Edit tour

Windows Analysis Report
Renewal.exe

Overview

General Information

Sample name:	Renewal.exe
Analysis ID:	1370152
MD5:	e7457fc1fecac4151a1d49b54cf3acd5
SHA1:	cca952ab905f83550a9d4b2cafec99b4e6e2bb17
SHA256:	ccc064b8982473125fd5e30f787d621bd682ffdaa7a6dc5e515a1120bb4c1250
Infos:

Detection

Score:	3
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

Stores files to the Windows start menu directory

Uses 32bit PE files

Uses insecure TLS / SSL version for HTTPS connection

Classification

Process Tree

System is w10x64

Renewal.exe (PID: 4508 cmdline: C:\Users\user\Desktop\Renewal.exe MD5: E7457FC1FECAC4151A1D49B54CF3ACD5)

chrome.exe (PID: 3452 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=Renewal.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 4052 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2540 --field-trial-handle=2364,i,3433059245063578953,17793063878387418449,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 7468 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=Renewal.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 7728 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 --field-trial-handle=2028,i,5267686039598994631,3060138403470109992,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=Renewal.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	HTTP Parser: No favicon
Source: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=Renewal.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	HTTP Parser: No favicon
Source: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=Renewal.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	HTTP Parser: No favicon
Source: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=Renewal.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	HTTP Parser: No favicon

Source: Renewal.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 23.1.237.91:443 -> 192.168.2.5:49785 version: TLS 1.0

Source: unknown	HTTPS traffic detected: 23.1.244.180:443 -> 192.168.2.5:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.1.244.180:443 -> 192.168.2.5:49751 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.5:49776 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.5:49796 version: TLS 1.2

Source: Renewal.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: \Renewal\obj\Debug\Renewal.pdb4FNF @F_CorExeMainmscoree.dll source: Renewal.exe
Source:	Binary string: \Renewal\obj\Debug\Renewal.pdb source: Renewal.exe

Source: Joe Sandbox View	IP Address: 13.107.213.57 13.107.213.57
Source: Joe Sandbox View	IP Address: 239.255.255.250 239.255.255.250

Source: Joe Sandbox View	JA3 fingerprint: 1138de370e523e824bbca92d049a3777
Source: Joe Sandbox View	JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4

Source: unknown

HTTPS traffic detected: 23.1.237.91:443 -> 192.168.2.5:49785 version: TLS 1.0

Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.244.180
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.244.180
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.244.180
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.244.180
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.244.180
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.244.180
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.244.180
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.244.180
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.244.180
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.244.180
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.244.180
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.244.180
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.244.180
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.244.180
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.244.180
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.244.180
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.244.180
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.244.180
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.244.180
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50

Source: global traffic	HTTP traffic detected: GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=117.0.5938.132&lang=en-US&acceptformat=crx3,puff&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26brand%3DONGR%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1Host: clients2.google.comConnection: keep-aliveX-Goog-Update-Interactivity: fgX-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmiedaX-Goog-Update-Updater: chromecrx-117.0.5938.132Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /scripts/c/ms.jsll-3.min.js HTTP/1.1Host: js.monitor.azure.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://learn.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /mscc/lib/v2/wcp-consent.js HTTP/1.1Host: wcpstatic.microsoft.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://learn.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=bwRtW6N881YGmLR&MD=aOu5faNG HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=bwRtW6N881YGmLR&MD=aOu5faNG HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /tools/pso/ping?as=chrome&brand=ONGR&pid=&hl=en&events=C1I,C2I,C7I,C1S,C7S&rep=2&rlz=C1:,C2:,C7:&id=000000000000000000000000000000000000000040896C04EA HTTP/1.1Host: clients1.google.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, br

Source: chromecache_87.4.dr	String found in binary or memory: href="https://www.facebook.com/sharer/sharer.php?u=${l}" equals www.facebook.com (Facebook)
Source: chromecache_87.4.dr	String found in binary or memory: href="https://www.linkedin.com/cws/share?url=${l}" equals www.linkedin.com (Linkedin)
Source: chromecache_87.4.dr	String found in binary or memory: href="https://www.linkedin.com/cws/share?url=${encodeURIComponent(t)}&text=${encodeURIComponent(VC.replace("{credentialName}",e.title))}" equals www.linkedin.com (Linkedin)
Source: chromecache_87.4.dr	String found in binary or memory: </div>`,i};function n(s){if(s.parentElement?.classList.contains("is-active")){let i=s.getAttribute("id"),a=Number(s.dataset.totalItems),l=e.querySelector(".card-footer");t?.setAttribute("id",`${i}-card-content-container`);let c=Array.from(e.querySelectorAll(".is-expanded"));c.length!==0&&c.forEach(u=>u.classList.remove("is-expanded")),a>3?l\|\|t?.parentNode?.insertBefore(r(i\|\|""),t?.nextSibling):l&&l.remove()}}o.forEach(s=>{n(s),new MutationObserver(()=>{n(s)}).observe(s,{attributes:!0,attributeFilter:["aria-selected","tabindex"]})})}var e3e;function t3e(){let e=document.getElementById("share-to-linkedin-profile");e&&e.addEventListener("click",t=>{let o=t.currentTarget,r=JSON.parse(o.dataset.credential),n=document.createElement("div"),s=Zpt(r);x(s,n),e3e=new ge(n),e3e.show();let i=document.getElementById("share-to-feed-button"),a=document.getElementById("linkedin-feed-message"),l=new URL(decodeURI(i.getAttribute("href")));a.onchange=()=>{l.searchParams.set("text",a.value),i.setAttribute("href",l.toString())}})}function Zpt(e){let t=encodeURI(`https://${location.host}/api/credentials/share/${h.data.userLocale}/${S.userName}/${e?.credentialId}?sharingId=${S.sharingId}`),o=1035,r=i=>new Date(i).getFullYear(),n=i=>new Date(i).getMonth()+1,s=encodeURI(`https://www.linkedin.com/profile/add?startTask=CERTIFICATION_NAME&name=${e.title}&organizationId=${o}&issueYear=${r(e.awardedOn)}&issueMonth=${n(e.awardedOn)}&expirationYear=${e.expiresOn?r(e.expiresOn):""}&expirationMonth=${e.expiresOn?n(e.expiresOn):""}&certUrl=${t}&certId=${e.credentialId}&skills=${e.skills?`${e.skills.map(i=>encodeURIComponent(i)).join(",")}`:""}`);return d` equals www.linkedin.com (Linkedin)
Source: chromecache_87.4.dr	String found in binary or memory: `};function Uet(e){let t=Array.from(e.querySelectorAll('iframe[src^="https://channel9.msdn.com/"]'));t.length&&t.forEach(o=>{let r=o.src.split("/"),n=r[r.length-2],s=`${w$}: ${n}`;o.title=o.title\|\|s})}function zet(e){let t=Array.from(e.querySelectorAll('iframe[src^="https://www.youtube"]'));t.length&&t.forEach(o=>{let r=o.src.split("/").pop(),n=`${w$}: ${r}`;o.title=o.title\|\|n})}function Het(e){let t=[],o=[];window.addEventListener("beforeprint",()=>{Array.from(e.querySelectorAll(".embeddedvideo iframe")).forEach(n=>{if(n.offsetParent!==null){let s=n.src,i=document.createElement("a");i.href=s,i.target="_blank",i.text=s,n.parentElement.appendChild(i),n.hidden=!0,t.push(n),o.push(i)}})}),window.addEventListener("afterprint",()=>{t.forEach(r=>r.hidden=!1),o.forEach(r=>r.remove()),t=[],o=[]})}var Bet=e=>{let t=new URL(e);return t.protocol="https",t.host.localeCompare("channel9.msdn.com",void 0,{sensitivity:"base"})===0?t.searchParams.set("nocookie","true"):(t.host.localeCompare("youtube.com",void 0,{sensitivity:"base"})===0\|\|t.host.localeCompare("www.youtube.com",void 0,{sensitivity:"base"})===0)&&(t.host="www.youtube-nocookie.com"),t.href};function YR(e){zet(e),Uet(e),Het(e)}var J$e=(e,t)=>{let o=t\|\|Mu;return d`<div class="embeddedvideo"> equals www.youtube.com (Youtube)
Source: chromecache_87.4.dr	String found in binary or memory: `)}`,y=encodeURIComponent(`https://${W.host}/api/achievements/share/${h.data.userLocale}/${S.userName}/${m.id}?sharingId=${S.sharingId}`),v=f==="badge"?"MSLearnBadge":f==="trophy"?"MSLearnTrophy":"";return{linkedIn:{href:`https://www.linkedin.com/feed/?shareUrl=${y}&shareActive=true&text=${b}`},email:{href:`mailto:?subject=${_}&body=${b}${y}`},twitter:{href:`https://twitter.com/share?url=${y}&text=${b}&hashtags=${v}`},facebook:{href:`https://www.facebook.com/sharer/sharer.php?u=${y}&quote=${b}&hashtag=${v}`},copy:{href:y}}}let p=d` equals www.facebook.com (Facebook)
Source: chromecache_87.4.dr	String found in binary or memory: `)}`,y=encodeURIComponent(`https://${W.host}/api/achievements/share/${h.data.userLocale}/${S.userName}/${m.id}?sharingId=${S.sharingId}`),v=f==="badge"?"MSLearnBadge":f==="trophy"?"MSLearnTrophy":"";return{linkedIn:{href:`https://www.linkedin.com/feed/?shareUrl=${y}&shareActive=true&text=${b}`},email:{href:`mailto:?subject=${_}&body=${b}${y}`},twitter:{href:`https://twitter.com/share?url=${y}&text=${b}&hashtags=${v}`},facebook:{href:`https://www.facebook.com/sharer/sharer.php?u=${y}&quote=${b}&hashtag=${v}`},copy:{href:y}}}let p=d` equals www.linkedin.com (Linkedin)
Source: chromecache_87.4.dr	String found in binary or memory: `)}`,y=encodeURIComponent(`https://${W.host}/api/achievements/share/${h.data.userLocale}/${S.userName}/${m.id}?sharingId=${S.sharingId}`),v=f==="badge"?"MSLearnBadge":f==="trophy"?"MSLearnTrophy":"";return{linkedIn:{href:`https://www.linkedin.com/feed/?shareUrl=${y}&shareActive=true&text=${b}`},email:{href:`mailto:?subject=${_}&body=${b}${y}`},twitter:{href:`https://twitter.com/share?url=${y}&text=${b}&hashtags=${v}`},facebook:{href:`https://www.facebook.com/sharer/sharer.php?u=${y}&quote=${b}&hashtag=${v}`},copy:{href:y}}}let p=d` equals www.twitter.com (Twitter)

Source: unknown

DNS traffic detected: queries for: clients2.google.com

Source: unknown

HTTP traffic detected: POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1Host: accounts.google.comConnection: keep-aliveContent-Length: 1Origin: https://www.google.comContent-Type: application/x-www-form-urlencodedSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4

Source: chromecache_87.4.dr	String found in binary or memory: http://polymer.github.io/AUTHORS.txt
Source: chromecache_87.4.dr	String found in binary or memory: http://polymer.github.io/CONTRIBUTORS.txt
Source: chromecache_87.4.dr	String found in binary or memory: http://polymer.github.io/LICENSE.txt
Source: chromecache_87.4.dr	String found in binary or memory: http://polymer.github.io/PATENTS.txt
Source: chromecache_112.4.dr	String found in binary or memory: http://schema.org/Organization
Source: chromecache_98.4.dr	String found in binary or memory: https://aka.ms/3rdpartycookies
Source: chromecache_87.4.dr	String found in binary or memory: https://aka.ms/certhelp
Source: chromecache_112.4.dr	String found in binary or memory: https://aka.ms/feedback/report?space=61
Source: chromecache_87.4.dr	String found in binary or memory: https://aka.ms/ignitecsc?ocid=ignite23_CSC_bbanner_cnl
Source: chromecache_93.4.dr, chromecache_95.4.dr	String found in binary or memory: https://aka.ms/ignitecsc?ocid=ignite23_CSC_sbanner2_cnl
Source: chromecache_87.4.dr	String found in binary or memory: https://aka.ms/pshelpmechoose
Source: chromecache_112.4.dr	String found in binary or memory: https://aka.ms/yourcaliforniaprivacychoices
Source: chromecache_112.4.dr	String found in binary or memory: https://authoring-docs-microsoft.poolparty.biz/devrel/69c76c32-967e-4c65-b89a-74cc527db725
Source: chromecache_112.4.dr	String found in binary or memory: https://authoring-docs-microsoft.poolparty.biz/devrel/7696cda6-0510-47f6-8302-71bb5d2e28cf
Source: chromecache_87.4.dr	String found in binary or memory: https://channel9.msdn.com/
Source: chromecache_87.4.dr	String found in binary or memory: https://github.com/$
Source: chromecache_112.4.dr	String found in binary or memory: https://github.com/Thraka
Source: chromecache_112.4.dr	String found in binary or memory: https://github.com/Youssef1313
Source: chromecache_112.4.dr	String found in binary or memory: https://github.com/adegeo
Source: chromecache_112.4.dr	String found in binary or memory: https://github.com/dotnet/docs/blob/17c4acca45e573a92878a44a2cce57d699fe9c7c/docs/framework/install/
Source: chromecache_112.4.dr	String found in binary or memory: https://github.com/dotnet/docs/blob/live/docs/framework/install/application-not-started.md
Source: chromecache_112.4.dr	String found in binary or memory: https://github.com/dotnet/docs/blob/main/docs/framework/install/application-not-started.md
Source: chromecache_112.4.dr	String found in binary or memory: https://github.com/dotnet/docs/issues
Source: chromecache_112.4.dr	String found in binary or memory: https://github.com/dotnet/docs/issues/new?template=customer-feedback.yml
Source: chromecache_87.4.dr	String found in binary or memory: https://github.com/dotnet/try
Source: chromecache_112.4.dr	String found in binary or memory: https://github.com/gewarren
Source: chromecache_87.4.dr	String found in binary or memory: https://github.com/jonschlinkert/is-plain-object
Source: chromecache_87.4.dr, chromecache_94.4.dr	String found in binary or memory: https://github.com/js-cookie/js-cookie
Source: chromecache_112.4.dr	String found in binary or memory: https://github.com/mairaw
Source: chromecache_112.4.dr	String found in binary or memory: https://github.com/nschonni
Source: chromecache_112.4.dr	String found in binary or memory: https://js.monitor.azure.com/scripts/c/ms.jsll-3.min.js
Source: chromecache_87.4.dr	String found in binary or memory: https://labclient.labondemand.com
Source: chromecache_87.4.dr	String found in binary or memory: https://learn-video.azurefd.net/
Source: chromecache_87.4.dr	String found in binary or memory: https://learn-video.azurefd.net/vod/player
Source: chromecache_87.4.dr	String found in binary or memory: https://learn-video.azurefd.net/vod/player?id=235e7a95-82c6-4693-859f-2ab7597ab168&embedUrl=%2ftrain
Source: chromecache_87.4.dr	String found in binary or memory: https://learn-video.azurefd.net/vod/player?id=b7179148-9d19-41b1-ad18-fb7f0d1dad97&embedUrl=%2ftrain
Source: chromecache_87.4.dr	String found in binary or memory: https://management.azure.com/providers/Microsoft.Portal/consoles/default?api-version=2017-12-01-prev
Source: chromecache_87.4.dr	String found in binary or memory: https://management.azure.com/providers/Microsoft.Portal/userSettings/cloudconsole?api-version=2017-0
Source: chromecache_87.4.dr	String found in binary or memory: https://management.azure.com/subscriptions?api-version=2016-06-01
Source: chromecache_87.4.dr	String found in binary or memory: https://octokit.github.io/rest.js/#throttling
Source: chromecache_87.4.dr	String found in binary or memory: https://schema.org
Source: chromecache_87.4.dr	String found in binary or memory: https://twitter.com/intent/tweet?original_referer=$
Source: chromecache_87.4.dr	String found in binary or memory: https://twitter.com/share?url=$
Source: chromecache_87.4.dr	String found in binary or memory: https://www.linkedin.com/cws/share?url=$
Source: chromecache_87.4.dr	String found in binary or memory: https://www.linkedin.com/feed/?shareUrl=$
Source: chromecache_87.4.dr	String found in binary or memory: https://www.linkedin.com/profile/add?startTask=CERTIFICATION_NAME&name=$

Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49802

Source: unknown	HTTPS traffic detected: 23.1.244.180:443 -> 192.168.2.5:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.1.244.180:443 -> 192.168.2.5:49751 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.5:49776 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.5:49796 version: TLS 1.2

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Windows\SystemTemp\chrome_BITS_3452_1450416276

Jump to behavior

Source: Renewal.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: Renewal.exe

Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Source: Renewal.exe

Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Source: classification engine

Classification label: clean3.winEXE@24/42@18/8

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Jump to behavior

Source: Renewal.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%

Source: C:\Users\user\Desktop\Renewal.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\Renewal.exe C:\Users\user\Desktop\Renewal.exe
Source: C:\Users\user\Desktop\Renewal.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=Renewal.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2540 --field-trial-handle=2364,i,3433059245063578953,17793063878387418449,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Users\user\Desktop\Renewal.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=Renewal.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 --field-trial-handle=2028,i,5267686039598994631,3060138403470109992,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Users\user\Desktop\Renewal.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=Renewal.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	Jump to behavior
Source: C:\Users\user\Desktop\Renewal.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=Renewal.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2540 --field-trial-handle=2364,i,3433059245063578953,17793063878387418449,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 --field-trial-handle=2028,i,5267686039598994631,3060138403470109992,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior

Source: C:\Users\user\Desktop\Renewal.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\InProcServer32

Jump to behavior

Source: Google Drive.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: Renewal.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: Renewal.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: Renewal.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: \Renewal\obj\Debug\Renewal.pdb4FNF @F_CorExeMainmscoree.dll source: Renewal.exe
Source:	Binary string: \Renewal\obj\Debug\Renewal.pdb source: Renewal.exe

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Source: C:\Users\user\Desktop\Renewal.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=Renewal.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0			Jump to behavior
Source: C:\Users\user\Desktop\Renewal.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=Renewal.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0			Jump to behavior

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact	Resource Development	Reconnaissance
Valid Accounts	Windows Management Instrumentation	1 Registry Run Keys / Startup Folder	11 Process Injection	11 Masquerading	OS Credential Dumping	1 System Information Discovery	Remote Services	Data from Local System	Exfiltration Over Other Network Medium	1 Encrypted Channel	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Abuse Accessibility Features	Acquire Infrastructure	Gather Victim Identity Information
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Registry Run Keys / Startup Folder	11 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	3 Non-Application Layer Protocol	SIM Card Swap	Obtain Device Cloud Backups	Network Denial of Service	Domains	Credentials
Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	4 Application Layer Protocol			Data Encrypted for Impact	DNS Server	Email Addresses
Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Traffic Duplication	1 Ingress Tool Transfer			Data Destruction	Virtual Private Server	Employee Names

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
http://polymer.github.io/CONTRIBUTORS.txt	0%	Avira URL Cloud	safe
http://polymer.github.io/AUTHORS.txt	0%	Avira URL Cloud	safe
https://learn-video.azurefd.net/vod/player	0%	Avira URL Cloud	safe
https://learn-video.azurefd.net/vod/player?id=235e7a95-82c6-4693-859f-2ab7597ab168&embedUrl=%2ftrain	0%	Avira URL Cloud	safe
https://learn-video.azurefd.net/vod/player?id=b7179148-9d19-41b1-ad18-fb7f0d1dad97&embedUrl=%2ftrain	0%	Avira URL Cloud	safe
https://learn-video.azurefd.net/	0%	Avira URL Cloud	safe
http://polymer.github.io/PATENTS.txt	0%	Avira URL Cloud	safe
http://polymer.github.io/LICENSE.txt	0%	Avira URL Cloud	safe
http://polymer.github.io/AUTHORS.txt	0%	Virustotal		Browse
https://learn-video.azurefd.net/vod/player	0%	Virustotal		Browse
https://octokit.github.io/rest.js/#throttling	0%	Avira URL Cloud	safe
https://learn-video.azurefd.net/vod/player?id=235e7a95-82c6-4693-859f-2ab7597ab168&embedUrl=%2ftrain	0%	Virustotal		Browse
http://polymer.github.io/PATENTS.txt	0%	Virustotal		Browse
http://polymer.github.io/LICENSE.txt	0%	Virustotal		Browse
https://learn-video.azurefd.net/vod/player?id=b7179148-9d19-41b1-ad18-fb7f0d1dad97&embedUrl=%2ftrain	0%	Virustotal		Browse
http://polymer.github.io/CONTRIBUTORS.txt	0%	Virustotal		Browse
https://octokit.github.io/rest.js/#throttling	0%	Virustotal		Browse
https://learn-video.azurefd.net/	0%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
adobetarget.data.adobedc.net	63.140.36.139	true	false	unknown
accounts.google.com	142.250.115.84	true	false	high
dcs-public-edge-usw2-219535174.us-west-2.elb.amazonaws.com	52.34.144.49	true	false	high
part-0029.t-0009.t-msedge.net	13.107.213.57	true	false	unknown
www.google.com	142.251.116.104	true	false	high
clients.l.google.com	142.250.114.100	true	false	high
js.monitor.azure.com	unknown	unknown	false	high
clients1.google.com	unknown	unknown	false	high
clients2.google.com	unknown	unknown	false	high
microsoftmscompoc.tt.omtrdc.net	unknown	unknown	false	unknown
mdec.nelreports.net	unknown	unknown	false	unknown
mscom.demdex.net	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
https://clients1.google.com/tools/pso/ping?as=chrome&brand=ONGR&pid=&hl=en&events=C1I,C2I,C7I,C1S,C7S&rep=2&rlz=C1:,C2:,C7:&id=000000000000000000000000000000000000000040896C04EA	false	high
https://js.monitor.azure.com/scripts/c/ms.jsll-3.min.js	false	high
https://accounts.google.com/ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard	false	high
https://clients2.google.com/service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=117.0.5938.132&lang=en-US&acceptformat=crx3,puff&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26brand%3DONGR%26ping%3Dr%253D-1%2526e%253D1	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://authoring-docs-microsoft.poolparty.biz/devrel/7696cda6-0510-47f6-8302-71bb5d2e28cf	chromecache_112.4.dr	false		high
https://learn-video.azurefd.net/vod/player?id=235e7a95-82c6-4693-859f-2ab7597ab168&embedUrl=%2ftrain	chromecache_87.4.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://github.com/dotnet/docs/blob/17c4acca45e573a92878a44a2cce57d699fe9c7c/docs/framework/install/	chromecache_112.4.dr	false		high
https://www.linkedin.com/cws/share?url=$	chromecache_87.4.dr	false		high
https://github.com/Youssef1313	chromecache_112.4.dr	false		high
http://polymer.github.io/AUTHORS.txt	chromecache_87.4.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://aka.ms/3rdpartycookies	chromecache_98.4.dr	false		high
https://learn-video.azurefd.net/vod/player?id=b7179148-9d19-41b1-ad18-fb7f0d1dad97&embedUrl=%2ftrain	chromecache_87.4.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://management.azure.com/subscriptions?api-version=2016-06-01	chromecache_87.4.dr	false		high
https://labclient.labondemand.com	chromecache_87.4.dr	false		high
https://github.com/dotnet/docs/blob/main/docs/framework/install/application-not-started.md	chromecache_112.4.dr	false		high
https://aka.ms/pshelpmechoose	chromecache_87.4.dr	false		high
https://aka.ms/feedback/report?space=61	chromecache_112.4.dr	false		high
https://www.linkedin.com/feed/?shareUrl=$	chromecache_87.4.dr	false		high
https://learn-video.azurefd.net/vod/player	chromecache_87.4.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://twitter.com/intent/tweet?original_referer=$	chromecache_87.4.dr	false		high
https://github.com/gewarren	chromecache_112.4.dr	false		high
http://polymer.github.io/CONTRIBUTORS.txt	chromecache_87.4.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://www.linkedin.com/profile/add?startTask=CERTIFICATION_NAME&name=$	chromecache_87.4.dr	false		high
https://learn-video.azurefd.net/	chromecache_87.4.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://github.com/dotnet/docs/blob/live/docs/framework/install/application-not-started.md	chromecache_112.4.dr	false		high
https://authoring-docs-microsoft.poolparty.biz/devrel/69c76c32-967e-4c65-b89a-74cc527db725	chromecache_112.4.dr	false		high
https://management.azure.com/providers/Microsoft.Portal/consoles/default?api-version=2017-12-01-prev	chromecache_87.4.dr	false		high
https://aka.ms/ignitecsc?ocid=ignite23_CSC_bbanner_cnl	chromecache_87.4.dr	false		high
https://github.com/Thraka	chromecache_112.4.dr	false		high
https://github.com/dotnet/docs/issues	chromecache_112.4.dr	false		high
http://polymer.github.io/PATENTS.txt	chromecache_87.4.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://aka.ms/certhelp	chromecache_87.4.dr	false		high
https://github.com/mairaw	chromecache_112.4.dr	false		high
https://schema.org	chromecache_87.4.dr	false		high
http://polymer.github.io/LICENSE.txt	chromecache_87.4.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://aka.ms/yourcaliforniaprivacychoices	chromecache_112.4.dr	false		high
https://github.com/nschonni	chromecache_112.4.dr	false		high
https://github.com/dotnet/docs/issues/new?template=customer-feedback.yml	chromecache_112.4.dr	false		high
https://github.com/adegeo	chromecache_112.4.dr	false		high
https://github.com/jonschlinkert/is-plain-object	chromecache_87.4.dr	false		high
https://octokit.github.io/rest.js/#throttling	chromecache_87.4.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://management.azure.com/providers/Microsoft.Portal/userSettings/cloudconsole?api-version=2017-0	chromecache_87.4.dr	false		high
https://github.com/js-cookie/js-cookie	chromecache_87.4.dr, chromecache_94.4.dr	false		high
https://github.com/$	chromecache_87.4.dr	false		high
http://schema.org/Organization	chromecache_112.4.dr	false		high
https://channel9.msdn.com/	chromecache_87.4.dr	false		high
https://aka.ms/ignitecsc?ocid=ignite23_CSC_sbanner2_cnl	chromecache_93.4.dr, chromecache_95.4.dr	false		high
https://twitter.com/share?url=$	chromecache_87.4.dr	false		high
https://github.com/dotnet/try	chromecache_87.4.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
142.251.116.104	www.google.com	United States	15169	GOOGLEUS	false
52.34.144.49	dcs-public-edge-usw2-219535174.us-west-2.elb.amazonaws.com	United States	16509	AMAZON-02US	false
142.250.115.84	accounts.google.com	United States	15169	GOOGLEUS	false
142.250.114.100	clients.l.google.com	United States	15169	GOOGLEUS	false
13.107.213.57	part-0029.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
142.250.115.139	unknown	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.5

