024 18:53:11.815541029 CEST	49721	443	192.168.2.5	13.107.246.60
Jul 24, 2024 18:53:11.815560102 CEST	443	49721	13.107.246.60	192.168.2.5
Jul 24, 2024 18:53:11.931448936 CEST	443	49721	13.107.246.60	192.168.2.5
Jul 24, 2024 18:53:11.931479931 CEST	443	49721	13.107.246.60	192.168.2.5
Jul 24, 2024 18:53:11.931499004 CEST	443	49721	13.107.246.60	192.168.2.5
Jul 24, 2024 18:53:11.931538105 CEST	443	49721	13.107.246.60	192.168.2.5
Jul 24, 2024 18:53:11.931560040 CEST	443	49721	13.107.246.60	192.168.2.5
Jul 24, 2024 18:53:11.931576014 CEST	49721	443	192.168.2.5	13.107.246.60
Jul 24, 2024 18:53:11.931632996 CEST	443	49721	13.107.246.60	192.168.2.5
Jul 24, 2024 18:53:11.931674957 CEST	49721	443	192.168.2.5	13.107.246.60
Jul 24, 2024 18:53:11.931674957 CEST	443	49721	13.107.246.60	192.168.2.5
Jul 24, 2024 18:53:11.931674957 CEST	49721	443	192.168.2.5	13.107.246.60
Jul 24, 2024 18:53:11.931704044 CEST	49721	443	192.168.2.5	13.107.246.60
Jul 24, 2024 18:53:11.959450006 CEST	49719	443	192.168.2.5	142.250.185.132
Jul 24, 2024 18:53:12.020756960 CEST	443	49721	13.107.246.60	192.168.2.5
Jul 24, 2024 18:53:12.020792961 CEST	443	49721	13.107.246.60	192.168.2.5
Jul 24, 2024 18:53:12.020814896 CEST	443	49721	13.107.246.60	192.168.2.5
Jul 24, 2024 18:53:12.020869970 CEST	443	49721	13.107.246.60	192.168.2.5
Jul 24, 2024 18:53:12.020875931 CEST	49721	443	192.168.2.5	13.107.246.60
Jul 24, 2024 18:53:12.020904064 CEST	443	49721	13.107.246.60	192.168.2.5
Jul 24, 2024 18:53:12.020930052 CEST	443	49721	13.107.246.60	192.168.2.5
Jul 24, 2024 18:53:12.020967007 CEST	49721	443	192.168.2.5	13.107.246.60
Jul 24, 2024 18:53:12.020967007 CEST	49721	443	192.168.2.5	13.107.246.60
Jul 24, 2024 18:53:12.020971060 CEST	443	49721	13.107.246.60	192.168.2.5
Jul 24, 2024 18:53:12.021001101 CEST	49721	443	192.168.2.5	13.107.246.60
Jul 24, 2024 18:53:12.021001101 CEST	49721	443	192.168.2.5	13.107.246.60
Jul 24, 2024 18:53:12.023262978 CEST	443	49721	13.107.246.60	192.168.2.5
Jul 24, 2024 18:53:12.023283958 CEST	443	49721	13.107.246.60	192.168.2.5
Jul 24, 2024 18:53:12.023304939 CEST	443	49721	13.107.246.60	192.168.2.5
Jul 24, 2024 18:53:12.023336887 CEST	49721	443	192.168.2.5	13.107.246.60
Jul 24, 2024 18:53:12.023345947 CEST	443	49721	13.107.246.60	192.168.2.5
Jul 24, 2024 18:53:12.023377895 CEST	49721	443	192.168.2.5	13.107.246.60
Jul 24, 2024 18:53:12.023379087 CEST	443	49721	13.107.246.60	192.168.2.5
Jul 24, 2024 18:53:12.023394108 CEST	443	49721	13.107.246.60	192.168.2.5
Jul 24, 2024 18:53:12.023423910 CEST	49721	443	192.168.2.5	13.107.246.60
Jul 24, 2024 18:53:12.023425102 CEST	443	49721	13.107.246.60	192.168.2.5
Jul 24, 2024 18:53:12.023459911 CEST	49721	443	192.168.2.5	13.107.246.60
Jul 24, 2024 18:53:12.024152994 CEST	443	49721	13.107.246.60	192.168.2.5
Jul 24, 2024 18:53:12.024220943 CEST	49721	443	192.168.2.5	13.107.246.60
Jul 24, 2024 18:53:12.024235964 CEST	443	49721	13.107.246.60	192.168.2.5
Jul 24, 2024 18:53:12.024291039 CEST	49721	443	192.168.2.5	13.107.246.60
Jul 24, 2024 18:53:12.024312019 CEST	443	49721	13.107.246.60	192.168.2.5
Jul 24, 2024 18:53:12.024379015 CEST	49721	443	192.168.2.5	13.107.246.60
Jul 24, 2024 18:53:12.024524927 CEST	49721	443	192.168.2.5	13.107.246.60
Jul 24, 2024 18:53:12.024554014 CEST	443	49721	13.107.246.60	192.168.2.5
Jul 24, 2024 18:53:12.082865953 CEST	443	49725	13.107.246.60	192.168.2.5
Jul 24, 2024 18:53:12.083255053 CEST	49725	443	192.168.2.5	13.107.246.60
Jul 24, 2024 18:53:12.083331108 CEST	443	49725	13.107.246.60	192.168.2.5
Jul 24, 2024 18:53:12.085436106 CEST	49726	443	192.168.2.5	184.28.90.27
Jul 24, 2024 18:53:12.085470915 CEST	443	49726	184.28.90.27	192.168.2.5
Jul 24, 2024 18:53:12.085602999 CEST	49726	443	192.168.2.5	184.28.90.27
Jul 24, 2024 18:53:12.086895943 CEST	443	49725	13.107.246.60	192.168.2.5
Jul 24, 2024 18:53:12.086973906 CEST	49725	443	192.168.2.5	13.107.246.60
Jul 24, 2024 18:53:12.087304115 CEST	49725	443	192.168.2.5	13.107.246.60
Jul 24, 2024 18:53:12.087374926 CEST	443	49725	13.107.246.60	192.168.2.5
Jul 24, 2024 18:53:12.087435007 CEST	49725	443	192.168.2.5	13.107.246.60
Jul 24, 2024 18:53:12.087461948 CEST	443	49725	13.107.246.60	192.168.2.5
Jul 24, 2024 18:53:12.088026047 CEST	49726	443	192.168.2.5	184.28.90.27
Jul 24, 2024 18:53:12.088037968 CEST	443	49726	184.28.90.27	192.168.2.5
Jul 24, 2024 18:53:12.205929995 CEST	443	49725	13.107.246.60	192.168.2.5
Jul 24, 2024 18:53:12.205985069 CEST	443	49725	13.107.246.60	192.168.2.5
Jul 24, 2024 18:53:12.206028938 CEST	49725	443	192.168.2.5	13.107.246.60
Jul 24, 2024 18:53:12.206070900 CEST	443	49725	13.107.246.60	192.168.2.5
Jul 24, 2024 18:53:12.206088066 CEST	49725	443	192.168.2.5	13.107.246.60
Jul 24, 2024 18:53:12.206095934 CEST	443	49725	13.107.246.60	192.168.2.5
Jul 24, 2024 18:53:12.206119061 CEST	49725	443	192.168.2.5	13.107.246.60
Jul 24, 2024 18:53:12.294306040 CEST	443	49725	13.107.246.60	192.168.2.5
Jul 24, 2024 18:53:12.294342041 CEST	443	49725	13.107.246.60	192.168.2.5
Jul 24, 2024 18:53:12.294399023 CEST	443	49725	13.107.246.60	192.168.2.5
Jul 24, 2024 18:53:12.294416904 CEST	443	49725	13.107.246.60	192.168.2.5
Jul 24, 2024 18:53:12.294431925 CEST	49725	443	192.168.2.5	13.107.246.60
Jul 24, 2024 18:53:12.294522047 CEST	443	49725	13.107.246.60	192.168.2.5
Jul 24, 2024 18:53:12.294569969 CEST	49725	443	192.168.2.5	13.107.246.60
Jul 24, 2024 18:53:12.294569969 CEST	49725	443	192.168.2.5	13.107.246.60
Jul 24, 2024 18:53:12.297326088 CEST	443	49725	13.107.246.60	192.168.2.5
Jul 24, 2024 18:53:12.297348976 CEST	443	49725	13.107.246.60	192.168.2.5
Jul 24, 2024 18:53:12.297390938 CEST	49725	443	192.168.2.5	13.107.246.60
Jul 24, 2024 18:53:12.297395945 CEST	443	49725	13.107.246.60	192.168.2.5
Jul 24, 2024 18:53:12.297415972 CEST	443	49725	13.107.246.60	192.168.2.5
Jul 24, 2024 18:53:12.297422886 CEST	49725	443	192.168.2.5	13.107.246.60
Jul 24, 2024 18:53:12.297435045 CEST	443	49725	13.107.246.60	192.168.2.5
Jul 24, 2024 18:53:12.297451973 CEST	443	49725	13.107.246.60	192.168.2.5
Jul 24, 2024 18:53:12.297451973 CEST	49725	443	192.168.2.5	13.107.246.60
Jul 24, 2024 18:53:12.297472954 CEST	49725	443	192.168.2.5	13.107.246.60
Jul 24, 2024 18:53:12.297478914 CEST	443	49725	13.107.246.60	192.168.2.5
Jul 24, 2024 18:53:12.297491074 CEST	49725	443	192.168.2.5	13.107.246.60
Jul 24, 2024 18:53:12.297512054 CEST	49725	443	192.168.2.5	13.107.246.60
Jul 24, 2024 18:53:12.389373064 CEST	443	49725	13.107.246.60	192.168.2.5
Jul 24, 2024 18:53:12.389473915 CEST	49725	443	192.168.2.5	13.107.246.60
Jul 24, 2024 18:53:12.389476061 CEST	443	49725	13.107.246.60	192.168.2.5
Jul 24, 2024 18:53:12.389537096 CEST	443	49725	13.107.246.60	192.168.2.5
Jul 24, 2024 18:53:12.389555931 CEST	49725	443	192.168.2.5	13.107.246.60
Jul 24, 2024 18:53:12.389566898 CEST	443	49725	13.107.246.60	192.168.2.5
Jul 24, 2024 18:53:12.389586926 CEST	443	49725	13.107.246.60	192.168.2.5
Jul 24, 2024 18:53:12.389616013 CEST	49725	443	192.168.2.5	13.107.246.60
Jul 24, 2024 18:53:12.389619112 CEST	443	49725	13.107.246.60	192.168.2.5
Jul 24, 2024 18:53:12.389642954 CEST	443	49725	13.107.246.60	192.168.2.5
Jul 24, 2024 18:53:12.389646053 CEST	49725	443	192.168.2.5	13.107.246.60
Jul 24, 2024 18:53:12.389662027 CEST	49725	443	192.168.2.5	13.107.246.60
Jul 24, 2024 18:53:12.391547918 CEST	443	49725	13.107.246.60	192.168.2.5
Jul 24, 2024 18:53:12.391582012 CEST	443	49725	13.107.246.60	192.168.2.5
Jul 24, 2024 18:53:12.391628027 CEST	49725	443	192.168.2.5	13.107.246.60
Jul 24, 2024 18:53:12.391640902 CEST	443	49725	13.107.246.60	192.168.2.5
Jul 24, 2024 18:53:12.391659021 CEST	443	49725	13.107.246.60	192.168.2.5
Jul 24, 2024 18:53:12.391659021 CEST	49725	443	192.168.2.5	13.107.246.60
Jul 24, 2024 18:53:12.391686916 CEST	49725	443	192.168.2.5	13.107.246.60
Jul 24, 2024 18:53:12.391700029 CEST	443	49725	13.107.246.60	192.168.2.5
Jul 24, 2024 18:53:12.391719103 CEST	49725	443	192.168.2.5	13.107.246.60
Jul 24, 2024 18:53:12.394448996 CEST	443	49725	13.107.246.60	192.168.2.5
Jul 24, 2024 18:53:12.394495010 CEST	443	49725	13.107.246.60	192.168.2.5
Jul 24, 2024 18:53:12.394507885 CEST	49725	443	192.168.2.5	13.107.246.60
Jul 24, 2024 18:53:12.394511938 CEST	443	49725	13.107.246.60	192.168.2.5
Jul 24, 2024 18:53:12.394532919 CEST	443	49725	13.107.246.60	192.168.2.5
Jul 24, 2024 18:53:12.394540071 CEST	49725	443	192.168.2.5	13.107.246.60
Jul 24, 2024 18:53:12.394578934 CEST	49725	443	192.168.2.5	13.107.246.60
Jul 24, 2024 18:53:12.394579887 CEST	443	49725	13.107.246.60	192.168.2.5
Jul 24, 2024 18:53:12.396296024 CEST	443	49725	13.107.246.60	192.168.2.5
Jul 24, 2024 18:53:12.396336079 CEST	443	49725	13.107.246.60	192.168.2.5
Jul 24, 2024 18:53:12.396357059 CEST	49725	443	192.168.2.5	13.107.246.60
Jul 24, 2024 18:53:12.396372080 CEST	443	49725	13.107.246.60	192.168.2.5
Jul 24, 2024 18:53:12.396388054 CEST	443	49725	13.107.246.60	192.168.2.5
