Windows Analysis Report
LisectAVT_2403002C_142.exe

Machine Learning detection for sample

Source: Yara match	File source: LisectAVT_2403002C_142.exe, type: SAMPLE
Source: Yara match	File source: 0.0.LisectAVT_2403002C_142.exe.20000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1379310040.0000000000022000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: LisectAVT_2403002C_142.exe PID: 7492, type: MEMORYSTR

Source: LisectAVT_2403002C_142.exe

Joe Sandbox ML: detected

Source: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=LisectAVT_2403002C_142.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	HTTP Parser: No favicon
Source: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=LisectAVT_2403002C_142.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	HTTP Parser: No favicon

Source: LisectAVT_2403002C_142.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.8:49720 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.8:49727 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.68.123.157:443 -> 192.168.2.8:49760 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.8:60450 version: TLS 1.2

Source: LisectAVT_2403002C_142.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Spreading

Contains functionality to spread to USB devices (.Net source)

Source: LisectAVT_2403002C_142.exe, Usb1.cs

.Net Code: infect

Source: LisectAVT_2403002C_142.exe, 00000000.00000000.1379310040.0000000000022000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: \autorun.inf
Source: LisectAVT_2403002C_142.exe, 00000000.00000000.1379310040.0000000000022000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: [autorun]
Source: LisectAVT_2403002C_142.exe, 00000000.00000000.1379310040.0000000000022000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: autorun.inf
Source: LisectAVT_2403002C_142.exe	Binary or memory string: \autorun.inf
Source: LisectAVT_2403002C_142.exe	Binary or memory string: [autorun]
Source: LisectAVT_2403002C_142.exe	Binary or memory string: autorun.inf

Source: global traffic

TCP traffic: 192.168.2.8:60448 -> 1.1.1.1:53

Source: Joe Sandbox View	IP Address: 13.107.246.42 13.107.246.42
Source: Joe Sandbox View	IP Address: 13.107.253.45 13.107.253.45
Source: Joe Sandbox View	IP Address: 239.255.255.250 239.255.255.250
Source: Joe Sandbox View	IP Address: 13.107.253.42 13.107.253.42

Source: Joe Sandbox View

JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4

Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.143.211
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.226
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.226
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.143.211
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.226
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.226
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.226
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.226
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.214.172

Source: global traffic	HTTP traffic detected: GET /mscc/lib/v2/wcp-consent.js HTTP/1.1Host: wcpstatic.microsoft.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://learn.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /scripts/c/ms.jsll-4.min.js HTTP/1.1Host: js.monitor.azure.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://learn.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /mscc/lib/v2/wcp-consent.js HTTP/1.1Host: wcpstatic.microsoft.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /scripts/c/ms.jsll-4.min.js HTTP/1.1Host: js.monitor.azure.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=3FgPvgo5hwHzvrg&MD=TArSOtKe HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=3FgPvgo5hwHzvrg&MD=TArSOtKe HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com

Source: chromecache_187.5.dr, chromecache_180.5.dr	String found in binary or memory: href="https://www.facebook.com/sharer/sharer.php?u=${s}" equals www.facebook.com (Facebook)
Source: chromecache_187.5.dr, chromecache_180.5.dr	String found in binary or memory: href="https://www.linkedin.com/cws/share?url=${s}" equals www.linkedin.com (Linkedin)
Source: chromecache_187.5.dr, chromecache_180.5.dr	String found in binary or memory: </section>`}function Ise(e=hT,t=Gd){return Ha(UB,e,t)}function Pse(e=TT,t=yT){return Ha(aB,e,t)}var yI=(s=>(s.facebook="facebook",s.twitter="twitter",s.linkedin="linkedin",s.email="email",s.weibo="weibo",s))(yI\|\|{}),xke={facebook:"https://www.facebook.com/sharer/sharer.php?u={url}",twitter:"https://twitter.com/intent/tweet?original_referer={url}&text={achievementCopy}&tw_p=tweetbutton&url={url}",linkedin:"https://www.linkedin.com/feed/?shareActive=true&text={body}",email:"mailto:?subject={subject}&body={body}",weibo:"http://service.weibo.com/share/share.php?title={title}&url={url}"};function ex(e,t,n){let o=encodeURIComponent(t),r=new URL(e);r.hostname="learn.microsoft.com";let s=r.href+=(e.indexOf("?")!==-1?"&":"?")+"WT.mc_id=",i=R.sharingId?`&sharingId=${R.sharingId}`:"";return Object.values(yI).reduce((l,c)=>{if(_.data.isPermissioned)return l[c]="#",l;let u=encodeURIComponent(s+c+i),d=n?.achievementCopyTitle?.overrideTitle??t,p=encodeURIComponent(c8.replace("{achievementTitle}",n?.achievementCopyTitle?.isUnquoted?`${d}`:`"${d}"`)),g={achievementCopy:p,url:u,title:o,body:`${p}${encodeURIComponent(` equals www.facebook.com (Facebook)
Source: chromecache_187.5.dr, chromecache_180.5.dr	String found in binary or memory: </section>`}function Ise(e=hT,t=Gd){return Ha(UB,e,t)}function Pse(e=TT,t=yT){return Ha(aB,e,t)}var yI=(s=>(s.facebook="facebook",s.twitter="twitter",s.linkedin="linkedin",s.email="email",s.weibo="weibo",s))(yI\|\|{}),xke={facebook:"https://www.facebook.com/sharer/sharer.php?u={url}",twitter:"https://twitter.com/intent/tweet?original_referer={url}&text={achievementCopy}&tw_p=tweetbutton&url={url}",linkedin:"https://www.linkedin.com/feed/?shareActive=true&text={body}",email:"mailto:?subject={subject}&body={body}",weibo:"http://service.weibo.com/share/share.php?title={title}&url={url}"};function ex(e,t,n){let o=encodeURIComponent(t),r=new URL(e);r.hostname="learn.microsoft.com";let s=r.href+=(e.indexOf("?")!==-1?"&":"?")+"WT.mc_id=",i=R.sharingId?`&sharingId=${R.sharingId}`:"";return Object.values(yI).reduce((l,c)=>{if(_.data.isPermissioned)return l[c]="#",l;let u=encodeURIComponent(s+c+i),d=n?.achievementCopyTitle?.overrideTitle??t,p=encodeURIComponent(c8.replace("{achievementTitle}",n?.achievementCopyTitle?.isUnquoted?`${d}`:`"${d}"`)),g={achievementCopy:p,url:u,title:o,body:`${p}${encodeURIComponent(` equals www.linkedin.com (Linkedin)
Source: chromecache_187.5.dr, chromecache_180.5.dr	String found in binary or memory: </section>`}function Ise(e=hT,t=Gd){return Ha(UB,e,t)}function Pse(e=TT,t=yT){return Ha(aB,e,t)}var yI=(s=>(s.facebook="facebook",s.twitter="twitter",s.linkedin="linkedin",s.email="email",s.weibo="weibo",s))(yI\|\|{}),xke={facebook:"https://www.facebook.com/sharer/sharer.php?u={url}",twitter:"https://twitter.com/intent/tweet?original_referer={url}&text={achievementCopy}&tw_p=tweetbutton&url={url}",linkedin:"https://www.linkedin.com/feed/?shareActive=true&text={body}",email:"mailto:?subject={subject}&body={body}",weibo:"http://service.weibo.com/share/share.php?title={title}&url={url}"};function ex(e,t,n){let o=encodeURIComponent(t),r=new URL(e);r.hostname="learn.microsoft.com";let s=r.href+=(e.indexOf("?")!==-1?"&":"?")+"WT.mc_id=",i=R.sharingId?`&sharingId=${R.sharingId}`:"";return Object.values(yI).reduce((l,c)=>{if(_.data.isPermissioned)return l[c]="#",l;let u=encodeURIComponent(s+c+i),d=n?.achievementCopyTitle?.overrideTitle??t,p=encodeURIComponent(c8.replace("{achievementTitle}",n?.achievementCopyTitle?.isUnquoted?`${d}`:`"${d}"`)),g={achievementCopy:p,url:u,title:o,body:`${p}${encodeURIComponent(` equals www.twitter.com (Twitter)

Source: global traffic	DNS traffic detected: DNS query: mdec.nelreports.net
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: js.monitor.azure.com

Source: chromecache_187.5.dr, chromecache_180.5.dr	String found in binary or memory: http://polymer.github.io/AUTHORS.txt
Source: chromecache_187.5.dr, chromecache_180.5.dr	String found in binary or memory: http://polymer.github.io/CONTRIBUTORS.txt
Source: chromecache_187.5.dr, chromecache_180.5.dr	String found in binary or memory: http://polymer.github.io/LICENSE.txt
Source: chromecache_187.5.dr, chromecache_180.5.dr	String found in binary or memory: http://polymer.github.io/PATENTS.txt
Source: chromecache_162.5.dr	String found in binary or memory: http://schema.org/Organization
Source: chromecache_162.5.dr	String found in binary or memory: https://aka.ms/ContentUserFeedback
Source: chromecache_161.5.dr, chromecache_159.5.dr	String found in binary or memory: https://aka.ms/DP600/Plan/LearnT2?ocid=fabric24-dp600plan_learnpromo_T2_ad
Source: chromecache_161.5.dr, chromecache_159.5.dr	String found in binary or memory: https://aka.ms/LFO_Events?wt.mc_id=esi_lfobannerevents_webpage_wwl
Source: chromecache_187.5.dr, chromecache_180.5.dr	String found in binary or memory: https://aka.ms/certhelp
Source: chromecache_162.5.dr	String found in binary or memory: https://aka.ms/feedback/report?space=61
Source: chromecache_187.5.dr, chromecache_180.5.dr	String found in binary or memory: https://aka.ms/pshelpmechoose
Source: chromecache_162.5.dr	String found in binary or memory: https://aka.ms/yourcaliforniaprivacychoices
Source: chromecache_162.5.dr	String found in binary or memory: https://authoring-docs-microsoft.poolparty.biz/devrel/69c76c32-967e-4c65-b89a-74cc527db725
Source: chromecache_162.5.dr	String found in binary or memory: https://authoring-docs-microsoft.poolparty.biz/devrel/7696cda6-0510-47f6-8302-71bb5d2e28cf
Source: chromecache_187.5.dr, chromecache_180.5.dr	String found in binary or memory: https://aznb-ame-prod.azureedge.net/component/$
Source: chromecache_180.5.dr	String found in binary or memory: https://channel9.msdn.com/
Source: chromecache_187.5.dr, chromecache_180.5.dr	String found in binary or memory: https://client-api.arkoselabs.com/v2/api.js
Source: chromecache_187.5.dr, chromecache_180.5.dr	String found in binary or memory: https://github.com/$
Source: chromecache_162.5.dr	String found in binary or memory: https://github.com/Thraka
Source: chromecache_162.5.dr	String found in binary or memory: https://github.com/Youssef1313
Source: chromecache_162.5.dr	String found in binary or memory: https://github.com/adegeo
Source: chromecache_162.5.dr	String found in binary or memory: https://github.com/dotnet/docs/blob/17c4acca45e573a92878a44a2cce57d699fe9c7c/docs/framework/install/
Source: chromecache_162.5.dr	String found in binary or memory: https://github.com/dotnet/docs/blob/live/docs/framework/install/application-not-started.md
Source: chromecache_162.5.dr	String found in binary or memory: https://github.com/dotnet/docs/blob/main/docs/framework/install/application-not-started.md
Source: chromecache_162.5.dr	String found in binary or memory: https://github.com/dotnet/docs/issues
Source: chromecache_162.5.dr	String found in binary or memory: https://github.com/dotnet/docs/issues/new?template=z-customer-feedback.yml
Source: chromecache_187.5.dr, chromecache_180.5.dr	String found in binary or memory: https://github.com/dotnet/try
Source: chromecache_162.5.dr	String found in binary or memory: https://github.com/gewarren
Source: chromecache_187.5.dr, chromecache_180.5.dr	String found in binary or memory: https://github.com/jonschlinkert/is-plain-object
Source: chromecache_187.5.dr, chromecache_180.5.dr	String found in binary or memory: https://github.com/js-cookie/js-cookie
Source: chromecache_162.5.dr	String found in binary or memory: https://github.com/mairaw
Source: chromecache_162.5.dr	String found in binary or memory: https://github.com/nschonni
Source: chromecache_162.5.dr	String found in binary or memory: https://js.monitor.azure.com/scripts/c/ms.jsll-4.min.js
Source: chromecache_187.5.dr, chromecache_180.5.dr	String found in binary or memory: https://learn-video.azurefd.net/
Source: chromecache_187.5.dr, chromecache_180.5.dr	String found in binary or memory: https://learn-video.azurefd.net/vod/player
Source: chromecache_187.5.dr, chromecache_180.5.dr	String found in binary or memory: https://management.azure.com/providers/Microsoft.Portal/consoles/default?api-version=2017-12-01-prev
Source: chromecache_187.5.dr, chromecache_180.5.dr	String found in binary or memory: https://management.azure.com/providers/Microsoft.Portal/userSettings/cloudconsole?api-version=2017-0
Source: chromecache_187.5.dr, chromecache_180.5.dr	String found in binary or memory: https://management.azure.com/subscriptions?api-version=2016-06-01
Source: chromecache_187.5.dr, chromecache_180.5.dr	String found in binary or memory: https://octokit.github.io/rest.js/#throttling
Source: chromecache_180.5.dr	String found in binary or memory: https://schema.org
Source: chromecache_187.5.dr, chromecache_180.5.dr	String found in binary or memory: https://twitter.com/intent/tweet?original_referer=$
Source: chromecache_187.5.dr, chromecache_180.5.dr	String found in binary or memory: https://www.linkedin.com/cws/share?url=$

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49676 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60453
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60450
Source: unknown	Network traffic detected: HTTP traffic on port 60450 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49671 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60453 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.8:49720 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.8:49727 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.68.123.157:443 -> 192.168.2.8:49760 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.8:60450 version: TLS 1.2

E-Banking Fraud

Malicious sample detected (through community Yara rule)

Source: Yara match	File source: LisectAVT_2403002C_142.exe, type: SAMPLE
Source: Yara match	File source: 0.0.LisectAVT_2403002C_142.exe.20000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1379310040.0000000000022000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: LisectAVT_2403002C_142.exe PID: 7492, type: MEMORYSTR

System Summary

Source: LisectAVT_2403002C_142.exe, type: SAMPLE	Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: LisectAVT_2403002C_142.exe, type: SAMPLE	Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: LisectAVT_2403002C_142.exe, type: SAMPLE	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: 0.0.LisectAVT_2403002C_142.exe.20000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 0.0.LisectAVT_2403002C_142.exe.20000.0.unpack, type: UNPACKEDPE	Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: 0.0.LisectAVT_2403002C_142.exe.20000.0.unpack, type: UNPACKEDPE	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: 00000000.00000000.1379310040.0000000000022000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 00000000.00000000.1379310040.0000000000022000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group

PE file contains section with special chars

Source: LisectAVT_2403002C_142.exe

Static PE information: section name: >|u

Source: LisectAVT_2403002C_142.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: LisectAVT_2403002C_142.exe, type: SAMPLE	Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: LisectAVT_2403002C_142.exe, type: SAMPLE	Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: LisectAVT_2403002C_142.exe, type: SAMPLE	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: 0.0.LisectAVT_2403002C_142.exe.20000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: 0.0.LisectAVT_2403002C_142.exe.20000.0.unpack, type: UNPACKEDPE	Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: 0.0.LisectAVT_2403002C_142.exe.20000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: 00000000.00000000.1379310040.0000000000022000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: 00000000.00000000.1379310040.0000000000022000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan

Source: classification engine

Classification label: mal100.spre.troj.evad.winEXE@29/67@10/6

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Jump to behavior

Source: LisectAVT_2403002C_142.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 50.01%

Source: C:\Users\user\Desktop\LisectAVT_2403002C_142.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: LisectAVT_2403002C_142.exe

ReversingLabs: Detection: 97%

Source: unknown	Process created: C:\Users\user\Desktop\LisectAVT_2403002C_142.exe "C:\Users\user\Desktop\LisectAVT_2403002C_142.exe"
Source: C:\Users\user\Desktop\LisectAVT_2403002C_142.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=LisectAVT_2403002C_142.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 --field-trial-handle=1904,i,3045040594546194306,8046493471930814901,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Users\user\Desktop\LisectAVT_2403002C_142.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=LisectAVT_2403002C_142.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2128 --field-trial-handle=1888,i,6999489819283979014,13540749176578719827,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Users\user\Desktop\LisectAVT_2403002C_142.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=LisectAVT_2403002C_142.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002C_142.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=LisectAVT_2403002C_142.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 --field-trial-handle=1904,i,3045040594546194306,8046493471930814901,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2128 --field-trial-handle=1888,i,6999489819283979014,13540749176578719827,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior

Source: C:\Users\user\Desktop\LisectAVT_2403002C_142.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002C_142.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002C_142.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002C_142.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002C_142.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002C_142.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002C_142.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002C_142.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002C_142.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002C_142.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002C_142.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002C_142.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002C_142.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002C_142.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002C_142.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002C_142.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002C_142.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002C_142.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002C_142.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002C_142.exe	Section loaded: windows.shell.servicehostbuilder.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002C_142.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002C_142.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002C_142.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002C_142.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002C_142.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002C_142.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002C_142.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002C_142.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002C_142.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002C_142.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002C_142.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002C_142.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002C_142.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002C_142.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002C_142.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002C_142.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002C_142.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002C_142.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002C_142.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002C_142.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002C_142.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002C_142.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002C_142.exe	Section loaded: wkscli.dll	Jump to behavior

Source: C:\Users\user\Desktop\LisectAVT_2403002C_142.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\InProcServer32

Jump to behavior

Source: Google Drive.lnk.3.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.3.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.3.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.3.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.3.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.3.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: LisectAVT_2403002C_142.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: LisectAVT_2403002C_142.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Data Obfuscation

.NET source code contains potential unpacker

Source: LisectAVT_2403002C_142.exe, Fransesco.cs

.Net Code: Plugin System.Reflection.Assembly.Load(byte[])

Source: initial sample

Static PE information: section where entry point is pointing to: >|u

Source: LisectAVT_2403002C_142.exe

Static PE information: section name: >|u

Source: LisectAVT_2403002C_142.exe

Static PE information: section name: >|u entropy: 6.934439630498995

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Source: LisectAVT_2403002C_142.exe, 00000000.00000002.1546170095.00000000006ED000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\\?\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\
Source: LisectAVT_2403002C_142.exe, 00000000.00000002.1546170095.00000000006ED000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\

Source: C:\Users\user\Desktop\LisectAVT_2403002C_142.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=LisectAVT_2403002C_142.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0			Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002C_142.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=LisectAVT_2403002C_142.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0			Jump to behavior

Source: LisectAVT_2403002C_142.exe	Binary or memory string: Shell_traywnd+MostrarBarraDeTarefas
Source: LisectAVT_2403002C_142.exe	Binary or memory string: Shell_TrayWnd
Source: LisectAVT_2403002C_142.exe	Binary or memory string: ProgMan

Lowering of HIPS / PFW / Operating System Security Settings

Contains functionality to disable the Task Manager (.Net Source)

Source: LisectAVT_2403002C_142.exe, Fransesco.cs

.Net Code: INS

Stealing of Sensitive Information

Source: Yara match	File source: LisectAVT_2403002C_142.exe, type: SAMPLE
Source: Yara match	File source: 0.0.LisectAVT_2403002C_142.exe.20000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1379310040.0000000000022000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: LisectAVT_2403002C_142.exe PID: 7492, type: MEMORYSTR

Remote Access Functionality

Source: Yara match	File source: LisectAVT_2403002C_142.exe, type: SAMPLE
Source: Yara match	File source: 0.0.LisectAVT_2403002C_142.exe.20000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1379310040.0000000000022000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: LisectAVT_2403002C_142.exe PID: 7492, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	11 Replication Through Removable Media	Windows Management Instrumentation	1 Registry Run Keys / Startup Folder	12 Process Injection	1 Masquerading	OS Credential Dumping	1 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 DLL Side-Loading	1 Registry Run Keys / Startup Folder	1 Disable or Modify Tools	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	Data from Removable Media	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	12 Process Injection	Security Account Manager	1 Peripheral Device Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	1 System Information Discovery	Distributed Component Object Model	Input Capture	3 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	11 Software Packing	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label
LisectAVT_2403002C_142.exe	97%	ReversingLabs	Win32.Virus.Jadtre
LisectAVT_2403002C_142.exe	100%	Avira	W32/Jadtre.B
LisectAVT_2403002C_142.exe	100%	Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
http://polymer.github.io/PATENTS.txt	0%	URL Reputation	safe
https://schema.org	0%	URL Reputation	safe
http://polymer.github.io/LICENSE.txt	0%	URL Reputation	safe
http://polymer.github.io/AUTHORS.txt	0%	URL Reputation	safe
https://aka.ms/yourcaliforniaprivacychoices	0%	URL Reputation	safe
http://schema.org/Organization	0%	URL Reputation	safe
http://polymer.github.io/CONTRIBUTORS.txt	0%	URL Reputation	safe
https://github.com/dotnet/docs/blob/live/docs/framework/install/application-not-started.md	0%	Avira URL Cloud	safe
https://management.azure.com/providers/Microsoft.Portal/consoles/default?api-version=2017-12-01-prev	0%	Avira URL Cloud	safe
https://github.com/dotnet/docs/blob/17c4acca45e573a92878a44a2cce57d699fe9c7c/docs/framework/install/	0%	Avira URL Cloud	safe
https://github.com/dotnet/docs/issues	0%	Avira URL Cloud	safe
https://github.com/Thraka	0%	Avira URL Cloud	safe
https://client-api.arkoselabs.com/v2/api.js	0%	Avira URL Cloud	safe
https://authoring-docs-microsoft.poolparty.biz/devrel/69c76c32-967e-4c65-b89a-74cc527db725	0%	Avira URL Cloud	safe
https://authoring-docs-microsoft.poolparty.biz/devrel/7696cda6-0510-47f6-8302-71bb5d2e28cf	0%	Avira URL Cloud	safe
https://aka.ms/certhelp	0%	Avira URL Cloud	safe
https://github.com/dotnet/docs/issues/new?template=z-customer-feedback.yml	0%	Avira URL Cloud	safe
https://www.linkedin.com/cws/share?url=$	0%	Avira URL Cloud	safe
https://aka.ms/ContentUserFeedback	0%	Avira URL Cloud	safe
https://github.com/nschonni	0%	Avira URL Cloud	safe
https://github.com/Youssef1313	0%	Avira URL Cloud	safe
https://management.azure.com/subscriptions?api-version=2016-06-01	0%	Avira URL Cloud	safe
https://github.com/mairaw	0%	Avira URL Cloud	safe
https://js.monitor.azure.com/scripts/c/ms.jsll-4.min.js	0%	Avira URL Cloud	safe
https://aka.ms/DP600/Plan/LearnT2?ocid=fabric24-dp600plan_learnpromo_T2_ad	0%	Avira URL Cloud	safe
https://github.com/adegeo	0%	Avira URL Cloud	safe
https://aka.ms/pshelpmechoose	0%	Avira URL Cloud	safe
https://github.com/dotnet/docs/blob/main/docs/framework/install/application-not-started.md	0%	Avira URL Cloud	safe
https://octokit.github.io/rest.js/#throttling	0%	Avira URL Cloud	safe
https://aka.ms/feedback/report?space=61	0%	Avira URL Cloud	safe
https://github.com/$	0%	Avira URL Cloud	safe
https://github.com/js-cookie/js-cookie	0%	Avira URL Cloud	safe
https://twitter.com/intent/tweet?original_referer=$	0%	Avira URL Cloud	safe
https://learn-video.azurefd.net/vod/player	0%	Avira URL Cloud	safe
https://management.azure.com/providers/Microsoft.Portal/userSettings/cloudconsole?api-version=2017-0	0%	Avira URL Cloud	safe
https://github.com/gewarren	0%	Avira URL Cloud	safe
https://channel9.msdn.com/	0%	Avira URL Cloud	safe
https://learn-video.azurefd.net/	0%	Avira URL Cloud	safe
https://github.com/dotnet/try	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
s-part-0014.t-0009.t-msedge.net	13.107.246.42	true	false	unknown
s-part-0014.t-0009.fb-t-msedge.net	13.107.253.42	true	false	unknown
s-part-0017.t-0009.fb-t-msedge.net	13.107.253.45	true	false	unknown
www.google.com	172.217.18.4	true	false	unknown
js.monitor.azure.com	unknown	unknown	true	unknown
mdec.nelreports.net	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://js.monitor.azure.com/scripts/c/ms.jsll-4.min.js	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://authoring-docs-microsoft.poolparty.biz/devrel/7696cda6-0510-47f6-8302-71bb5d2e28cf	chromecache_162.5.dr	false	Avira URL Cloud: safe	unknown
https://github.com/dotnet/docs/blob/live/docs/framework/install/application-not-started.md	chromecache_162.5.dr	false	Avira URL Cloud: safe	unknown
https://authoring-docs-microsoft.poolparty.biz/devrel/69c76c32-967e-4c65-b89a-74cc527db725	chromecache_162.5.dr	false	Avira URL Cloud: safe	unknown
https://client-api.arkoselabs.com/v2/api.js	chromecache_187.5.dr, chromecache_180.5.dr	false	Avira URL Cloud: safe	unknown
https://management.azure.com/providers/Microsoft.Portal/consoles/default?api-version=2017-12-01-prev	chromecache_187.5.dr, chromecache_180.5.dr	false	Avira URL Cloud: safe	unknown
https://github.com/Thraka	chromecache_162.5.dr	false	Avira URL Cloud: safe	unknown
https://github.com/dotnet/docs/issues	chromecache_162.5.dr	false	Avira URL Cloud: safe	unknown
http://polymer.github.io/PATENTS.txt	chromecache_187.5.dr, chromecache_180.5.dr	false	URL Reputation: safe	unknown
https://aka.ms/LFO_Events?wt.mc_id=esi_lfobannerevents_webpage_wwl	chromecache_161.5.dr, chromecache_159.5.dr	false		unknown
https://aka.ms/certhelp	chromecache_187.5.dr, chromecache_180.5.dr	false	Avira URL Cloud: safe	unknown
https://github.com/dotnet/docs/blob/17c4acca45e573a92878a44a2cce57d699fe9c7c/docs/framework/install/	chromecache_162.5.dr	false	Avira URL Cloud: safe	unknown
https://www.linkedin.com/cws/share?url=$	chromecache_187.5.dr, chromecache_180.5.dr	false	Avira URL Cloud: safe	unknown
https://aka.ms/ContentUserFeedback	chromecache_162.5.dr	false	Avira URL Cloud: safe	unknown
https://github.com/mairaw	chromecache_162.5.dr	false	Avira URL Cloud: safe	unknown
https://schema.org	chromecache_180.5.dr	false	URL Reputation: safe	unknown
http://polymer.github.io/LICENSE.txt	chromecache_187.5.dr, chromecache_180.5.dr	false	URL Reputation: safe	unknown
https://github.com/Youssef1313	chromecache_162.5.dr	false	Avira URL Cloud: safe	unknown
http://polymer.github.io/AUTHORS.txt	chromecache_187.5.dr, chromecache_180.5.dr	false	URL Reputation: safe	unknown
https://aka.ms/yourcaliforniaprivacychoices	chromecache_162.5.dr	false	URL Reputation: safe	unknown
https://github.com/dotnet/docs/issues/new?template=z-customer-feedback.yml	chromecache_162.5.dr	false	Avira URL Cloud: safe	unknown
https://github.com/nschonni	chromecache_162.5.dr	false	Avira URL Cloud: safe	unknown
https://aka.ms/DP600/Plan/LearnT2?ocid=fabric24-dp600plan_learnpromo_T2_ad	chromecache_161.5.dr, chromecache_159.5.dr	false	Avira URL Cloud: safe	unknown
https://management.azure.com/subscriptions?api-version=2016-06-01	chromecache_187.5.dr, chromecache_180.5.dr	false	Avira URL Cloud: safe	unknown
https://github.com/adegeo	chromecache_162.5.dr	false	Avira URL Cloud: safe	unknown
https://github.com/dotnet/docs/blob/main/docs/framework/install/application-not-started.md	chromecache_162.5.dr	false	Avira URL Cloud: safe	unknown
https://aka.ms/pshelpmechoose	chromecache_187.5.dr, chromecache_180.5.dr	false	Avira URL Cloud: safe	unknown
https://aka.ms/feedback/report?space=61	chromecache_162.5.dr	false	Avira URL Cloud: safe	unknown
https://github.com/jonschlinkert/is-plain-object	chromecache_187.5.dr, chromecache_180.5.dr	false		unknown
https://octokit.github.io/rest.js/#throttling	chromecache_187.5.dr, chromecache_180.5.dr	false	Avira URL Cloud: safe	unknown
https://management.azure.com/providers/Microsoft.Portal/userSettings/cloudconsole?api-version=2017-0	chromecache_187.5.dr, chromecache_180.5.dr	false	Avira URL Cloud: safe	unknown
https://github.com/js-cookie/js-cookie	chromecache_187.5.dr, chromecache_180.5.dr	false	Avira URL Cloud: safe	unknown
https://learn-video.azurefd.net/vod/player	chromecache_187.5.dr, chromecache_180.5.dr	false	Avira URL Cloud: safe	unknown
https://twitter.com/intent/tweet?original_referer=$	chromecache_187.5.dr, chromecache_180.5.dr	false	Avira URL Cloud: safe	unknown
https://github.com/$	chromecache_187.5.dr, chromecache_180.5.dr	false	Avira URL Cloud: safe	unknown
https://github.com/gewarren	chromecache_162.5.dr	false	Avira URL Cloud: safe	unknown
http://schema.org/Organization	chromecache_162.5.dr	false	URL Reputation: safe	unknown
http://polymer.github.io/CONTRIBUTORS.txt	chromecache_187.5.dr, chromecache_180.5.dr	false	URL Reputation: safe	unknown
https://channel9.msdn.com/	chromecache_180.5.dr	false	Avira URL Cloud: safe	unknown
https://learn-video.azurefd.net/	chromecache_187.5.dr, chromecache_180.5.dr	false	Avira URL Cloud: safe	unknown
https://github.com/dotnet/try	chromecache_187.5.dr, chromecache_180.5.dr	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
13.107.246.42	s-part-0014.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
172.217.18.4	www.google.com	United States	15169	GOOGLEUS	false
13.107.253.45	s-part-0017.t-0009.fb-t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
13.107.253.42	s-part-0014.t-0009.fb-t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false

Private

IP
192.168.2.8

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1481468
Start date and time:	2024-07-25 09:46:50 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 52s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	16
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	LisectAVT_2403002C_142.exe
Detection:	MAL
Classification:	mal100.spre.troj.evad.winEXE@29/67@10/6
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 216.58.206.35, 2.19.246.123, 142.250.185.238, 74.125.133.84, 34.104.35.123, 95.101.150.2, 2.19.126.156, 2.19.126.137, 216.58.206.74, 172.217.16.138, 142.250.185.138, 142.250.185.74, 142.250.186.106, 172.217.23.106, 142.250.185.106, 172.217.18.10, 142.250.184.202, 142.250.185.202, 142.250.185.170, 142.250.186.74, 216.58.206.42, 142.250.181.234, 142.250.185.234, 142.250.186.42, 52.168.117.171, 192.229.221.95, 13.74.129.1, 13.107.21.237, 204.79.197.237, 52.168.117.169, 142.250.185.131, 142.250.185.206
Excluded domains from analysis (whitelisted): aijscdn2.afd.azureedge.net, azurefd-t-fb-prod.trafficmanager.net, slscr.update.microsoft.com, c-msn-com-nsatc.trafficmanager.net, clientservices.googleapis.com, browser.events.data.trafficmanager.net, learn.microsoft.com, onedscolprdeus10.eastus.cloudapp.azure.com, e11290.dspg.akamaiedge.net, mdec.nelreports.net.akamaized.net, go.microsoft.com, clients2.google.com, ocsp.digicert.com, a1883.dscd.akamai.net, onedscolprdeus16.eastus.cloudapp.azure.com, learn.microsoft.com.edgekey.net, update.googleapis.com, clients1.google.com, fs.microsoft.com, accounts.google.com, content-autofill.googleapis.com, c-bing-com.dual-a-0034.a-msedge.net, learn.microsoft.com.edgekey.net.globalredir.akadns.net, firstparty-azurefd-prod.trafficmanager.net, fe3cr.delivery.mp.microsoft.com, aijscdn2.azureedge.net, browser.events.data.microsoft.com, edgedl.me.gvt1.com, e13636.dscb.akamaiedge.net, c.bing.com, learn-public.trafficmanager.net, go.microsoft.com.edgekey.net, dual-a-0034.a-msedge.ne
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: LisectAVT_2403002C_142.exe

Simulations

Behavior and APIs

⊘No simulations

LLM Input / Output

Input

Output

URL: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=LisectAVT_2403002C_142.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 Model: Perplexity: mixtral-8x7b-instruct

