Edit tour

Windows Analysis Report
WAXD480.exe

Overview

General Information

Sample name:	WAXD480.exe (renamed file extension from tmp to exe)
Original sample name:	WAXD480.tmp
Analysis ID:	1430820
MD5:	7f1ffc9be9757477a8a39cb06d5032c8
SHA1:	31a174cb6a0d6b4f59529235d8efdb5bf5cca94a
SHA256:	f9a43eaa4e4ba619d3470762e5cd4226ad707f59bd89d892584df2771089ef3d
Infos:

Detection

Score:	3
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

Binary contains a suspicious time stamp

Creates a process in suspended mode (likely to inject code)

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

PE file does not import any functions

Uses 32bit PE files

Classification

Process Tree

System is w10x64

WAXD480.exe (PID: 7260 cmdline: "C:\Users\user\Desktop\WAXD480.exe" MD5: 7F1FFC9BE9757477A8A39CB06D5032C8)

chrome.exe (PID: 7364 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=WAXD480.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 7576 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1680 --field-trial-handle=2028,i,4872466835619599832,212431843967096772,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 792 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=WAXD480.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 7824 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2052 --field-trial-handle=1996,i,12553455973178745463,2557296557389022246,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=WAXD480.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	HTTP Parser: No favicon
Source: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=WAXD480.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	HTTP Parser: No favicon
Source: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=WAXD480.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	HTTP Parser: No favicon

Source: WAXD480.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 23.202.57.177:443 -> 192.168.2.4:49755 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.202.57.177:443 -> 192.168.2.4:49760 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.165.165.26:443 -> 192.168.2.4:49792 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.165.165.26:443 -> 192.168.2.4:49835 version: TLS 1.2

Source: WAXD480.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: Joe Sandbox View	IP Address: 63.140.37.206 63.140.37.206
Source: Joe Sandbox View	IP Address: 13.107.213.69 13.107.213.69
Source: Joe Sandbox View	IP Address: 239.255.255.250 239.255.255.250
Source: Joe Sandbox View	IP Address: 63.140.36.51 63.140.36.51

Source: Joe Sandbox View

JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 23.202.57.177
Source: unknown	TCP traffic detected without corresponding DNS query: 23.202.57.177
Source: unknown	TCP traffic detected without corresponding DNS query: 23.202.57.177
Source: unknown	TCP traffic detected without corresponding DNS query: 23.202.57.177
Source: unknown	TCP traffic detected without corresponding DNS query: 23.202.57.177
Source: unknown	TCP traffic detected without corresponding DNS query: 23.202.57.177
Source: unknown	TCP traffic detected without corresponding DNS query: 23.202.57.177
Source: unknown	TCP traffic detected without corresponding DNS query: 23.202.57.177
Source: unknown	TCP traffic detected without corresponding DNS query: 23.202.57.177
Source: unknown	TCP traffic detected without corresponding DNS query: 23.202.57.177
Source: unknown	TCP traffic detected without corresponding DNS query: 23.202.57.177
Source: unknown	TCP traffic detected without corresponding DNS query: 23.202.57.177
Source: unknown	TCP traffic detected without corresponding DNS query: 23.202.57.177
Source: unknown	TCP traffic detected without corresponding DNS query: 23.202.57.177
Source: unknown	TCP traffic detected without corresponding DNS query: 23.202.57.177
Source: unknown	TCP traffic detected without corresponding DNS query: 23.202.57.177
Source: unknown	TCP traffic detected without corresponding DNS query: 23.202.57.177
Source: unknown	TCP traffic detected without corresponding DNS query: 23.202.57.177
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.234.57
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.234.57
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26

Source: global traffic	HTTP traffic detected: GET /mscc/lib/v2/wcp-consent.js HTTP/1.1Host: wcpstatic.microsoft.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://learn.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: MC1=GUID=749eee6039c5489b9db3000c7ab3f399&HASH=749e&LV=202310&V=4&LU=1696413236917; MUID=375E6F2E0D8F6B9C2CEB7C8E098F6DFE
Source: global traffic	HTTP traffic detected: GET /scripts/c/ms.jsll-3.min.js HTTP/1.1Host: js.monitor.azure.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://learn.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rest/v1/delivery?client=microsoftmscompoc&sessionId=0791c829041c4c068b787022a66647a2&version=2.9.0 HTTP/1.1Host: target.microsoft.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: MC1=GUID=749eee6039c5489b9db3000c7ab3f399&HASH=749e&LV=202310&V=4&LU=1696413236917; MUID=375E6F2E0D8F6B9C2CEB7C8E098F6DFE; MSCC=NR; at_check=true; mbox=session#0791c829041c4c068b787022a66647a2#1713944149\|PC#0791c829041c4c068b787022a66647a2.35_0#1748122289
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=gztnYs+RTGfK+AB&MD=PdPVE7VN HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rest/v1/delivery?client=microsoftmscompoc&sessionId=0791c829041c4c068b787022a66647a2&version=2.9.0 HTTP/1.1Host: target.microsoft.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: MC1=GUID=749eee6039c5489b9db3000c7ab3f399&HASH=749e&LV=202310&V=4&LU=1696413236917; MUID=375E6F2E0D8F6B9C2CEB7C8E098F6DFE; MSCC=NR; at_check=true; mbox=session#0791c829041c4c068b787022a66647a2#1713944151\|PC#0791c829041c4c068b787022a66647a2.35_0#1748122289; MS0=1e372c3aab014af7b628c367b32124df
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=gztnYs+RTGfK+AB&MD=PdPVE7VN HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com