Jul 24, 2024 18:53:12.396400928 CEST	49725	443	192.168.2.5	13.107.246.60
Jul 24, 2024 18:53:12.396416903 CEST	49725	443	192.168.2.5	13.107.246.60
Jul 24, 2024 18:53:12.491396904 CEST	443	49725	13.107.246.60	192.168.2.5
Jul 24, 2024 18:53:12.491425037 CEST	443	49725	13.107.246.60	192.168.2.5
Jul 24, 2024 18:53:12.491471052 CEST	49725	443	192.168.2.5	13.107.246.60
Jul 24, 2024 18:53:12.491509914 CEST	443	49725	13.107.246.60	192.168.2.5
Jul 24, 2024 18:53:12.491532087 CEST	49725	443	192.168.2.5	13.107.246.60
Jul 24, 2024 18:53:12.493504047 CEST	443	49725	13.107.246.60	192.168.2.5
Jul 24, 2024 18:53:12.493514061 CEST	443	49725	13.107.246.60	192.168.2.5
Jul 24, 2024 18:53:12.493529081 CEST	443	49725	13.107.246.60	192.168.2.5
Jul 24, 2024 18:53:12.493568897 CEST	49725	443	192.168.2.5	13.107.246.60
Jul 24, 2024 18:53:12.493573904 CEST	443	49725	13.107.246.60	192.168.2.5
Jul 24, 2024 18:53:12.493612051 CEST	49725	443	192.168.2.5	13.107.246.60
Jul 24, 2024 18:53:12.493624926 CEST	443	49725	13.107.246.60	192.168.2.5
Jul 24, 2024 18:53:12.493644953 CEST	49725	443	192.168.2.5	13.107.246.60
Jul 24, 2024 18:53:12.496325016 CEST	443	49725	13.107.246.60	192.168.2.5
Jul 24, 2024 18:53:12.496383905 CEST	49725	443	192.168.2.5	13.107.246.60
Jul 24, 2024 18:53:12.496392965 CEST	443	49725	13.107.246.60	192.168.2.5
Jul 24, 2024 18:53:12.496428967 CEST	443	49725	13.107.246.60	192.168.2.5
Jul 24, 2024 18:53:12.496459007 CEST	443	49725	13.107.246.60	192.168.2.5
Jul 24, 2024 18:53:12.496474981 CEST	443	49725	13.107.246.60	192.168.2.5
Jul 24, 2024 18:53:12.496509075 CEST	49725	443	192.168.2.5	13.107.246.60
Jul 24, 2024 18:53:12.496509075 CEST	49725	443	192.168.2.5	13.107.246.60
Jul 24, 2024 18:53:12.496510029 CEST	49725	443	192.168.2.5	13.107.246.60
Jul 24, 2024 18:53:12.498207092 CEST	443	49725	13.107.246.60	192.168.2.5
Jul 24, 2024 18:53:12.498229027 CEST	443	49725	13.107.246.60	192.168.2.5
Jul 24, 2024 18:53:12.498269081 CEST	49725	443	192.168.2.5	13.107.246.60
Jul 24, 2024 18:53:12.498285055 CEST	443	49725	13.107.246.60	192.168.2.5
Jul 24, 2024 18:53:12.498301983 CEST	49725	443	192.168.2.5	13.107.246.60
Jul 24, 2024 18:53:12.500058889 CEST	443	49725	13.107.246.60	192.168.2.5
Jul 24, 2024 18:53:12.500082970 CEST	443	49725	13.107.246.60	192.168.2.5
Jul 24, 2024 18:53:12.500127077 CEST	49725	443	192.168.2.5	13.107.246.60
Jul 24, 2024 18:53:12.500144005 CEST	443	49725	13.107.246.60	192.168.2.5
Jul 24, 2024 18:53:12.500159025 CEST	49725	443	192.168.2.5	13.107.246.60
Jul 24, 2024 18:53:12.501090050 CEST	443	49725	13.107.246.60	192.168.2.5
Jul 24, 2024 18:53:12.501133919 CEST	443	49725	13.107.246.60	192.168.2.5
Jul 24, 2024 18:53:12.501152039 CEST	49725	443	192.168.2.5	13.107.246.60
Jul 24, 2024 18:53:12.501163006 CEST	443	49725	13.107.246.60	192.168.2.5
Jul 24, 2024 18:53:12.501188040 CEST	443	49725	13.107.246.60	192.168.2.5
Jul 24, 2024 18:53:12.501190901 CEST	49725	443	192.168.2.5	13.107.246.60
Jul 24, 2024 18:53:12.501312971 CEST	49725	443	192.168.2.5	13.107.246.60
Jul 24, 2024 18:53:12.501322985 CEST	443	49725	13.107.246.60	192.168.2.5
Jul 24, 2024 18:53:12.501338005 CEST	49725	443	192.168.2.5	13.107.246.60
Jul 24, 2024 18:53:12.773364067 CEST	443	49726	184.28.90.27	192.168.2.5
Jul 24, 2024 18:53:12.773443937 CEST	49726	443	192.168.2.5	184.28.90.27
Jul 24, 2024 18:53:12.777299881 CEST	49726	443	192.168.2.5	184.28.90.27
Jul 24, 2024 18:53:12.777309895 CEST	443	49726	184.28.90.27	192.168.2.5
Jul 24, 2024 18:53:12.777678013 CEST	443	49726	184.28.90.27	192.168.2.5
Jul 24, 2024 18:53:12.829602003 CEST	49726	443	192.168.2.5	184.28.90.27
Jul 24, 2024 18:53:12.876501083 CEST	443	49726	184.28.90.27	192.168.2.5
Jul 24, 2024 18:53:13.062930107 CEST	443	49726	184.28.90.27	192.168.2.5
Jul 24, 2024 18:53:13.063107967 CEST	443	49726	184.28.90.27	192.168.2.5
Jul 24, 2024 18:53:13.063121080 CEST	49726	443	192.168.2.5	184.28.90.27
Jul 24, 2024 18:53:13.063154936 CEST	443	49726	184.28.90.27	192.168.2.5
Jul 24, 2024 18:53:13.063170910 CEST	49726	443	192.168.2.5	184.28.90.27
Jul 24, 2024 18:53:13.063178062 CEST	443	49726	184.28.90.27	192.168.2.5
Jul 24, 2024 18:53:13.063186884 CEST	49726	443	192.168.2.5	184.28.90.27
Jul 24, 2024 18:53:13.063190937 CEST	443	49726	184.28.90.27	192.168.2.5
Jul 24, 2024 18:53:13.106828928 CEST	49727	443	192.168.2.5	184.28.90.27
Jul 24, 2024 18:53:13.106874943 CEST	443	49727	184.28.90.27	192.168.2.5
Jul 24, 2024 18:53:13.106954098 CEST	49727	443	192.168.2.5	184.28.90.27
Jul 24, 2024 18:53:13.107276917 CEST	49727	443	192.168.2.5	184.28.90.27
Jul 24, 2024 18:53:13.107291937 CEST	443	49727	184.28.90.27	192.168.2.5
Jul 24, 2024 18:53:14.255088091 CEST	443	49727	184.28.90.27	192.168.2.5
Jul 24, 2024 18:53:14.255184889 CEST	49727	443	192.168.2.5	184.28.90.27
Jul 24, 2024 18:53:14.258939981 CEST	49727	443	192.168.2.5	184.28.90.27
Jul 24, 2024 18:53:14.258951902 CEST	443	49727	184.28.90.27	192.168.2.5
Jul 24, 2024 18:53:14.259294987 CEST	443	49727	184.28.90.27	192.168.2.5
Jul 24, 2024 18:53:14.260787964 CEST	49727	443	192.168.2.5	184.28.90.27
Jul 24, 2024 18:53:14.304513931 CEST	443	49727	184.28.90.27	192.168.2.5
Jul 24, 2024 18:53:14.531763077 CEST	443	49727	184.28.90.27	192.168.2.5
Jul 24, 2024 18:53:14.531939030 CEST	443	49727	184.28.90.27	192.168.2.5
Jul 24, 2024 18:53:14.532001972 CEST	49727	443	192.168.2.5	184.28.90.27
Jul 24, 2024 18:53:14.533118963 CEST	49727	443	192.168.2.5	184.28.90.27
Jul 24, 2024 18:53:14.533137083 CEST	443	49727	184.28.90.27	192.168.2.5
Jul 24, 2024 18:53:14.533150911 CEST	49727	443	192.168.2.5	184.28.90.27
Jul 24, 2024 18:53:14.533157110 CEST	443	49727	184.28.90.27	192.168.2.5
Jul 24, 2024 18:53:18.526707888 CEST	49742	443	192.168.2.5	13.85.23.86
Jul 24, 2024 18:53:18.526797056 CEST	443	49742	13.85.23.86	192.168.2.5
Jul 24, 2024 18:53:18.526906013 CEST	49742	443	192.168.2.5	13.85.23.86
Jul 24, 2024 18:53:18.527932882 CEST	49742	443	192.168.2.5	13.85.23.86
Jul 24, 2024 18:53:18.527964115 CEST	443	49742	13.85.23.86	192.168.2.5
Jul 24, 2024 18:53:19.264420986 CEST	443	49742	13.85.23.86	192.168.2.5
Jul 24, 2024 18:53:19.264523029 CEST	49742	443	192.168.2.5	13.85.23.86
Jul 24, 2024 18:53:19.267142057 CEST	49742	443	192.168.2.5	13.85.23.86
Jul 24, 2024 18:53:19.267177105 CEST	443	49742	13.85.23.86	192.168.2.5
Jul 24, 2024 18:53:19.267570019 CEST	443	49742	13.85.23.86	192.168.2.5
Jul 24, 2024 18:53:19.320291996 CEST	49742	443	192.168.2.5	13.85.23.86
Jul 24, 2024 18:53:20.007304907 CEST	49742	443	192.168.2.5	13.85.23.86
Jul 24, 2024 18:53:20.048507929 CEST	443	49742	13.85.23.86	192.168.2.5
Jul 24, 2024 18:53:20.245163918 CEST	443	49742	13.85.23.86	192.168.2.5
Jul 24, 2024 18:53:20.245230913 CEST	443	49742	13.85.23.86	192.168.2.5
Jul 24, 2024 18:53:20.245258093 CEST	443	49742	13.85.23.86	192.168.2.5
Jul 24, 2024 18:53:20.245281935 CEST	443	49742	13.85.23.86	192.168.2.5
Jul 24, 2024 18:53:20.245301008 CEST	49742	443	192.168.2.5	13.85.23.86
Jul 24, 2024 18:53:20.245321989 CEST	443	49742	13.85.23.86	192.168.2.5
Jul 24, 2024 18:53:20.245342016 CEST	443	49742	13.85.23.86	192.168.2.5
Jul 24, 2024 18:53:20.245343924 CEST	49742	443	192.168.2.5	13.85.23.86
Jul 24, 2024 18:53:20.245368958 CEST	443	49742	13.85.23.86	192.168.2.5
Jul 24, 2024 18:53:20.245399952 CEST	49742	443	192.168.2.5	13.85.23.86
Jul 24, 2024 18:53:20.245418072 CEST	49742	443	192.168.2.5	13.85.23.86
Jul 24, 2024 18:53:20.245498896 CEST	443	49742	13.85.23.86	192.168.2.5
Jul 24, 2024 18:53:20.245562077 CEST	49742	443	192.168.2.5	13.85.23.86
Jul 24, 2024 18:53:20.245574951 CEST	443	49742	13.85.23.86	192.168.2.5
Jul 24, 2024 18:53:20.245774984 CEST	443	49742	13.85.23.86	192.168.2.5
Jul 24, 2024 18:53:20.245835066 CEST	49742	443	192.168.2.5	13.85.23.86
Jul 24, 2024 18:53:20.834806919 CEST	49703	443	192.168.2.5	23.1.237.91
Jul 24, 2024 18:53:20.834845066 CEST	49703	443	192.168.2.5	23.1.237.91
Jul 24, 2024 18:53:20.835129976 CEST	49756	443	192.168.2.5	23.1.237.91
Jul 24, 2024 18:53:20.835213900 CEST	443	49756	23.1.237.91	192.168.2.5
Jul 24, 2024 18:53:20.835369110 CEST	49756	443	192.168.2.5	23.1.237.91
Jul 24, 2024 18:53:20.840020895 CEST	49756	443	192.168.2.5	23.1.237.91
Jul 24, 2024 18:53:20.840058088 CEST	443	49756	23.1.237.91	192.168.2.5
Jul 24, 2024 18:53:21.160258055 CEST	443	49703	23.1.237.91	192.168.2.5
Jul 24, 2024 18:53:21.160296917 CEST	443	49703	23.1.237.91	192.168.2.5
Jul 24, 2024 18:53:21.189361095 CEST	49742	443	192.168.2.5	13.85.23.86
Jul 24, 2024 18:53:21.189430952 CEST	443	49742	13.85.23.86	192.168.2.5
Jul 24, 2024 18:53:21.189466000 CEST	49742	443	192.168.2.5	13.85.23.86
Jul 24, 2024 18:53:21.189501047 CEST	443	49742	13.85.23.86	192.168.2.5
Jul 24, 2024 18:53:21.477754116 CEST	443	49719	142.250.185.132	192.168.2.5
Jul 24, 2024 18:53:21.477828979 CEST	443	49719	142.250.185.132	192.168.2.5
Jul 24, 2024 18:53:21.477930069 CEST	49719	443	192.168.2.5	142.250.185.132
Jul 24, 2024 18:53:21.811711073 CEST	443	49756	23.1.237.91	192.168.2.5