{"loginform": false,"urgency": false,"captcha": false,"reasons": ["The webpage does not contain a login form, as it does not request any sensitive information such as passwords, email addresses, usernames, phone numbers, or credit card numbers.","The text of the webpage does not create a sense of urgency, as it does not contain phrases such as 'Click here to view document', 'To view secured document click here', or 'Open the link to see your invoice'.","The webpage does not contain a CAPTCHA or any other anti-robot detection mechanism."]}

Title: Fix .NET Framework 'This application could not be started' - .NET Framework | Microsoft Learn OCR: Learn Q Sign in Discover v Product documentation Development languages v Topics v .NET Languages Features v Workloads Troubleshooting Resources v Download .NET APIs v Filter by title .NET / .NET Framework / Learn / .NET Framework documentation "This application could not be Overview of .NET Framework started" error when running a .NET Get started v Installation guide Framework application Overview For developers Article  02/16/2023  6 contributors Feedback > By OS version Repair .NET framework In this article v TroubleshcHJt How to fix the error Troubleshoot install end uninstall See also Troubleshoot 'This application could not started' When you attempt to run a .NET Framework application, you may receive the "This .NET Framework 3.5 on Windows 8 application could not be started" error message. When this error is caused by an installed through Windows 11 version of .NET Framework not being detected, or by .NET Framework being corrupted, use this article to try to solve that problem. .NET Framework 1.1 on Windows 8 through Windows 11 mt.exe - This application could not be started. > Migration guide Development guide This application could not be started, > Tools Do you want to view information about this issue? > Additional APIs > What's new and obsolete Code analysis Yes No Download PDF

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
13.107.246.42	https://protect-us.mimecast.com/s/FVibCzpzxLsxEMXAhgAOBC	Get hash	malicious	Unknown	Browse	www.mimecast.com/Customers/Support/Contact-support/
	http://border-fd.smartertechnologies.com/	Get hash	malicious	Unknown	Browse	border-fd.smartertechnologies.com/
	https://protect-us.mimecast.com/s/4MrPCrkvgotDWxrNCzxa8p	Get hash	malicious	Unknown	Browse	www.mimecast.com/
239.255.255.250	https://gist.github.com/CreativeRoy/7405537df8cb20f60a08246a6093453b	Get hash	malicious	Coinhive, Xmrig	Browse
	https://gist.github.com/qiuxiuya/d1415f62623f8acf65dd0a4c1096b1e2	Get hash	malicious	Xmrig	Browse
	LisectAVT_2403002C_181.exe	Get hash	malicious	Revenge	Browse
	https://forms.office.com/Pages/ResponsePage.aspx?id=kAi_W0yZC0qQpKIHxTYoPxauHzsZJkZMuCk5U9e1Y4RUNFlCMDNQTTdIRTdLV0dKQ1lOUjJYQjg4Si4u&origin=Invitation&channel=0	Get hash	malicious	HTMLPhisher	Browse
	LisectAVT_2403002C_66.exe	Get hash	malicious	Unknown	Browse
	Sol Distribution - SO-SBES3039324 - - PO52880.eml	Get hash	malicious	Unknown	Browse
	https://drive.google.com/file/d/18uQaHuJAdR5xS3lALDyDJ0z0B_5vCmVE/view?usp=drivesdk	Get hash	malicious	Unknown	Browse
	http://oopb.juhrtjao.shop/	Get hash	malicious	Unknown	Browse
	http://www.dpm.gov.pg	Get hash	malicious	Unknown	Browse
	Lisect_AVT_24003_G1A_33.exe	Get hash	malicious	Unknown	Browse
13.107.253.42	https://cdp3.tracking.e360.salesforce.com/click?jwt=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ0ZW5hbnRfaWQiOiJhMzYwL3Byb2QvNzJlOTY4NTBhOWZiNGE2ZWE0MGY0N2JjMzQ0NzQxOWIiLCJjcmVhdGlvbl90aW1lIjoxNzIxNzI5NzE0LCJtZXNzYWdlX2lkIjoiMGhtbWRwZ3d4ejU5cTJiZzU4eWRhem01I2ViOTU2OGFlLTUxMDEtNDRmOC1iYmM1LWNkYjdhMTU0MmZhOCIsImNoYW5uZWxfdHlwZSI6ImVtYWlsIiwiZXhwIjoxNzUzMjY1NzE0LCJyZWRpcmVjdF91cmwiOiJodHRwczovL21hY3Bob3RvZ3JhcGh5Lm9yZyIsImluZGl2aWR1YWxfaWQiOiIwMFFhbTAwMDAwQTVaYzVFQUYifQ.n1MJx5qXzIyes_2paKdgiE1L8vPLZY6s0PjxhlIpfl0	Get hash	malicious	HTMLPhisher	Browse
	PO N#U00b0202415-0004 CULTER-ASSOCIETES_pdf.exe	Get hash	malicious	AgentTesla	Browse
	https://emea.dcv.ms/mWYAaJ9Es5VL5xBm8gooqYiMKijC0p?owla=rlKBhvBq	Get hash	malicious	HTMLPhisher	Browse
	PowerShell101 (AutoRecovered).docx	Get hash	malicious	Unknown	Browse
	https://emurzhun.com/loop/Untitled/?id=84hsi4&p=page_1&c=1	Get hash	malicious	Unknown	Browse
	https://www.cognitoforms.com/Hhg3/PowerAdhesivesLtd	Get hash	malicious	Unknown	Browse
	Perfomance_Evalution.docx	Get hash	malicious	HTMLPhisher	Browse
	RFQ - From Arcadia Aerospace Industries Entry CodeRBW51-PU5Y-9A5R.html	Get hash	malicious	HTMLPhisher	Browse
	invoice-72717953897646054572255005658360083176291774189023-quiltercheviot.pdf	Get hash	malicious	HTMLPhisher	Browse
	Setup.exe	Get hash	malicious	Unknown	Browse
13.107.253.45	2FF72350C5FE5280B47181095F061645E0B9F11833A7659408580240556FEA61.exe	Get hash	malicious	Unknown	Browse
	http://link.mail.beehiiv.com/ss/c/u001.6C5fb2jgNhK_7sih4vM3VZa9fE9tHBc9fWZLirgY7_MATRo7_qx7xDq5ZlnkMcO1QobynJ6PiItP4Wtcapt8tiaBcTbWM1w1MHuIiN_t_ffA_hJhmN8MgAW_Y4IPUoI18R3nDq7jKhCU2UyzKyGI-WqX2eqj-24lz37CpJQS3GK6BrMVhay0EFgw7CotaqH_C4NeRs-Js1jFAgB-bC5fNuJsXIDVbqNxP8z0vJ5voWsqHFmAhBhiDboOh3SaB-W0Q5R0-uHhyR22-eNa4lM2dEMKEW-Uy_fmTStthhgMkN4s--utxh_CoRNop7H6ZS1KTlU8MhyHYw0Xczv8AC7SmYR5LDaG03-YqHtdniUuPK3bJken9x2qXEhtO3XWDwy5/489/-BrXoE3aRI6JP48kxPJ6yg/h6/h001.YHI9KXXSnEtAYI6X6AzK5QT189WwD3EM6jWgGhu4Mzw#MARKUS.LINGNAU@GATX.EU	Get hash	malicious	HTMLPhisher	Browse
	https://ashcroftinc-my.sharepoint.com/:o:/g/personal/jim_beecher_ashcroft_com/EbmeA-1APhZIkfAOSWvb8lgB2-ZnHrxyDgNCs9XUSwGk3g?e=4%3auSlIHZ&at=9&xsdata=MDV8MDJ8aXRzdXBwb3J0QHRoZXJtb3N5c3RlbXMuY29tfGRlOGQ2MzFhYjQwZDQzNDU5OWQ4MDhkY2E1MDBlNGFkfDk1NTFjNjI5ODMzODQ2NTY4ZWFlY2U5OWYwNTU5NmM3fDB8MHw2Mzg1NjY2NzA0NzEwNTA4NzN8VW5rbm93bnxUV0ZwYkdac2IzZDhleUpXSWpvaU1DNHdMakF3TURBaUxDSlFJam9pVjJsdU16SWlMQ0pCVGlJNklrMWhhV3dpTENKWFZDSTZNbjA9fDB8fHw%3d&sdata=Q09aWmloVTZraXovREJ3SGgrWHFSV0MwTnQzRWthcksxUloxa0tMNWZkTT0%3d	Get hash	malicious	HTMLPhisher	Browse
	img_Zam#U00f3wienie - #20240716-A09461_pdf.com.exe	Get hash	malicious	AgentTesla	Browse
	https://midlandcomputerscouk.sharepoint.com/sites/Website/_layouts/15/AccessDenied.aspx?Source=https%3A%2F%2Fmidlandcomputerscouk%2Esharepoint%2Ecom%2Fsites%2FWebsite%3FuserExpiration%3D1%26p%3Dtrue&correlation=40d13ca1%2D20b5%2D9000%2D6a3f%2D58c0ad0360af	Get hash	malicious	Unknown	Browse
	https://1drv.ms/o/s!At-8sPpRzvxIqQDSUMWIAACun1sr?e=FTp3hr	Get hash	malicious	HTMLPhisher	Browse
	https://www.winhelponline.com/blog/microsoft-edge-url-shortcut/	Get hash	malicious	HTMLPhisher	Browse
	ACH Receipt.html	Get hash	malicious	HTMLPhisher	Browse
	Play____Now_AUD__autoresponse.htm	Get hash	malicious	Unknown	Browse
	Copy of Stonhard_BulkImageRefFileTemplate (version 1).eml	Get hash	malicious	Unknown	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
s-part-0014.t-0009.t-msedge.net	Lisect_AVT_24003_G1A_33.exe	Get hash	malicious	Unknown	Browse	13.107.246.42
	https://emea.dcv.ms/V1nd75OZS4	Get hash	malicious	HTMLPhisher	Browse	13.107.246.42
	Lisect_AVT_24003_G1A_59.exe	Get hash	malicious	Unknown	Browse	13.107.246.42
	Lisect_AVT_24003_G1A_76.exe	Get hash	malicious	Unknown	Browse	13.107.246.42
	Lisect_AVT_24003_G1A_62.exe	Get hash	malicious	Unknown	Browse	13.107.246.42
	Lisect_AVT_24003_G1A_46.exe	Get hash	malicious	Unknown	Browse	13.107.246.42
	LisectAVT_2403002B_493.exe	Get hash	malicious	Unknown	Browse	13.107.246.42
	Lisect_AVT_24003_G1A_49.exe	Get hash	malicious	Unknown	Browse	13.107.246.42
	LisectAVT_2403002A_61.exe	Get hash	malicious	Ramnit	Browse	13.107.246.42
	LisectAVT_2403002A_270.exe	Get hash	malicious	BlackMoon	Browse	13.107.246.42
s-part-0017.t-0009.fb-t-msedge.net	2FF72350C5FE5280B47181095F061645E0B9F11833A7659408580240556FEA61.exe	Get hash	malicious	Unknown	Browse	13.107.253.45
	http://link.mail.beehiiv.com/ss/c/u001.6C5fb2jgNhK_7sih4vM3VZa9fE9tHBc9fWZLirgY7_MATRo7_qx7xDq5ZlnkMcO1QobynJ6PiItP4Wtcapt8tiaBcTbWM1w1MHuIiN_t_ffA_hJhmN8MgAW_Y4IPUoI18R3nDq7jKhCU2UyzKyGI-WqX2eqj-24lz37CpJQS3GK6BrMVhay0EFgw7CotaqH_C4NeRs-Js1jFAgB-bC5fNuJsXIDVbqNxP8z0vJ5voWsqHFmAhBhiDboOh3SaB-W0Q5R0-uHhyR22-eNa4lM2dEMKEW-Uy_fmTStthhgMkN4s--utxh_CoRNop7H6ZS1KTlU8MhyHYw0Xczv8AC7SmYR5LDaG03-YqHtdniUuPK3bJken9x2qXEhtO3XWDwy5/489/-BrXoE3aRI6JP48kxPJ6yg/h6/h001.YHI9KXXSnEtAYI6X6AzK5QT189WwD3EM6jWgGhu4Mzw#MARKUS.LINGNAU@GATX.EU	Get hash	malicious	HTMLPhisher	Browse	13.107.253.45
	https://ashcroftinc-my.sharepoint.com/:o:/g/personal/jim_beecher_ashcroft_com/EbmeA-1APhZIkfAOSWvb8lgB2-ZnHrxyDgNCs9XUSwGk3g?e=4%3auSlIHZ&at=9&xsdata=MDV8MDJ8aXRzdXBwb3J0QHRoZXJtb3N5c3RlbXMuY29tfGRlOGQ2MzFhYjQwZDQzNDU5OWQ4MDhkY2E1MDBlNGFkfDk1NTFjNjI5ODMzODQ2NTY4ZWFlY2U5OWYwNTU5NmM3fDB8MHw2Mzg1NjY2NzA0NzEwNTA4NzN8VW5rbm93bnxUV0ZwYkdac2IzZDhleUpXSWpvaU1DNHdMakF3TURBaUxDSlFJam9pVjJsdU16SWlMQ0pCVGlJNklrMWhhV3dpTENKWFZDSTZNbjA9fDB8fHw%3d&sdata=Q09aWmloVTZraXovREJ3SGgrWHFSV0MwTnQzRWthcksxUloxa0tMNWZkTT0%3d	Get hash	malicious	HTMLPhisher	Browse	13.107.253.45
	img_Zam#U00f3wienie - #20240716-A09461_pdf.com.exe	Get hash	malicious	AgentTesla	Browse	13.107.253.45
	https://midlandcomputerscouk.sharepoint.com/sites/Website/_layouts/15/AccessDenied.aspx?Source=https%3A%2F%2Fmidlandcomputerscouk%2Esharepoint%2Ecom%2Fsites%2FWebsite%3FuserExpiration%3D1%26p%3Dtrue&correlation=40d13ca1%2D20b5%2D9000%2D6a3f%2D58c0ad0360af	Get hash	malicious	Unknown	Browse	13.107.253.45
	https://1drv.ms/o/s!At-8sPpRzvxIqQDSUMWIAACun1sr?e=FTp3hr	Get hash	malicious	HTMLPhisher	Browse	13.107.253.45
	ACH Receipt.html	Get hash	malicious	HTMLPhisher	Browse	13.107.253.45
	Play____Now_AUD__autoresponse.htm	Get hash	malicious	Unknown	Browse	13.107.253.45
	Copy of Stonhard_BulkImageRefFileTemplate (version 1).eml	Get hash	malicious	Unknown	Browse	13.107.253.45
	https://www.baidu.com/link?url=AFUg5ImByRbRDFqEAwVY_yQvqKKQI0Z9CKlSAojfE3k4FpO2skeOBycThw4wTQJI&wd=YWdyZWdvaXJlQGNvbW11bml0eWZvY3VzZmN1Lm9yZw==&eqid=ukEwxUaNVofiahyjoYydlLeVsGpoQBLJyZiHAGvxPtreMNMzHg	Get hash	malicious	HTMLPhisher	Browse	13.107.253.45
s-part-0014.t-0009.fb-t-msedge.net	https://cdp3.tracking.e360.salesforce.com/click?jwt=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ0ZW5hbnRfaWQiOiJhMzYwL3Byb2QvNzJlOTY4NTBhOWZiNGE2ZWE0MGY0N2JjMzQ0NzQxOWIiLCJjcmVhdGlvbl90aW1lIjoxNzIxNzI5NzE0LCJtZXNzYWdlX2lkIjoiMGhtbWRwZ3d4ejU5cTJiZzU4eWRhem01I2ViOTU2OGFlLTUxMDEtNDRmOC1iYmM1LWNkYjdhMTU0MmZhOCIsImNoYW5uZWxfdHlwZSI6ImVtYWlsIiwiZXhwIjoxNzUzMjY1NzE0LCJyZWRpcmVjdF91cmwiOiJodHRwczovL21hY3Bob3RvZ3JhcGh5Lm9yZyIsImluZGl2aWR1YWxfaWQiOiIwMFFhbTAwMDAwQTVaYzVFQUYifQ.n1MJx5qXzIyes_2paKdgiE1L8vPLZY6s0PjxhlIpfl0	Get hash	malicious	HTMLPhisher	Browse	13.107.253.42
	PO N#U00b0202415-0004 CULTER-ASSOCIETES_pdf.exe	Get hash	malicious	AgentTesla	Browse	13.107.253.42
	https://emea.dcv.ms/mWYAaJ9Es5VL5xBm8gooqYiMKijC0p?owla=rlKBhvBq	Get hash	malicious	HTMLPhisher	Browse	13.107.253.42
	PowerShell101 (AutoRecovered).docx	Get hash	malicious	Unknown	Browse	13.107.253.42
	https://emurzhun.com/loop/Untitled/?id=84hsi4&p=page_1&c=1	Get hash	malicious	Unknown	Browse	13.107.253.42
	https://www.cognitoforms.com/Hhg3/PowerAdhesivesLtd	Get hash	malicious	Unknown	Browse	13.107.253.42
	Perfomance_Evalution.docx	Get hash	malicious	HTMLPhisher	Browse	13.107.253.42
	RFQ - From Arcadia Aerospace Industries Entry CodeRBW51-PU5Y-9A5R.html	Get hash	malicious	HTMLPhisher	Browse	13.107.253.42
	https://control.gruptelevisio.com/getimg.php?l=https://yapidonusum.com/accoTxunts2APthI1AnkoTx4RAcha4RA4DCz01coTxm	Get hash	malicious	HTMLPhisher	Browse	13.107.253.42
	invoice-72717953897646054572255005658360083176291774189023-quiltercheviot.pdf	Get hash	malicious	HTMLPhisher	Browse	13.107.253.42

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
MICROSOFT-CORP-MSN-AS-BLOCKUS	CWS610973I4SC2024.exe	Get hash	malicious	DBatLoader	Browse	13.107.137.11
	LisectAVT_2403002C_181.exe	Get hash	malicious	Revenge	Browse	13.107.246.60
	LisectAVT_2403002C_44.exe	Get hash	malicious	EICAR	Browse	13.89.179.12
	KolataFixed.exe	Get hash	malicious	Unknown	Browse	20.199.16.17
	KolataFixed.exe	Get hash	malicious	Unknown	Browse	20.199.16.17
	LisectAVT_2403002C_69.exe	Get hash	malicious	Unknown	Browse	52.123.243.85
	Lisect_AVT_24003_G1A_33.exe	Get hash	malicious	Unknown	Browse	13.107.246.60
	Remittance advice.htm	Get hash	malicious	Unknown	Browse	20.13.96.71
	Lisect_AVT_24003_G1B_6.exe	Get hash	malicious	Unknown	Browse	20.205.229.222
	Lisect_AVT_24003_G1B_6.exe	Get hash	malicious	Unknown	Browse	20.205.229.222
MICROSOFT-CORP-MSN-AS-BLOCKUS	CWS610973I4SC2024.exe	Get hash	malicious	DBatLoader	Browse	13.107.137.11
	LisectAVT_2403002C_181.exe	Get hash	malicious	Revenge	Browse	13.107.246.60
	LisectAVT_2403002C_44.exe	Get hash	malicious	EICAR	Browse	13.89.179.12
	KolataFixed.exe	Get hash	malicious	Unknown	Browse	20.199.16.17
	KolataFixed.exe	Get hash	malicious	Unknown	Browse	20.199.16.17
	LisectAVT_2403002C_69.exe	Get hash	malicious	Unknown	Browse	52.123.243.85
	Lisect_AVT_24003_G1A_33.exe	Get hash	malicious	Unknown	Browse	13.107.246.60
	Remittance advice.htm	Get hash	malicious	Unknown	Browse	20.13.96.71
	Lisect_AVT_24003_G1B_6.exe	Get hash	malicious	Unknown	Browse	20.205.229.222
	Lisect_AVT_24003_G1B_6.exe	Get hash	malicious	Unknown	Browse	20.205.229.222
MICROSOFT-CORP-MSN-AS-BLOCKUS	CWS610973I4SC2024.exe	Get hash	malicious	DBatLoader	Browse	13.107.137.11
	LisectAVT_2403002C_181.exe	Get hash	malicious	Revenge	Browse	13.107.246.60
	LisectAVT_2403002C_44.exe	Get hash	malicious	EICAR	Browse	13.89.179.12
	KolataFixed.exe	Get hash	malicious	Unknown	Browse	20.199.16.17
	KolataFixed.exe	Get hash	malicious	Unknown	Browse	20.199.16.17
	LisectAVT_2403002C_69.exe	Get hash	malicious	Unknown	Browse	52.123.243.85
	Lisect_AVT_24003_G1A_33.exe	Get hash	malicious	Unknown	Browse	13.107.246.60
	Remittance advice.htm	Get hash	malicious	Unknown	Browse	20.13.96.71
	Lisect_AVT_24003_G1B_6.exe	Get hash	malicious	Unknown	Browse	20.205.229.222
	Lisect_AVT_24003_G1B_6.exe	Get hash	malicious	Unknown	Browse	20.205.229.222

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	https://gist.github.com/CreativeRoy/7405537df8cb20f60a08246a6093453b	Get hash	malicious	Coinhive, Xmrig	Browse	184.28.90.27 40.68.123.157 20.12.23.50
	https://gist.github.com/qiuxiuya/d1415f62623f8acf65dd0a4c1096b1e2	Get hash	malicious	Xmrig	Browse	184.28.90.27 40.68.123.157 20.12.23.50
	LisectAVT_2403002C_181.exe	Get hash	malicious	Revenge	Browse	184.28.90.27 40.68.123.157 20.12.23.50
	https://forms.office.com/Pages/ResponsePage.aspx?id=kAi_W0yZC0qQpKIHxTYoPxauHzsZJkZMuCk5U9e1Y4RUNFlCMDNQTTdIRTdLV0dKQ1lOUjJYQjg4Si4u&origin=Invitation&channel=0	Get hash	malicious	HTMLPhisher	Browse	184.28.90.27 40.68.123.157 20.12.23.50
	LisectAVT_2403002C_66.exe	Get hash	malicious	Unknown	Browse	184.28.90.27 40.68.123.157 20.12.23.50
	Sol Distribution - SO-SBES3039324 - - PO52880.eml	Get hash	malicious	Unknown	Browse	184.28.90.27 40.68.123.157 20.12.23.50
	https://drive.google.com/file/d/18uQaHuJAdR5xS3lALDyDJ0z0B_5vCmVE/view?usp=drivesdk	Get hash	malicious	Unknown	Browse	184.28.90.27 40.68.123.157 20.12.23.50
	http://oopb.juhrtjao.shop/	Get hash	malicious	Unknown	Browse	184.28.90.27 40.68.123.157 20.12.23.50
	http://www.dpm.gov.pg	Get hash	malicious	Unknown	Browse	184.28.90.27 40.68.123.157 20.12.23.50
	Lisect_AVT_24003_G1A_33.exe	Get hash	malicious	Unknown	Browse	184.28.90.27 40.68.123.157 20.12.23.50

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Jul 25 06:47:51 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.988875670508166
Encrypted:	false
SSDEEP:	48:81K0dsQTM0hDbYEHgidAKZdA1oehwiZUklqehny+3:81KRQYODbBUy
MD5:	873CE71EE1333F7F64018A3AB38CC034
SHA1:	9AA10E07C8C63A621131701AA7FE0410D85F91D3
SHA-256:	A6BA81B35D86BF43FE79DA0CD9F32AF3949A44DC84BF4844FF04793490EF7050
SHA-512:	4608676A5BD3AF8C2D7FBD87373EF2B69EF563CB4538D4DE87364D48AC50767E567CDC5B6423119845A30CB30F7726E72616F2646030317222BBFAF806BDAA4D
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,........f...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW)C..PROGRA~1..t......O.I.X.=....B...............J.....V...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X.=....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X.=....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X.=..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.X.=...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............q"......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Jul 25 06:47:51 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	4.004309522662485
Encrypted:	false
SSDEEP:	48:8iK0dsQTM0hDbYEHgidAKZdA1leh/iZUkAQkqehEy+2:8iKRQYODbT9QVy
MD5:	19B882CF18A36C93F74F6BFD0EFC065F
SHA1:	ECC6B5A179973B5E9F212B74A82B386B849ADD28
SHA-256:	DA1865DC369AC353A66AE9229116945D3E0D71CB2B78BE350AABE6C0E100F523
SHA-512:	398A6AF835BE418CFA5704CEA56C63D591080B46D67EA02B47C90698BAB4D37BE75CCF3129600CCD8BA2511B40CD168027FF7B904017C1513247DF9C3F0A4D23
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,........f...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW)C..PROGRA~1..t......O.I.X.=....B...............J.....V...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X.=....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X.=....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X.=..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.X.=...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............q"......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 5 07:00:51 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2693
Entropy (8bit):	4.012860144614373
Encrypted:	false
SSDEEP:	48:8NK0dsQTM0hDbbHgidAKZdA14t5eh7sFiZUkmgqeh7sqy+BX:8NKRQYODbhnwy
MD5:	65C0C93B9A5C58DE58568730512132E7
SHA1:	576B4234761BCAEF364D6DD17BA95894632E234C
SHA-256:	1BE13ABB4636DAF31C9FFD1A8B8EF616B429C2304D2B8328522C116A0D0AD4A6
SHA-512:	74D05A2A1122A02CB27382C2DED4F1C93C36FE2EA884B1962048889353DBFB939A950AA90254352F6968B5660F2629C7AC56475F6D22230F98DDFBD544EB0DCD
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.....C..b...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW)C..PROGRA~1..t......O.I.X.=....B...............J.....V...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X.=....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X.=....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X.=..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VEW.@...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............q"......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Jul 25 06:47:51 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	4.002443019104078
Encrypted:	false
SSDEEP:	48:8X8K0dsQTM0hDbYEHgidAKZdA16ehDiZUkwqehIy+R:8MKRQYODbgiy
MD5:	08A8E05DD151345768A10BD459B19FED
SHA1:	7DD567BD5A807E18B117E3F091CBDC69800F4ACC
SHA-256:	920B9D6A37099D8F54B3DE19EA3CC7CA27C5AF84C6EC6788B0739AD72499050E
SHA-512:	2EA0664C2F228FAD0BF89545FC869D215E92E0C9B5BBCB145A01058F387DC8C42814FB90D490F6C2967E12F595713D49B6403A2DC555F2C0943C1CA27CDA93E0
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,........f...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW)C..PROGRA~1..t......O.I.X.=....B...............J.....V...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X.=....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X.=....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X.=..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.X.=...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............q"......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Jul 25 06:47:51 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.990145364487473
Encrypted:	false
SSDEEP:	48:88K0dsQTM0hDbYEHgidAKZdA1UehBiZUk1W1qehGy+C:88KRQYODbA9my
MD5:	27393E7C6E9357D98BE6072ACB6CBC23
SHA1:	8607FB50C4DE73C52ABCA21DEFC36E7B0DFDCA58
SHA-256:	210856FB459BC89F1D3389B3F2B4729B407FF9DF165780E31AF35C02692E0D7C
SHA-512:	63AB2B5EF1F27FE5D31DC3BADDC87768703DE7DB5BCF8AB58314C35CFAC23DA3EF0E9BD4516D4223D5425BC118657E71B50A02F3F4A64C18A4FF238FCA4B2D27
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,....XY..f...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW)C..PROGRA~1..t......O.I.X.=....B...............J.....V...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X.=....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X.=....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X.=..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.X.=...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............q"......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Jul 25 06:47:51 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2683
Entropy (8bit):	4.002177543584746
Encrypted:	false
SSDEEP:	48:8EK0dsQTM0hDbYEHgidAKZdA1duTrehOuTbbiZUk5OjqehOuTbwy+yT+:8EKRQYODbtTYTbxWOvTbwy7T
MD5:	D0A1C06C7B240C912E6D27AFAC361BF4
SHA1:	AAB9C1AD3FCF0318B3D2AEFDD0BB31DB06BA327D
SHA-256:	A57F265EBCA4940E8A66054063B5441F630C74760ECE01E120CE4AD9224E2CB3
SHA-512:	1F9DC8CAB1B3248042F6E9CA5CCE38BF1DC3FC6760A7DC89F81DDD2770808159DC88D7F88161B965CF259E4DA869FC868A04B0E103DB0F3051A2E6CC57A12747
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,....".u.f...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW)C..PROGRA~1..t......O.I.X.=....B...............J.....V...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X.=....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X.=....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X.=..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.X.=...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............q"......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Chrome Cache Entry: 150

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 533 x 478, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	13339
Entropy (8bit):	7.683569563478597
Encrypted:	false
SSDEEP:	192:zjSKAj04ndWb6OuzZjk6TsEaJS0/bJur2Gz4Imm3MhE4NfM:zutfW69XTspsG3G0TfhEQM
MD5:	512625CF8F40021445D74253DC7C28C0
SHA1:	F6B27CE0F7D4E48E34FDDCA8A96337F07CFFE730
SHA-256:	1D4DCEE8511D5371FEC911660D6049782E12901C662B409A5C675772E9B87369
SHA-512:	AE02319D03884D758A86C286B6F593BDFFD067885D56D82EEB8215FDCB41637C7BB9109039E7FBC93AD246D030C368FB285B3161976ED485ABC5A8DF6DF9A38C
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	.PNG........IHDR.............,#......sRGB.........gAMA......a.....pHYs..........o.d..3.IDATx^..].5Y...C.$..tH .NF.I&A0..;.r.fF.#..!7...'..3.0.../..s....."!.y...~....4....om.g.3.BTP......j..g.zVU....u...a.Z..j..U....y......$.....I...pAR...\.T....$.....I...pAR...\.T..p....5O>.d...}Rg.$....@.4....fb1.o.I...7..<.P.....n0.D.P.....n..L.P.....n8.......P.~......n(+..'. ......J.vM,H......W...h.T....$.....I...pAR...\.T....$.....I...pAR...\.T....$.....I...pAR...\.T....$......'....w....g....\|../5_.......T...~.y.'.'.\|...W..[...C.)......\|.[.[WK...w...w..y.{..\|.#.n>...5....5...h>..O6O>.Xx....o.B........g?.........~....?o...w.......}..-_k^........l....\|.D.TH.....o..B'..(.W-%...?...W.......E?h..........~.......?...~,..}...o^...5ox..bI.mo{[s.}.5.<.L.......<......Y.W......K..Q._...Iu...2...e)d]4.}Y..............k.%k..s.'..L(..o4...g...z............N.X.....W.O.^.4.....7......i~._7..~,bI......3.0RRq..\|.Mk..?.{.K_...t.........SYG.W^#).N^..._W...(.8.7.....W....7...m

Chrome Cache Entry: 151

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 533 x 478, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	18367
Entropy (8bit):	7.7772261735974215
Encrypted:	false
SSDEEP:	384:4qqZYz7CAda2Qmd6VWWNg9h8XvdkRbdi2nki:1qZYz7Cma2hYNMh8XvdObdi2nX
MD5:	240C4CC15D9FD65405BB642AB81BE615
SHA1:	5A66783FE5DD932082F40811AE0769526874BFD3
SHA-256:	030272CE6BA1BECA700EC83FDED9DBDC89296FBDE0633A7F5943EF5831876C07
SHA-512:	267FE31BC25944DD7B6071C2C2C271CCC188AE1F6A0D7E587DCF9198B81598DA6B058D1B413F228DF0CB37C8304329E808089388359651E81B5F3DEC566D0EE0
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/install/media/application-not-started/repair-tool-no-resolution.png
Preview:	.PNG........IHDR.............,#......sRGB.........gAMA......a.....pHYs..........o.d..GTIDATx^._.}.U.7..BkB.......!E......b.Ej.K...Z...iK.$..h..B`..T.?5.7.I..16$.E.......c...c...Q_V.k...k..g.y.9..G.g..g.9.Z{..Z{.nv....@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...<@v.].../.1R'm.....x..h.....]a1U7........s.......x.h.q.A! ....8IL\GP..............M...W.............D.....dJ<.+,.........W...pgAT...@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...@......P.;/..G....O~..O~...'?......h.....}.y..4/....S..........Y......?..?.g7...G...............x{..w..y.~.9.~.y....y.#.c....<.E.............^..7G.._.u.nv/..f........5.....5?.;...w.....i~.?\|..H+Dd.....Y%....r~.$Q...7.v..._hv..r.O_.4..7M.6....o..=..?....3....?.....xE...O..7....^......D.W....m...6........O..Ob.4.9J........6.;..>.,.....o.l..>%J.V......%k..0.bQqIA..O..y.{.....7.......4_..Za...4.o.....h..........k...M...i....G.4...h.L.#...&.'%...~j..W.*Kx......o.%s.m