General Information

Joe Sandbox version:	38.0.0 Ammolite
Analysis ID:	1370152
Start date and time:	2024-01-05 03:28:37 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 29s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Run name:	Potential for more IOCs and behavior
Number of analysed new started processes analysed:	10
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Renewal.exe
Detection:	CLEAN
Classification:	clean3.winEXE@24/42@18/8
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 23.221.253.211, 142.250.138.94, 23.219.218.56, 34.104.35.123, 23.212.74.133, 184.28.78.183, 184.28.78.206, 142.251.116.95, 142.250.115.95, 142.250.114.95, 142.250.113.95, 142.250.138.95, 20.189.173.13, 20.42.65.90, 23.48.162.204, 23.48.162.196, 192.229.211.108, 142.251.116.94, 23.45.173.81, 23.45.173.60, 23.221.226.41
Excluded domains from analysis (whitelisted): aijscdn2.afd.azureedge.net, slscr.update.microsoft.com, clientservices.googleapis.com, browser.events.data.trafficmanager.net, learn.microsoft.com, onedscolprdeus14.eastus.cloudapp.azure.com, e11290.dspg.akamaiedge.net, mdec.nelreports.net.akamaized.net, go.microsoft.com, ocsp.digicert.com, a1883.dscd.akamai.net, learn.microsoft.com.edgekey.net, update.googleapis.com, fs.microsoft.com, target.microsoft.com, content-autofill.googleapis.com, ctldl.windowsupdate.com, learn.microsoft.com.edgekey.net.globalredir.akadns.net, firstparty-azurefd-prod.trafficmanager.net, fe3cr.delivery.mp.microsoft.com, aijscdn2.azureedge.net, browser.events.data.microsoft.com, edgedl.me.gvt1.com, onedscolprdwus12.westus.cloudapp.azure.com, e13636.dscb.akamaiedge.net, learn-public.trafficmanager.net, go.microsoft.com.edgekey.net, wcpstatic.microsoft.com
HTTPS proxy raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
13.107.213.57	https://pub-62af56b1dbc845bd824ffe58ddaf2505.r2.dev/offlinode.html	Get hash	malicious	HTMLPhisher	Browse
	https://google.com/amp/ip182.ip-135-148-101.us/YllnQll2MlQ2a1hTK01xZHFOQmRGUmthNXpNOFM4bGRodTZCeGoyV1dyNGczTDA0UG11eGJxTGJLMU92SFZzZ2VSaTNPRU05SXNFeDllQXNoeWNzNXc9PQ__	Get hash	malicious	Unknown	Browse
	http://countryflags.io	Get hash	malicious	Unknown	Browse
	https://r20.rs6.net/tn.jsp?f=001li4RqeGHZ8qwYmafrEBmla3Ga7E7d6hyrEFrY04IgbfTxR2C0d1M-t25GQWTRzLWi3oeztkmSNT2Tp-22ACxRhevmIf2VMfgYOKK-YkOrEJSnligNe0NLBMeBHGGNrD7_85LLR0X12GrlFEgreACgpduIm6a3gqBb6ik_LDxepG-TG9luf7ms5XGNiwc4coI&c=&ch==&__=/data/bmFuY3kucm9uZ29lQHJhdmVpcy5jb20=	Get hash	malicious	HTMLPhisher	Browse
	https://trk.klclick3.com/ls/click?upn=qv6sSJ61i-2FCKcGs-2FWg5X5zSxUPH2ZrqUtgTrwIqP9tbV5nGRnmcCyzwEsyGChMEEVfcMVsKyWwCHSROXPHp2ssugEGqO5s0anA-2For84UxcDq0TVqcknxBCOK9bomYKxHZeGI_sriuaryqqdv1VntrH6X8cr710FsqQrnNUbUkxkf7x0pMSAkpeuB0WYDuTzAgnc1ypLmqKYwtOZGJRbr42WyOuUQfTu-2F4nzRvnExBDhTcsDCxAYSlvrUnKqhNu2QucwzzHnfd3nc1PaEOPnCY7lVi-2F-2FTTNyovG0zYk5qi6TlQOaMUlPhhOg1CBzrWoD-2BJCy6CeRTNCOxMmeykKFlmppbGGEqcnv1Ns33HkJq5QrEE1i7TzFrSdTciiW2xeho3yieI3kgFCvNAbW4DmtirZICDakbW9OIKR7-2BXEXF9V211cy5MWvnRyElRCDnZQGhhC4Xmy8QpWVQ1hkRUjNSqbxBIyJs0NLN-2BicHZse9nYwlxxMdUHA7kW8jSzXcgtmt4bmXpQ8CJpa3Q6l8HoWplFamAv33yszfV6dEc-2BB0CG8c2HMNZZ1XSXq7GmTl-2BvMA-2BfRvY#YnJ5b255LmdyaW1lc0B2aXJnaW5tZWRpYW8yLmNvLnVr	Get hash	malicious	HTMLPhisher	Browse
	PDFSuperHero (1).exe	Get hash	malicious	Unknown	Browse
	https://dmeodlekaed.blob.core.windows.net/dmeodlekaed/url.html#cl/8478_md/12/678/2075/430/395518	Get hash	malicious	Unknown	Browse
	seznam.cz!rak-hamburg.de!1701216000!1701302400.xml	Get hash	malicious	Unknown	Browse
	https://neon.ly/f132f836-82cf-441d-83cc-ac2dde9fb1d7	Get hash	malicious	Unknown	Browse
	https://p.feedblitz.com/t3.asp?/1081591/102442729/7821567_/~feeds.feedblitz.com/~/t/0/0/sethsblog/posts/~//trk.klclick2.com/ls/click?upn=HVRWduvhL1zapb3BWQOCNk56kKLaZN2NWyuuAuFxgIz8zMiQxnawrj2-2FFp7gbcQnyWrOdGbOqFj-2FZgkAzyq-2BC8khjhjfMbBT9dGWSJRNZI03JhXEl1PVjz9DwJY0pvjIWHbttWgqwTZC6g51Xo9ipGls7VH82Bc77cvYM1wSwlM-3Dhsu-_UQf6CZtgTiGkpBx1ujDHnZAntAuJNxWSG9pjq-2BiEMRDParvahGK2lvPcgi8z-2B-2BWUg4E10bFWhVQPx2J677B6FP8yx0-2FJysvwueXTDlekc4fuJqc9eTKiFd28lcyexC81Cqlaf8OneDq0RQqpzSs3OrNXYkcO5BGQ0-2Bvj-2BMgtvx9EU5ceWacKEsrgo34D-2BvQlfVKavXIJnXz55AiUSDivcOKyMMkM77dkhlnU-2Fwhqfd9sgtV5U5QT43TnSbZVQbSpb6JM5Fd-2B9zjF7ujAa-2BmGKp80xEnPvX0pprbw2q6dePK-2Fn-2FOxE0W-2Fd2ibbASB-2BOpeh70-2F-2FM4Apmxghfiw9-2FaXl4pMadZgZf5tgK06pK1jU3LWhF-2FesHp6BuC4Zm6NA2siQYaKh1PINuPYtQTQ71r8gsRavODOVonVqF9fhuZTl08PrNKgQ12YYqGjBnkNreOqLUzSmcrbnQz49pZIL4H8Zw-3D-3D#YW15QHZpcnR1YWxpbnRlbGxpZ2VuY2VicmllZmluZy5jb20===8axoeifyzgmgsvofhrr=Z29vZ2xlLmNvbQ==	Get hash	malicious	HTMLPhisher	Browse
	part2.html	Get hash	malicious	HTMLPhisher	Browse
	Inv_No. 52130316.msg	Get hash	malicious	HTMLPhisher	Browse
	https://cloudflare-ipfs.com/ipfs/bafybeia5oggkq62k6lcwbiwoetxns6qmd3ebfedk2h74zpfrdho2h3etym/	Get hash	malicious	HTMLPhisher	Browse
	https://wolimieieieieueue.pages.dev/	Get hash	malicious	HTMLPhisher	Browse
	https://pub-2d60515458664a6cad7c750e9f679d87.r2.dev/12345.html	Get hash	malicious	HTMLPhisher	Browse
	https://pub-e1054d351e574dc09ec7cadc634b739f.r2.dev/ma.html	Get hash	malicious	HTMLPhisher	Browse
	https://pub-b71c16e9ba864559ac772df2b4d9f147.r2.dev/verification.html	Get hash	malicious	HTMLPhisher	Browse
	O6fNCCdNd3.exe	Get hash	malicious	RisePro Stealer, SmokeLoader, Vidar	Browse
	https://inmailnummamnetext-paper-ab55.sr-171.workers.dev/	Get hash	malicious	Unknown	Browse
	http://feedbacks.hgdtk-sec.com/index.html	Get hash	malicious	Unknown	Browse
239.255.255.250	http://nervous-seed-snowplow.glitch.me	Get hash	malicious	Unknown	Browse
	lpk.dll	Get hash	malicious	Unknown	Browse
	http://getol.xyz/?action=register&chan=THEHUNTER	Get hash	malicious	Unknown	Browse
	https://indd.adobe.com/view/a4b3551e-fb20-4176-a450-a3d49c28e11c	Get hash	malicious	Unknown	Browse
	https://url7923.marsello.io/ls/click?upn=Xn88PJeNIL29Y2OVpP6Ui0LpID1OB9-2FQ7fdFAYW30og-3DGplJ_sZqRmnE4gRhrBPkGQNcsa9DgzygEBYPysLEudQ1VJAq74vZRJeMql8sJzU98zFljux8zkiiKazy44WmsmvEX3LjrGhAW5qE5e5HDXiuWXZ2P8OGKvis9oV40cQ1FdnJo8zESv9Jki6ESwhjWgY4joB7Epd2zEz70eg3jyvM2mBGLCWLz6OjsoyWFs-2FZo3zUssxa4GpWNSMsRc-2FEBe4IoB8C7frcim0QAsAlnmmVivO7vKPSqIp7t-2FV5fWpJQ4cjZQ8GUxUzO4rI9pAboFP1In2z0vKd-2Bqmh2msfVXa2nSqw4JidMdtStqhtINKXJmjFg	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse
	http://47.149.31.206	Get hash	malicious	Unknown	Browse
	https://38.105.25.233/	Get hash	malicious	Unknown	Browse
	https://204.44.66.107/	Get hash	malicious	Unknown	Browse
	https://156.247.14.65/	Get hash	malicious	Unknown	Browse
	https://47.252.0.216/	Get hash	malicious	Unknown	Browse
	https://ntf860f8.page.link/1srt	Get hash	malicious	Unknown	Browse
	https://indd.adobe.com/view/738ed234-d2b3-427d-925e-2e91c73bcc9c	Get hash	malicious	Unknown	Browse
	https://www.smbc-co.jp.gcguyjav5r7molqmwsxfh.kjfnb.xyz/	Get hash	malicious	Unknown	Browse
	https://66.203.159.154/	Get hash	malicious	Unknown	Browse
	https://shonetown.com/	Get hash	malicious	Unknown	Browse
	https://guangyyq.com/login	Get hash	malicious	Unknown	Browse
	https://info-d6776fd98f34bh325f.waste-service.com/verfolgung/2880408?page=037	Get hash	malicious	Unknown	Browse
	https://netflixlogin111.blogspot.com/	Get hash	malicious	Unknown	Browse
	https://trevorservices.trevor3340.workers.dev/	Get hash	malicious	HTMLPhisher	Browse
	https://bnl-tarif-transaksi.ssd-i.com/Tarif-Transaksi-BNI/	Get hash	malicious	Unknown	Browse
52.34.144.49	https://pub-7a05263f273a456bb4e5284e1a031154.r2.dev/jsnew.html	Get hash	malicious	HTMLPhisher	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
adobetarget.data.adobedc.net	https://purple-ground-080c0e60f.4.azurestaticapps.net/.auth/invitations/accept	Get hash	malicious	Unknown	Browse	63.140.38.120
	https://www.fortinet.com/blog/threat-research/teamcity-intrusion-saga-apt29-suspected-exploiting-cve-2023-42793	Get hash	malicious	Unknown	Browse	63.140.36.14
	Resume_C.D.Murali.doc	Get hash	malicious	Unknown	Browse	63.140.36.121
	https://yinghuodnf.com/	Get hash	malicious	Unknown	Browse	63.140.38.149
	https://szdaoshui.com/	Get hash	malicious	Unknown	Browse	63.140.38.151
	https://acrobat.adobe.com/id/urn:aaid:sc:VA6C2:7e2ff22d-e9ad-4bf2-9af9-8280f312d601	Get hash	malicious	Unknown	Browse	63.140.38.160
	PO#800019DOCS.exe	Get hash	malicious	Unknown	Browse	63.140.38.225
	Comprobante Fiscal Digital - d1S4S7k6l4d2D09043655750.html	Get hash	malicious	Unknown	Browse	63.140.38.123
	rpmOhktwoL.exe	Get hash	malicious	Glupteba, LummaC Stealer, Petite Virus, RedLine, SmokeLoader, Socks5Systemz, Stealc	Browse	63.140.38.201
	PVT_MNDREQUEST_FOR_QOUTATION_07964766IKJGDS.exe	Get hash	malicious	Unknown	Browse	63.140.38.151
	http://url4950.cardamomauction.com/ls/click?upn=egCPuzUzE3IgDlrJllQ8yUBDO8VIETbuALPBUwtYINtrfRoh4niogEH8ew5kcjpQHM6X_5oPQIRm8LVmW-2FxweY307RHB6-2FfahtC57rDiHjDqcmR3wVeFHqU860zUYKXVGazyJpxMz-2BcQ5uK-2BNpDHERkaIkSLRnnlu-2Fc6D63JAIl8JEZb1GxYrBpkUR5dGmGiZ7tVIHJtwdg2sVnEwwf6w1QvIy9Zxou6xRVLuTVo-2BvDlX32eGOdm-2FS4cfnyxoMZpQM-2FzWDOoNZbiI7Zh9oLibZCTy9w-3D-3D#offer/001mu/120/frznm/ijv/41/79	Get hash	malicious	Phisher	Browse	63.140.38.165
	https://url12.mailanyone.net/scanner?m=1rCpkc-0008eu-6Q&d=4%7Cmail%2F90%2F1702337400%2F1rCpkc-0008eu-6Q%7Cin12i%7C57e1b682%7C21208867%7C12850088%7C65779BE6B573E32E40AAA75850226809&o=%2Fphtl%3A%2Fctst.icacprkiicckpm%2Fc.opl%2Frpy.hea04%3Fr3862%3D0%3Ds2%267id4mgt4270ac%3D0%267%26AA0%3D188c%3D%26776id22pd919s8%26e00natihio%3Dnt%25sttF3A2p%25lw%252nw.iFwoike%25.cmdnmn2Fc2Fii%25klhaoacsejlmnc%25belap3c2F9%3D11%26f9%3D1%26442dv2934d2df38a02693a593d7548c5b936221619f6b9ca3059c08890c233fc&s=B5zt8KWIS6xHlUijhBDho5gJNR8	Get hash	malicious	Unknown	Browse	63.140.38.104
	1QWuKDSrfN.exe	Get hash	malicious	Neshta	Browse	63.140.38.151
	https://acrobat.adobe.com/id/urn:aaid:sc:us:017842a5-a13a-4022-a03e-af8d86316b9c	Get hash	malicious	HTMLPhisher	Browse	63.140.38.225
	http://url7816.acetaxi.com/ls/click?upn=k9eqZnPBEZmPVPka3LxS61O1ksdCJOgznvtiwccqzi2-2BneqvfCXEJ-2FQj-2BZo7snmCwDunBahf2LYhfs7qQp7-2F23xLStq-2BkxJ70xqVvyXzkWM-3D8Cie_z5TGfmB4A65PPE2hDgRdrx6OZsZ3AmrJLHJ0M9ePWeHP5QDTWsAVp117uXam9dNn-2BGSxHeP-2BInRF-2Bgy2v-2FXBPODjmLss6NRV2RYsUYD7um77hgLl0ET9pPGTHF-2BQ1m6-2Fw7-2B-2B9DJOpakZj874YLC8uUep0F7rZMDlM46gmHmQqqAeCV477M0h2b07T2IcXu0hzUcKftN0UG2jhPq8qo00cQl0gvOLl-2BjChyaOdLpENao-3D	Get hash	malicious	Unknown	Browse	63.140.38.128
	http://arsyology.xyz/gYefq09	Get hash	malicious	Unknown	Browse	63.140.38.201
	https://smbbc-static.top/mem/index.html	Get hash	malicious	Unknown	Browse	63.140.38.113
	Alyssa M Juris Please Confirm Subscription.msg	Get hash	malicious	Unknown	Browse	63.140.38.160
	5sL4tK1.exe	Get hash	malicious	Glupteba, LummaC Stealer, RedLine, SmokeLoader, Xmrig, zgRAT	Browse	63.140.38.151
	3WK60hS.exe	Get hash	malicious	LummaC Stealer, Petite Virus, RedLine, SmokeLoader, zgRAT	Browse	63.140.38.12
part-0029.t-0009.t-msedge.net	https://mikro-six.vercel.app/	Get hash	malicious	HTMLPhisher	Browse	13.107.246.57
	https://drive.google.com/file/d/1FES-ilIgDK8aY-l0WDjuU_r-5xHYO257/view?usp=sharing_eip_m&ts=658b61c4&sh=G9iUz3WHSlBcIUFB&ca=1&exids=71685779,71685773	Get hash	malicious	Unknown	Browse	13.107.246.57
	https://pub-62af56b1dbc845bd824ffe58ddaf2505.r2.dev/offlinode.html	Get hash	malicious	HTMLPhisher	Browse	13.107.246.57
	https://google.com/amp/ip182.ip-135-148-101.us/YllnQll2MlQ2a1hTK01xZHFOQmRGUmthNXpNOFM4bGRodTZCeGoyV1dyNGczTDA0UG11eGJxTGJLMU92SFZzZ2VSaTNPRU05SXNFeDllQXNoeWNzNXc9PQ__	Get hash	malicious	Unknown	Browse	13.107.213.57
	http://countryflags.io	Get hash	malicious	Unknown	Browse	13.107.213.57
	https://r20.rs6.net/tn.jsp?f=001li4RqeGHZ8qwYmafrEBmla3Ga7E7d6hyrEFrY04IgbfTxR2C0d1M-t25GQWTRzLWi3oeztkmSNT2Tp-22ACxRhevmIf2VMfgYOKK-YkOrEJSnligNe0NLBMeBHGGNrD7_85LLR0X12GrlFEgreACgpduIm6a3gqBb6ik_LDxepG-TG9luf7ms5XGNiwc4coI&c=&ch==&__=/data/bmFuY3kucm9uZ29lQHJhdmVpcy5jb20=	Get hash	malicious	HTMLPhisher	Browse	13.107.246.57
	https://trk.klclick3.com/ls/click?upn=qv6sSJ61i-2FCKcGs-2FWg5X5zSxUPH2ZrqUtgTrwIqP9tbV5nGRnmcCyzwEsyGChMEEVfcMVsKyWwCHSROXPHp2ssugEGqO5s0anA-2For84UxcDq0TVqcknxBCOK9bomYKxHZeGI_sriuaryqqdv1VntrH6X8cr710FsqQrnNUbUkxkf7x0pMSAkpeuB0WYDuTzAgnc1ypLmqKYwtOZGJRbr42WyOuUQfTu-2F4nzRvnExBDhTcsDCxAYSlvrUnKqhNu2QucwzzHnfd3nc1PaEOPnCY7lVi-2F-2FTTNyovG0zYk5qi6TlQOaMUlPhhOg1CBzrWoD-2BJCy6CeRTNCOxMmeykKFlmppbGGEqcnv1Ns33HkJq5QrEE1i7TzFrSdTciiW2xeho3yieI3kgFCvNAbW4DmtirZICDakbW9OIKR7-2BXEXF9V211cy5MWvnRyElRCDnZQGhhC4Xmy8QpWVQ1hkRUjNSqbxBIyJs0NLN-2BicHZse9nYwlxxMdUHA7kW8jSzXcgtmt4bmXpQ8CJpa3Q6l8HoWplFamAv33yszfV6dEc-2BB0CG8c2HMNZZ1XSXq7GmTl-2BvMA-2BfRvY#YnJ5b255LmdyaW1lc0B2aXJnaW5tZWRpYW8yLmNvLnVr	Get hash	malicious	HTMLPhisher	Browse	13.107.246.57
	PDFSuperHero (1).exe	Get hash	malicious	Unknown	Browse	13.107.246.57
	http://www.tinyurl.com/stationnement-infraction	Get hash	malicious	Unknown	Browse	13.107.246.57
	seznam.cz!rak-hamburg.de!1701216000!1701302400.xml	Get hash	malicious	Unknown	Browse	13.107.246.57
	seznam.cz!rak-hamburg.de!1701216000!1701302400.xml	Get hash	malicious	Unknown	Browse	13.107.213.57
	TAX INV_No. 68430304.msg	Get hash	malicious	HTMLPhisher	Browse	13.107.213.57
	https://www.cloudflare-ipfs.com/ipfs/bafybeidh3wdcpsqif5e33rgmpsv55ddzsbmoretfb6beocz24c75r6czyu/	Get hash	malicious	HTMLPhisher	Browse	13.107.246.57
	https://p.feedblitz.com/t3.asp?/1081591/102442729/7821567_/~feeds.feedblitz.com/~/t/0/0/sethsblog/posts/~//trk.klclick2.com/ls/click?upn=HVRWduvhL1zapb3BWQOCNk56kKLaZN2NWyuuAuFxgIz8zMiQxnawrj2-2FFp7gbcQnyWrOdGbOqFj-2FZgkAzyq-2BC8khjhjfMbBT9dGWSJRNZI03JhXEl1PVjz9DwJY0pvjIWHbttWgqwTZC6g51Xo9ipGls7VH82Bc77cvYM1wSwlM-3Dhsu-_UQf6CZtgTiGkpBx1ujDHnZAntAuJNxWSG9pjq-2BiEMRDParvahGK2lvPcgi8z-2B-2BWUg4E10bFWhVQPx2J677B6FP8yx0-2FJysvwueXTDlekc4fuJqc9eTKiFd28lcyexC81Cqlaf8OneDq0RQqpzSs3OrNXYkcO5BGQ0-2Bvj-2BMgtvx9EU5ceWacKEsrgo34D-2BvQlfVKavXIJnXz55AiUSDivcOKyMMkM77dkhlnU-2Fwhqfd9sgtV5U5QT43TnSbZVQbSpb6JM5Fd-2B9zjF7ujAa-2BmGKp80xEnPvX0pprbw2q6dePK-2Fn-2FOxE0W-2Fd2ibbASB-2BOpeh70-2F-2FM4Apmxghfiw9-2FaXl4pMadZgZf5tgK06pK1jU3LWhF-2FesHp6BuC4Zm6NA2siQYaKh1PINuPYtQTQ71r8gsRavODOVonVqF9fhuZTl08PrNKgQ12YYqGjBnkNreOqLUzSmcrbnQz49pZIL4H8Zw-3D-3D#YW15QHZpcnR1YWxpbnRlbGxpZ2VuY2VicmllZmluZy5jb20===8axoeifyzgmgsvofhrr=Z29vZ2xlLmNvbQ==	Get hash	malicious	HTMLPhisher	Browse	13.107.213.57
	part2.html	Get hash	malicious	HTMLPhisher	Browse	13.107.213.57
	Inv_No. 52130316.msg	Get hash	malicious	HTMLPhisher	Browse	13.107.213.57
	https://action.azurecomm.net/api/a/c?r=AIAAC5YOW6VICXVUC6AGB6WOWJEE6QQVQ2N32HJNHCXHTHWHEIKWFIZLLH27IFVW4OEX5FRBXTR7F4PYJ5FGTGN7NHMBMAS4DFM6SJL2OUDENAV6TZTXREKYPXHYCEDSDSBEASF6RDWYMPEMPFYEN5WGL4563K5NM4AKBUEHVFVV22JSCF2LF52C6EXPDD7FUENICOOB7ETSN6S7RJ3LOAHSJ3FN6BVORK236MTVYNNG4OPJ47NGHE3FLZCG4YG7PGZKDXFXEFPHWQ3YYWAI5OGRISHFRMM2KEGL6R3BHFSRZEUXRDOK5CPVYJBLVSRAMPVPTWSWQZ5UQSQVKIR2SRY27MNNXLN4VCM267YTKPQCBRGS4PFEBOPWMAJ2JO7VMH4RVHYXP5X3VVRDLC35GDHO7OG5TVE4REFC56DN5RBNKC27HSVFBULZV436VOHXOFCVYLDYPFVJ2W2AEWBWK2MHR3VC3RINUAZFIBN3CU2QP7YHLJ6PI4RFOQZWN66LLFDY4PESK36IYFGJG2DMR6VTEHSVSDQ&d=AIAACHM7OILYGPOJOJMSG42VSKMYC4TMP2GK4TLACUH6VP47UOXJSWUFYAFEHQ7T2BIRMKJW5VYVHFQKGEXOPOAY57Z5FBCXN6VEQX2LLYQQ4QCWCEBR6DOOXXCCUISD5VT4NSHT6BCN4YUVN7U4ALFOSBPEAX5LB6Q4UZ7MJX4TZR4JOQOUHXJ7CKDL3MQUWMQDJYE4M2WPSWN66YV65GAPOGL4XVBRN4HWDGI362HDIBUXUPNTY7KC423S6LTVKIWJZFAOUUOP6CXALJ4MJFWRVCUWRKY&url=PY/NToNAFEbfhp0MEF1gMtFoC21Sa6i1pGzMnWEoU7gzZH5q8emlLPotzzmbr3VueCZE+IemdqYLjfZO2KEJuUZCeL83wLsXWVNi8/YP2xsPEZwwSrrRtlrM5YaDm5jTisxrDKguhJ6B0q/9Xd5a7/AHRS09UoEg++AGOOAA8qRor086+LbCrGvKkzjiq4Pnq7eRJQUNdoILeZkd5FlbJQdf5NdH9hUrjmnM35/OLIlokBmNU3NMUl9hP7Iyi6BMp7ayotzFR8yGDW4vrKA0mA4qC9xJrdYL+rFf/m7Py+vnohj/AQ==	Get hash	malicious	HTMLPhisher	Browse	13.107.246.57
	Signature Required on cra-arc Q1 DrawDown Request - Execution Copy.zip	Get hash	malicious	HTMLPhisher	Browse	13.107.246.57
	Inv_No. 52130316.msg	Get hash	malicious	HTMLPhisher	Browse	13.107.213.57
	http://yeshlasoftware.com/PDFCastle.exe	Get hash	malicious	Unknown	Browse	13.107.246.57
dcs-public-edge-usw2-219535174.us-west-2.elb.amazonaws.com	https://google.com/amp/ip182.ip-135-148-101.us/SWhOYXJKdC9NYllYNWFSNXdvbGswWjU0M1U1Vk9xZXQvVUs2cHVtRGFsRVhGblA2ajJrbVppVUxBSEFMNXNTWWVPNm0xa3FQQm5BZEp1ZndrUFdGQ3c9PQ__	Get hash	malicious	Unknown	Browse	34.208.28.93
	http://www.tinyurl.com/stationnement-infraction	Get hash	malicious	Unknown	Browse	52.40.168.59
	https://hujr9.pages.dev/	Get hash	malicious	Unknown	Browse	44.224.119.250
	https://hrk4.pages.dev/	Get hash	malicious	Unknown	Browse	52.88.218.158
	http://accedi.54-227-63-246.cprapid.com/	Get hash	malicious	Unknown	Browse	52.32.40.227
	https://bgi.pages.dev/	Get hash	malicious	Unknown	Browse	52.40.168.36
	https://faq-kak.ru/kak-najti-svoyu-biblioteku-v-steam/	Get hash	malicious	Unknown	Browse	52.40.168.59
	https://pub-7a05263f273a456bb4e5284e1a031154.r2.dev/jsnew.html	Get hash	malicious	HTMLPhisher	Browse	52.34.53.96
	O6fNCCdNd3.exe	Get hash	malicious	RisePro Stealer, SmokeLoader, Vidar	Browse	34.212.247.228
	https://www.americanexpressseguros.com/	Get hash	malicious	Unknown	Browse	54.190.64.98
	https://pub-5e1216f7ac0c4c66ad3357156574b076.r2.dev/American_Express_card_protection.htm	Get hash	malicious	HTMLPhisher	Browse	35.166.198.201
	https://pub-deefeb5d00534e3992bcd5b787c594a8.r2.dev/jsnew.html	Get hash	malicious	HTMLPhisher	Browse	35.166.198.201
	https://www.fortinet.com/blog/threat-research/teamcity-intrusion-saga-apt29-suspected-exploiting-cve-2023-42793	Get hash	malicious	Unknown	Browse	54.190.64.98
	https://pub-af1ca2628047462d82e8cad6b44984b9.r2.dev/index.htm	Get hash	malicious	HTMLPhisher	Browse	54.244.173.3
	http://www.m9c.net	Get hash	malicious	Unknown	Browse	54.190.64.98
	Resume_C.D.Murali.doc	Get hash	malicious	Unknown	Browse	54.190.64.98
	1va32uO2.exe	Get hash	malicious	Unknown	Browse	54.201.93.159
	WEXTRACT.EXE.exe	Get hash	malicious	RisePro Stealer, Vidar	Browse	52.42.171.249
	wextract2.exe	Get hash	malicious	RisePro Stealer, SmokeLoader	Browse	54.190.64.98
	WEXTRACT13.EXE.exe	Get hash	malicious	RisePro Stealer, SmokeLoader, Vidar, zgRAT	Browse	52.42.120.103

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
MICROSOFT-CORP-MSN-AS-BLOCKUS	VYPW2R1c6f.elf	Get hash	malicious	Mirai	Browse	20.52.245.233
	KddPKUnEY7.elf	Get hash	malicious	Mirai	Browse	20.246.165.77
	AN917z2mDV.exe	Get hash	malicious	RedLine	Browse	20.79.30.95
	https://ntf860f8.page.link/1srt	Get hash	malicious	Unknown	Browse	52.149.246.39
	sora.arm.elf	Get hash	malicious	Mirai	Browse	13.91.200.38
	https://trevorservices.trevor3340.workers.dev/	Get hash	malicious	HTMLPhisher	Browse	13.107.213.40
	Thank You Inv#2024 ADOBE PDF.htm	Get hash	malicious	HTMLPhisher	Browse	13.107.246.40
	riatCif1bF.elf	Get hash	malicious	Mirai	Browse	157.55.40.136
	p2hClh5NdZ.elf	Get hash	malicious	Mirai	Browse	52.160.28.193
	x86_64	Get hash	malicious	Mirai	Browse	70.37.80.25
	ia5oWfGclS.elf	Get hash	malicious	Mirai	Browse	157.56.241.237
	oOdJWGP3g2.elf	Get hash	malicious	Mirai	Browse	20.161.37.117
	https://www.dropbox.com/scl/fi/wixtsar1jve2oak92gpd6/Cameron-Lux-Farmers-Union-Insurance-has-a-vital-document-for-you.Check-below-for-the-vital-document-shared.paper?rlkey=s4nqkki1okthmv0wunvifol7u&dl=0	Get hash	malicious	HTMLPhisher	Browse	20.190.190.131
	arm7.elf	Get hash	malicious	Mirai	Browse	13.100.26.34
	x86.elf	Get hash	malicious	Mirai	Browse	52.179.210.17
	https://brokerdealer-my.sharepoint.com/:f:/g/personal/irene_albon_cetera_com/EgEridaWCk5DncOEFkD0eTQBGh1hFUtwLXOIgvq65O6VfA?e=wfIHTL	Get hash	malicious	HTMLPhisher	Browse	13.107.136.10
	https://purple-ground-080c0e60f.4.azurestaticapps.net/.auth/invitations/accept	Get hash	malicious	Unknown	Browse	20.22.31.128
	Thank You Inv#2124 ADOBE PDF.htm	Get hash	malicious	HTMLPhisher	Browse	13.107.246.40
	https://www.baidu.com/link?url=0wAYVyA8FwwTAf4BPuuhFiLagReX1m8YEK8UHbHELux8sCJ--hepIcC5HKQXNyTd#yultia.oneal@dot.gov	Get hash	malicious	Unknown	Browse	13.89.172.14
	https://vhb-my.sharepoint.com/:f:/p/rbarr/Egs8mLLY8YlDiwRPlFM9248BERY-Yct2JjmHRSAbvY2AIA?e=d2CrQc	Get hash	malicious	Unknown	Browse	52.109.8.89
AMAZON-02US	arm7.elf	Get hash	malicious	Mirai	Browse	13.251.247.130
	lpk.dll	Get hash	malicious	Unknown	Browse	99.84.208.102
	x86.elf	Get hash	malicious	Mirai	Browse	18.196.227.76
	arm7.elf	Get hash	malicious	Mirai	Browse	44.229.157.183
	https://indd.adobe.com/view/a4b3551e-fb20-4176-a450-a3d49c28e11c	Get hash	malicious	Unknown	Browse	99.86.102.53
	KddPKUnEY7.elf	Get hash	malicious	Mirai	Browse	13.238.47.58
	https://indd.adobe.com/view/738ed234-d2b3-427d-925e-2e91c73bcc9c	Get hash	malicious	Unknown	Browse	99.86.229.14
	https://guangyyq.com/login	Get hash	malicious	Unknown	Browse	52.193.160.35
	sora.arm.elf	Get hash	malicious	Mirai	Browse	18.249.16.140
	ztlF9MWoA9.elf	Get hash	malicious	Mirai	Browse	54.219.128.237
	p2hClh5NdZ.elf	Get hash	malicious	Mirai	Browse	54.150.59.202
	z3fYEzpiwC.elf	Get hash	malicious	Mirai	Browse	52.17.28.175
	ia5oWfGclS.elf	Get hash	malicious	Mirai	Browse	157.175.218.216
	https://sube-krediacikdenizbasvurgirisonayi.click/	Get hash	malicious	Unknown	Browse	99.84.191.73
	https://www.dropbox.com/scl/fi/wixtsar1jve2oak92gpd6/Cameron-Lux-Farmers-Union-Insurance-has-a-vital-document-for-you.Check-below-for-the-vital-document-shared.paper?rlkey=s4nqkki1okthmv0wunvifol7u&dl=0	Get hash	malicious	HTMLPhisher	Browse	3.162.112.122
	arm7.elf	Get hash	malicious	Mirai	Browse	157.175.218.35
	https://d2-d7j04.eu1.hubspotlinks.com/Ctc/2N+113/d2-D7j04/VWB4QX5fwHPCW42cVfS3wMTX3W2H1VMy57V5tdN1MKF_83m2ndW8wLKSR6lZ3nkW3w-N_M1snmxsW7sJsgQ16frX2W49JTc65kxnsNW15RLPY7PwHHTW8RY_Z32ZldNbW2znPwl5mcTGZW5R_hSW1fwHfMW7kgGZT1zF7r6W6y3l5p2jVwm2W4WGdBG45_4GWW6JzVYX6GPCZ2W4fK68W84XtxfW8C53tM1JJ1NLN51JvBSxCrdnMZL4FKYd4MWW1sK1_w7FGxb7N77FVBVvQK7vW3hmb-L8jMQRrW77CJdf225svTW49DLHn8rJ7ChW6BTxPM41Ns86VgmTyT6LP2q2W94x92s4MyS9XW4z-HK67-mwPxW3sxytv6-bjcHN5wsG1ZZSWGlW1vPYxG6b90MKW7lMnbp3wclxQf9hpn4j04	Get hash	malicious	Unknown	Browse	52.84.151.43
	https://shankkits.uk	Get hash	malicious	Unknown	Browse	52.51.79.195
	x86.elf	Get hash	malicious	Mirai	Browse	34.216.38.3
	arm7.elf	Get hash	malicious	Mirai	Browse	52.46.126.93

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
1138de370e523e824bbca92d049a3777	https://47.252.0.216/	Get hash	malicious	Unknown	Browse	23.1.237.91
	https://indd.adobe.com/view/738ed234-d2b3-427d-925e-2e91c73bcc9c	Get hash	malicious	Unknown	Browse	23.1.237.91
	https://info-d6776fd98f34bh325f.waste-service.com/verfolgung/2880408?page=037	Get hash	malicious	Unknown	Browse	23.1.237.91
	https://trevorservices.trevor3340.workers.dev/	Get hash	malicious	HTMLPhisher	Browse	23.1.237.91
	https://cloude-dd47.aeancsesekhi.workers.dev/	Get hash	malicious	HTMLPhisher	Browse	23.1.237.91
	Thank You Inv#2024 ADOBE PDF.htm	Get hash	malicious	HTMLPhisher	Browse	23.1.237.91
	https://mufgpw.com/	Get hash	malicious	Unknown	Browse	23.1.237.91
	https://mufgom.com/	Get hash	malicious	Unknown	Browse	23.1.237.91
	https://customervoice.microsoft.com/Pages/ResponsePage.aspx?id=wmNeWLLV4ESFFVLcth9VVNgwr-OMg-1Go9eA620XiABURVNUU0RQVjFRME1PQjZXM1lFNEk5TDVDVC4u	Get hash	malicious	Unknown	Browse	23.1.237.91
	https://dmarleneprodutosregionais.com.br/r/qJU	Get hash	malicious	Unknown	Browse	23.1.237.91
	https://google.us/amp/ip0.ip-51-77-110.eu/cl/40074_md/105/13065/2104/0/0	Get hash	malicious	Unknown	Browse	23.1.237.91
	https://masseuxproform.uk/	Get hash	malicious	Unknown	Browse	23.1.237.91
	https://fvytvgh.blob.core.windows.net/vhgvhcg/6398.html	Get hash	malicious	Phisher	Browse	23.1.237.91
	https://e4bfrhhfr.blob.core.windows.net/eddedews/5673.html	Get hash	malicious	HTMLPhisher	Browse	23.1.237.91
	http://malnutritionandfoodfirst.rdash.nhs.uk	Get hash	malicious	Unknown	Browse	23.1.237.91
	http://mrsbagbag.com/4rUNry2143gMDK263hjjeroetyw14745YCONSOABNTKUDTM99PEOD8633o13	Get hash	malicious	Phisher	Browse	23.1.237.91
	http://mrsbagbag.com/4tkBEH2143PfSu263cgltpebjmi14745AIXOEQYETLDGXMB99RSBE8633F13	Get hash	malicious	Phisher	Browse	23.1.237.91
	https://www.msw-consultants.com/	Get hash	malicious	Unknown	Browse	23.1.237.91
	http://comparisonshoppingpartners.withgoogle.com/	Get hash	malicious	Unknown	Browse	23.1.237.91
	http://kineticwing.com/	Get hash	malicious	Unknown	Browse	23.1.237.91
28a2c9bd18a11de089ef85a160da29e4	http://nervous-seed-snowplow.glitch.me	Get hash	malicious	Unknown	Browse	23.1.244.180 20.12.23.50
	lpk.dll	Get hash	malicious	Unknown	Browse	23.1.244.180 20.12.23.50
	http://getol.xyz/?action=register&chan=THEHUNTER	Get hash	malicious	Unknown	Browse	23.1.244.180 20.12.23.50
	https://indd.adobe.com/view/a4b3551e-fb20-4176-a450-a3d49c28e11c	Get hash	malicious	Unknown	Browse	23.1.244.180 20.12.23.50
	https://38.105.25.233/	Get hash	malicious	Unknown	Browse	23.1.244.180 20.12.23.50
	https://47.252.0.216/	Get hash	malicious	Unknown	Browse	23.1.244.180 20.12.23.50
	https://indd.adobe.com/view/738ed234-d2b3-427d-925e-2e91c73bcc9c	Get hash	malicious	Unknown	Browse	23.1.244.180 20.12.23.50
	https://www.smbc-co.jp.gcguyjav5r7molqmwsxfh.kjfnb.xyz/	Get hash	malicious	Unknown	Browse	23.1.244.180 20.12.23.50
	https://shonetown.com/	Get hash	malicious	Unknown	Browse	23.1.244.180 20.12.23.50
	https://guangyyq.com/login	Get hash	malicious	Unknown	Browse	23.1.244.180 20.12.23.50
	https://info-d6776fd98f34bh325f.waste-service.com/verfolgung/2880408?page=037	Get hash	malicious	Unknown	Browse	23.1.244.180 20.12.23.50
	https://netflixlogin111.blogspot.com/	Get hash	malicious	Unknown	Browse	23.1.244.180 20.12.23.50
	https://trevorservices.trevor3340.workers.dev/	Get hash	malicious	HTMLPhisher	Browse	23.1.244.180 20.12.23.50
	https://bnl-tarif-transaksi.ssd-i.com/Tarif-Transaksi-BNI/	Get hash	malicious	Unknown	Browse	23.1.244.180 20.12.23.50
	http://bakwasnakar.com/web/index.html	Get hash	malicious	Unknown	Browse	23.1.244.180 20.12.23.50
	https://id-f0596.remaxguys.com/verfolgung/rastreo.php?id=4478819&page=305	Get hash	malicious	Unknown	Browse	23.1.244.180 20.12.23.50
	https://cloude-dd47.aeancsesekhi.workers.dev/	Get hash	malicious	HTMLPhisher	Browse	23.1.244.180 20.12.23.50
	Thank You Inv#2024 ADOBE PDF.htm	Get hash	malicious	HTMLPhisher	Browse	23.1.244.180 20.12.23.50
	https://faze44.com/	Get hash	malicious	Unknown	Browse	23.1.244.180 20.12.23.50
	https://sube-krediacikdenizbasvurgirisonayi.click/	Get hash	malicious	Unknown	Browse	23.1.244.180 20.12.23.50