Jul 24, 2024 18:53:21.811815023 CEST	49756	443	192.168.2.5	23.1.237.91
Jul 24, 2024 18:53:22.709281921 CEST	49719	443	192.168.2.5	142.250.185.132
Jul 24, 2024 18:53:22.709290981 CEST	443	49719	142.250.185.132	192.168.2.5
Jul 24, 2024 18:53:40.961194992 CEST	443	49756	23.1.237.91	192.168.2.5
Jul 24, 2024 18:53:40.961299896 CEST	49756	443	192.168.2.5	23.1.237.91
Jul 24, 2024 18:53:49.122293949 CEST	63957	53	192.168.2.5	1.1.1.1
Jul 24, 2024 18:53:49.127379894 CEST	53	63957	1.1.1.1	192.168.2.5
Jul 24, 2024 18:53:49.127499104 CEST	63957	53	192.168.2.5	1.1.1.1
Jul 24, 2024 18:53:49.128370047 CEST	63957	53	192.168.2.5	1.1.1.1
Jul 24, 2024 18:53:49.134016991 CEST	53	63957	1.1.1.1	192.168.2.5
Jul 24, 2024 18:53:49.593832016 CEST	53	63957	1.1.1.1	192.168.2.5
Jul 24, 2024 18:53:49.594662905 CEST	63957	53	192.168.2.5	1.1.1.1
Jul 24, 2024 18:53:49.600158930 CEST	53	63957	1.1.1.1	192.168.2.5
Jul 24, 2024 18:53:49.600241899 CEST	63957	53	192.168.2.5	1.1.1.1
Jul 24, 2024 18:53:57.622677088 CEST	63959	443	192.168.2.5	13.85.23.86
Jul 24, 2024 18:53:57.622762918 CEST	443	63959	13.85.23.86	192.168.2.5
Jul 24, 2024 18:53:57.622853994 CEST	63959	443	192.168.2.5	13.85.23.86
Jul 24, 2024 18:53:57.623191118 CEST	63959	443	192.168.2.5	13.85.23.86
Jul 24, 2024 18:53:57.623213053 CEST	443	63959	13.85.23.86	192.168.2.5
Jul 24, 2024 18:53:59.410725117 CEST	443	63959	13.85.23.86	192.168.2.5
Jul 24, 2024 18:53:59.410928965 CEST	63959	443	192.168.2.5	13.85.23.86
Jul 24, 2024 18:53:59.416260958 CEST	63959	443	192.168.2.5	13.85.23.86
Jul 24, 2024 18:53:59.416269064 CEST	443	63959	13.85.23.86	192.168.2.5
Jul 24, 2024 18:53:59.416709900 CEST	443	63959	13.85.23.86	192.168.2.5
Jul 24, 2024 18:53:59.424328089 CEST	63959	443	192.168.2.5	13.85.23.86
Jul 24, 2024 18:53:59.468544006 CEST	443	63959	13.85.23.86	192.168.2.5
Jul 24, 2024 18:53:59.696724892 CEST	443	63959	13.85.23.86	192.168.2.5
Jul 24, 2024 18:53:59.696805000 CEST	443	63959	13.85.23.86	192.168.2.5
Jul 24, 2024 18:53:59.696890116 CEST	63959	443	192.168.2.5	13.85.23.86
Jul 24, 2024 18:53:59.696903944 CEST	443	63959	13.85.23.86	192.168.2.5
Jul 24, 2024 18:53:59.697031021 CEST	443	63959	13.85.23.86	192.168.2.5
Jul 24, 2024 18:53:59.697098017 CEST	63959	443	192.168.2.5	13.85.23.86
Jul 24, 2024 18:53:59.697105885 CEST	443	63959	13.85.23.86	192.168.2.5
Jul 24, 2024 18:53:59.699424028 CEST	443	63959	13.85.23.86	192.168.2.5
Jul 24, 2024 18:53:59.699467897 CEST	443	63959	13.85.23.86	192.168.2.5
Jul 24, 2024 18:53:59.699496984 CEST	63959	443	192.168.2.5	13.85.23.86
Jul 24, 2024 18:53:59.699501991 CEST	443	63959	13.85.23.86	192.168.2.5
Jul 24, 2024 18:53:59.699548960 CEST	63959	443	192.168.2.5	13.85.23.86
Jul 24, 2024 18:53:59.700509071 CEST	443	63959	13.85.23.86	192.168.2.5
Jul 24, 2024 18:53:59.700575113 CEST	63959	443	192.168.2.5	13.85.23.86
Jul 24, 2024 18:53:59.700803995 CEST	443	63959	13.85.23.86	192.168.2.5
Jul 24, 2024 18:53:59.700895071 CEST	63959	443	192.168.2.5	13.85.23.86
Jul 24, 2024 18:53:59.702775002 CEST	63959	443	192.168.2.5	13.85.23.86
Jul 24, 2024 18:53:59.702790022 CEST	443	63959	13.85.23.86	192.168.2.5
Jul 24, 2024 18:53:59.702820063 CEST	63959	443	192.168.2.5	13.85.23.86
Jul 24, 2024 18:53:59.702825069 CEST	443	63959	13.85.23.86	192.168.2.5
Jul 24, 2024 18:54:11.508202076 CEST	63961	443	192.168.2.5	142.250.185.100
Jul 24, 2024 18:54:11.508291960 CEST	443	63961	142.250.185.100	192.168.2.5
Jul 24, 2024 18:54:11.508416891 CEST	63961	443	192.168.2.5	142.250.185.100
Jul 24, 2024 18:54:11.508611917 CEST	63961	443	192.168.2.5	142.250.185.100
Jul 24, 2024 18:54:11.508642912 CEST	443	63961	142.250.185.100	192.168.2.5
Jul 24, 2024 18:54:12.166414976 CEST	443	63961	142.250.185.100	192.168.2.5
Jul 24, 2024 18:54:12.166840076 CEST	63961	443	192.168.2.5	142.250.185.100
Jul 24, 2024 18:54:12.166906118 CEST	443	63961	142.250.185.100	192.168.2.5
Jul 24, 2024 18:54:12.167608976 CEST	443	63961	142.250.185.100	192.168.2.5
Jul 24, 2024 18:54:12.168039083 CEST	63961	443	192.168.2.5	142.250.185.100
Jul 24, 2024 18:54:12.168158054 CEST	443	63961	142.250.185.100	192.168.2.5
Jul 24, 2024 18:54:12.221734047 CEST	63961	443	192.168.2.5	142.250.185.100
Jul 24, 2024 18:54:22.067733049 CEST	443	63961	142.250.185.100	192.168.2.5
Jul 24, 2024 18:54:22.067838907 CEST	443	63961	142.250.185.100	192.168.2.5
Jul 24, 2024 18:54:22.067897081 CEST	63961	443	192.168.2.5	142.250.185.100
Jul 24, 2024 18:54:23.182384968 CEST	63961	443	192.168.2.5	142.250.185.100
Jul 24, 2024 18:54:23.182463884 CEST	443	63961	142.250.185.100	192.168.2.5

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 24, 2024 18:53:06.810446024 CEST	53	49396	1.1.1.1	192.168.2.5
Jul 24, 2024 18:53:06.817857981 CEST	53	57916	1.1.1.1	192.168.2.5
Jul 24, 2024 18:53:07.951709986 CEST	53	52837	1.1.1.1	192.168.2.5
Jul 24, 2024 18:53:10.018311977 CEST	52902	53	192.168.2.5	1.1.1.1
Jul 24, 2024 18:53:10.018377066 CEST	53773	53	192.168.2.5	1.1.1.1
Jul 24, 2024 18:53:10.878650904 CEST	56196	53	192.168.2.5	1.1.1.1
Jul 24, 2024 18:53:10.879023075 CEST	53678	53	192.168.2.5	1.1.1.1
Jul 24, 2024 18:53:10.886687994 CEST	53	56196	1.1.1.1	192.168.2.5
Jul 24, 2024 18:53:10.886912107 CEST	53	53678	1.1.1.1	192.168.2.5
Jul 24, 2024 18:53:11.362303019 CEST	63224	53	192.168.2.5	1.1.1.1
Jul 24, 2024 18:53:11.362581015 CEST	64580	53	192.168.2.5	1.1.1.1
Jul 24, 2024 18:53:23.178606033 CEST	56614	53	192.168.2.5	1.1.1.1
Jul 24, 2024 18:53:23.179074049 CEST	50943	53	192.168.2.5	1.1.1.1
Jul 24, 2024 18:53:23.180684090 CEST	53	59031	1.1.1.1	192.168.2.5
Jul 24, 2024 18:53:25.248794079 CEST	53	49271	1.1.1.1	192.168.2.5
Jul 24, 2024 18:53:44.060405016 CEST	53	54798	1.1.1.1	192.168.2.5
Jul 24, 2024 18:53:49.121751070 CEST	53	53976	1.1.1.1	192.168.2.5
Jul 24, 2024 18:54:06.640260935 CEST	53	55704	1.1.1.1	192.168.2.5
Jul 24, 2024 18:54:10.932185888 CEST	65131	53	192.168.2.5	1.1.1.1
Jul 24, 2024 18:54:10.932307005 CEST	54309	53	192.168.2.5	1.1.1.1
Jul 24, 2024 18:54:11.505426884 CEST	53	65131	1.1.1.1	192.168.2.5
Jul 24, 2024 18:54:11.505471945 CEST	53	54309	1.1.1.1	192.168.2.5
Jul 24, 2024 18:54:24.750617981 CEST	62803	53	192.168.2.5	1.1.1.1
Jul 24, 2024 18:54:24.750793934 CEST	65306	53	192.168.2.5	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jul 24, 2024 18:53:10.018311977 CEST	192.168.2.5	1.1.1.1	0x79f3	Standard query (0)	js.monitor.azure.com	A (IP address)	IN (0x0001)	false
Jul 24, 2024 18:53:10.018377066 CEST	192.168.2.5	1.1.1.1	0xac0f	Standard query (0)	js.monitor.azure.com	65	IN (0x0001)	false
Jul 24, 2024 18:53:10.878650904 CEST	192.168.2.5	1.1.1.1	0xdfa1	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Jul 24, 2024 18:53:10.879023075 CEST	192.168.2.5	1.1.1.1	0x66c9	Standard query (0)	www.google.com	65	IN (0x0001)	false
Jul 24, 2024 18:53:11.362303019 CEST	192.168.2.5	1.1.1.1	0xc1cf	Standard query (0)	js.monitor.azure.com	A (IP address)	IN (0x0001)	false
Jul 24, 2024 18:53:11.362581015 CEST	192.168.2.5	1.1.1.1	0x4606	Standard query (0)	js.monitor.azure.com	65	IN (0x0001)	false
Jul 24, 2024 18:53:23.178606033 CEST	192.168.2.5	1.1.1.1	0xa14f	Standard query (0)	mdec.nelreports.net	A (IP address)	IN (0x0001)	false
Jul 24, 2024 18:53:23.179074049 CEST	192.168.2.5	1.1.1.1	0xeb75	Standard query (0)	mdec.nelreports.net	65	IN (0x0001)	false
Jul 24, 2024 18:54:10.932185888 CEST	192.168.2.5	1.1.1.1	0x354e	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Jul 24, 2024 18:54:10.932307005 CEST	192.168.2.5	1.1.1.1	0xd616	Standard query (0)	www.google.com	65	IN (0x0001)	false
Jul 24, 2024 18:54:24.750617981 CEST	192.168.2.5	1.1.1.1	0xda4e	Standard query (0)	mdec.nelreports.net	A (IP address)	IN (0x0001)	false
Jul 24, 2024 18:54:24.750793934 CEST	192.168.2.5	1.1.1.1	0x896c	Standard query (0)	mdec.nelreports.net	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jul 24, 2024 18:53:10.026599884 CEST	1.1.1.1	192.168.2.5	0xb16a	No error (0)	consentdeliveryfd.azurefd.net	firstparty-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 24, 2024 18:53:10.030579090 CEST	1.1.1.1	192.168.2.5	0xa6ee	No error (0)	consentdeliveryfd.azurefd.net	firstparty-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 24, 2024 18:53:10.030579090 CEST	1.1.1.1	192.168.2.5	0xa6ee	No error (0)	shed.dual-low.s-part-0014.t-0009.t-msedge.net	s-part-0014.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 24, 2024 18:53:10.030579090 CEST	1.1.1.1	192.168.2.5	0xa6ee	No error (0)	s-part-0014.t-0009.t-msedge.net		13.107.246.42	A (IP address)	IN (0x0001)	false
Jul 24, 2024 18:53:10.030608892 CEST	1.1.1.1	192.168.2.5	0x79f3	No error (0)	js.monitor.azure.com	aijscdn2.azureedge.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 24, 2024 18:53:10.030608892 CEST	1.1.1.1	192.168.2.5	0x79f3	No error (0)	shed.dual-low.s-part-0014.t-0009.t-msedge.net	s-part-0014.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 24, 2024 18:53:10.030608892 CEST	1.1.1.1	192.168.2.5	0x79f3	No error (0)	s-part-0014.t-0009.t-msedge.net		13.107.246.42	A (IP address)	IN (0x0001)	false