Chrome Cache Entry: 152

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	1154
Entropy (8bit):	4.59126408969148
Encrypted:	false
SSDEEP:	24:txFRuJpzYeGK+VS6ckNL2091JP/UcHc8oQJ1sUWMLc/jH6GbKqjHJIOHA:JsfcU6ckNL2091Z/U/YsUDM+GhS
MD5:	37258A983459AE1C2E4F1E551665F388
SHA1:	603A4E9115E613CC827206CF792C62AEB606C941
SHA-256:	8E34F3807B4BF495D8954E7229681DA8D0DD101DD6DDC2AD7F90CD2983802B44
SHA-512:	184CB63EF510143B0AF013F506411C917D68BB63F2CFA47EA2A42688FD4F55F3B820AF94F87083C24F48AACEE6A692199E185FC5C5CFBED5D70790454EED7F5C
Malicious:	false
Preview:	<svg width="456" height="456" viewBox="0 0 456 456" fill="none" xmlns="http://www.w3.org/2000/svg">..<rect width="456" height="456" fill="#512BD4"/>..<path d="M81.2738 291.333C78.0496 291.333 75.309 290.259 73.052 288.11C70.795 285.906 69.6665 283.289 69.6665 280.259C69.6665 277.173 70.795 274.529 73.052 272.325C75.309 270.121 78.0496 269.019 81.2738 269.019C84.5518 269.019 87.3193 270.121 89.5763 272.325C91.887 274.529 93.0424 277.173 93.0424 280.259C93.0424 283.289 91.887 285.906 89.5763 288.11C87.3193 290.259 84.5518 291.333 81.2738 291.333Z" fill="white"/>..<path d="M210.167 289.515H189.209L133.994 202.406C132.597 200.202 131.441 197.915 130.528 195.546H130.044C130.474 198.081 130.689 203.508 130.689 211.827V289.515H112.149V171H134.477L187.839 256.043C190.096 259.57 191.547 261.994 192.192 263.316H192.514C191.977 260.176 191.708 254.859 191.708 247.365V171H210.167V289.515Z" fill="white"/>..<path d="M300.449 289.515H235.561V171H297.87V187.695H254.746V221.249H294.485V237.861H254.746V

Chrome Cache Entry: 153

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	443348
Entropy (8bit):	5.079350267097991
Encrypted:	false
SSDEEP:	6144:Fe43jzKCey05dPjZkYh6BFPDxZYX04GK7MI:NKCeyQPjj
MD5:	DBAAB65D35238246BEAF5AA34B9736CF
SHA1:	DFA25539F60B3A4F60B933515309E97DA379C2C5
SHA-256:	564E1C96899DDBC5692257CC9F2EEB8F615220E23466BF333FD26FE28BEACF78
SHA-512:	16EEA9018AD102EEEE67CE940A992EF610EF99BE36F803957B47FD0EF4F65B15FF23A39AF5D931E23A39D89BC68DB1026E904F5B172A7374B69A8AC76E466225
Malicious:	false
URL:	https://learn.microsoft.com/static/assets/0.4.027605576/styles/site-ltr.css
Preview:	.CodeMirror{height:300px;color:#000;direction:ltr;font-family:monospace}.CodeMirror-lines{padding:4px 0}.CodeMirror pre.CodeMirror-line,.CodeMirror pre.CodeMirror-line-like{padding:0 4px}.CodeMirror-scrollbar-filler,.CodeMirror-gutter-filler{background-color:#fff}.CodeMirror-gutters{white-space:nowrap;background-color:#f7f7f7;border-right:1px solid #ddd}.CodeMirror-linenumber{min-width:20px;text-align:right;color:#999;white-space:nowrap;padding:0 3px 0 5px}.CodeMirror-guttermarker{color:#000}.CodeMirror-guttermarker-subtle{color:#999}.CodeMirror-cursor{width:0;border-left:1px solid #000;border-right:none}.CodeMirror div.CodeMirror-secondarycursor{border-left:1px solid silver}.cm-fat-cursor .CodeMirror-cursor{width:auto;background:#7e7;border:0!important}.cm-fat-cursor div.CodeMirror-cursors{z-index:1}.cm-fat-cursor .CodeMirror-line::selection,.cm-fat-cursor .CodeMirror-line>span::selection,.cm-fat-cursor .CodeMirror-line>span>span::selection{background:0 0}.cm-fat-cursor{caret-color:#0

Chrome Cache Entry: 154

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3130
Entropy (8bit):	4.790069981348324
Encrypted:	false
SSDEEP:	48:YWuGl640ynAqgDJ9OJWuO6Z3Db8VgK/ni47ttbtlSlA37ERw7II77Aj5M1:Nv0ynAhD3CO5t5lNEYIOEjc
MD5:	EBA6E81304F2F555E1D2EA3126A18A41
SHA1:	61429C3FE837FD4DD68E7B26678F131F2E00070D
SHA-256:	F309CCCE17B2B4706E7110F6C76F81761F0A44168D12C358AC4D120776907F81
SHA-512:	3BE0466794E7BDDC8565758DBF5553E89ED0003271F07695F09283F242BB65C1978ED79A38D5E589A99F68C0130E1E4B52576D7CD655EE272EE104BE0378E72E
Malicious:	false
Preview:	{"items":[{"children":[{"children":[{"homepage":"/dotnet/api/index","href":"/dotnet/api/","toc_title":"API browser"},{"homepage":"/dotnet/csharp/index","href":"/dotnet/csharp/","toc_title":"C#"},{"homepage":"/dotnet/fsharp/index","href":"/dotnet/fsharp/","toc_title":"F#"},{"homepage":"/dotnet/visual-basic/index","href":"/dotnet/visual-basic/","toc_title":"Visual Basic"},{"homepage":"/dotnet/ai/index","href":"/dotnet/ai/","toc_title":"AI"},{"homepage":"/dotnet/azure/index","href":"/dotnet/azure/","toc_title":"Azure"},{"homepage":"/dotnet/aspire/index","href":"/dotnet/aspire/","toc_title":".NET Aspire"},{"homepage":"/dotnet/orleans/index","href":"/dotnet/orleans/","toc_title":"Orleans"},{"children":[{"homepage":"/dotnet/framework/unmanaged-api/","href":"/dotnet/framework/unmanaged-api/","toc_title":"Unmanaged API reference"}],"homepage":"/dotnet/framework/index","href":"/dotnet/framework/","toc_title":".NET Framework"},{"children":[{"homepage":"/dotnet/architecture/modern-web-apps-azure/

Chrome Cache Entry: 155

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 533 x 478, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	15427
Entropy (8bit):	7.784472070227724
Encrypted:	false
SSDEEP:	384:CKKdvwj3SJMpKKKKKKKKikCyKwqHILyPGQV4ykihKKKKKKKCm:CKKdvMMgKKKKKKKKiqB3yPVXkihKKKKI
MD5:	3062488F9D119C0D79448BE06ED140D8
SHA1:	8A148951C894FC9E968D3E46589A2E978267650E
SHA-256:	C47A383DE6DD60149B37DD24825D42D83CB48BE0ED094E3FC3B228D0A7BB9332
SHA-512:	00BBA6BCBFBF44B977129594A47F732809DCE7D4E2D22D050338E4EEA91FCC02A9B333C45EEB4C9024DF076CBDA0B46B621BF48309C0D037D19BBEAE0367F5ED
Malicious:	false
Preview:	.PNG........IHDR.............,#......sRGB.........gAMA......a.....pHYs..........o.d..;.IDATx^..].u.Y..M....B.X...".......@.ZzSys..,H{.Rz!... .......WM.IN..9n..I....g...p<P.0-....\|...X..s...Z.Y{....w..5.._s..x...E.......... ..................... ..................{....2. ...`.$h.......)....,T-x.5......,.."..(.A.......>.. ...`......4..G.\|.....,T-..'. ...`....]........?~.....A...pAP...\.T..........A...pAP...\.T..........A...pAP...\.T..........A...pAP...\.}P../}....TJ...'.O...'?......XH...K..>.b..K/t...o.......T.._.E.....q.$.x..qJ......mo...ww.}.{....W..._...._.^z...........(^x..C..P.../.........U..]../u.....w..{.O.N..o.l........_.^...2.....*....<...iP.W...o......]..+.?}c...t!.....p.=..._x..._yo....?....~u.c?.c1'.....{.^.}.S...5.yMx./.>.lwqq.}.....g..g1wZ..%......h.i[..%ul.&..U.k..";7-.9.6...s..s..0.......}.s..?...c..X...\|..........>.x..o.?.?..{........n..o....]?....Ej..yuu5...A.}....5...^...f........s.qJ..SYF.V...'..q.......T..'..z.....

Chrome Cache Entry: 156

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	16
Entropy (8bit):	3.875
Encrypted:	false
SSDEEP:	3:HMB:k
MD5:	0B04EA412F8FC88B51398B1CBF38110E
SHA1:	E073BCC5A03E7BBA2A16CF201A3CED1BE7533FBF
SHA-256:	7562254FF78FD854F0A8808E75A406F5C6058B57B71514481DAE490FC7B8F4C3
SHA-512:	6D516068C3F3CBFC1500032E600BFF5542EE30C0EAC11A929EE002C707810BBF614A5586C2673EE959AFDF19C08F6EAEFA18193AD6CEDC839BDF249CF95E8079
Malicious:	false
URL:	https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzISEAkEurwx6c-nJBIFDb_mJfI=?alt=proto
Preview:	CgkKBw2/5iXyGgA=

Chrome Cache Entry: 157

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65410)
Category:	dropped
Size (bytes):	206998
Entropy (8bit):	5.418793847287795
Encrypted:	false
SSDEEP:	3072:X/9cGgmjXCGzE0ploS6MeaUpyd57vUDgg4+RT7:XlcGxxsfMe3pyPvkB4cT7
MD5:	DEAA16321132C38272BDA251563F48A1
SHA1:	0209A287D78181B0A8FC3644E8E99BE2105F46F0
SHA-256:	80934D21B5493C94EE3AA1F35745543326CF6C9D695C85C635BAD9C19CE0D84F
SHA-512:	0473BF532047268B569B54B23C1B0117FB25A21058C2E985E9D245E695A523ABC983DF4D64A2420D635A02FFF6A83E5393A75608FB8EC10DB2834D54456DDA91
Malicious:	false
Preview:	/!. 1DS JSLL SKU, 4.3.0. * Copyright (c) Microsoft and contributors. All rights reserved.. * (Microsoft Internal Only). */.!function(e,t){var n="undefined";if("object"==typeof exports&&typeof module!=n)t(exports);else if("function"==typeof define&&define.amd)define(["exports"],t);else{var r,i,e=typeof globalThis!=n?globalThis:e\|\|self,a={},o="__ms$mod__",c={},u=c.es5_ms_jsll_4_3_0={},s="4.3.0",l="oneDS4",f=(f=e)[l]=f[l]\|\|{},d=(d=e)[l="oneDS"]=d[l]\|\|{},e=f[o]=f[o]\|\|{},p=e.v=e.v\|\|[],l=d[o]=d[o]\|\|{},g=l.v=l.v\|\|[];for(i in(l.o=l.o\|\|[]).push(c),t(a),a)r="x",f[i]=a[i],p[i]=s,typeof d[i]==n?(r="n",(d[i]=a[i])&&(g[i]=s)):g[i]\|\|(g[i]="---"),(u[r]=u[r]\|\|[]).push(i)}}(this,function(f){"use strict";var d="function",p="object",se="undefined",Ce="prototype",g=Object,h=g[Ce];function m(e,t){return e\|\|t}var y,be=undefined,C=null,b="",T="function",I="object",_="prototype",S="__proto__",x="undefined",N="constructor",D="Symbol",A="_polyfill",w="length",k="name",Te="call",P="toString",O=m(Object),R=O[_]

Chrome Cache Entry: 158

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 18768, version 1.0
Category:	downloaded
Size (bytes):	18768
Entropy (8bit):	7.987865266610692
Encrypted:	false
SSDEEP:	384:Jg8I5VXe4fT0sr9WHEzMrMk7OF+IkXpFlhwOFKepi9L6hOz:JRyVnpr8MeOFwpFbgZx6ha
MD5:	870B357C3BAE1178740236D64790E444
SHA1:	5FA06435D0ECF28CBD005773F8C335C44D7DF522
SHA-256:	0227BD6A0408946E9B4DF6F1A340E3713759A42A7677BDB8CB34698E4EDF541E
SHA-512:	7FC902E787B1F51B86D967354C0F2987EA9FD582FEF2959831EA6DBC5E7BF998A8F24BA906F0EE99AE8493AEB0C53AF06BEE106D60B448AC50B827C63B1ED169
Malicious:	false
URL:	https://learn.microsoft.com/static/assets/0.4.027605576/styles/docons.aa8255ca.woff2
Preview:	wOF2......IP..........H..........................T.V..&......9.6.$..h..v.. ..y..{.^y'd^K....w^77..<.B..{..d...Jr2D.N.D...?..bxj+.nP.U.......X...sg.!..{B...r.).......t.JT.Rs.t..u.%.[.....p.......&.'z../......E......q...\|.8...g..%.?...O..:9$). .-.{LMK....=\3D.y...y ..0...vX3.\|..$...(.. Z..b...p.u.q,:$VP...ZG[GEp.I..P..1.}.Y..........F...m#.....`w.FA..\|7.\| .Od..R.&.......wK..@....\..t........j9Dv.j.....V..A...\.q..[...g.!....(.....JQ.,.9[..o..6.p.....v...........E ,ap{..Z..ms.y..B.gH.a...?....]... .@....o.....8.@.......Vf<.CX.(...c..$.t.....=..(...w.....d...xOvr.<.uj{.I...`.!E...r......yE...}...".e>A ...q._Um%..Y...VR...a.2.F... .B..B.E.E $?....*.%.HL...e...<....t.u%.....a.).x.x...vq.h..[.'.$......i..3....8>....1...!AK9%...(..cGM{....$.Y4:...}.U...3D..)E.j.....%..+......Q..p....D.!.`..E..E....o.c.M-.......L,...mg.A. .V....G....t$..T......D/.T..mQ.......#CA4.dQA=.hc..d..6j.....+......M4.....6V{.....c..?...(t....qw\|....0..`....^.^g..y...

Chrome Cache Entry: 159

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2945
Entropy (8bit):	5.11559629166894
Encrypted:	false
SSDEEP:	48:YJckl90I99HHJ3PSC/HCcTxdB4H0CrsfSMrxMZuv15C/h1/8iHd0MBToe1xrvAKB:gjlJFSCVxd7wsfSMrxguv+/h1P0MBToE
MD5:	16A9A2CEBAEBD81D7E24D9D73988CFDB
SHA1:	C28CD7B14A019A7A800EC5CC4315BCD27DB00A16
SHA-256:	115DAC6DD805A8F85C48218C1292D9633E63131FE8907DA7ED4730197C4E6AAF
SHA-512:	468BEB586F938ED8A2F22D26D20A43ED3C1F77C014EAC5EE9BD16965AF2AE1723FCDD2D42D37BE8AF1911B2F44382BF16B7FE0C71AE856537C444DDABFDCA466
Malicious:	false
Preview:	{"banners":[{"content":{"text":"You may experience reduced functionality with empty pages and broken links. Development is in progress to improve your experience."},"dismissable":false,"location":"sectional","scope":{"accessLevels":["isolated"],"endDate":"2030-01-01T00:00:00-00:00","paths":["/samples/browse/","/lifecycle/products/","/dotnet/api/","/javascript/api/","/java/api/","/powershell/module/","/python/api/","/rest/api/","/assessments/"],"startDate":"2020-10-01T05:00:00-04:00"},"uid":"development-in-progress-isolated"},{"content":{"link":{"href":"/en-us/answers/questions/1657059/the-subscription-is-not-allowed-to-create-or-updat","title":"View discussion"},"text":"App Service deployment: subscription \u0027xxxxxxxx\u0027 is not allowed to create or update the server farm."},"dismissable":true,"location":"sectional","scope":{"accessLevels":["online"],"endDate":"2024-05-24T07:34:00.000Z","paths":["/answers/tags/436/azure-app-service"],"startDate":"2024-04-22T07:34:00.000Z"},"uid":"

Chrome Cache Entry: 160

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65410)
Category:	downloaded
Size (bytes):	206998
Entropy (8bit):	5.418793847287795
Encrypted:	false
SSDEEP:	3072:X/9cGgmjXCGzE0ploS6MeaUpyd57vUDgg4+RT7:XlcGxxsfMe3pyPvkB4cT7
MD5:	DEAA16321132C38272BDA251563F48A1
SHA1:	0209A287D78181B0A8FC3644E8E99BE2105F46F0
SHA-256:	80934D21B5493C94EE3AA1F35745543326CF6C9D695C85C635BAD9C19CE0D84F
SHA-512:	0473BF532047268B569B54B23C1B0117FB25A21058C2E985E9D245E695A523ABC983DF4D64A2420D635A02FFF6A83E5393A75608FB8EC10DB2834D54456DDA91
Malicious:	false
URL:	https://js.monitor.azure.com/scripts/c/ms.jsll-4.min.js
Preview:	/!. 1DS JSLL SKU, 4.3.0. * Copyright (c) Microsoft and contributors. All rights reserved.. * (Microsoft Internal Only). */.!function(e,t){var n="undefined";if("object"==typeof exports&&typeof module!=n)t(exports);else if("function"==typeof define&&define.amd)define(["exports"],t);else{var r,i,e=typeof globalThis!=n?globalThis:e\|\|self,a={},o="__ms$mod__",c={},u=c.es5_ms_jsll_4_3_0={},s="4.3.0",l="oneDS4",f=(f=e)[l]=f[l]\|\|{},d=(d=e)[l="oneDS"]=d[l]\|\|{},e=f[o]=f[o]\|\|{},p=e.v=e.v\|\|[],l=d[o]=d[o]\|\|{},g=l.v=l.v\|\|[];for(i in(l.o=l.o\|\|[]).push(c),t(a),a)r="x",f[i]=a[i],p[i]=s,typeof d[i]==n?(r="n",(d[i]=a[i])&&(g[i]=s)):g[i]\|\|(g[i]="---"),(u[r]=u[r]\|\|[]).push(i)}}(this,function(f){"use strict";var d="function",p="object",se="undefined",Ce="prototype",g=Object,h=g[Ce];function m(e,t){return e\|\|t}var y,be=undefined,C=null,b="",T="function",I="object",_="prototype",S="__proto__",x="undefined",N="constructor",D="Symbol",A="_polyfill",w="length",k="name",Te="call",P="toString",O=m(Object),R=O[_]

Chrome Cache Entry: 161

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	2945
Entropy (8bit):	5.11559629166894
Encrypted:	false
SSDEEP:	48:YJckl90I99HHJ3PSC/HCcTxdB4H0CrsfSMrxMZuv15C/h1/8iHd0MBToe1xrvAKB:gjlJFSCVxd7wsfSMrxguv+/h1P0MBToE
MD5:	16A9A2CEBAEBD81D7E24D9D73988CFDB
SHA1:	C28CD7B14A019A7A800EC5CC4315BCD27DB00A16
SHA-256:	115DAC6DD805A8F85C48218C1292D9633E63131FE8907DA7ED4730197C4E6AAF
SHA-512:	468BEB586F938ED8A2F22D26D20A43ED3C1F77C014EAC5EE9BD16965AF2AE1723FCDD2D42D37BE8AF1911B2F44382BF16B7FE0C71AE856537C444DDABFDCA466
Malicious:	false
URL:	https://learn.microsoft.com/en-us/banners/index.json
Preview:	{"banners":[{"content":{"text":"You may experience reduced functionality with empty pages and broken links. Development is in progress to improve your experience."},"dismissable":false,"location":"sectional","scope":{"accessLevels":["isolated"],"endDate":"2030-01-01T00:00:00-00:00","paths":["/samples/browse/","/lifecycle/products/","/dotnet/api/","/javascript/api/","/java/api/","/powershell/module/","/python/api/","/rest/api/","/assessments/"],"startDate":"2020-10-01T05:00:00-04:00"},"uid":"development-in-progress-isolated"},{"content":{"link":{"href":"/en-us/answers/questions/1657059/the-subscription-is-not-allowed-to-create-or-updat","title":"View discussion"},"text":"App Service deployment: subscription \u0027xxxxxxxx\u0027 is not allowed to create or update the server farm."},"dismissable":true,"location":"sectional","scope":{"accessLevels":["online"],"endDate":"2024-05-24T07:34:00.000Z","paths":["/answers/tags/436/azure-app-service"],"startDate":"2024-04-22T07:34:00.000Z"},"uid":"

Chrome Cache Entry: 162

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (639), with CRLF, LF line terminators
Category:	downloaded
Size (bytes):	49783
Entropy (8bit):	5.052270079620471
Encrypted:	false
SSDEEP:	768:6DcycfvwcwOffIYswsuKJmQT1Yn4/1ggM6F5F30leYUS99AG:6Y/ovOff9swsu+mQTO4/1BzRUhUe95
MD5:	E77FFFD507B64085DDC6B99DE2B03710
SHA1:	5FE0D5E7BBD6E36A8215629E09D0F57BDAE2E32A
SHA-256:	3AA4ED6C1B3CC8940116D35D0AFF1B519675236ABFD1D7720D68E1833AF6BDD1
SHA-512:	D4FBE712574D558FD2238B5FA0F5D9F2D9495B1DF65B81FACEB53ED8E9C2D4770F98CF870E67425D752A6726477E2E9B855D148FFB6E1169A1D4121451F615BA
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=LisectAVT_2403002C_142.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Preview:	<!DOCTYPE html><html...class="hasSidebar hasPageActions hasBreadcrumb conceptual has-default-focus theme-light"...lang="en-us"...dir="ltr"...data-authenticated="false"...data-auth-status-determined="false"...data-target="docs"...x-ms-format-detection="none">....<head>...<meta charset="utf-8" />...<meta name="viewport" content="width=device-width, initial-scale=1.0" />...<meta property="og:title" content="Fix .NET Framework 'This application could not be started' - .NET Framework" />...<meta property="og:type" content="website" />...<meta property="og:url" content="https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started" /><meta property="og:description" content="Learn what to do if you see a 'This application could not be started' dialog box when running a .NET Framework application." /><meta property="og:image" content="https://learn.microsoft.com/dotnet/media/dotnet-logo.png" />.....<meta property="og:image:alt" content="Fix .NET Framework 'This application

Chrome Cache Entry: 163

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 533 x 478, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	15427
Entropy (8bit):	7.784472070227724
Encrypted:	false
SSDEEP:	384:CKKdvwj3SJMpKKKKKKKKikCyKwqHILyPGQV4ykihKKKKKKKCm:CKKdvMMgKKKKKKKKiqB3yPVXkihKKKKI
MD5:	3062488F9D119C0D79448BE06ED140D8
SHA1:	8A148951C894FC9E968D3E46589A2E978267650E
SHA-256:	C47A383DE6DD60149B37DD24825D42D83CB48BE0ED094E3FC3B228D0A7BB9332
SHA-512:	00BBA6BCBFBF44B977129594A47F732809DCE7D4E2D22D050338E4EEA91FCC02A9B333C45EEB4C9024DF076CBDA0B46B621BF48309C0D037D19BBEAE0367F5ED
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/install/media/application-not-started/repair-tool-recommended-changes.png
Preview:	.PNG........IHDR.............,#......sRGB.........gAMA......a.....pHYs..........o.d..;.IDATx^..].u.Y..M....B.X...".......@.ZzSys..,H{.Rz!... .......WM.IN..9n..I....g...p<P.0-....\|...X..s...Z.Y{....w..5.._s..x...E.......... ..................... ..................{....2. ...`.$h.......)....,T-x.5......,.."..(.A.......>.. ...`......4..G.\|.....,T-..'. ...`....]........?~.....A...pAP...\.T..........A...pAP...\.T..........A...pAP...\.T..........A...pAP...\.}P../}....TJ...'.O...'?......XH...K..>.b..K/t...o.......T.._.E.....q.$.x..qJ......mo...ww.}.{....W..._...._.^z...........(^x..C..P.../.........U..]../u.....w..{.O.N..o.l........_.^...2.....*....<...iP.W...o......]..+.?}c...t!.....p.=..._x..._yo....?....~u.c?.c1'.....{.^.}.S...5.yMx./.>.lwqq.}.....g..g1wZ..%......h.i[..%ul.&..U.k..";7-.9.6...s..s..0.......}.s..?...c..X...\|..........>.x..o.?.?..{........n..o....]?....Ej..yuu5...A.}....5...^...f........s.qJ..SYF.V...'..q.......T..'..z.....

Chrome Cache Entry: 164

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (52717), with no line terminators
Category:	dropped
Size (bytes):	52717
Entropy (8bit):	5.462668685745912
Encrypted:	false
SSDEEP:	1536:tjspYRrxlhd0fq3agV3IcgPPPI3r7DAQHCloIB3Tj7xHw:tjZLCtxQ
MD5:	413FCC759CC19821B61B6941808B29B5
SHA1:	1AD23B8A202043539C20681B1B3E9F3BC5D55133
SHA-256:	DAF7759FEDD9AF6C4D7E374B0D056547AE7CB245EC24A1C4ACF02932F30DC536
SHA-512:	E9BF8A74FEF494990AAFD15A0F21E0398DC28B4939C8F9F8AA1F3FFBD18056C8D1AB282B081F5C56F0928C48E30E768F7E347929304B55547F9CA8C1AABD80B8
Malicious:	false
Preview:	var WcpConsent;!function(){var e={229:function(e){window,e.exports=function(e){var t={};function o(n){if(t[n])return t[n].exports;var r=t[n]={i:n,l:!1,exports:{}};return e[n].call(r.exports,r,r.exports,o),r.l=!0,r.exports}return o.m=e,o.c=t,o.d=function(e,t,n){o.o(e,t)\|\|Object.defineProperty(e,t,{enumerable:!0,get:n})},o.r=function(e){"undefined"!=typeof Symbol&&Symbol.toStringTag&&Object.defineProperty(e,Symbol.toStringTag,{value:"Module"}),Object.defineProperty(e,"__esModule",{value:!0})},o.t=function(e,t){if(1&t&&(e=o(e)),8&t)return e;if(4&t&&"object"==typeof e&&e&&e.__esModule)return e;var n=Object.create(null);if(o.r(n),Object.defineProperty(n,"default",{enumerable:!0,value:e}),2&t&&"string"!=typeof e)for(var r in e)o.d(n,r,function(t){return e[t]}.bind(null,r));return n},o.n=function(e){var t=e&&e.__esModule?function(){return e.default}:function(){return e};return o.d(t,"a",t),t},o.o=function(e,t){return Object.prototype.hasOwnProperty.call(e,t)},o.p="",o(o.s=3)}([function(e,t,o)

Chrome Cache Entry: 165

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (52717), with no line terminators
Category:	downloaded
Size (bytes):	52717
Entropy (8bit):	5.462668685745912
Encrypted:	false
SSDEEP:	1536:tjspYRrxlhd0fq3agV3IcgPPPI3r7DAQHCloIB3Tj7xHw:tjZLCtxQ
MD5:	413FCC759CC19821B61B6941808B29B5
SHA1:	1AD23B8A202043539C20681B1B3E9F3BC5D55133
SHA-256:	DAF7759FEDD9AF6C4D7E374B0D056547AE7CB245EC24A1C4ACF02932F30DC536
SHA-512:	E9BF8A74FEF494990AAFD15A0F21E0398DC28B4939C8F9F8AA1F3FFBD18056C8D1AB282B081F5C56F0928C48E30E768F7E347929304B55547F9CA8C1AABD80B8
Malicious:	false
URL:	https://wcpstatic.microsoft.com/mscc/lib/v2/wcp-consent.js
Preview:	var WcpConsent;!function(){var e={229:function(e){window,e.exports=function(e){var t={};function o(n){if(t[n])return t[n].exports;var r=t[n]={i:n,l:!1,exports:{}};return e[n].call(r.exports,r,r.exports,o),r.l=!0,r.exports}return o.m=e,o.c=t,o.d=function(e,t,n){o.o(e,t)\|\|Object.defineProperty(e,t,{enumerable:!0,get:n})},o.r=function(e){"undefined"!=typeof Symbol&&Symbol.toStringTag&&Object.defineProperty(e,Symbol.toStringTag,{value:"Module"}),Object.defineProperty(e,"__esModule",{value:!0})},o.t=function(e,t){if(1&t&&(e=o(e)),8&t)return e;if(4&t&&"object"==typeof e&&e&&e.__esModule)return e;var n=Object.create(null);if(o.r(n),Object.defineProperty(n,"default",{enumerable:!0,value:e}),2&t&&"string"!=typeof e)for(var r in e)o.d(n,r,function(t){return e[t]}.bind(null,r));return n},o.n=function(e){var t=e&&e.__esModule?function(){return e.default}:function(){return e};return o.d(t,"a",t),t},o.o=function(e,t){return Object.prototype.hasOwnProperty.call(e,t)},o.p="",o(o.s=3)}([function(e,t,o)

Chrome Cache Entry: 166

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	exported SGML document, ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	1173007
Entropy (8bit):	5.503893944397598
Encrypted:	false
SSDEEP:	24576:VMga+4IVzOjS1Jho1WXQFjTEr39/jHXzT:VMcVzOjS1Jho1WXQar39/bXzT
MD5:	2E00D51C98DBB338E81054F240E1DEB2
SHA1:	D33BAC6B041064AE4330DCC2D958EBE4C28EBE58
SHA-256:	300480069078B5892D2363A2B65E2DFBBF30FE5C80F83EDBFECF4610FD093862
SHA-512:	B6268D980CE9CB729C82DBA22F04FD592952B2A1AAB43079CA5330C68A86E72B0D232CE4070DB893A5054EE5C68325C92C9F1A33F868D61EBB35129E74FC7EF9
Malicious:	false
URL:	https://learn.microsoft.com/static/third-party/MathJax/3.2.2/tex-mml-chtml.js
Preview:	(function(){"use strict";var __webpack_modules__={351:function(t,e,r){var n,o=this&&this.__extends\|\|(n=function(t,e){return n=Object.setPrototypeOf\|\|{__proto__:[]}instanceof Array&&function(t,e){t.__proto__=e}\|\|function(t,e){for(var r in e)Object.prototype.hasOwnProperty.call(e,r)&&(t[r]=e[r])},n(t,e)},function(t,e){if("function"!=typeof e&&null!==e)throw new TypeError("Class extends value "+String(e)+" is not a constructor or null");function r(){this.constructor=t}n(t,e),t.prototype=null===e?Object.create(e):(r.prototype=e.prototype,new r)}),i=this&&this.__assign\|\|function(){return i=Object.assign\|\|function(t){for(var e,r=1,n=arguments.length;r<n;r++)for(var o in e=arguments[r])Object.prototype.hasOwnProperty.call(e,o)&&(t[o]=e[o]);return t},i.apply(this,arguments)},s=this&&this.__read\|\|function(t,e){var r="function"==typeof Symbol&&t[Symbol.iterator];if(!r)return t;var n,o,i=r.call(t),s=[];try{for(;(void 0===e\|\|e-- >0)&&!(n=i.next()).done;)s.push(n.value)}catch(t){o={error:t}}finally

Chrome Cache Entry: 167

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 533 x 478, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	13339
Entropy (8bit):	7.683569563478597
Encrypted:	false
SSDEEP:	192:zjSKAj04ndWb6OuzZjk6TsEaJS0/bJur2Gz4Imm3MhE4NfM:zutfW69XTspsG3G0TfhEQM
MD5:	512625CF8F40021445D74253DC7C28C0
SHA1:	F6B27CE0F7D4E48E34FDDCA8A96337F07CFFE730
SHA-256:	1D4DCEE8511D5371FEC911660D6049782E12901C662B409A5C675772E9B87369
SHA-512:	AE02319D03884D758A86C286B6F593BDFFD067885D56D82EEB8215FDCB41637C7BB9109039E7FBC93AD246D030C368FB285B3161976ED485ABC5A8DF6DF9A38C
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/install/media/application-not-started/repair-tool-changes-complete.png
Preview:	.PNG........IHDR.............,#......sRGB.........gAMA......a.....pHYs..........o.d..3.IDATx^..].5Y...C.$..tH .NF.I&A0..;.r.fF.#..!7...'..3.0.../..s....."!.y...~....4....om.g.3.BTP......j..g.zVU....u...a.Z..j..U....y......$.....I...pAR...\.T....$.....I...pAR...\.T..p....5O>.d...}Rg.$....@.4....fb1.o.I...7..<.P.....n0.D.P.....n..L.P.....n8.......P.~......n(+..'. ......J.vM,H......W...h.T....$.....I...pAR...\.T....$.....I...pAR...\.T....$.....I...pAR...\.T....$......'....w....g....\|../5_.......T...~.y.'.'.\|...W..[...C.)......\|.[.[WK...w...w..y.{..\|.#.n>...5....5...h>..O6O>.Xx....o.B........g?.........~....?o...w.......}..-_k^........l....\|.D.TH.....o..B'..(.W-%...?...W.......E?h..........~.......?...~,..}...o^...5ox..bI.mo{[s.}.5.<.L.......<......Y.W......K..Q._...Iu...2...e)d]4.}Y..............k.%k..s.'..L(..o4...g...z............N.X.....W.O.^.4.....7......i~._7..~,bI......3.0RRq..\|.Mk..?.{.K_...t.........SYG.W^#).N^..._W...(.8.7.....W....7...m