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Jan 5 01:29:32 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.9799698601942515
Encrypted:	false
SSDEEP:	48:8YdhoTBsKwWH2idAKZdA19ehwiZUklqehRy+3:8Nnwfey
MD5:	72C82540A82291FE2F1F6FDEE38E4FDC
SHA1:	7DDF8A17C6C7282173547EE8FAB55DE18C53D9A3
SHA-256:	9AB865206F863346F49C12DE6C8BEBB277D476C4A6F7FCB773071E5830F8BA3B
SHA-512:	9757C888074707F9591AA3A21391918BDA5DB715EC2EDA8138D6B92D817B6399DC6A3DDA61E4201B8B801A257587ACB3B75AB369D3C7B766A4E2FFAF65A43E4E
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,........?..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I%X......B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V%X......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V%X......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V%X............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V%X.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............l.@.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Jan 5 01:29:32 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	3.994793614131305
Encrypted:	false
SSDEEP:	48:8X3dhoTBsKwWH2idAKZdA1weh/iZUkAQkqehOy+2:8knwl9Qjy
MD5:	61BC4D6D12C5ACA14758CA885FED3E4F
SHA1:	0531C257D415F2D36E6BB70D2CD000D3D3FD8665
SHA-256:	B97FB1B78228D9E129FBF651163B4D949EAB961B9786E66C43CFFEC1D145E4FA
SHA-512:	A633CD5A2D1237A0AE6B1D3E3ACD58A1EBC36138600CAC5DC5DF357EC0137F650D4C5C431BAD2EAE6A22C475089FE1812CAB91F6487CB88B80F7290BFFD85C6C
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.........?..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I%X......B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V%X......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V%X......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V%X............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V%X.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............l.@.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 4 12:54:07 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2693
Entropy (8bit):	4.00429158678724
Encrypted:	false
SSDEEP:	48:8xjdhoTBsKsH2idAKZdA14tseh7sFiZUkmgqeh7soy+BX:8xwnfnyy
MD5:	9F4C5D59084895E7DBFF725E7A466E8C
SHA1:	8BC57385BEF9D62EEE3FB1687B2D8ABFC896E99A
SHA-256:	6043D4989DD0034B19C8AD89CDB144E27B43B697CAAFB53352CADCC0A337B4F9
SHA-512:	5BFE2B9DC7AA162B601F1A735B97C97DA7F388DC06CFB8C3A8CDE498BC70E3801B968F1459746C9E20DCED7160C2E9874D2D854EAC8EBFA6A14F64137EB0AF47
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,......e>....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I%X......B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V%X......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V%X......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V%X............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VDW.n...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............l.@.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Jan 5 01:29:32 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.992699044385276
Encrypted:	false
SSDEEP:	48:8EdhoTBsKwWH2idAKZdA1vehDiZUkwqehKy+R:8ZnwmAy
MD5:	B0CF5D531EFE53D539B344236913A988
SHA1:	83EF2DF9962B1A2CCA701BF0C3FD296B08BB25BD
SHA-256:	27D02595D6E781F467A04816C2728800DE4DF9C3B87C0265F1476255032AAE1B
SHA-512:	DAC2689F347985D94061F14C2E697ECC60847DF2B6F24BDA649EBEC165041CEDC210A52B9FB753EC42B263146E0D3C7CE3EFED73E712C187B2BE3F9018B14E6E
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.........?..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I%X......B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V%X......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V%X......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V%X............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V%X.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............l.@.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Jan 5 01:29:32 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.980744940190875
Encrypted:	false
SSDEEP:	48:85dhoTBsKwWH2idAKZdA1hehBiZUk1W1qehMy+C:82nwm9sy
MD5:	99C1352CD641CAA62E59CCA4FE045808
SHA1:	059A2B913C5E3CE6F11EB3B252AE3DAD554279B3
SHA-256:	8FF90456591C6BA6A7866CFF38E6E65EC6681B7B2950C146214EFA5E8D546290
SHA-512:	75C6ABEE87BEE61C5FBF94D08508731CBBCF5A321F2903F73AB83BB240EBD9E1D1376379F9468829326195837B52D89C345D3EF2CE48D5648C5CBAA4479CC8E7
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.........?..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I%X......B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V%X......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V%X......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V%X............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V%X.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............l.@.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Jan 5 01:29:31 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2683
Entropy (8bit):	3.9913709190110467
Encrypted:	false
SSDEEP:	48:8+dhoTBsKwWH2idAKZdA1duT+ehOuTbbiZUk5OjqehOuTbyy+yT+:8znw4T/TbxWOvTbyy7T
MD5:	3A77DAA76B9EFC31C2EA9FD4C7E25455
SHA1:	5199B23C69C64B96EACD342C633889752C80D331
SHA-256:	A1EBAFF77C172B73D95CA7B126AE5696D94A583639D9C52091A9549A33F6AF47
SHA-512:	3DF079314AE7ED392C9811A31C21761946731D578771A2B6AD9B020A5ADBDA8462AA47F04B2168CD4D28DF9DFF7A0D1C608BEEA1CFAA598130A9FC5CF50A9507
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,....n,...?..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I%X......B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V%X......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V%X......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V%X............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V%X.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............l.@.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Chrome Cache Entry: 100

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 533 x 478, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	13339
Entropy (8bit):	7.683569563478597
Encrypted:	false
SSDEEP:	192:zjSKAj04ndWb6OuzZjk6TsEaJS0/bJur2Gz4Imm3MhE4NfM:zutfW69XTspsG3G0TfhEQM
MD5:	512625CF8F40021445D74253DC7C28C0
SHA1:	F6B27CE0F7D4E48E34FDDCA8A96337F07CFFE730
SHA-256:	1D4DCEE8511D5371FEC911660D6049782E12901C662B409A5C675772E9B87369
SHA-512:	AE02319D03884D758A86C286B6F593BDFFD067885D56D82EEB8215FDCB41637C7BB9109039E7FBC93AD246D030C368FB285B3161976ED485ABC5A8DF6DF9A38C
Malicious:	false
Reputation:	moderate, very likely benign file
URL:	https://learn.microsoft.com/en-us/dotnet/framework/install/media/application-not-started/repair-tool-changes-complete.png
Preview:	.PNG........IHDR.............,#......sRGB.........gAMA......a.....pHYs..........o.d..3.IDATx^..].5Y...C.$..tH .NF.I&A0..;.r.fF.#..!7...'..3.0.../..s....."!.y...~....4....om.g.3.BTP......j..g.zVU....u...a.Z..j..U....y......$.....I...pAR...\.T....$.....I...pAR...\.T..p....5O>.d...}Rg.$....@.4....fb1.o.I...7..<.P.....n0.D.P.....n..L.P.....n8.......P.~......n(+..'. ......J.vM,H......W...h.T....$.....I...pAR...\.T....$.....I...pAR...\.T....$.....I...pAR...\.T....$......'....w....g....\|../5_.......T...~.y.'.'.\|...W..[...C.)......\|.[.[WK...w...w..y.{..\|.#.n>...5....5...h>..O6O>.Xx....o.B........g?.........~....?o...w.......}..-_k^........l....\|.D.TH.....o..B'..(.W-%...?...W.......E?h..........~.......?...~,..}...o^...5ox..bI.mo{[s.}.5.<.L.......<......Y.W......K..Q._...Iu...2...e)d]4.}Y..............k.%k..s.'..L(..o4...g...z............N.X.....W.O.^.4.....7......i~._7..~,bI......3.0RRq..\|.Mk..?.{.K_...t.........SYG.W^#).N^..._W...(.8.7.....W....7...m

Chrome Cache Entry: 101

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors
Category:	downloaded
Size (bytes):	17174
Entropy (8bit):	2.9129715116732746
Encrypted:	false
SSDEEP:	24:QSNTmTFxg4lyyyyyyyyyyyyyio7eeeeeeeeekzgsLsLsLsLsLsQZp:nfgyyyyyyyyyyyyynzQQQQQO
MD5:	12E3DAC858061D088023B2BD48E2FA96
SHA1:	E08CE1A144ECEAE0C3C2EA7A9D6FBC5658F24CE5
SHA-256:	90CDAF487716184E4034000935C605D1633926D348116D198F355A98B8C6CD21
SHA-512:	C5030C55A855E7A9E20E22F4C70BF1E0F3C558A9B7D501CFAB6992AC2656AE5E41B050CCAC541EFA55F9603E0D349B247EB4912EE169D44044271789C719CD01
Malicious:	false
URL:	https://learn.microsoft.com/favicon.ico
Preview:	..............h(..f...HH...........(..00......h....6.. ...........=...............@..........(....A..(....................(....................................."P.........................................."""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333""""""""""""""""""""""""""

Chrome Cache Entry: 102

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	5649
Entropy (8bit):	4.827579089865689
Encrypted:	false
SSDEEP:	96:ogtBNUQ5FD4cI3aDNjExAjfWQpL0dpwmWMv7BRevy8RJNjvZPyJ2tlh7RewZUZSr:ogtUcUaDNjESLWQN0dpwm99qllVR7pU8
MD5:	C13D99256A4D6B655EEEC64E5A18B37D
SHA1:	754DB1FEC55D2766D45A68414F0A688BE04E5B9F
SHA-256:	16298AE72C70BAB3FCA5C2491DF8C431098EB85F15971B7769D57F10A79E5F48
SHA-512:	6360B358FC312E9276CAB761904962B6B8016C18F3E8DD7C6A6C6A9CF406C2E05A5F68CFB830330BB2BC06B66F4FFFFE5BDF0A7D3727B3C675C41853AD3A804B
Malicious:	false
Preview:	{"brandLink":{"biName":"learn","displayName":"Learn","href":"/"},"featuredContent":[{"biName":"1-featured-assessment","description":"Wherever you are in your AI journey, Microsoft Learn meets you where you are and helps you deepen your skills.","href":"/en-us/assessments/1c032171-8ca0-4032-8962-a38a5cc424a8/?wt.mc_id=ailearningjourney_rightrail_webpage_wwl","supertitle":"Featured assessment","title":"It\u0027s your AI learning journey"}],"metadata":{"git_commit_id":"9f8beb715bb4b0741b855e57146444d538c4593c"},"navCategories":[{"biName":"1-discover","panel":{"panelContent":[{"biName":"1-documentation","componentType":"header-panel-card","description":"In-depth articles on Microsoft developer tools and technologies","href":"/docs/","title":"Documentation"},{"biName":"2-training","componentType":"header-panel-card","description":"Personalized learning paths and courses","href":"/training/","title":"Training"},{"biName":"3-credentials","componentType":"header-panel-card","description":"Glob

Chrome Cache Entry: 103

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	4.241202481433726
Encrypted:	false
SSDEEP:	3:YozDD/RNgQJzRWWlKFiFD3e4xCzY:YovtNgmzR/wYFDxkY
MD5:	9E576E34B18E986347909C29AE6A82C6
SHA1:	532C767978DC2B55854B3CA2D2DF5B4DB221C934
SHA-256:	88BDF5AF090328963973990DE427779F9C4DF3B8E1F5BADC3D972BAC3087006D
SHA-512:	5EF6DCFFD93434D45760888BF4B95FF134D53F34DA9DC904AD3C5EBEDC58409073483F531FEA4233869ED3EC75F38B022A70B2E179A5D3A13BDB10AB5C46B124
Malicious:	false
Preview:	{"Message":"The requested resource does not support http method 'GET'."}

Chrome Cache Entry: 104

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors
Category:	dropped
Size (bytes):	17174
Entropy (8bit):	2.9129715116732746
Encrypted:	false
SSDEEP:	24:QSNTmTFxg4lyyyyyyyyyyyyyio7eeeeeeeeekzgsLsLsLsLsLsQZp:nfgyyyyyyyyyyyyynzQQQQQO
MD5:	12E3DAC858061D088023B2BD48E2FA96
SHA1:	E08CE1A144ECEAE0C3C2EA7A9D6FBC5658F24CE5
SHA-256:	90CDAF487716184E4034000935C605D1633926D348116D198F355A98B8C6CD21
SHA-512:	C5030C55A855E7A9E20E22F4C70BF1E0F3C558A9B7D501CFAB6992AC2656AE5E41B050CCAC541EFA55F9603E0D349B247EB4912EE169D44044271789C719CD01
Malicious:	false
Preview:	..............h(..f...HH...........(..00......h....6.. ...........=...............@..........(....A..(....................(....................................."P.........................................."""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333""""""""""""""""""""""""""

Chrome Cache Entry: 105

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 658 x 480, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	13842
Entropy (8bit):	7.802399161550213
Encrypted:	false
SSDEEP:	192:NLNf+jBQsDHg7av3EEondO8PuRu2mIYXEIiDm42NpsHFMHfgnJ4K2DVwv:NLt+1jDmY+ndXwjLUpiDwpzfwoDVk
MD5:	F6EC97C43480D41695065AD55A97B382
SHA1:	D9C3D0895A5ED1A3951B8774B519B8217F0A54C5
SHA-256:	07A599FAB1E66BABC430E5FED3029F25FF3F4EA2DD0EC8968FFBA71EF1872F68
SHA-512:	22462763178409D60609761A2AF734F97B35B9A818EC1FD9046AFAB489AAD83CE34896EE8586EFE402EA7739ECF088BC2DB5C1C8E4FB39E6A0FC5B3ADC6B4A9B
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/install/media/application-not-started/install-3-5.png
Preview:	.PNG........IHDR................1....sRGB.........gAMA......a.....pHYs..........o.d..5.IDATx^..[.,.]...../<.!.B(/y..).F\r...!(.H..a ..B.~..A..KXA.M...6..8...!1....l./.X.1....2.`.y"l..R...V.....{...}._gWW.Z.VUw.N...U..P@..... ..@.A...".$..E.I.........$..("H..PD..... ..p....U.}.{.....l..A.....A........s.......D.0...@....E..x........L. /.".A.....$...Y."...%.I..["../.&.I..[`.0..IA.........p4.I.........$..("H..PD..... ..@.A...".$..E.I.........$..("H..PD..... ..@.A...".$..E.>H...O.................?.~.......].7.....a?....(H....m.G..G..a.P..?yo......f?...o. .B.....mo{[....:9<].....7.....a.....S..Cd.5,.R....#....>......._g.....Wo\|.....z.g.........w.T...]x.>.....y(.........6....[..px...U....~.~hu...}H.......~.L... ....r...iY.$..Id..Ax"../....._..U....OTo\|.Mh.km..A.k..k....n.C`\|._\=...o...a.e.. ...&.A2..k.. ....X.+...C..P....y..>.{._..(H....8(.?...w.}M.........:s_!.m.........BY..T..z.5{.W.~..6.....F....bq....m.....?.......v....o..o...ki...iX.$......\]V...V...

Chrome Cache Entry: 106

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (31303), with no line terminators
Category:	dropped
Size (bytes):	31303
Entropy (8bit):	4.892506462241851
Encrypted:	false
SSDEEP:	384:FGvJOb4OLIchlKCnMet7NPXlJl+HjZjBTRdE0zIwHdD9:whOEO8ch3Met7pCjBfF9
MD5:	760955EE70B19FEB1545158DCFC8ACDF
SHA1:	E0FBC5CEA5BE7A9F6A09698C07833E89F4DCB510
SHA-256:	5B715F49891177083D6622A3649C1C059F3F54532B1135DF1D4D70A83487D084
SHA-512:	DB0F37CD609E5E9156CE64A4E0603EC3A0F1249A1DEEABFAEEFD9FC4FBCA1E43059354012BE010BECE85ACA2C9FD957AC92F9424C8EE405EC56F39D6D318C01B
Malicious:	false
Preview:	{"items":[{"href":"./","toc_title":".NET Framework documentation"},{"href":"get-started/overview","toc_title":"Overview of .NET Framework"},{"children":[{"href":"get-started/","toc_title":"Overview"},{"href":"get-started/the-net-framework-and-out-of-band-releases","toc_title":"Out-of-band releases"},{"href":"get-started/system-requirements","toc_title":"System requirements"}],"toc_title":"Get started"},{"children":[{"href":"install/","toc_title":"Overview"},{"href":"install/guide-for-developers","toc_title":"For developers"},{"children":[{"href":"install/on-windows-11","toc_title":"Windows 11"},{"href":"install/on-server-2022","toc_title":"Windows Server 2022"},{"href":"install/on-windows-10","toc_title":"Windows 10 and Windows Server 2016"},{"href":"install/on-windows-8-1","toc_title":"Windows 8.1 and Windows Server 2012 R2"},{"href":"install/on-windows-8","toc_title":"Windows 8 and Windows Server 2012"}],"toc_title":"By OS version"},{"href":"install/repair","toc_title":"Repair .NET f

Chrome Cache Entry: 107

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	5649
Entropy (8bit):	4.827579089865689
Encrypted:	false
SSDEEP:	96:ogtBNUQ5FD4cI3aDNjExAjfWQpL0dpwmWMv7BRevy8RJNjvZPyJ2tlh7RewZUZSr:ogtUcUaDNjESLWQN0dpwm99qllVR7pU8
MD5:	C13D99256A4D6B655EEEC64E5A18B37D
SHA1:	754DB1FEC55D2766D45A68414F0A688BE04E5B9F
SHA-256:	16298AE72C70BAB3FCA5C2491DF8C431098EB85F15971B7769D57F10A79E5F48
SHA-512:	6360B358FC312E9276CAB761904962B6B8016C18F3E8DD7C6A6C6A9CF406C2E05A5F68CFB830330BB2BC06B66F4FFFFE5BDF0A7D3727B3C675C41853AD3A804B
Malicious:	false
URL:	https://learn.microsoft.com/en-us/content-nav/site-header/site-header.json?
Preview:	{"brandLink":{"biName":"learn","displayName":"Learn","href":"/"},"featuredContent":[{"biName":"1-featured-assessment","description":"Wherever you are in your AI journey, Microsoft Learn meets you where you are and helps you deepen your skills.","href":"/en-us/assessments/1c032171-8ca0-4032-8962-a38a5cc424a8/?wt.mc_id=ailearningjourney_rightrail_webpage_wwl","supertitle":"Featured assessment","title":"It\u0027s your AI learning journey"}],"metadata":{"git_commit_id":"9f8beb715bb4b0741b855e57146444d538c4593c"},"navCategories":[{"biName":"1-discover","panel":{"panelContent":[{"biName":"1-documentation","componentType":"header-panel-card","description":"In-depth articles on Microsoft developer tools and technologies","href":"/docs/","title":"Documentation"},{"biName":"2-training","componentType":"header-panel-card","description":"Personalized learning paths and courses","href":"/training/","title":"Training"},{"biName":"3-credentials","componentType":"header-panel-card","description":"Glob

Chrome Cache Entry: 108

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 475 x 212, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	35005
Entropy (8bit):	7.980061050467981
Encrypted:	false
SSDEEP:	768:aHBEr/QXnbCgWotMq4AZZivq2/Qu0cEv1FjHBep6U0Z/68R:ahWqbTWiM7ACvdIdldhep4rR
MD5:	522037F008E03C9448AE0AAAF09E93CB
SHA1:	8A32997EAB79246BEED5A37DB0C92FBFB006BEF2
SHA-256:	983C35607C4FB0B529CA732BE42115D3FCAAC947CEE9C9632F7CACDBDECAF5A7
SHA-512:	643EC613B2E7BDBB2F61E1799C189B0E3392EA5AE10845EB0B1F1542A03569E886F4B54D5B38AF10E78DB49C71357108C94589474B181F6A4573B86CF2D6F0D8
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/install/media/application-not-started/app-could-not-be-started.png
Preview:	.PNG........IHDR..............[.U....sRGB.........gAMA......a.....pHYs..........+.....RIDATx^..`........B hpwww(PJ....R.B.....K[j....@ H ..r:...].P._.`...K.ffg.v.ygf.TM.4.m...`.D".H$......"##..2e.X.t..Y".H$...d..PK.V".H$..uVm.,.H$.....b+.H$.I-#.V".H$.ZF..D".H$...[.D".Hj.)...D"..2Rl%..D".e..J$..DR.H..H$.....b+.H$..9..Neee.X,.B.\/.....o.b+.H$..9...q...EHU....p.....=z....b.7.q..........N.. ....cUAX.9...m'_...2.`.g{...4.H.9.p.4...K ^.....`.\|.n..]..m..`W..W.H.~..\|.^.a..K.6......_....K..w....9......^.....&...R....[...w..Ix=.:..^/..Epp0.5.....QRR...l....S.b.5.c.6...5..8.\....z...I......&.>....../.{.=...]'c......[.E`@Cg......Z.....c.f..,.y\|,.{.o@.j..2..:.&l4.{.]Ll.N.0..b:b...g.n.........I...Ewc....[..,i`v......F...il\|.c,{.-.....%BP.U........y.x....6..E2..n.W...J .*..`..r....F....#BCC......\|.L&........O...'........\.....;...q.n$...7...ga..x....)..A...0.{1..'1../...+yRC...W.-..b..c0dDG...U[po....2eG.G.../.@........h.:.k?.......Q...

Chrome Cache Entry: 109

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	3632
Entropy (8bit):	4.777826373210915
Encrypted:	false
SSDEEP:	48:YZJMIY+D4fCI0CtAhee+LQr+rWBZIzwqLd5hbIYuhfhqMyUImRm1S5:AWIvsf91tAhV+LQr+5wqL1bI59fI2
MD5:	A42627A4ED5AB6350ED00542763B332D
SHA1:	303F051BA4F1B8DFC0B1A822A5294981A76E02BA
SHA-256:	12A36C84DAAC51DBCB204EA01EF9CBA075B909375EAE066D513C510FE28E89E4
SHA-512:	94DF6FE8C7E3FE51217834722E3255E97F664D575F7E99B5436E9D1512B411749314D7CE2CA928F0B6258334546FC2B425B3481AA988C4B48209145916EAF3BD
Malicious:	false
URL:	https://learn.microsoft.com/en-us/content-nav/MSDocsHeader-DotNet.json?
Preview:	{"callToAction":{"primary":{"href":"https://dotnet.microsoft.com/download","kind":"link","title":"Download .NET"}},"category":{"href":"/dotnet/","kind":"link","title":".NET"},"items":[{"items":[{"href":"/dotnet/csharp/","kind":"link","title":"C#"},{"href":"/dotnet/fsharp/","kind":"link","title":"F#"},{"href":"/dotnet/visual-basic/","kind":"link","title":"Visual Basic"}],"kind":"menu","title":"Languages"},{"items":[{"href":"/dotnet/fundamentals/","kind":"link","title":"Fundamentals"},{"href":"/dotnet/navigate/tools-diagnostics/","kind":"link","title":"Tools and diagnostics"},{"href":"/dotnet/navigate/migration-guide/","kind":"link","title":"Migrate from .NET Framework"},{"href":"/dotnet/core/compatibility/breaking-changes/","kind":"link","title":"Compatibility"},{"href":"/dotnet/navigate/advanced-programming/","kind":"link","title":"Advanced programming"},{"href":"/dotnet/navigate/devops-testing/","kind":"link","title":"DevOps and testing"},{"href":"/dotnet/navigate/security/","kind":"l

Chrome Cache Entry: 110

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	4.241202481433726
Encrypted:	false
SSDEEP:	3:YozDD/RNgQJzRWWlKFiFD3e4xCzY:YovtNgmzR/wYFDxkY
MD5:	9E576E34B18E986347909C29AE6A82C6
SHA1:	532C767978DC2B55854B3CA2D2DF5B4DB221C934
SHA-256:	88BDF5AF090328963973990DE427779F9C4DF3B8E1F5BADC3D972BAC3087006D
SHA-512:	5EF6DCFFD93434D45760888BF4B95FF134D53F34DA9DC904AD3C5EBEDC58409073483F531FEA4233869ED3EC75F38B022A70B2E179A5D3A13BDB10AB5C46B124
Malicious:	false
Preview:	{"Message":"The requested resource does not support http method 'GET'."}

Chrome Cache Entry: 111

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	460218
Entropy (8bit):	5.085854368049498
Encrypted:	false
SSDEEP:	6144:3e63j6KCefMvY/0TKPYh6BFPDxZYX04GK7M0:+KCeff/0u8
MD5:	A223E579DF543AA565420F5AC62BA85D
SHA1:	08E30B248B6C62E3118F20EA3C94F11B2CF86E64
SHA-256:	5706D9AC992D508D7B53756A853F756DC940BCEAF4A5D84F9DBA9AB4FFA52F62
SHA-512:	C16CA6AC39D7C5CC5DFD3B5184E4B005B596829C9A5FE6999910F195A2B1A81035825871EC988F821738865475FC2FE54B2FD1F3A231C31E05727879DB13EC6C
Malicious:	false
URL:	https://learn.microsoft.com/_themes/docs.theme/master/en-us/_themes/styles/9f887604.site-ltr.css
Preview:	.CodeMirror{height:300px;color:#000;direction:ltr;font-family:monospace}.CodeMirror-lines{padding:4px 0}.CodeMirror pre.CodeMirror-line,.CodeMirror pre.CodeMirror-line-like{padding:0 4px}.CodeMirror-scrollbar-filler,.CodeMirror-gutter-filler{background-color:#fff}.CodeMirror-gutters{white-space:nowrap;background-color:#f7f7f7;border-right:1px solid #ddd}.CodeMirror-linenumber{min-width:20px;text-align:right;color:#999;white-space:nowrap;padding:0 3px 0 5px}.CodeMirror-guttermarker{color:#000}.CodeMirror-guttermarker-subtle{color:#999}.CodeMirror-cursor{width:0;border-left:1px solid #000;border-right:none}.CodeMirror div.CodeMirror-secondarycursor{border-left:1px solid silver}.cm-fat-cursor .CodeMirror-cursor{width:auto;background:#7e7;border:0!important}.cm-fat-cursor div.CodeMirror-cursors{z-index:1}.cm-fat-cursor .CodeMirror-line::selection,.cm-fat-cursor .CodeMirror-line>span::selection,.cm-fat-cursor .CodeMirror-line>span>span::selection{background:0 0}.cm-fat-cursor{caret-color:#0

Chrome Cache Entry: 112

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (516), with CRLF, LF line terminators
Category:	downloaded
Size (bytes):	50338
Entropy (8bit):	5.046116665915689
Encrypted:	false
SSDEEP:	768:+YDtuN8/zcif/t/60dCkNmrFw1Yn4/1VgMNF5F3E8eYU4EUmB:+6M8/oif/V60dCksrFwO4/4yzRVhUVUq
MD5:	AAEBA471C01D928C431299435388F663
SHA1:	E613E47273A86A82992A75F9003A77930983DDAD
SHA-256:	19F40300DADEB11493AF93F1D86E9CF386803D81D592E5F46962256A324FE421
SHA-512:	45ADBA53B88EA8F43AB4F92670FB7CB2B9A9F95066DFD8790549258D3A23957A6250E7FA8E965953714985873E9162D54FD5984E4BB99879A798B7841BF9EB3B
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=Renewal.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Preview:	<!DOCTYPE html>................................................................................................................<html class="hasSidebar hasPageActions hasBreadcrumb conceptual has-default-focus theme-light" lang="en-us" dir="ltr" data-css-variable-support="true" data-authenticated="false" data-auth-status-determined="false" data-target="docs" x-ms-format-detection="none">....<head>...<meta charset="utf-8" />...<meta name="viewport" content="width=device-width, initial-scale=1.0" />...<meta property="og:title" content="Fix .NET Framework 'This application could not be started' - .NET Framework" />...<meta property="og:type" content="website" />...<meta property="og:url" content="https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started" />.....<meta property="og:description" content="Learn what to do if you see a 'This application could not be started' dialog box when running a .NET Framework application." />.....<meta property="og:image" content=

Chrome Cache Entry: 113

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1154
Entropy (8bit):	4.59126408969148
Encrypted:	false
SSDEEP:	24:txFRuJpzYeGK+VS6ckNL2091JP/UcHc8oQJ1sUWMLc/jH6GbKqjHJIOHA:JsfcU6ckNL2091Z/U/YsUDM+GhS
MD5:	37258A983459AE1C2E4F1E551665F388
SHA1:	603A4E9115E613CC827206CF792C62AEB606C941
SHA-256:	8E34F3807B4BF495D8954E7229681DA8D0DD101DD6DDC2AD7F90CD2983802B44
SHA-512:	184CB63EF510143B0AF013F506411C917D68BB63F2CFA47EA2A42688FD4F55F3B820AF94F87083C24F48AACEE6A692199E185FC5C5CFBED5D70790454EED7F5C
Malicious:	false
URL:	https://learn.microsoft.com/en-us/media/logos/logo_net.svg
Preview:	<svg width="456" height="456" viewBox="0 0 456 456" fill="none" xmlns="http://www.w3.org/2000/svg">..<rect width="456" height="456" fill="#512BD4"/>..<path d="M81.2738 291.333C78.0496 291.333 75.309 290.259 73.052 288.11C70.795 285.906 69.6665 283.289 69.6665 280.259C69.6665 277.173 70.795 274.529 73.052 272.325C75.309 270.121 78.0496 269.019 81.2738 269.019C84.5518 269.019 87.3193 270.121 89.5763 272.325C91.887 274.529 93.0424 277.173 93.0424 280.259C93.0424 283.289 91.887 285.906 89.5763 288.11C87.3193 290.259 84.5518 291.333 81.2738 291.333Z" fill="white"/>..<path d="M210.167 289.515H189.209L133.994 202.406C132.597 200.202 131.441 197.915 130.528 195.546H130.044C130.474 198.081 130.689 203.508 130.689 211.827V289.515H112.149V171H134.477L187.839 256.043C190.096 259.57 191.547 261.994 192.192 263.316H192.514C191.977 260.176 191.708 254.859 191.708 247.365V171H210.167V289.515Z" fill="white"/>..<path d="M300.449 289.515H235.561V171H297.87V187.695H254.746V221.249H294.485V237.861H254.746V

Chrome Cache Entry: 114

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (31303), with no line terminators
Category:	downloaded
Size (bytes):	31303
Entropy (8bit):	4.892506462241851
Encrypted:	false
SSDEEP:	384:FGvJOb4OLIchlKCnMet7NPXlJl+HjZjBTRdE0zIwHdD9:whOEO8ch3Met7pCjBfF9
MD5:	760955EE70B19FEB1545158DCFC8ACDF
SHA1:	E0FBC5CEA5BE7A9F6A09698C07833E89F4DCB510
SHA-256:	5B715F49891177083D6622A3649C1C059F3F54532B1135DF1D4D70A83487D084
SHA-512:	DB0F37CD609E5E9156CE64A4E0603EC3A0F1249A1DEEABFAEEFD9FC4FBCA1E43059354012BE010BECE85ACA2C9FD957AC92F9424C8EE405EC56F39D6D318C01B
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/toc.json
Preview:	{"items":[{"href":"./","toc_title":".NET Framework documentation"},{"href":"get-started/overview","toc_title":"Overview of .NET Framework"},{"children":[{"href":"get-started/","toc_title":"Overview"},{"href":"get-started/the-net-framework-and-out-of-band-releases","toc_title":"Out-of-band releases"},{"href":"get-started/system-requirements","toc_title":"System requirements"}],"toc_title":"Get started"},{"children":[{"href":"install/","toc_title":"Overview"},{"href":"install/guide-for-developers","toc_title":"For developers"},{"children":[{"href":"install/on-windows-11","toc_title":"Windows 11"},{"href":"install/on-server-2022","toc_title":"Windows Server 2022"},{"href":"install/on-windows-10","toc_title":"Windows 10 and Windows Server 2016"},{"href":"install/on-windows-8-1","toc_title":"Windows 8.1 and Windows Server 2012 R2"},{"href":"install/on-windows-8","toc_title":"Windows 8 and Windows Server 2012"}],"toc_title":"By OS version"},{"href":"install/repair","toc_title":"Repair .NET f

Chrome Cache Entry: 115

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 475 x 212, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	35005
Entropy (8bit):	7.980061050467981
Encrypted:	false
SSDEEP:	768:aHBEr/QXnbCgWotMq4AZZivq2/Qu0cEv1FjHBep6U0Z/68R:ahWqbTWiM7ACvdIdldhep4rR
MD5:	522037F008E03C9448AE0AAAF09E93CB
SHA1:	8A32997EAB79246BEED5A37DB0C92FBFB006BEF2
SHA-256:	983C35607C4FB0B529CA732BE42115D3FCAAC947CEE9C9632F7CACDBDECAF5A7
SHA-512:	643EC613B2E7BDBB2F61E1799C189B0E3392EA5AE10845EB0B1F1542A03569E886F4B54D5B38AF10E78DB49C71357108C94589474B181F6A4573B86CF2D6F0D8
Malicious:	false
Preview:	.PNG........IHDR..............[.U....sRGB.........gAMA......a.....pHYs..........+.....RIDATx^..`........B hpwww(PJ....R.B.....K[j....@ H ..r:...].P._.`...K.ffg.v.ygf.TM.4.m...`.D".H$......"##..2e.X.t..Y".H$...d..PK.V".H$..uVm.,.H$.....b+.H$.I-#.V".H$.ZF..D".H$...[.D".Hj.)...D"..2Rl%..D".e..J$..DR.H..H$.....b+.H$..9..Neee.X,.B.\/.....o.b+.H$..9...q...EHU....p.....=z....b.7.q..........N.. ....cUAX.9...m'_...2.`.g{...4.H.9.p.4...K ^.....`.\|.n..]..m..`W..W.H.~..\|.^.a..K.6......_....K..w....9......^.....&...R....[...w..Ix=.:..^/..Epp0.5.....QRR...l....S.b.5.c.6...5..8.\....z...I......&.>....../.{.=...]'c......[.E`@Cg......Z.....c.f..,.y\|,.{.o@.j..2..:.&l4.{.]Ll.N.0..b:b...g.n.........I...Ewc....[..,i`v......F...il\|.c,{.-.....%BP.U........y.x....6..E2..n.W...J .*..`..r....F....#BCC......\|.L&........O...'........\.....;...q.n$...7...ga..x....)..A...0.{1..'1../...+yRC...W.-..b..c0dDG...U[po....2eG.G.../.@........h.:.k?.......Q...