Jul 24, 2024 18:53:10.030637980 CEST	1.1.1.1	192.168.2.5	0xac0f	No error (0)	js.monitor.azure.com	aijscdn2.azureedge.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 24, 2024 18:53:10.886687994 CEST	1.1.1.1	192.168.2.5	0xdfa1	No error (0)	www.google.com		142.250.185.132	A (IP address)	IN (0x0001)	false
Jul 24, 2024 18:53:10.886912107 CEST	1.1.1.1	192.168.2.5	0x66c9	No error (0)	www.google.com			65	IN (0x0001)	false
Jul 24, 2024 18:53:10.978986025 CEST	1.1.1.1	192.168.2.5	0x6d22	No error (0)	consentdeliveryfd.azurefd.net	firstparty-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 24, 2024 18:53:10.978986025 CEST	1.1.1.1	192.168.2.5	0x6d22	No error (0)	shed.dual-low.s-part-0032.t-0009.t-msedge.net	s-part-0032.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 24, 2024 18:53:10.978986025 CEST	1.1.1.1	192.168.2.5	0x6d22	No error (0)	s-part-0032.t-0009.t-msedge.net		13.107.246.60	A (IP address)	IN (0x0001)	false
Jul 24, 2024 18:53:10.979023933 CEST	1.1.1.1	192.168.2.5	0xb0cf	No error (0)	consentdeliveryfd.azurefd.net	firstparty-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 24, 2024 18:53:11.370462894 CEST	1.1.1.1	192.168.2.5	0xc1cf	No error (0)	js.monitor.azure.com	aijscdn2.azureedge.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 24, 2024 18:53:11.370462894 CEST	1.1.1.1	192.168.2.5	0xc1cf	No error (0)	shed.dual-low.s-part-0032.t-0009.t-msedge.net	s-part-0032.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 24, 2024 18:53:11.370462894 CEST	1.1.1.1	192.168.2.5	0xc1cf	No error (0)	s-part-0032.t-0009.t-msedge.net		13.107.246.60	A (IP address)	IN (0x0001)	false
Jul 24, 2024 18:53:11.371921062 CEST	1.1.1.1	192.168.2.5	0x4606	No error (0)	js.monitor.azure.com	aijscdn2.azureedge.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 24, 2024 18:53:23.187575102 CEST	1.1.1.1	192.168.2.5	0xa14f	No error (0)	mdec.nelreports.net	mdec.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 24, 2024 18:53:23.192919016 CEST	1.1.1.1	192.168.2.5	0xeb75	No error (0)	mdec.nelreports.net	mdec.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 24, 2024 18:53:24.336957932 CEST	1.1.1.1	192.168.2.5	0x7eb8	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 24, 2024 18:53:24.340919971 CEST	1.1.1.1	192.168.2.5	0x21d4	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 24, 2024 18:53:27.927747965 CEST	1.1.1.1	192.168.2.5	0x5292	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 24, 2024 18:53:27.930493116 CEST	1.1.1.1	192.168.2.5	0xe545	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 24, 2024 18:54:11.505426884 CEST	1.1.1.1	192.168.2.5	0x354e	No error (0)	www.google.com		142.250.185.100	A (IP address)	IN (0x0001)	false
Jul 24, 2024 18:54:11.505471945 CEST	1.1.1.1	192.168.2.5	0xd616	No error (0)	www.google.com			65	IN (0x0001)	false
Jul 24, 2024 18:54:24.759488106 CEST	1.1.1.1	192.168.2.5	0x896c	No error (0)	mdec.nelreports.net	mdec.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 24, 2024 18:54:24.760451078 CEST	1.1.1.1	192.168.2.5	0xda4e	No error (0)	mdec.nelreports.net	mdec.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

https:

wcpstatic.microsoft.com

js.monitor.azure.com

fs.microsoft.com

slscr.update.microsoft.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49718	13.107.246.42	443	2820	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-24 16:53:10 UTC	551	OUT	GET /mscc/lib/v2/wcp-consent.js HTTP/1.1 Host: wcpstatic.microsoft.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://learn.microsoft.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-07-24 16:53:10 UTC	713	IN	HTTP/1.1 200 OK Date: Wed, 24 Jul 2024 16:53:10 GMT Content-Type: application/javascript Content-Length: 52717 Connection: close Access-Control-Allow-Origin: * Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding Age: 35260 Cache-Control: max-age=43200 Content-MD5: QT/MdZzBmCG2G2lBgIsptQ== Etag: 0x8DA85F6F74C6D08 Last-Modified: Wed, 24 Aug 2022 17:34:58 GMT Vary: Accept-Encoding X-Cache: CONFIG_NOCACHE x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: e58378cc-201e-00d5-1b97-dd2f52000000 x-ms-version: 2009-09-19 x-azure-ref: 20240724T165310Z-15b94bb6ff9f5mm5g2kn1xpxws00000003e0000000007khm Accept-Ranges: bytes
2024-07-24 16:53:10 UTC	15671	IN	Data Raw: 76 61 72 20 57 63 70 43 6f 6e 73 65 6e 74 3b 21 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 65 3d 7b 32 32 39 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 77 69 6e 64 6f 77 2c 65 2e 65 78 70 6f 72 74 73 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 7b 7d 3b 66 75 6e 63 74 69 6f 6e 20 6f 28 6e 29 7b 69 66 28 74 5b 6e 5d 29 72 65 74 75 72 6e 20 74 5b 6e 5d 2e 65 78 70 6f 72 74 73 3b 76 61 72 20 72 3d 74 5b 6e 5d 3d 7b 69 3a 6e 2c 6c 3a 21 31 2c 65 78 70 6f 72 74 73 3a 7b 7d 7d 3b 72 65 74 75 72 6e 20 65 5b 6e 5d 2e 63 61 6c 6c 28 72 2e 65 78 70 6f 72 74 73 2c 72 2c 72 2e 65 78 70 6f 72 74 73 2c 6f 29 2c 72 2e 6c 3d 21 30 2c 72 2e 65 78 70 6f 72 74 73 7d 72 65 74 75 72 6e 20 6f 2e 6d 3d 65 2c 6f 2e 63 3d 74 2c 6f 2e 64 3d 66 75 6e 63 74 69 6f 6e 28 65 Data Ascii: var WcpConsent;!function(){var e={229:function(e){window,e.exports=function(e){var t={};function o(n){if(t[n])return t[n].exports;var r=t[n]={i:n,l:!1,exports:{}};return e[n].call(r.exports,r,r.exports,o),r.l=!0,r.exports}return o.m=e,o.c=t,o.d=function(e
2024-07-24 16:53:10 UTC	16384	IN	Data Raw: 29 7b 72 65 74 75 72 6e 20 65 3f 65 2e 72 65 70 6c 61 63 65 28 2f 26 2f 67 2c 22 26 61 6d 70 3b 22 29 2e 72 65 70 6c 61 63 65 28 2f 3c 2f 67 2c 22 26 6c 74 3b 22 29 2e 72 65 70 6c 61 63 65 28 2f 3e 2f 67 2c 22 26 67 74 3b 22 29 2e 72 65 70 6c 61 63 65 28 2f 22 2f 67 2c 22 26 71 75 6f 74 3b 22 29 2e 72 65 70 6c 61 63 65 28 2f 27 2f 67 2c 22 26 23 30 33 39 3b 22 29 3a 22 22 7d 2c 65 7d 28 29 2c 61 3d 6e 2e 6c 6f 63 61 6c 73 2c 6c 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 65 28 65 2c 74 2c 6f 2c 6e 2c 72 2c 69 2c 61 29 7b 74 68 69 73 2e 64 69 72 65 63 74 69 6f 6e 3d 22 6c 74 72 22 2c 74 68 69 73 2e 70 72 65 76 69 6f 75 73 46 6f 63 75 73 45 6c 65 6d 65 6e 74 42 65 66 6f 72 65 50 6f 70 75 70 3d 6e 75 6c 6c 2c 74 68 69 73 2e 63 6f 6f 6b 69 Data Ascii: ){return e?e.replace(/&/g,"&").replace(/</g,"<").replace(/>/g,">").replace(/"/g,""").replace(/'/g,"'"):""},e}(),a=n.locals,l=function(){function e(e,t,o,n,r,i,a){this.direction="ltr",this.previousFocusElementBeforePopup=null,this.cooki
2024-07-24 16:53:10 UTC	711	IN	Data Raw: 6f 72 22 5d 2b 22 20 21 69 6d 70 6f 72 74 61 6e 74 3b 5c 6e 20 20 20 20 20 20 20 20 7d 22 2c 74 2b 3d 27 69 6e 70 75 74 5b 74 79 70 65 3d 22 72 61 64 69 6f 22 5d 2e 27 2b 63 2e 63 6f 6f 6b 69 65 49 74 65 6d 52 61 64 69 6f 42 74 6e 2b 22 20 2b 20 6c 61 62 65 6c 3a 68 6f 76 65 72 3a 3a 61 66 74 65 72 20 7b 5c 6e 20 20 20 20 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 22 2b 65 5b 22 72 61 64 69 6f 2d 62 75 74 74 6f 6e 2d 68 6f 76 65 72 2d 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 22 5d 2b 22 20 21 69 6d 70 6f 72 74 61 6e 74 3b 5c 6e 20 20 20 20 20 20 20 20 7d 22 2c 74 2b 3d 27 69 6e 70 75 74 5b 74 79 70 65 3d 22 72 61 64 69 6f 22 5d 2e 27 2b 63 2e 63 6f 6f 6b 69 65 49 74 65 6d 52 61 64 69 6f 42 74 6e 2b 22 20 2b 20 6c Data Ascii: or"]+" !important;\n }",t+='input[type="radio"].'+c.cookieItemRadioBtn+" + label:hover::after {\n background-color: "+e["radio-button-hover-background-color"]+" !important;\n }",t+='input[type="radio"].'+c.cookieItemRadioBtn+" + l
2024-07-24 16:53:10 UTC	16384	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 22 2b 65 5b 22 72 61 64 69 6f 2d 62 75 74 74 6f 6e 2d 64 69 73 61 62 6c 65 64 2d 63 6f 6c 6f 72 22 5d 2b 22 20 21 69 6d 70 6f 72 74 61 6e 74 3b 5c 6e 20 20 20 20 20 20 20 20 7d 22 7d 2c 65 7d 28 29 2c 64 3d 5b 22 61 72 22 2c 22 68 65 22 2c 22 70 73 22 2c 22 75 72 22 2c 22 66 61 22 2c 22 70 61 22 2c 22 73 64 22 2c 22 74 6b 22 2c 22 75 67 22 2c 22 79 69 22 2c 22 73 79 72 22 2c 22 6b 73 2d 61 72 61 62 22 5d 2c 75 3d 7b 22 63 6c 6f 73 65 2d 62 75 74 74 6f 6e 2d 63 6f 6c 6f 72 22 3a 22 23 36 36 36 36 36 36 22 2c 22 73 65 63 6f 6e 64 61 72 79 2d 62 75 74 74 6f 6e 2d 64 69 73 61 62 6c 65 64 2d 6f 70 61 63 69 74 79 22 3a 22 31 22 2c 22 73 65 63 6f 6e 64 61 72 79 2d 62 75 74 74 6f Data Ascii: background-color: "+e["radio-button-disabled-color"]+" !important;\n }"},e}(),d=["ar","he","ps","ur","fa","pa","sd","tk","ug","yi","syr","ks-arab"],u={"close-button-color":"#666666","secondary-button-disabled-opacity":"1","secondary-butto