Source: chromecache_94.3.dr	String found in binary or memory: href="https://www.linkedin.com/cws/share?url=${encodeURIComponent(e)}&text=${encodeURIComponent(dS.replace("{credentialName}",t.title))}" equals www.linkedin.com (Linkedin)
Source: chromecache_94.3.dr	String found in binary or memory: href="https://www.facebook.com/sharer/sharer.php?u=${s}" equals www.facebook.com (Facebook)
Source: chromecache_94.3.dr	String found in binary or memory: href="https://www.linkedin.com/cws/share?url=${s}" equals www.linkedin.com (Linkedin)
Source: chromecache_94.3.dr	String found in binary or memory: </div>`;w(e,t)}}function kA(t){x.documentElement.classList.add("api-search-has-results");for(let{container:e}of vy)e.textContent=t}function Xne(){x.documentElement.classList.remove("api-search-has-results");for(let{container:t}of vy)t.innerHTML=""}function iEe(t,e){let o=dt(),n,r;if(o==="")n=_r[Rt].displayName,r=null;else{let a=e.packagesByMoniker[o];n=a.product.displayName,r=a.versionDisplayName}let s=x.createElement("h2");s.classList.add("api-search-results-heading","font-size-h3");let i=m`${EA.resultsHeadingTemplate.replace("{platformName}",n)}`;if(w(i,s),r!==null&&Rt==="rest"){let a=m`${ee(`${Oe(o)} REST ${EA.resultsHeadingTemplate.replace("{platformName}",n)}`)}`;w(a,s)}else if(r!==null){let a=m`${ee(`${EA.resultsHeadingTemplate.replace("{platformName}",n)} <span class="moniker-version">version ${Oe(r)}</span>`)}`;w(a,s)}t.appendChild(s)}function o1(t,e){if(e!==""&&!/[?&]view=/i.test(t)){let[n,r]=t.split("#");r=r===void 0?"":"#"+r,t=Rt==="rest"?`${n}${r}`:`${n}?view=${encodeURIComponent(e)}${r}`}let o=new URL(t,location.origin);return t=`${o.pathname}${o.search}${o.hash}`,Rt!=="rest"&&(t=`/${_.data.userLocale}${t}`),t}var fm="api-search-term-changed",Ch="";function gm(){return Ch}function n1(t){t=t.trim(),t!==Ch&&(Ch=t,_.data.pageTemplate==="ApiBrowserPage"&&Mt({term:Ch},"pushState"),window.dispatchEvent(new CustomEvent(fm,{detail:{term:Ch}})))}function Zne(){let t=oe().term;return t===void 0?"":t.trim()}_.data.pageTemplate==="ApiBrowserPage"&&(Ch=Zne(),window.addEventListener("popstate",()=>n1(Zne())));function ere(){q.addEventListener(fm,r1),q.addEventListener(Mr,r1),_.data.pageTemplate==="ApiBrowserPage"&&r1()}var AA="";function r1(){let t=gm(),e=dt(),o=`${t}/${e}`;return o===AA?Promise.resolve():(AA=o,_.data.pageTemplate==="ApiBrowserPage"&&e!==""&&t===""?(t1(),Promise.all([Wne(Rt,e,_.data.userLocale),il()]).then(([n,r])=>{if(o===AA){if(n.apiItems.length===0){kA(Xo);return}CA(r,n.apiItems,null)}},()=>{kA(TP)})):t.length<3?(Xne(),Promise.resolve()):_r[Rt].validSearchTerm.test(t)?(t1(),Promise.all([wA(Rt,e,t,_.data.userLocale),il()]).then(([n,r])=>{o===AA&&(s1(e,t,n.results.length),CA(r,n.results,n["@nextLink"]))},()=>{kA(TP)})):il().then(n=>CA(n,[],null)))}function s1(t,e,o){Ge({actionType:He.OTHER,behavior:Ee.SEARCH,content:{event:"api-browser-search",platform:Rt,moniker:t,term:e,results:o}})}var tre="api-search-field";function ore(){let t=x.createElement("form");t.classList.add(tre,"margin-top-xxs"),t.setAttribute(To.name,tre),t.action="javascript:",t.addEventListener("submit",l=>l.preventDefault());let e=x.createElement("label"),o=x.createElement("span");o.classList.add("visually-hidden"),o.textContent=mo,e.appendChild(o),t.appendChild(e);let n=x.createElement("input");n.type="search",n.classList.add("input","input-lg","padding-right-sm"),n.value=gm(),n.placeholder=mo,e.appendChild(n);let r=x.createElement("a");r.href="#",r.title=_2,r.classList.add("clear"),r.addEventListener("click",l=>{l.preventDefault(),n.value="",n.dispatchEvent(
Source: chromecache_94.3.dr	String found in binary or memory: </div>`;w(e,t)}}function kA(t){x.documentElement.classList.add("api-search-has-results");for(let{container:e}of vy)e.textContent=t}function Xne(){x.documentElement.classList.remove("api-search-has-results");for(let{container:t}of vy)t.innerHTML=""}function iEe(t,e){let o=dt(),n,r;if(o==="")n=_r[Rt].displayName,r=null;else{let a=e.packagesByMoniker[o];n=a.product.displayName,r=a.versionDisplayName}let s=x.createElement("h2");s.classList.add("api-search-results-heading","font-size-h3");let i=m`${EA.resultsHeadingTemplate.replace("{platformName}",n)}`;if(w(i,s),r!==null&&Rt==="rest"){let a=m`${ee(`${Oe(o)} REST ${EA.resultsHeadingTemplate.replace("{platformName}",n)}`)}`;w(a,s)}else if(r!==null){let a=m`${ee(`${EA.resultsHeadingTemplate.replace("{platformName}",n)} <span class="moniker-version">version ${Oe(r)}</span>`)}`;w(a,s)}t.appendChild(s)}function o1(t,e){if(e!==""&&!/[?&]view=/i.test(t)){let[n,r]=t.split("#");r=r===void 0?"":"#"+r,t=Rt==="rest"?`${n}${r}`:`${n}?view=${encodeURIComponent(e)}${r}`}let o=new URL(t,location.origin);return t=`${o.pathname}${o.search}${o.hash}`,Rt!=="rest"&&(t=`/${_.data.userLocale}${t}`),t}var fm="api-search-term-changed",Ch="";function gm(){return Ch}function n1(t){t=t.trim(),t!==Ch&&(Ch=t,_.data.pageTemplate==="ApiBrowserPage"&&Mt({term:Ch},"pushState"),window.dispatchEvent(new CustomEvent(fm,{detail:{term:Ch}})))}function Zne(){let t=oe().term;return t===void 0?"":t.trim()}_.data.pageTemplate==="ApiBrowserPage"&&(Ch=Zne(),window.addEventListener("popstate",()=>n1(Zne())));function ere(){q.addEventListener(fm,r1),q.addEventListener(Mr,r1),_.data.pageTemplate==="ApiBrowserPage"&&r1()}var AA="";function r1(){let t=gm(),e=dt(),o=`${t}/${e}`;return o===AA?Promise.resolve():(AA=o,_.data.pageTemplate==="ApiBrowserPage"&&e!==""&&t===""?(t1(),Promise.all([Wne(Rt,e,_.data.userLocale),il()]).then(([n,r])=>{if(o===AA){if(n.apiItems.length===0){kA(Xo);return}CA(r,n.apiItems,null)}},()=>{kA(TP)})):t.length<3?(Xne(),Promise.resolve()):_r[Rt].validSearchTerm.test(t)?(t1(),Promise.all([wA(Rt,e,t,_.data.userLocale),il()]).then(([n,r])=>{o===AA&&(s1(e,t,n.results.length),CA(r,n.results,n["@nextLink"]))},()=>{kA(TP)})):il().then(n=>CA(n,[],null)))}function s1(t,e,o){Ge({actionType:He.OTHER,behavior:Ee.SEARCH,content:{event:"api-browser-search",platform:Rt,moniker:t,term:e,results:o}})}var tre="api-search-field";function ore(){let t=x.createElement("form");t.classList.add(tre,"margin-top-xxs"),t.setAttribute(To.name,tre),t.action="javascript:",t.addEventListener("submit",l=>l.preventDefault());let e=x.createElement("label"),o=x.createElement("span");o.classList.add("visually-hidden"),o.textContent=mo,e.appendChild(o),t.appendChild(e);let n=x.createElement("input");n.type="search",n.classList.add("input","input-lg","padding-right-sm"),n.value=gm(),n.placeholder=mo,e.appendChild(n);let r=x.createElement("a");r.href="#",r.title=_2,r.classList.add("clear"),r.addEventListener("click",l=>{l.preventDefault(),n.value="",n.dispatchEvent(
Source: chromecache_94.3.dr	String found in binary or memory: </div>`;w(e,t)}}function kA(t){x.documentElement.classList.add("api-search-has-results");for(let{container:e}of vy)e.textContent=t}function Xne(){x.documentElement.classList.remove("api-search-has-results");for(let{container:t}of vy)t.innerHTML=""}function iEe(t,e){let o=dt(),n,r;if(o==="")n=_r[Rt].displayName,r=null;else{let a=e.packagesByMoniker[o];n=a.product.displayName,r=a.versionDisplayName}let s=x.createElement("h2");s.classList.add("api-search-results-heading","font-size-h3");let i=m`${EA.resultsHeadingTemplate.replace("{platformName}",n)}`;if(w(i,s),r!==null&&Rt==="rest"){let a=m`${ee(`${Oe(o)} REST ${EA.resultsHeadingTemplate.replace("{platformName}",n)}`)}`;w(a,s)}else if(r!==null){let a=m`${ee(`${EA.resultsHeadingTemplate.replace("{platformName}",n)} <span class="moniker-version">version ${Oe(r)}</span>`)}`;w(a,s)}t.appendChild(s)}function o1(t,e){if(e!==""&&!/[?&]view=/i.test(t)){let[n,r]=t.split("#");r=r===void 0?"":"#"+r,t=Rt==="rest"?`${n}${r}`:`${n}?view=${encodeURIComponent(e)}${r}`}let o=new URL(t,location.origin);return t=`${o.pathname}${o.search}${o.hash}`,Rt!=="rest"&&(t=`/${_.data.userLocale}${t}`),t}var fm="api-search-term-changed",Ch="";function gm(){return Ch}function n1(t){t=t.trim(),t!==Ch&&(Ch=t,_.data.pageTemplate==="ApiBrowserPage"&&Mt({term:Ch},"pushState"),window.dispatchEvent(new CustomEvent(fm,{detail:{term:Ch}})))}function Zne(){let t=oe().term;return t===void 0?"":t.trim()}_.data.pageTemplate==="ApiBrowserPage"&&(Ch=Zne(),window.addEventListener("popstate",()=>n1(Zne())));function ere(){q.addEventListener(fm,r1),q.addEventListener(Mr,r1),_.data.pageTemplate==="ApiBrowserPage"&&r1()}var AA="";function r1(){let t=gm(),e=dt(),o=`${t}/${e}`;return o===AA?Promise.resolve():(AA=o,_.data.pageTemplate==="ApiBrowserPage"&&e!==""&&t===""?(t1(),Promise.all([Wne(Rt,e,_.data.userLocale),il()]).then(([n,r])=>{if(o===AA){if(n.apiItems.length===0){kA(Xo);return}CA(r,n.apiItems,null)}},()=>{kA(TP)})):t.length<3?(Xne(),Promise.resolve()):_r[Rt].validSearchTerm.test(t)?(t1(),Promise.all([wA(Rt,e,t,_.data.userLocale),il()]).then(([n,r])=>{o===AA&&(s1(e,t,n.results.length),CA(r,n.results,n["@nextLink"]))},()=>{kA(TP)})):il().then(n=>CA(n,[],null)))}function s1(t,e,o){Ge({actionType:He.OTHER,behavior:Ee.SEARCH,content:{event:"api-browser-search",platform:Rt,moniker:t,term:e,results:o}})}var tre="api-search-field";function ore(){let t=x.createElement("form");t.classList.add(tre,"margin-top-xxs"),t.setAttribute(To.name,tre),t.action="javascript:",t.addEventListener("submit",l=>l.preventDefault());let e=x.createElement("label"),o=x.createElement("span");o.classList.add("visually-hidden"),o.textContent=mo,e.appendChild(o),t.appendChild(e);let n=x.createElement("input");n.type="search",n.classList.add("input","input-lg","padding-right-sm"),n.value=gm(),n.placeholder=mo,e.appendChild(n);let r=x.createElement("a");r.href="#",r.title=_2,r.classList.add("clear"),r.addEventListener("click",l=>{l.preventDefault(),n.value="",n.dispatchEvent(
Source: chromecache_94.3.dr	String found in binary or memory: </div>`}function gCe(t){return t.authenticationModes?t.authenticationModes.map(e=>e.type).includes("MSA"):!1}function hCe(t){let e=t.authenticationModes.find(o=>o.type==="MSA");return e?e.upn:null}function bCe(t){let e=t.authenticationModes.find(o=>o.type==="AAD");return e?e.upn:null}function _Ce(t,e,o){return e??(Qt(t.email)?o:t.email)??""}function $re(t){let e=gCe(t),o=e?hCe(t):null,n=e?null:bCe(t),r=_Ce(t,o,n);return[e,r]}function vCe(t,e){let[o,n]=$re(e);if(o){let i=t.querySelector("#report-msa-email-account");i.innerText=n}let r=t.querySelector("#opt-into-email-checkbox"),s=t.querySelector("#submitter-info");r.addEventListener("change",()=>{r.checked?s.hidden=!1:s.hidden=!0})}function yCe(t){if(!t)return;let e=t.querySelector("#select-reason"),o=t.querySelector("#other-reason-textarea-container"),n=o.querySelector("textarea");!e\|\|!o\|\|!n\|\|(e.value==="Other"&&(o.hidden=!1,n.required=!0),e.addEventListener("change",()=>{e.value==="Other"\|\|e.value==="14"?(o.hidden=!1,n.required=!0,n.disabled=!1):(o.hidden=!0,n.required=!1,n.disabled=!0)}))}var oo;function Nre(){let t=document.getElementById("share-to-linkedin-profile");t&&t.addEventListener("click",e=>{let o=e.currentTarget,n=JSON.parse(o.dataset.credential),r=document.createElement("div"),s=xCe(n);w(s,r),oo=new Se(r),oo.show();let i=document.getElementById("share-to-feed-button"),a=document.getElementById("linkedin-feed-message"),l=new URL(decodeURI(i.getAttribute("href")));a.onchange=()=>{l.searchParams.set("text",a.value),i.setAttribute("href",l.toString())}})}function xCe(t){let e=encodeURI(`https://${location.host}/api/credentials/share/${_.data.userLocale}/${R.userName}/${t?.credentialId}?sharingId=${R.sharingId}`),o=1035,n=i=>new Date(i).getFullYear(),r=i=>new Date(i).getMonth()+1,s=encodeURI(`https://www.linkedin.com/profile/add?startTask=CERTIFICATION_NAME&name=${t.title}&organizationId=${o}&issueYear=${n(t.awardedOn)}&issueMonth=${r(t.awardedOn)}&expirationYear=${t.expiresOn?n(t.expiresOn):""}&expirationMonth=${t.expiresOn?r(t.expiresOn):""}&certUrl=${e}&certId=${t.credentialId}&skills=${t.skills?`${t.skills.map(i=>encodeURIComponent(i)).join(",")}`:""}`);return m` equals www.linkedin.com (Linkedin)