Chrome Cache Entry: 116

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 658 x 480, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	13842
Entropy (8bit):	7.802399161550213
Encrypted:	false
SSDEEP:	192:NLNf+jBQsDHg7av3EEondO8PuRu2mIYXEIiDm42NpsHFMHfgnJ4K2DVwv:NLt+1jDmY+ndXwjLUpiDwpzfwoDVk
MD5:	F6EC97C43480D41695065AD55A97B382
SHA1:	D9C3D0895A5ED1A3951B8774B519B8217F0A54C5
SHA-256:	07A599FAB1E66BABC430E5FED3029F25FF3F4EA2DD0EC8968FFBA71EF1872F68
SHA-512:	22462763178409D60609761A2AF734F97B35B9A818EC1FD9046AFAB489AAD83CE34896EE8586EFE402EA7739ECF088BC2DB5C1C8E4FB39E6A0FC5B3ADC6B4A9B
Malicious:	false
Preview:	.PNG........IHDR................1....sRGB.........gAMA......a.....pHYs..........o.d..5.IDATx^..[.,.]...../<.!.B(/y..).F\r...!(.H..a ..B.~..A..KXA.M...6..8...!1....l./.X.1....2.`.y"l..R...V.....{...}._gWW.Z.VUw.N...U..P@..... ..@.A...".$..E.I.........$..("H..PD..... ..p....U.}.{.....l..A.....A........s.......D.0...@....E..x........L. /.".A.....$...Y."...%.I..["../.&.I..[`.0..IA.........p4.I.........$..("H..PD..... ..@.A...".$..E.I.........$..("H..PD..... ..@.A...".$..E.>H...O.................?.~.......].7.....a?....(H....m.G..G..a.P..?yo......f?...o. .B.....mo{[....:9<].....7.....a.....S..Cd.5,.R....#....>......._g.....Wo\|.....z.g.........w.T...]x.>.....y(.........6....[..px...U....~.~hu...}H.......~.L... ....r...iY.$..Id..Ax"../....._..U....OTo\|.Mh.km..A.k..k....n.C`\|._\=...o...a.e.. ...&.A2..k.. ....X.+...C..P....y..>.{._..(H....8(.?...w.}M.........:s_!.m.........BY..T..z.5{.W.~..6.....F....bq....m.....?.......v....o..o...ki...iX.$......\]V...V...

Chrome Cache Entry: 117

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3632
Entropy (8bit):	4.777826373210915
Encrypted:	false
SSDEEP:	48:YZJMIY+D4fCI0CtAhee+LQr+rWBZIzwqLd5hbIYuhfhqMyUImRm1S5:AWIvsf91tAhV+LQr+5wqL1bI59fI2
MD5:	A42627A4ED5AB6350ED00542763B332D
SHA1:	303F051BA4F1B8DFC0B1A822A5294981A76E02BA
SHA-256:	12A36C84DAAC51DBCB204EA01EF9CBA075B909375EAE066D513C510FE28E89E4
SHA-512:	94DF6FE8C7E3FE51217834722E3255E97F664D575F7E99B5436E9D1512B411749314D7CE2CA928F0B6258334546FC2B425B3481AA988C4B48209145916EAF3BD
Malicious:	false
Preview:	{"callToAction":{"primary":{"href":"https://dotnet.microsoft.com/download","kind":"link","title":"Download .NET"}},"category":{"href":"/dotnet/","kind":"link","title":".NET"},"items":[{"items":[{"href":"/dotnet/csharp/","kind":"link","title":"C#"},{"href":"/dotnet/fsharp/","kind":"link","title":"F#"},{"href":"/dotnet/visual-basic/","kind":"link","title":"Visual Basic"}],"kind":"menu","title":"Languages"},{"items":[{"href":"/dotnet/fundamentals/","kind":"link","title":"Fundamentals"},{"href":"/dotnet/navigate/tools-diagnostics/","kind":"link","title":"Tools and diagnostics"},{"href":"/dotnet/navigate/migration-guide/","kind":"link","title":"Migrate from .NET Framework"},{"href":"/dotnet/core/compatibility/breaking-changes/","kind":"link","title":"Compatibility"},{"href":"/dotnet/navigate/advanced-programming/","kind":"link","title":"Advanced programming"},{"href":"/dotnet/navigate/devops-testing/","kind":"link","title":"DevOps and testing"},{"href":"/dotnet/navigate/security/","kind":"l

Chrome Cache Entry: 118

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	16
Entropy (8bit):	3.875
Encrypted:	false
SSDEEP:	3:HesuCkYn:+s2Y
MD5:	8666ACCA900248B6FF53EF1A2F7D34DB
SHA1:	9A06EB704EC97A663D9B7AB81586E9B65C7E8F87
SHA-256:	FE72C61E5E9D6F17591666FEEBFBDC9D782C1724887401A1EDD1237BEE7D5190
SHA-512:	5EA6AC377210A131293A52C48CF843FDEAB3E32FD1E29D6701D479CB78685E4C95962ABF2DFA5FB5EF5F4DBC79BF832C1947F9B551C4F53C081D4A556CBE2792
Malicious:	false
URL:	https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzISEAkNAwtLDxRgARIFDasRA68=?alt=proto
Preview:	CgkKBw2rEQOvGgA=

Chrome Cache Entry: 119

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65409)
Category:	downloaded
Size (bytes):	185041
Entropy (8bit):	5.415965724989535
Encrypted:	false
SSDEEP:	3072:9r0poOF5Zr0dW2FUsSMecKkjVs6zLK5uAxL1Uo:J0pok0VMMevkj6BNKo
MD5:	9F667FCBE79A2F0A5881315D22CE5B34
SHA1:	745BE50B4AFFBF86A900DBC6FEA9DCADA089C63B
SHA-256:	ED20090AB9EAC537CD83A784F70DD61F1EA14DA013E0E9C38174BFC691353304
SHA-512:	E2FCC27F22C2EA0CA9C00F2A638C53EC322D4D1ADE38570FCEFDD86452090DD5052B9E4EACA409B4542AD5F3C40332314D361FCF7B3460405CD6DFE51748D4DE
Malicious:	false
URL:	https://js.monitor.azure.com/scripts/c/ms.jsll-3.min.js
Preview:	/!. 1DS JSLL SKU, 3.2.14. * Copyright (c) Microsoft and contributors. All rights reserved.. * (Microsoft Internal Only). */.!function(e,t){var n="undefined";if("object"==typeof exports&&typeof module!=n)t(exports);else if("function"==typeof define&&define.amd)define(["exports"],t);else{var r,n=typeof globalThis!=n?globalThis:e\|\|self,i={},e="__ms$mod__",a={},o=a.esm_ms_jsll_3_2_14={},s="3.2.14",c="oneDS3",u=(u=n)[c]=u[c]\|\|{},l=(l=n)[c="oneDS"]=l[c]\|\|{},n=u[e]=u[e]\|\|{},f=n.v=n.v\|\|[],c=l[e]=l[e]\|\|{},d=c.v=c.v\|\|[];for(r in(c.o=c.o\|\|[]).push(a),t(i),i)u[r]=i[r],f[r]=s,l[r]=i[r],d[r]=s,(o.n=o.n\|\|[]).push(r)}}(this,function(u){"use strict";!function(e,t,n){var r=Object.defineProperty;if(r)try{return r(e,t,n)}catch(i){}typeof n.value!==undefined&&(e[t]=n.value)}(u,"__esModule",{value:!0});var l="function",f="object",fe="undefined",j="prototype",d="hasOwnProperty",g=Object,m=g[j],y=g.assign,C=g.create,e=g.defineProperty,E=m[d],b=null;function K(e){e=!1===(e=void 0===e\|\|e)?null:b;return e\|\|((

Chrome Cache Entry: 120

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (32824), with no line terminators
Category:	downloaded
Size (bytes):	32824
Entropy (8bit):	4.713305957345882
Encrypted:	false
SSDEEP:	384:L7UMoRNB1S+i+SkaLBr00lNz6hEpISM3BGE/x9orjDgTDGKvpU:L7qRN21kaLBr0qKvpU
MD5:	2508EE07A05552B2A1B35770302B71E7
SHA1:	6F6C72E2FC5F9C0B4B7D3B133588ACC7F5879CD4
SHA-256:	BFEFD888A35E31BAEEBAB17E7B742E54355FEB64095335AEB637269C7E560B20
SHA-512:	26C894CE1B348D71CE12F02691205D35A06A7A6CCEFA192485BD2742BDDFC1ED3CCA2DD10BEE23F301328E657DEA97AE552BF06E05FEE07F19D941FFA194C0D9
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/breadcrumb/toc.json
Preview:	{"items":[{"children":[{"children":[{"homepage":"/dotnet/api/index","href":"/dotnet/api/","toc_title":"API browser"},{"homepage":"/dotnet/fundamentals/index","href":"/dotnet/fundamentals/","toc_title":"Fundamentals"},{"children":[{"homepage":"/dotnet/standard/assembly/index","href":"/dotnet/standard/assembly","toc_title":"Assemblies in .NET"},{"children":[{"homepage":"/dotnet/standard/collections/thread-safe/index","href":"/dotnet/standard/collections/thread-safe/","toc_title":"Thread-safe collections"}],"homepage":"/dotnet/standard/collections/index","href":"/dotnet/standard/collections/","toc_title":"Collections and data structures"},{"homepage":"/dotnet/standard/datetime/index","href":"/dotnet/standard/datetime/","toc_title":"Dates, times, and time zones"},{"homepage":"/dotnet/standard/globalization-localization/index","href":"/dotnet/standard/globalization-localization/","toc_title":"Globalization and localization"},{"children":[{"homepage":"/dotnet/standard/serialization/system-te

Chrome Cache Entry: 121

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 533 x 478, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	18367
Entropy (8bit):	7.7772261735974215
Encrypted:	false
SSDEEP:	384:4qqZYz7CAda2Qmd6VWWNg9h8XvdkRbdi2nki:1qZYz7Cma2hYNMh8XvdObdi2nX
MD5:	240C4CC15D9FD65405BB642AB81BE615
SHA1:	5A66783FE5DD932082F40811AE0769526874BFD3
SHA-256:	030272CE6BA1BECA700EC83FDED9DBDC89296FBDE0633A7F5943EF5831876C07
SHA-512:	267FE31BC25944DD7B6071C2C2C271CCC188AE1F6A0D7E587DCF9198B81598DA6B058D1B413F228DF0CB37C8304329E808089388359651E81B5F3DEC566D0EE0
Malicious:	false
Preview:	.PNG........IHDR.............,#......sRGB.........gAMA......a.....pHYs..........o.d..GTIDATx^._.}.U.7..BkB.......!E......b.Ej.K...Z...iK.$..h..B`..T.?5.7.I..16$.E.......c...c...Q_V.k...k..g.y.9..G.g..g.9.Z{..Z{.nv....@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...<@v.].../.1R'm.....x..h.....]a1U7........s.......x.h.q.A! ....8IL\GP..............M...W.............D.....dJ<.+,.........W...pgAT...@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...@......P.;/..G....O~..O~...'?......h.....}.y..4/....S..........Y......?..?.g7...G...............x{..w..y.~.9.~.y....y.#.c....<.E.............^..7G.._.u.nv/..f........5.....5?.;...w.....i~.?\|..H+Dd.....Y%....r~.$Q...7.v..._hv..r.O_.4..7M.6....o..=..?....3....?.....xE...O..7....^......D.W....m...6........O..Ob.4.9J........6.;..>.,.....o.l..>%J.V......%k..0.bQqIA..O..y.{.....7.......4_..Za...4.o.....h..........k...M...i....G.4...h.L.#...&.'%...~j..W.*Kx......o.%s.m

Chrome Cache Entry: 86

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with CRLF line terminators
Category:	downloaded
Size (bytes):	1478
Entropy (8bit):	5.030941252322257
Encrypted:	false
SSDEEP:	24:TGAg3Efef6tfTf/fffCfxfdffW4N5f0f8fK8zyRWmmkYRWDKslbzP3LTPv4NUhqI:TK0W6bXnq512ysUbkfKCvUjeGxbu
MD5:	020629EBA820F2E09D8CDA1A753C032B
SHA1:	D91A65036E4C36B07AE3641E32F23F8DD616BD17
SHA-256:	F8AE8A1DC7CE7877B9FB9299183D2EBB3BEFAD0B6489AE785D99047EC2EB92D1
SHA-512:	EF5A5C7A301DE55D103B1BE375D988970D9C4ECD62CE464F730C49E622128F431761D641E1DFAA32CA03F8280B435AE909486806DF62A538B48337725EB63CE1
Malicious:	false
URL:	https://learn.microsoft.com/_themes/docs.theme/master/en-us/_themes/global/67a45209.deprecation.js
Preview:	// ES5 script for back compat with unsupported browsers...!(function () {...'use strict';...// Keep in sync with environment/browser.ts...var supportedBrowser =....typeof Blob === 'function' &&....typeof PerformanceObserver === 'function' &&....typeof Intl === 'object' &&....typeof MutationObserver === 'function' &&....typeof URLSearchParams === 'function' &&....typeof WebSocket === 'function' &&....typeof IntersectionObserver === 'function' &&....typeof queueMicrotask === 'function' &&....typeof TextEncoder === 'function' &&....typeof TextDecoder === 'function' &&....typeof customElements === 'object' &&....typeof HTMLDetailsElement === 'function' &&....typeof AbortController === 'function' &&....typeof AbortSignal === 'function' &&....'entries' in FormData.prototype &&....'toggleAttribute' in Element.prototype &&....'replaceChildren' in Element.prototype &&....// ES2019....'fromEntries' in Object &&....'flatMap' in Array.prototype &&....'trimEnd' in String.prototype &&....// ES2020..

Chrome Cache Entry: 87

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (46312), with CRLF line terminators
Category:	downloaded
Size (bytes):	2203877
Entropy (8bit):	5.502043496926449
Encrypted:	false
SSDEEP:	49152:Wu6zj2dmYXwSB1DkCXW8WMY2OmtwS2BDy/lU16:NeuySB1DkCXWkn
MD5:	5EBE0697B6D9A7173C3C8798660304C0
SHA1:	F68ED45707C2440C106963417EC233367DCE8C76
SHA-256:	AF1A919D9CB6F16510ADBB45B1E6C9A7101F547E8E3FD110FE7CF6CA991123F6
SHA-512:	6AB9009520FB3AF649D6AA6DE696DE8C6A1283485774B105A4FB292409569D0A6A1F99421FAD2822B191D01F3FE694EA4587F2BACB3DFFA6EABCD4222994F219
Malicious:	false
URL:	https://learn.microsoft.com/_themes/docs.theme/master/en-us/_themes/scripts/9d69245e.index-docs.js
Preview:	"use strict";(()=>{var Z3e=Object.create;var Av=Object.defineProperty;var I4=Object.getOwnPropertyDescriptor;var eGe=Object.getOwnPropertyNames;var tGe=Object.getPrototypeOf,oGe=Object.prototype.hasOwnProperty;var rGe=(e,t,o)=>t in e?Av(e,t,{enumerable:!0,configurable:!0,writable:!0,value:o}):e[t]=o;var De=(e,t)=>()=>(t\|\|e((t={exports:{}}).exports,t),t.exports),nGe=(e,t)=>{for(var o in t)Av(e,o,{get:t[o],enumerable:!0})},sGe=(e,t,o,r)=>{if(t&&typeof t=="object"\|\|typeof t=="function")for(let n of eGe(t))!oGe.call(e,n)&&n!==o&&Av(e,n,{get:()=>t[n],enumerable:!(r=I4(t,n))\|\|r.enumerable});return e};var Gp=(e,t,o)=>(o=e!=null?Z3e(tGe(e)):{},sGe(t\|\|!e\|\|!e.__esModule?Av(o,"default",{value:e,enumerable:!0}):o,e));var Y=(e,t,o,r)=>{for(var n=r>1?void 0:r?I4(t,o):t,s=e.length-1,i;s>=0;s--)(i=e[s])&&(n=(r?i(t,o,n):i(n))\|\|n);return r&&n&&Av(t,o,n),n};var pc=(e,t,o)=>(rGe(e,typeof t!="symbol"?t+"":t,o),o);var WO=De((jO,QO)=>{(function(e,t){typeof jO=="object"&&typeof QO<"u"?QO.exports=t():typeof de

Chrome Cache Entry: 88

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 533 x 478, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	13339
Entropy (8bit):	7.683569563478597
Encrypted:	false
SSDEEP:	192:zjSKAj04ndWb6OuzZjk6TsEaJS0/bJur2Gz4Imm3MhE4NfM:zutfW69XTspsG3G0TfhEQM
MD5:	512625CF8F40021445D74253DC7C28C0
SHA1:	F6B27CE0F7D4E48E34FDDCA8A96337F07CFFE730
SHA-256:	1D4DCEE8511D5371FEC911660D6049782E12901C662B409A5C675772E9B87369
SHA-512:	AE02319D03884D758A86C286B6F593BDFFD067885D56D82EEB8215FDCB41637C7BB9109039E7FBC93AD246D030C368FB285B3161976ED485ABC5A8DF6DF9A38C
Malicious:	false
Preview:	.PNG........IHDR.............,#......sRGB.........gAMA......a.....pHYs..........o.d..3.IDATx^..].5Y...C.$..tH .NF.I&A0..;.r.fF.#..!7...'..3.0.../..s....."!.y...~....4....om.g.3.BTP......j..g.zVU....u...a.Z..j..U....y......$.....I...pAR...\.T....$.....I...pAR...\.T..p....5O>.d...}Rg.$....@.4....fb1.o.I...7..<.P.....n0.D.P.....n..L.P.....n8.......P.~......n(+..'. ......J.vM,H......W...h.T....$.....I...pAR...\.T....$.....I...pAR...\.T....$.....I...pAR...\.T....$......'....w....g....\|../5_.......T...~.y.'.'.\|...W..[...C.)......\|.[.[WK...w...w..y.{..\|.#.n>...5....5...h>..O6O>.Xx....o.B........g?.........~....?o...w.......}..-_k^........l....\|.D.TH.....o..B'..(.W-%...?...W.......E?h..........~.......?...~,..}...o^...5ox..bI.mo{[s.}.5.<.L.......<......Y.W......K..Q._...Iu...2...e)d]4.}Y..............k.%k..s.'..L(..o4...g...z............N.X.....W.O.^.4.....7......i~._7..~,bI......3.0RRq..\|.Mk..?.{.K_...t.........SYG.W^#).N^..._W...(.8.7.....W....7...m

Chrome Cache Entry: 89

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 533 x 478, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	18367
Entropy (8bit):	7.7772261735974215
Encrypted:	false
SSDEEP:	384:4qqZYz7CAda2Qmd6VWWNg9h8XvdkRbdi2nki:1qZYz7Cma2hYNMh8XvdObdi2nX
MD5:	240C4CC15D9FD65405BB642AB81BE615
SHA1:	5A66783FE5DD932082F40811AE0769526874BFD3
SHA-256:	030272CE6BA1BECA700EC83FDED9DBDC89296FBDE0633A7F5943EF5831876C07
SHA-512:	267FE31BC25944DD7B6071C2C2C271CCC188AE1F6A0D7E587DCF9198B81598DA6B058D1B413F228DF0CB37C8304329E808089388359651E81B5F3DEC566D0EE0
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/install/media/application-not-started/repair-tool-no-resolution.png
Preview:	.PNG........IHDR.............,#......sRGB.........gAMA......a.....pHYs..........o.d..GTIDATx^._.}.U.7..BkB.......!E......b.Ej.K...Z...iK.$..h..B`..T.?5.7.I..16$.E.......c...c...Q_V.k...k..g.y.9..G.g..g.9.Z{..Z{.nv....@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...<@v.].../.1R'm.....x..h.....]a1U7........s.......x.h.q.A! ....8IL\GP..............M...W.............D.....dJ<.+,.........W...pgAT...@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...@......P.;/..G....O~..O~...'?......h.....}.y..4/....S..........Y......?..?.g7...G...............x{..w..y.~.9.~.y....y.#.c....<.E.............^..7G.._.u.nv/..f........5.....5?.;...w.....i~.?\|..H+Dd.....Y%....r~.$Q...7.v..._hv..r.O_.4..7M.6....o..=..?....3....?.....xE...O..7....^......D.W....m...6........O..Ob.4.9J........6.;..>.,.....o.l..>%J.V......%k..0.bQqIA..O..y.{.....7.......4_..Za...4.o.....h..........k...M...i....G.4...h.L.#...&.'%...~j..W.*Kx......o.%s.m

Chrome Cache Entry: 90

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	1154
Entropy (8bit):	4.59126408969148
Encrypted:	false
SSDEEP:	24:txFRuJpzYeGK+VS6ckNL2091JP/UcHc8oQJ1sUWMLc/jH6GbKqjHJIOHA:JsfcU6ckNL2091Z/U/YsUDM+GhS
MD5:	37258A983459AE1C2E4F1E551665F388
SHA1:	603A4E9115E613CC827206CF792C62AEB606C941
SHA-256:	8E34F3807B4BF495D8954E7229681DA8D0DD101DD6DDC2AD7F90CD2983802B44
SHA-512:	184CB63EF510143B0AF013F506411C917D68BB63F2CFA47EA2A42688FD4F55F3B820AF94F87083C24F48AACEE6A692199E185FC5C5CFBED5D70790454EED7F5C
Malicious:	false
Preview:	<svg width="456" height="456" viewBox="0 0 456 456" fill="none" xmlns="http://www.w3.org/2000/svg">..<rect width="456" height="456" fill="#512BD4"/>..<path d="M81.2738 291.333C78.0496 291.333 75.309 290.259 73.052 288.11C70.795 285.906 69.6665 283.289 69.6665 280.259C69.6665 277.173 70.795 274.529 73.052 272.325C75.309 270.121 78.0496 269.019 81.2738 269.019C84.5518 269.019 87.3193 270.121 89.5763 272.325C91.887 274.529 93.0424 277.173 93.0424 280.259C93.0424 283.289 91.887 285.906 89.5763 288.11C87.3193 290.259 84.5518 291.333 81.2738 291.333Z" fill="white"/>..<path d="M210.167 289.515H189.209L133.994 202.406C132.597 200.202 131.441 197.915 130.528 195.546H130.044C130.474 198.081 130.689 203.508 130.689 211.827V289.515H112.149V171H134.477L187.839 256.043C190.096 259.57 191.547 261.994 192.192 263.316H192.514C191.977 260.176 191.708 254.859 191.708 247.365V171H210.167V289.515Z" fill="white"/>..<path d="M300.449 289.515H235.561V171H297.87V187.695H254.746V221.249H294.485V237.861H254.746V

Chrome Cache Entry: 91

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (32824), with no line terminators
Category:	dropped
Size (bytes):	32824
Entropy (8bit):	4.713305957345882
Encrypted:	false
SSDEEP:	384:L7UMoRNB1S+i+SkaLBr00lNz6hEpISM3BGE/x9orjDgTDGKvpU:L7qRN21kaLBr0qKvpU
MD5:	2508EE07A05552B2A1B35770302B71E7
SHA1:	6F6C72E2FC5F9C0B4B7D3B133588ACC7F5879CD4
SHA-256:	BFEFD888A35E31BAEEBAB17E7B742E54355FEB64095335AEB637269C7E560B20
SHA-512:	26C894CE1B348D71CE12F02691205D35A06A7A6CCEFA192485BD2742BDDFC1ED3CCA2DD10BEE23F301328E657DEA97AE552BF06E05FEE07F19D941FFA194C0D9
Malicious:	false
Preview:	{"items":[{"children":[{"children":[{"homepage":"/dotnet/api/index","href":"/dotnet/api/","toc_title":"API browser"},{"homepage":"/dotnet/fundamentals/index","href":"/dotnet/fundamentals/","toc_title":"Fundamentals"},{"children":[{"homepage":"/dotnet/standard/assembly/index","href":"/dotnet/standard/assembly","toc_title":"Assemblies in .NET"},{"children":[{"homepage":"/dotnet/standard/collections/thread-safe/index","href":"/dotnet/standard/collections/thread-safe/","toc_title":"Thread-safe collections"}],"homepage":"/dotnet/standard/collections/index","href":"/dotnet/standard/collections/","toc_title":"Collections and data structures"},{"homepage":"/dotnet/standard/datetime/index","href":"/dotnet/standard/datetime/","toc_title":"Dates, times, and time zones"},{"homepage":"/dotnet/standard/globalization-localization/index","href":"/dotnet/standard/globalization-localization/","toc_title":"Globalization and localization"},{"children":[{"homepage":"/dotnet/standard/serialization/system-te

Chrome Cache Entry: 92

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 533 x 478, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	15427
Entropy (8bit):	7.784472070227724
Encrypted:	false
SSDEEP:	384:CKKdvwj3SJMpKKKKKKKKikCyKwqHILyPGQV4ykihKKKKKKKCm:CKKdvMMgKKKKKKKKiqB3yPVXkihKKKKI
MD5:	3062488F9D119C0D79448BE06ED140D8
SHA1:	8A148951C894FC9E968D3E46589A2E978267650E
SHA-256:	C47A383DE6DD60149B37DD24825D42D83CB48BE0ED094E3FC3B228D0A7BB9332
SHA-512:	00BBA6BCBFBF44B977129594A47F732809DCE7D4E2D22D050338E4EEA91FCC02A9B333C45EEB4C9024DF076CBDA0B46B621BF48309C0D037D19BBEAE0367F5ED
Malicious:	false
Preview:	.PNG........IHDR.............,#......sRGB.........gAMA......a.....pHYs..........o.d..;.IDATx^..].u.Y..M....B.X...".......@.ZzSys..,H{.Rz!... .......WM.IN..9n..I....g...p<P.0-....\|...X..s...Z.Y{....w..5.._s..x...E.......... ..................... ..................{....2. ...`.$h.......)....,T-x.5......,.."..(.A.......>.. ...`......4..G.\|.....,T-..'. ...`....]........?~.....A...pAP...\.T..........A...pAP...\.T..........A...pAP...\.T..........A...pAP...\.}P../}....TJ...'.O...'?......XH...K..>.b..K/t...o.......T.._.E.....q.$.x..qJ......mo...ww.}.{....W..._...._.^z...........(^x..C..P.../.........U..]../u.....w..{.O.N..o.l........_.^...2.....*....<...iP.W...o......]..+.?}c...t!.....p.=..._x..._yo....?....~u.c?.c1'.....{.^.}.S...5.yMx./.>.lwqq.}.....g..g1wZ..%......h.i[..%ul.&..U.k..";7-.9.6...s..s..0.......}.s..?...c..X...\|..........>.x..o.?.?..{........n..o....]?....Ej..yuu5...A.}....5...^...f........s.qJ..SYF.V...'..q.......T..'..z.....

Chrome Cache Entry: 93

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2108
Entropy (8bit):	5.089949137056051
Encrypted:	false
SSDEEP:	48:YJckl90I99HHJ3PK9t4p73D19RxoVLERiHM1lDej+BxgEZUxHEMicmcJHHxI:gjlJF6t4Z3D1LxLHej+BxgEZ8icJm
MD5:	74902A7AD3F654BC10F912D14D863ACA
SHA1:	9D03C42964888C2A9D9F42C7F6007E113D232553
SHA-256:	68927038A80C5A876BED9A7A68FACCD9E5C4936504C3B42153E45B2D2290B669
SHA-512:	466AEA0749E1ACB0BF478BD69D76906A46D9B45441C00DC6D5F18501409E51A6C7CB557280EF28ED188814209AD732ABB68AFCC0BC960F0343FBD1B802595648
Malicious:	false
Preview:	{"banners":[{"content":{"text":"You may experience reduced functionality with empty pages and broken links. Development is in progress to improve your experience."},"dismissable":false,"location":"sectional","scope":{"accessLevels":["isolated"],"endDate":"2030-01-01T00:00:00-00:00","paths":["/samples/browse/","/lifecycle/products/","/dotnet/api/","/javascript/api/","/java/api/","/powershell/module/","/python/api/","/rest/api/","/assessments/"],"startDate":"2020-10-01T05:00:00-04:00"},"uid":"development-in-progress-isolated"},{"content":{"link":{"href":"/azure/well-architected/whats-new#well-architected-framework-assessments","title":"Learn more"},"text":"Azure Well-Architected Review updated \| The Core Well-Architected Review was rebuilt to align with the refresh of the Azure Well-Architected Framework. As a result, your first new milestone won\u0027t have your previous assessment responses."},"dismissable":true,"location":"sectional","scope":{"accessLevels":["online"],"endDate":"2024-

Chrome Cache Entry: 94

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (54649), with CRLF line terminators
Category:	downloaded
Size (bytes):	106026
Entropy (8bit):	5.171529071699513
Encrypted:	false
SSDEEP:	1536:JXQw7M1QH3FHimDA4A6b3UBm5AcTO5uIod:JXQ2tXUBmhLd
MD5:	A76A653DAAA136B17D3ABB880C159606
SHA1:	CEACBC85439BC26B17CB6B4422A8907CF446469C
SHA-256:	F50053CCD6D8CD18E2736166CE8376BBA8BC673C49AF7D96DFB8DFF7EC9BF715
SHA-512:	3FDAB4797F3CC73F2279887913970146894F441BE361512A2E5D14117B760AA193656B357CE8061E22967354544DC431599C1191860996EC3993FED5CA00B7E0
Malicious:	false
URL:	https://learn.microsoft.com/static/third-party/adobe-target/at-js/2.9.0/at.js
Preview:	// No custom JavaScript../*.. @license.. * at.js 2.9.0 \| (c) Adobe Systems Incorporated \| All rights reserved.. * zepto.js \| (c) 2010-2016 Thomas Fuchs \| zeptojs.com/license..*/..window.adobe=window.adobe\|\|{},window.adobe.target=function(){"use strict";var t=window,e=document,n=!e.documentMode\|\|e.documentMode>=11;var r,o,i,c=e.compatMode&&"CSS1Compat"===e.compatMode&&n&&(r=window.navigator.userAgent,o=r.indexOf("MSIE ")>0,i=r.indexOf("Trident/")>0,!(o\|\|i)),s=t.targetGlobalSettings;if(!c\|\|s&&!1===s.enabled)return t.adobe=t.adobe\|\|{},t.adobe.target={VERSION:"",event:{},getOffer:Ke,getOffers:yt,applyOffer:Ke,applyOffers:yt,sendNotifications:yt,trackEvent:Ke,triggerView:Ke,registerExtension:Ke,init:Ke},t.mboxCreate=Ke,t.mboxDefine=Ke,t.mboxUpdate=Ke,"console"in t&&"warn"in t.console&&(c\|\|t.console.warn("AT: Adobe Target content delivery is disabled. Update your DOCTYPE to support Standards mode."),t.console.warn("AT: Adobe Target content delivery is disabled in targetGlobalSettings.")),

Chrome Cache Entry: 95

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	2108
Entropy (8bit):	5.089949137056051
Encrypted:	false
SSDEEP:	48:YJckl90I99HHJ3PK9t4p73D19RxoVLERiHM1lDej+BxgEZUxHEMicmcJHHxI:gjlJF6t4Z3D1LxLHej+BxgEZ8icJm
MD5:	74902A7AD3F654BC10F912D14D863ACA
SHA1:	9D03C42964888C2A9D9F42C7F6007E113D232553
SHA-256:	68927038A80C5A876BED9A7A68FACCD9E5C4936504C3B42153E45B2D2290B669
SHA-512:	466AEA0749E1ACB0BF478BD69D76906A46D9B45441C00DC6D5F18501409E51A6C7CB557280EF28ED188814209AD732ABB68AFCC0BC960F0343FBD1B802595648
Malicious:	false
URL:	https://learn.microsoft.com/en-us/banners/index.json
Preview:	{"banners":[{"content":{"text":"You may experience reduced functionality with empty pages and broken links. Development is in progress to improve your experience."},"dismissable":false,"location":"sectional","scope":{"accessLevels":["isolated"],"endDate":"2030-01-01T00:00:00-00:00","paths":["/samples/browse/","/lifecycle/products/","/dotnet/api/","/javascript/api/","/java/api/","/powershell/module/","/python/api/","/rest/api/","/assessments/"],"startDate":"2020-10-01T05:00:00-04:00"},"uid":"development-in-progress-isolated"},{"content":{"link":{"href":"/azure/well-architected/whats-new#well-architected-framework-assessments","title":"Learn more"},"text":"Azure Well-Architected Review updated \| The Core Well-Architected Review was rebuilt to align with the refresh of the Azure Well-Architected Framework. As a result, your first new milestone won\u0027t have your previous assessment responses."},"dismissable":true,"location":"sectional","scope":{"accessLevels":["online"],"endDate":"2024-

Chrome Cache Entry: 96

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 533 x 478, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	15427
Entropy (8bit):	7.784472070227724
Encrypted:	false
SSDEEP:	384:CKKdvwj3SJMpKKKKKKKKikCyKwqHILyPGQV4ykihKKKKKKKCm:CKKdvMMgKKKKKKKKiqB3yPVXkihKKKKI
MD5:	3062488F9D119C0D79448BE06ED140D8
SHA1:	8A148951C894FC9E968D3E46589A2E978267650E
SHA-256:	C47A383DE6DD60149B37DD24825D42D83CB48BE0ED094E3FC3B228D0A7BB9332
SHA-512:	00BBA6BCBFBF44B977129594A47F732809DCE7D4E2D22D050338E4EEA91FCC02A9B333C45EEB4C9024DF076CBDA0B46B621BF48309C0D037D19BBEAE0367F5ED
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/install/media/application-not-started/repair-tool-recommended-changes.png
Preview:	.PNG........IHDR.............,#......sRGB.........gAMA......a.....pHYs..........o.d..;.IDATx^..].u.Y..M....B.X...".......@.ZzSys..,H{.Rz!... .......WM.IN..9n..I....g...p<P.0-....\|...X..s...Z.Y{....w..5.._s..x...E.......... ..................... ..................{....2. ...`.$h.......)....,T-x.5......,.."..(.A.......>.. ...`......4..G.\|.....,T-..'. ...`....]........?~.....A...pAP...\.T..........A...pAP...\.T..........A...pAP...\.T..........A...pAP...\.}P../}....TJ...'.O...'?......XH...K..>.b..K/t...o.......T.._.E.....q.$.x..qJ......mo...ww.}.{....W..._...._.^z...........(^x..C..P.../.........U..]../u.....w..{.O.N..o.l........_.^...2.....*....<...iP.W...o......]..+.?}c...t!.....p.=..._x..._yo....?....~u.c?.c1'.....{.^.}.S...5.yMx./.>.lwqq.}.....g..g1wZ..%......h.i[..%ul.&..U.k..";7-.9.6...s..s..0.......}.s..?...c..X...\|..........>.x..o.?.?..{........n..o....]?....Ej..yuu5...A.}....5...^...f........s.qJ..SYF.V...'..q.......T..'..z.....