Chrome Cache Entry: 168

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors
Category:	downloaded
Size (bytes):	17174
Entropy (8bit):	2.9129715116732746
Encrypted:	false
SSDEEP:	24:QSNTmTFxg4lyyyyyyyyyyyyyio7eeeeeeeeekzgsLsLsLsLsLsQZp:nfgyyyyyyyyyyyyynzQQQQQO
MD5:	12E3DAC858061D088023B2BD48E2FA96
SHA1:	E08CE1A144ECEAE0C3C2EA7A9D6FBC5658F24CE5
SHA-256:	90CDAF487716184E4034000935C605D1633926D348116D198F355A98B8C6CD21
SHA-512:	C5030C55A855E7A9E20E22F4C70BF1E0F3C558A9B7D501CFAB6992AC2656AE5E41B050CCAC541EFA55F9603E0D349B247EB4912EE169D44044271789C719CD01
Malicious:	false
URL:	https://learn.microsoft.com/favicon.ico
Preview:	..............h(..f...HH...........(..00......h....6.. ...........=...............@..........(....A..(....................(....................................."P.........................................."""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333""""""""""""""""""""""""""

Chrome Cache Entry: 169

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	5655
Entropy (8bit):	4.790648170893192
Encrypted:	false
SSDEEP:	96:ogVOjPWccI3aDNjExAjfWQpL0dpwmWMv7BRevy8RJNjvZPyJ2tlh7RewZUZSeZV1:og2cUaDNjESLWQN0dpwm99qllVR7pUZF
MD5:	D3383426D3B6D3B34CFE726209647339
SHA1:	E656FAA1B2A5235C9E745C534BC7FB10396484D7
SHA-256:	6B7B929D611665A1F5EC015EB590FC70BA1F2C6D0D131F5796A53874C0ADFDE2
SHA-512:	F39A67F02165DB08D31B50FDB21667A286C15B774D3E31FA0ED727DA29BFE7C5C50F691367AC19511660BB38EA9B9F3395C27865AF9A1FB3EA8DD90C15004669
Malicious:	false
Preview:	{"brandLink":{"biName":"learn","displayName":"Learn","href":"/"},"featuredContent":[{"biName":"1-microsoft-learn-for-organizations","description":"Access curated resources to upskill your team and close skills gaps.","href":"/training/organizations/","supertitle":"Microsoft Learn for Organizations","title":"Boost your team\u0027s technical skills"}],"metadata":{"git_commit_id":"fc6a701829ff5069dcb2f756662cd778bf45c3a3"},"navCategories":[{"biName":"1-discover","panel":{"panelContent":[{"biName":"1-documentation","componentType":"header-panel-card","description":"In-depth articles on Microsoft developer tools and technologies","href":"/docs/","title":"Documentation"},{"biName":"2-training","componentType":"header-panel-card","description":"Personalized learning paths and courses","href":"/training/","title":"Training"},{"biName":"3-credentials","componentType":"header-panel-card","description":"Globally recognized, industry-endorsed credentials","href":"/credentials/","title":"Credential

Chrome Cache Entry: 170

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors
Category:	dropped
Size (bytes):	17174
Entropy (8bit):	2.9129715116732746
Encrypted:	false
SSDEEP:	24:QSNTmTFxg4lyyyyyyyyyyyyyio7eeeeeeeeekzgsLsLsLsLsLsQZp:nfgyyyyyyyyyyyyynzQQQQQO
MD5:	12E3DAC858061D088023B2BD48E2FA96
SHA1:	E08CE1A144ECEAE0C3C2EA7A9D6FBC5658F24CE5
SHA-256:	90CDAF487716184E4034000935C605D1633926D348116D198F355A98B8C6CD21
SHA-512:	C5030C55A855E7A9E20E22F4C70BF1E0F3C558A9B7D501CFAB6992AC2656AE5E41B050CCAC541EFA55F9603E0D349B247EB4912EE169D44044271789C719CD01
Malicious:	false
Preview:	..............h(..f...HH...........(..00......h....6.. ...........=...............@..........(....A..(....................(....................................."P.........................................."""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333""""""""""""""""""""""""""

Chrome Cache Entry: 171

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	4.241202481433726
Encrypted:	false
SSDEEP:	3:YozDD/RNgQJzRWWlKFiFD3e4xCzY:YovtNgmzR/wYFDxkY
MD5:	9E576E34B18E986347909C29AE6A82C6
SHA1:	532C767978DC2B55854B3CA2D2DF5B4DB221C934
SHA-256:	88BDF5AF090328963973990DE427779F9C4DF3B8E1F5BADC3D972BAC3087006D
SHA-512:	5EF6DCFFD93434D45760888BF4B95FF134D53F34DA9DC904AD3C5EBEDC58409073483F531FEA4233869ED3EC75F38B022A70B2E179A5D3A13BDB10AB5C46B124
Malicious:	false
Preview:	{"Message":"The requested resource does not support http method 'GET'."}

Chrome Cache Entry: 172

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 658 x 480, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	13842
Entropy (8bit):	7.802399161550213
Encrypted:	false
SSDEEP:	192:NLNf+jBQsDHg7av3EEondO8PuRu2mIYXEIiDm42NpsHFMHfgnJ4K2DVwv:NLt+1jDmY+ndXwjLUpiDwpzfwoDVk
MD5:	F6EC97C43480D41695065AD55A97B382
SHA1:	D9C3D0895A5ED1A3951B8774B519B8217F0A54C5
SHA-256:	07A599FAB1E66BABC430E5FED3029F25FF3F4EA2DD0EC8968FFBA71EF1872F68
SHA-512:	22462763178409D60609761A2AF734F97B35B9A818EC1FD9046AFAB489AAD83CE34896EE8586EFE402EA7739ECF088BC2DB5C1C8E4FB39E6A0FC5B3ADC6B4A9B
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/install/media/application-not-started/install-3-5.png
Preview:	.PNG........IHDR................1....sRGB.........gAMA......a.....pHYs..........o.d..5.IDATx^..[.,.]...../<.!.B(/y..).F\r...!(.H..a ..B.~..A..KXA.M...6..8...!1....l./.X.1....2.`.y"l..R...V.....{...}._gWW.Z.VUw.N...U..P@..... ..@.A...".$..E.I.........$..("H..PD..... ..p....U.}.{.....l..A.....A........s.......D.0...@....E..x........L. /.".A.....$...Y."...%.I..["../.&.I..[`.0..IA.........p4.I.........$..("H..PD..... ..@.A...".$..E.I.........$..("H..PD..... ..@.A...".$..E.>H...O.................?.~.......].7.....a?....(H....m.G..G..a.P..?yo......f?...o. .B.....mo{[....:9<].....7.....a.....S..Cd.5,.R....#....>......._g.....Wo\|.....z.g.........w.T...]x.>.....y(.........6....[..px...U....~.~hu...}H.......~.L... ....r...iY.$..Id..Ax"../....._..U....OTo\|.Mh.km..A.k..k....n.C`\|._\=...o...a.e.. ...&.A2..k.. ....X.+...C..P....y..>.{._..(H....8(.?...w.}M.........:s_!.m.........BY..T..z.5{.W.~..6.....F....bq....m.....?.......v....o..o...ki...iX.$......\]V...V...

Chrome Cache Entry: 173

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (32029), with no line terminators
Category:	dropped
Size (bytes):	32029
Entropy (8bit):	4.903574747591743
Encrypted:	false
SSDEEP:	384:FnvJOb4OLIch+KCnMet7NPXlJl+HjZjBTRdE0zIwHdZjV8din4ELi:5hOEO8chkMet7pCjBfnWOLi
MD5:	178A496645B67ABCE799D62DB8095CAB
SHA1:	0C264AFE3DB13E5B00A0E497FB6AB8556EB97939
SHA-256:	70A34968E8715CF14074EA089B66896A9BC10AF79352DB8A40DA83467891F92D
SHA-512:	EF7CDA8F433A47BABCBB74A57C3B4A20251A6D52E5C9CBEC33B5889A110760719180776BD9C7D7964CF140F950CAB8BC2AD08EAB5FA650FE7744FD9242C67E23
Malicious:	false
Preview:	{"items":[{"href":"./","toc_title":".NET Framework documentation"},{"href":"get-started/overview","toc_title":"Overview of .NET Framework"},{"children":[{"href":"get-started/","toc_title":"Overview"},{"href":"get-started/out-of-band-releases","toc_title":"Out-of-band releases"},{"href":"get-started/system-requirements","toc_title":"System requirements"}],"toc_title":"Get started"},{"children":[{"href":"install/","toc_title":"Overview"},{"href":"install/guide-for-developers","toc_title":"For developers"},{"children":[{"href":"install/on-windows-11","toc_title":"Windows 11"},{"href":"install/on-windows-10","toc_title":"Windows 10 and Windows Server 2016"},{"href":"install/on-windows-8-1","toc_title":"Windows 8.1 and Windows Server 2012 R2"},{"href":"install/on-windows-8","toc_title":"Windows 8 and Windows Server 2012"},{"href":"install/on-server-2022","toc_title":"Windows Server 2022"},{"href":"install/on-server-2019","toc_title":"Windows Server 2019"}],"toc_title":"By OS version"},{"hre

Chrome Cache Entry: 174

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	5655
Entropy (8bit):	4.790648170893192
Encrypted:	false
SSDEEP:	96:ogVOjPWccI3aDNjExAjfWQpL0dpwmWMv7BRevy8RJNjvZPyJ2tlh7RewZUZSeZV1:og2cUaDNjESLWQN0dpwm99qllVR7pUZF
MD5:	D3383426D3B6D3B34CFE726209647339
SHA1:	E656FAA1B2A5235C9E745C534BC7FB10396484D7
SHA-256:	6B7B929D611665A1F5EC015EB590FC70BA1F2C6D0D131F5796A53874C0ADFDE2
SHA-512:	F39A67F02165DB08D31B50FDB21667A286C15B774D3E31FA0ED727DA29BFE7C5C50F691367AC19511660BB38EA9B9F3395C27865AF9A1FB3EA8DD90C15004669
Malicious:	false
URL:	https://learn.microsoft.com/en-us/content-nav/site-header/site-header.json?
Preview:	{"brandLink":{"biName":"learn","displayName":"Learn","href":"/"},"featuredContent":[{"biName":"1-microsoft-learn-for-organizations","description":"Access curated resources to upskill your team and close skills gaps.","href":"/training/organizations/","supertitle":"Microsoft Learn for Organizations","title":"Boost your team\u0027s technical skills"}],"metadata":{"git_commit_id":"fc6a701829ff5069dcb2f756662cd778bf45c3a3"},"navCategories":[{"biName":"1-discover","panel":{"panelContent":[{"biName":"1-documentation","componentType":"header-panel-card","description":"In-depth articles on Microsoft developer tools and technologies","href":"/docs/","title":"Documentation"},{"biName":"2-training","componentType":"header-panel-card","description":"Personalized learning paths and courses","href":"/training/","title":"Training"},{"biName":"3-credentials","componentType":"header-panel-card","description":"Globally recognized, industry-endorsed credentials","href":"/credentials/","title":"Credential

Chrome Cache Entry: 175

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 475 x 212, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	35005
Entropy (8bit):	7.980061050467981
Encrypted:	false
SSDEEP:	768:aHBEr/QXnbCgWotMq4AZZivq2/Qu0cEv1FjHBep6U0Z/68R:ahWqbTWiM7ACvdIdldhep4rR
MD5:	522037F008E03C9448AE0AAAF09E93CB
SHA1:	8A32997EAB79246BEED5A37DB0C92FBFB006BEF2
SHA-256:	983C35607C4FB0B529CA732BE42115D3FCAAC947CEE9C9632F7CACDBDECAF5A7
SHA-512:	643EC613B2E7BDBB2F61E1799C189B0E3392EA5AE10845EB0B1F1542A03569E886F4B54D5B38AF10E78DB49C71357108C94589474B181F6A4573B86CF2D6F0D8
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/install/media/application-not-started/app-could-not-be-started.png
Preview:	.PNG........IHDR..............[.U....sRGB.........gAMA......a.....pHYs..........+.....RIDATx^..`........B hpwww(PJ....R.B.....K[j....@ H ..r:...].P._.`...K.ffg.v.ygf.TM.4.m...`.D".H$......"##..2e.X.t..Y".H$...d..PK.V".H$..uVm.,.H$.....b+.H$.I-#.V".H$.ZF..D".H$...[.D".Hj.)...D"..2Rl%..D".e..J$..DR.H..H$.....b+.H$..9..Neee.X,.B.\/.....o.b+.H$..9...q...EHU....p.....=z....b.7.q..........N.. ....cUAX.9...m'_...2.`.g{...4.H.9.p.4...K ^.....`.\|.n..]..m..`W..W.H.~..\|.^.a..K.6......_....K..w....9......^.....&...R....[...w..Ix=.:..^/..Epp0.5.....QRR...l....S.b.5.c.6...5..8.\....z...I......&.>....../.{.=...]'c......[.E`@Cg......Z.....c.f..,.y\|,.{.o@.j..2..:.&l4.{.]Ll.N.0..b:b...g.n.........I...Ewc....[..,i`v......F...il\|.c,{.-.....%BP.U........y.x....6..E2..n.W...J .*..`..r....F....#BCC......\|.L&........O...'........\.....;...q.n$...7...ga..x....)..A...0.{1..'1../...+yRC...W.-..b..c0dDG...U[po....2eG.G.../.@........h.:.k?.......Q...

Chrome Cache Entry: 176

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1478
Entropy (8bit):	5.030941252322257
Encrypted:	false
SSDEEP:	24:TGAg3Efef6tfTf/fffCfxfdffW4N5f0f8fK8zyRWmmkYRWDKslbzP3LTPv4NUhqI:TK0W6bXnq512ysUbkfKCvUjeGxbu
MD5:	020629EBA820F2E09D8CDA1A753C032B
SHA1:	D91A65036E4C36B07AE3641E32F23F8DD616BD17
SHA-256:	F8AE8A1DC7CE7877B9FB9299183D2EBB3BEFAD0B6489AE785D99047EC2EB92D1
SHA-512:	EF5A5C7A301DE55D103B1BE375D988970D9C4ECD62CE464F730C49E622128F431761D641E1DFAA32CA03F8280B435AE909486806DF62A538B48337725EB63CE1
Malicious:	false
Preview:	// ES5 script for back compat with unsupported browsers...!(function () {...'use strict';...// Keep in sync with environment/browser.ts...var supportedBrowser =....typeof Blob === 'function' &&....typeof PerformanceObserver === 'function' &&....typeof Intl === 'object' &&....typeof MutationObserver === 'function' &&....typeof URLSearchParams === 'function' &&....typeof WebSocket === 'function' &&....typeof IntersectionObserver === 'function' &&....typeof queueMicrotask === 'function' &&....typeof TextEncoder === 'function' &&....typeof TextDecoder === 'function' &&....typeof customElements === 'object' &&....typeof HTMLDetailsElement === 'function' &&....typeof AbortController === 'function' &&....typeof AbortSignal === 'function' &&....'entries' in FormData.prototype &&....'toggleAttribute' in Element.prototype &&....'replaceChildren' in Element.prototype &&....// ES2019....'fromEntries' in Object &&....'flatMap' in Array.prototype &&....'trimEnd' in String.prototype &&....// ES2020..

Chrome Cache Entry: 177

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	4897
Entropy (8bit):	4.794639101874543
Encrypted:	false
SSDEEP:	96:A0AIvEQ+KfZcbhaW9dp45qtAdflfDOFnymoLByzVqrpCvJ4QG63JjJ+do88HxbqP:dgQ+KfZcbhaWjp45qtAdflfDOFnNgBy4
MD5:	84E6C95F0E5378BDA94FA965C4692FAF
SHA1:	7C1D6572906509B08F8CD7B7A33EB9F9697EE6D1
SHA-256:	88A4A7B4F1160F8CAD3EB835116C29AC39659D586D4DADC54D9E40AC7E1BC610
SHA-512:	D34BFF37F8402B4A1FEE3C26F247A86D72666647A10E83D711A1BED1D24C6FC13674D65DCC037C22811B227FEC34B5DE20442191A42F9D78FC79D55FD5792761
Malicious:	false
URL:	https://learn.microsoft.com/en-us/content-nav/MSDocsHeader-DotNet.json?
Preview:	{"callToAction":{"primary":{"biName":"download-dotnet","href":"https://dotnet.microsoft.com/download","kind":"link","title":"Download .NET"}},"category":{"biName":"dotnet","href":"/dotnet/","kind":"link","title":".NET"},"items":[{"biName":"1-languages","items":[{"biName":"1-c-sharp","href":"/dotnet/csharp/","kind":"link","title":"C#"},{"biName":"2-f-sharp","href":"/dotnet/fsharp/","kind":"link","title":"F#"},{"biName":"3-visual-basic","href":"/dotnet/visual-basic/","kind":"link","title":"Visual Basic"}],"kind":"menu","title":"Languages"},{"biName":"2-features","items":[{"biName":"1-fundamental","href":"/dotnet/fundamentals/","kind":"link","title":"Fundamentals"},{"biName":"2-tools-and-diagnostics","href":"/dotnet/navigate/tools-diagnostics/","kind":"link","title":"Tools and diagnostics"},{"biName":"3-ai","items":[{"biName":"1-generative-ai","href":"/dotnet/ai/","kind":"link","title":"Generative AI"},{"biName":"2-mlnet","href":"/dotnet/machine-learning/","kind":"link","title":"ML.NET"}]

Chrome Cache Entry: 178

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	4.241202481433726
Encrypted:	false
SSDEEP:	3:YozDD/RNgQJzRWWlKFiFD3e4xCzY:YovtNgmzR/wYFDxkY
MD5:	9E576E34B18E986347909C29AE6A82C6
SHA1:	532C767978DC2B55854B3CA2D2DF5B4DB221C934
SHA-256:	88BDF5AF090328963973990DE427779F9C4DF3B8E1F5BADC3D972BAC3087006D
SHA-512:	5EF6DCFFD93434D45760888BF4B95FF134D53F34DA9DC904AD3C5EBEDC58409073483F531FEA4233869ED3EC75F38B022A70B2E179A5D3A13BDB10AB5C46B124
Malicious:	false
Preview:	{"Message":"The requested resource does not support http method 'GET'."}

Chrome Cache Entry: 179

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	exported SGML document, ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	1173007
Entropy (8bit):	5.503893944397598
Encrypted:	false
SSDEEP:	24576:VMga+4IVzOjS1Jho1WXQFjTEr39/jHXzT:VMcVzOjS1Jho1WXQar39/bXzT
MD5:	2E00D51C98DBB338E81054F240E1DEB2
SHA1:	D33BAC6B041064AE4330DCC2D958EBE4C28EBE58
SHA-256:	300480069078B5892D2363A2B65E2DFBBF30FE5C80F83EDBFECF4610FD093862
SHA-512:	B6268D980CE9CB729C82DBA22F04FD592952B2A1AAB43079CA5330C68A86E72B0D232CE4070DB893A5054EE5C68325C92C9F1A33F868D61EBB35129E74FC7EF9
Malicious:	false
Preview:	(function(){"use strict";var __webpack_modules__={351:function(t,e,r){var n,o=this&&this.__extends\|\|(n=function(t,e){return n=Object.setPrototypeOf\|\|{__proto__:[]}instanceof Array&&function(t,e){t.__proto__=e}\|\|function(t,e){for(var r in e)Object.prototype.hasOwnProperty.call(e,r)&&(t[r]=e[r])},n(t,e)},function(t,e){if("function"!=typeof e&&null!==e)throw new TypeError("Class extends value "+String(e)+" is not a constructor or null");function r(){this.constructor=t}n(t,e),t.prototype=null===e?Object.create(e):(r.prototype=e.prototype,new r)}),i=this&&this.__assign\|\|function(){return i=Object.assign\|\|function(t){for(var e,r=1,n=arguments.length;r<n;r++)for(var o in e=arguments[r])Object.prototype.hasOwnProperty.call(e,o)&&(t[o]=e[o]);return t},i.apply(this,arguments)},s=this&&this.__read\|\|function(t,e){var r="function"==typeof Symbol&&t[Symbol.iterator];if(!r)return t;var n,o,i=r.call(t),s=[];try{for(;(void 0===e\|\|e-- >0)&&!(n=i.next()).done;)s.push(n.value)}catch(t){o={error:t}}finally

Chrome Cache Entry: 180

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (46884)
Category:	dropped
Size (bytes):	1729946
Entropy (8bit):	5.506784610641439
Encrypted:	false
SSDEEP:	24576:BBweqomwDtVnoZlsG3QO/GFGVgTvjC10wCTOWIzE+0RlMVSB1DkCXWEea87ZGxnJ:BiwDbotVSB1DkCXWEe57ZGxnS+Vh2xDg
MD5:	95DE4EB9C18E800B4E68761D99845561
SHA1:	8CD61A75D8E9D5A1EB894284850AAB6C1E547D6D
SHA-256:	15163779156DA543DEFAAFC12F7C1A850C91411FE7495F03C3BFE0231D5057E3
SHA-512:	86BDE4F52A505FAC4BC49A30C0BDB145D88F568917E8EC89C26CFAA7E7DF85E9744291470E3587312196D93FB6BAA6F75B29D88CB722B7969C284C9A31886DBE
Malicious:	false
Preview:	"use strict";(()=>{var qge=Object.create;var Mx=Object.defineProperty;var OU=Object.getOwnPropertyDescriptor;var Fge=Object.getOwnPropertyNames;var Uge=Object.getPrototypeOf,Oge=Object.prototype.hasOwnProperty;var Hge=(e,t,n)=>t in e?Mx(e,t,{enumerable:!0,configurable:!0,writable:!0,value:n}):e[t]=n;var Ie=(e,t)=>()=>(t\|\|e((t={exports:{}}).exports,t),t.exports);var Bge=(e,t,n,o)=>{if(t&&typeof t=="object"\|\|typeof t=="function")for(let r of Fge(t))!Oge.call(e,r)&&r!==n&&Mx(e,r,{get:()=>t[r],enumerable:!(o=OU(t,r))\|\|o.enumerable});return e};var Rd=(e,t,n)=>(n=e!=null?qge(Uge(e)):{},Bge(t\|\|!e\|\|!e.__esModule?Mx(n,"default",{value:e,enumerable:!0}):n,e));var U=(e,t,n,o)=>{for(var r=o>1?void 0:o?OU(t,n):t,s=e.length-1,i;s>=0;s--)(i=e[s])&&(r=(o?i(t,n,r):i(r))\|\|r);return o&&r&&Mx(t,n,r),r};var Ni=(e,t,n)=>(Hge(e,typeof t!="symbol"?t+"":t,n),n),lL=(e,t,n)=>{if(!t.has(e))throw TypeError("Cannot "+n)};var xt=(e,t,n)=>(lL(e,t,"read from private field"),n?n.call(e):t.get(e)),On=(e,t,n)=>{if(t.has(

Chrome Cache Entry: 181

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1154
Entropy (8bit):	4.59126408969148
Encrypted:	false
SSDEEP:	24:txFRuJpzYeGK+VS6ckNL2091JP/UcHc8oQJ1sUWMLc/jH6GbKqjHJIOHA:JsfcU6ckNL2091Z/U/YsUDM+GhS
MD5:	37258A983459AE1C2E4F1E551665F388
SHA1:	603A4E9115E613CC827206CF792C62AEB606C941
SHA-256:	8E34F3807B4BF495D8954E7229681DA8D0DD101DD6DDC2AD7F90CD2983802B44
SHA-512:	184CB63EF510143B0AF013F506411C917D68BB63F2CFA47EA2A42688FD4F55F3B820AF94F87083C24F48AACEE6A692199E185FC5C5CFBED5D70790454EED7F5C
Malicious:	false
URL:	https://learn.microsoft.com/en-us/media/logos/logo_net.svg
Preview:	<svg width="456" height="456" viewBox="0 0 456 456" fill="none" xmlns="http://www.w3.org/2000/svg">..<rect width="456" height="456" fill="#512BD4"/>..<path d="M81.2738 291.333C78.0496 291.333 75.309 290.259 73.052 288.11C70.795 285.906 69.6665 283.289 69.6665 280.259C69.6665 277.173 70.795 274.529 73.052 272.325C75.309 270.121 78.0496 269.019 81.2738 269.019C84.5518 269.019 87.3193 270.121 89.5763 272.325C91.887 274.529 93.0424 277.173 93.0424 280.259C93.0424 283.289 91.887 285.906 89.5763 288.11C87.3193 290.259 84.5518 291.333 81.2738 291.333Z" fill="white"/>..<path d="M210.167 289.515H189.209L133.994 202.406C132.597 200.202 131.441 197.915 130.528 195.546H130.044C130.474 198.081 130.689 203.508 130.689 211.827V289.515H112.149V171H134.477L187.839 256.043C190.096 259.57 191.547 261.994 192.192 263.316H192.514C191.977 260.176 191.708 254.859 191.708 247.365V171H210.167V289.515Z" fill="white"/>..<path d="M300.449 289.515H235.561V171H297.87V187.695H254.746V221.249H294.485V237.861H254.746V

Chrome Cache Entry: 182

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (32029), with no line terminators
Category:	downloaded
Size (bytes):	32029
Entropy (8bit):	4.903574747591743
Encrypted:	false
SSDEEP:	384:FnvJOb4OLIch+KCnMet7NPXlJl+HjZjBTRdE0zIwHdZjV8din4ELi:5hOEO8chkMet7pCjBfnWOLi
MD5:	178A496645B67ABCE799D62DB8095CAB
SHA1:	0C264AFE3DB13E5B00A0E497FB6AB8556EB97939
SHA-256:	70A34968E8715CF14074EA089B66896A9BC10AF79352DB8A40DA83467891F92D
SHA-512:	EF7CDA8F433A47BABCBB74A57C3B4A20251A6D52E5C9CBEC33B5889A110760719180776BD9C7D7964CF140F950CAB8BC2AD08EAB5FA650FE7744FD9242C67E23
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/toc.json
Preview:	{"items":[{"href":"./","toc_title":".NET Framework documentation"},{"href":"get-started/overview","toc_title":"Overview of .NET Framework"},{"children":[{"href":"get-started/","toc_title":"Overview"},{"href":"get-started/out-of-band-releases","toc_title":"Out-of-band releases"},{"href":"get-started/system-requirements","toc_title":"System requirements"}],"toc_title":"Get started"},{"children":[{"href":"install/","toc_title":"Overview"},{"href":"install/guide-for-developers","toc_title":"For developers"},{"children":[{"href":"install/on-windows-11","toc_title":"Windows 11"},{"href":"install/on-windows-10","toc_title":"Windows 10 and Windows Server 2016"},{"href":"install/on-windows-8-1","toc_title":"Windows 8.1 and Windows Server 2012 R2"},{"href":"install/on-windows-8","toc_title":"Windows 8 and Windows Server 2012"},{"href":"install/on-server-2022","toc_title":"Windows Server 2022"},{"href":"install/on-server-2019","toc_title":"Windows Server 2019"}],"toc_title":"By OS version"},{"hre

Chrome Cache Entry: 183

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with CRLF line terminators
Category:	downloaded
Size (bytes):	1478
Entropy (8bit):	5.030941252322257
Encrypted:	false
SSDEEP:	24:TGAg3Efef6tfTf/fffCfxfdffW4N5f0f8fK8zyRWmmkYRWDKslbzP3LTPv4NUhqI:TK0W6bXnq512ysUbkfKCvUjeGxbu
MD5:	020629EBA820F2E09D8CDA1A753C032B
SHA1:	D91A65036E4C36B07AE3641E32F23F8DD616BD17
SHA-256:	F8AE8A1DC7CE7877B9FB9299183D2EBB3BEFAD0B6489AE785D99047EC2EB92D1
SHA-512:	EF5A5C7A301DE55D103B1BE375D988970D9C4ECD62CE464F730C49E622128F431761D641E1DFAA32CA03F8280B435AE909486806DF62A538B48337725EB63CE1
Malicious:	false
URL:	https://learn.microsoft.com/static/assets/0.4.027605576/global/deprecation.js
Preview:	// ES5 script for back compat with unsupported browsers...!(function () {...'use strict';...// Keep in sync with environment/browser.ts...var supportedBrowser =....typeof Blob === 'function' &&....typeof PerformanceObserver === 'function' &&....typeof Intl === 'object' &&....typeof MutationObserver === 'function' &&....typeof URLSearchParams === 'function' &&....typeof WebSocket === 'function' &&....typeof IntersectionObserver === 'function' &&....typeof queueMicrotask === 'function' &&....typeof TextEncoder === 'function' &&....typeof TextDecoder === 'function' &&....typeof customElements === 'object' &&....typeof HTMLDetailsElement === 'function' &&....typeof AbortController === 'function' &&....typeof AbortSignal === 'function' &&....'entries' in FormData.prototype &&....'toggleAttribute' in Element.prototype &&....'replaceChildren' in Element.prototype &&....// ES2019....'fromEntries' in Object &&....'flatMap' in Array.prototype &&....'trimEnd' in String.prototype &&....// ES2020..

Chrome Cache Entry: 184

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 475 x 212, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	35005
Entropy (8bit):	7.980061050467981
Encrypted:	false
SSDEEP:	768:aHBEr/QXnbCgWotMq4AZZivq2/Qu0cEv1FjHBep6U0Z/68R:ahWqbTWiM7ACvdIdldhep4rR
MD5:	522037F008E03C9448AE0AAAF09E93CB
SHA1:	8A32997EAB79246BEED5A37DB0C92FBFB006BEF2
SHA-256:	983C35607C4FB0B529CA732BE42115D3FCAAC947CEE9C9632F7CACDBDECAF5A7
SHA-512:	643EC613B2E7BDBB2F61E1799C189B0E3392EA5AE10845EB0B1F1542A03569E886F4B54D5B38AF10E78DB49C71357108C94589474B181F6A4573B86CF2D6F0D8
Malicious:	false
Preview:	.PNG........IHDR..............[.U....sRGB.........gAMA......a.....pHYs..........+.....RIDATx^..`........B hpwww(PJ....R.B.....K[j....@ H ..r:...].P._.`...K.ffg.v.ygf.TM.4.m...`.D".H$......"##..2e.X.t..Y".H$...d..PK.V".H$..uVm.,.H$.....b+.H$.I-#.V".H$.ZF..D".H$...[.D".Hj.)...D"..2Rl%..D".e..J$..DR.H..H$.....b+.H$..9..Neee.X,.B.\/.....o.b+.H$..9...q...EHU....p.....=z....b.7.q..........N.. ....cUAX.9...m'_...2.`.g{...4.H.9.p.4...K ^.....`.\|.n..]..m..`W..W.H.~..\|.^.a..K.6......_....K..w....9......^.....&...R....[...w..Ix=.:..^/..Epp0.5.....QRR...l....S.b.5.c.6...5..8.\....z...I......&.>....../.{.=...]'c......[.E`@Cg......Z.....c.f..,.y\|,.{.o@.j..2..:.&l4.{.]Ll.N.0..b:b...g.n.........I...Ewc....[..,i`v......F...il\|.c,{.-.....%BP.U........y.x....6..E2..n.W...J .*..`..r....F....#BCC......\|.L&........O...'........\.....;...q.n$...7...ga..x....)..A...0.{1..'1../...+yRC...W.-..b..c0dDG...U[po....2eG.G.../.@........h.:.k?.......Q...

Chrome Cache Entry: 185

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 658 x 480, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	13842
Entropy (8bit):	7.802399161550213
Encrypted:	false
SSDEEP:	192:NLNf+jBQsDHg7av3EEondO8PuRu2mIYXEIiDm42NpsHFMHfgnJ4K2DVwv:NLt+1jDmY+ndXwjLUpiDwpzfwoDVk
MD5:	F6EC97C43480D41695065AD55A97B382
SHA1:	D9C3D0895A5ED1A3951B8774B519B8217F0A54C5
SHA-256:	07A599FAB1E66BABC430E5FED3029F25FF3F4EA2DD0EC8968FFBA71EF1872F68
SHA-512:	22462763178409D60609761A2AF734F97B35B9A818EC1FD9046AFAB489AAD83CE34896EE8586EFE402EA7739ECF088BC2DB5C1C8E4FB39E6A0FC5B3ADC6B4A9B
Malicious:	false
Preview:	.PNG........IHDR................1....sRGB.........gAMA......a.....pHYs..........o.d..5.IDATx^..[.,.]...../<.!.B(/y..).F\r...!(.H..a ..B.~..A..KXA.M...6..8...!1....l./.X.1....2.`.y"l..R...V.....{...}._gWW.Z.VUw.N...U..P@..... ..@.A...".$..E.I.........$..("H..PD..... ..p....U.}.{.....l..A.....A........s.......D.0...@....E..x........L. /.".A.....$...Y."...%.I..["../.&.I..[`.0..IA.........p4.I.........$..("H..PD..... ..@.A...".$..E.I.........$..("H..PD..... ..@.A...".$..E.>H...O.................?.~.......].7.....a?....(H....m.G..G..a.P..?yo......f?...o. .B.....mo{[....:9<].....7.....a.....S..Cd.5,.R....#....>......._g.....Wo\|.....z.g.........w.T...]x.>.....y(.........6....[..px...U....~.~hu...}H.......~.L... ....r...iY.$..Id..Ax"../....._..U....OTo\|.Mh.km..A.k..k....n.C`\|._\=...o...a.e.. ...&.A2..k.. ....X.+...C..P....y..>.{._..(H....8(.?...w.}M.........:s_!.m.........BY..T..z.5{.W.~..6.....F....bq....m.....?.......v....o..o...ki...iX.$......\]V...V...