Source: unknown

DNS traffic detected: queries for: js.monitor.azure.com

Source: unknown

HTTP traffic detected: POST /rest/v1/delivery?client=microsoftmscompoc&sessionId=0791c829041c4c068b787022a66647a2&version=2.9.0 HTTP/1.1Host: target.microsoft.comConnection: keep-aliveContent-Length: 1111sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Type: text/plainAccept: */*Origin: https://learn.microsoft.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://learn.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: MC1=GUID=749eee6039c5489b9db3000c7ab3f399&HASH=749e&LV=202310&V=4&LU=1696413236917; MUID=375E6F2E0D8F6B9C2CEB7C8E098F6DFE; MSCC=NR; at_check=true; mbox=session#0791c829041c4c068b787022a66647a2#1713944147

Source: WAXD480.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl19/
Source: chromecache_94.3.dr	String found in binary or memory: http://polymer.github.io/AUTHORS.txt
Source: chromecache_94.3.dr	String found in binary or memory: http://polymer.github.io/CONTRIBUTORS.txt
Source: chromecache_94.3.dr	String found in binary or memory: http://polymer.github.io/LICENSE.txt
Source: chromecache_94.3.dr	String found in binary or memory: http://polymer.github.io/PATENTS.txt
Source: chromecache_93.3.dr	String found in binary or memory: http://schema.org/Organization
Source: chromecache_85.3.dr, chromecache_103.3.dr	String found in binary or memory: http://www.gimp.org/xmp/
Source: chromecache_93.3.dr	String found in binary or memory: https://aka.ms/ContentUserFeedback
Source: chromecache_94.3.dr	String found in binary or memory: https://aka.ms/banner_mslearn_tier1?wt.mc_id=build24_t1_learnpromotion_events
Source: chromecache_94.3.dr	String found in binary or memory: https://aka.ms/certhelp
Source: chromecache_93.3.dr	String found in binary or memory: https://aka.ms/feedback/report?space=61
Source: chromecache_94.3.dr	String found in binary or memory: https://aka.ms/pshelpmechoose
Source: chromecache_93.3.dr	String found in binary or memory: https://aka.ms/yourcaliforniaprivacychoices
Source: chromecache_93.3.dr	String found in binary or memory: https://authoring-docs-microsoft.poolparty.biz/devrel/69c76c32-967e-4c65-b89a-74cc527db725
Source: chromecache_93.3.dr	String found in binary or memory: https://authoring-docs-microsoft.poolparty.biz/devrel/7696cda6-0510-47f6-8302-71bb5d2e28cf
Source: chromecache_94.3.dr	String found in binary or memory: https://aznb-ame-prod.azureedge.net/component/$
Source: chromecache_94.3.dr	String found in binary or memory: https://channel9.msdn.com/
Source: chromecache_94.3.dr	String found in binary or memory: https://github.com/$
Source: chromecache_93.3.dr	String found in binary or memory: https://github.com/Thraka
Source: chromecache_93.3.dr	String found in binary or memory: https://github.com/Youssef1313
Source: chromecache_93.3.dr	String found in binary or memory: https://github.com/adegeo
Source: chromecache_93.3.dr	String found in binary or memory: https://github.com/dotnet/docs/blob/17c4acca45e573a92878a44a2cce57d699fe9c7c/docs/framework/install/
Source: chromecache_93.3.dr	String found in binary or memory: https://github.com/dotnet/docs/blob/live/docs/framework/install/application-not-started.md
Source: chromecache_93.3.dr	String found in binary or memory: https://github.com/dotnet/docs/blob/main/docs/framework/install/application-not-started.md
Source: chromecache_93.3.dr	String found in binary or memory: https://github.com/dotnet/docs/issues
Source: chromecache_93.3.dr	String found in binary or memory: https://github.com/dotnet/docs/issues/new?template=z-customer-feedback.yml
Source: chromecache_94.3.dr	String found in binary or memory: https://github.com/dotnet/try
Source: chromecache_93.3.dr	String found in binary or memory: https://github.com/gewarren
Source: chromecache_94.3.dr	String found in binary or memory: https://github.com/jonschlinkert/is-plain-object
Source: chromecache_77.3.dr, chromecache_94.3.dr	String found in binary or memory: https://github.com/js-cookie/js-cookie
Source: chromecache_93.3.dr	String found in binary or memory: https://github.com/mairaw
Source: chromecache_93.3.dr	String found in binary or memory: https://github.com/nschonni
Source: chromecache_93.3.dr	String found in binary or memory: https://js.monitor.azure.com/scripts/c/ms.jsll-3.min.js
Source: chromecache_94.3.dr	String found in binary or memory: https://learn-video.azurefd.net/
Source: chromecache_94.3.dr	String found in binary or memory: https://learn-video.azurefd.net/vod/player
Source: chromecache_94.3.dr	String found in binary or memory: https://management.azure.com/providers/Microsoft.Portal/consoles/default?api-version=2017-12-01-prev
Source: chromecache_94.3.dr	String found in binary or memory: https://management.azure.com/providers/Microsoft.Portal/userSettings/cloudconsole?api-version=2017-0
Source: chromecache_94.3.dr	String found in binary or memory: https://management.azure.com/subscriptions?api-version=2016-06-01
Source: chromecache_94.3.dr	String found in binary or memory: https://octokit.github.io/rest.js/#throttling
Source: chromecache_94.3.dr	String found in binary or memory: https://schema.org
Source: chromecache_94.3.dr	String found in binary or memory: https://twitter.com/intent/tweet?original_referer=$
Source: chromecache_94.3.dr	String found in binary or memory: https://www.cafbaseline.com/
Source: chromecache_94.3.dr	String found in binary or memory: https://www.linkedin.com/cws/share?url=$
Source: chromecache_94.3.dr	String found in binary or memory: https://www.linkedin.com/profile/add?startTask=CERTIFICATION_NAME&name=$

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49810 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49810
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49672
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 23.202.57.177:443 -> 192.168.2.4:49755 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.202.57.177:443 -> 192.168.2.4:49760 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.165.165.26:443 -> 192.168.2.4:49792 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.165.165.26:443 -> 192.168.2.4:49835 version: TLS 1.2

Source: WAXD480.exe

Static PE information: No import functions for PE file found

Source: WAXD480.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: WAXD480.exe