Chrome Cache Entry: 97

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 18168, version 1.0
Category:	downloaded
Size (bytes):	18168
Entropy (8bit):	7.98771170554982
Encrypted:	false
SSDEEP:	384:ZPWeqUCcmZlYRRDhMnEMYl15U5UsDLVChQ3iLtmu+B5cX55H:ZeeJqQJ8Ql1+UYVwQ3iLMubH
MD5:	79F0E322EF5D42B4A8B773D213E8625C
SHA1:	80E4105E219FE6E081AAD78AB4C6893CEC5E1C7B
SHA-256:	55179F1C4FC5C31596804E8AB649045602CACA8836A77765474E46279A98134E
SHA-512:	22844AAEAF7746D7DDA28B0978C4DC6375C6F0D766A39E2DE99F92EE0EA373375401F5A5EBC6D559FA699F4CC50ED90987CB3A8EE783C54C018E436D06FC0526
Malicious:	false
URL:	https://learn.microsoft.com/_themes/docs.theme/master/en-us/_themes/styles/docons.67869e45.woff2
Preview:	wOF2......F...........F..........................T.V..:......W.6.$..P..j.. ..y.....v7...~w.U!..@Q..U..&PN.....N..c...hNk...:...G.j~..ZsK...,.....u...{.F..U.....4s......A@...[.t..^q.&.ZI{.mu....W..._dXi=..l.n.....]N.g.I....o.._.s....C..IP..{a..`.l...LT.A.../...]._..!...gO..Y..!$....@.DA.+ .D..8......P......C....].rT.g...........i...I...M....0....../W.u.0....0,C..?(.x....f#....A.;....t.Kv'..cX8..$H.&..m.v.5.>P..U@%`I.m.`+..o.O..y....l..jn.(.-9.S............t.R....@....mb.`.U..7L...a_..K"..S........S $...<...."......74..A.....Mx.@.9...... ]..K..1..6...>.?..4..0b-......A.$'.M9..d-(.d..g6e./.....Es...\|.5u}T..[....G.Zx...j.v..4.......ac..z..))...cV7....l..,tF...G}l.@.6......%K..P.....&....J.h...4..q....l).0B...l.@..d`o..J"..?..7..`..2....d4..: ..tAR.Dh.h_.J..>..........!.d..@.T..&6pNGN.....^f.....ui..y.......k.k...0.a..z..v..w..2..~w.....;.~....C...+>........K.....Pm3...@D*HBf'?.4...i....Z.z...}....w?o{...6.....>.o.hc.)..M...r..X.c[j....

Chrome Cache Entry: 98

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (63888), with no line terminators
Category:	downloaded
Size (bytes):	279220
Entropy (8bit):	6.058071014041615
Encrypted:	false
SSDEEP:	6144:dIcsZZWWI0BDqL9W4sC6Hdo7NjIZjIZP0hZRWLF9LmSF/EI:dIcsZtI0BGoHdo7NjIZjIZP0vC75F/x
MD5:	5F524E20CE61F542125454BAF867C47B
SHA1:	7E9834FD30DCFD27532CE79165344A438C31D78B
SHA-256:	C688D3F2135B6B51617A306A0B1A665324402A00A6BCEBA475881AF281503AD9
SHA-512:	224A6E2961C75BE0236140FED3606507BCA49EB10CB13F7DF2BCFBB3B12EBECED7107DE7AA8B2B2BB3FC2AA07CD4F057739735C040EF908381BE5BC86E0479B2
Malicious:	false
URL:	https://wcpstatic.microsoft.com/mscc/lib/v2/wcp-consent.js
Preview:	var WcpConsent;!function(){var e={229:function(e){window,e.exports=function(e){var a={};function i(n){if(a[n])return a[n].exports;var o=a[n]={i:n,l:!1,exports:{}};return e[n].call(o.exports,o,o.exports,i),o.l=!0,o.exports}return i.m=e,i.c=a,i.d=function(e,a,n){i.o(e,a)\|\|Object.defineProperty(e,a,{enumerable:!0,get:n})},i.r=function(e){"undefined"!=typeof Symbol&&Symbol.toStringTag&&Object.defineProperty(e,Symbol.toStringTag,{value:"Module"}),Object.defineProperty(e,"__esModule",{value:!0})},i.t=function(e,a){if(1&a&&(e=i(e)),8&a)return e;if(4&a&&"object"==typeof e&&e&&e.__esModule)return e;var n=Object.create(null);if(i.r(n),Object.defineProperty(n,"default",{enumerable:!0,value:e}),2&a&&"string"!=typeof e)for(var o in e)i.d(n,o,function(a){return e[a]}.bind(null,o));return n},i.n=function(e){var a=e&&e.__esModule?function(){return e.default}:function(){return e};return i.d(a,"a",a),a},i.o=function(e,a){return Object.prototype.hasOwnProperty.call(e,a)},i.p="",i(i.s=3)}([function(e,a,i)

Chrome Cache Entry: 99

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	exported SGML document, ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	1173007
Entropy (8bit):	5.503893944397598
Encrypted:	false
SSDEEP:	24576:VMga+4IVzOjS1Jho1WXQFjTEr39/jHXzT:VMcVzOjS1Jho1WXQar39/bXzT
MD5:	2E00D51C98DBB338E81054F240E1DEB2
SHA1:	D33BAC6B041064AE4330DCC2D958EBE4C28EBE58
SHA-256:	300480069078B5892D2363A2B65E2DFBBF30FE5C80F83EDBFECF4610FD093862
SHA-512:	B6268D980CE9CB729C82DBA22F04FD592952B2A1AAB43079CA5330C68A86E72B0D232CE4070DB893A5054EE5C68325C92C9F1A33F868D61EBB35129E74FC7EF9
Malicious:	false
URL:	https://learn.microsoft.com/static/third-party/MathJax/3.2.2/tex-mml-chtml.js
Preview:	(function(){"use strict";var __webpack_modules__={351:function(t,e,r){var n,o=this&&this.__extends\|\|(n=function(t,e){return n=Object.setPrototypeOf\|\|{__proto__:[]}instanceof Array&&function(t,e){t.__proto__=e}\|\|function(t,e){for(var r in e)Object.prototype.hasOwnProperty.call(e,r)&&(t[r]=e[r])},n(t,e)},function(t,e){if("function"!=typeof e&&null!==e)throw new TypeError("Class extends value "+String(e)+" is not a constructor or null");function r(){this.constructor=t}n(t,e),t.prototype=null===e?Object.create(e):(r.prototype=e.prototype,new r)}),i=this&&this.__assign\|\|function(){return i=Object.assign\|\|function(t){for(var e,r=1,n=arguments.length;r<n;r++)for(var o in e=arguments[r])Object.prototype.hasOwnProperty.call(e,o)&&(t[o]=e[o]);return t},i.apply(this,arguments)},s=this&&this.__read\|\|function(t,e){var r="function"==typeof Symbol&&t[Symbol.iterator];if(!r)return t;var n,o,i=r.call(t),s=[];try{for(;(void 0===e\|\|e-- >0)&&!(n=i.next()).done;)s.push(n.value)}catch(t){o={error:t}}finally

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	5.131280946694984
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.80% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Generic Win/DOS Executable (2004/3) 0.01%
File name:	Renewal.exe
File size:	12'800 bytes
MD5:	e7457fc1fecac4151a1d49b54cf3acd5
SHA1:	cca952ab905f83550a9d4b2cafec99b4e6e2bb17
SHA256:	ccc064b8982473125fd5e30f787d621bd682ffdaa7a6dc5e515a1120bb4c1250
SHA512:	e00a77695ad2b63cb287f74262ed3b6ab64d7ea8393c3e36924e434a45439426c3b45831943fd75e438425d59a03305c30841bdd5d8dac7dd32f8e4cb87fcb12
SSDEEP:	192:zfW+tV4EH+RA6xvHV7V0qfG5/PIBjeCGvLIzOwCCvgLWQhIf2lkiS+gHTMNJ:z++j4EGtfGpkGD8OxugLWz+2UO4
TLSH:	90421A5537ECC337C9BA0BBA5C6321414774B286C563E91E6F88A45F99F370009A3BA3
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...uX1d.................(..........^F... ...`....@.. ....................................`................................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x40465e
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x64315875 [Sat Apr 8 12:05:09 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x460c	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x6000	0x530	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x8000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x44d4	0x1c	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x2664	0x2800	False	0.50615234375	data	5.497172072637766	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x6000	0x530	0x600	False	0.3821614583333333	data	3.8772839360498508	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x8000	0x200	0x200	False	0.044921875	data	0.08153941234324169	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x60a0	0x2a0	data			0.43601190476190477
RT_MANIFEST	0x6340	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5469387755102041

Imports

DLL	Import
mscoree.dll	_CorExeMain

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 5, 2024 03:29:21.741683006 CET	49675	443	192.168.2.5	23.1.237.91
Jan 5, 2024 03:29:21.741683960 CET	49674	443	192.168.2.5	23.1.237.91
Jan 5, 2024 03:29:21.835431099 CET	49673	443	192.168.2.5	23.1.237.91
Jan 5, 2024 03:29:30.527767897 CET	49708	443	192.168.2.5	142.250.115.84
Jan 5, 2024 03:29:30.527791977 CET	443	49708	142.250.115.84	192.168.2.5
Jan 5, 2024 03:29:30.527858973 CET	49708	443	192.168.2.5	142.250.115.84
Jan 5, 2024 03:29:30.528436899 CET	49709	443	192.168.2.5	142.250.114.100
Jan 5, 2024 03:29:30.528450966 CET	443	49709	142.250.114.100	192.168.2.5
Jan 5, 2024 03:29:30.528525114 CET	49709	443	192.168.2.5	142.250.114.100
Jan 5, 2024 03:29:30.528764963 CET	49708	443	192.168.2.5	142.250.115.84
Jan 5, 2024 03:29:30.528778076 CET	443	49708	142.250.115.84	192.168.2.5
Jan 5, 2024 03:29:30.528927088 CET	49709	443	192.168.2.5	142.250.114.100
Jan 5, 2024 03:29:30.528939009 CET	443	49709	142.250.114.100	192.168.2.5
Jan 5, 2024 03:29:30.809540987 CET	443	49709	142.250.114.100	192.168.2.5
Jan 5, 2024 03:29:30.809752941 CET	443	49708	142.250.115.84	192.168.2.5
Jan 5, 2024 03:29:30.810467005 CET	49709	443	192.168.2.5	142.250.114.100
Jan 5, 2024 03:29:30.810486078 CET	443	49709	142.250.114.100	192.168.2.5
Jan 5, 2024 03:29:30.810836077 CET	49708	443	192.168.2.5	142.250.115.84
Jan 5, 2024 03:29:30.810851097 CET	443	49708	142.250.115.84	192.168.2.5
Jan 5, 2024 03:29:30.810888052 CET	443	49709	142.250.114.100	192.168.2.5
Jan 5, 2024 03:29:30.810937881 CET	49709	443	192.168.2.5	142.250.114.100
Jan 5, 2024 03:29:30.811975002 CET	443	49709	142.250.114.100	192.168.2.5
Jan 5, 2024 03:29:30.812021971 CET	49709	443	192.168.2.5	142.250.114.100
Jan 5, 2024 03:29:30.812485933 CET	443	49708	142.250.115.84	192.168.2.5
Jan 5, 2024 03:29:30.812556982 CET	49708	443	192.168.2.5	142.250.115.84
Jan 5, 2024 03:29:30.814898014 CET	49709	443	192.168.2.5	142.250.114.100
Jan 5, 2024 03:29:30.814973116 CET	443	49709	142.250.114.100	192.168.2.5
Jan 5, 2024 03:29:30.815362930 CET	49708	443	192.168.2.5	142.250.115.84
Jan 5, 2024 03:29:30.815468073 CET	443	49708	142.250.115.84	192.168.2.5
Jan 5, 2024 03:29:30.815516949 CET	49709	443	192.168.2.5	142.250.114.100
Jan 5, 2024 03:29:30.815525055 CET	443	49709	142.250.114.100	192.168.2.5
Jan 5, 2024 03:29:30.815716982 CET	49708	443	192.168.2.5	142.250.115.84
Jan 5, 2024 03:29:30.815722942 CET	443	49708	142.250.115.84	192.168.2.5
Jan 5, 2024 03:29:30.867490053 CET	49709	443	192.168.2.5	142.250.114.100
Jan 5, 2024 03:29:30.867681980 CET	49708	443	192.168.2.5	142.250.115.84
Jan 5, 2024 03:29:31.061172009 CET	443	49709	142.250.114.100	192.168.2.5
Jan 5, 2024 03:29:31.061320066 CET	443	49709	142.250.114.100	192.168.2.5
Jan 5, 2024 03:29:31.061520100 CET	49709	443	192.168.2.5	142.250.114.100
Jan 5, 2024 03:29:31.061819077 CET	49709	443	192.168.2.5	142.250.114.100
Jan 5, 2024 03:29:31.061826944 CET	443	49709	142.250.114.100	192.168.2.5
Jan 5, 2024 03:29:31.068747997 CET	443	49708	142.250.115.84	192.168.2.5
Jan 5, 2024 03:29:31.068918943 CET	443	49708	142.250.115.84	192.168.2.5
Jan 5, 2024 03:29:31.068953037 CET	49708	443	192.168.2.5	142.250.115.84
Jan 5, 2024 03:29:31.068974018 CET	49708	443	192.168.2.5	142.250.115.84
Jan 5, 2024 03:29:31.069823027 CET	49708	443	192.168.2.5	142.250.115.84
Jan 5, 2024 03:29:31.069832087 CET	443	49708	142.250.115.84	192.168.2.5
Jan 5, 2024 03:29:31.351711988 CET	49674	443	192.168.2.5	23.1.237.91
Jan 5, 2024 03:29:31.351749897 CET	49675	443	192.168.2.5	23.1.237.91
Jan 5, 2024 03:29:31.444787025 CET	49673	443	192.168.2.5	23.1.237.91
Jan 5, 2024 03:29:32.791594028 CET	49721	443	192.168.2.5	13.107.213.57
Jan 5, 2024 03:29:32.791611910 CET	443	49721	13.107.213.57	192.168.2.5
Jan 5, 2024 03:29:32.791814089 CET	49721	443	192.168.2.5	13.107.213.57
Jan 5, 2024 03:29:32.792263985 CET	49721	443	192.168.2.5	13.107.213.57
Jan 5, 2024 03:29:32.792278051 CET	443	49721	13.107.213.57	192.168.2.5
Jan 5, 2024 03:29:32.801292896 CET	49722	443	192.168.2.5	13.107.213.57
Jan 5, 2024 03:29:32.801322937 CET	443	49722	13.107.213.57	192.168.2.5
Jan 5, 2024 03:29:32.801717043 CET	49722	443	192.168.2.5	13.107.213.57
Jan 5, 2024 03:29:32.802175999 CET	49722	443	192.168.2.5	13.107.213.57
Jan 5, 2024 03:29:32.802195072 CET	443	49722	13.107.213.57	192.168.2.5
Jan 5, 2024 03:29:32.802634001 CET	443	49703	23.1.237.91	192.168.2.5
Jan 5, 2024 03:29:32.802726984 CET	49703	443	192.168.2.5	23.1.237.91
Jan 5, 2024 03:29:33.171252012 CET	443	49721	13.107.213.57	192.168.2.5
Jan 5, 2024 03:29:33.177063942 CET	49721	443	192.168.2.5	13.107.213.57
Jan 5, 2024 03:29:33.177084923 CET	443	49721	13.107.213.57	192.168.2.5
Jan 5, 2024 03:29:33.178117990 CET	443	49721	13.107.213.57	192.168.2.5
Jan 5, 2024 03:29:33.178198099 CET	49721	443	192.168.2.5	13.107.213.57
Jan 5, 2024 03:29:33.179455042 CET	443	49722	13.107.213.57	192.168.2.5
Jan 5, 2024 03:29:33.181090117 CET	49722	443	192.168.2.5	13.107.213.57
Jan 5, 2024 03:29:33.181109905 CET	443	49722	13.107.213.57	192.168.2.5
Jan 5, 2024 03:29:33.182231903 CET	443	49722	13.107.213.57	192.168.2.5
Jan 5, 2024 03:29:33.182286978 CET	49722	443	192.168.2.5	13.107.213.57
Jan 5, 2024 03:29:33.182332993 CET	49721	443	192.168.2.5	13.107.213.57
Jan 5, 2024 03:29:33.182389975 CET	443	49721	13.107.213.57	192.168.2.5
Jan 5, 2024 03:29:33.182852983 CET	49721	443	192.168.2.5	13.107.213.57
Jan 5, 2024 03:29:33.182858944 CET	443	49721	13.107.213.57	192.168.2.5
Jan 5, 2024 03:29:33.183259010 CET	49722	443	192.168.2.5	13.107.213.57
Jan 5, 2024 03:29:33.183324099 CET	443	49722	13.107.213.57	192.168.2.5
Jan 5, 2024 03:29:33.183449030 CET	49722	443	192.168.2.5	13.107.213.57
Jan 5, 2024 03:29:33.183455944 CET	443	49722	13.107.213.57	192.168.2.5
Jan 5, 2024 03:29:33.226480007 CET	49722	443	192.168.2.5	13.107.213.57
Jan 5, 2024 03:29:33.226485968 CET	49721	443	192.168.2.5	13.107.213.57
Jan 5, 2024 03:29:33.445405006 CET	443	49722	13.107.213.57	192.168.2.5
Jan 5, 2024 03:29:33.445425034 CET	443	49722	13.107.213.57	192.168.2.5
Jan 5, 2024 03:29:33.445432901 CET	443	49722	13.107.213.57	192.168.2.5
Jan 5, 2024 03:29:33.445465088 CET	443	49722	13.107.213.57	192.168.2.5
Jan 5, 2024 03:29:33.445486069 CET	49722	443	192.168.2.5	13.107.213.57
Jan 5, 2024 03:29:33.445494890 CET	443	49722	13.107.213.57	192.168.2.5
Jan 5, 2024 03:29:33.445499897 CET	443	49722	13.107.213.57	192.168.2.5
Jan 5, 2024 03:29:33.445509911 CET	443	49722	13.107.213.57	192.168.2.5
Jan 5, 2024 03:29:33.445513010 CET	49722	443	192.168.2.5	13.107.213.57
Jan 5, 2024 03:29:33.445532084 CET	443	49722	13.107.213.57	192.168.2.5
Jan 5, 2024 03:29:33.445542097 CET	49722	443	192.168.2.5	13.107.213.57
Jan 5, 2024 03:29:33.445563078 CET	49722	443	192.168.2.5	13.107.213.57
Jan 5, 2024 03:29:33.445568085 CET	443	49722	13.107.213.57	192.168.2.5
Jan 5, 2024 03:29:33.445595026 CET	49722	443	192.168.2.5	13.107.213.57
Jan 5, 2024 03:29:33.445620060 CET	49722	443	192.168.2.5	13.107.213.57
Jan 5, 2024 03:29:33.446002960 CET	443	49721	13.107.213.57	192.168.2.5
Jan 5, 2024 03:29:33.446033955 CET	443	49721	13.107.213.57	192.168.2.5
Jan 5, 2024 03:29:33.446060896 CET	443	49721	13.107.213.57	192.168.2.5
Jan 5, 2024 03:29:33.446069956 CET	443	49721	13.107.213.57	192.168.2.5
Jan 5, 2024 03:29:33.446082115 CET	49721	443	192.168.2.5	13.107.213.57
Jan 5, 2024 03:29:33.446086884 CET	443	49721	13.107.213.57	192.168.2.5
Jan 5, 2024 03:29:33.446095943 CET	443	49721	13.107.213.57	192.168.2.5
Jan 5, 2024 03:29:33.446124077 CET	49721	443	192.168.2.5	13.107.213.57
Jan 5, 2024 03:29:33.446132898 CET	49721	443	192.168.2.5	13.107.213.57
Jan 5, 2024 03:29:33.446427107 CET	443	49721	13.107.213.57	192.168.2.5
Jan 5, 2024 03:29:33.446455002 CET	443	49721	13.107.213.57	192.168.2.5
Jan 5, 2024 03:29:33.446489096 CET	49721	443	192.168.2.5	13.107.213.57
Jan 5, 2024 03:29:33.446494102 CET	443	49721	13.107.213.57	192.168.2.5
Jan 5, 2024 03:29:33.446516037 CET	49721	443	192.168.2.5	13.107.213.57
Jan 5, 2024 03:29:33.446527958 CET	49721	443	192.168.2.5	13.107.213.57
Jan 5, 2024 03:29:33.568582058 CET	443	49721	13.107.213.57	192.168.2.5
Jan 5, 2024 03:29:33.568600893 CET	443	49721	13.107.213.57	192.168.2.5
Jan 5, 2024 03:29:33.568677902 CET	49721	443	192.168.2.5	13.107.213.57
Jan 5, 2024 03:29:33.568684101 CET	443	49721	13.107.213.57	192.168.2.5
Jan 5, 2024 03:29:33.568732023 CET	49721	443	192.168.2.5	13.107.213.57
Jan 5, 2024 03:29:33.569125891 CET	443	49721	13.107.213.57	192.168.2.5
Jan 5, 2024 03:29:33.569143057 CET	443	49721	13.107.213.57	192.168.2.5
Jan 5, 2024 03:29:33.569210052 CET	49721	443	192.168.2.5	13.107.213.57
Jan 5, 2024 03:29:33.569214106 CET	443	49721	13.107.213.57	192.168.2.5
Jan 5, 2024 03:29:33.569303989 CET	49721	443	192.168.2.5	13.107.213.57
Jan 5, 2024 03:29:33.570075989 CET	443	49722	13.107.213.57	192.168.2.5
Jan 5, 2024 03:29:33.570099115 CET	443	49722	13.107.213.57	192.168.2.5
Jan 5, 2024 03:29:33.570144892 CET	49722	443	192.168.2.5	13.107.213.57
Jan 5, 2024 03:29:33.570169926 CET	443	49722	13.107.213.57	192.168.2.5
Jan 5, 2024 03:29:33.570190907 CET	49722	443	192.168.2.5	13.107.213.57
Jan 5, 2024 03:29:33.570207119 CET	49722	443	192.168.2.5	13.107.213.57
Jan 5, 2024 03:29:33.570411921 CET	443	49722	13.107.213.57	192.168.2.5
Jan 5, 2024 03:29:33.570427895 CET	443	49722	13.107.213.57	192.168.2.5
Jan 5, 2024 03:29:33.570472002 CET	49722	443	192.168.2.5	13.107.213.57
Jan 5, 2024 03:29:33.570480108 CET	443	49722	13.107.213.57	192.168.2.5
Jan 5, 2024 03:29:33.570516109 CET	49722	443	192.168.2.5	13.107.213.57
Jan 5, 2024 03:29:33.571002960 CET	443	49722	13.107.213.57	192.168.2.5
Jan 5, 2024 03:29:33.571021080 CET	443	49722	13.107.213.57	192.168.2.5
Jan 5, 2024 03:29:33.571069956 CET	49722	443	192.168.2.5	13.107.213.57
Jan 5, 2024 03:29:33.571077108 CET	443	49722	13.107.213.57	192.168.2.5
Jan 5, 2024 03:29:33.571111917 CET	49722	443	192.168.2.5	13.107.213.57
Jan 5, 2024 03:29:33.571985960 CET	443	49721	13.107.213.57	192.168.2.5
Jan 5, 2024 03:29:33.572001934 CET	443	49721	13.107.213.57	192.168.2.5
Jan 5, 2024 03:29:33.572046041 CET	49721	443	192.168.2.5	13.107.213.57
Jan 5, 2024 03:29:33.572051048 CET	443	49721	13.107.213.57	192.168.2.5
Jan 5, 2024 03:29:33.572160959 CET	49721	443	192.168.2.5	13.107.213.57
Jan 5, 2024 03:29:33.691932917 CET	443	49721	13.107.213.57	192.168.2.5
Jan 5, 2024 03:29:33.691951036 CET	443	49721	13.107.213.57	192.168.2.5
Jan 5, 2024 03:29:33.692009926 CET	49721	443	192.168.2.5	13.107.213.57
Jan 5, 2024 03:29:33.692018032 CET	443	49721	13.107.213.57	192.168.2.5
Jan 5, 2024 03:29:33.692039013 CET	49721	443	192.168.2.5	13.107.213.57
Jan 5, 2024 03:29:33.692054987 CET	49721	443	192.168.2.5	13.107.213.57
Jan 5, 2024 03:29:33.692205906 CET	443	49721	13.107.213.57	192.168.2.5
Jan 5, 2024 03:29:33.692219973 CET	443	49721	13.107.213.57	192.168.2.5
Jan 5, 2024 03:29:33.692253113 CET	49721	443	192.168.2.5	13.107.213.57
Jan 5, 2024 03:29:33.692255974 CET	443	49721	13.107.213.57	192.168.2.5
Jan 5, 2024 03:29:33.692286015 CET	49721	443	192.168.2.5	13.107.213.57
Jan 5, 2024 03:29:33.692301035 CET	49721	443	192.168.2.5	13.107.213.57
Jan 5, 2024 03:29:33.692466974 CET	443	49721	13.107.213.57	192.168.2.5
Jan 5, 2024 03:29:33.692481041 CET	443	49721	13.107.213.57	192.168.2.5
Jan 5, 2024 03:29:33.692514896 CET	49721	443	192.168.2.5	13.107.213.57
Jan 5, 2024 03:29:33.692517996 CET	443	49721	13.107.213.57	192.168.2.5
Jan 5, 2024 03:29:33.692554951 CET	49721	443	192.168.2.5	13.107.213.57
Jan 5, 2024 03:29:33.692574978 CET	49721	443	192.168.2.5	13.107.213.57
Jan 5, 2024 03:29:33.692965031 CET	443	49722	13.107.213.57	192.168.2.5
Jan 5, 2024 03:29:33.692982912 CET	443	49722	13.107.213.57	192.168.2.5
Jan 5, 2024 03:29:33.693010092 CET	443	49722	13.107.213.57	192.168.2.5
Jan 5, 2024 03:29:33.693018913 CET	49722	443	192.168.2.5	13.107.213.57
Jan 5, 2024 03:29:33.693039894 CET	443	49722	13.107.213.57	192.168.2.5
Jan 5, 2024 03:29:33.693049908 CET	49722	443	192.168.2.5	13.107.213.57
Jan 5, 2024 03:29:33.693512917 CET	443	49722	13.107.213.57	192.168.2.5
Jan 5, 2024 03:29:33.693547964 CET	443	49722	13.107.213.57	192.168.2.5
Jan 5, 2024 03:29:33.693559885 CET	49722	443	192.168.2.5	13.107.213.57
Jan 5, 2024 03:29:33.693567991 CET	443	49722	13.107.213.57	192.168.2.5
Jan 5, 2024 03:29:33.693586111 CET	49722	443	192.168.2.5	13.107.213.57
Jan 5, 2024 03:29:33.693918943 CET	443	49722	13.107.213.57	192.168.2.5
Jan 5, 2024 03:29:33.693933964 CET	443	49722	13.107.213.57	192.168.2.5
Jan 5, 2024 03:29:33.693969965 CET	49722	443	192.168.2.5	13.107.213.57
Jan 5, 2024 03:29:33.693977118 CET	443	49722	13.107.213.57	192.168.2.5
Jan 5, 2024 03:29:33.693991899 CET	49722	443	192.168.2.5	13.107.213.57
Jan 5, 2024 03:29:33.694194078 CET	443	49722	13.107.213.57	192.168.2.5
Jan 5, 2024 03:29:33.694211960 CET	443	49722	13.107.213.57	192.168.2.5
Jan 5, 2024 03:29:33.694241047 CET	49722	443	192.168.2.5	13.107.213.57
Jan 5, 2024 03:29:33.694247007 CET	443	49722	13.107.213.57	192.168.2.5
Jan 5, 2024 03:29:33.694263935 CET	49722	443	192.168.2.5	13.107.213.57
Jan 5, 2024 03:29:33.694524050 CET	443	49722	13.107.213.57	192.168.2.5
Jan 5, 2024 03:29:33.694536924 CET	443	49722	13.107.213.57	192.168.2.5
Jan 5, 2024 03:29:33.694540024 CET	443	49721	13.107.213.57	192.168.2.5
Jan 5, 2024 03:29:33.694555044 CET	443	49721	13.107.213.57	192.168.2.5
Jan 5, 2024 03:29:33.694571972 CET	49722	443	192.168.2.5	13.107.213.57
Jan 5, 2024 03:29:33.694581032 CET	443	49722	13.107.213.57	192.168.2.5
Jan 5, 2024 03:29:33.694639921 CET	49721	443	192.168.2.5	13.107.213.57
Jan 5, 2024 03:29:33.694644928 CET	443	49721	13.107.213.57	192.168.2.5
Jan 5, 2024 03:29:33.694672108 CET	49722	443	192.168.2.5	13.107.213.57
Jan 5, 2024 03:29:33.694689989 CET	49721	443	192.168.2.5	13.107.213.57
Jan 5, 2024 03:29:33.696595907 CET	443	49721	13.107.213.57	192.168.2.5
Jan 5, 2024 03:29:33.696609974 CET	443	49721	13.107.213.57	192.168.2.5
Jan 5, 2024 03:29:33.696647882 CET	49721	443	192.168.2.5	13.107.213.57
Jan 5, 2024 03:29:33.696651936 CET	443	49721	13.107.213.57	192.168.2.5
Jan 5, 2024 03:29:33.696677923 CET	49721	443	192.168.2.5	13.107.213.57
Jan 5, 2024 03:29:33.696703911 CET	49721	443	192.168.2.5	13.107.213.57
Jan 5, 2024 03:29:33.696773052 CET	443	49721	13.107.213.57	192.168.2.5
Jan 5, 2024 03:29:33.696785927 CET	443	49721	13.107.213.57	192.168.2.5
Jan 5, 2024 03:29:33.696830034 CET	49721	443	192.168.2.5	13.107.213.57
Jan 5, 2024 03:29:33.696834087 CET	443	49721	13.107.213.57	192.168.2.5
Jan 5, 2024 03:29:33.696860075 CET	49721	443	192.168.2.5	13.107.213.57
Jan 5, 2024 03:29:33.696885109 CET	49721	443	192.168.2.5	13.107.213.57
Jan 5, 2024 03:29:33.696888924 CET	443	49721	13.107.213.57	192.168.2.5
Jan 5, 2024 03:29:33.696897984 CET	443	49721	13.107.213.57	192.168.2.5
Jan 5, 2024 03:29:33.696926117 CET	49721	443	192.168.2.5	13.107.213.57
Jan 5, 2024 03:29:33.696957111 CET	443	49721	13.107.213.57	192.168.2.5
Jan 5, 2024 03:29:33.696978092 CET	49721	443	192.168.2.5	13.107.213.57
Jan 5, 2024 03:29:33.697012901 CET	49721	443	192.168.2.5	13.107.213.57
Jan 5, 2024 03:29:33.699548960 CET	49721	443	192.168.2.5	13.107.213.57
Jan 5, 2024 03:29:33.699558020 CET	443	49721	13.107.213.57	192.168.2.5
Jan 5, 2024 03:29:33.732812881 CET	443	49722	13.107.213.57	192.168.2.5
Jan 5, 2024 03:29:33.732831955 CET	443	49722	13.107.213.57	192.168.2.5
Jan 5, 2024 03:29:33.732891083 CET	49722	443	192.168.2.5	13.107.213.57
Jan 5, 2024 03:29:33.732906103 CET	443	49722	13.107.213.57	192.168.2.5
Jan 5, 2024 03:29:33.773212910 CET	49722	443	192.168.2.5	13.107.213.57
Jan 5, 2024 03:29:33.815831900 CET	443	49722	13.107.213.57	192.168.2.5
Jan 5, 2024 03:29:33.815846920 CET	443	49722	13.107.213.57	192.168.2.5
Jan 5, 2024 03:29:33.815910101 CET	49722	443	192.168.2.5	13.107.213.57
Jan 5, 2024 03:29:33.815927029 CET	443	49722	13.107.213.57	192.168.2.5
Jan 5, 2024 03:29:33.815963984 CET	49722	443	192.168.2.5	13.107.213.57
Jan 5, 2024 03:29:33.816593885 CET	443	49722	13.107.213.57	192.168.2.5
Jan 5, 2024 03:29:33.816617966 CET	443	49722	13.107.213.57	192.168.2.5
Jan 5, 2024 03:29:33.816647053 CET	49722	443	192.168.2.5	13.107.213.57
Jan 5, 2024 03:29:33.816660881 CET	443	49722	13.107.213.57	192.168.2.5
Jan 5, 2024 03:29:33.816677094 CET	49722	443	192.168.2.5	13.107.213.57
Jan 5, 2024 03:29:33.816699982 CET	49722	443	192.168.2.5	13.107.213.57
Jan 5, 2024 03:29:33.816803932 CET	443	49722	13.107.213.57	192.168.2.5
Jan 5, 2024 03:29:33.816824913 CET	443	49722	13.107.213.57	192.168.2.5
Jan 5, 2024 03:29:33.816860914 CET	443	49722	13.107.213.57	192.168.2.5
Jan 5, 2024 03:29:33.816864967 CET	49722	443	192.168.2.5	13.107.213.57
Jan 5, 2024 03:29:33.816870928 CET	443	49722	13.107.213.57	192.168.2.5
Jan 5, 2024 03:29:33.816912889 CET	49722	443	192.168.2.5	13.107.213.57
Jan 5, 2024 03:29:33.817048073 CET	443	49722	13.107.213.57	192.168.2.5
Jan 5, 2024 03:29:33.817063093 CET	443	49722	13.107.213.57	192.168.2.5
Jan 5, 2024 03:29:33.817100048 CET	49722	443	192.168.2.5	13.107.213.57
Jan 5, 2024 03:29:33.817109108 CET	443	49722	13.107.213.57	192.168.2.5
Jan 5, 2024 03:29:33.817122936 CET	49722	443	192.168.2.5	13.107.213.57
Jan 5, 2024 03:29:33.817426920 CET	443	49722	13.107.213.57	192.168.2.5
Jan 5, 2024 03:29:33.817445993 CET	443	49722	13.107.213.57	192.168.2.5
Jan 5, 2024 03:29:33.817473888 CET	49722	443	192.168.2.5	13.107.213.57
Jan 5, 2024 03:29:33.817480087 CET	443	49722	13.107.213.57	192.168.2.5
Jan 5, 2024 03:29:33.817507029 CET	49722	443	192.168.2.5	13.107.213.57
Jan 5, 2024 03:29:33.817513943 CET	443	49722	13.107.213.57	192.168.2.5
Jan 5, 2024 03:29:33.817543030 CET	443	49722	13.107.213.57	192.168.2.5
Jan 5, 2024 03:29:33.817552090 CET	49722	443	192.168.2.5	13.107.213.57
Jan 5, 2024 03:29:33.817563057 CET	443	49722	13.107.213.57	192.168.2.5
Jan 5, 2024 03:29:33.817580938 CET	49722	443	192.168.2.5	13.107.213.57
Jan 5, 2024 03:29:33.817593098 CET	443	49722	13.107.213.57	192.168.2.5
Jan 5, 2024 03:29:33.817631960 CET	49722	443	192.168.2.5	13.107.213.57
Jan 5, 2024 03:29:33.818128109 CET	49722	443	192.168.2.5	13.107.213.57
Jan 5, 2024 03:29:33.818145037 CET	443	49722	13.107.213.57	192.168.2.5
Jan 5, 2024 03:29:34.212030888 CET	49730	443	192.168.2.5	52.34.144.49
Jan 5, 2024 03:29:34.212038994 CET	443	49730	52.34.144.49	192.168.2.5
Jan 5, 2024 03:29:34.212111950 CET	49730	443	192.168.2.5	52.34.144.49
Jan 5, 2024 03:29:34.212928057 CET	49730	443	192.168.2.5	52.34.144.49
Jan 5, 2024 03:29:34.212938070 CET	443	49730	52.34.144.49	192.168.2.5
Jan 5, 2024 03:29:34.579005003 CET	443	49730	52.34.144.49	192.168.2.5
Jan 5, 2024 03:29:34.584095001 CET	49730	443	192.168.2.5	52.34.144.49
Jan 5, 2024 03:29:34.584115982 CET	443	49730	52.34.144.49	192.168.2.5
Jan 5, 2024 03:29:34.585999012 CET	443	49730	52.34.144.49	192.168.2.5
Jan 5, 2024 03:29:34.586091042 CET	49730	443	192.168.2.5	52.34.144.49
Jan 5, 2024 03:29:34.588459015 CET	49730	443	192.168.2.5	52.34.144.49
Jan 5, 2024 03:29:34.588560104 CET	443	49730	52.34.144.49	192.168.2.5
Jan 5, 2024 03:29:34.630918980 CET	49730	443	192.168.2.5	52.34.144.49
Jan 5, 2024 03:29:34.630937099 CET	443	49730	52.34.144.49	192.168.2.5
Jan 5, 2024 03:29:34.678122044 CET	49730	443	192.168.2.5	52.34.144.49
Jan 5, 2024 03:29:34.697937965 CET	49740	443	192.168.2.5	142.251.116.104
Jan 5, 2024 03:29:34.697981119 CET	443	49740	142.251.116.104	192.168.2.5
Jan 5, 2024 03:29:34.698092937 CET	49740	443	192.168.2.5	142.251.116.104
Jan 5, 2024 03:29:34.698729038 CET	49740	443	192.168.2.5	142.251.116.104
Jan 5, 2024 03:29:34.698750019 CET	443	49740	142.251.116.104	192.168.2.5
Jan 5, 2024 03:29:34.968704939 CET	443	49740	142.251.116.104	192.168.2.5
Jan 5, 2024 03:29:34.969058037 CET	49740	443	192.168.2.5	142.251.116.104
Jan 5, 2024 03:29:34.969089985 CET	443	49740	142.251.116.104	192.168.2.5
Jan 5, 2024 03:29:34.970074892 CET	443	49740	142.251.116.104	192.168.2.5
Jan 5, 2024 03:29:34.970134974 CET	49740	443	192.168.2.5	142.251.116.104
Jan 5, 2024 03:29:34.971307039 CET	49740	443	192.168.2.5	142.251.116.104
Jan 5, 2024 03:29:34.971362114 CET	443	49740	142.251.116.104	192.168.2.5
Jan 5, 2024 03:29:35.024426937 CET	49740	443	192.168.2.5	142.251.116.104
Jan 5, 2024 03:29:35.024440050 CET	443	49740	142.251.116.104	192.168.2.5
Jan 5, 2024 03:29:35.070413113 CET	49740	443	192.168.2.5	142.251.116.104
Jan 5, 2024 03:29:35.193200111 CET	49741	443	192.168.2.5	23.1.244.180
Jan 5, 2024 03:29:35.193233967 CET	443	49741	23.1.244.180	192.168.2.5
Jan 5, 2024 03:29:35.193310976 CET	49741	443	192.168.2.5	23.1.244.180
Jan 5, 2024 03:29:35.195766926 CET	49741	443	192.168.2.5	23.1.244.180
Jan 5, 2024 03:29:35.195776939 CET	443	49741	23.1.244.180	192.168.2.5
Jan 5, 2024 03:29:35.546314955 CET	443	49741	23.1.244.180	192.168.2.5
Jan 5, 2024 03:29:35.546391964 CET	49741	443	192.168.2.5	23.1.244.180
Jan 5, 2024 03:29:35.548749924 CET	49741	443	192.168.2.5	23.1.244.180
Jan 5, 2024 03:29:35.548755884 CET	443	49741	23.1.244.180	192.168.2.5
Jan 5, 2024 03:29:35.549088955 CET	443	49741	23.1.244.180	192.168.2.5
Jan 5, 2024 03:29:35.599289894 CET	49741	443	192.168.2.5	23.1.244.180
Jan 5, 2024 03:29:35.621887922 CET	49741	443	192.168.2.5	23.1.244.180
Jan 5, 2024 03:29:35.668736935 CET	443	49741	23.1.244.180	192.168.2.5
Jan 5, 2024 03:29:35.844197035 CET	443	49741	23.1.244.180	192.168.2.5
Jan 5, 2024 03:29:35.844382048 CET	443	49741	23.1.244.180	192.168.2.5
Jan 5, 2024 03:29:35.844424963 CET	49741	443	192.168.2.5	23.1.244.180
Jan 5, 2024 03:29:35.844448090 CET	443	49741	23.1.244.180	192.168.2.5
Jan 5, 2024 03:29:35.844460011 CET	49741	443	192.168.2.5	23.1.244.180
Jan 5, 2024 03:29:35.844460011 CET	49741	443	192.168.2.5	23.1.244.180
Jan 5, 2024 03:29:35.844465971 CET	443	49741	23.1.244.180	192.168.2.5
Jan 5, 2024 03:29:35.844471931 CET	443	49741	23.1.244.180	192.168.2.5
Jan 5, 2024 03:29:35.889090061 CET	49751	443	192.168.2.5	23.1.244.180
Jan 5, 2024 03:29:35.889111996 CET	443	49751	23.1.244.180	192.168.2.5
Jan 5, 2024 03:29:35.889177084 CET	49751	443	192.168.2.5	23.1.244.180
Jan 5, 2024 03:29:35.889717102 CET	49751	443	192.168.2.5	23.1.244.180
Jan 5, 2024 03:29:35.889729023 CET	443	49751	23.1.244.180	192.168.2.5
Jan 5, 2024 03:29:36.216020107 CET	443	49751	23.1.244.180	192.168.2.5
Jan 5, 2024 03:29:36.216092110 CET	49751	443	192.168.2.5	23.1.244.180
Jan 5, 2024 03:29:36.217998981 CET	49751	443	192.168.2.5	23.1.244.180
Jan 5, 2024 03:29:36.218003988 CET	443	49751	23.1.244.180	192.168.2.5
Jan 5, 2024 03:29:36.218239069 CET	443	49751	23.1.244.180	192.168.2.5
Jan 5, 2024 03:29:36.220319033 CET	49751	443	192.168.2.5	23.1.244.180
Jan 5, 2024 03:29:36.260745049 CET	443	49751	23.1.244.180	192.168.2.5
Jan 5, 2024 03:29:36.536914110 CET	443	49751	23.1.244.180	192.168.2.5
Jan 5, 2024 03:29:36.537043095 CET	443	49751	23.1.244.180	192.168.2.5
Jan 5, 2024 03:29:36.537094116 CET	49751	443	192.168.2.5	23.1.244.180
Jan 5, 2024 03:29:36.539529085 CET	49751	443	192.168.2.5	23.1.244.180
Jan 5, 2024 03:29:36.539535999 CET	443	49751	23.1.244.180	192.168.2.5
Jan 5, 2024 03:29:36.539545059 CET	49751	443	192.168.2.5	23.1.244.180
Jan 5, 2024 03:29:36.539549112 CET	443	49751	23.1.244.180	192.168.2.5
Jan 5, 2024 03:29:42.125629902 CET	49776	443	192.168.2.5	20.12.23.50
Jan 5, 2024 03:29:42.125655890 CET	443	49776	20.12.23.50	192.168.2.5
Jan 5, 2024 03:29:42.125716925 CET	49776	443	192.168.2.5	20.12.23.50
Jan 5, 2024 03:29:42.127377033 CET	49776	443	192.168.2.5	20.12.23.50
Jan 5, 2024 03:29:42.127389908 CET	443	49776	20.12.23.50	192.168.2.5
Jan 5, 2024 03:29:42.618377924 CET	443	49776	20.12.23.50	192.168.2.5
Jan 5, 2024 03:29:42.618510008 CET	49776	443	192.168.2.5	20.12.23.50
Jan 5, 2024 03:29:42.631778955 CET	49776	443	192.168.2.5	20.12.23.50
Jan 5, 2024 03:29:42.631788969 CET	443	49776	20.12.23.50	192.168.2.5
Jan 5, 2024 03:29:42.632006884 CET	443	49776	20.12.23.50	192.168.2.5
Jan 5, 2024 03:29:42.755366087 CET	49776	443	192.168.2.5	20.12.23.50
Jan 5, 2024 03:29:43.189539909 CET	49776	443	192.168.2.5	20.12.23.50
Jan 5, 2024 03:29:43.236740112 CET	443	49776	20.12.23.50	192.168.2.5
Jan 5, 2024 03:29:43.284203053 CET	49703	443	192.168.2.5	23.1.237.91
Jan 5, 2024 03:29:43.284293890 CET	49703	443	192.168.2.5	23.1.237.91
Jan 5, 2024 03:29:43.285804033 CET	49785	443	192.168.2.5	23.1.237.91
Jan 5, 2024 03:29:43.285818100 CET	443	49785	23.1.237.91	192.168.2.5
Jan 5, 2024 03:29:43.285888910 CET	49785	443	192.168.2.5	23.1.237.91
Jan 5, 2024 03:29:43.287570953 CET	49785	443	192.168.2.5	23.1.237.91
Jan 5, 2024 03:29:43.287580967 CET	443	49785	23.1.237.91	192.168.2.5
Jan 5, 2024 03:29:43.434221983 CET	443	49703	23.1.237.91	192.168.2.5
Jan 5, 2024 03:29:43.434237957 CET	443	49703	23.1.237.91	192.168.2.5
Jan 5, 2024 03:29:43.507426977 CET	443	49776	20.12.23.50	192.168.2.5
Jan 5, 2024 03:29:43.507452965 CET	443	49776	20.12.23.50	192.168.2.5
Jan 5, 2024 03:29:43.507460117 CET	443	49776	20.12.23.50	192.168.2.5
Jan 5, 2024 03:29:43.507483006 CET	443	49776	20.12.23.50	192.168.2.5
Jan 5, 2024 03:29:43.507493019 CET	443	49776	20.12.23.50	192.168.2.5
Jan 5, 2024 03:29:43.507497072 CET	443	49776	20.12.23.50	192.168.2.5
Jan 5, 2024 03:29:43.507512093 CET	49776	443	192.168.2.5	20.12.23.50
Jan 5, 2024 03:29:43.507535934 CET	443	49776	20.12.23.50	192.168.2.5
Jan 5, 2024 03:29:43.507545948 CET	443	49776	20.12.23.50	192.168.2.5
Jan 5, 2024 03:29:43.507556915 CET	49776	443	192.168.2.5	20.12.23.50
Jan 5, 2024 03:29:43.507565022 CET	443	49776	20.12.23.50	192.168.2.5
Jan 5, 2024 03:29:43.507570982 CET	443	49776	20.12.23.50	192.168.2.5
Jan 5, 2024 03:29:43.507576942 CET	49776	443	192.168.2.5	20.12.23.50
Jan 5, 2024 03:29:43.507596016 CET	443	49776	20.12.23.50	192.168.2.5
Jan 5, 2024 03:29:43.507622957 CET	49776	443	192.168.2.5	20.12.23.50
Jan 5, 2024 03:29:43.507622957 CET	49776	443	192.168.2.5	20.12.23.50
Jan 5, 2024 03:29:43.507663965 CET	49776	443	192.168.2.5	20.12.23.50
Jan 5, 2024 03:29:43.599929094 CET	443	49785	23.1.237.91	192.168.2.5
Jan 5, 2024 03:29:43.599987030 CET	49785	443	192.168.2.5	23.1.237.91
Jan 5, 2024 03:29:43.676462889 CET	49785	443	192.168.2.5	23.1.237.91
Jan 5, 2024 03:29:43.676474094 CET	443	49785	23.1.237.91	192.168.2.5
Jan 5, 2024 03:29:43.676753044 CET	443	49785	23.1.237.91	192.168.2.5
Jan 5, 2024 03:29:43.676810980 CET	49785	443	192.168.2.5	23.1.237.91
Jan 5, 2024 03:29:43.678169012 CET	49785	443	192.168.2.5	23.1.237.91
Jan 5, 2024 03:29:43.678194046 CET	443	49785	23.1.237.91	192.168.2.5
Jan 5, 2024 03:29:43.679631948 CET	49785	443	192.168.2.5	23.1.237.91
Jan 5, 2024 03:29:43.679637909 CET	443	49785	23.1.237.91	192.168.2.5
Jan 5, 2024 03:29:43.841675043 CET	49776	443	192.168.2.5	20.12.23.50
Jan 5, 2024 03:29:43.841696978 CET	443	49776	20.12.23.50	192.168.2.5
Jan 5, 2024 03:29:43.841711044 CET	49776	443	192.168.2.5	20.12.23.50
Jan 5, 2024 03:29:43.841717958 CET	443	49776	20.12.23.50	192.168.2.5
Jan 5, 2024 03:29:43.955269098 CET	443	49785	23.1.237.91	192.168.2.5
Jan 5, 2024 03:29:43.955468893 CET	49785	443	192.168.2.5	23.1.237.91
Jan 5, 2024 03:29:43.955470085 CET	49785	443	192.168.2.5	23.1.237.91
Jan 5, 2024 03:29:43.955478907 CET	443	49785	23.1.237.91	192.168.2.5
Jan 5, 2024 03:29:43.955492973 CET	443	49785	23.1.237.91	192.168.2.5
Jan 5, 2024 03:29:43.955559015 CET	49785	443	192.168.2.5	23.1.237.91
Jan 5, 2024 03:29:43.955559015 CET	49785	443	192.168.2.5	23.1.237.91
Jan 5, 2024 03:29:44.959641933 CET	443	49740	142.251.116.104	192.168.2.5
Jan 5, 2024 03:29:44.959685087 CET	443	49740	142.251.116.104	192.168.2.5
Jan 5, 2024 03:29:44.959726095 CET	49740	443	192.168.2.5	142.251.116.104
Jan 5, 2024 03:29:45.358791113 CET	49740	443	192.168.2.5	142.251.116.104
Jan 5, 2024 03:29:45.358814955 CET	443	49740	142.251.116.104	192.168.2.5
Jan 5, 2024 03:30:19.632885933 CET	49730	443	192.168.2.5	52.34.144.49
Jan 5, 2024 03:30:19.632915974 CET	443	49730	52.34.144.49	192.168.2.5
Jan 5, 2024 03:30:20.360821009 CET	49796	443	192.168.2.5	20.12.23.50
Jan 5, 2024 03:30:20.360872030 CET	443	49796	20.12.23.50	192.168.2.5
Jan 5, 2024 03:30:20.360975981 CET	49796	443	192.168.2.5	20.12.23.50
Jan 5, 2024 03:30:20.361660957 CET	49796	443	192.168.2.5	20.12.23.50
Jan 5, 2024 03:30:20.361671925 CET	443	49796	20.12.23.50	192.168.2.5
Jan 5, 2024 03:30:20.852803946 CET	443	49796	20.12.23.50	192.168.2.5
Jan 5, 2024 03:30:20.852888107 CET	49796	443	192.168.2.5	20.12.23.50
Jan 5, 2024 03:30:20.856923103 CET	49796	443	192.168.2.5	20.12.23.50
Jan 5, 2024 03:30:20.856934071 CET	443	49796	20.12.23.50	192.168.2.5
Jan 5, 2024 03:30:20.857202053 CET	443	49796	20.12.23.50	192.168.2.5
Jan 5, 2024 03:30:20.869234085 CET	49796	443	192.168.2.5	20.12.23.50
Jan 5, 2024 03:30:20.916745901 CET	443	49796	20.12.23.50	192.168.2.5
Jan 5, 2024 03:30:21.329874992 CET	443	49796	20.12.23.50	192.168.2.5
Jan 5, 2024 03:30:21.329896927 CET	443	49796	20.12.23.50	192.168.2.5
Jan 5, 2024 03:30:21.329941034 CET	443	49796	20.12.23.50	192.168.2.5
Jan 5, 2024 03:30:21.330045938 CET	49796	443	192.168.2.5	20.12.23.50
Jan 5, 2024 03:30:21.330066919 CET	443	49796	20.12.23.50	192.168.2.5
Jan 5, 2024 03:30:21.330140114 CET	49796	443	192.168.2.5	20.12.23.50
Jan 5, 2024 03:30:21.337264061 CET	49796	443	192.168.2.5	20.12.23.50
Jan 5, 2024 03:30:21.337274075 CET	443	49796	20.12.23.50	192.168.2.5
Jan 5, 2024 03:30:21.337296963 CET	49796	443	192.168.2.5	20.12.23.50
Jan 5, 2024 03:30:21.337301016 CET	443	49796	20.12.23.50	192.168.2.5
Jan 5, 2024 03:30:34.631233931 CET	49730	443	192.168.2.5	52.34.144.49
Jan 5, 2024 03:30:34.631357908 CET	443	49730	52.34.144.49	192.168.2.5
Jan 5, 2024 03:30:34.631441116 CET	49730	443	192.168.2.5	52.34.144.49
Jan 5, 2024 03:30:34.631536961 CET	49798	443	192.168.2.5	142.251.116.104
Jan 5, 2024 03:30:34.631566048 CET	443	49798	142.251.116.104	192.168.2.5
Jan 5, 2024 03:30:34.631634951 CET	49798	443	192.168.2.5	142.251.116.104
Jan 5, 2024 03:30:34.631984949 CET	49798	443	192.168.2.5	142.251.116.104
Jan 5, 2024 03:30:34.631999969 CET	443	49798	142.251.116.104	192.168.2.5
Jan 5, 2024 03:30:36.561201096 CET	443	49798	142.251.116.104	192.168.2.5
Jan 5, 2024 03:30:36.561475039 CET	49798	443	192.168.2.5	142.251.116.104
Jan 5, 2024 03:30:36.561494112 CET	443	49798	142.251.116.104	192.168.2.5
Jan 5, 2024 03:30:36.561816931 CET	443	49798	142.251.116.104	192.168.2.5
Jan 5, 2024 03:30:36.562098980 CET	49798	443	192.168.2.5	142.251.116.104
Jan 5, 2024 03:30:36.562156916 CET	443	49798	142.251.116.104	192.168.2.5
Jan 5, 2024 03:30:36.614877939 CET	49798	443	192.168.2.5	142.251.116.104
Jan 5, 2024 03:30:46.564811945 CET	443	49798	142.251.116.104	192.168.2.5
Jan 5, 2024 03:30:46.564879894 CET	443	49798	142.251.116.104	192.168.2.5
Jan 5, 2024 03:30:46.565031052 CET	49798	443	192.168.2.5	142.251.116.104
Jan 5, 2024 03:30:46.756802082 CET	49798	443	192.168.2.5	142.251.116.104
Jan 5, 2024 03:30:46.756824970 CET	443	49798	142.251.116.104	192.168.2.5
Jan 5, 2024 03:30:59.694804907 CET	49802	443	192.168.2.5	142.250.115.139
Jan 5, 2024 03:30:59.694839954 CET	443	49802	142.250.115.139	192.168.2.5
Jan 5, 2024 03:30:59.694892883 CET	49802	443	192.168.2.5	142.250.115.139
Jan 5, 2024 03:30:59.695451021 CET	49802	443	192.168.2.5	142.250.115.139
Jan 5, 2024 03:30:59.695465088 CET	443	49802	142.250.115.139	192.168.2.5
Jan 5, 2024 03:30:59.947937965 CET	443	49802	142.250.115.139	192.168.2.5
Jan 5, 2024 03:30:59.948303938 CET	49802	443	192.168.2.5	142.250.115.139
Jan 5, 2024 03:30:59.948318958 CET	443	49802	142.250.115.139	192.168.2.5
Jan 5, 2024 03:30:59.948676109 CET	443	49802	142.250.115.139	192.168.2.5
Jan 5, 2024 03:30:59.948730946 CET	49802	443	192.168.2.5	142.250.115.139
Jan 5, 2024 03:30:59.949307919 CET	443	49802	142.250.115.139	192.168.2.5
Jan 5, 2024 03:30:59.949368000 CET	49802	443	192.168.2.5	142.250.115.139
Jan 5, 2024 03:30:59.950391054 CET	49802	443	192.168.2.5	142.250.115.139
Jan 5, 2024 03:30:59.950485945 CET	443	49802	142.250.115.139	192.168.2.5
Jan 5, 2024 03:30:59.950599909 CET	49802	443	192.168.2.5	142.250.115.139
Jan 5, 2024 03:30:59.950608015 CET	443	49802	142.250.115.139	192.168.2.5
Jan 5, 2024 03:31:00.005393028 CET	49802	443	192.168.2.5	142.250.115.139
Jan 5, 2024 03:31:00.224499941 CET	443	49802	142.250.115.139	192.168.2.5
Jan 5, 2024 03:31:00.225886106 CET	443	49802	142.250.115.139	192.168.2.5
Jan 5, 2024 03:31:00.225943089 CET	49802	443	192.168.2.5	142.250.115.139
Jan 5, 2024 03:31:00.226088047 CET	49802	443	192.168.2.5	142.250.115.139
Jan 5, 2024 03:31:00.226104975 CET	443	49802	142.250.115.139	192.168.2.5