Chrome Cache Entry: 186

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	4897
Entropy (8bit):	4.794639101874543
Encrypted:	false
SSDEEP:	96:A0AIvEQ+KfZcbhaW9dp45qtAdflfDOFnymoLByzVqrpCvJ4QG63JjJ+do88HxbqP:dgQ+KfZcbhaWjp45qtAdflfDOFnNgBy4
MD5:	84E6C95F0E5378BDA94FA965C4692FAF
SHA1:	7C1D6572906509B08F8CD7B7A33EB9F9697EE6D1
SHA-256:	88A4A7B4F1160F8CAD3EB835116C29AC39659D586D4DADC54D9E40AC7E1BC610
SHA-512:	D34BFF37F8402B4A1FEE3C26F247A86D72666647A10E83D711A1BED1D24C6FC13674D65DCC037C22811B227FEC34B5DE20442191A42F9D78FC79D55FD5792761
Malicious:	false
Preview:	{"callToAction":{"primary":{"biName":"download-dotnet","href":"https://dotnet.microsoft.com/download","kind":"link","title":"Download .NET"}},"category":{"biName":"dotnet","href":"/dotnet/","kind":"link","title":".NET"},"items":[{"biName":"1-languages","items":[{"biName":"1-c-sharp","href":"/dotnet/csharp/","kind":"link","title":"C#"},{"biName":"2-f-sharp","href":"/dotnet/fsharp/","kind":"link","title":"F#"},{"biName":"3-visual-basic","href":"/dotnet/visual-basic/","kind":"link","title":"Visual Basic"}],"kind":"menu","title":"Languages"},{"biName":"2-features","items":[{"biName":"1-fundamental","href":"/dotnet/fundamentals/","kind":"link","title":"Fundamentals"},{"biName":"2-tools-and-diagnostics","href":"/dotnet/navigate/tools-diagnostics/","kind":"link","title":"Tools and diagnostics"},{"biName":"3-ai","items":[{"biName":"1-generative-ai","href":"/dotnet/ai/","kind":"link","title":"Generative AI"},{"biName":"2-mlnet","href":"/dotnet/machine-learning/","kind":"link","title":"ML.NET"}]

Chrome Cache Entry: 187

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (46884)
Category:	downloaded
Size (bytes):	1729946
Entropy (8bit):	5.506784610641439
Encrypted:	false
SSDEEP:	24576:BBweqomwDtVnoZlsG3QO/GFGVgTvjC10wCTOWIzE+0RlMVSB1DkCXWEea87ZGxnJ:BiwDbotVSB1DkCXWEe57ZGxnS+Vh2xDg
MD5:	95DE4EB9C18E800B4E68761D99845561
SHA1:	8CD61A75D8E9D5A1EB894284850AAB6C1E547D6D
SHA-256:	15163779156DA543DEFAAFC12F7C1A850C91411FE7495F03C3BFE0231D5057E3
SHA-512:	86BDE4F52A505FAC4BC49A30C0BDB145D88F568917E8EC89C26CFAA7E7DF85E9744291470E3587312196D93FB6BAA6F75B29D88CB722B7969C284C9A31886DBE
Malicious:	false
URL:	https://learn.microsoft.com/static/assets/0.4.027605576/scripts/en-us/index-docs.js
Preview:	"use strict";(()=>{var qge=Object.create;var Mx=Object.defineProperty;var OU=Object.getOwnPropertyDescriptor;var Fge=Object.getOwnPropertyNames;var Uge=Object.getPrototypeOf,Oge=Object.prototype.hasOwnProperty;var Hge=(e,t,n)=>t in e?Mx(e,t,{enumerable:!0,configurable:!0,writable:!0,value:n}):e[t]=n;var Ie=(e,t)=>()=>(t\|\|e((t={exports:{}}).exports,t),t.exports);var Bge=(e,t,n,o)=>{if(t&&typeof t=="object"\|\|typeof t=="function")for(let r of Fge(t))!Oge.call(e,r)&&r!==n&&Mx(e,r,{get:()=>t[r],enumerable:!(o=OU(t,r))\|\|o.enumerable});return e};var Rd=(e,t,n)=>(n=e!=null?qge(Uge(e)):{},Bge(t\|\|!e\|\|!e.__esModule?Mx(n,"default",{value:e,enumerable:!0}):n,e));var U=(e,t,n,o)=>{for(var r=o>1?void 0:o?OU(t,n):t,s=e.length-1,i;s>=0;s--)(i=e[s])&&(r=(o?i(t,n,r):i(r))\|\|r);return o&&r&&Mx(t,n,r),r};var Ni=(e,t,n)=>(Hge(e,typeof t!="symbol"?t+"":t,n),n),lL=(e,t,n)=>{if(!t.has(e))throw TypeError("Cannot "+n)};var xt=(e,t,n)=>(lL(e,t,"read from private field"),n?n.call(e):t.get(e)),On=(e,t,n)=>{if(t.has(

Chrome Cache Entry: 188

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	3130
Entropy (8bit):	4.790069981348324
Encrypted:	false
SSDEEP:	48:YWuGl640ynAqgDJ9OJWuO6Z3Db8VgK/ni47ttbtlSlA37ERw7II77Aj5M1:Nv0ynAhD3CO5t5lNEYIOEjc
MD5:	EBA6E81304F2F555E1D2EA3126A18A41
SHA1:	61429C3FE837FD4DD68E7B26678F131F2E00070D
SHA-256:	F309CCCE17B2B4706E7110F6C76F81761F0A44168D12C358AC4D120776907F81
SHA-512:	3BE0466794E7BDDC8565758DBF5553E89ED0003271F07695F09283F242BB65C1978ED79A38D5E589A99F68C0130E1E4B52576D7CD655EE272EE104BE0378E72E
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/breadcrumb/toc.json
Preview:	{"items":[{"children":[{"children":[{"homepage":"/dotnet/api/index","href":"/dotnet/api/","toc_title":"API browser"},{"homepage":"/dotnet/csharp/index","href":"/dotnet/csharp/","toc_title":"C#"},{"homepage":"/dotnet/fsharp/index","href":"/dotnet/fsharp/","toc_title":"F#"},{"homepage":"/dotnet/visual-basic/index","href":"/dotnet/visual-basic/","toc_title":"Visual Basic"},{"homepage":"/dotnet/ai/index","href":"/dotnet/ai/","toc_title":"AI"},{"homepage":"/dotnet/azure/index","href":"/dotnet/azure/","toc_title":"Azure"},{"homepage":"/dotnet/aspire/index","href":"/dotnet/aspire/","toc_title":".NET Aspire"},{"homepage":"/dotnet/orleans/index","href":"/dotnet/orleans/","toc_title":"Orleans"},{"children":[{"homepage":"/dotnet/framework/unmanaged-api/","href":"/dotnet/framework/unmanaged-api/","toc_title":"Unmanaged API reference"}],"homepage":"/dotnet/framework/index","href":"/dotnet/framework/","toc_title":".NET Framework"},{"children":[{"homepage":"/dotnet/architecture/modern-web-apps-azure/

Chrome Cache Entry: 189

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 533 x 478, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	18367
Entropy (8bit):	7.7772261735974215
Encrypted:	false
SSDEEP:	384:4qqZYz7CAda2Qmd6VWWNg9h8XvdkRbdi2nki:1qZYz7Cma2hYNMh8XvdObdi2nX
MD5:	240C4CC15D9FD65405BB642AB81BE615
SHA1:	5A66783FE5DD932082F40811AE0769526874BFD3
SHA-256:	030272CE6BA1BECA700EC83FDED9DBDC89296FBDE0633A7F5943EF5831876C07
SHA-512:	267FE31BC25944DD7B6071C2C2C271CCC188AE1F6A0D7E587DCF9198B81598DA6B058D1B413F228DF0CB37C8304329E808089388359651E81B5F3DEC566D0EE0
Malicious:	false
Preview:	.PNG........IHDR.............,#......sRGB.........gAMA......a.....pHYs..........o.d..GTIDATx^._.}.U.7..BkB.......!E......b.Ej.K...Z...iK.$..h..B`..T.?5.7.I..16$.E.......c...c...Q_V.k...k..g.y.9..G.g..g.9.Z{..Z{.nv....@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...<@v.].../.1R'm.....x..h.....]a1U7........s.......x.h.q.A! ....8IL\GP..............M...W.............D.....dJ<.+,.........W...pgAT...@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...@......P.;/..G....O~..O~...'?......h.....}.y..4/....S..........Y......?..?.g7...G...............x{..w..y.~.9.~.y....y.#.c....<.E.............^..7G.._.u.nv/..f........5.....5?.;...w.....i~.?\|..H+Dd.....Y%....r~.$Q...7.v..._hv..r.O_.4..7M.6....o..=..?....3....?.....xE...O..7....^......D.W....m...6........O..Ob.4.9J........6.;..>.,.....o.l..>%J.V......%k..0.bQqIA..O..y.{.....7.......4_..Za...4.o.....h..........k...M...i....G.4...h.L.#...&.'%...~j..W.*Kx......o.%s.m

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	5.87969851994072
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 50.01% Win32 Executable (generic) a (10002005/4) 49.97% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	LisectAVT_2403002C_142.exe
File size:	112'128 bytes
MD5:	01da9ea1cc55c02a1755b20a4ec69f05
SHA1:	1e2d88fc38f6afbde00ce873c2325c8d0c327879
SHA256:	e10057cbc98b12819a4a3a41f68281398a3f18f0a411019e7f069b31a11395fc
SHA512:	d005b838b5905ab8f10b7b6e581f976879d518a6c714722a64e0551b25b3a4793d8a696e8ffeb316e0893284886285a28007310c549b795e7bd9900c4439c05b
SSDEEP:	1536:LgxOx6baIa9RZj00ljEwzGi1dD8DlgSg2GCq2iW7z:LgxbaIa93jNSi1dCyMGCH
TLSH:	61B3084977E42424E4BF56F79871F2004F34B4871642E39E49F259AB1A33AC44F89EEB
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...?\|.f................................. ........@.. ....................... ............@................................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x41c000
Entrypoint Section:	>\|u
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x66007C3F [Sun Mar 24 19:17:19 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
sub esp, 0000016Ch
xor eax, eax
push ebx
push esi
push edi
mov dword ptr [ebp-24h], eax
mov dword ptr [ebp-10h], eax
mov dword ptr [ebp-14h], eax
mov dword ptr [ebp-08h], eax
mov dword ptr [ebp-0Ch], eax
mov dword ptr [ebp-20h], eax
mov dword ptr [ebp-18h], eax
mov dword ptr [ebp-48h], 47505765h
mov dword ptr [ebp-44h], 652E4255h
mov dword ptr [ebp-40h], 00006578h
mov dword ptr [ebp-3Ch], 00000000h
call 00007F07C885A4F5h
pop eax
add eax, 00000225h
mov dword ptr [ebp-04h], eax
mov eax, dword ptr fs:[00000030h]
mov dword ptr [ebp-28h], eax
mov eax, dword ptr [ebp-04h]
mov dword ptr [eax], E904C483h
mov eax, dword ptr [ebp-04h]
mov dword ptr [eax+04h], FFFFCC8Dh
mov eax, dword ptr [ebp-28h]
mov eax, dword ptr [eax+0Ch]
mov eax, dword ptr [eax+1Ch]
mov eax, dword ptr [eax]
mov eax, dword ptr [eax+08h]
mov ecx, dword ptr [eax+3Ch]
mov ecx, dword ptr [ecx+eax+78h]
add ecx, eax
mov edi, dword ptr [ecx+1Ch]
mov ebx, dword ptr [ecx+20h]
mov esi, dword ptr [ecx+24h]
mov ecx, dword ptr [ecx+18h]
add esi, eax
add edi, eax
add ebx, eax
xor edx, edx
mov dword ptr [ebp-30h], esi
mov dword ptr [ebp-1Ch], edx
mov dword ptr [ebp-34h], ecx
cmp edx, dword ptr [ebp-34h]
jnc 00007F07C885A63Eh
movzx ecx, word ptr [esi+edx*2]
mov edx, dword ptr [ebx+edx*4]
mov esi, dword ptr [edi+ecx*4]
add edx, eax
mov ecx, dword ptr [edx]
add esi, eax
cmp ecx, 4D746547h
jne 00007F07C885A544h
cmp dword ptr [edx+04h], 6C75646Fh
jne 00007F07C885A53Bh

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x18ea8	0x53	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x1a000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x16f04	0x17000	32d67fdac305711b4aeb32f409a975b5	False	0.3680579144021739	data	5.591546860496406	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.reloc	0x1a000	0xc	0x200	02466978873e232bef309f048b95192f	False	0.041015625	data	0.08153941234324169	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
>\|u	0x1c000	0x6000	0x4200	973ec8a3a78ff4be698f3b3a8e2ee1b7	False	0.7774621212121212	data	6.934439630498995	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	Protocol	SID	Signature	Source Port	Dest Port	Source IP	Dest IP
2024-07-25T09:47:57.186261+0200	TCP	2012510	ET SHELLCODE UTF-8/16 Encoded Shellcode	443	49726	95.101.150.2	192.168.2.8
2024-07-25T09:47:59.822671+0200	TCP	2012510	ET SHELLCODE UTF-8/16 Encoded Shellcode	443	49737	95.101.150.2	192.168.2.8
2024-07-25T09:47:59.844808+0200	TCP	2012510	ET SHELLCODE UTF-8/16 Encoded Shellcode	443	49737	95.101.150.2	192.168.2.8
2024-07-25T09:48:40.834189+0200	TCP	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	443	60450	20.12.23.50	192.168.2.8
2024-07-25T09:47:58.111870+0200	TCP	2012510	ET SHELLCODE UTF-8/16 Encoded Shellcode	443	49726	95.101.150.2	192.168.2.8
2024-07-25T09:47:56.967085+0200	TCP	2012510	ET SHELLCODE UTF-8/16 Encoded Shellcode	443	49726	95.101.150.2	192.168.2.8
2024-07-25T09:48:00.029513+0200	TCP	2012510	ET SHELLCODE UTF-8/16 Encoded Shellcode	443	49737	95.101.150.2	192.168.2.8
2024-07-25T09:48:00.949369+0200	TCP	2012510	ET SHELLCODE UTF-8/16 Encoded Shellcode	443	49737	95.101.150.2	192.168.2.8
2024-07-25T09:47:58.111882+0200	TCP	2012510	ET SHELLCODE UTF-8/16 Encoded Shellcode	443	49726	95.101.150.2	192.168.2.8
2024-07-25T09:47:56.999296+0200	TCP	2012510	ET SHELLCODE UTF-8/16 Encoded Shellcode	443	49726	95.101.150.2	192.168.2.8
2024-07-25T09:48:02.551404+0200	TCP	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	443	49760	40.68.123.157	192.168.2.8
2024-07-25T09:48:00.949372+0200	TCP	2012510	ET SHELLCODE UTF-8/16 Encoded Shellcode	443	49737	95.101.150.2	192.168.2.8