Binary string: a\Device\HarddiskVolume4\Windows>

Source: classification engine

Classification label: clean3.winEXE@25/61@12/7

Source: WAXD480.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\WAXD480.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\WAXD480.exe "C:\Users\user\Desktop\WAXD480.exe"
Source: C:\Users\user\Desktop\WAXD480.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=WAXD480.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1680 --field-trial-handle=2028,i,4872466835619599832,212431843967096772,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Users\user\Desktop\WAXD480.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=WAXD480.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2052 --field-trial-handle=1996,i,12553455973178745463,2557296557389022246,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Users\user\Desktop\WAXD480.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=WAXD480.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	Jump to behavior
Source: C:\Users\user\Desktop\WAXD480.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=WAXD480.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1680 --field-trial-handle=2028,i,4872466835619599832,212431843967096772,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2052 --field-trial-handle=1996,i,12553455973178745463,2557296557389022246,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior

Source: C:\Users\user\Desktop\WAXD480.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\WAXD480.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\WAXD480.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\WAXD480.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\WAXD480.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\WAXD480.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\WAXD480.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\WAXD480.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\WAXD480.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\WAXD480.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\WAXD480.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\WAXD480.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\WAXD480.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\WAXD480.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\WAXD480.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\WAXD480.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\WAXD480.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\WAXD480.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\WAXD480.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\WAXD480.exe	Section loaded: windows.shell.servicehostbuilder.dll	Jump to behavior
Source: C:\Users\user\Desktop\WAXD480.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\WAXD480.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\WAXD480.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\WAXD480.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\WAXD480.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\WAXD480.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\WAXD480.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\Desktop\WAXD480.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\WAXD480.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\WAXD480.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\WAXD480.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\WAXD480.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Users\user\Desktop\WAXD480.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\WAXD480.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\WAXD480.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Users\user\Desktop\WAXD480.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Users\user\Desktop\WAXD480.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\WAXD480.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\WAXD480.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\WAXD480.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\WAXD480.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\WAXD480.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\WAXD480.exe	Section loaded: wkscli.dll	Jump to behavior

Source: C:\Users\user\Desktop\WAXD480.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: WAXD480.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: WAXD480.exe

Static file information: File size 14544896 > 1048576

Source: WAXD480.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: WAXD480.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source: WAXD480.exe

Static PE information: 0xFF7D5888 [Sat Oct 31 03:59:04 2105 UTC]

Source: WAXD480.exe, 00000000.00000002.1765382088.000000000069C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: WAXD480.exe, 00000000.00000002.1765382088.000000000069C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\

Source: C:\Users\user\Desktop\WAXD480.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=WAXD480.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0			Jump to behavior
Source: C:\Users\user\Desktop\WAXD480.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=WAXD480.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0			Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	11 Process Injection	11 Process Injection	OS Credential Dumping	1 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Timestomp	LSASS Memory	1 System Information Discovery	Remote Desktop Protocol	Data from Removable Media	3 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 DLL Side-Loading	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	4 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
WAXD480.exe	0%	Virustotal		Browse

Source	Detection	Scanner	Label	Link
http://polymer.github.io/PATENTS.txt	0%	URL Reputation	safe
http://polymer.github.io/PATENTS.txt	0%	URL Reputation	safe
http://polymer.github.io/LICENSE.txt	0%	URL Reputation	safe
http://polymer.github.io/AUTHORS.txt	0%	URL Reputation	safe
https://octokit.github.io/rest.js/#throttling	0%	URL Reputation	safe
https://learn-video.azurefd.net/vod/player	0%	URL Reputation	safe
http://polymer.github.io/CONTRIBUTORS.txt	0%	URL Reputation	safe
https://learn-video.azurefd.net/	0%	Avira URL Cloud	safe
https://www.cafbaseline.com/	0%	Avira URL Cloud	safe
https://www.cafbaseline.com/	1%	Virustotal		Browse
https://learn-video.azurefd.net/	0%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
adobetarget.data.adobedc.net	63.140.36.145	true	false	unknown
part-0041.t-0009.t-msedge.net	13.107.213.69	true	false	unknown
dcs-public-edge-usw2-219535174.us-west-2.elb.amazonaws.com	52.40.13.65	true	false	high
www.google.com	142.250.101.104	true	false	high
js.monitor.azure.com	unknown	unknown	false	high
microsoftmscompoc.tt.omtrdc.net	unknown	unknown	false	unknown
mdec.nelreports.net	unknown	unknown	false	unknown
mscom.demdex.net	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://js.monitor.azure.com/scripts/c/ms.jsll-3.min.js	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://authoring-docs-microsoft.poolparty.biz/devrel/7696cda6-0510-47f6-8302-71bb5d2e28cf	chromecache_93.3.dr	false		high
https://github.com/dotnet/docs/blob/live/docs/framework/install/application-not-started.md	chromecache_93.3.dr	false		high
https://authoring-docs-microsoft.poolparty.biz/devrel/69c76c32-967e-4c65-b89a-74cc527db725	chromecache_93.3.dr	false		high
https://management.azure.com/providers/Microsoft.Portal/consoles/default?api-version=2017-12-01-prev	chromecache_94.3.dr	false		high
https://github.com/Thraka	chromecache_93.3.dr	false		high
https://github.com/dotnet/docs/issues	chromecache_93.3.dr	false		high
http://www.gimp.org/xmp/	chromecache_85.3.dr, chromecache_103.3.dr	false		high
http://polymer.github.io/PATENTS.txt	chromecache_94.3.dr	false	URL Reputation: safe URL Reputation: safe	unknown
https://aka.ms/certhelp	chromecache_94.3.dr	false		high
https://github.com/dotnet/docs/blob/17c4acca45e573a92878a44a2cce57d699fe9c7c/docs/framework/install/	chromecache_93.3.dr	false		high
https://www.linkedin.com/cws/share?url=$	chromecache_94.3.dr	false		high
https://aka.ms/ContentUserFeedback	chromecache_93.3.dr	false		high
https://github.com/mairaw	chromecache_93.3.dr	false		high
https://schema.org	chromecache_94.3.dr	false		high
http://polymer.github.io/LICENSE.txt	chromecache_94.3.dr	false	URL Reputation: safe	unknown
https://github.com/Youssef1313	chromecache_93.3.dr	false		high
http://polymer.github.io/AUTHORS.txt	chromecache_94.3.dr	false	URL Reputation: safe	unknown
https://aka.ms/banner_mslearn_tier1?wt.mc_id=build24_t1_learnpromotion_events	chromecache_94.3.dr	false		high
https://aka.ms/yourcaliforniaprivacychoices	chromecache_93.3.dr	false		high
https://github.com/dotnet/docs/issues/new?template=z-customer-feedback.yml	chromecache_93.3.dr	false		high
https://github.com/nschonni	chromecache_93.3.dr	false		high
https://management.azure.com/subscriptions?api-version=2016-06-01	chromecache_94.3.dr	false		high
https://github.com/adegeo	chromecache_93.3.dr	false		high
https://github.com/dotnet/docs/blob/main/docs/framework/install/application-not-started.md	chromecache_93.3.dr	false		high
https://aka.ms/pshelpmechoose	chromecache_94.3.dr	false		high
https://aka.ms/feedback/report?space=61	chromecache_93.3.dr	false		high
https://github.com/jonschlinkert/is-plain-object	chromecache_94.3.dr	false		high
https://octokit.github.io/rest.js/#throttling	chromecache_94.3.dr	false	URL Reputation: safe	unknown
https://management.azure.com/providers/Microsoft.Portal/userSettings/cloudconsole?api-version=2017-0	chromecache_94.3.dr	false		high
https://github.com/js-cookie/js-cookie	chromecache_77.3.dr, chromecache_94.3.dr	false		high
https://learn-video.azurefd.net/vod/player	chromecache_94.3.dr	false	URL Reputation: safe	unknown
https://twitter.com/intent/tweet?original_referer=$	chromecache_94.3.dr	false		high
https://github.com/$	chromecache_94.3.dr	false		high
https://github.com/gewarren	chromecache_93.3.dr	false		high
http://schema.org/Organization	chromecache_93.3.dr	false		high
http://polymer.github.io/CONTRIBUTORS.txt	chromecache_94.3.dr	false	URL Reputation: safe	unknown
https://channel9.msdn.com/	chromecache_94.3.dr	false		high
https://www.linkedin.com/profile/add?startTask=CERTIFICATION_NAME&name=$	chromecache_94.3.dr	false		high
https://learn-video.azurefd.net/	chromecache_94.3.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://github.com/dotnet/try	chromecache_94.3.dr	false		high
https://www.cafbaseline.com/	chromecache_94.3.dr	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.101.104	www.google.com	United States	15169	GOOGLEUS	false
52.40.13.65	dcs-public-edge-usw2-219535174.us-west-2.elb.amazonaws.com	United States	16509	AMAZON-02US	false
63.140.37.206	unknown	United States	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
13.107.213.69	part-0041.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
63.140.36.51	unknown	United States	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false