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 5, 2024 03:29:30.382226944 CET	64096	53	192.168.2.5	1.1.1.1
Jan 5, 2024 03:29:30.382397890 CET	64177	53	192.168.2.5	1.1.1.1
Jan 5, 2024 03:29:30.382884026 CET	53690	53	192.168.2.5	1.1.1.1
Jan 5, 2024 03:29:30.383064032 CET	49735	53	192.168.2.5	1.1.1.1
Jan 5, 2024 03:29:30.430777073 CET	53	59996	1.1.1.1	192.168.2.5
Jan 5, 2024 03:29:30.504518032 CET	53	64177	1.1.1.1	192.168.2.5
Jan 5, 2024 03:29:30.504641056 CET	53	64096	1.1.1.1	192.168.2.5
Jan 5, 2024 03:29:30.505326986 CET	53	49735	1.1.1.1	192.168.2.5
Jan 5, 2024 03:29:30.505660057 CET	53	53690	1.1.1.1	192.168.2.5
Jan 5, 2024 03:29:31.238533020 CET	53	51580	1.1.1.1	192.168.2.5
Jan 5, 2024 03:29:32.666347980 CET	51456	53	192.168.2.5	1.1.1.1
Jan 5, 2024 03:29:32.666347980 CET	51087	53	192.168.2.5	1.1.1.1
Jan 5, 2024 03:29:34.081645012 CET	51430	53	192.168.2.5	1.1.1.1
Jan 5, 2024 03:29:34.082139969 CET	62436	53	192.168.2.5	1.1.1.1
Jan 5, 2024 03:29:34.087564945 CET	53216	53	192.168.2.5	1.1.1.1
Jan 5, 2024 03:29:34.087704897 CET	51668	53	192.168.2.5	1.1.1.1
Jan 5, 2024 03:29:34.204696894 CET	53	51430	1.1.1.1	192.168.2.5
Jan 5, 2024 03:29:34.205221891 CET	53	62436	1.1.1.1	192.168.2.5
Jan 5, 2024 03:29:34.214915037 CET	53	51668	1.1.1.1	192.168.2.5
Jan 5, 2024 03:29:34.215208054 CET	53	53216	1.1.1.1	192.168.2.5
Jan 5, 2024 03:29:34.565218925 CET	50507	53	192.168.2.5	1.1.1.1
Jan 5, 2024 03:29:34.565638065 CET	64051	53	192.168.2.5	1.1.1.1
Jan 5, 2024 03:29:34.687881947 CET	53	50507	1.1.1.1	192.168.2.5
Jan 5, 2024 03:29:34.688044071 CET	53	64051	1.1.1.1	192.168.2.5
Jan 5, 2024 03:29:36.159655094 CET	59098	53	192.168.2.5	1.1.1.1
Jan 5, 2024 03:29:36.160041094 CET	64214	53	192.168.2.5	1.1.1.1
Jan 5, 2024 03:29:37.125111103 CET	53	60090	1.1.1.1	192.168.2.5
Jan 5, 2024 03:29:48.144860983 CET	53	49175	1.1.1.1	192.168.2.5
Jan 5, 2024 03:30:07.176038027 CET	53	62372	1.1.1.1	192.168.2.5
Jan 5, 2024 03:30:29.902967930 CET	53	55052	1.1.1.1	192.168.2.5
Jan 5, 2024 03:30:30.182197094 CET	53	58439	1.1.1.1	192.168.2.5
Jan 5, 2024 03:30:36.983007908 CET	62259	53	192.168.2.5	1.1.1.1
Jan 5, 2024 03:30:36.983285904 CET	62428	53	192.168.2.5	1.1.1.1
Jan 5, 2024 03:30:58.537374973 CET	53	53789	1.1.1.1	192.168.2.5
Jan 5, 2024 03:30:59.570862055 CET	49763	53	192.168.2.5	1.1.1.1
Jan 5, 2024 03:30:59.571155071 CET	60807	53	192.168.2.5	1.1.1.1
Jan 5, 2024 03:30:59.693605900 CET	53	49763	1.1.1.1	192.168.2.5
Jan 5, 2024 03:30:59.694328070 CET	53	60807	1.1.1.1	192.168.2.5

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Jan 5, 2024 03:29:36.323713064 CET	192.168.2.5	1.1.1.1	c276	(Port unreachable)	Destination Unreachable