2024-07-24 16:53:10 UTC	3567	IN	Data Raw: 28 22 2d 22 29 5b 30 5d 3b 6f 3d 65 2e 73 70 6c 69 74 28 22 2d 22 29 5b 30 5d 3d 3d 3d 6e 7d 72 65 74 75 72 6e 20 6f 7d 28 65 2c 63 29 7d 29 29 3b 73 26 26 30 3d 3d 3d 73 2e 6c 65 6e 67 74 68 26 26 28 65 3d 22 65 6e 2d 55 53 22 29 2c 6f 2e 70 6c 61 63 65 68 6f 6c 64 65 72 45 6c 65 6d 65 6e 74 3d 6c 2c 72 26 26 6f 2e 63 6f 6e 73 65 6e 74 43 68 61 6e 67 65 64 43 61 6c 6c 62 61 63 6b 73 2e 72 65 67 69 73 74 65 72 43 61 6c 6c 62 61 63 6b 28 72 29 2c 6f 2e 73 61 76 65 43 6f 6f 6b 69 65 28 29 2c 6f 2e 73 69 74 65 43 6f 6e 73 65 6e 74 3d 6e 65 77 20 66 28 21 31 29 2c 6e 75 6c 6c 3d 3d 6e 7c 7c 6e 28 76 6f 69 64 20 30 2c 6f 2e 73 69 74 65 43 6f 6e 73 65 6e 74 29 2c 6f 2e 69 73 49 6e 69 74 52 65 61 64 79 3d 21 30 2c 74 68 69 73 2e 63 6f 6e 73 65 6e 74 43 68 61 6e Data Ascii: ("-")[0];o=e.split("-")[0]===n}return o}(e,c)}));s&&0===s.length&&(e="en-US"),o.placeholderElement=l,r&&o.consentChangedCallbacks.registerCallback(r),o.saveCookie(),o.siteConsent=new f(!1),null==n\|\|n(void 0,o.siteConsent),o.isInitReady=!0,this.consentChan

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49717	13.107.246.42	443	2820	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-24 16:53:10 UTC	549	OUT	GET /scripts/c/ms.jsll-4.min.js HTTP/1.1 Host: js.monitor.azure.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://learn.microsoft.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-07-24 16:53:10 UTC	958	IN	HTTP/1.1 200 OK Date: Wed, 24 Jul 2024 16:53:10 GMT Content-Type: text/javascript; charset=utf-8 Content-Length: 206998 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: no-transform, public, max-age=1800, immutable Last-Modified: Mon, 15 Jul 2024 17:38:35 GMT ETag: 0x8DCA4F4F47351DF x-ms-request-id: bd54a350-101e-00a5-0729-dd7893000000 x-ms-version: 2009-09-19 x-ms-meta-jssdkver: 4.3.0 x-ms-meta-jssdksrc: [cdn]/scripts/c/ms.jsll-4.3.0.min.js Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,x-ms-meta-jssdkver,x-ms-meta-jssdksrc,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240724T165310Z-15b94bb6ff9rvst5kfy6cdy6hc0000000190000000000504 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-07-24 16:53:10 UTC	15426	IN	Data Raw: 2f 2a 21 0a 20 2a 20 31 44 53 20 4a 53 4c 4c 20 53 4b 55 2c 20 34 2e 33 2e 30 0a 20 2a 20 43 6f 70 79 72 69 67 68 74 20 28 63 29 20 4d 69 63 72 6f 73 6f 66 74 20 61 6e 64 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 2e 20 41 6c 6c 20 72 69 67 68 74 73 20 72 65 73 65 72 76 65 64 2e 0a 20 2a 20 28 4d 69 63 72 6f 73 6f 66 74 20 49 6e 74 65 72 6e 61 6c 20 4f 6e 6c 79 29 0a 20 2a 2f 0a 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 76 61 72 20 6e 3d 22 75 6e 64 65 66 69 6e 65 64 22 3b 69 66 28 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 65 78 70 6f 72 74 73 26 26 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 21 3d 6e 29 74 28 65 78 70 6f 72 74 73 29 3b 65 6c 73 65 20 69 66 28 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 64 65 66 69 6e 65 26 26 64 65 66 69 Data Ascii: /! 1DS JSLL SKU, 4.3.0 * Copyright (c) Microsoft and contributors. All rights reserved. * (Microsoft Internal Only) */!function(e,t){var n="undefined";if("object"==typeof exports&&typeof module!=n)t(exports);else if("function"==typeof define&&defi
2024-07-24 16:53:10 UTC	16384	IN	Data Raw: 66 65 28 22 63 6f 6e 73 6f 6c 65 22 29 29 26 26 28 72 2e 65 72 72 6f 72 7c 7c 72 2e 6c 6f 67 29 28 74 2c 61 65 28 69 29 29 29 29 7d 78 65 28 61 3d 7b 74 68 65 6e 3a 6f 2c 22 63 61 74 63 68 22 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 6f 28 75 6e 64 65 66 69 6e 65 64 2c 65 29 7d 2c 22 66 69 6e 61 6c 6c 79 22 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 61 72 20 65 3d 74 2c 6e 3d 74 3b 72 65 74 75 72 6e 20 51 28 74 29 26 26 28 65 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 74 26 26 74 28 29 2c 65 7d 2c 6e 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 74 68 72 6f 77 20 74 26 26 74 28 29 2c 65 7d 29 2c 6f 28 65 2c 6e 29 7d 7d 2c 22 73 74 61 74 65 22 2c 7b 67 65 74 3a 64 7d 29 2c 6d 74 28 29 26 26 28 61 5b 79 74 28 31 31 29 5d 3d 22 49 Data Ascii: fe("console"))&&(r.error\|\|r.log)(t,ae(i))))}xe(a={then:o,"catch":function(e){return o(undefined,e)},"finally":function(t){var e=t,n=t;return Q(t)&&(e=function(e){return t&&t(),e},n=function(e){throw t&&t(),e}),o(e,n)}},"state",{get:d}),mt()&&(a[yt(11)]="I
2024-07-24 16:53:10 UTC	16384	IN	Data Raw: 2c 6e 2e 68 3d 6e 2e 68 7c 7c 72 6e 28 73 63 2c 30 2c 6e 29 29 3a 4c 28 72 2c 5b 65 5d 29 29 7d 29 7d 64 63 2e 5f 5f 69 65 44 79 6e 3d 31 3b 76 61 72 20 66 63 3d 64 63 3b 66 75 6e 63 74 69 6f 6e 20 64 63 28 65 29 7b 74 68 69 73 2e 6c 69 73 74 65 6e 65 72 73 3d 5b 5d 3b 76 61 72 20 6e 2c 69 3d 5b 5d 2c 61 3d 7b 68 3a 6e 75 6c 6c 2c 63 62 3a 5b 5d 7d 2c 6f 3d 6c 6f 28 65 2c 75 63 29 5b 47 6e 5d 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 6e 3d 21 21 65 2e 63 66 67 2e 70 65 72 66 45 76 74 73 53 65 6e 64 41 6c 6c 7d 29 3b 76 65 28 64 63 2c 74 68 69 73 2c 66 75 6e 63 74 69 6f 6e 28 65 29 7b 59 28 65 2c 22 6c 69 73 74 65 6e 65 72 73 22 2c 7b 67 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 69 7d 7d 29 2c 65 5b 74 72 5d 3d 66 75 6e 63 74 69 6f 6e 28 65 29 Data Ascii: ,n.h=n.h\|\|rn(sc,0,n)):L(r,[e]))})}dc.__ieDyn=1;var fc=dc;function dc(e){this.listeners=[];var n,i=[],a={h:null,cb:[]},o=lo(e,uc)[Gn](function(e){n=!!e.cfg.perfEvtsSendAll});ve(dc,this,function(e){Y(e,"listeners",{g:function(){return i}}),e[tr]=function(e)
2024-07-24 16:53:11 UTC	16384	IN	Data Raw: 28 61 29 7d 2c 36 2c 6e 29 2c 69 7d 2c 66 5b 63 72 5d 3d 73 2c 66 2e 61 64 64 50 6c 75 67 69 6e 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 2c 72 29 7b 69 66 28 21 65 29 72 65 74 75 72 6e 20 72 26 26 72 28 21 31 29 2c 76 6f 69 64 20 43 28 6e 75 29 3b 76 61 72 20 69 3d 73 28 65 5b 5a 6e 5d 29 3b 69 66 28 69 26 26 21 74 29 72 65 74 75 72 6e 20 72 26 26 72 28 21 31 29 2c 76 6f 69 64 20 43 28 22 50 6c 75 67 69 6e 20 5b 22 2b 65 5b 5a 6e 5d 2b 22 5d 20 69 73 20 61 6c 72 65 61 64 79 20 6c 6f 61 64 65 64 21 22 29 3b 76 61 72 20 61 2c 6f 3d 7b 72 65 61 73 6f 6e 3a 31 36 7d 3b 66 75 6e 63 74 69 6f 6e 20 63 28 29 7b 41 5b 74 65 5d 28 65 29 2c 6f 2e 61 64 64 65 64 3d 5b 65 5d 2c 67 28 6f 29 2c 72 26 26 72 28 21 30 29 7d 69 3f 76 28 61 3d 5b 69 2e 70 6c 75 67 69 6e Data Ascii: (a)},6,n),i},f[cr]=s,f.addPlugin=function(e,t,n,r){if(!e)return r&&r(!1),void C(nu);var i=s(e[Zn]);if(i&&!t)return r&&r(!1),void C("Plugin ["+e[Zn]+"] is already loaded!");var a,o={reason:16};function c(){A[te](e),o.added=[e],g(o),r&&r(!0)}i?v(a=[i.plugin
2024-07-24 16:53:11 UTC	16384	IN	Data Raw: 73 5d 28 29 2c 6e 3d 66 65 28 65 3d 3d 3d 43 6c 2e 4c 6f 63 61 6c 53 74 6f 72 61 67 65 3f 22 6c 6f 63 61 6c 53 74 6f 72 61 67 65 22 3a 22 73 65 73 73 69 6f 6e 53 74 6f 72 61 67 65 22 29 2c 72 3d 54 6c 2b 74 2c 69 3d 28 6e 2e 73 65 74 49 74 65 6d 28 72 2c 74 29 2c 6e 2e 67 65 74 49 74 65 6d 28 72 29 21 3d 3d 74 29 3b 69 66 28 6e 5b 77 73 5d 28 72 29 2c 21 69 29 72 65 74 75 72 6e 20 6e 7d 63 61 74 63 68 28 61 29 7b 7d 72 65 74 75 72 6e 20 6e 75 6c 6c 7d 66 75 6e 63 74 69 6f 6e 20 45 6c 28 29 7b 72 65 74 75 72 6e 20 5f 6c 28 29 3f 49 6c 28 43 6c 2e 53 65 73 73 69 6f 6e 53 74 6f 72 61 67 65 29 3a 6e 75 6c 6c 7d 66 75 6e 63 74 69 6f 6e 20 5f 6c 28 65 29 7b 72 65 74 75 72 6e 20 62 6c 3d 65 7c 7c 62 6c 3d 3d 3d 75 6e 64 65 66 69 6e 65 64 3f 21 21 49 6c 28 43 6c Data Ascii: s](),n=fe(e===Cl.LocalStorage?"localStorage":"sessionStorage"),r=Tl+t,i=(n.setItem(r,t),n.getItem(r)!==t);if(n[ws](r),!i)return n}catch(a){}return null}function El(){return _l()?Il(Cl.SessionStorage):null}function _l(e){return bl=e\|\|bl===undefined?!!Il(Cl
2024-07-24 16:53:11 UTC	16384	IN	Data Raw: 72 6e 20 6f 7d 7d 29 2c 59 28 65 2c 22 70 61 67 65 56 69 73 69 74 54 69 6d 65 54 72 61 63 6b 69 6e 67 48 61 6e 64 6c 65 72 22 2c 7b 67 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 63 7d 7d 29 7d 29 7d 76 61 72 20 45 64 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 74 68 69 73 5b 6c 64 5d 3d 4f 74 28 29 2c 74 68 69 73 2e 70 61 67 65 4e 61 6d 65 3d 65 2c 74 68 69 73 2e 70 61 67 65 55 72 6c 3d 74 7d 2c 5f 64 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 65 29 7b 76 61 72 20 6f 3d 74 68 69 73 2c 63 3d 7b 7d 3b 6f 2e 73 74 61 72 74 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 63 5b 65 5d 26 26 6d 65 28 61 2c 32 2c 36 32 2c 22 73 74 61 72 74 20 77 61 73 20 63 61 6c 6c 65 64 20 6d 6f 72 65 20 74 68 61 6e 20 Data Ascii: rn o}}),Y(e,"pageVisitTimeTrackingHandler",{g:function(){return c}})})}var Ed=function(e,t){this[ld]=Ot(),this.pageName=e,this.pageUrl=t},_d=function(a,e){var o=this,c={};o.start=function(e){"undefined"!=typeof c[e]&&me(a,2,62,"start was called more than