Private

IP
192.168.2.4

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1430820
Start date and time:	2024-04-24 09:03:40 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 14s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	10
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	WAXD480.exe (renamed file extension from tmp to exe)
Original Sample Name:	WAXD480.tmp
Detection:	CLEAN
Classification:	clean3.winEXE@25/61@12/7
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 23.202.58.34, 74.125.137.94, 142.251.2.113, 142.251.2.101, 142.251.2.102, 142.251.2.138, 142.251.2.139, 142.251.2.100, 142.251.2.84, 23.35.30.26, 34.104.35.123, 184.28.81.149, 184.28.81.169, 20.189.173.6, 142.250.101.95, 74.125.137.95, 142.251.2.95, 20.125.62.241, 199.232.214.172, 204.79.197.237, 13.107.21.237, 192.229.211.108, 142.251.2.94, 74.125.137.113, 74.125.137.139, 74.125.137.102, 74.125.137.101, 74.125.137.100, 74.125.137.138
Excluded domains from analysis (whitelisted): aijscdn2.afd.azureedge.net, slscr.update.microsoft.com, c-msn-com-nsatc.trafficmanager.net, clientservices.googleapis.com, browser.events.data.trafficmanager.net, learn.microsoft.com, e11290.dspg.akamaiedge.net, mdec.nelreports.net.akamaized.net, go.microsoft.com, clients2.google.com, ocsp.digicert.com, a1883.dscd.akamai.net, learn.microsoft.com.edgekey.net, update.googleapis.com, clients1.google.com, fs.microsoft.com, accounts.google.com, target.microsoft.com, content-autofill.googleapis.com, c-bing-com.dual-a-0034.a-msedge.net, ctldl.windowsupdate.com, learn.microsoft.com.edgekey.net.globalredir.akadns.net, firstparty-azurefd-prod.trafficmanager.net, fe3cr.delivery.mp.microsoft.com, aijscdn2.azureedge.net, browser.events.data.microsoft.com, edgedl.me.gvt1.com, e13636.dscb.akamaiedge.net, c.bing.com, learn-public.trafficmanager.net, go.microsoft.com.edgekey.net, dual-a-0034.a-msedge.net, clients.l.google.com, c1.microsoft.com, onedscolprdwus05.westus.cloudapp.azu
HTTPS proxy raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
13.107.213.69	https://u44056869.ct.sendgrid.net/ls/click?upn=u001.nH1ryR-2Btr2av-2Bkfc8quLEXKlGRKFonctFf3nB-2FAP-2Bjae3IsQgCoKtK-2FQ57cEEmmhZzRyd07G16kQ6rsc4EaJT6S7Rh48kOVsBPHV-2Fkkk9Vfz7cojLOCLuj4sUGVMM7pbdmwtinmtiLhfYkhEkgve628OiJsccHyeYc3lkmkn6epsOmmj4-2Fi-2BWjxfm73m7vUzCOGnDWnQJBmmd6DmkDcfIw-3D-3DU_vL_MRfqZW9nS4IDBSHT8MfJfSAq9b0aOVvtJoUhpW1Ga8ePAnfV-2FfXwE0xIGnayeXag21qNKRc5VLcgMkPlIuCBf7Hi8EFUvj1-2FlklJpMLZNx1IQq8eO26tVdmeuxhGn-2B2zjA71oEkiC9pTrxX9Dz-2FMJk8mkJr62ye1KlBo-2B8fxBlVl-2B6T0POpB0GKoibGhcjh4Z-2FnPU453nMAkUkNy65MlaA-3D-3D	Get hash	malicious	HTMLPhisher	Browse
	Ref_Order04.xls	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Trojan.MSIL.zgRAT.Heur.21652.15881.exe	Get hash	malicious	PureLog Stealer, zgRAT	Browse
	https://wmicrosouab-4ba8.udydzj.workers.dev/	Get hash	malicious	HTMLPhisher	Browse
	https://uqgekpc20qn1.azureedge.net/6466/	Get hash	malicious	TechSupportScam	Browse
	https://pub-32bf4e9c1a1344aa8c0925c562b60fd3.r2.dev/index2.html	Get hash	malicious	HTMLPhisher	Browse
	https://hello-world-still-tree-8187.stevenmoulder.workers.dev/	Get hash	malicious	HTMLPhisher	Browse
	https://pub-fc51d290db584b328d6feb3913c634a1.r2.dev/office365webb.html	Get hash	malicious	HTMLPhisher	Browse
	https://pub-ccab1e1c90754b44a899b93b24a61322.r2.dev/pp.html	Get hash	malicious	HTMLPhisher	Browse
	https://loveyawork.com.au/stack/office-3D8/index.php	Get hash	malicious	HTMLPhisher	Browse
239.255.255.250	https://u44056869.ct.sendgrid.net/ls/click?upn=u001.nH1ryR-2Btr2av-2Bkfc8quLEXKlGRKFonctFf3nB-2FAP-2Bjae3IsQgCoKtK-2FQ57cEEmmhZzRyd07G16kQ6rsc4EaJT6S7Rh48kOVsBPHV-2Fkkk9Vfz7cojLOCLuj4sUGVMM7pbdmwtinmtiLhfYkhEkgve628OiJsccHyeYc3lkmkn6epsOmmj4-2Fi-2BWjxfm73m7vUzCOGnDWnQJBmmd6DmkDcfIw-3D-3DU_vL_MRfqZW9nS4IDBSHT8MfJfSAq9b0aOVvtJoUhpW1Ga8ePAnfV-2FfXwE0xIGnayeXag21qNKRc5VLcgMkPlIuCBf7Hi8EFUvj1-2FlklJpMLZNx1IQq8eO26tVdmeuxhGn-2B2zjA71oEkiC9pTrxX9Dz-2FMJk8mkJr62ye1KlBo-2B8fxBlVl-2B6T0POpB0GKoibGhcjh4Z-2FnPU453nMAkUkNy65MlaA-3D-3D	Get hash	malicious	HTMLPhisher	Browse
	#U5c97#U4f4d#U8865#U52a9#U5236#U5ea6.docx.doc	Get hash	malicious	Unknown	Browse
	#U5c97#U4f4d#U8865#U52a9#U5236#U5ea6.docx.doc	Get hash	malicious	Unknown	Browse
	https://tibusiness.cl/css/causarol.rar	Get hash	malicious	Unknown	Browse
	http://damarltda.cl/certificado.php	Get hash	malicious	Unknown	Browse
	http://rum.browser-intake-foxbusiness.com:443	Get hash	malicious	Unknown	Browse
	http://42.193.223.169/extensioncompabilitynode.exe	Get hash	malicious	Unknown	Browse
	https://d-wz.info/mygov	Get hash	malicious	HTMLPhisher	Browse
	https://www.longin-eki.co.jp.cduhzkc.cn/	Get hash	malicious	Unknown	Browse
	https://www.longin-eki.co.jp.nebxshr.cn/	Get hash	malicious	Unknown	Browse
63.140.36.51	https://uqgekpc20qn1.azureedge.net/6466/	Get hash	malicious	TechSupportScam	Browse
	https://acrobat.adobe.com/id/urn:aaid:sc:EU:a477f053-09e9-43b1-afaa-68422fe2c73d	Get hash	malicious	Unknown	Browse
	https://googleads.g.doubleclick.net/aclk?nis=4&sa=l&ai=CBy2nBWzuZebBCqaT9fwP3aiQyA_w2oDlddu5z5-iErOjjrWMDhABIPuchwNgpaCVgJgBoAH3paCUKsgBAqgDAcgDyQSqBK4CT9CEq8LQKNPdFDGXOtMpyjS3yMvP1hTqSeq0cEtWo62EIJdDfle1EjLt33lRwACMm2pw-rajkPdYwnT5Hl00cEmv9wBBsQioqExIWGvu6p-f1FgTA4lF99AYzAoZDqjOsgO1Aaf7zNmTuvPiNjPmB0lse0kqkk5ZW_51m-IllOWVbMnCztYUJcNx6Xyq6Uo5_4Le0urHHQPbXxiw_mda5IYUAcwGkwTL52V-4gywNNlNqOTkI7T9S7HMMTWKBFQXVzCHWUWNV3nKOVBWl4pQ82t3zIUfrU4C4jGcwqImfMmBkz7wuJEkik07BsxGcZ0EIPAjKv4S4TXrujRrzO55GTRkRsQnotspAHgJGD676hTPpQWOblgQN618COIhfqe2pEN3V0qQ1mCjVHv33q3ABNS0h5rvBIgFn4XMo06gBgKAB_fd8PMEqAfZtrECqAevvrECqAfVyRuoB6a-G6gHjs4bqAeT2BuoB-6WsQKoB_6esQKoB5oGqAfz0RuoB5bYG6gHqpuxAqgHg62xAqgH4L2xAqgH_56xAqgH35-xAqgHyqmxAqgH66WxAqgH6rGxAqgHmbWxAqgHvrexAtgHAdIILQiM4YBAEAEYHzIEi8KBDjoOj9CAgICADIDAgICAoChIvf3BOlj_u4e-lOuEA7EJaBWNCPNfR7iACgGYCwHICwHaDBEKCxDQlNaq1sWkyOIBEgIBA6oNAkFVyA0B2BMC0BUB-BYBgBcBshgJEgKCaBgCIgEA&ae=1&ase=2&gclid=EAIaIQobChMIptiHvpTrhAMVpkmdCR1dFAT5EAEYASAAEgJkAfD_BwE&num=1&cid=CAQSLQB7FLtqOsAeoITkk8_EfWxyFaX6LvfDD7qju4NO3pvtDST86esq5V2hobPA7hgB&sig=AOD64_3YUwGOAhvDgrtLKQSfZbxQDrMiug&client=ca-pub-3734677162347682&rf=2&nb=17&adurl=https://sites.google.com/view/fashionpassrent%3Fgclid%3DEAIaIQobChMIptiHvpTrhAMVpkmdCR1dFAT5EAEYASAAEgJkAfD_BwE	Get hash	malicious	Unknown	Browse
	DHL SHIPPING DOCUMENT - BL - AWB PACKING LIST_02292024.exe	Get hash	malicious	DBatLoader, PureLog Stealer, zgRAT	Browse
	Frija.exe	Get hash	malicious	Unknown	Browse
	https://tjk5ev4wyer7s8.pages.dev/Wi0nAbh0help0secure037/	Get hash	malicious	Unknown	Browse
	https://cwjd96l8a93s6.pages.dev/Wi0nAbh0help0secure037/	Get hash	malicious	Unknown	Browse
	https://acrobat.adobe.com/id/urn:aaid:sc:VA6C2:19673103-b29e-4634-baef-0fbf173db387	Get hash	malicious	Unknown	Browse
	corporations-myGovsecuredocument.html	Get hash	malicious	Unknown	Browse
63.140.37.206	https://acrobat.adobe.com/id/urn:aaid:sc:VA6C2:67958260-9d34-43ce-a81c-9e6e45fe2b11	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse
	https://acrobat.adobe.com/id/urn:aaid:sc:VA6C2:67958260-9d34-43ce-a81c-9e6e45fe2b11	Get hash	malicious	Unknown	Browse