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 5, 2024 03:29:30.382226944 CET	192.168.2.5	1.1.1.1	0xd09d	Standard query (0)	clients2.google.com	A (IP address)	IN (0x0001)	false
Jan 5, 2024 03:29:30.382397890 CET	192.168.2.5	1.1.1.1	0x33a1	Standard query (0)	clients2.google.com	65	IN (0x0001)	false
Jan 5, 2024 03:29:30.382884026 CET	192.168.2.5	1.1.1.1	0x3bbe	Standard query (0)	accounts.google.com	A (IP address)	IN (0x0001)	false
Jan 5, 2024 03:29:30.383064032 CET	192.168.2.5	1.1.1.1	0x13aa	Standard query (0)	accounts.google.com	65	IN (0x0001)	false
Jan 5, 2024 03:29:32.666347980 CET	192.168.2.5	1.1.1.1	0x338a	Standard query (0)	js.monitor.azure.com	A (IP address)	IN (0x0001)	false
Jan 5, 2024 03:29:32.666347980 CET	192.168.2.5	1.1.1.1	0xa8a3	Standard query (0)	js.monitor.azure.com	65	IN (0x0001)	false
Jan 5, 2024 03:29:34.081645012 CET	192.168.2.5	1.1.1.1	0xa0c6	Standard query (0)	mscom.demdex.net	A (IP address)	IN (0x0001)	false
Jan 5, 2024 03:29:34.082139969 CET	192.168.2.5	1.1.1.1	0xae6c	Standard query (0)	mscom.demdex.net	65	IN (0x0001)	false
Jan 5, 2024 03:29:34.087564945 CET	192.168.2.5	1.1.1.1	0x172d	Standard query (0)	microsoftmscompoc.tt.omtrdc.net	A (IP address)	IN (0x0001)	false
Jan 5, 2024 03:29:34.087704897 CET	192.168.2.5	1.1.1.1	0x7b16	Standard query (0)	microsoftmscompoc.tt.omtrdc.net	65	IN (0x0001)	false
Jan 5, 2024 03:29:34.565218925 CET	192.168.2.5	1.1.1.1	0x5267	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Jan 5, 2024 03:29:34.565638065 CET	192.168.2.5	1.1.1.1	0xea9e	Standard query (0)	www.google.com	65	IN (0x0001)	false
Jan 5, 2024 03:29:36.159655094 CET	192.168.2.5	1.1.1.1	0x7f08	Standard query (0)	mdec.nelreports.net	A (IP address)	IN (0x0001)	false
Jan 5, 2024 03:29:36.160041094 CET	192.168.2.5	1.1.1.1	0x4905	Standard query (0)	mdec.nelreports.net	65	IN (0x0001)	false
Jan 5, 2024 03:30:36.983007908 CET	192.168.2.5	1.1.1.1	0x4d9c	Standard query (0)	mdec.nelreports.net	A (IP address)	IN (0x0001)	false
Jan 5, 2024 03:30:36.983285904 CET	192.168.2.5	1.1.1.1	0xa4cf	Standard query (0)	mdec.nelreports.net	65	IN (0x0001)	false
Jan 5, 2024 03:30:59.570862055 CET	192.168.2.5	1.1.1.1	0xffa2	Standard query (0)	clients1.google.com	A (IP address)	IN (0x0001)	false
Jan 5, 2024 03:30:59.571155071 CET	192.168.2.5	1.1.1.1	0x4f4f	Standard query (0)	clients1.google.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 5, 2024 03:29:30.504518032 CET	1.1.1.1	192.168.2.5	0x33a1	No error (0)	clients2.google.com	clients.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 5, 2024 03:29:30.504641056 CET	1.1.1.1	192.168.2.5	0xd09d	No error (0)	clients2.google.com	clients.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 5, 2024 03:29:30.504641056 CET	1.1.1.1	192.168.2.5	0xd09d	No error (0)	clients.l.google.com		142.250.114.100	A (IP address)	IN (0x0001)	false
Jan 5, 2024 03:29:30.504641056 CET	1.1.1.1	192.168.2.5	0xd09d	No error (0)	clients.l.google.com		142.250.114.139	A (IP address)	IN (0x0001)	false
Jan 5, 2024 03:29:30.504641056 CET	1.1.1.1	192.168.2.5	0xd09d	No error (0)	clients.l.google.com		142.250.114.102	A (IP address)	IN (0x0001)	false
Jan 5, 2024 03:29:30.504641056 CET	1.1.1.1	192.168.2.5	0xd09d	No error (0)	clients.l.google.com		142.250.114.113	A (IP address)	IN (0x0001)	false
Jan 5, 2024 03:29:30.504641056 CET	1.1.1.1	192.168.2.5	0xd09d	No error (0)	clients.l.google.com		142.250.114.138	A (IP address)	IN (0x0001)	false
Jan 5, 2024 03:29:30.504641056 CET	1.1.1.1	192.168.2.5	0xd09d	No error (0)	clients.l.google.com		142.250.114.101	A (IP address)	IN (0x0001)	false
Jan 5, 2024 03:29:30.505660057 CET	1.1.1.1	192.168.2.5	0x3bbe	No error (0)	accounts.google.com		142.250.115.84	A (IP address)	IN (0x0001)	false
Jan 5, 2024 03:29:32.786983013 CET	1.1.1.1	192.168.2.5	0x9115	No error (0)	consentdeliveryfd.azurefd.net	firstparty-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 5, 2024 03:29:32.786983013 CET	1.1.1.1	192.168.2.5	0x9115	No error (0)	shed.dual-low.part-0029.t-0009.t-msedge.net	part-0029.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 5, 2024 03:29:32.786983013 CET	1.1.1.1	192.168.2.5	0x9115	No error (0)	part-0029.t-0009.t-msedge.net		13.107.213.57	A (IP address)	IN (0x0001)	false
Jan 5, 2024 03:29:32.786983013 CET	1.1.1.1	192.168.2.5	0x9115	No error (0)	part-0029.t-0009.t-msedge.net		13.107.246.57	A (IP address)	IN (0x0001)	false
Jan 5, 2024 03:29:32.790134907 CET	1.1.1.1	192.168.2.5	0xa8a3	No error (0)	js.monitor.azure.com	aijscdn2.azureedge.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 5, 2024 03:29:32.790141106 CET	1.1.1.1	192.168.2.5	0x338a	No error (0)	js.monitor.azure.com	aijscdn2.azureedge.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 5, 2024 03:29:32.790141106 CET	1.1.1.1	192.168.2.5	0x338a	No error (0)	shed.dual-low.part-0029.t-0009.t-msedge.net	part-0029.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 5, 2024 03:29:32.790141106 CET	1.1.1.1	192.168.2.5	0x338a	No error (0)	part-0029.t-0009.t-msedge.net		13.107.213.57	A (IP address)	IN (0x0001)	false
Jan 5, 2024 03:29:32.790141106 CET	1.1.1.1	192.168.2.5	0x338a	No error (0)	part-0029.t-0009.t-msedge.net		13.107.246.57	A (IP address)	IN (0x0001)	false
Jan 5, 2024 03:29:32.800815105 CET	1.1.1.1	192.168.2.5	0x7cac	No error (0)	consentdeliveryfd.azurefd.net	firstparty-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 5, 2024 03:29:34.204696894 CET	1.1.1.1	192.168.2.5	0xa0c6	No error (0)	mscom.demdex.net	gslb-2.demdex.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 5, 2024 03:29:34.204696894 CET	1.1.1.1	192.168.2.5	0xa0c6	No error (0)	gslb-2.demdex.net	edge-usw2.demdex.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 5, 2024 03:29:34.204696894 CET	1.1.1.1	192.168.2.5	0xa0c6	No error (0)	edge-usw2.demdex.net	dcs-public-edge-usw2-219535174.us-west-2.elb.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 5, 2024 03:29:34.204696894 CET	1.1.1.1	192.168.2.5	0xa0c6	No error (0)	dcs-public-edge-usw2-219535174.us-west-2.elb.amazonaws.com		52.34.144.49	A (IP address)	IN (0x0001)	false
Jan 5, 2024 03:29:34.204696894 CET	1.1.1.1	192.168.2.5	0xa0c6	No error (0)	dcs-public-edge-usw2-219535174.us-west-2.elb.amazonaws.com		52.25.210.92	A (IP address)	IN (0x0001)	false
Jan 5, 2024 03:29:34.204696894 CET	1.1.1.1	192.168.2.5	0xa0c6	No error (0)	dcs-public-edge-usw2-219535174.us-west-2.elb.amazonaws.com		34.212.247.228	A (IP address)	IN (0x0001)	false
Jan 5, 2024 03:29:34.204696894 CET	1.1.1.1	192.168.2.5	0xa0c6	No error (0)	dcs-public-edge-usw2-219535174.us-west-2.elb.amazonaws.com		52.40.168.36	A (IP address)	IN (0x0001)	false
Jan 5, 2024 03:29:34.204696894 CET	1.1.1.1	192.168.2.5	0xa0c6	No error (0)	dcs-public-edge-usw2-219535174.us-west-2.elb.amazonaws.com		52.35.215.33	A (IP address)	IN (0x0001)	false
Jan 5, 2024 03:29:34.204696894 CET	1.1.1.1	192.168.2.5	0xa0c6	No error (0)	dcs-public-edge-usw2-219535174.us-west-2.elb.amazonaws.com		44.224.119.250	A (IP address)	IN (0x0001)	false
Jan 5, 2024 03:29:34.204696894 CET	1.1.1.1	192.168.2.5	0xa0c6	No error (0)	dcs-public-edge-usw2-219535174.us-west-2.elb.amazonaws.com		44.236.54.8	A (IP address)	IN (0x0001)	false
Jan 5, 2024 03:29:34.204696894 CET	1.1.1.1	192.168.2.5	0xa0c6	No error (0)	dcs-public-edge-usw2-219535174.us-west-2.elb.amazonaws.com		52.35.107.54	A (IP address)	IN (0x0001)	false
Jan 5, 2024 03:29:34.205221891 CET	1.1.1.1	192.168.2.5	0xae6c	No error (0)	mscom.demdex.net	gslb-2.demdex.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 5, 2024 03:29:34.205221891 CET	1.1.1.1	192.168.2.5	0xae6c	No error (0)	gslb-2.demdex.net	edge-va6.demdex.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 5, 2024 03:29:34.205221891 CET	1.1.1.1	192.168.2.5	0xae6c	No error (0)	edge-va6.demdex.net	dcs-public-edge-va6-158015560.us-east-1.elb.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 5, 2024 03:29:34.205617905 CET	1.1.1.1	192.168.2.5	0x7613	No error (0)	microsoftmscompoc.tt.omtrdc.net	adobetarget.data.adobedc.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 5, 2024 03:29:34.205617905 CET	1.1.1.1	192.168.2.5	0x7613	No error (0)	adobetarget.data.adobedc.net		63.140.36.139	A (IP address)	IN (0x0001)	false
Jan 5, 2024 03:29:34.205617905 CET	1.1.1.1	192.168.2.5	0x7613	No error (0)	adobetarget.data.adobedc.net		63.140.36.197	A (IP address)	IN (0x0001)	false
Jan 5, 2024 03:29:34.205617905 CET	1.1.1.1	192.168.2.5	0x7613	No error (0)	adobetarget.data.adobedc.net		63.140.36.119	A (IP address)	IN (0x0001)	false
Jan 5, 2024 03:29:34.205617905 CET	1.1.1.1	192.168.2.5	0x7613	No error (0)	adobetarget.data.adobedc.net		63.140.36.148	A (IP address)	IN (0x0001)	false
Jan 5, 2024 03:29:34.205617905 CET	1.1.1.1	192.168.2.5	0x7613	No error (0)	adobetarget.data.adobedc.net		63.140.36.101	A (IP address)	IN (0x0001)	false
Jan 5, 2024 03:29:34.205617905 CET	1.1.1.1	192.168.2.5	0x7613	No error (0)	adobetarget.data.adobedc.net		63.140.36.130	A (IP address)	IN (0x0001)	false
Jan 5, 2024 03:29:34.205617905 CET	1.1.1.1	192.168.2.5	0x7613	No error (0)	adobetarget.data.adobedc.net		63.140.36.138	A (IP address)	IN (0x0001)	false
Jan 5, 2024 03:29:34.205617905 CET	1.1.1.1	192.168.2.5	0x7613	No error (0)	adobetarget.data.adobedc.net		63.140.36.14	A (IP address)	IN (0x0001)	false
Jan 5, 2024 03:29:34.205617905 CET	1.1.1.1	192.168.2.5	0x7613	No error (0)	adobetarget.data.adobedc.net		63.140.36.121	A (IP address)	IN (0x0001)	false
Jan 5, 2024 03:29:34.205617905 CET	1.1.1.1	192.168.2.5	0x7613	No error (0)	adobetarget.data.adobedc.net		63.140.36.104	A (IP address)	IN (0x0001)	false
Jan 5, 2024 03:29:34.206171989 CET	1.1.1.1	192.168.2.5	0x71e0	No error (0)	microsoftmscompoc.tt.omtrdc.net	adobetarget.data.adobedc.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 5, 2024 03:29:34.214915037 CET	1.1.1.1	192.168.2.5	0x7b16	No error (0)	microsoftmscompoc.tt.omtrdc.net	adobetarget.data.adobedc.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 5, 2024 03:29:34.215208054 CET	1.1.1.1	192.168.2.5	0x172d	No error (0)	microsoftmscompoc.tt.omtrdc.net	adobetarget.data.adobedc.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 5, 2024 03:29:34.215208054 CET	1.1.1.1	192.168.2.5	0x172d	No error (0)	adobetarget.data.adobedc.net		63.140.36.139	A (IP address)	IN (0x0001)	false
Jan 5, 2024 03:29:34.215208054 CET	1.1.1.1	192.168.2.5	0x172d	No error (0)	adobetarget.data.adobedc.net		63.140.36.119	A (IP address)	IN (0x0001)	false
Jan 5, 2024 03:29:34.215208054 CET	1.1.1.1	192.168.2.5	0x172d	No error (0)	adobetarget.data.adobedc.net		63.140.36.148	A (IP address)	IN (0x0001)	false
Jan 5, 2024 03:29:34.215208054 CET	1.1.1.1	192.168.2.5	0x172d	No error (0)	adobetarget.data.adobedc.net		63.140.36.130	A (IP address)	IN (0x0001)	false
Jan 5, 2024 03:29:34.215208054 CET	1.1.1.1	192.168.2.5	0x172d	No error (0)	adobetarget.data.adobedc.net		63.140.36.197	A (IP address)	IN (0x0001)	false
Jan 5, 2024 03:29:34.215208054 CET	1.1.1.1	192.168.2.5	0x172d	No error (0)	adobetarget.data.adobedc.net		63.140.36.138	A (IP address)	IN (0x0001)	false
Jan 5, 2024 03:29:34.215208054 CET	1.1.1.1	192.168.2.5	0x172d	No error (0)	adobetarget.data.adobedc.net		63.140.36.14	A (IP address)	IN (0x0001)	false
Jan 5, 2024 03:29:34.215208054 CET	1.1.1.1	192.168.2.5	0x172d	No error (0)	adobetarget.data.adobedc.net		63.140.36.101	A (IP address)	IN (0x0001)	false
Jan 5, 2024 03:29:34.215208054 CET	1.1.1.1	192.168.2.5	0x172d	No error (0)	adobetarget.data.adobedc.net		63.140.36.104	A (IP address)	IN (0x0001)	false
Jan 5, 2024 03:29:34.215208054 CET	1.1.1.1	192.168.2.5	0x172d	No error (0)	adobetarget.data.adobedc.net		63.140.36.112	A (IP address)	IN (0x0001)	false
Jan 5, 2024 03:29:34.687881947 CET	1.1.1.1	192.168.2.5	0x5267	No error (0)	www.google.com		142.251.116.104	A (IP address)	IN (0x0001)	false
Jan 5, 2024 03:29:34.687881947 CET	1.1.1.1	192.168.2.5	0x5267	No error (0)	www.google.com		142.251.116.106	A (IP address)	IN (0x0001)	false
Jan 5, 2024 03:29:34.687881947 CET	1.1.1.1	192.168.2.5	0x5267	No error (0)	www.google.com		142.251.116.99	A (IP address)	IN (0x0001)	false
Jan 5, 2024 03:29:34.687881947 CET	1.1.1.1	192.168.2.5	0x5267	No error (0)	www.google.com		142.251.116.105	A (IP address)	IN (0x0001)	false
Jan 5, 2024 03:29:34.687881947 CET	1.1.1.1	192.168.2.5	0x5267	No error (0)	www.google.com		142.251.116.147	A (IP address)	IN (0x0001)	false
Jan 5, 2024 03:29:34.687881947 CET	1.1.1.1	192.168.2.5	0x5267	No error (0)	www.google.com		142.251.116.103	A (IP address)	IN (0x0001)	false
Jan 5, 2024 03:29:34.688044071 CET	1.1.1.1	192.168.2.5	0xea9e	No error (0)	www.google.com			65	IN (0x0001)	false
Jan 5, 2024 03:29:36.285432100 CET	1.1.1.1	192.168.2.5	0x7f08	No error (0)	mdec.nelreports.net	mdec.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 5, 2024 03:29:36.323632002 CET	1.1.1.1	192.168.2.5	0x4905	No error (0)	mdec.nelreports.net	mdec.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 5, 2024 03:30:37.108326912 CET	1.1.1.1	192.168.2.5	0x4d9c	No error (0)	mdec.nelreports.net	mdec.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 5, 2024 03:30:37.108350992 CET	1.1.1.1	192.168.2.5	0xa4cf	No error (0)	mdec.nelreports.net	mdec.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 5, 2024 03:30:59.693605900 CET	1.1.1.1	192.168.2.5	0xffa2	No error (0)	clients1.google.com	clients.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 5, 2024 03:30:59.693605900 CET	1.1.1.1	192.168.2.5	0xffa2	No error (0)	clients.l.google.com		142.250.115.139	A (IP address)	IN (0x0001)	false
Jan 5, 2024 03:30:59.693605900 CET	1.1.1.1	192.168.2.5	0xffa2	No error (0)	clients.l.google.com		142.250.115.138	A (IP address)	IN (0x0001)	false
Jan 5, 2024 03:30:59.693605900 CET	1.1.1.1	192.168.2.5	0xffa2	No error (0)	clients.l.google.com		142.250.115.113	A (IP address)	IN (0x0001)	false
Jan 5, 2024 03:30:59.693605900 CET	1.1.1.1	192.168.2.5	0xffa2	No error (0)	clients.l.google.com		142.250.115.100	A (IP address)	IN (0x0001)	false
Jan 5, 2024 03:30:59.693605900 CET	1.1.1.1	192.168.2.5	0xffa2	No error (0)	clients.l.google.com		142.250.115.101	A (IP address)	IN (0x0001)	false
Jan 5, 2024 03:30:59.693605900 CET	1.1.1.1	192.168.2.5	0xffa2	No error (0)	clients.l.google.com		142.250.115.102	A (IP address)	IN (0x0001)	false
Jan 5, 2024 03:30:59.694328070 CET	1.1.1.1	192.168.2.5	0x4f4f	No error (0)	clients1.google.com	clients.l.google.com		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

clients2.google.com

accounts.google.com

https:

js.monitor.azure.com

wcpstatic.microsoft.com

www.bing.com

fs.microsoft.com

slscr.update.microsoft.com

clients1.google.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49709	142.250.114.100	443	4052	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-05 02:29:30 UTC	752	OUT	GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=117.0.5938.132&lang=en-US&acceptformat=crx3,puff&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26brand%3DONGR%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1 Host: clients2.google.com Connection: keep-alive X-Goog-Update-Interactivity: fg X-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmieda X-Goog-Update-Updater: chromecrx-117.0.5938.132 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-05 02:29:31 UTC	732	IN	HTTP/1.1 200 OK Content-Security-Policy: script-src 'report-sample' 'nonce-y2nv9ohbGLWQuDzFCZYzbw' 'unsafe-inline' 'strict-dynamic' https: http:;object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/clientupdate-aus/1 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 05 Jan 2024 02:29:30 GMT Content-Type: text/xml; charset=UTF-8 X-Daynum: 6212 X-Daystart: 66570 X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block Server: GSE Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-01-05 02:29:31 UTC	520	IN	Data Raw: 32 63 39 0d 0a 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 67 75 70 64 61 74 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 75 70 64 61 74 65 32 2f 72 65 73 70 6f 6e 73 65 22 20 70 72 6f 74 6f 63 6f 6c 3d 22 32 2e 30 22 20 73 65 72 76 65 72 3d 22 70 72 6f 64 22 3e 3c 64 61 79 73 74 61 72 74 20 65 6c 61 70 73 65 64 5f 64 61 79 73 3d 22 36 32 31 32 22 20 65 6c 61 70 73 65 64 5f 73 65 63 6f 6e 64 73 3d 22 36 36 35 37 30 22 2f 3e 3c 61 70 70 20 61 70 70 69 64 3d 22 6e 6d 6d 68 6b 6b 65 67 63 63 61 67 64 6c 64 67 69 69 6d 65 64 70 69 63 63 6d 67 6d 69 65 64 61 22 20 63 6f 68 6f 72 74 3d 22 31 3a 3a 22 20 63 6f 68 6f 72 74 6e 61 6d 65 3d 22 22 Data Ascii: 2c9<?xml version="1.0" encoding="UTF-8"?><gupdate xmlns="http://www.google.com/update2/response" protocol="2.0" server="prod"><daystart elapsed_days="6212" elapsed_seconds="66570"/><app appid="nmmhkkegccagdldgiimedpiccmgmieda" cohort="1::" cohortname=""
2024-01-05 02:29:31 UTC	200	IN	Data Raw: 37 32 33 66 35 36 62 38 37 31 37 31 37 35 63 35 33 36 36 38 35 63 35 34 35 30 31 32 32 62 33 30 37 38 39 34 36 34 61 64 38 32 22 20 68 61 73 68 5f 73 68 61 32 35 36 3d 22 38 31 65 33 61 34 64 34 33 61 37 33 36 39 39 65 31 62 37 37 38 31 37 32 33 66 35 36 62 38 37 31 37 31 37 35 63 35 33 36 36 38 35 63 35 34 35 30 31 32 32 62 33 30 37 38 39 34 36 34 61 64 38 32 22 20 70 72 6f 74 65 63 74 65 64 3d 22 30 22 20 73 69 7a 65 3d 22 32 34 38 35 33 31 22 20 73 74 61 74 75 73 3d 22 6f 6b 22 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 2e 30 2e 36 22 2f 3e 3c 2f 61 70 70 3e 3c 2f 67 75 70 64 61 74 65 3e 0d 0a Data Ascii: 723f56b8717175c536685c5450122b30789464ad82" hash_sha256="81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82" protected="0" size="248531" status="ok" version="1.0.0.6"/></app></gupdate>
2024-01-05 02:29:31 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49708	142.250.115.84	443	4052	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-05 02:29:30 UTC	680	OUT	POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1 Host: accounts.google.com Connection: keep-alive Content-Length: 1 Origin: https://www.google.com Content-Type: application/x-www-form-urlencoded Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
2024-01-05 02:29:30 UTC	1	OUT	Data Raw: 20 Data Ascii:
2024-01-05 02:29:31 UTC	1627	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=utf-8 Access-Control-Allow-Origin: https://www.google.com Access-Control-Allow-Credentials: true X-Content-Type-Options: nosniff Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 05 Jan 2024 02:29:31 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factor=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: script-src 'report-sample' 'nonce-708Lu7Tre4U3kZ33wolrEA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/IdentityListAccountsHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/IdentityListAccountsHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/IdentityListAccountsHttp/cspreport Server: ESF X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-01-05 02:29:31 UTC	23	IN	Data Raw: 31 31 0d 0a 5b 22 67 61 69 61 2e 6c 2e 61 2e 72 22 2c 5b 5d 5d 0d 0a Data Ascii: 11["gaia.l.a.r",[]]
2024-01-05 02:29:31 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49721	13.107.213.57	443	4052	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-05 02:29:33 UTC	549	OUT	GET /scripts/c/ms.jsll-3.min.js HTTP/1.1 Host: js.monitor.azure.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://learn.microsoft.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-05 02:29:33 UTC	925	IN	HTTP/1.1 200 OK Date: Fri, 05 Jan 2024 02:29:33 GMT Content-Type: text/javascript; charset=utf-8 Content-Length: 185041 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=1800, immutable, no-transform Last-Modified: Thu, 21 Sep 2023 19:29:40 GMT ETag: 0x8DBBAD919F17481 x-ms-request-id: ab576bf4-301e-0081-6c69-35e4dc000000 x-ms-version: 2009-09-19 x-ms-meta-jssdkver: 3.2.14 x-ms-meta-jssdksrc: [cdn]/scripts/c/ms.jsll-3.2.14.min.js Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,x-ms-meta-jssdkver,x-ms-meta-jssdksrc,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240105T022933Z-wdw78nttpp11x3p2hdqn5cn3d40000000hd0000000006yqr X-Cache: TCP_REVALIDATED_HIT Accept-Ranges: bytes
2024-01-05 02:29:33 UTC	15459	IN	Data Raw: 2f 2a 21 0a 20 2a 20 31 44 53 20 4a 53 4c 4c 20 53 4b 55 2c 20 33 2e 32 2e 31 34 0a 20 2a 20 43 6f 70 79 72 69 67 68 74 20 28 63 29 20 4d 69 63 72 6f 73 6f 66 74 20 61 6e 64 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 2e 20 41 6c 6c 20 72 69 67 68 74 73 20 72 65 73 65 72 76 65 64 2e 0a 20 2a 20 28 4d 69 63 72 6f 73 6f 66 74 20 49 6e 74 65 72 6e 61 6c 20 4f 6e 6c 79 29 0a 20 2a 2f 0a 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 76 61 72 20 6e 3d 22 75 6e 64 65 66 69 6e 65 64 22 3b 69 66 28 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 65 78 70 6f 72 74 73 26 26 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 21 3d 6e 29 74 28 65 78 70 6f 72 74 73 29 3b 65 6c 73 65 20 69 66 28 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 64 65 66 69 6e 65 26 26 64 65 66 Data Ascii: /! 1DS JSLL SKU, 3.2.14 * Copyright (c) Microsoft and contributors. All rights reserved. * (Microsoft Internal Only) */!function(e,t){var n="undefined";if("object"==typeof exports&&typeof module!=n)t(exports);else if("function"==typeof define&&def
2024-01-05 02:29:33 UTC	16384	IN	Data Raw: 74 3d 76 6f 69 64 20 30 21 3d 3d 74 26 26 74 29 3f 22 2e 22 2b 57 72 3a 70 29 2b 47 72 29 7d 66 75 6e 63 74 69 6f 6e 20 59 72 28 65 29 7b 76 61 72 20 61 3d 7b 69 64 3a 4a 72 28 22 5f 61 69 44 61 74 61 2d 22 2b 28 65 7c 7c 70 29 2b 22 2e 22 2b 57 72 29 2c 61 63 63 65 70 74 3a 51 72 2c 67 65 74 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 2c 72 29 7b 76 61 72 20 69 3d 65 5b 61 2e 69 64 5d 3b 72 65 74 75 72 6e 20 69 3f 69 5b 4d 74 28 74 29 5d 3a 28 72 26 26 28 28 69 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 76 61 72 20 6e 3d 74 5b 65 2e 69 64 5d 3b 69 66 28 21 6e 29 7b 6e 3d 7b 7d 3b 74 72 79 7b 51 72 28 74 29 26 26 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 69 66 28 4b 72 29 74 72 79 7b 72 65 74 75 72 6e 20 4b 72 28 65 2c 74 2c 7b 76 61 6c 75 65 Data Ascii: t=void 0!==t&&t)?"."+Wr:p)+Gr)}function Yr(e){var a={id:Jr("_aiData-"+(e\|\|p)+"."+Wr),accept:Qr,get:function(e,t,n,r){var i=e[a.id];return i?i[Mt(t)]:(r&&((i=function(e,t){var n=t[e.id];if(!n){n={};try{Qr(t)&&!function(e,t,n){if(Kr)try{return Kr(e,t,{value
2024-01-05 02:29:33 UTC	16384	IN	Data Raw: 6e 20 6b 65 79 22 29 2c 69 3d 72 2c 68 5b 4d 61 5d 3d 72 3b 65 3d 5a 74 28 43 2e 64 69 73 61 62 6c 65 44 62 67 45 78 74 29 2c 21 30 3d 3d 3d 65 26 26 50 26 26 28 69 5b 49 65 5d 28 50 29 2c 50 3d 6e 75 6c 6c 29 2c 69 26 26 21 50 26 26 21 30 21 3d 3d 65 26 26 28 50 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 21 6d 72 29 7b 6d 72 3d 7b 7d 3b 66 6f 72 28 76 61 72 20 74 3d 30 3b 74 3c 79 72 5b 55 5d 3b 74 2b 2b 29 6d 72 5b 79 72 5b 74 5d 5d 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 6e 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 65 3d 62 72 28 6e 29 3b 65 26 26 28 65 3d 65 2e 6c 69 73 74 65 6e 65 72 29 26 26 65 5b 74 5d 26 26 65 5b 74 5d 5b 4d 65 5d 28 65 2c 61 72 67 75 6d 65 6e 74 73 29 7d 7d 28 79 72 5b 74 5d 2c 65 29 7d 72 65 74 75 Data Ascii: n key"),i=r,h[Ma]=r;e=Zt(C.disableDbgExt),!0===e&&P&&(i[Ie](P),P=null),i&&!P&&!0!==e&&(P=function(e){if(!mr){mr={};for(var t=0;t<yr[U];t++)mr[yr[t]]=function(t,n){return function(){var e=br(n);e&&(e=e.listener)&&e[t]&&e[t][Me](e,arguments)}}(yr[t],e)}retu
2024-01-05 02:29:33 UTC	16384	IN	Data Raw: 3d 65 5b 4c 73 5d 3a 77 69 6e 64 6f 77 26 26 77 69 6e 64 6f 77 2e 6f 70 65 72 61 26 26 65 5b 56 73 5d 3f 6e 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 66 6f 72 28 76 61 72 20 74 3d 5b 5d 2c 6e 3d 65 5b 44 6f 5d 28 22 5c 6e 22 29 2c 72 3d 30 3b 72 3c 6e 5b 68 5d 3b 72 2b 2b 29 7b 76 61 72 20 69 3d 6e 5b 72 5d 3b 6e 5b 72 2b 31 5d 26 26 28 69 2b 3d 22 40 22 2b 6e 5b 72 2b 31 5d 2c 72 2b 2b 29 2c 74 2e 70 75 73 68 28 69 29 7d 72 65 74 75 72 6e 7b 73 72 63 3a 65 2c 6f 62 6a 3a 74 7d 7d 28 65 5b 4f 6f 5d 29 3a 65 2e 72 65 61 73 6f 6e 26 26 65 2e 72 65 61 73 6f 6e 5b 4d 73 5d 3f 6e 3d 6a 73 28 65 2e 72 65 61 73 6f 6e 5b 4d 73 5d 29 3a 24 28 65 29 3f 6e 3d 6a 73 28 65 29 3a 28 74 3d 65 5b 56 73 5d 7c 7c 65 5b 48 73 5d 7c 7c 22 22 2c 24 28 65 5b 55 73 5d 29 26 26 28 Data Ascii: =e[Ls]:window&&window.opera&&e[Vs]?n=function(e){for(var t=[],n=e[Do]("\n"),r=0;r<n[h];r++){var i=n[r];n[r+1]&&(i+="@"+n[r+1],r++),t.push(i)}return{src:e,obj:t}}(e[Oo]):e.reason&&e.reason[Ms]?n=js(e.reason[Ms]):$(e)?n=js(e):(t=e[Vs]\|\|e[Hs]\|\|"",$(e[Us])&&(
2024-01-05 02:29:33 UTC	16384	IN	Data Raw: 74 63 68 28 72 29 7b 64 28 31 2c 33 36 2c 22 74 72 61 63 6b 4d 65 74 72 69 63 20 66 61 69 6c 65 64 2c 20 6d 65 74 72 69 63 20 77 69 6c 6c 20 6e 6f 74 20 62 65 20 63 6f 6c 6c 65 63 74 65 64 3a 20 22 2b 76 28 72 29 2c 7b 65 78 63 65 70 74 69 6f 6e 3a 73 65 28 72 29 7d 29 7d 7d 2c 53 5b 55 63 5d 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 74 72 79 7b 76 61 72 20 6e 3d 65 7c 7c 7b 7d 3b 6b 5b 55 63 5d 28 6e 2c 58 28 58 28 58 28 7b 7d 2c 6e 2e 70 72 6f 70 65 72 74 69 65 73 29 2c 6e 2e 6d 65 61 73 75 72 65 6d 65 6e 74 73 29 2c 74 29 29 2c 53 2e 63 6f 6e 66 69 67 5b 5f 63 5d 26 26 4f 5b 56 63 5d 28 6e 2e 6e 61 6d 65 2c 6e 2e 75 72 69 29 7d 63 61 74 63 68 28 72 29 7b 64 28 31 2c 33 37 2c 22 74 72 61 63 6b 50 61 67 65 56 69 65 77 20 66 61 69 6c 65 64 2c 20 70 61 Data Ascii: tch(r){d(1,36,"trackMetric failed, metric will not be collected: "+v(r),{exception:se(r)})}},S[Uc]=function(e,t){try{var n=e\|\|{};k[Uc](n,X(X(X({},n.properties),n.measurements),t)),S.config[_c]&&O[Vc](n.name,n.uri)}catch(r){d(1,37,"trackPageView failed, pa
2024-01-05 02:29:33 UTC	16384	IN	Data Raw: 75 28 74 2c 4d 75 29 3b 69 66 28 65 26 26 31 3d 3d 3d 65 2e 6c 65 6e 67 74 68 29 7b 69 66 28 65 5b 30 5d 2e 68 72 65 66 29 72 65 74 75 72 6e 20 65 5b 30 5d 2e 68 72 65 66 3b 69 66 28 65 5b 30 5d 2e 73 72 63 29 72 65 74 75 72 6e 20 65 5b 30 5d 2e 73 72 63 7d 7d 72 65 74 75 72 6e 22 22 7d 28 29 3b 62 72 65 61 6b 3b 63 61 73 65 22 49 4e 50 55 54 22 3a 76 61 72 20 6e 3d 74 2e 74 79 70 65 3b 6e 26 26 7a 75 5b 6e 2e 74 6f 55 70 70 65 72 43 61 73 65 28 29 5d 26 26 28 6e 3d 73 72 28 29 7c 7c 7b 7d 2c 65 3d 74 2e 66 6f 72 6d 3f 74 2e 66 6f 72 6d 2e 61 63 74 69 6f 6e 7c 7c 6e 2e 70 61 74 68 6e 61 6d 65 7c 7c 22 22 3a 6e 2e 70 61 74 68 6e 61 6d 65 7c 7c 22 22 29 7d 72 65 74 75 72 6e 20 65 7d 28 65 29 2c 6f 3d 6c 65 28 6f 3d 74 68 69 73 2e 5f 63 6f 6e 74 65 6e 74 48 Data Ascii: u(t,Mu);if(e&&1===e.length){if(e[0].href)return e[0].href;if(e[0].src)return e[0].src}}return""}();break;case"INPUT":var n=t.type;n&&zu[n.toUpperCase()]&&(n=sr()\|\|{},e=t.form?t.form.action\|\|n.pathname\|\|"":n.pathname\|\|"")}return e}(e),o=le(o=this._contentH
2024-01-05 02:29:33 UTC	16384	IN	Data Raw: 6b 28 6e 29 7d 2c 66 2e 74 72 61 63 6b 50 61 67 65 56 69 65 77 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 49 2e 5f 72 65 63 6f 72 64 54 69 6d 65 53 70 61 6e 28 22 64 77 65 6c 6c 54 69 6d 65 22 2c 21 31 29 2c 54 2e 76 3d 30 2c 69 3d 21 31 2c 66 2e 69 64 2e 69 6e 69 74 69 61 6c 69 7a 65 49 64 73 28 29 2c 65 2e 69 64 3d 66 2e 69 64 2e 67 65 74 4c 61 73 74 50 61 67 65 56 69 65 77 49 64 28 29 2c 64 2e 73 65 6e 64 50 61 67 65 56 69 65 77 49 6e 74 65 72 6e 61 6c 28 65 2c 74 2c 72 28 65 29 29 7d 2c 66 2e 63 61 70 74 75 72 65 50 61 67 65 56 69 65 77 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 67 2e 63 61 70 74 75 72 65 50 61 67 65 56 69 65 77 28 65 2c 74 29 7d 2c 66 2e 74 72 61 63 6b 50 61 67 65 56 69 65 77 50 65 72 66 6f 72 6d 61 6e 63 65 3d 66 75 6e 63 74 69 Data Ascii: k(n)},f.trackPageView=function(e,t){I._recordTimeSpan("dwellTime",!1),T.v=0,i=!1,f.id.initializeIds(),e.id=f.id.getLastPageViewId(),d.sendPageViewInternal(e,t,r(e))},f.capturePageView=function(e,t){g.capturePageView(e,t)},f.trackPageViewPerformance=functi
2024-01-05 02:29:33 UTC	16384	IN	Data Raw: 74 75 72 6e 20 74 26 26 28 48 74 28 74 29 3f 65 3d 5b 74 5d 2e 63 6f 6e 63 61 74 28 65 29 3a 46 28 74 29 26 26 28 65 3d 74 2e 63 6f 6e 63 61 74 28 65 29 29 29 2c 65 7d 52 66 28 73 66 2c 73 66 2c 21 31 29 2c 52 66 28 74 66 2c 74 66 29 2c 52 66 28 6e 66 2c 22 43 6c 69 65 6e 74 2d 49 64 22 29 2c 52 66 28 6f 66 2c 6f 66 29 2c 52 66 28 72 66 2c 72 66 29 2c 52 66 28 61 66 2c 61 66 29 2c 52 66 28 68 63 2c 68 63 29 2c 46 66 2e 5f 5f 69 65 44 79 6e 3d 31 3b 76 61 72 20 48 66 3d 46 66 3b 66 75 6e 63 74 69 6f 6e 20 46 66 28 45 2c 65 2c 5f 2c 64 2c 78 29 7b 74 68 69 73 2e 5f 72 65 73 70 6f 6e 73 65 48 61 6e 64 6c 65 72 73 3d 5b 5d 3b 76 61 72 20 53 2c 4e 2c 44 2c 77 2c 41 2c 6b 2c 50 2c 4f 2c 52 2c 4d 2c 4c 3d 22 3f 63 6f 72 73 3d 74 72 75 65 26 63 6f 6e 74 65 6e 74 Data Ascii: turn t&&(Ht(t)?e=[t].concat(e):F(t)&&(e=t.concat(e))),e}Rf(sf,sf,!1),Rf(tf,tf),Rf(nf,"Client-Id"),Rf(of,of),Rf(rf,rf),Rf(af,af),Rf(hc,hc),Ff.__ieDyn=1;var Hf=Ff;function Ff(E,e,_,d,x){this._responseHandlers=[];var S,N,D,w,A,k,P,O,R,M,L="?cors=true&content
2024-01-05 02:29:33 UTC	16384	IN	Data Raw: 75 6e 63 74 69 6f 6e 28 29 7b 4c 3d 6e 75 6c 6c 2c 66 75 6e 63 74 69 6f 6e 20 72 28 65 2c 74 29 7b 61 28 31 2c 30 2c 74 29 2c 76 28 29 2c 66 75 6e 63 74 69 6f 6e 20 6e 28 65 29 7b 44 2e 69 73 43 6f 6d 70 6c 65 74 65 6c 79 49 64 6c 65 28 29 3f 65 28 29 3a 4c 3d 73 28 66 75 6e 63 74 69 6f 6e 28 29 7b 4c 3d 6e 75 6c 6c 2c 6e 28 65 29 7d 2c 2e 32 35 29 7d 28 66 75 6e 63 74 69 6f 6e 28 29 7b 65 26 26 65 28 29 2c 30 3c 4d 2e 6c 65 6e 67 74 68 3f 4c 3d 73 28 66 75 6e 63 74 69 6f 6e 28 29 7b 4c 3d 6e 75 6c 6c 2c 72 28 4d 2e 73 68 69 66 74 28 29 2c 74 29 7d 2c 30 29 3a 28 4c 3d 6e 75 6c 6c 2c 6f 28 29 29 7d 29 7d 28 74 2c 6e 29 7d 2c 30 29 29 3a 4d 2e 70 75 73 68 28 74 29 3a 28 65 3d 63 28 29 2c 61 28 31 2c 31 2c 6e 29 2c 6e 75 6c 6c 21 3d 3d 74 26 26 74 21 3d 3d Data Ascii: unction(){L=null,function r(e,t){a(1,0,t),v(),function n(e){D.isCompletelyIdle()?e():L=s(function(){L=null,n(e)},.25)}(function(){e&&e(),0<M.length?L=s(function(){L=null,r(M.shift(),t)},0):(L=null,o())})}(t,n)},0)):M.push(t):(e=c(),a(1,1,n),null!==t&&t!==
2024-01-05 02:29:33 UTC	16384	IN	Data Raw: 72 61 63 65 43 74 78 28 29 2e 67 65 74 54 72 61 63 65 49 64 28 29 7c 7c 72 7d 2c 65 2e 67 65 74 4c 61 73 74 50 61 67 65 56 69 65 77 49 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 6e 7d 7d 29 7d 63 70 2e 5f 5f 69 65 44 79 6e 3d 31 3b 76 61 72 20 75 70 3d 63 70 2c 6c 70 3d 22 64 75 72 61 74 69 6f 6e 22 2c 66 70 3d 22 70 72 6f 70 65 72 74 69 65 73 22 2c 64 70 3d 22 72 65 71 75 65 73 74 55 72 6c 22 2c 70 70 3d 22 69 6e 73 74 22 2c 67 70 3d 22 6c 65 6e 67 74 68 22 2c 68 70 3d 22 74 72 61 63 65 49 44 22 2c 76 70 3d 22 73 70 61 6e 49 44 22 2c 6d 70 3d 22 74 72 61 63 65 46 6c 61 67 73 22 2c 79 70 3d 22 63 6f 6e 74 65 78 74 22 2c 43 70 3d 22 61 62 6f 72 74 65 64 22 2c 62 70 3d 22 74 72 61 63 65 49 64 22 2c 54 70 3d 22 73 70 61 6e 49 64 22 2c 49 70 Data Ascii: raceCtx().getTraceId()\|\|r},e.getLastPageViewId=function(){return n}})}cp.__ieDyn=1;var up=cp,lp="duration",fp="properties",dp="requestUrl",pp="inst",gp="length",hp="traceID",vp="spanID",mp="traceFlags",yp="context",Cp="aborted",bp="traceId",Tp="spanId",Ip