2024-07-24 16:53:11 UTC	16384	IN	Data Raw: 61 67 73 3d 6d 73 28 21 30 2c 6e 2e 5f 70 61 67 65 54 61 67 73 2c 74 2e 70 61 67 65 54 61 67 73 29 29 2c 65 2e 70 72 6f 70 65 72 74 69 65 73 3d 65 2e 70 72 6f 70 65 72 74 69 65 73 7c 7c 7b 7d 2c 65 2e 70 72 6f 70 65 72 74 69 65 73 2e 70 61 67 65 54 61 67 73 3d 6e 2e 5f 70 61 67 65 54 61 67 73 7d 2c 65 70 2e 70 72 6f 74 6f 74 79 70 65 2e 5f 67 65 74 42 65 68 61 76 69 6f 72 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3b 72 65 74 75 72 6e 20 65 26 26 63 65 28 65 2e 62 65 68 61 76 69 6f 72 29 3f 74 3d 65 2e 62 65 68 61 76 69 6f 72 3a 63 65 28 74 68 69 73 2e 5f 62 65 68 61 76 69 6f 72 4d 65 74 61 54 61 67 29 26 26 28 74 3d 74 68 69 73 2e 5f 62 65 68 61 76 69 6f 72 4d 65 74 61 54 61 67 29 2c 74 68 69 73 2e 5f 67 65 74 56 61 6c 69 64 42 65 68 61 76 69 Data Ascii: ags=ms(!0,n._pageTags,t.pageTags)),e.properties=e.properties\|\|{},e.properties.pageTags=n._pageTags},ep.prototype._getBehavior=function(e){var t;return e&&ce(e.behavior)?t=e.behavior:ce(this._behaviorMetaTag)&&(t=this._behaviorMetaTag),this._getValidBehavi
2024-07-24 16:53:11 UTC	16384	IN	Data Raw: 6d 65 73 2e 63 6f 6e 74 65 6e 74 4e 61 6d 65 29 3b 72 26 26 28 61 5b 74 5d 3d 72 29 2c 69 26 26 28 61 5b 6e 5d 3d 69 29 7d 72 65 74 75 72 6e 20 61 7d 2c 53 70 29 3b 66 75 6e 63 74 69 6f 6e 20 53 70 28 65 2c 74 29 7b 74 68 69 73 2e 5f 63 6f 6e 66 69 67 3d 65 2c 74 68 69 73 2e 5f 74 72 61 63 65 4c 6f 67 67 65 72 3d 74 2c 74 68 69 73 2e 5f 63 6f 6e 74 65 6e 74 42 6c 6f 62 46 69 65 6c 64 4e 61 6d 65 73 3d 6e 75 6c 6c 2c 74 68 69 73 2e 5f 63 6f 6e 74 65 6e 74 42 6c 6f 62 46 69 65 6c 64 4e 61 6d 65 73 3d 21 30 3d 3d 3d 74 68 69 73 2e 5f 63 6f 6e 66 69 67 2e 75 73 65 53 68 6f 72 74 4e 61 6d 65 46 6f 72 43 6f 6e 74 65 6e 74 42 6c 6f 62 3f 54 70 2e 73 68 6f 72 74 4e 61 6d 65 73 3a 54 70 2e 6c 6f 6e 67 4e 61 6d 65 73 7d 76 61 72 20 78 70 2c 4e 70 3d 48 65 28 7b 75 Data Ascii: mes.contentName);r&&(a[t]=r),i&&(a[n]=i)}return a},Sp);function Sp(e,t){this._config=e,this._traceLogger=t,this._contentBlobFieldNames=null,this._contentBlobFieldNames=!0===this._config.useShortNameForContentBlob?Tp.shortNames:Tp.longNames}var xp,Np=He({u
2024-07-24 16:53:11 UTC	16384	IN	Data Raw: 67 3d 22 73 65 6e 64 54 79 70 65 22 2c 4b 67 3d 22 61 64 64 48 65 61 64 65 72 22 2c 47 67 3d 22 63 61 6e 53 65 6e 64 52 65 71 75 65 73 74 22 2c 58 67 3d 22 73 65 6e 64 51 75 65 75 65 64 52 65 71 75 65 73 74 73 22 2c 4a 67 3d 22 69 73 43 6f 6d 70 6c 65 74 65 6c 79 49 64 6c 65 22 2c 51 67 3d 22 73 65 74 55 6e 6c 6f 61 64 69 6e 67 22 2c 59 67 3d 22 73 65 6e 64 53 79 6e 63 68 72 6f 6e 6f 75 73 42 61 74 63 68 22 2c 24 67 3d 22 5f 74 72 61 6e 73 70 6f 72 74 22 2c 5a 67 3d 22 67 65 74 57 50 61 72 61 6d 22 2c 65 76 3d 22 69 73 42 65 61 63 6f 6e 22 2c 74 76 3d 22 74 69 6d 69 6e 67 73 22 2c 6e 76 3d 22 69 73 54 65 61 72 64 6f 77 6e 22 2c 72 76 3d 22 69 73 53 79 6e 63 22 2c 69 76 3d 22 64 61 74 61 22 2c 61 76 3d 22 5f 73 65 6e 64 52 65 61 73 6f 6e 22 2c 6f 76 3d 22 Data Ascii: g="sendType",Kg="addHeader",Gg="canSendRequest",Xg="sendQueuedRequests",Jg="isCompletelyIdle",Qg="setUnloading",Yg="sendSynchronousBatch",$g="_transport",Zg="getWParam",ev="isBeacon",tv="timings",nv="isTeardown",rv="isSync",iv="data",av="_sendReason",ov="
2024-07-24 16:53:11 UTC	16384	IN	Data Raw: 28 29 7b 72 65 3d 21 31 2c 61 65 3d 21 28 69 65 3d 5b 5d 29 2c 52 3d 31 65 34 2c 75 65 3d 7b 7d 2c 73 65 3d 59 70 2c 65 65 3d 21 28 46 3d 7b 7d 29 2c 71 3d 42 3d 56 3d 55 3d 63 65 3d 6f 65 3d 30 2c 7a 3d 2d 31 2c 4b 3d 21 28 57 3d 21 28 6a 3d 4c 3d 4d 3d 50 3d 6b 3d 6e 75 6c 6c 29 29 2c 47 3d 36 2c 74 65 3d 4a 3d 6e 75 6c 6c 2c 6e 65 3d 21 28 58 3d 32 29 2c 51 3d 50 76 28 29 2c 48 3d 6e 65 77 20 42 76 28 4f 3d 35 30 30 2c 32 2c 31 2c 7b 72 65 71 75 65 75 65 3a 65 2c 73 65 6e 64 3a 53 2c 73 65 6e 74 3a 78 2c 64 72 6f 70 3a 4e 2c 72 73 70 46 61 69 6c 3a 44 2c 6f 74 68 3a 41 7d 29 2c 74 28 29 2c 46 5b 34 5d 3d 7b 62 61 74 63 68 65 73 3a 5b 5d 2c 69 4b 65 79 4d 61 70 3a 7b 7d 7d 2c 46 5b 33 5d 3d 7b 62 61 74 63 68 65 73 3a 5b 5d 2c 69 4b 65 79 4d 61 70 3a 7b Data Ascii: (){re=!1,ae=!(ie=[]),R=1e4,ue={},se=Yp,ee=!(F={}),q=B=V=U=ce=oe=0,z=-1,K=!(W=!(j=L=M=P=k=null)),G=6,te=J=null,ne=!(X=2),Q=Pv(),H=new Bv(O=500,2,1,{requeue:e,send:S,sent:x,drop:N,rspFail:D,oth:A}),t(),F[4]={batches:[],iKeyMap:{}},F[3]={batches:[],iKeyMap:{

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49721	13.107.246.60	443	2820	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-24 16:53:11 UTC	373	OUT	GET /mscc/lib/v2/wcp-consent.js HTTP/1.1 Host: wcpstatic.microsoft.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-07-24 16:53:11 UTC	713	IN	HTTP/1.1 200 OK Date: Wed, 24 Jul 2024 16:53:11 GMT Content-Type: application/javascript Content-Length: 52717 Connection: close Access-Control-Allow-Origin: * Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding Age: 35261 Cache-Control: max-age=43200 Content-MD5: QT/MdZzBmCG2G2lBgIsptQ== Etag: 0x8DA85F6F74C6D08 Last-Modified: Wed, 24 Aug 2022 17:34:58 GMT Vary: Accept-Encoding X-Cache: CONFIG_NOCACHE x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: e58378cc-201e-00d5-1b97-dd2f52000000 x-ms-version: 2009-09-19 x-azure-ref: 20240724T165311Z-15b94bb6ff9qtq9cmrtva0dccc00000001pg000000006cu6 Accept-Ranges: bytes
2024-07-24 16:53:11 UTC	15671	IN	Data Raw: 76 61 72 20 57 63 70 43 6f 6e 73 65 6e 74 3b 21 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 65 3d 7b 32 32 39 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 77 69 6e 64 6f 77 2c 65 2e 65 78 70 6f 72 74 73 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 7b 7d 3b 66 75 6e 63 74 69 6f 6e 20 6f 28 6e 29 7b 69 66 28 74 5b 6e 5d 29 72 65 74 75 72 6e 20 74 5b 6e 5d 2e 65 78 70 6f 72 74 73 3b 76 61 72 20 72 3d 74 5b 6e 5d 3d 7b 69 3a 6e 2c 6c 3a 21 31 2c 65 78 70 6f 72 74 73 3a 7b 7d 7d 3b 72 65 74 75 72 6e 20 65 5b 6e 5d 2e 63 61 6c 6c 28 72 2e 65 78 70 6f 72 74 73 2c 72 2c 72 2e 65 78 70 6f 72 74 73 2c 6f 29 2c 72 2e 6c 3d 21 30 2c 72 2e 65 78 70 6f 72 74 73 7d 72 65 74 75 72 6e 20 6f 2e 6d 3d 65 2c 6f 2e 63 3d 74 2c 6f 2e 64 3d 66 75 6e 63 74 69 6f 6e 28 65 Data Ascii: var WcpConsent;!function(){var e={229:function(e){window,e.exports=function(e){var t={};function o(n){if(t[n])return t[n].exports;var r=t[n]={i:n,l:!1,exports:{}};return e[n].call(r.exports,r,r.exports,o),r.l=!0,r.exports}return o.m=e,o.c=t,o.d=function(e
2024-07-24 16:53:12 UTC	16384	IN	Data Raw: 29 7b 72 65 74 75 72 6e 20 65 3f 65 2e 72 65 70 6c 61 63 65 28 2f 26 2f 67 2c 22 26 61 6d 70 3b 22 29 2e 72 65 70 6c 61 63 65 28 2f 3c 2f 67 2c 22 26 6c 74 3b 22 29 2e 72 65 70 6c 61 63 65 28 2f 3e 2f 67 2c 22 26 67 74 3b 22 29 2e 72 65 70 6c 61 63 65 28 2f 22 2f 67 2c 22 26 71 75 6f 74 3b 22 29 2e 72 65 70 6c 61 63 65 28 2f 27 2f 67 2c 22 26 23 30 33 39 3b 22 29 3a 22 22 7d 2c 65 7d 28 29 2c 61 3d 6e 2e 6c 6f 63 61 6c 73 2c 6c 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 65 28 65 2c 74 2c 6f 2c 6e 2c 72 2c 69 2c 61 29 7b 74 68 69 73 2e 64 69 72 65 63 74 69 6f 6e 3d 22 6c 74 72 22 2c 74 68 69 73 2e 70 72 65 76 69 6f 75 73 46 6f 63 75 73 45 6c 65 6d 65 6e 74 42 65 66 6f 72 65 50 6f 70 75 70 3d 6e 75 6c 6c 2c 74 68 69 73 2e 63 6f 6f 6b 69 Data Ascii: ){return e?e.replace(/&/g,"&").replace(/</g,"<").replace(/>/g,">").replace(/"/g,""").replace(/'/g,"'"):""},e}(),a=n.locals,l=function(){function e(e,t,o,n,r,i,a){this.direction="ltr",this.previousFocusElementBeforePopup=null,this.cooki
2024-07-24 16:53:12 UTC	82	IN	Data Raw: 6f 72 22 5d 2b 22 20 21 69 6d 70 6f 72 74 61 6e 74 3b 5c 6e 20 20 20 20 20 20 20 20 7d 22 2c 74 2b 3d 27 69 6e 70 75 74 5b 74 79 70 65 3d 22 72 61 64 69 6f 22 5d 2e 27 2b 63 2e 63 6f 6f 6b 69 65 49 74 65 6d 52 61 64 69 6f 42 74 6e 2b 22 20 2b 20 Data Ascii: or"]+" !important;\n }",t+='input[type="radio"].'+c.cookieItemRadioBtn+" +
2024-07-24 16:53:12 UTC	16384	IN	Data Raw: 6c 61 62 65 6c 3a 68 6f 76 65 72 3a 3a 61 66 74 65 72 20 7b 5c 6e 20 20 20 20 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 22 2b 65 5b 22 72 61 64 69 6f 2d 62 75 74 74 6f 6e 2d 68 6f 76 65 72 2d 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 22 5d 2b 22 20 21 69 6d 70 6f 72 74 61 6e 74 3b 5c 6e 20 20 20 20 20 20 20 20 7d 22 2c 74 2b 3d 27 69 6e 70 75 74 5b 74 79 70 65 3d 22 72 61 64 69 6f 22 5d 2e 27 2b 63 2e 63 6f 6f 6b 69 65 49 74 65 6d 52 61 64 69 6f 42 74 6e 2b 22 20 2b 20 6c 61 62 65 6c 3a 66 6f 63 75 73 3a 3a 62 65 66 6f 72 65 20 7b 5c 6e 20 20 20 20 20 20 20 20 20 20 20 20 62 6f 72 64 65 72 3a 20 31 70 78 20 73 6f 6c 69 64 20 22 2b 65 5b 22 72 61 64 69 6f 2d 62 75 74 74 6f 6e 2d 68 6f 76 65 72 2d 62 6f 72 64 65 72 Data Ascii: label:hover::after {\n background-color: "+e["radio-button-hover-background-color"]+" !important;\n }",t+='input[type="radio"].'+c.cookieItemRadioBtn+" + label:focus::before {\n border: 1px solid "+e["radio-button-hover-border
2024-07-24 16:53:12 UTC	4196	IN	Data Raw: 2e 6c 65 6e 67 74 68 3b 6f 2b 2b 29 74 5b 6f 2d 31 5d 3d 61 72 67 75 6d 65 6e 74 73 5b 6f 5d 3b 76 61 72 20 6e 3d 74 68 69 73 2e 65 76 65 6e 74 73 5b 65 5d 3b 6e 26 26 6e 2e 66 6f 72 45 61 63 68 28 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 2e 61 70 70 6c 79 28 6e 75 6c 6c 2c 74 29 7d 29 29 7d 2c 65 2e 70 72 6f 74 6f 74 79 70 65 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6f 29 7b 65 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 3f 65 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 74 2c 6f 29 3a 65 2e 61 74 74 61 63 68 45 76 65 6e 74 28 22 6f 6e 22 2b 74 2c 28 66 75 6e 63 74 69 6f 6e 28 29 7b 6f 2e 63 61 6c 6c 28 65 29 7d 29 29 7d 2c 65 2e 63 6f 6f 6b 69 65 4e 61 6d 65 3d 22 4d 53 43 43 22 2c 65 Data Ascii: .length;o++)t[o-1]=arguments[o];var n=this.events[e];n&&n.forEach((function(e){e.apply(null,t)}))},e.prototype.addEventListener=function(e,t,o){e.addEventListener?e.addEventListener(t,o):e.attachEvent("on"+t,(function(){o.call(e)}))},e.cookieName="MSCC",e