	https://googleads.g.doubleclick.net/aclk?nis=4&sa=l&ai=CBy2nBWzuZebBCqaT9fwP3aiQyA_w2oDlddu5z5-iErOjjrWMDhABIPuchwNgpaCVgJgBoAH3paCUKsgBAqgDAcgDyQSqBK4CT9CEq8LQKNPdFDGXOtMpyjS3yMvP1hTqSeq0cEtWo62EIJdDfle1EjLt33lRwACMm2pw-rajkPdYwnT5Hl00cEmv9wBBsQioqExIWGvu6p-f1FgTA4lF99AYzAoZDqjOsgO1Aaf7zNmTuvPiNjPmB0lse0kqkk5ZW_51m-IllOWVbMnCztYUJcNx6Xyq6Uo5_4Le0urHHQPbXxiw_mda5IYUAcwGkwTL52V-4gywNNlNqOTkI7T9S7HMMTWKBFQXVzCHWUWNV3nKOVBWl4pQ82t3zIUfrU4C4jGcwqImfMmBkz7wuJEkik07BsxGcZ0EIPAjKv4S4TXrujRrzO55GTRkRsQnotspAHgJGD676hTPpQWOblgQN618COIhfqe2pEN3V0qQ1mCjVHv33q3ABNS0h5rvBIgFn4XMo06gBgKAB_fd8PMEqAfZtrECqAevvrECqAfVyRuoB6a-G6gHjs4bqAeT2BuoB-6WsQKoB_6esQKoB5oGqAfz0RuoB5bYG6gHqpuxAqgHg62xAqgH4L2xAqgH_56xAqgH35-xAqgHyqmxAqgH66WxAqgH6rGxAqgHmbWxAqgHvrexAtgHAdIILQiM4YBAEAEYHzIEi8KBDjoOj9CAgICADIDAgICAoChIvf3BOlj_u4e-lOuEA7EJaBWNCPNfR7iACgGYCwHICwHaDBEKCxDQlNaq1sWkyOIBEgIBA6oNAkFVyA0B2BMC0BUB-BYBgBcBshgJEgKCaBgCIgEA&ae=1&ase=2&gclid=EAIaIQobChMIptiHvpTrhAMVpkmdCR1dFAT5EAEYASAAEgJkAfD_BwE&num=1&cid=CAQSLQB7FLtqOsAeoITkk8_EfWxyFaX6LvfDD7qju4NO3pvtDST86esq5V2hobPA7hgB&sig=AOD64_3YUwGOAhvDgrtLKQSfZbxQDrMiug&client=ca-pub-3734677162347682&rf=2&nb=17&adurl=https://sites.google.com/view/fashionpassrent%3Fgclid%3DEAIaIQobChMIptiHvpTrhAMVpkmdCR1dFAT5EAEYASAAEgJkAfD_BwE	Get hash	malicious	Unknown	Browse
	https://www.googleadservices.com/pagead/aclk?nis=4&sa=L&ai=CEdmnpF3uZcmCEdLvz7sPgvaqSPDagOV127nPn6ISzuvWiowOEAEg-5yHA2CloJWAmAGgAfeloJQqyAECqAMByAPJBKoEqwJP0BOkHEQ1sHidZNLLodOtOyNxRFvrb6dqQQ9bhh3nOz-pugkuAKGT1JYZfWYhqel0zPTGGIbQQl9WB7_vFRV_MhmW5KIdroYx56OEClXEf-cWKat1aMrWuR35plIHQwgvrSp12MLefXdgr14Q5iELw4ozv24CWRBqCYEfchlQo4JnIovylCFfzNZg20N_V5T9lzIG1Nmm7l9MsFsKkwM-YPqei9OqUr9BDzie_LrcWi_Z2StMoNSQV8r8i1V33taCy4_lrZuMV-NzUQMD4TyIxtNRQLwkroqGCsQ7cBlARGQKqa5EXlyqKFmykXE2LLDQkRi_RahzgB5fX3_TIZgU_j7XfKOQqjgPSHLXdiWLqHfAPFpqdb7SXyjvdXpJEi0l2R3bDl1grQiXI8AE1LSHmu8EiAWfhcyjTqAGAoAH993w8wSoB9m2sQKoB6--sQKoB9XJG6gHpr4bqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgHmgaoB_PRG6gHltgbqAeqm7ECqAeDrbECqAfgvbECqAf_nrECqAffn7ECqAfKqbECqAfrpbECqAfqsbECqAeZtbECqAe-t7EC2AcB0ggkCIBhEAEYHzICigI6CYBAgMCAgICgKEi9_cE6WPfE7-KG64QDsQloFY0I819HuIAKAZgLAcgLAdoMEAoKELC17cf6_vjlBxICAQOqDQJBVcgNAdgTAtAVAfgWAYAXAbIYCRICgmgYAiIBAA&ae=1&ase=2&gclid=EAIaIQobChMIyeTv4obrhAMV0vdzAR0CuwoJEAEYASAAEgL6PvD_BwE&num=1&cid=CAQSOwB7FLtqsHK094spdoaQt-h9iX5PJ9zt-19kvYM1ldowDR1zOpgYOBfr1d5CeT8AheT9Tiy6z0yLnfuSGAE&sig=AOD64_2YAv3hZTWz95W_YbVDPxMhn7xpXg&client=ca-pub-3734677162347682&rf=2&nb=17&adurl=https://sites.google.com/view/fashionpassrent%3Fgclid%3DEAIaIQobChMIyeTv4obrhAMV0vdzAR0CuwoJEAEYASAAEgL6PvD_BwE	Get hash	malicious	Unknown	Browse
	https://yakoowood.com/	Get hash	malicious	Unknown	Browse
	DHL SHIPPING DOCUMENT - BL - AWB PACKING LIST_02292024.exe	Get hash	malicious	DBatLoader, PureLog Stealer, zgRAT	Browse
	https://fnbo-alerts.org	Get hash	malicious	Unknown	Browse
	https://cloudflare-ipfs.com	Get hash	malicious	Unknown	Browse
	https://kvf4bl8dz44hd.pages.dev/Wi0nAbh0help0secure037/	Get hash	malicious	Unknown	Browse
	https://acrobat.adobe.com/id/urn:aaid:sc:VA6C2:19673103-b29e-4634-baef-0fbf173db387	Get hash	malicious	Unknown	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
dcs-public-edge-usw2-219535174.us-west-2.elb.amazonaws.com	https://in.xero.com/m/g4EjeZDud5lCeLiKvMaATTgixUJedYwIXI96osSo?utm_source=invoiceEmailViewInvoiceButton&utm_campaign=invoicesEmailStandardV2	Get hash	malicious	Unknown	Browse	100.21.16.173
	FFE Order details - Cincy v41720.xlsx	Get hash	malicious	Unknown	Browse	54.71.166.176
	https://18apmic18.z13.web.core.windows.net/	Get hash	malicious	TechSupportScam	Browse	54.149.168.153
	http://www.sdmts.com/business-center/for-hire-vehicle-administration&c=E,1,pc5oom8YsW1RqHtANaUTLgMvd2z37r_4n-NR90jlF12Z7NyUKYXr1sKmCXY3dgMIENHwNl8jxylzX2garHrVx3wU2gE5fuDMBydZQ2COLEQJ&typo=1	Get hash	malicious	Unknown	Browse	50.112.189.71
	https://dmec.org/	Get hash	malicious	Unknown	Browse	100.21.242.169
	https://earnandexcel.com/blog/how-to-expand-columns-in-excel-multiple-tricks-to-resize-columns-rows/	Get hash	malicious	Unknown	Browse	52.88.22.80
	https://ctgoodjobs.hk/english/count/count_banner.asp?banner_name=newsletter-cthr_20230930_footer_privacy&href=https://acrobat.adobe.com/id/urn:aaid:sc:EU:496e3280-db43-4f27-9c85-1d9ad2126f15	Get hash	malicious	Unknown	Browse	44.235.166.15
	https://1drv.ms/f/s!Ah3RUujFpGTrbZcZBXk_HMFtmRQ	Get hash	malicious	Unknown	Browse	100.21.242.169
	https://yxu.pages.dev/account/js-reporting/?crumb=uZ4.07kERLI&message=javascript_not_enabled&ref=%2Faccount%2Fchallenge%2Fpassword	Get hash	malicious	HTMLPhisher	Browse	52.40.174.159
	http://zarabidarix.xyz/4kKUDf2271ibnX494fplpivknze26JVIISAKNWCQFBYE13955JAYA338314o10	Get hash	malicious	Unknown	Browse	54.71.166.176
adobetarget.data.adobedc.net	KxgGGaiW3E.exe	Get hash	malicious	Quasar	Browse	63.140.39.82
	https://acrobat.adobe.com/id/urn:aaid:sc:AP:c47bd847-0028-43f6-8564-6c8445af0ecc	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse	63.140.39.93
	23xCOZerXg.exe	Get hash	malicious	PureLog Stealer, Xmrig, zgRAT	Browse	63.140.39.82
	https://22apmic22.z13.web.core.windows.net/	Get hash	malicious	TechSupportScam	Browse	63.140.39.248
	https://in.xero.com/m/g4EjeZDud5lCeLiKvMaATTgixUJedYwIXI96osSo?utm_source=invoiceEmailViewInvoiceButton&utm_campaign=invoicesEmailStandardV2	Get hash	malicious	Unknown	Browse	63.140.38.55
	https://yxv.ens.mybluehost.me/Ca/net/login.php	Get hash	malicious	Unknown	Browse	63.140.38.111
	https://19apmic17.z13.web.core.windows.net/	Get hash	malicious	TechSupportScam	Browse	63.140.38.55
	https://19apmic11.z13.web.core.windows.net/	Get hash	malicious	TechSupportScam	Browse	63.140.38.189
	https://librospy.com/	Get hash	malicious	Unknown	Browse	63.140.39.35
	https://18apmic18.z13.web.core.windows.net/	Get hash	malicious	TechSupportScam	Browse	63.140.39.93
part-0041.t-0009.t-msedge.net	https://u44056869.ct.sendgrid.net/ls/click?upn=u001.nH1ryR-2Btr2av-2Bkfc8quLEXKlGRKFonctFf3nB-2FAP-2Bjae3IsQgCoKtK-2FQ57cEEmmhZzRyd07G16kQ6rsc4EaJT6S7Rh48kOVsBPHV-2Fkkk9Vfz7cojLOCLuj4sUGVMM7pbdmwtinmtiLhfYkhEkgve628OiJsccHyeYc3lkmkn6epsOmmj4-2Fi-2BWjxfm73m7vUzCOGnDWnQJBmmd6DmkDcfIw-3D-3DU_vL_MRfqZW9nS4IDBSHT8MfJfSAq9b0aOVvtJoUhpW1Ga8ePAnfV-2FfXwE0xIGnayeXag21qNKRc5VLcgMkPlIuCBf7Hi8EFUvj1-2FlklJpMLZNx1IQq8eO26tVdmeuxhGn-2B2zjA71oEkiC9pTrxX9Dz-2FMJk8mkJr62ye1KlBo-2B8fxBlVl-2B6T0POpB0GKoibGhcjh4Z-2FnPU453nMAkUkNy65MlaA-3D-3D	Get hash	malicious	HTMLPhisher	Browse	13.107.246.69
	Payment MT103.xls	Get hash	malicious	Unknown	Browse	13.107.246.69
	Ref_Order04.xls	Get hash	malicious	Unknown	Browse	13.107.213.69
	3Shape Unite Installer.exe	Get hash	malicious	Unknown	Browse	13.107.246.69
	SecuriteInfo.com.Trojan.MSIL.zgRAT.Heur.21652.15881.exe	Get hash	malicious	PureLog Stealer, zgRAT	Browse	13.107.213.69
	https://wmicrosouab-4ba8.udydzj.workers.dev/	Get hash	malicious	HTMLPhisher	Browse	13.107.213.69
	https://uqgekpc20qn1.azureedge.net/6466/	Get hash	malicious	TechSupportScam	Browse	13.107.246.69
	https://magnisteel.lk/4765445b-32c6-49b0-83e6-1d93765276ca.php	Get hash	malicious	HTMLPhisher	Browse	13.107.213.69
	https://condoresorts.com/	Get hash	malicious	Unknown	Browse	13.107.246.69
	https://mota-engil.caf0sa.com/tiyamike.chikabadwa56078874fessdGl5YW1pa2UuY2hpa2FiYWR3YUBtb3RhLWVuZ2lsLnB097140964?5101245168264822=2215800694735574#dGl5YW1pa2UuY2hpa2FiYWR3YUBtb3RhLWVuZ2lsLnB0	Get hash	malicious	Unknown	Browse	13.107.246.69