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49722	13.107.213.57	443	4052	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-05 02:29:33 UTC	551	OUT	GET /mscc/lib/v2/wcp-consent.js HTTP/1.1 Host: wcpstatic.microsoft.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://learn.microsoft.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-05 02:29:33 UTC	714	IN	HTTP/1.1 200 OK Date: Fri, 05 Jan 2024 02:29:33 GMT Content-Type: application/javascript Content-Length: 279220 Connection: close Access-Control-Allow-Origin: * Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding Age: 13270 Cache-Control: max-age=43200 Content-MD5: X1JOIM5h9UISVFS6+GfEew== Etag: 0x8DA85F6EA62BF74 Last-Modified: Wed, 24 Aug 2022 17:34:36 GMT Vary: Accept-Encoding X-Cache: CONFIG_NOCACHE x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: 0445ab9f-d01e-0042-2c60-3fb266000000 x-ms-version: 2009-09-19 x-azure-ref: 20240105T022933Z-ncp95y70ah50fcrsz4p3u6yhh80000000hg0000000003qwv Accept-Ranges: bytes
2024-01-05 02:29:33 UTC	15670	IN	Data Raw: 76 61 72 20 57 63 70 43 6f 6e 73 65 6e 74 3b 21 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 65 3d 7b 32 32 39 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 77 69 6e 64 6f 77 2c 65 2e 65 78 70 6f 72 74 73 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 61 3d 7b 7d 3b 66 75 6e 63 74 69 6f 6e 20 69 28 6e 29 7b 69 66 28 61 5b 6e 5d 29 72 65 74 75 72 6e 20 61 5b 6e 5d 2e 65 78 70 6f 72 74 73 3b 76 61 72 20 6f 3d 61 5b 6e 5d 3d 7b 69 3a 6e 2c 6c 3a 21 31 2c 65 78 70 6f 72 74 73 3a 7b 7d 7d 3b 72 65 74 75 72 6e 20 65 5b 6e 5d 2e 63 61 6c 6c 28 6f 2e 65 78 70 6f 72 74 73 2c 6f 2c 6f 2e 65 78 70 6f 72 74 73 2c 69 29 2c 6f 2e 6c 3d 21 30 2c 6f 2e 65 78 70 6f 72 74 73 7d 72 65 74 75 72 6e 20 69 2e 6d 3d 65 2c 69 2e 63 3d 61 2c 69 2e 64 3d 66 75 6e 63 74 69 6f 6e 28 65 Data Ascii: var WcpConsent;!function(){var e={229:function(e){window,e.exports=function(e){var a={};function i(n){if(a[n])return a[n].exports;var o=a[n]={i:n,l:!1,exports:{}};return e[n].call(o.exports,o,o.exports,i),o.l=!0,o.exports}return i.m=e,i.c=a,i.d=function(e
2024-01-05 02:29:33 UTC	16384	IN	Data Raw: 65 29 7b 72 65 74 75 72 6e 20 65 3f 65 2e 72 65 70 6c 61 63 65 28 2f 26 2f 67 2c 22 26 61 6d 70 3b 22 29 2e 72 65 70 6c 61 63 65 28 2f 3c 2f 67 2c 22 26 6c 74 3b 22 29 2e 72 65 70 6c 61 63 65 28 2f 3e 2f 67 2c 22 26 67 74 3b 22 29 2e 72 65 70 6c 61 63 65 28 2f 22 2f 67 2c 22 26 71 75 6f 74 3b 22 29 2e 72 65 70 6c 61 63 65 28 2f 27 2f 67 2c 22 26 23 30 33 39 3b 22 29 3a 22 22 7d 2c 65 7d 28 29 2c 72 3d 6e 2e 6c 6f 63 61 6c 73 2c 73 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 65 28 65 2c 61 2c 69 2c 6e 2c 6f 2c 74 2c 72 29 7b 74 68 69 73 2e 64 69 72 65 63 74 69 6f 6e 3d 22 6c 74 72 22 2c 74 68 69 73 2e 70 72 65 76 69 6f 75 73 46 6f 63 75 73 45 6c 65 6d 65 6e 74 42 65 66 6f 72 65 50 6f 70 75 70 3d 6e 75 6c 6c 2c 74 68 69 73 2e 63 6f 6f 6b Data Ascii: e){return e?e.replace(/&/g,"&").replace(/</g,"<").replace(/>/g,">").replace(/"/g,""").replace(/'/g,"'"):""},e}(),r=n.locals,s=function(){function e(e,a,i,n,o,t,r){this.direction="ltr",this.previousFocusElementBeforePopup=null,this.cook
2024-01-05 02:29:33 UTC	713	IN	Data Raw: 6c 6f 72 22 5d 2b 22 20 21 69 6d 70 6f 72 74 61 6e 74 3b 5c 6e 20 20 20 20 20 20 20 20 7d 22 2c 61 2b 3d 27 69 6e 70 75 74 5b 74 79 70 65 3d 22 72 61 64 69 6f 22 5d 2e 27 2b 6c 2e 63 6f 6f 6b 69 65 49 74 65 6d 52 61 64 69 6f 42 74 6e 2b 22 20 2b 20 6c 61 62 65 6c 3a 68 6f 76 65 72 3a 3a 61 66 74 65 72 20 7b 5c 6e 20 20 20 20 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 22 2b 65 5b 22 72 61 64 69 6f 2d 62 75 74 74 6f 6e 2d 68 6f 76 65 72 2d 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 22 5d 2b 22 20 21 69 6d 70 6f 72 74 61 6e 74 3b 5c 6e 20 20 20 20 20 20 20 20 7d 22 2c 61 2b 3d 27 69 6e 70 75 74 5b 74 79 70 65 3d 22 72 61 64 69 6f 22 5d 2e 27 2b 6c 2e 63 6f 6f 6b 69 65 49 74 65 6d 52 61 64 69 6f 42 74 6e 2b 22 20 2b 20 Data Ascii: lor"]+" !important;\n }",a+='input[type="radio"].'+l.cookieItemRadioBtn+" + label:hover::after {\n background-color: "+e["radio-button-hover-background-color"]+" !important;\n }",a+='input[type="radio"].'+l.cookieItemRadioBtn+" +
2024-01-05 02:29:33 UTC	16384	IN	Data Raw: 20 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 22 2b 65 5b 22 72 61 64 69 6f 2d 62 75 74 74 6f 6e 2d 64 69 73 61 62 6c 65 64 2d 63 6f 6c 6f 72 22 5d 2b 22 20 21 69 6d 70 6f 72 74 61 6e 74 3b 5c 6e 20 20 20 20 20 20 20 20 7d 22 7d 2c 65 7d 28 29 2c 64 3d 5b 22 61 72 22 2c 22 68 65 22 2c 22 70 73 22 2c 22 75 72 22 2c 22 66 61 22 2c 22 70 61 22 2c 22 73 64 22 2c 22 74 6b 22 2c 22 75 67 22 2c 22 79 69 22 2c 22 73 79 72 22 2c 22 6b 73 2d 61 72 61 62 22 5d 2c 75 3d 7b 22 63 6c 6f 73 65 2d 62 75 74 74 6f 6e 2d 63 6f 6c 6f 72 22 3a 22 23 36 36 36 36 36 36 22 2c 22 73 65 63 6f 6e 64 61 72 79 2d 62 75 74 74 6f 6e 2d 64 69 73 61 62 6c 65 64 2d 6f 70 61 63 69 74 79 22 3a 22 31 22 2c 22 73 65 63 6f 6e 64 61 72 79 2d 62 75 74 74 6f 6e Data Ascii: background-color: "+e["radio-button-disabled-color"]+" !important;\n }"},e}(),d=["ar","he","ps","ur","fa","pa","sd","tk","ug","yi","syr","ks-arab"],u={"close-button-color":"#666666","secondary-button-disabled-opacity":"1","secondary-button
2024-01-05 02:29:33 UTC	16384	IN	Data Raw: 6f 72 74 65 64 2c 20 73 65 74 74 69 6e 67 20 63 6f 6e 73 65 6e 74 20 69 73 20 68 61 6e 64 6c 65 64 20 62 79 20 6c 69 62 72 61 72 79 22 29 7d 2c 65 2e 68 61 73 43 6f 6e 73 65 6e 74 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 67 28 29 7d 2c 65 2e 69 73 56 69 73 69 62 6c 65 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 21 21 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 22 77 63 70 43 6f 6e 73 65 6e 74 42 61 6e 6e 65 72 43 74 72 6c 22 29 7d 2c 65 2e 65 6d 69 74 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 66 6f 72 28 76 61 72 20 61 3d 5b 5d 2c 69 3d 31 3b 69 3c 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3b 69 2b 2b 29 61 5b 69 2d 31 5d 3d 61 72 67 75 6d 65 6e 74 73 5b 69 5d 3b 76 61 72 20 6e 3d 74 68 69 73 2e 65 Data Ascii: orted, setting consent is handled by library")},e.hasConsent=function(){return g()},e.isVisible=function(){return!!document.getElementById("wcpConsentBannerCtrl")},e.emit=function(e){for(var a=[],i=1;i<arguments.length;i++)a[i-1]=arguments[i];var n=this.e
2024-01-05 02:29:33 UTC	16384	IN	Data Raw: 84 d9 81 d8 a7 d8 aa 20 d8 aa d8 b9 d8 b1 d9 8a d9 81 20 d8 a7 d9 84 d8 a7 d8 b1 d8 aa d8 a8 d8 a7 d8 b7 20 d8 b9 d9 84 d9 89 20 d9 88 d8 b3 d8 a7 d8 a6 d9 84 20 d8 a7 d9 84 d8 aa d9 88 d8 a7 d8 b5 d9 84 20 d8 a7 d9 84 d8 a7 d8 ac d8 aa d9 85 d8 a7 d8 b9 d9 8a 20 d9 84 d8 b9 d8 b1 d8 b6 20 d8 a7 d9 84 d8 a5 d8 b9 d9 84 d8 a7 d9 86 d8 a7 d8 aa 20 d9 88 d8 a7 d9 84 d9 85 d8 ad d8 aa d9 88 d9 89 20 d8 a7 d8 b3 d8 aa d9 86 d8 a7 d8 af d9 8b d8 a7 20 d8 a5 d9 84 d9 89 20 d9 85 d9 84 d9 81 d8 a7 d8 aa 20 d8 aa d8 b9 d8 b1 d9 8a d9 81 d9 83 20 d8 b9 d9 84 d9 89 20 d9 88 d8 b3 d8 a7 d8 a6 d9 84 20 d8 a7 d9 84 d8 aa d9 88 d8 a7 d8 b5 d9 84 20 d8 a7 d9 84 d8 a7 d8 ac d8 aa d9 85 d8 a7 d8 b9 d9 8a 20 d9 88 d8 a7 d9 84 d9 86 d8 b4 d8 a7 d8 b7 20 d8 b9 d9 84 d9 89 20 Data Ascii:
2024-01-05 02:29:33 UTC	16384	IN	Data Raw: 80 d1 81 d0 be d0 bd d0 b0 d0 bb d0 b8 d0 b7 d0 b8 d1 80 d0 b0 d0 bd d0 b0 20 d1 80 d0 b5 d0 ba d0 bb d0 b0 d0 bc d0 b0 20 d0 b2 d1 8a d0 b7 20 d0 be d1 81 d0 bd d0 be d0 b2 d0 b0 20 d0 bd d0 b0 20 d0 b2 d0 b0 d1 88 d0 b0 d1 82 d0 b0 20 d0 be d0 bd d0 bb d0 b0 d0 b9 d0 bd 20 d0 b0 d0 ba d1 82 d0 b8 d0 b2 d0 bd d0 be d1 81 d1 82 2e 20 d0 90 d0 ba d0 be 20 d0 be d1 82 d1 85 d0 b2 d1 8a d1 80 d0 bb d0 b8 d1 82 d0 b5 20 d0 be d0 bf d1 86 d0 b8 d0 be d0 bd d0 b0 d0 bb d0 bd d0 b8 d1 82 d0 b5 20 d0 b1 d0 b8 d1 81 d0 ba d0 b2 d0 b8 d1 82 d0 ba d0 b8 2c 20 d1 89 d0 b5 20 d1 81 d0 b5 20 d0 b8 d0 b7 d0 bf d0 be d0 bb d0 b7 d0 b2 d0 b0 d1 82 20 d1 81 d0 b0 d0 bc d0 be 20 d0 b1 d0 b8 d1 81 d0 ba d0 b2 d0 b8 d1 82 d0 ba d0 b8 2c 20 d0 ba d0 be d0 b8 d1 82 d0 be 20 d1 Data Ascii: . , ,
2024-01-05 02:29:33 UTC	1024	IN	Data Raw: 69 65 20 70 72 6f 20 73 6f 63 69 c3 a1 6c 6e c3 ad 20 73 c3 ad 74 c4 9b 20 70 6f 75 c5 be c3 ad 76 c3 a1 6d 65 20 73 70 6f 6c 75 20 73 20 74 c5 99 65 74 c3 ad 6d 69 20 73 74 72 61 6e 61 6d 69 20 6b 20 7a 6f 62 72 61 7a 6f 76 c3 a1 6e c3 ad 20 72 65 6b 6c 61 6d 20 61 20 6f 62 73 61 68 75 20 6e 61 20 7a c3 a1 6b 6c 61 64 c4 9b 20 76 61 c5 a1 69 63 68 20 70 72 6f 66 69 6c c5 af 20 6e 61 20 73 6f 63 69 c3 a1 6c 6e c3 ad 63 68 20 73 c3 ad 74 c3 ad 63 68 20 61 20 61 6b 74 69 76 69 74 20 6e 61 20 6e 61 c5 a1 69 63 68 20 77 65 62 65 63 68 2e 20 53 6c 6f 75 c5 be c3 ad 20 6b 20 70 72 6f 70 6f 6a 65 6e c3 ad 20 76 61 c5 a1 c3 ad 20 61 6b 74 69 76 69 74 79 20 6e 61 20 6e 61 c5 a1 69 63 68 20 77 65 62 65 63 68 20 73 20 70 72 6f 66 69 6c 79 20 6e 61 20 73 6f 63 69 c3 Data Ascii: ie pro sociln st pouvme spolu s tetmi stranami k zobrazovn reklam a obsahu na zklad vaich profil na socilnch stch a aktivit na naich webech. Slou k propojen va aktivity na naich webech s profily na soci
2024-01-05 02:29:33 UTC	16384	IN	Data Raw: 69 27 6e 20 64 65 66 6e 79 64 64 69 6f 20 62 72 69 77 73 69 6f 6e 20 69 20 77 65 6c 6c 61 27 63 68 20 70 72 6f 66 69 61 64 20 61 72 20 65 69 6e 20 67 77 65 66 61 6e 6e 61 75 20 61 72 20 67 79 66 65 72 20 68 79 73 62 79 73 65 62 75 2e 20 3c 61 20 74 61 72 67 65 74 3d 27 5f 62 6c 61 6e 6b 27 20 68 72 65 66 3d 27 68 74 74 70 73 3a 2f 2f 67 6f 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 66 77 6c 69 6e 6b 2f 3f 4c 69 6e 6b 49 64 3d 35 32 31 38 33 39 27 3e 44 61 74 67 61 6e 69 61 64 20 50 72 65 69 66 61 74 72 77 79 64 64 3c 2f 61 3e 22 2c 61 63 63 65 70 74 41 6c 6c 4c 61 62 65 6c 3a 22 44 65 72 62 79 6e 22 2c 72 65 6a 65 63 74 41 6c 6c 4c 61 62 65 6c 3a 22 47 77 72 74 68 6f 64 22 2c 6d 6f 72 65 49 6e 66 6f 4c 61 62 65 6c 3a 22 52 68 65 6f 6c 69 20 62 72 69 77 Data Ascii: i'n defnyddio briwsion i wella'ch profiad ar ein gwefannau ar gyfer hysbysebu. <a target='_blank' href='https://go.microsoft.com/fwlink/?LinkId=521839'>Datganiad Preifatrwydd</a>",acceptAllLabel:"Derbyn",rejectAllLabel:"Gwrthod",moreInfoLabel:"Rheoli briw
2024-01-05 02:29:33 UTC	16384	IN	Data Raw: cf 84 ce b9 ce ba ce b1 cf 84 ce bf cf 80 cf 84 cf 81 ce af ce b6 ce bf cf 85 ce bd 20 ce ba ce b1 ce bb cf 8d cf 84 ce b5 cf 81 ce b1 20 cf 84 ce b1 20 ce b5 ce bd ce b4 ce b9 ce b1 cf 86 ce ad cf 81 ce bf ce bd cf 84 ce ac 20 cf 83 ce b1 cf 82 2e 22 7d 2c 7b 69 64 3a 22 63 33 22 2c 6e 61 6d 65 3a 22 43 6f 6f 6b 69 65 20 ce b4 ce b9 ce b1 cf 86 ce b7 ce bc ce af cf 83 ce b5 cf 89 ce bd 22 2c 64 65 73 63 3a 22 ce 95 ce bc ce b5 ce af cf 82 2c 20 ce ba ce b1 ce b8 cf 8e cf 82 20 ce ba ce b1 ce b9 20 cf 84 cf 81 ce af cf 84 ce b1 20 ce bc ce ad cf 81 ce b7 2c 20 cf 87 cf 81 ce b7 cf 83 ce b9 ce bc ce bf cf 80 ce bf ce b9 ce bf cf 8d ce bc ce b5 20 63 6f 6f 6b 69 65 20 ce b4 ce b9 ce b1 cf 86 ce b7 ce bc ce af cf 83 ce b5 cf 89 ce bd 20 ce ba ce b1 ce b9 20 Data Ascii: ."},{id:"c3",name:"Cookie ",desc:", , cookie

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49741	23.1.244.180	443

Timestamp	Bytes transferred	Direction	Data
2024-01-05 02:29:35 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-01-05 02:29:35 UTC	533	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Last-Modified: Tue, 16 May 2017 22:58:00 GMT ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-eus2-z1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json X-MSEdge-Ref: Ref A: EBAA5EB4F8314AE9868BD97CD6EDC6C5 Ref B: PAOEDGE0606 Ref C: 2024-01-04T23:40:21Z Cache-Control: public, max-age=249011 Date: Fri, 05 Jan 2024 02:29:35 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49751	23.1.244.180	443

Timestamp	Bytes transferred	Direction	Data
2024-01-05 02:29:36 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-01-05 02:29:36 UTC	531	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Last-Modified: Tue, 16 May 2017 22:58:00 GMT ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json X-Azure-Ref: 0tRYRYwAAAAB+m19QWmzDRKgUYMFKn7LkU0pDRURHRTA1MDYAY2VmYzI1ODMtYTliMi00NGE3LTk3NTUtYjc2ZDE3ZTA1Zjdm Cache-Control: public, max-age=248732 Date: Fri, 05 Jan 2024 02:29:36 GMT Content-Length: 55 Connection: close X-CID: 2
2024-01-05 02:29:36 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49776	20.12.23.50	443

Timestamp	Bytes transferred	Direction	Data
2024-01-05 02:29:43 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=bwRtW6N881YGmLR&MD=aOu5faNG HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-01-05 02:29:43 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: 413bbe8c-4f91-4e99-a362-cac5984f0845 MS-RequestId: 9592dd9a-6b0c-420a-ad95-d710a56171ae MS-CV: bJOUMuvbOEGqGsz1.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Fri, 05 Jan 2024 02:29:42 GMT Connection: close Content-Length: 24490
2024-01-05 02:29:43 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-01-05 02:29:43 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port
7	192.168.2.5	49785	23.1.237.91	443

Timestamp	Bytes transferred	Direction	Data
2024-01-05 02:29:43 UTC	2148	OUT	POST /threshold/xls.aspx HTTP/1.1 Origin: https://www.bing.com Referer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/Init Accept: / Accept-Language: en-CH Content-type: text/xml X-Agent-DeviceId: 01000A410900D492 X-BM-CBT: 1696428841 X-BM-DateFormat: dd/MM/yyyy X-BM-DeviceDimensions: 784x984 X-BM-DeviceDimensionsLogical: 784x984 X-BM-DeviceScale: 100 X-BM-DTZ: 120 X-BM-Market: CH X-BM-Theme: 000000;0078d7 X-BM-WindowsFlights: FX:117B9872,FX:119E26AD,FX:11C0E96C,FX:11C6E5C2,FX:11C7EB6A,FX:11C9408A,FX:11C940DB,FX:11CB9A9F,FX:11CB9AC1,FX:11CC111C,FX:11D5BFCD,FX:11DF5B12,FX:11DF5B75,FX:1240931B,FX:124B38D0,FX:127FC878,FX:1283FFE8,FX:12840617,FX:128979F9,FX:128EBD7E,FX:129135BB,FX:129E053F,FX:12A74DB5,FX:12AB734D,FX:12B8450E,FX:12BD6E73,FX:12C3331B,FX:12C7D66E X-Device-ClientSession: DB0AFB19004F47BC80E5208C7478FF22 X-Device-isOptin: false X-Device-MachineId: {92C86F7C-DB2B-4F6A-95AD-98B4A2AE008A} X-Device-OSSKU: 48 X-Device-Touch: false X-DeviceID: 01000A410900D492 X-MSEdge-ExternalExp: d-thshld39,d-thshld42,d-thshld77,d-thshld78,staticsh X-MSEdge-ExternalExpType: JointCoord X-PositionerType: Desktop X-Search-AppId: Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUI X-Search-CortanaAvailableCapabilities: None X-Search-SafeSearch: Moderate X-Search-TimeZone: Bias=-60; DaylightBias=-60; TimeZoneKeyName=W. Europe Standard Time X-UserAgeClass: Unknown Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: www.bing.com Content-Length: 2483 Connection: Keep-Alive Cache-Control: no-cache Cookie: MUID=2F4E96DB8B7049E59AD4484C3C00F7CF; _SS=SID=1A6DEABB468B65843EB5F91B47916435&CPID=1704421751788&AC=1&CPH=d1a4eb75; _EDGE_S=SID=1A6DEABB468B65843EB5F91B47916435; SRCHUID=V=2&GUID=3D32B8AC657C4AD781A584E283227995&dmnchg=1; SRCHD=AF=NOFORM; SRCHUSR=DOB=20231004; SRCHHPGUSR=SRCHLANG=en&IPMH=986d886c&IPMID=1696428841029&HV=1696428756; CortanaAppUID=5A290E2CC4B523E2D8B5E2E3E4CB7CB7; MUIDB=2F4E96DB8B7049E59AD4484C3C00F7CF
2024-01-05 02:29:43 UTC	1	OUT	Data Raw: 3c Data Ascii: <
2024-01-05 02:29:43 UTC	2482	OUT	Data Raw: 43 6c 69 65 6e 74 49 6e 73 74 52 65 71 75 65 73 74 3e 3c 43 49 44 3e 33 36 34 34 46 44 37 34 44 46 31 36 36 31 38 46 30 38 46 37 45 43 30 33 44 45 35 35 36 30 30 31 3c 2f 43 49 44 3e 3c 45 76 65 6e 74 73 3e 3c 45 3e 3c 54 3e 45 76 65 6e 74 2e 43 6c 69 65 6e 74 49 6e 73 74 3c 2f 54 3e 3c 49 47 3e 37 35 32 32 38 31 35 36 37 30 33 41 34 30 44 35 42 39 37 45 35 41 36 38 33 36 46 32 41 31 43 45 3c 2f 49 47 3e 3c 44 3e 3c 21 5b 43 44 41 54 41 5b 7b 22 43 75 72 55 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 62 69 6e 67 2e 63 6f 6d 2f 41 53 2f 41 50 49 2f 57 69 6e 64 6f 77 73 43 6f 72 74 61 6e 61 50 61 6e 65 2f 56 32 2f 49 6e 69 74 22 2c 22 50 69 76 6f 74 22 3a 22 51 46 22 2c 22 54 22 3a 22 43 49 2e 42 6f 78 4d 6f 64 65 6c 22 2c 22 46 49 44 22 3a 22 43 49 Data Ascii: ClientInstRequest><CID>3644FD74DF16618F08F7EC03DE556001</CID><Events><E><T>Event.ClientInst</T><IG>75228156703A40D5B97E5A6836F2A1CE</IG><D><![CDATA[{"CurUrl":"https://www.bing.com/AS/API/WindowsCortanaPane/V2/Init","Pivot":"QF","T":"CI.BoxModel","FID":"CI
2024-01-05 02:29:43 UTC	476	IN	HTTP/1.1 204 No Content Access-Control-Allow-Origin: * Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: 116BE13E2AAA4BCDA1478E6AA892D05C Ref B: BY3EDGE0312 Ref C: 2024-01-05T02:29:43Z Date: Fri, 05 Jan 2024 02:29:43 GMT Connection: close Alt-Svc: h3=":443"; ma=93600 X-CDN-TraceID: 0.57ed0117.1704421783.94851dce

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.5	49796	20.12.23.50	443

Timestamp	Bytes transferred	Direction	Data
2024-01-05 02:30:20 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=bwRtW6N881YGmLR&MD=aOu5faNG HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-01-05 02:30:21 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "Mx1RoJH/qEwpWfKllx7sbsl28AuERz5IYdcsvtTJcgM=_2160" MS-CorrelationId: 5e89564f-514b-4e55-b028-f093998e6287 MS-RequestId: c1a5cac0-6723-477f-85e3-ec40d063b7a0 MS-CV: DPVDm6anDUKDVHvs.0 X-Microsoft-SLSClientCache: 2160 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Fri, 05 Jan 2024 02:30:20 GMT Connection: close Content-Length: 25457
2024-01-05 02:30:21 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 51 22 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 db 8e 00 00 14 00 00 00 00 00 10 00 51 22 00 00 20 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 f3 43 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 0d 92 6f db e5 21 f3 43 43 4b ed 5a 09 38 55 5b df 3f 93 99 90 29 99 e7 29 ec 73 cc 4a 66 32 cf 84 32 64 c8 31 c7 11 52 38 87 90 42 66 09 99 87 32 0f 19 0a 09 51 a6 a8 08 29 53 86 4a 52 84 50 df 46 83 ba dd 7b df fb 7e ef 7d ee 7d bf ef 9e e7 d9 67 ef 35 ee b5 fe eb 3f ff b6 96 81 a2 0a 04 fc 31 40 21 5b 3f a5 ed 1b 04 0e 85 42 a0 10 04 64 12 6c a5 de aa a1 d8 ea f3 58 01 f2 f5 67 0b 5e 9b bd e8 a0 90 1d bf 40 88 9d eb 49 b4 87 9b ab 8b 9d 2b 46 c8 c7 c5 19 92 Data Ascii: MSCFQ"DQ" AdCenvironment.cabo!CCKZ8U[?))sJf22d1R8Bf2Q)SJRPF{~}}g5?1@![?BdlXg^@I+F
2024-01-05 02:30:21 UTC	9633	IN	Data Raw: 21 6f b3 eb a6 cc f5 31 be cf 05 e2 a9 fe fa 57 6d 19 30 b3 c2 c5 66 c9 6a df f5 e7 f0 78 bd c7 a8 9e 25 e3 f9 bc ed 6b 54 57 08 2b 51 82 44 12 fb b9 53 8c cc f4 60 12 8a 76 cc 40 40 41 9b dc 5c 17 ff 5c f9 5e 17 35 98 24 56 4b 74 ef 42 10 c8 af bf 7f c6 7f f2 37 7d 5a 3f 1c f2 99 79 4a 91 52 00 af 38 0f 17 f5 2f 79 81 65 d9 a9 b5 6b e4 c7 ce f6 ca 7a 00 6f 4b 30 44 24 22 3c cf ed 03 a5 96 8f 59 29 bc b6 fd 04 e1 70 9f 32 4a 27 fd 55 af 2f fe b6 e5 8e 33 bb 62 5f 9a db 57 40 e9 f1 ce 99 66 90 8c ff 6a 62 7f dd c5 4a 0b 91 26 e2 39 ec 19 4a 71 63 9d 7b 21 6d c3 9c a3 a2 3c fa 7f 7d 96 6a 90 78 a6 6d d2 e1 9c f9 1d fc 38 d8 94 f4 c6 a5 0a 96 86 a4 bd 9e 1a ae 04 42 83 b8 b5 80 9b 22 38 20 b5 25 e5 64 ec f7 f4 bf 7e 63 59 25 0f 7a 2e 39 57 76 a2 71 aa 06 8a Data Ascii: !o1Wm0fjx%kTW+QDS`v@@A\\^5$VKtB7}Z?yJR8/yekzoK0D$"<Y)p2J'U/3b_W@fjbJ&9Jqc{!m<}jxm8B"8 %d~cY%z.9Wvq

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.5	49802	142.250.115.139	443	4052	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-05 02:30:59 UTC	449	OUT	GET /tools/pso/ping?as=chrome&brand=ONGR&pid=&hl=en&events=C1I,C2I,C7I,C1S,C7S&rep=2&rlz=C1:,C2:,C7:&id=000000000000000000000000000000000000000040896C04EA HTTP/1.1 Host: clients1.google.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br
2024-01-05 02:31:00 UTC	817	IN	HTTP/1.1 200 OK Content-Security-Policy: script-src 'report-sample' 'nonce-0T3Ko_5_-ZoNL1T7gBuC9w' 'unsafe-inline' 'strict-dynamic' https: http:;object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/download-dt/1 Content-Security-Policy: script-src 'report-sample' 'nonce-lg48q2xHEIWEniEL7Jhdzg' 'unsafe-inline' 'strict-dynamic' https: http:;object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/download-dt/1 Content-Type: text/plain; charset=utf-8 Content-Length: 220 Date: Fri, 05 Jan 2024 02:31:00 GMT Expires: Fri, 05 Jan 2024 02:31:00 GMT Cache-Control: private, max-age=0 X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block Server: GSE Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-01-05 02:31:00 UTC	220	IN	Data Raw: 72 6c 7a 43 31 3a 20 31 43 31 4f 4e 47 52 5f 65 6e 47 42 31 30 39 31 0a 72 6c 7a 43 32 3a 20 31 43 32 4f 4e 47 52 5f 65 6e 47 42 31 30 39 31 0a 72 6c 7a 43 37 3a 20 31 43 37 4f 4e 47 52 5f 65 6e 47 42 31 30 39 31 0a 64 63 63 3a 20 0a 73 65 74 5f 64 63 63 3a 20 43 31 3a 31 43 31 4f 4e 47 52 5f 65 6e 47 42 31 30 39 31 2c 43 32 3a 31 43 32 4f 4e 47 52 5f 65 6e 47 42 31 30 39 31 2c 43 37 3a 31 43 37 4f 4e 47 52 5f 65 6e 47 42 31 30 39 31 0a 65 76 65 6e 74 73 3a 20 43 31 49 2c 43 32 49 2c 43 37 49 2c 43 31 53 2c 43 37 53 0a 73 74 61 74 65 66 75 6c 2d 65 76 65 6e 74 73 3a 20 43 31 49 2c 43 32 49 2c 43 37 49 0a 63 72 63 33 32 3a 20 65 63 33 33 62 66 35 33 0a Data Ascii: rlzC1: 1C1ONGR_enGB1091rlzC2: 1C2ONGR_enGB1091rlzC7: 1C7ONGR_enGB1091dcc: set_dcc: C1:1C1ONGR_enGB1091,C2:1C2ONGR_enGB1091,C7:1C7ONGR_enGB1091events: C1I,C2I,C7I,C1S,C7Sstateful-events: C1I,C2I,C7Icrc32: ec33bf53

Target ID:	0
Start time:	03:29:23
Start date:	05/01/2024
Path:	C:\Users\user\Desktop\Renewal.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\Renewal.exe
Imagebase:	0xcd0000
File size:	12'800 bytes
MD5 hash:	E7457FC1FECAC4151A1D49B54CF3ACD5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	03:29:28
Start date:	05/01/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=Renewal.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	4
Start time:	03:29:29
Start date:	05/01/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2540 --field-trial-handle=2364,i,3433059245063578953,17793063878387418449,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	03:29:31
Start date:	05/01/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=Renewal.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	03:29:32
Start date:	05/01/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 --field-trial-handle=2028,i,5267686039598994631,3060138403470109992,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Renewal.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

Phishing

Compliance

Networking

System Summary

Boot Survival

HIPS / PFW / Operating System Protection Evasion

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Chrome Cache Entry: 100

Chrome Cache Entry: 101

Chrome Cache Entry: 102

Chrome Cache Entry: 103

Chrome Cache Entry: 104

Chrome Cache Entry: 105

Chrome Cache Entry: 106

Chrome Cache Entry: 107

Chrome Cache Entry: 108

Chrome Cache Entry: 109

Chrome Cache Entry: 110

Chrome Cache Entry: 111

Chrome Cache Entry: 112

Chrome Cache Entry: 113

Chrome Cache Entry: 114

Chrome Cache Entry: 115

Chrome Cache Entry: 116

Chrome Cache Entry: 117

Chrome Cache Entry: 118

Chrome Cache Entry: 119

Chrome Cache Entry: 120

Windows Analysis Report
Renewal.exe