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49725	13.107.246.60	443	2820	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-24 16:53:12 UTC	370	OUT	GET /scripts/c/ms.jsll-4.min.js HTTP/1.1 Host: js.monitor.azure.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-07-24 16:53:12 UTC	958	IN	HTTP/1.1 200 OK Date: Wed, 24 Jul 2024 16:53:12 GMT Content-Type: text/javascript; charset=utf-8 Content-Length: 206998 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: no-transform, public, max-age=1800, immutable Last-Modified: Mon, 15 Jul 2024 17:38:35 GMT ETag: 0x8DCA4F4F47351DF x-ms-request-id: bd54a350-101e-00a5-0729-dd7893000000 x-ms-version: 2009-09-19 x-ms-meta-jssdkver: 4.3.0 x-ms-meta-jssdksrc: [cdn]/scripts/c/ms.jsll-4.3.0.min.js Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,x-ms-meta-jssdkver,x-ms-meta-jssdksrc,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240724T165312Z-15b94bb6ff9l5m7947zaw26eh8000000029g0000000049qd x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-07-24 16:53:12 UTC	15426	IN	Data Raw: 2f 2a 21 0a 20 2a 20 31 44 53 20 4a 53 4c 4c 20 53 4b 55 2c 20 34 2e 33 2e 30 0a 20 2a 20 43 6f 70 79 72 69 67 68 74 20 28 63 29 20 4d 69 63 72 6f 73 6f 66 74 20 61 6e 64 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 2e 20 41 6c 6c 20 72 69 67 68 74 73 20 72 65 73 65 72 76 65 64 2e 0a 20 2a 20 28 4d 69 63 72 6f 73 6f 66 74 20 49 6e 74 65 72 6e 61 6c 20 4f 6e 6c 79 29 0a 20 2a 2f 0a 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 76 61 72 20 6e 3d 22 75 6e 64 65 66 69 6e 65 64 22 3b 69 66 28 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 65 78 70 6f 72 74 73 26 26 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 21 3d 6e 29 74 28 65 78 70 6f 72 74 73 29 3b 65 6c 73 65 20 69 66 28 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 64 65 66 69 6e 65 26 26 64 65 66 69 Data Ascii: /! 1DS JSLL SKU, 4.3.0 * Copyright (c) Microsoft and contributors. All rights reserved. * (Microsoft Internal Only) */!function(e,t){var n="undefined";if("object"==typeof exports&&typeof module!=n)t(exports);else if("function"==typeof define&&defi
2024-07-24 16:53:12 UTC	16384	IN	Data Raw: 66 65 28 22 63 6f 6e 73 6f 6c 65 22 29 29 26 26 28 72 2e 65 72 72 6f 72 7c 7c 72 2e 6c 6f 67 29 28 74 2c 61 65 28 69 29 29 29 29 7d 78 65 28 61 3d 7b 74 68 65 6e 3a 6f 2c 22 63 61 74 63 68 22 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 6f 28 75 6e 64 65 66 69 6e 65 64 2c 65 29 7d 2c 22 66 69 6e 61 6c 6c 79 22 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 61 72 20 65 3d 74 2c 6e 3d 74 3b 72 65 74 75 72 6e 20 51 28 74 29 26 26 28 65 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 74 26 26 74 28 29 2c 65 7d 2c 6e 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 74 68 72 6f 77 20 74 26 26 74 28 29 2c 65 7d 29 2c 6f 28 65 2c 6e 29 7d 7d 2c 22 73 74 61 74 65 22 2c 7b 67 65 74 3a 64 7d 29 2c 6d 74 28 29 26 26 28 61 5b 79 74 28 31 31 29 5d 3d 22 49 Data Ascii: fe("console"))&&(r.error\|\|r.log)(t,ae(i))))}xe(a={then:o,"catch":function(e){return o(undefined,e)},"finally":function(t){var e=t,n=t;return Q(t)&&(e=function(e){return t&&t(),e},n=function(e){throw t&&t(),e}),o(e,n)}},"state",{get:d}),mt()&&(a[yt(11)]="I
2024-07-24 16:53:12 UTC	16384	IN	Data Raw: 2c 6e 2e 68 3d 6e 2e 68 7c 7c 72 6e 28 73 63 2c 30 2c 6e 29 29 3a 4c 28 72 2c 5b 65 5d 29 29 7d 29 7d 64 63 2e 5f 5f 69 65 44 79 6e 3d 31 3b 76 61 72 20 66 63 3d 64 63 3b 66 75 6e 63 74 69 6f 6e 20 64 63 28 65 29 7b 74 68 69 73 2e 6c 69 73 74 65 6e 65 72 73 3d 5b 5d 3b 76 61 72 20 6e 2c 69 3d 5b 5d 2c 61 3d 7b 68 3a 6e 75 6c 6c 2c 63 62 3a 5b 5d 7d 2c 6f 3d 6c 6f 28 65 2c 75 63 29 5b 47 6e 5d 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 6e 3d 21 21 65 2e 63 66 67 2e 70 65 72 66 45 76 74 73 53 65 6e 64 41 6c 6c 7d 29 3b 76 65 28 64 63 2c 74 68 69 73 2c 66 75 6e 63 74 69 6f 6e 28 65 29 7b 59 28 65 2c 22 6c 69 73 74 65 6e 65 72 73 22 2c 7b 67 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 69 7d 7d 29 2c 65 5b 74 72 5d 3d 66 75 6e 63 74 69 6f 6e 28 65 29 Data Ascii: ,n.h=n.h\|\|rn(sc,0,n)):L(r,[e]))})}dc.__ieDyn=1;var fc=dc;function dc(e){this.listeners=[];var n,i=[],a={h:null,cb:[]},o=lo(e,uc)[Gn](function(e){n=!!e.cfg.perfEvtsSendAll});ve(dc,this,function(e){Y(e,"listeners",{g:function(){return i}}),e[tr]=function(e)
2024-07-24 16:53:12 UTC	16384	IN	Data Raw: 28 61 29 7d 2c 36 2c 6e 29 2c 69 7d 2c 66 5b 63 72 5d 3d 73 2c 66 2e 61 64 64 50 6c 75 67 69 6e 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 2c 72 29 7b 69 66 28 21 65 29 72 65 74 75 72 6e 20 72 26 26 72 28 21 31 29 2c 76 6f 69 64 20 43 28 6e 75 29 3b 76 61 72 20 69 3d 73 28 65 5b 5a 6e 5d 29 3b 69 66 28 69 26 26 21 74 29 72 65 74 75 72 6e 20 72 26 26 72 28 21 31 29 2c 76 6f 69 64 20 43 28 22 50 6c 75 67 69 6e 20 5b 22 2b 65 5b 5a 6e 5d 2b 22 5d 20 69 73 20 61 6c 72 65 61 64 79 20 6c 6f 61 64 65 64 21 22 29 3b 76 61 72 20 61 2c 6f 3d 7b 72 65 61 73 6f 6e 3a 31 36 7d 3b 66 75 6e 63 74 69 6f 6e 20 63 28 29 7b 41 5b 74 65 5d 28 65 29 2c 6f 2e 61 64 64 65 64 3d 5b 65 5d 2c 67 28 6f 29 2c 72 26 26 72 28 21 30 29 7d 69 3f 76 28 61 3d 5b 69 2e 70 6c 75 67 69 6e Data Ascii: (a)},6,n),i},f[cr]=s,f.addPlugin=function(e,t,n,r){if(!e)return r&&r(!1),void C(nu);var i=s(e[Zn]);if(i&&!t)return r&&r(!1),void C("Plugin ["+e[Zn]+"] is already loaded!");var a,o={reason:16};function c(){A[te](e),o.added=[e],g(o),r&&r(!0)}i?v(a=[i.plugin
2024-07-24 16:53:12 UTC	16384	IN	Data Raw: 73 5d 28 29 2c 6e 3d 66 65 28 65 3d 3d 3d 43 6c 2e 4c 6f 63 61 6c 53 74 6f 72 61 67 65 3f 22 6c 6f 63 61 6c 53 74 6f 72 61 67 65 22 3a 22 73 65 73 73 69 6f 6e 53 74 6f 72 61 67 65 22 29 2c 72 3d 54 6c 2b 74 2c 69 3d 28 6e 2e 73 65 74 49 74 65 6d 28 72 2c 74 29 2c 6e 2e 67 65 74 49 74 65 6d 28 72 29 21 3d 3d 74 29 3b 69 66 28 6e 5b 77 73 5d 28 72 29 2c 21 69 29 72 65 74 75 72 6e 20 6e 7d 63 61 74 63 68 28 61 29 7b 7d 72 65 74 75 72 6e 20 6e 75 6c 6c 7d 66 75 6e 63 74 69 6f 6e 20 45 6c 28 29 7b 72 65 74 75 72 6e 20 5f 6c 28 29 3f 49 6c 28 43 6c 2e 53 65 73 73 69 6f 6e 53 74 6f 72 61 67 65 29 3a 6e 75 6c 6c 7d 66 75 6e 63 74 69 6f 6e 20 5f 6c 28 65 29 7b 72 65 74 75 72 6e 20 62 6c 3d 65 7c 7c 62 6c 3d 3d 3d 75 6e 64 65 66 69 6e 65 64 3f 21 21 49 6c 28 43 6c Data Ascii: s](),n=fe(e===Cl.LocalStorage?"localStorage":"sessionStorage"),r=Tl+t,i=(n.setItem(r,t),n.getItem(r)!==t);if(n[ws](r),!i)return n}catch(a){}return null}function El(){return _l()?Il(Cl.SessionStorage):null}function _l(e){return bl=e\|\|bl===undefined?!!Il(Cl
2024-07-24 16:53:12 UTC	16384	IN	Data Raw: 72 6e 20 6f 7d 7d 29 2c 59 28 65 2c 22 70 61 67 65 56 69 73 69 74 54 69 6d 65 54 72 61 63 6b 69 6e 67 48 61 6e 64 6c 65 72 22 2c 7b 67 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 63 7d 7d 29 7d 29 7d 76 61 72 20 45 64 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 74 68 69 73 5b 6c 64 5d 3d 4f 74 28 29 2c 74 68 69 73 2e 70 61 67 65 4e 61 6d 65 3d 65 2c 74 68 69 73 2e 70 61 67 65 55 72 6c 3d 74 7d 2c 5f 64 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 65 29 7b 76 61 72 20 6f 3d 74 68 69 73 2c 63 3d 7b 7d 3b 6f 2e 73 74 61 72 74 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 63 5b 65 5d 26 26 6d 65 28 61 2c 32 2c 36 32 2c 22 73 74 61 72 74 20 77 61 73 20 63 61 6c 6c 65 64 20 6d 6f 72 65 20 74 68 61 6e 20 Data Ascii: rn o}}),Y(e,"pageVisitTimeTrackingHandler",{g:function(){return c}})})}var Ed=function(e,t){this[ld]=Ot(),this.pageName=e,this.pageUrl=t},_d=function(a,e){var o=this,c={};o.start=function(e){"undefined"!=typeof c[e]&&me(a,2,62,"start was called more than
2024-07-24 16:53:12 UTC	16384	IN	Data Raw: 61 67 73 3d 6d 73 28 21 30 2c 6e 2e 5f 70 61 67 65 54 61 67 73 2c 74 2e 70 61 67 65 54 61 67 73 29 29 2c 65 2e 70 72 6f 70 65 72 74 69 65 73 3d 65 2e 70 72 6f 70 65 72 74 69 65 73 7c 7c 7b 7d 2c 65 2e 70 72 6f 70 65 72 74 69 65 73 2e 70 61 67 65 54 61 67 73 3d 6e 2e 5f 70 61 67 65 54 61 67 73 7d 2c 65 70 2e 70 72 6f 74 6f 74 79 70 65 2e 5f 67 65 74 42 65 68 61 76 69 6f 72 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3b 72 65 74 75 72 6e 20 65 26 26 63 65 28 65 2e 62 65 68 61 76 69 6f 72 29 3f 74 3d 65 2e 62 65 68 61 76 69 6f 72 3a 63 65 28 74 68 69 73 2e 5f 62 65 68 61 76 69 6f 72 4d 65 74 61 54 61 67 29 26 26 28 74 3d 74 68 69 73 2e 5f 62 65 68 61 76 69 6f 72 4d 65 74 61 54 61 67 29 2c 74 68 69 73 2e 5f 67 65 74 56 61 6c 69 64 42 65 68 61 76 69 Data Ascii: ags=ms(!0,n._pageTags,t.pageTags)),e.properties=e.properties\|\|{},e.properties.pageTags=n._pageTags},ep.prototype._getBehavior=function(e){var t;return e&&ce(e.behavior)?t=e.behavior:ce(this._behaviorMetaTag)&&(t=this._behaviorMetaTag),this._getValidBehavi