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 25, 2024 09:47:40.392432928 CEST	49676	443	192.168.2.8	52.182.143.211
Jul 25, 2024 09:47:40.673702002 CEST	49673	443	192.168.2.8	23.206.229.226
Jul 25, 2024 09:47:41.001727104 CEST	49672	443	192.168.2.8	23.206.229.226
Jul 25, 2024 09:47:41.659132957 CEST	49671	443	192.168.2.8	204.79.197.203
Jul 25, 2024 09:47:42.001773119 CEST	49677	80	192.168.2.8	192.229.211.108
Jul 25, 2024 09:47:50.001759052 CEST	49676	443	192.168.2.8	52.182.143.211
Jul 25, 2024 09:47:50.283004999 CEST	49673	443	192.168.2.8	23.206.229.226
Jul 25, 2024 09:47:50.612695932 CEST	49672	443	192.168.2.8	23.206.229.226
Jul 25, 2024 09:47:52.254597902 CEST	443	49704	23.206.229.226	192.168.2.8
Jul 25, 2024 09:47:52.254707098 CEST	49704	443	192.168.2.8	23.206.229.226
Jul 25, 2024 09:47:52.635158062 CEST	49677	80	192.168.2.8	192.229.211.108
Jul 25, 2024 09:47:55.015718937 CEST	49719	443	192.168.2.8	172.217.18.4
Jul 25, 2024 09:47:55.015759945 CEST	443	49719	172.217.18.4	192.168.2.8
Jul 25, 2024 09:47:55.016091108 CEST	49719	443	192.168.2.8	172.217.18.4
Jul 25, 2024 09:47:55.016091108 CEST	49719	443	192.168.2.8	172.217.18.4
Jul 25, 2024 09:47:55.016125917 CEST	443	49719	172.217.18.4	192.168.2.8
Jul 25, 2024 09:47:55.348664999 CEST	49720	443	192.168.2.8	184.28.90.27
Jul 25, 2024 09:47:55.348715067 CEST	443	49720	184.28.90.27	192.168.2.8
Jul 25, 2024 09:47:55.348822117 CEST	49720	443	192.168.2.8	184.28.90.27
Jul 25, 2024 09:47:55.368998051 CEST	49720	443	192.168.2.8	184.28.90.27
Jul 25, 2024 09:47:55.369026899 CEST	443	49720	184.28.90.27	192.168.2.8
Jul 25, 2024 09:47:55.687405109 CEST	443	49719	172.217.18.4	192.168.2.8
Jul 25, 2024 09:47:55.687809944 CEST	49719	443	192.168.2.8	172.217.18.4
Jul 25, 2024 09:47:55.687828064 CEST	443	49719	172.217.18.4	192.168.2.8
Jul 25, 2024 09:47:55.688913107 CEST	443	49719	172.217.18.4	192.168.2.8
Jul 25, 2024 09:47:55.688985109 CEST	49719	443	192.168.2.8	172.217.18.4
Jul 25, 2024 09:47:55.689860106 CEST	49719	443	192.168.2.8	172.217.18.4
Jul 25, 2024 09:47:55.689956903 CEST	443	49719	172.217.18.4	192.168.2.8
Jul 25, 2024 09:47:55.741384029 CEST	49719	443	192.168.2.8	172.217.18.4
Jul 25, 2024 09:47:55.741405964 CEST	443	49719	172.217.18.4	192.168.2.8
Jul 25, 2024 09:47:55.796541929 CEST	49719	443	192.168.2.8	172.217.18.4
Jul 25, 2024 09:47:55.796668053 CEST	49724	443	192.168.2.8	13.107.246.42
Jul 25, 2024 09:47:55.796708107 CEST	443	49724	13.107.246.42	192.168.2.8
Jul 25, 2024 09:47:55.796772003 CEST	49724	443	192.168.2.8	13.107.246.42
Jul 25, 2024 09:47:55.799649954 CEST	49725	443	192.168.2.8	13.107.246.42
Jul 25, 2024 09:47:55.799683094 CEST	443	49725	13.107.246.42	192.168.2.8
Jul 25, 2024 09:47:55.799736977 CEST	49725	443	192.168.2.8	13.107.246.42
Jul 25, 2024 09:47:55.800304890 CEST	49725	443	192.168.2.8	13.107.246.42
Jul 25, 2024 09:47:55.800323963 CEST	443	49725	13.107.246.42	192.168.2.8
Jul 25, 2024 09:47:55.800431967 CEST	49724	443	192.168.2.8	13.107.246.42
Jul 25, 2024 09:47:55.800451040 CEST	443	49724	13.107.246.42	192.168.2.8
Jul 25, 2024 09:47:56.037745953 CEST	443	49720	184.28.90.27	192.168.2.8
Jul 25, 2024 09:47:56.037841082 CEST	49720	443	192.168.2.8	184.28.90.27
Jul 25, 2024 09:47:56.112699032 CEST	49720	443	192.168.2.8	184.28.90.27
Jul 25, 2024 09:47:56.112718105 CEST	443	49720	184.28.90.27	192.168.2.8
Jul 25, 2024 09:47:56.113207102 CEST	443	49720	184.28.90.27	192.168.2.8
Jul 25, 2024 09:47:56.165682077 CEST	49720	443	192.168.2.8	184.28.90.27
Jul 25, 2024 09:47:56.196572065 CEST	49720	443	192.168.2.8	184.28.90.27
Jul 25, 2024 09:47:56.240510941 CEST	443	49720	184.28.90.27	192.168.2.8
Jul 25, 2024 09:47:56.387072086 CEST	443	49720	184.28.90.27	192.168.2.8
Jul 25, 2024 09:47:56.387166977 CEST	443	49720	184.28.90.27	192.168.2.8
Jul 25, 2024 09:47:56.387223005 CEST	49720	443	192.168.2.8	184.28.90.27
Jul 25, 2024 09:47:56.387432098 CEST	49720	443	192.168.2.8	184.28.90.27
Jul 25, 2024 09:47:56.387454987 CEST	443	49720	184.28.90.27	192.168.2.8
Jul 25, 2024 09:47:56.387471914 CEST	49720	443	192.168.2.8	184.28.90.27
Jul 25, 2024 09:47:56.387480021 CEST	443	49720	184.28.90.27	192.168.2.8
Jul 25, 2024 09:47:56.428529024 CEST	49727	443	192.168.2.8	184.28.90.27
Jul 25, 2024 09:47:56.428584099 CEST	443	49727	184.28.90.27	192.168.2.8
Jul 25, 2024 09:47:56.428659916 CEST	49727	443	192.168.2.8	184.28.90.27
Jul 25, 2024 09:47:56.428915024 CEST	49727	443	192.168.2.8	184.28.90.27
Jul 25, 2024 09:47:56.428926945 CEST	443	49727	184.28.90.27	192.168.2.8
Jul 25, 2024 09:47:56.483031034 CEST	443	49725	13.107.246.42	192.168.2.8
Jul 25, 2024 09:47:56.483213902 CEST	49725	443	192.168.2.8	13.107.246.42
Jul 25, 2024 09:47:56.483239889 CEST	443	49725	13.107.246.42	192.168.2.8
Jul 25, 2024 09:47:56.484313011 CEST	443	49725	13.107.246.42	192.168.2.8
Jul 25, 2024 09:47:56.484371901 CEST	49725	443	192.168.2.8	13.107.246.42
Jul 25, 2024 09:47:56.489820004 CEST	443	49724	13.107.246.42	192.168.2.8
Jul 25, 2024 09:47:56.490134001 CEST	49724	443	192.168.2.8	13.107.246.42
Jul 25, 2024 09:47:56.490159035 CEST	443	49724	13.107.246.42	192.168.2.8
Jul 25, 2024 09:47:56.490264893 CEST	49725	443	192.168.2.8	13.107.246.42
Jul 25, 2024 09:47:56.490355015 CEST	443	49725	13.107.246.42	192.168.2.8
Jul 25, 2024 09:47:56.490391970 CEST	49725	443	192.168.2.8	13.107.246.42
Jul 25, 2024 09:47:56.491396904 CEST	443	49724	13.107.246.42	192.168.2.8
Jul 25, 2024 09:47:56.491458893 CEST	49724	443	192.168.2.8	13.107.246.42
Jul 25, 2024 09:47:56.492398024 CEST	49724	443	192.168.2.8	13.107.246.42
Jul 25, 2024 09:47:56.492465019 CEST	443	49724	13.107.246.42	192.168.2.8
Jul 25, 2024 09:47:56.492645025 CEST	49724	443	192.168.2.8	13.107.246.42
Jul 25, 2024 09:47:56.492651939 CEST	443	49724	13.107.246.42	192.168.2.8
Jul 25, 2024 09:47:56.530781984 CEST	49725	443	192.168.2.8	13.107.246.42
Jul 25, 2024 09:47:56.530802011 CEST	443	49725	13.107.246.42	192.168.2.8
Jul 25, 2024 09:47:56.546338081 CEST	49724	443	192.168.2.8	13.107.246.42
Jul 25, 2024 09:47:56.578026056 CEST	49725	443	192.168.2.8	13.107.246.42
Jul 25, 2024 09:47:56.615775108 CEST	443	49724	13.107.246.42	192.168.2.8
Jul 25, 2024 09:47:56.615811110 CEST	443	49724	13.107.246.42	192.168.2.8
Jul 25, 2024 09:47:56.615818977 CEST	443	49724	13.107.246.42	192.168.2.8
Jul 25, 2024 09:47:56.615833998 CEST	443	49724	13.107.246.42	192.168.2.8
Jul 25, 2024 09:47:56.615840912 CEST	443	49724	13.107.246.42	192.168.2.8
Jul 25, 2024 09:47:56.615868092 CEST	443	49724	13.107.246.42	192.168.2.8
Jul 25, 2024 09:47:56.615875006 CEST	49724	443	192.168.2.8	13.107.246.42
Jul 25, 2024 09:47:56.615905046 CEST	443	49724	13.107.246.42	192.168.2.8
Jul 25, 2024 09:47:56.615921974 CEST	49724	443	192.168.2.8	13.107.246.42
Jul 25, 2024 09:47:56.615952969 CEST	49724	443	192.168.2.8	13.107.246.42
Jul 25, 2024 09:47:56.631328106 CEST	443	49725	13.107.246.42	192.168.2.8
Jul 25, 2024 09:47:56.631355047 CEST	443	49725	13.107.246.42	192.168.2.8
Jul 25, 2024 09:47:56.631365061 CEST	443	49725	13.107.246.42	192.168.2.8
Jul 25, 2024 09:47:56.631393909 CEST	443	49725	13.107.246.42	192.168.2.8
Jul 25, 2024 09:47:56.631413937 CEST	443	49725	13.107.246.42	192.168.2.8
Jul 25, 2024 09:47:56.631428957 CEST	49725	443	192.168.2.8	13.107.246.42
Jul 25, 2024 09:47:56.631434917 CEST	443	49725	13.107.246.42	192.168.2.8
Jul 25, 2024 09:47:56.631462097 CEST	443	49725	13.107.246.42	192.168.2.8
Jul 25, 2024 09:47:56.631483078 CEST	49725	443	192.168.2.8	13.107.246.42
Jul 25, 2024 09:47:56.631510019 CEST	49725	443	192.168.2.8	13.107.246.42
Jul 25, 2024 09:47:56.706593990 CEST	443	49724	13.107.246.42	192.168.2.8
Jul 25, 2024 09:47:56.706624031 CEST	443	49724	13.107.246.42	192.168.2.8
Jul 25, 2024 09:47:56.706710100 CEST	49724	443	192.168.2.8	13.107.246.42
Jul 25, 2024 09:47:56.706736088 CEST	443	49724	13.107.246.42	192.168.2.8
Jul 25, 2024 09:47:56.706783056 CEST	49724	443	192.168.2.8	13.107.246.42
Jul 25, 2024 09:47:56.710422039 CEST	443	49724	13.107.246.42	192.168.2.8
Jul 25, 2024 09:47:56.710447073 CEST	443	49724	13.107.246.42	192.168.2.8
Jul 25, 2024 09:47:56.710495949 CEST	49724	443	192.168.2.8	13.107.246.42
Jul 25, 2024 09:47:56.710509062 CEST	443	49724	13.107.246.42	192.168.2.8
Jul 25, 2024 09:47:56.710556984 CEST	49724	443	192.168.2.8	13.107.246.42
Jul 25, 2024 09:47:56.727071047 CEST	443	49725	13.107.246.42	192.168.2.8
Jul 25, 2024 09:47:56.727101088 CEST	443	49725	13.107.246.42	192.168.2.8
Jul 25, 2024 09:47:56.727142096 CEST	49725	443	192.168.2.8	13.107.246.42
Jul 25, 2024 09:47:56.727157116 CEST	443	49725	13.107.246.42	192.168.2.8
Jul 25, 2024 09:47:56.727191925 CEST	49725	443	192.168.2.8	13.107.246.42
Jul 25, 2024 09:47:56.727217913 CEST	49725	443	192.168.2.8	13.107.246.42
Jul 25, 2024 09:47:56.730617046 CEST	443	49725	13.107.246.42	192.168.2.8
Jul 25, 2024 09:47:56.730640888 CEST	443	49725	13.107.246.42	192.168.2.8
Jul 25, 2024 09:47:56.730675936 CEST	49725	443	192.168.2.8	13.107.246.42
Jul 25, 2024 09:47:56.730681896 CEST	443	49725	13.107.246.42	192.168.2.8
Jul 25, 2024 09:47:56.730724096 CEST	49725	443	192.168.2.8	13.107.246.42
Jul 25, 2024 09:47:56.731432915 CEST	443	49725	13.107.246.42	192.168.2.8
Jul 25, 2024 09:47:56.731477976 CEST	49725	443	192.168.2.8	13.107.246.42
Jul 25, 2024 09:47:56.731482029 CEST	443	49725	13.107.246.42	192.168.2.8
Jul 25, 2024 09:47:56.731507063 CEST	443	49725	13.107.246.42	192.168.2.8
Jul 25, 2024 09:47:56.731518984 CEST	49725	443	192.168.2.8	13.107.246.42
Jul 25, 2024 09:47:56.731547117 CEST	49725	443	192.168.2.8	13.107.246.42
Jul 25, 2024 09:47:56.731801033 CEST	49725	443	192.168.2.8	13.107.246.42
Jul 25, 2024 09:47:56.731817007 CEST	443	49725	13.107.246.42	192.168.2.8
Jul 25, 2024 09:47:56.760315895 CEST	49730	443	192.168.2.8	13.107.253.42
Jul 25, 2024 09:47:56.760354042 CEST	443	49730	13.107.253.42	192.168.2.8
Jul 25, 2024 09:47:56.760416031 CEST	49730	443	192.168.2.8	13.107.253.42
Jul 25, 2024 09:47:56.760811090 CEST	49730	443	192.168.2.8	13.107.253.42
Jul 25, 2024 09:47:56.760823011 CEST	443	49730	13.107.253.42	192.168.2.8
Jul 25, 2024 09:47:56.796701908 CEST	443	49724	13.107.246.42	192.168.2.8
Jul 25, 2024 09:47:56.796727896 CEST	443	49724	13.107.246.42	192.168.2.8
Jul 25, 2024 09:47:56.796770096 CEST	49724	443	192.168.2.8	13.107.246.42
Jul 25, 2024 09:47:56.796792984 CEST	443	49724	13.107.246.42	192.168.2.8
Jul 25, 2024 09:47:56.796813011 CEST	49724	443	192.168.2.8	13.107.246.42
Jul 25, 2024 09:47:56.796835899 CEST	49724	443	192.168.2.8	13.107.246.42
Jul 25, 2024 09:47:56.800455093 CEST	443	49724	13.107.246.42	192.168.2.8
Jul 25, 2024 09:47:56.800474882 CEST	443	49724	13.107.246.42	192.168.2.8
Jul 25, 2024 09:47:56.800523996 CEST	49724	443	192.168.2.8	13.107.246.42
Jul 25, 2024 09:47:56.800535917 CEST	443	49724	13.107.246.42	192.168.2.8
Jul 25, 2024 09:47:56.800585985 CEST	49724	443	192.168.2.8	13.107.246.42
Jul 25, 2024 09:47:56.803486109 CEST	443	49724	13.107.246.42	192.168.2.8
Jul 25, 2024 09:47:56.803502083 CEST	443	49724	13.107.246.42	192.168.2.8
Jul 25, 2024 09:47:56.803555012 CEST	49724	443	192.168.2.8	13.107.246.42
Jul 25, 2024 09:47:56.803565025 CEST	443	49724	13.107.246.42	192.168.2.8
Jul 25, 2024 09:47:56.803606033 CEST	49724	443	192.168.2.8	13.107.246.42
Jul 25, 2024 09:47:56.806571007 CEST	443	49724	13.107.246.42	192.168.2.8
Jul 25, 2024 09:47:56.806587934 CEST	443	49724	13.107.246.42	192.168.2.8
Jul 25, 2024 09:47:56.806651115 CEST	49724	443	192.168.2.8	13.107.246.42
Jul 25, 2024 09:47:56.806664944 CEST	443	49724	13.107.246.42	192.168.2.8
Jul 25, 2024 09:47:56.806703091 CEST	49724	443	192.168.2.8	13.107.246.42
Jul 25, 2024 09:47:56.910435915 CEST	443	49724	13.107.246.42	192.168.2.8
Jul 25, 2024 09:47:56.910456896 CEST	443	49724	13.107.246.42	192.168.2.8
Jul 25, 2024 09:47:56.910522938 CEST	49724	443	192.168.2.8	13.107.246.42
Jul 25, 2024 09:47:56.910540104 CEST	443	49724	13.107.246.42	192.168.2.8
Jul 25, 2024 09:47:56.910579920 CEST	49724	443	192.168.2.8	13.107.246.42
Jul 25, 2024 09:47:56.914650917 CEST	443	49724	13.107.246.42	192.168.2.8
Jul 25, 2024 09:47:56.914669037 CEST	443	49724	13.107.246.42	192.168.2.8
Jul 25, 2024 09:47:56.914725065 CEST	49724	443	192.168.2.8	13.107.246.42
Jul 25, 2024 09:47:56.914731026 CEST	443	49724	13.107.246.42	192.168.2.8
Jul 25, 2024 09:47:56.914769888 CEST	49724	443	192.168.2.8	13.107.246.42
Jul 25, 2024 09:47:56.918041945 CEST	443	49724	13.107.246.42	192.168.2.8
Jul 25, 2024 09:47:56.918057919 CEST	443	49724	13.107.246.42	192.168.2.8
Jul 25, 2024 09:47:56.918128967 CEST	49724	443	192.168.2.8	13.107.246.42
Jul 25, 2024 09:47:56.918133974 CEST	443	49724	13.107.246.42	192.168.2.8
Jul 25, 2024 09:47:56.918174982 CEST	49724	443	192.168.2.8	13.107.246.42
Jul 25, 2024 09:47:56.919843912 CEST	443	49724	13.107.246.42	192.168.2.8
Jul 25, 2024 09:47:56.919863939 CEST	443	49724	13.107.246.42	192.168.2.8
Jul 25, 2024 09:47:56.919917107 CEST	49724	443	192.168.2.8	13.107.246.42
Jul 25, 2024 09:47:56.919923067 CEST	443	49724	13.107.246.42	192.168.2.8
Jul 25, 2024 09:47:56.919962883 CEST	49724	443	192.168.2.8	13.107.246.42
Jul 25, 2024 09:47:56.921408892 CEST	443	49724	13.107.246.42	192.168.2.8
Jul 25, 2024 09:47:56.921426058 CEST	443	49724	13.107.246.42	192.168.2.8
Jul 25, 2024 09:47:56.921483994 CEST	49724	443	192.168.2.8	13.107.246.42
Jul 25, 2024 09:47:56.921489000 CEST	443	49724	13.107.246.42	192.168.2.8
Jul 25, 2024 09:47:56.921538115 CEST	49724	443	192.168.2.8	13.107.246.42
Jul 25, 2024 09:47:56.922202110 CEST	443	49724	13.107.246.42	192.168.2.8
Jul 25, 2024 09:47:56.922249079 CEST	443	49724	13.107.246.42	192.168.2.8
Jul 25, 2024 09:47:56.922272921 CEST	49724	443	192.168.2.8	13.107.246.42
Jul 25, 2024 09:47:56.922281981 CEST	443	49724	13.107.246.42	192.168.2.8
Jul 25, 2024 09:47:56.922291040 CEST	443	49724	13.107.246.42	192.168.2.8
Jul 25, 2024 09:47:56.922308922 CEST	49724	443	192.168.2.8	13.107.246.42
Jul 25, 2024 09:47:56.922329903 CEST	49724	443	192.168.2.8	13.107.246.42
Jul 25, 2024 09:47:56.925055981 CEST	49724	443	192.168.2.8	13.107.246.42
Jul 25, 2024 09:47:56.925074100 CEST	443	49724	13.107.246.42	192.168.2.8
Jul 25, 2024 09:47:56.940871000 CEST	49732	443	192.168.2.8	13.107.253.45
Jul 25, 2024 09:47:56.940911055 CEST	443	49732	13.107.253.45	192.168.2.8
Jul 25, 2024 09:47:56.940983057 CEST	49732	443	192.168.2.8	13.107.253.45
Jul 25, 2024 09:47:56.941184998 CEST	49732	443	192.168.2.8	13.107.253.45
Jul 25, 2024 09:47:56.941198111 CEST	443	49732	13.107.253.45	192.168.2.8
Jul 25, 2024 09:47:57.093374014 CEST	443	49727	184.28.90.27	192.168.2.8
Jul 25, 2024 09:47:57.093446016 CEST	49727	443	192.168.2.8	184.28.90.27
Jul 25, 2024 09:47:57.094770908 CEST	49727	443	192.168.2.8	184.28.90.27
Jul 25, 2024 09:47:57.094779968 CEST	443	49727	184.28.90.27	192.168.2.8
Jul 25, 2024 09:47:57.095010042 CEST	443	49727	184.28.90.27	192.168.2.8
Jul 25, 2024 09:47:57.096138000 CEST	49727	443	192.168.2.8	184.28.90.27
Jul 25, 2024 09:47:57.136497974 CEST	443	49727	184.28.90.27	192.168.2.8
Jul 25, 2024 09:47:57.374531984 CEST	443	49727	184.28.90.27	192.168.2.8
Jul 25, 2024 09:47:57.374605894 CEST	443	49727	184.28.90.27	192.168.2.8
Jul 25, 2024 09:47:57.374665976 CEST	49727	443	192.168.2.8	184.28.90.27
Jul 25, 2024 09:47:57.376754999 CEST	49727	443	192.168.2.8	184.28.90.27
Jul 25, 2024 09:47:57.376775980 CEST	443	49727	184.28.90.27	192.168.2.8
Jul 25, 2024 09:47:57.376787901 CEST	49727	443	192.168.2.8	184.28.90.27
Jul 25, 2024 09:47:57.376794100 CEST	443	49727	184.28.90.27	192.168.2.8
Jul 25, 2024 09:47:57.508115053 CEST	443	49730	13.107.253.42	192.168.2.8
Jul 25, 2024 09:47:57.508356094 CEST	49730	443	192.168.2.8	13.107.253.42
Jul 25, 2024 09:47:57.508383989 CEST	443	49730	13.107.253.42	192.168.2.8
Jul 25, 2024 09:47:57.509454012 CEST	443	49730	13.107.253.42	192.168.2.8
Jul 25, 2024 09:47:57.509519100 CEST	49730	443	192.168.2.8	13.107.253.42
Jul 25, 2024 09:47:57.509828091 CEST	49730	443	192.168.2.8	13.107.253.42
Jul 25, 2024 09:47:57.509886026 CEST	443	49730	13.107.253.42	192.168.2.8
Jul 25, 2024 09:47:57.509958029 CEST	49730	443	192.168.2.8	13.107.253.42
Jul 25, 2024 09:47:57.509965897 CEST	443	49730	13.107.253.42	192.168.2.8
Jul 25, 2024 09:47:57.557092905 CEST	49730	443	192.168.2.8	13.107.253.42
Jul 25, 2024 09:47:57.633752108 CEST	443	49730	13.107.253.42	192.168.2.8
Jul 25, 2024 09:47:57.641201019 CEST	443	49730	13.107.253.42	192.168.2.8
Jul 25, 2024 09:47:57.641238928 CEST	443	49730	13.107.253.42	192.168.2.8
Jul 25, 2024 09:47:57.641289949 CEST	443	49730	13.107.253.42	192.168.2.8
Jul 25, 2024 09:47:57.641304016 CEST	49730	443	192.168.2.8	13.107.253.42
Jul 25, 2024 09:47:57.641340017 CEST	443	49730	13.107.253.42	192.168.2.8
Jul 25, 2024 09:47:57.641359091 CEST	49730	443	192.168.2.8	13.107.253.42
Jul 25, 2024 09:47:57.641388893 CEST	49730	443	192.168.2.8	13.107.253.42
Jul 25, 2024 09:47:57.659847021 CEST	443	49732	13.107.253.45	192.168.2.8
Jul 25, 2024 09:47:57.660120964 CEST	49732	443	192.168.2.8	13.107.253.45
Jul 25, 2024 09:47:57.660144091 CEST	443	49732	13.107.253.45	192.168.2.8
Jul 25, 2024 09:47:57.663805962 CEST	443	49732	13.107.253.45	192.168.2.8
Jul 25, 2024 09:47:57.663866997 CEST	49732	443	192.168.2.8	13.107.253.45
Jul 25, 2024 09:47:57.664156914 CEST	49732	443	192.168.2.8	13.107.253.45
Jul 25, 2024 09:47:57.664222956 CEST	443	49732	13.107.253.45	192.168.2.8
Jul 25, 2024 09:47:57.664316893 CEST	49732	443	192.168.2.8	13.107.253.45
Jul 25, 2024 09:47:57.664323092 CEST	443	49732	13.107.253.45	192.168.2.8
Jul 25, 2024 09:47:57.716680050 CEST	49732	443	192.168.2.8	13.107.253.45
Jul 25, 2024 09:47:57.731389046 CEST	443	49730	13.107.253.42	192.168.2.8
Jul 25, 2024 09:47:57.731477022 CEST	443	49730	13.107.253.42	192.168.2.8
Jul 25, 2024 09:47:57.731498003 CEST	49730	443	192.168.2.8	13.107.253.42
Jul 25, 2024 09:47:57.731530905 CEST	443	49730	13.107.253.42	192.168.2.8
Jul 25, 2024 09:47:57.731549025 CEST	49730	443	192.168.2.8	13.107.253.42
Jul 25, 2024 09:47:57.731578112 CEST	49730	443	192.168.2.8	13.107.253.42
Jul 25, 2024 09:47:57.736907959 CEST	443	49730	13.107.253.42	192.168.2.8
Jul 25, 2024 09:47:57.736958027 CEST	443	49730	13.107.253.42	192.168.2.8
Jul 25, 2024 09:47:57.736987114 CEST	49730	443	192.168.2.8	13.107.253.42
Jul 25, 2024 09:47:57.737006903 CEST	443	49730	13.107.253.42	192.168.2.8
Jul 25, 2024 09:47:57.737035036 CEST	49730	443	192.168.2.8	13.107.253.42
Jul 25, 2024 09:47:57.737051010 CEST	49730	443	192.168.2.8	13.107.253.42
Jul 25, 2024 09:47:57.737106085 CEST	443	49730	13.107.253.42	192.168.2.8
Jul 25, 2024 09:47:57.737158060 CEST	49730	443	192.168.2.8	13.107.253.42
Jul 25, 2024 09:47:57.737164974 CEST	443	49730	13.107.253.42	192.168.2.8
Jul 25, 2024 09:47:57.737206936 CEST	49730	443	192.168.2.8	13.107.253.42
Jul 25, 2024 09:47:57.737248898 CEST	443	49730	13.107.253.42	192.168.2.8
Jul 25, 2024 09:47:57.737495899 CEST	49730	443	192.168.2.8	13.107.253.42
Jul 25, 2024 09:47:57.737525940 CEST	49730	443	192.168.2.8	13.107.253.42
Jul 25, 2024 09:47:57.737544060 CEST	443	49730	13.107.253.42	192.168.2.8
Jul 25, 2024 09:47:57.784379005 CEST	443	49732	13.107.253.45	192.168.2.8
Jul 25, 2024 09:47:57.784414053 CEST	443	49732	13.107.253.45	192.168.2.8
Jul 25, 2024 09:47:57.784421921 CEST	443	49732	13.107.253.45	192.168.2.8
Jul 25, 2024 09:47:57.784446955 CEST	443	49732	13.107.253.45	192.168.2.8
Jul 25, 2024 09:47:57.784465075 CEST	49732	443	192.168.2.8	13.107.253.45
Jul 25, 2024 09:47:57.784477949 CEST	443	49732	13.107.253.45	192.168.2.8
Jul 25, 2024 09:47:57.784492970 CEST	443	49732	13.107.253.45	192.168.2.8
Jul 25, 2024 09:47:57.784508944 CEST	49732	443	192.168.2.8	13.107.253.45
Jul 25, 2024 09:47:57.784529924 CEST	49732	443	192.168.2.8	13.107.253.45
Jul 25, 2024 09:47:57.784559965 CEST	49732	443	192.168.2.8	13.107.253.45
Jul 25, 2024 09:47:57.875502110 CEST	443	49732	13.107.253.45	192.168.2.8
Jul 25, 2024 09:47:57.875535965 CEST	443	49732	13.107.253.45	192.168.2.8
Jul 25, 2024 09:47:57.875581026 CEST	49732	443	192.168.2.8	13.107.253.45
Jul 25, 2024 09:47:57.875603914 CEST	443	49732	13.107.253.45	192.168.2.8
Jul 25, 2024 09:47:57.875622988 CEST	49732	443	192.168.2.8	13.107.253.45
Jul 25, 2024 09:47:57.875647068 CEST	49732	443	192.168.2.8	13.107.253.45
Jul 25, 2024 09:47:57.881849051 CEST	443	49732	13.107.253.45	192.168.2.8
Jul 25, 2024 09:47:57.881866932 CEST	443	49732	13.107.253.45	192.168.2.8
Jul 25, 2024 09:47:57.881918907 CEST	49732	443	192.168.2.8	13.107.253.45
Jul 25, 2024 09:47:57.881927013 CEST	443	49732	13.107.253.45	192.168.2.8
Jul 25, 2024 09:47:57.881978035 CEST	49732	443	192.168.2.8	13.107.253.45
Jul 25, 2024 09:47:57.999392033 CEST	443	49732	13.107.253.45	192.168.2.8
Jul 25, 2024 09:47:57.999463081 CEST	443	49732	13.107.253.45	192.168.2.8
Jul 25, 2024 09:47:57.999480963 CEST	49732	443	192.168.2.8	13.107.253.45
Jul 25, 2024 09:47:57.999500036 CEST	443	49732	13.107.253.45	192.168.2.8
Jul 25, 2024 09:47:57.999527931 CEST	49732	443	192.168.2.8	13.107.253.45
Jul 25, 2024 09:47:57.999576092 CEST	49732	443	192.168.2.8	13.107.253.45
Jul 25, 2024 09:47:58.000143051 CEST	443	49732	13.107.253.45	192.168.2.8
Jul 25, 2024 09:47:58.000190973 CEST	443	49732	13.107.253.45	192.168.2.8
Jul 25, 2024 09:47:58.000211000 CEST	49732	443	192.168.2.8	13.107.253.45
Jul 25, 2024 09:47:58.000219107 CEST	443	49732	13.107.253.45	192.168.2.8
Jul 25, 2024 09:47:58.000248909 CEST	49732	443	192.168.2.8	13.107.253.45
Jul 25, 2024 09:47:58.000268936 CEST	49732	443	192.168.2.8	13.107.253.45
Jul 25, 2024 09:47:58.008371115 CEST	443	49732	13.107.253.45	192.168.2.8
Jul 25, 2024 09:47:58.008393049 CEST	443	49732	13.107.253.45	192.168.2.8
Jul 25, 2024 09:47:58.008446932 CEST	49732	443	192.168.2.8	13.107.253.45
Jul 25, 2024 09:47:58.008455038 CEST	443	49732	13.107.253.45	192.168.2.8
Jul 25, 2024 09:47:58.008512974 CEST	49732	443	192.168.2.8	13.107.253.45
Jul 25, 2024 09:47:58.011373997 CEST	443	49732	13.107.253.45	192.168.2.8
Jul 25, 2024 09:47:58.011419058 CEST	443	49732	13.107.253.45	192.168.2.8
Jul 25, 2024 09:47:58.011464119 CEST	49732	443	192.168.2.8	13.107.253.45
Jul 25, 2024 09:47:58.011471033 CEST	443	49732	13.107.253.45	192.168.2.8
Jul 25, 2024 09:47:58.011502981 CEST	49732	443	192.168.2.8	13.107.253.45
Jul 25, 2024 09:47:58.011523962 CEST	49732	443	192.168.2.8	13.107.253.45
Jul 25, 2024 09:47:58.092916012 CEST	443	49732	13.107.253.45	192.168.2.8
Jul 25, 2024 09:47:58.092989922 CEST	443	49732	13.107.253.45	192.168.2.8
Jul 25, 2024 09:47:58.093018055 CEST	49732	443	192.168.2.8	13.107.253.45
Jul 25, 2024 09:47:58.093044996 CEST	443	49732	13.107.253.45	192.168.2.8
Jul 25, 2024 09:47:58.093058109 CEST	49732	443	192.168.2.8	13.107.253.45
Jul 25, 2024 09:47:58.093082905 CEST	49732	443	192.168.2.8	13.107.253.45
Jul 25, 2024 09:47:58.094367027 CEST	443	49732	13.107.253.45	192.168.2.8
Jul 25, 2024 09:47:58.094384909 CEST	443	49732	13.107.253.45	192.168.2.8
Jul 25, 2024 09:47:58.094435930 CEST	49732	443	192.168.2.8	13.107.253.45
Jul 25, 2024 09:47:58.094450951 CEST	443	49732	13.107.253.45	192.168.2.8
Jul 25, 2024 09:47:58.094476938 CEST	49732	443	192.168.2.8	13.107.253.45
Jul 25, 2024 09:47:58.094491959 CEST	49732	443	192.168.2.8	13.107.253.45
Jul 25, 2024 09:47:58.095221996 CEST	443	49732	13.107.253.45	192.168.2.8
Jul 25, 2024 09:47:58.095240116 CEST	443	49732	13.107.253.45	192.168.2.8
Jul 25, 2024 09:47:58.095289946 CEST	49732	443	192.168.2.8	13.107.253.45
Jul 25, 2024 09:47:58.095294952 CEST	443	49732	13.107.253.45	192.168.2.8
Jul 25, 2024 09:47:58.095347881 CEST	49732	443	192.168.2.8	13.107.253.45
Jul 25, 2024 09:47:58.096782923 CEST	443	49732	13.107.253.45	192.168.2.8
Jul 25, 2024 09:47:58.096802950 CEST	443	49732	13.107.253.45	192.168.2.8
Jul 25, 2024 09:47:58.096844912 CEST	49732	443	192.168.2.8	13.107.253.45
Jul 25, 2024 09:47:58.096851110 CEST	443	49732	13.107.253.45	192.168.2.8
Jul 25, 2024 09:47:58.096900940 CEST	49732	443	192.168.2.8	13.107.253.45
Jul 25, 2024 09:47:58.187098026 CEST	443	49732	13.107.253.45	192.168.2.8
Jul 25, 2024 09:47:58.187120914 CEST	443	49732	13.107.253.45	192.168.2.8
Jul 25, 2024 09:47:58.187165022 CEST	49732	443	192.168.2.8	13.107.253.45
Jul 25, 2024 09:47:58.187181950 CEST	443	49732	13.107.253.45	192.168.2.8
Jul 25, 2024 09:47:58.187211990 CEST	49732	443	192.168.2.8	13.107.253.45
Jul 25, 2024 09:47:58.187227964 CEST	49732	443	192.168.2.8	13.107.253.45
Jul 25, 2024 09:47:58.187799931 CEST	443	49732	13.107.253.45	192.168.2.8
Jul 25, 2024 09:47:58.187829018 CEST	443	49732	13.107.253.45	192.168.2.8
Jul 25, 2024 09:47:58.187856913 CEST	49732	443	192.168.2.8	13.107.253.45
Jul 25, 2024 09:47:58.187860966 CEST	443	49732	13.107.253.45	192.168.2.8
Jul 25, 2024 09:47:58.187875986 CEST	443	49732	13.107.253.45	192.168.2.8
Jul 25, 2024 09:47:58.187890053 CEST	49732	443	192.168.2.8	13.107.253.45
Jul 25, 2024 09:47:58.187916994 CEST	49732	443	192.168.2.8	13.107.253.45
Jul 25, 2024 09:47:58.210180044 CEST	49732	443	192.168.2.8	13.107.253.45
Jul 25, 2024 09:47:58.210205078 CEST	443	49732	13.107.253.45	192.168.2.8
Jul 25, 2024 09:48:01.389157057 CEST	49760	443	192.168.2.8	40.68.123.157
Jul 25, 2024 09:48:01.389206886 CEST	443	49760	40.68.123.157	192.168.2.8
Jul 25, 2024 09:48:01.389353037 CEST	49760	443	192.168.2.8	40.68.123.157
Jul 25, 2024 09:48:01.391098976 CEST	49760	443	192.168.2.8	40.68.123.157
Jul 25, 2024 09:48:01.391135931 CEST	443	49760	40.68.123.157	192.168.2.8
Jul 25, 2024 09:48:02.181348085 CEST	443	49760	40.68.123.157	192.168.2.8
Jul 25, 2024 09:48:02.181444883 CEST	49760	443	192.168.2.8	40.68.123.157
Jul 25, 2024 09:48:02.190994024 CEST	49760	443	192.168.2.8	40.68.123.157
Jul 25, 2024 09:48:02.191009998 CEST	443	49760	40.68.123.157	192.168.2.8
Jul 25, 2024 09:48:02.191452026 CEST	443	49760	40.68.123.157	192.168.2.8
Jul 25, 2024 09:48:02.244769096 CEST	49760	443	192.168.2.8	40.68.123.157
Jul 25, 2024 09:48:02.286618948 CEST	49760	443	192.168.2.8	40.68.123.157
Jul 25, 2024 09:48:02.332504988 CEST	443	49760	40.68.123.157	192.168.2.8
Jul 25, 2024 09:48:02.550203085 CEST	443	49760	40.68.123.157	192.168.2.8
Jul 25, 2024 09:48:02.550235033 CEST	443	49760	40.68.123.157	192.168.2.8
Jul 25, 2024 09:48:02.550242901 CEST	443	49760	40.68.123.157	192.168.2.8
Jul 25, 2024 09:48:02.550267935 CEST	443	49760	40.68.123.157	192.168.2.8
Jul 25, 2024 09:48:02.550282001 CEST	443	49760	40.68.123.157	192.168.2.8
Jul 25, 2024 09:48:02.550293922 CEST	443	49760	40.68.123.157	192.168.2.8
Jul 25, 2024 09:48:02.550328970 CEST	49760	443	192.168.2.8	40.68.123.157
Jul 25, 2024 09:48:02.550343037 CEST	443	49760	40.68.123.157	192.168.2.8
Jul 25, 2024 09:48:02.550359964 CEST	49760	443	192.168.2.8	40.68.123.157
Jul 25, 2024 09:48:02.550383091 CEST	49760	443	192.168.2.8	40.68.123.157
Jul 25, 2024 09:48:02.551212072 CEST	443	49760	40.68.123.157	192.168.2.8
Jul 25, 2024 09:48:02.551275015 CEST	49760	443	192.168.2.8	40.68.123.157
Jul 25, 2024 09:48:02.551284075 CEST	443	49760	40.68.123.157	192.168.2.8
Jul 25, 2024 09:48:02.551302910 CEST	443	49760	40.68.123.157	192.168.2.8
Jul 25, 2024 09:48:02.551352024 CEST	49760	443	192.168.2.8	40.68.123.157
Jul 25, 2024 09:48:02.563339949 CEST	49760	443	192.168.2.8	40.68.123.157
Jul 25, 2024 09:48:02.563371897 CEST	443	49760	40.68.123.157	192.168.2.8
Jul 25, 2024 09:48:02.563385010 CEST	49760	443	192.168.2.8	40.68.123.157
Jul 25, 2024 09:48:02.563390970 CEST	443	49760	40.68.123.157	192.168.2.8
Jul 25, 2024 09:48:05.580939054 CEST	443	49719	172.217.18.4	192.168.2.8
Jul 25, 2024 09:48:05.581001043 CEST	443	49719	172.217.18.4	192.168.2.8
Jul 25, 2024 09:48:05.581054926 CEST	49719	443	192.168.2.8	172.217.18.4
Jul 25, 2024 09:48:05.602459908 CEST	49719	443	192.168.2.8	172.217.18.4
Jul 25, 2024 09:48:05.602483034 CEST	443	49719	172.217.18.4	192.168.2.8
Jul 25, 2024 09:48:06.046356916 CEST	49704	443	192.168.2.8	23.206.229.226
Jul 25, 2024 09:48:06.051203966 CEST	443	49704	23.206.229.226	192.168.2.8
Jul 25, 2024 09:48:16.259087086 CEST	60448	53	192.168.2.8	1.1.1.1
Jul 25, 2024 09:48:16.265141964 CEST	53	60448	1.1.1.1	192.168.2.8
Jul 25, 2024 09:48:16.265259981 CEST	60448	53	192.168.2.8	1.1.1.1
Jul 25, 2024 09:48:16.265316963 CEST	60448	53	192.168.2.8	1.1.1.1
Jul 25, 2024 09:48:16.271518946 CEST	53	60448	1.1.1.1	192.168.2.8
Jul 25, 2024 09:48:16.859018087 CEST	53	60448	1.1.1.1	192.168.2.8
Jul 25, 2024 09:48:16.863204002 CEST	60448	53	192.168.2.8	1.1.1.1
Jul 25, 2024 09:48:16.870737076 CEST	53	60448	1.1.1.1	192.168.2.8
Jul 25, 2024 09:48:16.870831966 CEST	60448	53	192.168.2.8	1.1.1.1
Jul 25, 2024 09:48:31.228121996 CEST	49703	80	192.168.2.8	199.232.214.172
Jul 25, 2024 09:48:31.540935040 CEST	49703	80	192.168.2.8	199.232.214.172
Jul 25, 2024 09:48:31.998020887 CEST	80	49703	199.232.214.172	192.168.2.8
Jul 25, 2024 09:48:31.999429941 CEST	80	49703	199.232.214.172	192.168.2.8
Jul 25, 2024 09:48:31.999488115 CEST	49703	80	192.168.2.8	199.232.214.172
Jul 25, 2024 09:48:39.987485886 CEST	60450	443	192.168.2.8	20.12.23.50
Jul 25, 2024 09:48:39.987529039 CEST	443	60450	20.12.23.50	192.168.2.8
Jul 25, 2024 09:48:39.987618923 CEST	60450	443	192.168.2.8	20.12.23.50
Jul 25, 2024 09:48:39.988009930 CEST	60450	443	192.168.2.8	20.12.23.50
Jul 25, 2024 09:48:39.988027096 CEST	443	60450	20.12.23.50	192.168.2.8
Jul 25, 2024 09:48:40.613061905 CEST	443	60450	20.12.23.50	192.168.2.8
Jul 25, 2024 09:48:40.613174915 CEST	60450	443	192.168.2.8	20.12.23.50
Jul 25, 2024 09:48:40.614706993 CEST	60450	443	192.168.2.8	20.12.23.50
Jul 25, 2024 09:48:40.614715099 CEST	443	60450	20.12.23.50	192.168.2.8
Jul 25, 2024 09:48:40.615084887 CEST	443	60450	20.12.23.50	192.168.2.8
Jul 25, 2024 09:48:40.616097927 CEST	60450	443	192.168.2.8	20.12.23.50
Jul 25, 2024 09:48:40.660505056 CEST	443	60450	20.12.23.50	192.168.2.8
Jul 25, 2024 09:48:40.827464104 CEST	443	60450	20.12.23.50	192.168.2.8
Jul 25, 2024 09:48:40.827518940 CEST	443	60450	20.12.23.50	192.168.2.8
Jul 25, 2024 09:48:40.827562094 CEST	443	60450	20.12.23.50	192.168.2.8
Jul 25, 2024 09:48:40.827586889 CEST	60450	443	192.168.2.8	20.12.23.50
Jul 25, 2024 09:48:40.827610016 CEST	443	60450	20.12.23.50	192.168.2.8
Jul 25, 2024 09:48:40.827630997 CEST	60450	443	192.168.2.8	20.12.23.50
Jul 25, 2024 09:48:40.827650070 CEST	60450	443	192.168.2.8	20.12.23.50
Jul 25, 2024 09:48:40.833734989 CEST	443	60450	20.12.23.50	192.168.2.8
Jul 25, 2024 09:48:40.833795071 CEST	443	60450	20.12.23.50	192.168.2.8
Jul 25, 2024 09:48:40.833812952 CEST	60450	443	192.168.2.8	20.12.23.50
Jul 25, 2024 09:48:40.833823919 CEST	443	60450	20.12.23.50	192.168.2.8
Jul 25, 2024 09:48:40.833847046 CEST	60450	443	192.168.2.8	20.12.23.50
Jul 25, 2024 09:48:40.833940983 CEST	443	60450	20.12.23.50	192.168.2.8
Jul 25, 2024 09:48:40.833987951 CEST	60450	443	192.168.2.8	20.12.23.50
Jul 25, 2024 09:48:40.834042072 CEST	60450	443	192.168.2.8	20.12.23.50
Jul 25, 2024 09:48:40.834059000 CEST	443	60450	20.12.23.50	192.168.2.8
Jul 25, 2024 09:48:54.964273930 CEST	60453	443	192.168.2.8	172.217.18.4
Jul 25, 2024 09:48:54.964359045 CEST	443	60453	172.217.18.4	192.168.2.8
Jul 25, 2024 09:48:54.964464903 CEST	60453	443	192.168.2.8	172.217.18.4
Jul 25, 2024 09:48:54.964754105 CEST	60453	443	192.168.2.8	172.217.18.4
Jul 25, 2024 09:48:54.964807034 CEST	443	60453	172.217.18.4	192.168.2.8
Jul 25, 2024 09:48:55.742502928 CEST	443	60453	172.217.18.4	192.168.2.8
Jul 25, 2024 09:48:55.742855072 CEST	60453	443	192.168.2.8	172.217.18.4
Jul 25, 2024 09:48:55.742902994 CEST	443	60453	172.217.18.4	192.168.2.8
Jul 25, 2024 09:48:55.743535995 CEST	443	60453	172.217.18.4	192.168.2.8
Jul 25, 2024 09:48:55.743822098 CEST	60453	443	192.168.2.8	172.217.18.4
Jul 25, 2024 09:48:55.743921041 CEST	443	60453	172.217.18.4	192.168.2.8
Jul 25, 2024 09:48:55.791043997 CEST	60453	443	192.168.2.8	172.217.18.4
Jul 25, 2024 09:49:05.532162905 CEST	443	60453	172.217.18.4	192.168.2.8
Jul 25, 2024 09:49:05.532262087 CEST	443	60453	172.217.18.4	192.168.2.8
Jul 25, 2024 09:49:05.532330036 CEST	60453	443	192.168.2.8	172.217.18.4
Jul 25, 2024 09:49:07.230246067 CEST	60453	443	192.168.2.8	172.217.18.4
Jul 25, 2024 09:49:07.230281115 CEST	443	60453	172.217.18.4	192.168.2.8

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 25, 2024 09:47:50.809377909 CEST	53	58524	1.1.1.1	192.168.2.8
Jul 25, 2024 09:47:50.817761898 CEST	53	50605	1.1.1.1	192.168.2.8
Jul 25, 2024 09:47:51.995273113 CEST	53	65253	1.1.1.1	192.168.2.8
Jul 25, 2024 09:47:53.788778067 CEST	50376	53	192.168.2.8	1.1.1.1
Jul 25, 2024 09:47:53.788988113 CEST	64884	53	192.168.2.8	1.1.1.1
Jul 25, 2024 09:47:54.903347015 CEST	51468	53	192.168.2.8	1.1.1.1
Jul 25, 2024 09:47:54.903595924 CEST	60085	53	192.168.2.8	1.1.1.1
Jul 25, 2024 09:47:55.010911942 CEST	53	51468	1.1.1.1	192.168.2.8
Jul 25, 2024 09:47:55.011104107 CEST	53	60085	1.1.1.1	192.168.2.8
Jul 25, 2024 09:47:55.776076078 CEST	64359	53	192.168.2.8	1.1.1.1
Jul 25, 2024 09:47:55.776192904 CEST	55595	53	192.168.2.8	1.1.1.1
Jul 25, 2024 09:47:56.932029963 CEST	58561	53	192.168.2.8	1.1.1.1
Jul 25, 2024 09:47:56.932161093 CEST	62558	53	192.168.2.8	1.1.1.1
Jul 25, 2024 09:48:01.309175014 CEST	53	53453	1.1.1.1	192.168.2.8
Jul 25, 2024 09:48:09.176326036 CEST	53	51328	1.1.1.1	192.168.2.8
Jul 25, 2024 09:48:16.258554935 CEST	53	63875	1.1.1.1	192.168.2.8
Jul 25, 2024 09:48:30.812012911 CEST	138	138	192.168.2.8	192.168.2.255
Jul 25, 2024 09:48:50.253880978 CEST	53	57414	1.1.1.1	192.168.2.8
Jul 25, 2024 09:48:53.776052952 CEST	61576	53	192.168.2.8	1.1.1.1
Jul 25, 2024 09:48:53.776269913 CEST	51309	53	192.168.2.8	1.1.1.1

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Jul 25, 2024 09:47:52.137048006 CEST	192.168.2.8	1.1.1.1	c2e7	(Port unreachable)	Destination Unreachable
Jul 25, 2024 09:48:53.795216084 CEST	192.168.2.8	1.1.1.1	c279	(Port unreachable)	Destination Unreachable