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CHINANET-BACKBONENo31Jin-rongStreetCN	https://d-wz.info/mygov	Get hash	malicious	HTMLPhisher	Browse	63.140.36.145
	https://uqgekpc20qn1.azureedge.net/6466/	Get hash	malicious	TechSupportScam	Browse	63.140.36.51
	KxgGGaiW3E.exe	Get hash	malicious	Quasar	Browse	63.140.39.82
	https://acrobat.adobe.com/id/urn:aaid:sc:AP:c47bd847-0028-43f6-8564-6c8445af0ecc	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse	63.140.39.93
	23xCOZerXg.exe	Get hash	malicious	PureLog Stealer, Xmrig, zgRAT	Browse	63.140.39.82
	oVOImRIAaz.elf	Get hash	malicious	Mirai	Browse	220.160.120.160
	NMdpQecbkg.elf	Get hash	malicious	Mirai	Browse	106.86.148.241
	1mHUcsxKG6.elf	Get hash	malicious	Mirai	Browse	171.113.147.175
	xzk9TKqNoI.elf	Get hash	malicious	Mirai	Browse	14.105.136.165
	sora.arm.elf	Get hash	malicious	Mirai	Browse	112.67.254.212
MICROSOFT-CORP-MSN-AS-BLOCKUS	URGENTE_NOTIFICATION.cmd	Get hash	malicious	Remcos, DBatLoader	Browse	13.107.139.11
	https://u44056869.ct.sendgrid.net/ls/click?upn=u001.nH1ryR-2Btr2av-2Bkfc8quLEXKlGRKFonctFf3nB-2FAP-2Bjae3IsQgCoKtK-2FQ57cEEmmhZzRyd07G16kQ6rsc4EaJT6S7Rh48kOVsBPHV-2Fkkk9Vfz7cojLOCLuj4sUGVMM7pbdmwtinmtiLhfYkhEkgve628OiJsccHyeYc3lkmkn6epsOmmj4-2Fi-2BWjxfm73m7vUzCOGnDWnQJBmmd6DmkDcfIw-3D-3DU_vL_MRfqZW9nS4IDBSHT8MfJfSAq9b0aOVvtJoUhpW1Ga8ePAnfV-2FfXwE0xIGnayeXag21qNKRc5VLcgMkPlIuCBf7Hi8EFUvj1-2FlklJpMLZNx1IQq8eO26tVdmeuxhGn-2B2zjA71oEkiC9pTrxX9Dz-2FMJk8mkJr62ye1KlBo-2B8fxBlVl-2B6T0POpB0GKoibGhcjh4Z-2FnPU453nMAkUkNy65MlaA-3D-3D	Get hash	malicious	HTMLPhisher	Browse	13.107.213.69
	OKhCyJ619J.rtf	Get hash	malicious	Remcos, DBatLoader	Browse	13.107.137.11
	#U5c97#U4f4d#U8865#U52a9#U5236#U5ea6.docx.doc	Get hash	malicious	Unknown	Browse	52.184.66.142
	fu56fbrtn8.exe	Get hash	malicious	Remcos, DBatLoader	Browse	13.107.139.11
	Payment MT103.xls	Get hash	malicious	Unknown	Browse	13.107.246.69
	Ref_Order04.xls	Get hash	malicious	Unknown	Browse	13.107.213.69
	FT. 40FE CNY .xlsx.lnk	Get hash	malicious	AgentTesla, DBatLoader, PureLog Stealer, RedLine	Browse	13.107.139.11
	3Shape Unite Installer.exe	Get hash	malicious	Unknown	Browse	40.67.232.186
	OHkRFujs2m.exe	Get hash	malicious	Unknown	Browse	104.208.16.94
AMAZON-02US	https://u44056869.ct.sendgrid.net/ls/click?upn=u001.nH1ryR-2Btr2av-2Bkfc8quLEXKlGRKFonctFf3nB-2FAP-2Bjae3IsQgCoKtK-2FQ57cEEmmhZzRyd07G16kQ6rsc4EaJT6S7Rh48kOVsBPHV-2Fkkk9Vfz7cojLOCLuj4sUGVMM7pbdmwtinmtiLhfYkhEkgve628OiJsccHyeYc3lkmkn6epsOmmj4-2Fi-2BWjxfm73m7vUzCOGnDWnQJBmmd6DmkDcfIw-3D-3DU_vL_MRfqZW9nS4IDBSHT8MfJfSAq9b0aOVvtJoUhpW1Ga8ePAnfV-2FfXwE0xIGnayeXag21qNKRc5VLcgMkPlIuCBf7Hi8EFUvj1-2FlklJpMLZNx1IQq8eO26tVdmeuxhGn-2B2zjA71oEkiC9pTrxX9Dz-2FMJk8mkJr62ye1KlBo-2B8fxBlVl-2B6T0POpB0GKoibGhcjh4Z-2FnPU453nMAkUkNy65MlaA-3D-3D	Get hash	malicious	HTMLPhisher	Browse	13.226.210.111
	https://tibusiness.cl/css/causarol.rar	Get hash	malicious	Unknown	Browse	52.25.6.244
	PO#0023298413.xls	Get hash	malicious	Unknown	Browse	76.76.21.61
	PO#0023298413.xls	Get hash	malicious	Unknown	Browse	76.76.21.93
	PO#0023298413.xls	Get hash	malicious	Unknown	Browse	76.76.21.9
	Ref_Order04.xls	Get hash	malicious	Unknown	Browse	76.76.21.241
	Ref_Order04.xls	Get hash	malicious	Unknown	Browse	76.76.21.98
	az9a0rNKvy.elf	Get hash	malicious	Mirai, Okiru	Browse	54.171.230.55
	SecuriteInfo.com.Python.Stealer.1437.14994.32063.exe	Get hash	malicious	Python Stealer	Browse	45.112.123.239
	https://d-wz.info/mygov	Get hash	malicious	HTMLPhisher	Browse	18.154.132.7
CHINANET-BACKBONENo31Jin-rongStreetCN	https://d-wz.info/mygov	Get hash	malicious	HTMLPhisher	Browse	63.140.36.145
	https://uqgekpc20qn1.azureedge.net/6466/	Get hash	malicious	TechSupportScam	Browse	63.140.36.51
	KxgGGaiW3E.exe	Get hash	malicious	Quasar	Browse	63.140.39.82
	https://acrobat.adobe.com/id/urn:aaid:sc:AP:c47bd847-0028-43f6-8564-6c8445af0ecc	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse	63.140.39.93
	23xCOZerXg.exe	Get hash	malicious	PureLog Stealer, Xmrig, zgRAT	Browse	63.140.39.82
	oVOImRIAaz.elf	Get hash	malicious	Mirai	Browse	220.160.120.160
	NMdpQecbkg.elf	Get hash	malicious	Mirai	Browse	106.86.148.241
	1mHUcsxKG6.elf	Get hash	malicious	Mirai	Browse	171.113.147.175
	xzk9TKqNoI.elf	Get hash	malicious	Mirai	Browse	14.105.136.165
	sora.arm.elf	Get hash	malicious	Mirai	Browse	112.67.254.212