2024-07-24 16:53:12 UTC	16384	IN	Data Raw: 6d 65 73 2e 63 6f 6e 74 65 6e 74 4e 61 6d 65 29 3b 72 26 26 28 61 5b 74 5d 3d 72 29 2c 69 26 26 28 61 5b 6e 5d 3d 69 29 7d 72 65 74 75 72 6e 20 61 7d 2c 53 70 29 3b 66 75 6e 63 74 69 6f 6e 20 53 70 28 65 2c 74 29 7b 74 68 69 73 2e 5f 63 6f 6e 66 69 67 3d 65 2c 74 68 69 73 2e 5f 74 72 61 63 65 4c 6f 67 67 65 72 3d 74 2c 74 68 69 73 2e 5f 63 6f 6e 74 65 6e 74 42 6c 6f 62 46 69 65 6c 64 4e 61 6d 65 73 3d 6e 75 6c 6c 2c 74 68 69 73 2e 5f 63 6f 6e 74 65 6e 74 42 6c 6f 62 46 69 65 6c 64 4e 61 6d 65 73 3d 21 30 3d 3d 3d 74 68 69 73 2e 5f 63 6f 6e 66 69 67 2e 75 73 65 53 68 6f 72 74 4e 61 6d 65 46 6f 72 43 6f 6e 74 65 6e 74 42 6c 6f 62 3f 54 70 2e 73 68 6f 72 74 4e 61 6d 65 73 3a 54 70 2e 6c 6f 6e 67 4e 61 6d 65 73 7d 76 61 72 20 78 70 2c 4e 70 3d 48 65 28 7b 75 Data Ascii: mes.contentName);r&&(a[t]=r),i&&(a[n]=i)}return a},Sp);function Sp(e,t){this._config=e,this._traceLogger=t,this._contentBlobFieldNames=null,this._contentBlobFieldNames=!0===this._config.useShortNameForContentBlob?Tp.shortNames:Tp.longNames}var xp,Np=He({u
2024-07-24 16:53:12 UTC	16384	IN	Data Raw: 67 3d 22 73 65 6e 64 54 79 70 65 22 2c 4b 67 3d 22 61 64 64 48 65 61 64 65 72 22 2c 47 67 3d 22 63 61 6e 53 65 6e 64 52 65 71 75 65 73 74 22 2c 58 67 3d 22 73 65 6e 64 51 75 65 75 65 64 52 65 71 75 65 73 74 73 22 2c 4a 67 3d 22 69 73 43 6f 6d 70 6c 65 74 65 6c 79 49 64 6c 65 22 2c 51 67 3d 22 73 65 74 55 6e 6c 6f 61 64 69 6e 67 22 2c 59 67 3d 22 73 65 6e 64 53 79 6e 63 68 72 6f 6e 6f 75 73 42 61 74 63 68 22 2c 24 67 3d 22 5f 74 72 61 6e 73 70 6f 72 74 22 2c 5a 67 3d 22 67 65 74 57 50 61 72 61 6d 22 2c 65 76 3d 22 69 73 42 65 61 63 6f 6e 22 2c 74 76 3d 22 74 69 6d 69 6e 67 73 22 2c 6e 76 3d 22 69 73 54 65 61 72 64 6f 77 6e 22 2c 72 76 3d 22 69 73 53 79 6e 63 22 2c 69 76 3d 22 64 61 74 61 22 2c 61 76 3d 22 5f 73 65 6e 64 52 65 61 73 6f 6e 22 2c 6f 76 3d 22 Data Ascii: g="sendType",Kg="addHeader",Gg="canSendRequest",Xg="sendQueuedRequests",Jg="isCompletelyIdle",Qg="setUnloading",Yg="sendSynchronousBatch",$g="_transport",Zg="getWParam",ev="isBeacon",tv="timings",nv="isTeardown",rv="isSync",iv="data",av="_sendReason",ov="
2024-07-24 16:53:12 UTC	16384	IN	Data Raw: 28 29 7b 72 65 3d 21 31 2c 61 65 3d 21 28 69 65 3d 5b 5d 29 2c 52 3d 31 65 34 2c 75 65 3d 7b 7d 2c 73 65 3d 59 70 2c 65 65 3d 21 28 46 3d 7b 7d 29 2c 71 3d 42 3d 56 3d 55 3d 63 65 3d 6f 65 3d 30 2c 7a 3d 2d 31 2c 4b 3d 21 28 57 3d 21 28 6a 3d 4c 3d 4d 3d 50 3d 6b 3d 6e 75 6c 6c 29 29 2c 47 3d 36 2c 74 65 3d 4a 3d 6e 75 6c 6c 2c 6e 65 3d 21 28 58 3d 32 29 2c 51 3d 50 76 28 29 2c 48 3d 6e 65 77 20 42 76 28 4f 3d 35 30 30 2c 32 2c 31 2c 7b 72 65 71 75 65 75 65 3a 65 2c 73 65 6e 64 3a 53 2c 73 65 6e 74 3a 78 2c 64 72 6f 70 3a 4e 2c 72 73 70 46 61 69 6c 3a 44 2c 6f 74 68 3a 41 7d 29 2c 74 28 29 2c 46 5b 34 5d 3d 7b 62 61 74 63 68 65 73 3a 5b 5d 2c 69 4b 65 79 4d 61 70 3a 7b 7d 7d 2c 46 5b 33 5d 3d 7b 62 61 74 63 68 65 73 3a 5b 5d 2c 69 4b 65 79 4d 61 70 3a 7b Data Ascii: (){re=!1,ae=!(ie=[]),R=1e4,ue={},se=Yp,ee=!(F={}),q=B=V=U=ce=oe=0,z=-1,K=!(W=!(j=L=M=P=k=null)),G=6,te=J=null,ne=!(X=2),Q=Pv(),H=new Bv(O=500,2,1,{requeue:e,send:S,sent:x,drop:N,rspFail:D,oth:A}),t(),F[4]={batches:[],iKeyMap:{}},F[3]={batches:[],iKeyMap:{

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49726	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-07-24 16:53:12 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-07-24 16:53:13 UTC	466	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF4C) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=83801 Date: Wed, 24 Jul 2024 16:53:12 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49727	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-07-24 16:53:14 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-07-24 16:53:14 UTC	514	IN	HTTP/1.1 200 OK ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=83800 Date: Wed, 24 Jul 2024 16:53:14 GMT Content-Length: 55 Connection: close X-CID: 2
2024-07-24 16:53:14 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49742	13.85.23.86	443

Timestamp	Bytes transferred	Direction	Data
2024-07-24 16:53:20 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=S8+5YrXKhXghv93&MD=EDNDSfnb HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-07-24 16:53:20 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: b7b97a7c-1257-4090-8935-6ca5e2fa5f95 MS-RequestId: c5f01ddc-cf8b-4d0b-b7dd-744aa47b3c63 MS-CV: WKQ5uy+bPE24tRXs.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Wed, 24 Jul 2024 16:53:19 GMT Connection: close Content-Length: 24490
2024-07-24 16:53:20 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-07-24 16:53:20 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	63959	13.85.23.86	443

Timestamp	Bytes transferred	Direction	Data
2024-07-24 16:53:59 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=S8+5YrXKhXghv93&MD=EDNDSfnb HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-07-24 16:53:59 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "vic+p1MiJJ+/WMnK08jaWnCBGDfvkGRzPk9f8ZadQHg=_1440" MS-CorrelationId: 9213f4f6-a151-41dd-a82f-35da47616cf0 MS-RequestId: 5965111b-4062-404b-be1a-d441c520e7c5 MS-CV: 8Zm643HiH0qUnzsz.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Wed, 24 Jul 2024 16:53:59 GMT Connection: close Content-Length: 30005
2024-07-24 16:53:59 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 8d 2b 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 5b 49 00 00 14 00 00 00 00 00 10 00 8d 2b 00 00 a8 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 72 4d 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 fe f6 51 be 21 2b 72 4d 43 4b ed 7c 05 58 54 eb da f6 14 43 49 37 0a 02 d2 b9 86 0e 41 52 a4 1b 24 a5 bb 43 24 44 18 94 90 92 52 41 3a 05 09 95 ee 54 b0 00 91 2e e9 12 10 04 11 c9 6f 10 b7 a2 67 9f bd cf 3e ff b7 ff b3 bf 73 ed e1 9a 99 f5 c6 7a d7 bb de f5 3e cf fd 3c f7 dc 17 4a 1a 52 e7 41 a8 97 1e 14 f4 e5 25 7d f4 05 82 82 c1 20 30 08 06 ba c3 05 02 11 7f a9 c1 ff d2 87 5c 1e f4 ed 65 8e 7a 1f f6 0a 40 03 1d 7b f9 83 2c 1c 2f db b8 3a 39 3a 58 38 ba 73 5e Data Ascii: MSCF+D[I+IdrMenvironment.cabQ!+rMCK\|XTCI7AR$C$DRA:T.og>sz><JRA%} 0\ez@{,/:9:X8s^
2024-07-24 16:53:59 UTC	14181	IN	Data Raw: 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 26 30 24 06 03 55 04 03 13 1d 4d 69 63 72 6f 73 6f 66 74 20 54 69 6d 65 2d 53 74 61 6d 70 20 50 43 41 20 32 30 31 30 30 1e 17 0d 32 33 31 30 31 32 31 39 30 37 32 35 5a 17 0d 32 35 30 31 31 30 31 39 30 37 32 35 5a 30 81 d2 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 2d 30 2b 06 03 55 04 0b 13 24 4d 69 63 72 6f Data Ascii: UUS10UWashington10URedmond10UMicrosoft Corporation1&0$UMicrosoft Time-Stamp PCA 20100231012190725Z250110190725Z010UUS10UWashington10URedmond10UMicrosoft Corporation1-0+U$Micro

Target ID:	0
Start time:	12:52:59
Start date:	24/07/2024
Path:	C:\Users\user\Desktop\7F95320763FDCB0F731CE91FB8E178D4110E10A1D56836F442BA34C6F2A631F6.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\7F95320763FDCB0F731CE91FB8E178D4110E10A1D56836F442BA34C6F2A631F6.exe"
Imagebase:	0x680000
File size:	53'760 bytes
MD5 hash:	1A4AC0F78511C028B51E0B302B080946
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Njrat, Description: Yara detected Njrat, Source: 00000000.00000000.2056954933.0000000000682000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: Windows_Trojan_Njrat_30f3c220, Description: unknown, Source: 00000000.00000000.2056954933.0000000000682000.00000002.00000001.01000000.00000003.sdmp, Author: unknown Rule: njrat1, Description: Identify njRat, Source: 00000000.00000000.2056954933.0000000000682000.00000002.00000001.01000000.00000003.sdmp, Author: Brian Wallace @botnet_hunter
Reputation:	low
Has exited:	true

Target ID:	2
Start time:	12:53:04
Start date:	24/07/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=7F95320763FDCB0F731CE91FB8E178D4110E10A1D56836F442BA34C6F2A631F6.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Target ID:	4
Start time:	12:53:04
Start date:	24/07/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1700 --field-trial-handle=1884,i,637461877397389753,4389975086437105104,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Target ID:	5
Start time:	12:53:07
Start date:	24/07/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=7F95320763FDCB0F731CE91FB8E178D4110E10A1D56836F442BA34C6F2A631F6.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	6
Start time:	12:53:08
Start date:	24/07/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2144 --field-trial-handle=1936,i,10713725616331725220,8343982404964030147,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true