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jul 25, 2024 09:47:53.788778067 CEST	192.168.2.8	1.1.1.1	0x1c6a	Standard query (0)	mdec.nelreports.net	A (IP address)	IN (0x0001)	false
Jul 25, 2024 09:47:53.788988113 CEST	192.168.2.8	1.1.1.1	0xd7c7	Standard query (0)	mdec.nelreports.net	65	IN (0x0001)	false
Jul 25, 2024 09:47:54.903347015 CEST	192.168.2.8	1.1.1.1	0xd4a9	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Jul 25, 2024 09:47:54.903595924 CEST	192.168.2.8	1.1.1.1	0x81aa	Standard query (0)	www.google.com	65	IN (0x0001)	false
Jul 25, 2024 09:47:55.776076078 CEST	192.168.2.8	1.1.1.1	0xd7ec	Standard query (0)	js.monitor.azure.com	A (IP address)	IN (0x0001)	false
Jul 25, 2024 09:47:55.776192904 CEST	192.168.2.8	1.1.1.1	0x34e5	Standard query (0)	js.monitor.azure.com	65	IN (0x0001)	false
Jul 25, 2024 09:47:56.932029963 CEST	192.168.2.8	1.1.1.1	0x1af7	Standard query (0)	js.monitor.azure.com	A (IP address)	IN (0x0001)	false
Jul 25, 2024 09:47:56.932161093 CEST	192.168.2.8	1.1.1.1	0x935d	Standard query (0)	js.monitor.azure.com	65	IN (0x0001)	false
Jul 25, 2024 09:48:53.776052952 CEST	192.168.2.8	1.1.1.1	0xd539	Standard query (0)	mdec.nelreports.net	A (IP address)	IN (0x0001)	false
Jul 25, 2024 09:48:53.776269913 CEST	192.168.2.8	1.1.1.1	0xeb44	Standard query (0)	mdec.nelreports.net	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jul 25, 2024 09:47:53.796262026 CEST	1.1.1.1	192.168.2.8	0xd7c7	No error (0)	mdec.nelreports.net	mdec.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 25, 2024 09:47:53.798755884 CEST	1.1.1.1	192.168.2.8	0x1c6a	No error (0)	mdec.nelreports.net	mdec.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 25, 2024 09:47:55.010911942 CEST	1.1.1.1	192.168.2.8	0xd4a9	No error (0)	www.google.com		172.217.18.4	A (IP address)	IN (0x0001)	false
Jul 25, 2024 09:47:55.011104107 CEST	1.1.1.1	192.168.2.8	0x81aa	No error (0)	www.google.com			65	IN (0x0001)	false
Jul 25, 2024 09:47:55.784791946 CEST	1.1.1.1	192.168.2.8	0xe1b5	No error (0)	consentdeliveryfd.azurefd.net	firstparty-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 25, 2024 09:47:55.784791946 CEST	1.1.1.1	192.168.2.8	0xe1b5	No error (0)	shed.dual-low.s-part-0014.t-0009.t-msedge.net	s-part-0014.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 25, 2024 09:47:55.784791946 CEST	1.1.1.1	192.168.2.8	0xe1b5	No error (0)	s-part-0014.t-0009.t-msedge.net		13.107.246.42	A (IP address)	IN (0x0001)	false
Jul 25, 2024 09:47:55.784898996 CEST	1.1.1.1	192.168.2.8	0xd7ec	No error (0)	js.monitor.azure.com	aijscdn2.azureedge.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 25, 2024 09:47:55.784898996 CEST	1.1.1.1	192.168.2.8	0xd7ec	No error (0)	shed.dual-low.s-part-0014.t-0009.t-msedge.net	s-part-0014.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 25, 2024 09:47:55.784898996 CEST	1.1.1.1	192.168.2.8	0xd7ec	No error (0)	s-part-0014.t-0009.t-msedge.net		13.107.246.42	A (IP address)	IN (0x0001)	false
Jul 25, 2024 09:47:55.784941912 CEST	1.1.1.1	192.168.2.8	0xd270	No error (0)	consentdeliveryfd.azurefd.net	firstparty-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 25, 2024 09:47:55.785100937 CEST	1.1.1.1	192.168.2.8	0x34e5	No error (0)	js.monitor.azure.com	aijscdn2.azureedge.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 25, 2024 09:47:56.753951073 CEST	1.1.1.1	192.168.2.8	0xf6e8	No error (0)	consentdeliveryfd.azurefd.net	firstparty-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 25, 2024 09:47:56.753951073 CEST	1.1.1.1	192.168.2.8	0xf6e8	No error (0)	shed.dual-low.s-part-0014.t-0009.t-msedge.net	azurefd-t-fb-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 25, 2024 09:47:56.753951073 CEST	1.1.1.1	192.168.2.8	0xf6e8	No error (0)	dual.s-part-0014.t-0009.fb-t-msedge.net	s-part-0014.t-0009.fb-t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 25, 2024 09:47:56.753951073 CEST	1.1.1.1	192.168.2.8	0xf6e8	No error (0)	s-part-0014.t-0009.fb-t-msedge.net		13.107.253.42	A (IP address)	IN (0x0001)	false
Jul 25, 2024 09:47:56.759603024 CEST	1.1.1.1	192.168.2.8	0x4427	No error (0)	consentdeliveryfd.azurefd.net	firstparty-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 25, 2024 09:47:56.939085007 CEST	1.1.1.1	192.168.2.8	0x1af7	No error (0)	js.monitor.azure.com	aijscdn2.azureedge.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 25, 2024 09:47:56.939085007 CEST	1.1.1.1	192.168.2.8	0x1af7	No error (0)	shed.dual-low.s-part-0032.t-0009.t-msedge.net	azurefd-t-fb-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 25, 2024 09:47:56.939085007 CEST	1.1.1.1	192.168.2.8	0x1af7	No error (0)	dual.s-part-0017.t-0009.fb-t-msedge.net	s-part-0017.t-0009.fb-t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 25, 2024 09:47:56.939085007 CEST	1.1.1.1	192.168.2.8	0x1af7	No error (0)	s-part-0017.t-0009.fb-t-msedge.net		13.107.253.45	A (IP address)	IN (0x0001)	false
Jul 25, 2024 09:47:56.940375090 CEST	1.1.1.1	192.168.2.8	0x935d	No error (0)	js.monitor.azure.com	aijscdn2.azureedge.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 25, 2024 09:48:02.540080070 CEST	1.1.1.1	192.168.2.8	0xf567	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 25, 2024 09:48:02.542083979 CEST	1.1.1.1	192.168.2.8	0x64d6	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 25, 2024 09:48:06.044871092 CEST	1.1.1.1	192.168.2.8	0x97e7	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 25, 2024 09:48:06.044914007 CEST	1.1.1.1	192.168.2.8	0x5ddc	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 25, 2024 09:48:53.783736944 CEST	1.1.1.1	192.168.2.8	0xd539	No error (0)	mdec.nelreports.net	mdec.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 25, 2024 09:48:53.795115948 CEST	1.1.1.1	192.168.2.8	0xeb44	No error (0)	mdec.nelreports.net	mdec.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

https:

wcpstatic.microsoft.com

js.monitor.azure.com

fs.microsoft.com

slscr.update.microsoft.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49720	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-07-25 07:47:56 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-07-25 07:47:56 UTC	466	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF4C) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=30117 Date: Thu, 25 Jul 2024 07:47:56 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.8	49725	13.107.246.42	443	7900	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-25 07:47:56 UTC	551	OUT	GET /mscc/lib/v2/wcp-consent.js HTTP/1.1 Host: wcpstatic.microsoft.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://learn.microsoft.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-07-25 07:47:56 UTC	712	IN	HTTP/1.1 200 OK Date: Thu, 25 Jul 2024 07:47:56 GMT Content-Type: application/javascript Content-Length: 52717 Connection: close Access-Control-Allow-Origin: * Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding Age: 2546 Cache-Control: max-age=43200 Content-MD5: QT/MdZzBmCG2G2lBgIsptQ== Etag: 0x8DA85F6F74C6D08 Last-Modified: Wed, 24 Aug 2022 17:34:58 GMT Vary: Accept-Encoding X-Cache: CONFIG_NOCACHE x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: c453384c-901e-000b-3e61-de3bb4000000 x-ms-version: 2009-09-19 x-azure-ref: 20240725T074756Z-15b94bb6ff9hzj67et992uy4mg00000002zg00000000chf8 Accept-Ranges: bytes
2024-07-25 07:47:56 UTC	15672	IN	Data Raw: 76 61 72 20 57 63 70 43 6f 6e 73 65 6e 74 3b 21 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 65 3d 7b 32 32 39 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 77 69 6e 64 6f 77 2c 65 2e 65 78 70 6f 72 74 73 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 7b 7d 3b 66 75 6e 63 74 69 6f 6e 20 6f 28 6e 29 7b 69 66 28 74 5b 6e 5d 29 72 65 74 75 72 6e 20 74 5b 6e 5d 2e 65 78 70 6f 72 74 73 3b 76 61 72 20 72 3d 74 5b 6e 5d 3d 7b 69 3a 6e 2c 6c 3a 21 31 2c 65 78 70 6f 72 74 73 3a 7b 7d 7d 3b 72 65 74 75 72 6e 20 65 5b 6e 5d 2e 63 61 6c 6c 28 72 2e 65 78 70 6f 72 74 73 2c 72 2c 72 2e 65 78 70 6f 72 74 73 2c 6f 29 2c 72 2e 6c 3d 21 30 2c 72 2e 65 78 70 6f 72 74 73 7d 72 65 74 75 72 6e 20 6f 2e 6d 3d 65 2c 6f 2e 63 3d 74 2c 6f 2e 64 3d 66 75 6e 63 74 69 6f 6e 28 65 Data Ascii: var WcpConsent;!function(){var e={229:function(e){window,e.exports=function(e){var t={};function o(n){if(t[n])return t[n].exports;var r=t[n]={i:n,l:!1,exports:{}};return e[n].call(r.exports,r,r.exports,o),r.l=!0,r.exports}return o.m=e,o.c=t,o.d=function(e
2024-07-25 07:47:56 UTC	711	IN	Data Raw: 7b 72 65 74 75 72 6e 20 65 3f 65 2e 72 65 70 6c 61 63 65 28 2f 26 2f 67 2c 22 26 61 6d 70 3b 22 29 2e 72 65 70 6c 61 63 65 28 2f 3c 2f 67 2c 22 26 6c 74 3b 22 29 2e 72 65 70 6c 61 63 65 28 2f 3e 2f 67 2c 22 26 67 74 3b 22 29 2e 72 65 70 6c 61 63 65 28 2f 22 2f 67 2c 22 26 71 75 6f 74 3b 22 29 2e 72 65 70 6c 61 63 65 28 2f 27 2f 67 2c 22 26 23 30 33 39 3b 22 29 3a 22 22 7d 2c 65 7d 28 29 2c 61 3d 6e 2e 6c 6f 63 61 6c 73 2c 6c 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 65 28 65 2c 74 2c 6f 2c 6e 2c 72 2c 69 2c 61 29 7b 74 68 69 73 2e 64 69 72 65 63 74 69 6f 6e 3d 22 6c 74 72 22 2c 74 68 69 73 2e 70 72 65 76 69 6f 75 73 46 6f 63 75 73 45 6c 65 6d 65 6e 74 42 65 66 6f 72 65 50 6f 70 75 70 3d 6e 75 6c 6c 2c 74 68 69 73 2e 63 6f 6f 6b 69 65 Data Ascii: {return e?e.replace(/&/g,"&").replace(/</g,"<").replace(/>/g,">").replace(/"/g,""").replace(/'/g,"'"):""},e}(),a=n.locals,l=function(){function e(e,t,o,n,r,i,a){this.direction="ltr",this.previousFocusElementBeforePopup=null,this.cookie
2024-07-25 07:47:56 UTC	16383	IN	Data Raw: 61 2d 6c 61 62 65 6c 3d 22 27 2b 69 2e 65 73 63 61 70 65 48 74 6d 6c 28 74 68 69 73 2e 74 65 78 74 52 65 73 6f 75 72 63 65 73 2e 70 72 65 66 65 72 65 6e 63 65 73 44 69 61 6c 6f 67 43 6c 6f 73 65 4c 61 62 65 6c 29 2b 27 22 20 63 6c 61 73 73 3d 22 27 2b 61 2e 63 6c 6f 73 65 4d 6f 64 61 6c 49 63 6f 6e 2b 27 22 20 74 61 62 69 6e 64 65 78 3d 22 30 22 3e 26 23 78 32 37 31 35 3b 3c 2f 62 75 74 74 6f 6e 3e 5c 6e 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 72 6f 6c 65 3d 22 64 6f 63 75 6d 65 6e 74 22 20 63 6c 61 73 73 3d 22 27 2b 61 2e 6d 6f 64 61 6c 42 6f 64 79 2b 27 22 3e 5c 6e 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 3e 5c 6e 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 68 31 20 63 6c 61 73 73 3d 22 27 2b 61 2e 6d 6f Data Ascii: a-label="'+i.escapeHtml(this.textResources.preferencesDialogCloseLabel)+'" class="'+a.closeModalIcon+'" tabindex="0">✕</button>\n <div role="document" class="'+a.modalBody+'">\n <div>\n <h1 class="'+a.mo
2024-07-25 07:47:56 UTC	16383	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 22 2b 65 5b 22 72 61 64 69 6f 2d 62 75 74 74 6f 6e 2d 64 69 73 61 62 6c 65 64 2d 63 6f 6c 6f 72 22 5d 2b 22 20 21 69 6d 70 6f 72 74 61 6e 74 3b 5c 6e 20 20 20 20 20 20 20 20 7d 22 7d 2c 65 7d 28 29 2c 64 3d 5b 22 61 72 22 2c 22 68 65 22 2c 22 70 73 22 2c 22 75 72 22 2c 22 66 61 22 2c 22 70 61 22 2c 22 73 64 22 2c 22 74 6b 22 2c 22 75 67 22 2c 22 79 69 22 2c 22 73 79 72 22 2c 22 6b 73 2d 61 72 61 62 22 5d 2c 75 3d 7b 22 63 6c 6f 73 65 2d 62 75 74 74 6f 6e 2d 63 6f 6c 6f 72 22 3a 22 23 36 36 36 36 36 36 22 2c 22 73 65 63 6f 6e 64 61 72 79 2d 62 75 74 74 6f 6e 2d 64 69 73 61 62 6c 65 64 2d 6f 70 61 63 69 74 79 22 3a 22 31 22 2c 22 73 65 63 6f 6e 64 61 72 79 2d 62 75 74 74 6f Data Ascii: background-color: "+e["radio-button-disabled-color"]+" !important;\n }"},e}(),d=["ar","he","ps","ur","fa","pa","sd","tk","ug","yi","syr","ks-arab"],u={"close-button-color":"#666666","secondary-button-disabled-opacity":"1","secondary-butto
2024-07-25 07:47:56 UTC	3568	IN	Data Raw: 74 28 22 2d 22 29 5b 30 5d 3b 6f 3d 65 2e 73 70 6c 69 74 28 22 2d 22 29 5b 30 5d 3d 3d 3d 6e 7d 72 65 74 75 72 6e 20 6f 7d 28 65 2c 63 29 7d 29 29 3b 73 26 26 30 3d 3d 3d 73 2e 6c 65 6e 67 74 68 26 26 28 65 3d 22 65 6e 2d 55 53 22 29 2c 6f 2e 70 6c 61 63 65 68 6f 6c 64 65 72 45 6c 65 6d 65 6e 74 3d 6c 2c 72 26 26 6f 2e 63 6f 6e 73 65 6e 74 43 68 61 6e 67 65 64 43 61 6c 6c 62 61 63 6b 73 2e 72 65 67 69 73 74 65 72 43 61 6c 6c 62 61 63 6b 28 72 29 2c 6f 2e 73 61 76 65 43 6f 6f 6b 69 65 28 29 2c 6f 2e 73 69 74 65 43 6f 6e 73 65 6e 74 3d 6e 65 77 20 66 28 21 31 29 2c 6e 75 6c 6c 3d 3d 6e 7c 7c 6e 28 76 6f 69 64 20 30 2c 6f 2e 73 69 74 65 43 6f 6e 73 65 6e 74 29 2c 6f 2e 69 73 49 6e 69 74 52 65 61 64 79 3d 21 30 2c 74 68 69 73 2e 63 6f 6e 73 65 6e 74 43 68 61 Data Ascii: t("-")[0];o=e.split("-")[0]===n}return o}(e,c)}));s&&0===s.length&&(e="en-US"),o.placeholderElement=l,r&&o.consentChangedCallbacks.registerCallback(r),o.saveCookie(),o.siteConsent=new f(!1),null==n\|\|n(void 0,o.siteConsent),o.isInitReady=!0,this.consentCha

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.8	49724	13.107.246.42	443	7900	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-25 07:47:56 UTC	549	OUT	GET /scripts/c/ms.jsll-4.min.js HTTP/1.1 Host: js.monitor.azure.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://learn.microsoft.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-07-25 07:47:56 UTC	958	IN	HTTP/1.1 200 OK Date: Thu, 25 Jul 2024 07:47:56 GMT Content-Type: text/javascript; charset=utf-8 Content-Length: 206998 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: no-transform, public, max-age=1800, immutable Last-Modified: Mon, 15 Jul 2024 17:38:35 GMT ETag: 0x8DCA4F4F47351DF x-ms-request-id: bd54a350-101e-00a5-0729-dd7893000000 x-ms-version: 2009-09-19 x-ms-meta-jssdkver: 4.3.0 x-ms-meta-jssdksrc: [cdn]/scripts/c/ms.jsll-4.3.0.min.js Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,x-ms-meta-jssdkver,x-ms-meta-jssdksrc,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240725T074756Z-15b94bb6ff9jvw8lyyuzzsv82w00000001g000000000aeey x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-07-25 07:47:56 UTC	15426	IN	Data Raw: 2f 2a 21 0a 20 2a 20 31 44 53 20 4a 53 4c 4c 20 53 4b 55 2c 20 34 2e 33 2e 30 0a 20 2a 20 43 6f 70 79 72 69 67 68 74 20 28 63 29 20 4d 69 63 72 6f 73 6f 66 74 20 61 6e 64 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 2e 20 41 6c 6c 20 72 69 67 68 74 73 20 72 65 73 65 72 76 65 64 2e 0a 20 2a 20 28 4d 69 63 72 6f 73 6f 66 74 20 49 6e 74 65 72 6e 61 6c 20 4f 6e 6c 79 29 0a 20 2a 2f 0a 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 76 61 72 20 6e 3d 22 75 6e 64 65 66 69 6e 65 64 22 3b 69 66 28 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 65 78 70 6f 72 74 73 26 26 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 21 3d 6e 29 74 28 65 78 70 6f 72 74 73 29 3b 65 6c 73 65 20 69 66 28 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 64 65 66 69 6e 65 26 26 64 65 66 69 Data Ascii: /! 1DS JSLL SKU, 4.3.0 * Copyright (c) Microsoft and contributors. All rights reserved. * (Microsoft Internal Only) */!function(e,t){var n="undefined";if("object"==typeof exports&&typeof module!=n)t(exports);else if("function"==typeof define&&defi
2024-07-25 07:47:56 UTC	16384	IN	Data Raw: 66 65 28 22 63 6f 6e 73 6f 6c 65 22 29 29 26 26 28 72 2e 65 72 72 6f 72 7c 7c 72 2e 6c 6f 67 29 28 74 2c 61 65 28 69 29 29 29 29 7d 78 65 28 61 3d 7b 74 68 65 6e 3a 6f 2c 22 63 61 74 63 68 22 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 6f 28 75 6e 64 65 66 69 6e 65 64 2c 65 29 7d 2c 22 66 69 6e 61 6c 6c 79 22 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 61 72 20 65 3d 74 2c 6e 3d 74 3b 72 65 74 75 72 6e 20 51 28 74 29 26 26 28 65 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 74 26 26 74 28 29 2c 65 7d 2c 6e 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 74 68 72 6f 77 20 74 26 26 74 28 29 2c 65 7d 29 2c 6f 28 65 2c 6e 29 7d 7d 2c 22 73 74 61 74 65 22 2c 7b 67 65 74 3a 64 7d 29 2c 6d 74 28 29 26 26 28 61 5b 79 74 28 31 31 29 5d 3d 22 49 Data Ascii: fe("console"))&&(r.error\|\|r.log)(t,ae(i))))}xe(a={then:o,"catch":function(e){return o(undefined,e)},"finally":function(t){var e=t,n=t;return Q(t)&&(e=function(e){return t&&t(),e},n=function(e){throw t&&t(),e}),o(e,n)}},"state",{get:d}),mt()&&(a[yt(11)]="I
2024-07-25 07:47:56 UTC	16384	IN	Data Raw: 2c 6e 2e 68 3d 6e 2e 68 7c 7c 72 6e 28 73 63 2c 30 2c 6e 29 29 3a 4c 28 72 2c 5b 65 5d 29 29 7d 29 7d 64 63 2e 5f 5f 69 65 44 79 6e 3d 31 3b 76 61 72 20 66 63 3d 64 63 3b 66 75 6e 63 74 69 6f 6e 20 64 63 28 65 29 7b 74 68 69 73 2e 6c 69 73 74 65 6e 65 72 73 3d 5b 5d 3b 76 61 72 20 6e 2c 69 3d 5b 5d 2c 61 3d 7b 68 3a 6e 75 6c 6c 2c 63 62 3a 5b 5d 7d 2c 6f 3d 6c 6f 28 65 2c 75 63 29 5b 47 6e 5d 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 6e 3d 21 21 65 2e 63 66 67 2e 70 65 72 66 45 76 74 73 53 65 6e 64 41 6c 6c 7d 29 3b 76 65 28 64 63 2c 74 68 69 73 2c 66 75 6e 63 74 69 6f 6e 28 65 29 7b 59 28 65 2c 22 6c 69 73 74 65 6e 65 72 73 22 2c 7b 67 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 69 7d 7d 29 2c 65 5b 74 72 5d 3d 66 75 6e 63 74 69 6f 6e 28 65 29 Data Ascii: ,n.h=n.h\|\|rn(sc,0,n)):L(r,[e]))})}dc.__ieDyn=1;var fc=dc;function dc(e){this.listeners=[];var n,i=[],a={h:null,cb:[]},o=lo(e,uc)[Gn](function(e){n=!!e.cfg.perfEvtsSendAll});ve(dc,this,function(e){Y(e,"listeners",{g:function(){return i}}),e[tr]=function(e)
2024-07-25 07:47:56 UTC	16384	IN	Data Raw: 28 61 29 7d 2c 36 2c 6e 29 2c 69 7d 2c 66 5b 63 72 5d 3d 73 2c 66 2e 61 64 64 50 6c 75 67 69 6e 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 2c 72 29 7b 69 66 28 21 65 29 72 65 74 75 72 6e 20 72 26 26 72 28 21 31 29 2c 76 6f 69 64 20 43 28 6e 75 29 3b 76 61 72 20 69 3d 73 28 65 5b 5a 6e 5d 29 3b 69 66 28 69 26 26 21 74 29 72 65 74 75 72 6e 20 72 26 26 72 28 21 31 29 2c 76 6f 69 64 20 43 28 22 50 6c 75 67 69 6e 20 5b 22 2b 65 5b 5a 6e 5d 2b 22 5d 20 69 73 20 61 6c 72 65 61 64 79 20 6c 6f 61 64 65 64 21 22 29 3b 76 61 72 20 61 2c 6f 3d 7b 72 65 61 73 6f 6e 3a 31 36 7d 3b 66 75 6e 63 74 69 6f 6e 20 63 28 29 7b 41 5b 74 65 5d 28 65 29 2c 6f 2e 61 64 64 65 64 3d 5b 65 5d 2c 67 28 6f 29 2c 72 26 26 72 28 21 30 29 7d 69 3f 76 28 61 3d 5b 69 2e 70 6c 75 67 69 6e Data Ascii: (a)},6,n),i},f[cr]=s,f.addPlugin=function(e,t,n,r){if(!e)return r&&r(!1),void C(nu);var i=s(e[Zn]);if(i&&!t)return r&&r(!1),void C("Plugin ["+e[Zn]+"] is already loaded!");var a,o={reason:16};function c(){A[te](e),o.added=[e],g(o),r&&r(!0)}i?v(a=[i.plugin
2024-07-25 07:47:56 UTC	16384	IN	Data Raw: 73 5d 28 29 2c 6e 3d 66 65 28 65 3d 3d 3d 43 6c 2e 4c 6f 63 61 6c 53 74 6f 72 61 67 65 3f 22 6c 6f 63 61 6c 53 74 6f 72 61 67 65 22 3a 22 73 65 73 73 69 6f 6e 53 74 6f 72 61 67 65 22 29 2c 72 3d 54 6c 2b 74 2c 69 3d 28 6e 2e 73 65 74 49 74 65 6d 28 72 2c 74 29 2c 6e 2e 67 65 74 49 74 65 6d 28 72 29 21 3d 3d 74 29 3b 69 66 28 6e 5b 77 73 5d 28 72 29 2c 21 69 29 72 65 74 75 72 6e 20 6e 7d 63 61 74 63 68 28 61 29 7b 7d 72 65 74 75 72 6e 20 6e 75 6c 6c 7d 66 75 6e 63 74 69 6f 6e 20 45 6c 28 29 7b 72 65 74 75 72 6e 20 5f 6c 28 29 3f 49 6c 28 43 6c 2e 53 65 73 73 69 6f 6e 53 74 6f 72 61 67 65 29 3a 6e 75 6c 6c 7d 66 75 6e 63 74 69 6f 6e 20 5f 6c 28 65 29 7b 72 65 74 75 72 6e 20 62 6c 3d 65 7c 7c 62 6c 3d 3d 3d 75 6e 64 65 66 69 6e 65 64 3f 21 21 49 6c 28 43 6c Data Ascii: s](),n=fe(e===Cl.LocalStorage?"localStorage":"sessionStorage"),r=Tl+t,i=(n.setItem(r,t),n.getItem(r)!==t);if(n[ws](r),!i)return n}catch(a){}return null}function El(){return _l()?Il(Cl.SessionStorage):null}function _l(e){return bl=e\|\|bl===undefined?!!Il(Cl
2024-07-25 07:47:56 UTC	16384	IN	Data Raw: 72 6e 20 6f 7d 7d 29 2c 59 28 65 2c 22 70 61 67 65 56 69 73 69 74 54 69 6d 65 54 72 61 63 6b 69 6e 67 48 61 6e 64 6c 65 72 22 2c 7b 67 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 63 7d 7d 29 7d 29 7d 76 61 72 20 45 64 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 74 68 69 73 5b 6c 64 5d 3d 4f 74 28 29 2c 74 68 69 73 2e 70 61 67 65 4e 61 6d 65 3d 65 2c 74 68 69 73 2e 70 61 67 65 55 72 6c 3d 74 7d 2c 5f 64 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 65 29 7b 76 61 72 20 6f 3d 74 68 69 73 2c 63 3d 7b 7d 3b 6f 2e 73 74 61 72 74 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 63 5b 65 5d 26 26 6d 65 28 61 2c 32 2c 36 32 2c 22 73 74 61 72 74 20 77 61 73 20 63 61 6c 6c 65 64 20 6d 6f 72 65 20 74 68 61 6e 20 Data Ascii: rn o}}),Y(e,"pageVisitTimeTrackingHandler",{g:function(){return c}})})}var Ed=function(e,t){this[ld]=Ot(),this.pageName=e,this.pageUrl=t},_d=function(a,e){var o=this,c={};o.start=function(e){"undefined"!=typeof c[e]&&me(a,2,62,"start was called more than
2024-07-25 07:47:56 UTC	16384	IN	Data Raw: 61 67 73 3d 6d 73 28 21 30 2c 6e 2e 5f 70 61 67 65 54 61 67 73 2c 74 2e 70 61 67 65 54 61 67 73 29 29 2c 65 2e 70 72 6f 70 65 72 74 69 65 73 3d 65 2e 70 72 6f 70 65 72 74 69 65 73 7c 7c 7b 7d 2c 65 2e 70 72 6f 70 65 72 74 69 65 73 2e 70 61 67 65 54 61 67 73 3d 6e 2e 5f 70 61 67 65 54 61 67 73 7d 2c 65 70 2e 70 72 6f 74 6f 74 79 70 65 2e 5f 67 65 74 42 65 68 61 76 69 6f 72 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3b 72 65 74 75 72 6e 20 65 26 26 63 65 28 65 2e 62 65 68 61 76 69 6f 72 29 3f 74 3d 65 2e 62 65 68 61 76 69 6f 72 3a 63 65 28 74 68 69 73 2e 5f 62 65 68 61 76 69 6f 72 4d 65 74 61 54 61 67 29 26 26 28 74 3d 74 68 69 73 2e 5f 62 65 68 61 76 69 6f 72 4d 65 74 61 54 61 67 29 2c 74 68 69 73 2e 5f 67 65 74 56 61 6c 69 64 42 65 68 61 76 69 Data Ascii: ags=ms(!0,n._pageTags,t.pageTags)),e.properties=e.properties\|\|{},e.properties.pageTags=n._pageTags},ep.prototype._getBehavior=function(e){var t;return e&&ce(e.behavior)?t=e.behavior:ce(this._behaviorMetaTag)&&(t=this._behaviorMetaTag),this._getValidBehavi
2024-07-25 07:47:56 UTC	16384	IN	Data Raw: 6d 65 73 2e 63 6f 6e 74 65 6e 74 4e 61 6d 65 29 3b 72 26 26 28 61 5b 74 5d 3d 72 29 2c 69 26 26 28 61 5b 6e 5d 3d 69 29 7d 72 65 74 75 72 6e 20 61 7d 2c 53 70 29 3b 66 75 6e 63 74 69 6f 6e 20 53 70 28 65 2c 74 29 7b 74 68 69 73 2e 5f 63 6f 6e 66 69 67 3d 65 2c 74 68 69 73 2e 5f 74 72 61 63 65 4c 6f 67 67 65 72 3d 74 2c 74 68 69 73 2e 5f 63 6f 6e 74 65 6e 74 42 6c 6f 62 46 69 65 6c 64 4e 61 6d 65 73 3d 6e 75 6c 6c 2c 74 68 69 73 2e 5f 63 6f 6e 74 65 6e 74 42 6c 6f 62 46 69 65 6c 64 4e 61 6d 65 73 3d 21 30 3d 3d 3d 74 68 69 73 2e 5f 63 6f 6e 66 69 67 2e 75 73 65 53 68 6f 72 74 4e 61 6d 65 46 6f 72 43 6f 6e 74 65 6e 74 42 6c 6f 62 3f 54 70 2e 73 68 6f 72 74 4e 61 6d 65 73 3a 54 70 2e 6c 6f 6e 67 4e 61 6d 65 73 7d 76 61 72 20 78 70 2c 4e 70 3d 48 65 28 7b 75 Data Ascii: mes.contentName);r&&(a[t]=r),i&&(a[n]=i)}return a},Sp);function Sp(e,t){this._config=e,this._traceLogger=t,this._contentBlobFieldNames=null,this._contentBlobFieldNames=!0===this._config.useShortNameForContentBlob?Tp.shortNames:Tp.longNames}var xp,Np=He({u
2024-07-25 07:47:56 UTC	16384	IN	Data Raw: 67 3d 22 73 65 6e 64 54 79 70 65 22 2c 4b 67 3d 22 61 64 64 48 65 61 64 65 72 22 2c 47 67 3d 22 63 61 6e 53 65 6e 64 52 65 71 75 65 73 74 22 2c 58 67 3d 22 73 65 6e 64 51 75 65 75 65 64 52 65 71 75 65 73 74 73 22 2c 4a 67 3d 22 69 73 43 6f 6d 70 6c 65 74 65 6c 79 49 64 6c 65 22 2c 51 67 3d 22 73 65 74 55 6e 6c 6f 61 64 69 6e 67 22 2c 59 67 3d 22 73 65 6e 64 53 79 6e 63 68 72 6f 6e 6f 75 73 42 61 74 63 68 22 2c 24 67 3d 22 5f 74 72 61 6e 73 70 6f 72 74 22 2c 5a 67 3d 22 67 65 74 57 50 61 72 61 6d 22 2c 65 76 3d 22 69 73 42 65 61 63 6f 6e 22 2c 74 76 3d 22 74 69 6d 69 6e 67 73 22 2c 6e 76 3d 22 69 73 54 65 61 72 64 6f 77 6e 22 2c 72 76 3d 22 69 73 53 79 6e 63 22 2c 69 76 3d 22 64 61 74 61 22 2c 61 76 3d 22 5f 73 65 6e 64 52 65 61 73 6f 6e 22 2c 6f 76 3d 22 Data Ascii: g="sendType",Kg="addHeader",Gg="canSendRequest",Xg="sendQueuedRequests",Jg="isCompletelyIdle",Qg="setUnloading",Yg="sendSynchronousBatch",$g="_transport",Zg="getWParam",ev="isBeacon",tv="timings",nv="isTeardown",rv="isSync",iv="data",av="_sendReason",ov="
2024-07-25 07:47:56 UTC	16384	IN	Data Raw: 28 29 7b 72 65 3d 21 31 2c 61 65 3d 21 28 69 65 3d 5b 5d 29 2c 52 3d 31 65 34 2c 75 65 3d 7b 7d 2c 73 65 3d 59 70 2c 65 65 3d 21 28 46 3d 7b 7d 29 2c 71 3d 42 3d 56 3d 55 3d 63 65 3d 6f 65 3d 30 2c 7a 3d 2d 31 2c 4b 3d 21 28 57 3d 21 28 6a 3d 4c 3d 4d 3d 50 3d 6b 3d 6e 75 6c 6c 29 29 2c 47 3d 36 2c 74 65 3d 4a 3d 6e 75 6c 6c 2c 6e 65 3d 21 28 58 3d 32 29 2c 51 3d 50 76 28 29 2c 48 3d 6e 65 77 20 42 76 28 4f 3d 35 30 30 2c 32 2c 31 2c 7b 72 65 71 75 65 75 65 3a 65 2c 73 65 6e 64 3a 53 2c 73 65 6e 74 3a 78 2c 64 72 6f 70 3a 4e 2c 72 73 70 46 61 69 6c 3a 44 2c 6f 74 68 3a 41 7d 29 2c 74 28 29 2c 46 5b 34 5d 3d 7b 62 61 74 63 68 65 73 3a 5b 5d 2c 69 4b 65 79 4d 61 70 3a 7b 7d 7d 2c 46 5b 33 5d 3d 7b 62 61 74 63 68 65 73 3a 5b 5d 2c 69 4b 65 79 4d 61 70 3a 7b Data Ascii: (){re=!1,ae=!(ie=[]),R=1e4,ue={},se=Yp,ee=!(F={}),q=B=V=U=ce=oe=0,z=-1,K=!(W=!(j=L=M=P=k=null)),G=6,te=J=null,ne=!(X=2),Q=Pv(),H=new Bv(O=500,2,1,{requeue:e,send:S,sent:x,drop:N,rspFail:D,oth:A}),t(),F[4]={batches:[],iKeyMap:{}},F[3]={batches:[],iKeyMap:{

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.8	49727	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-07-25 07:47:57 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-07-25 07:47:57 UTC	514	IN	HTTP/1.1 200 OK ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=30117 Date: Thu, 25 Jul 2024 07:47:57 GMT Content-Length: 55 Connection: close X-CID: 2
2024-07-25 07:47:57 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.8	49730	13.107.253.42	443	7900	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-25 07:47:57 UTC	373	OUT	GET /mscc/lib/v2/wcp-consent.js HTTP/1.1 Host: wcpstatic.microsoft.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-07-25 07:47:57 UTC	712	IN	HTTP/1.1 200 OK Date: Thu, 25 Jul 2024 07:47:57 GMT Content-Type: application/javascript Content-Length: 52717 Connection: close Access-Control-Allow-Origin: * Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding Age: 2547 Cache-Control: max-age=43200 Content-MD5: QT/MdZzBmCG2G2lBgIsptQ== Etag: 0x8DA85F6F74C6D08 Last-Modified: Wed, 24 Aug 2022 17:34:58 GMT Vary: Accept-Encoding X-Cache: CONFIG_NOCACHE x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: c453384c-901e-000b-3e61-de3bb4000000 x-ms-version: 2009-09-19 x-azure-ref: 20240725T074757Z-17f67b96dd596c6lr12h41fu5n00000000900000000023ty Accept-Ranges: bytes
2024-07-25 07:47:57 UTC	16383	IN	Data Raw: 76 61 72 20 57 63 70 43 6f 6e 73 65 6e 74 3b 21 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 65 3d 7b 32 32 39 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 77 69 6e 64 6f 77 2c 65 2e 65 78 70 6f 72 74 73 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 7b 7d 3b 66 75 6e 63 74 69 6f 6e 20 6f 28 6e 29 7b 69 66 28 74 5b 6e 5d 29 72 65 74 75 72 6e 20 74 5b 6e 5d 2e 65 78 70 6f 72 74 73 3b 76 61 72 20 72 3d 74 5b 6e 5d 3d 7b 69 3a 6e 2c 6c 3a 21 31 2c 65 78 70 6f 72 74 73 3a 7b 7d 7d 3b 72 65 74 75 72 6e 20 65 5b 6e 5d 2e 63 61 6c 6c 28 72 2e 65 78 70 6f 72 74 73 2c 72 2c 72 2e 65 78 70 6f 72 74 73 2c 6f 29 2c 72 2e 6c 3d 21 30 2c 72 2e 65 78 70 6f 72 74 73 7d 72 65 74 75 72 6e 20 6f 2e 6d 3d 65 2c 6f 2e 63 3d 74 2c 6f 2e 64 3d 66 75 6e 63 74 69 6f 6e 28 65 Data Ascii: var WcpConsent;!function(){var e={229:function(e){window,e.exports=function(e){var t={};function o(n){if(t[n])return t[n].exports;var r=t[n]={i:n,l:!1,exports:{}};return e[n].call(r.exports,r,r.exports,o),r.l=!0,r.exports}return o.m=e,o.c=t,o.d=function(e
2024-07-25 07:47:57 UTC	16383	IN	Data Raw: 61 2d 6c 61 62 65 6c 3d 22 27 2b 69 2e 65 73 63 61 70 65 48 74 6d 6c 28 74 68 69 73 2e 74 65 78 74 52 65 73 6f 75 72 63 65 73 2e 70 72 65 66 65 72 65 6e 63 65 73 44 69 61 6c 6f 67 43 6c 6f 73 65 4c 61 62 65 6c 29 2b 27 22 20 63 6c 61 73 73 3d 22 27 2b 61 2e 63 6c 6f 73 65 4d 6f 64 61 6c 49 63 6f 6e 2b 27 22 20 74 61 62 69 6e 64 65 78 3d 22 30 22 3e 26 23 78 32 37 31 35 3b 3c 2f 62 75 74 74 6f 6e 3e 5c 6e 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 72 6f 6c 65 3d 22 64 6f 63 75 6d 65 6e 74 22 20 63 6c 61 73 73 3d 22 27 2b 61 2e 6d 6f 64 61 6c 42 6f 64 79 2b 27 22 3e 5c 6e 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 3e 5c 6e 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 68 31 20 63 6c 61 73 73 3d 22 27 2b 61 2e 6d 6f Data Ascii: a-label="'+i.escapeHtml(this.textResources.preferencesDialogCloseLabel)+'" class="'+a.closeModalIcon+'" tabindex="0">✕</button>\n <div role="document" class="'+a.modalBody+'">\n <div>\n <h1 class="'+a.mo
2024-07-25 07:47:57 UTC	16383	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 22 2b 65 5b 22 72 61 64 69 6f 2d 62 75 74 74 6f 6e 2d 64 69 73 61 62 6c 65 64 2d 63 6f 6c 6f 72 22 5d 2b 22 20 21 69 6d 70 6f 72 74 61 6e 74 3b 5c 6e 20 20 20 20 20 20 20 20 7d 22 7d 2c 65 7d 28 29 2c 64 3d 5b 22 61 72 22 2c 22 68 65 22 2c 22 70 73 22 2c 22 75 72 22 2c 22 66 61 22 2c 22 70 61 22 2c 22 73 64 22 2c 22 74 6b 22 2c 22 75 67 22 2c 22 79 69 22 2c 22 73 79 72 22 2c 22 6b 73 2d 61 72 61 62 22 5d 2c 75 3d 7b 22 63 6c 6f 73 65 2d 62 75 74 74 6f 6e 2d 63 6f 6c 6f 72 22 3a 22 23 36 36 36 36 36 36 22 2c 22 73 65 63 6f 6e 64 61 72 79 2d 62 75 74 74 6f 6e 2d 64 69 73 61 62 6c 65 64 2d 6f 70 61 63 69 74 79 22 3a 22 31 22 2c 22 73 65 63 6f 6e 64 61 72 79 2d 62 75 74 74 6f Data Ascii: background-color: "+e["radio-button-disabled-color"]+" !important;\n }"},e}(),d=["ar","he","ps","ur","fa","pa","sd","tk","ug","yi","syr","ks-arab"],u={"close-button-color":"#666666","secondary-button-disabled-opacity":"1","secondary-butto
2024-07-25 07:47:57 UTC	3568	IN	Data Raw: 74 28 22 2d 22 29 5b 30 5d 3b 6f 3d 65 2e 73 70 6c 69 74 28 22 2d 22 29 5b 30 5d 3d 3d 3d 6e 7d 72 65 74 75 72 6e 20 6f 7d 28 65 2c 63 29 7d 29 29 3b 73 26 26 30 3d 3d 3d 73 2e 6c 65 6e 67 74 68 26 26 28 65 3d 22 65 6e 2d 55 53 22 29 2c 6f 2e 70 6c 61 63 65 68 6f 6c 64 65 72 45 6c 65 6d 65 6e 74 3d 6c 2c 72 26 26 6f 2e 63 6f 6e 73 65 6e 74 43 68 61 6e 67 65 64 43 61 6c 6c 62 61 63 6b 73 2e 72 65 67 69 73 74 65 72 43 61 6c 6c 62 61 63 6b 28 72 29 2c 6f 2e 73 61 76 65 43 6f 6f 6b 69 65 28 29 2c 6f 2e 73 69 74 65 43 6f 6e 73 65 6e 74 3d 6e 65 77 20 66 28 21 31 29 2c 6e 75 6c 6c 3d 3d 6e 7c 7c 6e 28 76 6f 69 64 20 30 2c 6f 2e 73 69 74 65 43 6f 6e 73 65 6e 74 29 2c 6f 2e 69 73 49 6e 69 74 52 65 61 64 79 3d 21 30 2c 74 68 69 73 2e 63 6f 6e 73 65 6e 74 43 68 61 Data Ascii: t("-")[0];o=e.split("-")[0]===n}return o}(e,c)}));s&&0===s.length&&(e="en-US"),o.placeholderElement=l,r&&o.consentChangedCallbacks.registerCallback(r),o.saveCookie(),o.siteConsent=new f(!1),null==n\|\|n(void 0,o.siteConsent),o.isInitReady=!0,this.consentCha

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.8	49732	13.107.253.45	443	7900	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-25 07:47:57 UTC	370	OUT	GET /scripts/c/ms.jsll-4.min.js HTTP/1.1 Host: js.monitor.azure.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-07-25 07:47:57 UTC	958	IN	HTTP/1.1 200 OK Date: Thu, 25 Jul 2024 07:47:57 GMT Content-Type: text/javascript; charset=utf-8 Content-Length: 206998 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: no-transform, public, max-age=1800, immutable Last-Modified: Mon, 15 Jul 2024 17:38:35 GMT ETag: 0x8DCA4F4F47351DF x-ms-request-id: 4420ba21-201e-00a7-39f9-dd281d000000 x-ms-version: 2009-09-19 x-ms-meta-jssdkver: 4.3.0 x-ms-meta-jssdksrc: [cdn]/scripts/c/ms.jsll-4.3.0.min.js Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,x-ms-meta-jssdkver,x-ms-meta-jssdksrc,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240725T074757Z-17959f84c76zxlx62n2suheptw00000001a0000000002but x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-07-25 07:47:57 UTC	15426	IN	Data Raw: 2f 2a 21 0a 20 2a 20 31 44 53 20 4a 53 4c 4c 20 53 4b 55 2c 20 34 2e 33 2e 30 0a 20 2a 20 43 6f 70 79 72 69 67 68 74 20 28 63 29 20 4d 69 63 72 6f 73 6f 66 74 20 61 6e 64 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 2e 20 41 6c 6c 20 72 69 67 68 74 73 20 72 65 73 65 72 76 65 64 2e 0a 20 2a 20 28 4d 69 63 72 6f 73 6f 66 74 20 49 6e 74 65 72 6e 61 6c 20 4f 6e 6c 79 29 0a 20 2a 2f 0a 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 76 61 72 20 6e 3d 22 75 6e 64 65 66 69 6e 65 64 22 3b 69 66 28 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 65 78 70 6f 72 74 73 26 26 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 21 3d 6e 29 74 28 65 78 70 6f 72 74 73 29 3b 65 6c 73 65 20 69 66 28 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 64 65 66 69 6e 65 26 26 64 65 66 69 Data Ascii: /! 1DS JSLL SKU, 4.3.0 * Copyright (c) Microsoft and contributors. All rights reserved. * (Microsoft Internal Only) */!function(e,t){var n="undefined";if("object"==typeof exports&&typeof module!=n)t(exports);else if("function"==typeof define&&defi
2024-07-25 07:47:57 UTC	16384	IN	Data Raw: 66 65 28 22 63 6f 6e 73 6f 6c 65 22 29 29 26 26 28 72 2e 65 72 72 6f 72 7c 7c 72 2e 6c 6f 67 29 28 74 2c 61 65 28 69 29 29 29 29 7d 78 65 28 61 3d 7b 74 68 65 6e 3a 6f 2c 22 63 61 74 63 68 22 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 6f 28 75 6e 64 65 66 69 6e 65 64 2c 65 29 7d 2c 22 66 69 6e 61 6c 6c 79 22 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 61 72 20 65 3d 74 2c 6e 3d 74 3b 72 65 74 75 72 6e 20 51 28 74 29 26 26 28 65 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 74 26 26 74 28 29 2c 65 7d 2c 6e 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 74 68 72 6f 77 20 74 26 26 74 28 29 2c 65 7d 29 2c 6f 28 65 2c 6e 29 7d 7d 2c 22 73 74 61 74 65 22 2c 7b 67 65 74 3a 64 7d 29 2c 6d 74 28 29 26 26 28 61 5b 79 74 28 31 31 29 5d 3d 22 49 Data Ascii: fe("console"))&&(r.error\|\|r.log)(t,ae(i))))}xe(a={then:o,"catch":function(e){return o(undefined,e)},"finally":function(t){var e=t,n=t;return Q(t)&&(e=function(e){return t&&t(),e},n=function(e){throw t&&t(),e}),o(e,n)}},"state",{get:d}),mt()&&(a[yt(11)]="I
2024-07-25 07:47:57 UTC	16384	IN	Data Raw: 2c 6e 2e 68 3d 6e 2e 68 7c 7c 72 6e 28 73 63 2c 30 2c 6e 29 29 3a 4c 28 72 2c 5b 65 5d 29 29 7d 29 7d 64 63 2e 5f 5f 69 65 44 79 6e 3d 31 3b 76 61 72 20 66 63 3d 64 63 3b 66 75 6e 63 74 69 6f 6e 20 64 63 28 65 29 7b 74 68 69 73 2e 6c 69 73 74 65 6e 65 72 73 3d 5b 5d 3b 76 61 72 20 6e 2c 69 3d 5b 5d 2c 61 3d 7b 68 3a 6e 75 6c 6c 2c 63 62 3a 5b 5d 7d 2c 6f 3d 6c 6f 28 65 2c 75 63 29 5b 47 6e 5d 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 6e 3d 21 21 65 2e 63 66 67 2e 70 65 72 66 45 76 74 73 53 65 6e 64 41 6c 6c 7d 29 3b 76 65 28 64 63 2c 74 68 69 73 2c 66 75 6e 63 74 69 6f 6e 28 65 29 7b 59 28 65 2c 22 6c 69 73 74 65 6e 65 72 73 22 2c 7b 67 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 69 7d 7d 29 2c 65 5b 74 72 5d 3d 66 75 6e 63 74 69 6f 6e 28 65 29 Data Ascii: ,n.h=n.h\|\|rn(sc,0,n)):L(r,[e]))})}dc.__ieDyn=1;var fc=dc;function dc(e){this.listeners=[];var n,i=[],a={h:null,cb:[]},o=lo(e,uc)[Gn](function(e){n=!!e.cfg.perfEvtsSendAll});ve(dc,this,function(e){Y(e,"listeners",{g:function(){return i}}),e[tr]=function(e)
2024-07-25 07:47:57 UTC	16384	IN	Data Raw: 28 61 29 7d 2c 36 2c 6e 29 2c 69 7d 2c 66 5b 63 72 5d 3d 73 2c 66 2e 61 64 64 50 6c 75 67 69 6e 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 2c 72 29 7b 69 66 28 21 65 29 72 65 74 75 72 6e 20 72 26 26 72 28 21 31 29 2c 76 6f 69 64 20 43 28 6e 75 29 3b 76 61 72 20 69 3d 73 28 65 5b 5a 6e 5d 29 3b 69 66 28 69 26 26 21 74 29 72 65 74 75 72 6e 20 72 26 26 72 28 21 31 29 2c 76 6f 69 64 20 43 28 22 50 6c 75 67 69 6e 20 5b 22 2b 65 5b 5a 6e 5d 2b 22 5d 20 69 73 20 61 6c 72 65 61 64 79 20 6c 6f 61 64 65 64 21 22 29 3b 76 61 72 20 61 2c 6f 3d 7b 72 65 61 73 6f 6e 3a 31 36 7d 3b 66 75 6e 63 74 69 6f 6e 20 63 28 29 7b 41 5b 74 65 5d 28 65 29 2c 6f 2e 61 64 64 65 64 3d 5b 65 5d 2c 67 28 6f 29 2c 72 26 26 72 28 21 30 29 7d 69 3f 76 28 61 3d 5b 69 2e 70 6c 75 67 69 6e Data Ascii: (a)},6,n),i},f[cr]=s,f.addPlugin=function(e,t,n,r){if(!e)return r&&r(!1),void C(nu);var i=s(e[Zn]);if(i&&!t)return r&&r(!1),void C("Plugin ["+e[Zn]+"] is already loaded!");var a,o={reason:16};function c(){A[te](e),o.added=[e],g(o),r&&r(!0)}i?v(a=[i.plugin
2024-07-25 07:47:57 UTC	16384	IN	Data Raw: 73 5d 28 29 2c 6e 3d 66 65 28 65 3d 3d 3d 43 6c 2e 4c 6f 63 61 6c 53 74 6f 72 61 67 65 3f 22 6c 6f 63 61 6c 53 74 6f 72 61 67 65 22 3a 22 73 65 73 73 69 6f 6e 53 74 6f 72 61 67 65 22 29 2c 72 3d 54 6c 2b 74 2c 69 3d 28 6e 2e 73 65 74 49 74 65 6d 28 72 2c 74 29 2c 6e 2e 67 65 74 49 74 65 6d 28 72 29 21 3d 3d 74 29 3b 69 66 28 6e 5b 77 73 5d 28 72 29 2c 21 69 29 72 65 74 75 72 6e 20 6e 7d 63 61 74 63 68 28 61 29 7b 7d 72 65 74 75 72 6e 20 6e 75 6c 6c 7d 66 75 6e 63 74 69 6f 6e 20 45 6c 28 29 7b 72 65 74 75 72 6e 20 5f 6c 28 29 3f 49 6c 28 43 6c 2e 53 65 73 73 69 6f 6e 53 74 6f 72 61 67 65 29 3a 6e 75 6c 6c 7d 66 75 6e 63 74 69 6f 6e 20 5f 6c 28 65 29 7b 72 65 74 75 72 6e 20 62 6c 3d 65 7c 7c 62 6c 3d 3d 3d 75 6e 64 65 66 69 6e 65 64 3f 21 21 49 6c 28 43 6c Data Ascii: s](),n=fe(e===Cl.LocalStorage?"localStorage":"sessionStorage"),r=Tl+t,i=(n.setItem(r,t),n.getItem(r)!==t);if(n[ws](r),!i)return n}catch(a){}return null}function El(){return _l()?Il(Cl.SessionStorage):null}function _l(e){return bl=e\|\|bl===undefined?!!Il(Cl
2024-07-25 07:47:58 UTC	16384	IN	Data Raw: 72 6e 20 6f 7d 7d 29 2c 59 28 65 2c 22 70 61 67 65 56 69 73 69 74 54 69 6d 65 54 72 61 63 6b 69 6e 67 48 61 6e 64 6c 65 72 22 2c 7b 67 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 63 7d 7d 29 7d 29 7d 76 61 72 20 45 64 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 74 68 69 73 5b 6c 64 5d 3d 4f 74 28 29 2c 74 68 69 73 2e 70 61 67 65 4e 61 6d 65 3d 65 2c 74 68 69 73 2e 70 61 67 65 55 72 6c 3d 74 7d 2c 5f 64 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 65 29 7b 76 61 72 20 6f 3d 74 68 69 73 2c 63 3d 7b 7d 3b 6f 2e 73 74 61 72 74 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 63 5b 65 5d 26 26 6d 65 28 61 2c 32 2c 36 32 2c 22 73 74 61 72 74 20 77 61 73 20 63 61 6c 6c 65 64 20 6d 6f 72 65 20 74 68 61 6e 20 Data Ascii: rn o}}),Y(e,"pageVisitTimeTrackingHandler",{g:function(){return c}})})}var Ed=function(e,t){this[ld]=Ot(),this.pageName=e,this.pageUrl=t},_d=function(a,e){var o=this,c={};o.start=function(e){"undefined"!=typeof c[e]&&me(a,2,62,"start was called more than
2024-07-25 07:47:58 UTC	16384	IN	Data Raw: 61 67 73 3d 6d 73 28 21 30 2c 6e 2e 5f 70 61 67 65 54 61 67 73 2c 74 2e 70 61 67 65 54 61 67 73 29 29 2c 65 2e 70 72 6f 70 65 72 74 69 65 73 3d 65 2e 70 72 6f 70 65 72 74 69 65 73 7c 7c 7b 7d 2c 65 2e 70 72 6f 70 65 72 74 69 65 73 2e 70 61 67 65 54 61 67 73 3d 6e 2e 5f 70 61 67 65 54 61 67 73 7d 2c 65 70 2e 70 72 6f 74 6f 74 79 70 65 2e 5f 67 65 74 42 65 68 61 76 69 6f 72 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3b 72 65 74 75 72 6e 20 65 26 26 63 65 28 65 2e 62 65 68 61 76 69 6f 72 29 3f 74 3d 65 2e 62 65 68 61 76 69 6f 72 3a 63 65 28 74 68 69 73 2e 5f 62 65 68 61 76 69 6f 72 4d 65 74 61 54 61 67 29 26 26 28 74 3d 74 68 69 73 2e 5f 62 65 68 61 76 69 6f 72 4d 65 74 61 54 61 67 29 2c 74 68 69 73 2e 5f 67 65 74 56 61 6c 69 64 42 65 68 61 76 69 Data Ascii: ags=ms(!0,n._pageTags,t.pageTags)),e.properties=e.properties\|\|{},e.properties.pageTags=n._pageTags},ep.prototype._getBehavior=function(e){var t;return e&&ce(e.behavior)?t=e.behavior:ce(this._behaviorMetaTag)&&(t=this._behaviorMetaTag),this._getValidBehavi
2024-07-25 07:47:58 UTC	16384	IN	Data Raw: 6d 65 73 2e 63 6f 6e 74 65 6e 74 4e 61 6d 65 29 3b 72 26 26 28 61 5b 74 5d 3d 72 29 2c 69 26 26 28 61 5b 6e 5d 3d 69 29 7d 72 65 74 75 72 6e 20 61 7d 2c 53 70 29 3b 66 75 6e 63 74 69 6f 6e 20 53 70 28 65 2c 74 29 7b 74 68 69 73 2e 5f 63 6f 6e 66 69 67 3d 65 2c 74 68 69 73 2e 5f 74 72 61 63 65 4c 6f 67 67 65 72 3d 74 2c 74 68 69 73 2e 5f 63 6f 6e 74 65 6e 74 42 6c 6f 62 46 69 65 6c 64 4e 61 6d 65 73 3d 6e 75 6c 6c 2c 74 68 69 73 2e 5f 63 6f 6e 74 65 6e 74 42 6c 6f 62 46 69 65 6c 64 4e 61 6d 65 73 3d 21 30 3d 3d 3d 74 68 69 73 2e 5f 63 6f 6e 66 69 67 2e 75 73 65 53 68 6f 72 74 4e 61 6d 65 46 6f 72 43 6f 6e 74 65 6e 74 42 6c 6f 62 3f 54 70 2e 73 68 6f 72 74 4e 61 6d 65 73 3a 54 70 2e 6c 6f 6e 67 4e 61 6d 65 73 7d 76 61 72 20 78 70 2c 4e 70 3d 48 65 28 7b 75 Data Ascii: mes.contentName);r&&(a[t]=r),i&&(a[n]=i)}return a},Sp);function Sp(e,t){this._config=e,this._traceLogger=t,this._contentBlobFieldNames=null,this._contentBlobFieldNames=!0===this._config.useShortNameForContentBlob?Tp.shortNames:Tp.longNames}var xp,Np=He({u
2024-07-25 07:47:58 UTC	16384	IN	Data Raw: 67 3d 22 73 65 6e 64 54 79 70 65 22 2c 4b 67 3d 22 61 64 64 48 65 61 64 65 72 22 2c 47 67 3d 22 63 61 6e 53 65 6e 64 52 65 71 75 65 73 74 22 2c 58 67 3d 22 73 65 6e 64 51 75 65 75 65 64 52 65 71 75 65 73 74 73 22 2c 4a 67 3d 22 69 73 43 6f 6d 70 6c 65 74 65 6c 79 49 64 6c 65 22 2c 51 67 3d 22 73 65 74 55 6e 6c 6f 61 64 69 6e 67 22 2c 59 67 3d 22 73 65 6e 64 53 79 6e 63 68 72 6f 6e 6f 75 73 42 61 74 63 68 22 2c 24 67 3d 22 5f 74 72 61 6e 73 70 6f 72 74 22 2c 5a 67 3d 22 67 65 74 57 50 61 72 61 6d 22 2c 65 76 3d 22 69 73 42 65 61 63 6f 6e 22 2c 74 76 3d 22 74 69 6d 69 6e 67 73 22 2c 6e 76 3d 22 69 73 54 65 61 72 64 6f 77 6e 22 2c 72 76 3d 22 69 73 53 79 6e 63 22 2c 69 76 3d 22 64 61 74 61 22 2c 61 76 3d 22 5f 73 65 6e 64 52 65 61 73 6f 6e 22 2c 6f 76 3d 22 Data Ascii: g="sendType",Kg="addHeader",Gg="canSendRequest",Xg="sendQueuedRequests",Jg="isCompletelyIdle",Qg="setUnloading",Yg="sendSynchronousBatch",$g="_transport",Zg="getWParam",ev="isBeacon",tv="timings",nv="isTeardown",rv="isSync",iv="data",av="_sendReason",ov="
2024-07-25 07:47:58 UTC	16384	IN	Data Raw: 28 29 7b 72 65 3d 21 31 2c 61 65 3d 21 28 69 65 3d 5b 5d 29 2c 52 3d 31 65 34 2c 75 65 3d 7b 7d 2c 73 65 3d 59 70 2c 65 65 3d 21 28 46 3d 7b 7d 29 2c 71 3d 42 3d 56 3d 55 3d 63 65 3d 6f 65 3d 30 2c 7a 3d 2d 31 2c 4b 3d 21 28 57 3d 21 28 6a 3d 4c 3d 4d 3d 50 3d 6b 3d 6e 75 6c 6c 29 29 2c 47 3d 36 2c 74 65 3d 4a 3d 6e 75 6c 6c 2c 6e 65 3d 21 28 58 3d 32 29 2c 51 3d 50 76 28 29 2c 48 3d 6e 65 77 20 42 76 28 4f 3d 35 30 30 2c 32 2c 31 2c 7b 72 65 71 75 65 75 65 3a 65 2c 73 65 6e 64 3a 53 2c 73 65 6e 74 3a 78 2c 64 72 6f 70 3a 4e 2c 72 73 70 46 61 69 6c 3a 44 2c 6f 74 68 3a 41 7d 29 2c 74 28 29 2c 46 5b 34 5d 3d 7b 62 61 74 63 68 65 73 3a 5b 5d 2c 69 4b 65 79 4d 61 70 3a 7b 7d 7d 2c 46 5b 33 5d 3d 7b 62 61 74 63 68 65 73 3a 5b 5d 2c 69 4b 65 79 4d 61 70 3a 7b Data Ascii: (){re=!1,ae=!(ie=[]),R=1e4,ue={},se=Yp,ee=!(F={}),q=B=V=U=ce=oe=0,z=-1,K=!(W=!(j=L=M=P=k=null)),G=6,te=J=null,ne=!(X=2),Q=Pv(),H=new Bv(O=500,2,1,{requeue:e,send:S,sent:x,drop:N,rspFail:D,oth:A}),t(),F[4]={batches:[],iKeyMap:{}},F[3]={batches:[],iKeyMap:{

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.8	49760	40.68.123.157	443

Timestamp	Bytes transferred	Direction	Data
2024-07-25 07:48:02 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=3FgPvgo5hwHzvrg&MD=TArSOtKe HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-07-25 07:48:02 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: c4fca711-93f5-43d6-8e2f-86ac24331bd8 MS-RequestId: db48bc4a-9347-43c9-8dbc-cd4f69fa700f MS-CV: dL4sqJFhak6tWW45.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Thu, 25 Jul 2024 07:48:02 GMT Connection: close Content-Length: 24490
2024-07-25 07:48:02 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-07-25 07:48:02 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.8	60450	20.12.23.50	443

Timestamp	Bytes transferred	Direction	Data
2024-07-25 07:48:40 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=3FgPvgo5hwHzvrg&MD=TArSOtKe HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-07-25 07:48:40 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "vic+p1MiJJ+/WMnK08jaWnCBGDfvkGRzPk9f8ZadQHg=_1440" MS-CorrelationId: b861d6b6-eb7f-47c4-af0d-7a118f1f7607 MS-RequestId: 522fd455-32be-4b7c-b77a-5d4d555a25c9 MS-CV: tKs1MwM6oUOjaagP.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Thu, 25 Jul 2024 07:48:39 GMT Connection: close Content-Length: 30005
2024-07-25 07:48:40 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 8d 2b 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 5b 49 00 00 14 00 00 00 00 00 10 00 8d 2b 00 00 a8 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 72 4d 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 fe f6 51 be 21 2b 72 4d 43 4b ed 7c 05 58 54 eb da f6 14 43 49 37 0a 02 d2 b9 86 0e 41 52 a4 1b 24 a5 bb 43 24 44 18 94 90 92 52 41 3a 05 09 95 ee 54 b0 00 91 2e e9 12 10 04 11 c9 6f 10 b7 a2 67 9f bd cf 3e ff b7 ff b3 bf 73 ed e1 9a 99 f5 c6 7a d7 bb de f5 3e cf fd 3c f7 dc 17 4a 1a 52 e7 41 a8 97 1e 14 f4 e5 25 7d f4 05 82 82 c1 20 30 08 06 ba c3 05 02 11 7f a9 c1 ff d2 87 5c 1e f4 ed 65 8e 7a 1f f6 0a 40 03 1d 7b f9 83 2c 1c 2f db b8 3a 39 3a 58 38 ba 73 5e Data Ascii: MSCF+D[I+IdrMenvironment.cabQ!+rMCK\|XTCI7AR$C$DRA:T.og>sz><JRA%} 0\ez@{,/:9:X8s^
2024-07-25 07:48:40 UTC	14181	IN	Data Raw: 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 26 30 24 06 03 55 04 03 13 1d 4d 69 63 72 6f 73 6f 66 74 20 54 69 6d 65 2d 53 74 61 6d 70 20 50 43 41 20 32 30 31 30 30 1e 17 0d 32 33 31 30 31 32 31 39 30 37 32 35 5a 17 0d 32 35 30 31 31 30 31 39 30 37 32 35 5a 30 81 d2 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 2d 30 2b 06 03 55 04 0b 13 24 4d 69 63 72 6f Data Ascii: UUS10UWashington10URedmond10UMicrosoft Corporation1&0$UMicrosoft Time-Stamp PCA 20100231012190725Z250110190725Z010UUS10UWashington10URedmond10UMicrosoft Corporation1-0+U$Micro

Target ID:	0
Start time:	03:47:41
Start date:	25/07/2024
Path:	C:\Users\user\Desktop\LisectAVT_2403002C_142.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\LisectAVT_2403002C_142.exe"
Imagebase:	0x20000
File size:	112'128 bytes
MD5 hash:	01DA9EA1CC55C02A1755B20A4EC69F05
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Njrat, Description: Yara detected Njrat, Source: 00000000.00000000.1379310040.0000000000022000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: Windows_Trojan_Njrat_30f3c220, Description: unknown, Source: 00000000.00000000.1379310040.0000000000022000.00000002.00000001.01000000.00000003.sdmp, Author: unknown Rule: Njrat, Description: detect njRAT in memory, Source: 00000000.00000000.1379310040.0000000000022000.00000002.00000001.01000000.00000003.sdmp, Author: JPCERT/CC Incident Response Group
Reputation:	low
Has exited:	true

Target ID:	3
Start time:	03:47:47
Start date:	25/07/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=LisectAVT_2403002C_142.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Imagebase:	0x7ff678760000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Target ID:	5
Start time:	03:47:48
Start date:	25/07/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 --field-trial-handle=1904,i,3045040594546194306,8046493471930814901,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff678760000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Target ID:	6
Start time:	03:47:57
Start date:	25/07/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=LisectAVT_2403002C_142.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Imagebase:	0x7ff678760000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	7
Start time:	03:47:58
Start date:	25/07/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2128 --field-trial-handle=1888,i,6999489819283979014,13540749176578719827,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff678760000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true