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	https://u44056869.ct.sendgrid.net/ls/click?upn=u001.nH1ryR-2Btr2av-2Bkfc8quLEXKlGRKFonctFf3nB-2FAP-2Bjae3IsQgCoKtK-2FQ57cEEmmhZzRyd07G16kQ6rsc4EaJT6S7Rh48kOVsBPHV-2Fkkk9Vfz7cojLOCLuj4sUGVMM7pbdmwtinmtiLhfYkhEkgve628OiJsccHyeYc3lkmkn6epsOmmj4-2Fi-2BWjxfm73m7vUzCOGnDWnQJBmmd6DmkDcfIw-3D-3DU_vL_MRfqZW9nS4IDBSHT8MfJfSAq9b0aOVvtJoUhpW1Ga8ePAnfV-2FfXwE0xIGnayeXag21qNKRc5VLcgMkPlIuCBf7Hi8EFUvj1-2FlklJpMLZNx1IQq8eO26tVdmeuxhGn-2B2zjA71oEkiC9pTrxX9Dz-2FMJk8mkJr62ye1KlBo-2B8fxBlVl-2B6T0POpB0GKoibGhcjh4Z-2FnPU453nMAkUkNy65MlaA-3D-3D	Get hash	malicious	HTMLPhisher	Browse	52.165.165.26 23.202.57.177
	#U5c97#U4f4d#U8865#U52a9#U5236#U5ea6.docx.doc	Get hash	malicious	Unknown	Browse	52.165.165.26 23.202.57.177
	http://42.193.223.169/extensioncompabilitynode.exe	Get hash	malicious	Unknown	Browse	52.165.165.26 23.202.57.177
	https://d-wz.info/mygov	Get hash	malicious	HTMLPhisher	Browse	52.165.165.26 23.202.57.177
	https://emv1.3rujia.cn/	Get hash	malicious	Unknown	Browse	52.165.165.26 23.202.57.177
	SecuriteInfo.com.Trojan.MSIL.zgRAT.Heur.21652.15881.exe	Get hash	malicious	PureLog Stealer, zgRAT	Browse	52.165.165.26 23.202.57.177
	https://wmicrosouab-4ba8.udydzj.workers.dev/	Get hash	malicious	HTMLPhisher	Browse	52.165.165.26 23.202.57.177
	https://uqgekpc20qn1.azureedge.net/6466/	Get hash	malicious	TechSupportScam	Browse	52.165.165.26 23.202.57.177
	https://www.3rujia.cn/	Get hash	malicious	Unknown	Browse	52.165.165.26 23.202.57.177
	https://windowdefalerts-error0x21916-alert-virus-detected.pages.dev/	Get hash	malicious	HTMLPhisher, TechSupportScam	Browse	52.165.165.26 23.202.57.177

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 475 x 212, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	35005
Entropy (8bit):	7.980061050467981
Encrypted:	false
SSDEEP:	768:aHBEr/QXnbCgWotMq4AZZivq2/Qu0cEv1FjHBep6U0Z/68R:ahWqbTWiM7ACvdIdldhep4rR
MD5:	522037F008E03C9448AE0AAAF09E93CB
SHA1:	8A32997EAB79246BEED5A37DB0C92FBFB006BEF2
SHA-256:	983C35607C4FB0B529CA732BE42115D3FCAAC947CEE9C9632F7CACDBDECAF5A7
SHA-512:	643EC613B2E7BDBB2F61E1799C189B0E3392EA5AE10845EB0B1F1542A03569E886F4B54D5B38AF10E78DB49C71357108C94589474B181F6A4573B86CF2D6F0D8
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	.PNG........IHDR..............[.U....sRGB.........gAMA......a.....pHYs..........+.....RIDATx^..`........B hpwww(PJ....R.B.....K[j....@ H ..r:...].P._.`...K.ffg.v.ygf.TM.4.m...`.D".H$......"##..2e.X.t..Y".H$...d..PK.V".H$..uVm.,.H$.....b+.H$.I-#.V".H$.ZF..D".H$...[.D".Hj.)...D"..2Rl%..D".e..J$..DR.H..H$.....b+.H$..9..Neee.X,.B.\/.....o.b+.H$..9...q...EHU....p.....=z....b.7.q..........N.. ....cUAX.9...m'_...2.`.g{...4.H.9.p.4...K ^.....`.\|.n..]..m..`W..W.H.~..\|.^.a..K.6......_....K..w....9......^.....&...R....[...w..Ix=.:..^/..Epp0.5.....QRR...l....S.b.5.c.6...5..8.\....z...I......&.>....../.{.=...]'c......[.E`@Cg......Z.....c.f..,.y\|,.{.o@.j..2..:.&l4.{.]Ll.N.0..b:b...g.n.........I...Ewc....[..,i`v......F...il\|.c,{.-.....%BP.U........y.x....6..E2..n.W...J .*..`..r....F....#BCC......\|.L&........O...'........\.....;...q.n$...7...ga..x....)..A...0.{1..'1../...+yRC...W.-..b..c0dDG...U[po....2eG.G.../.@........h.:.k?.......Q...

Chrome Cache Entry: 101

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 658 x 480, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	13842
Entropy (8bit):	7.802399161550213
Encrypted:	false
SSDEEP:	192:NLNf+jBQsDHg7av3EEondO8PuRu2mIYXEIiDm42NpsHFMHfgnJ4K2DVwv:NLt+1jDmY+ndXwjLUpiDwpzfwoDVk
MD5:	F6EC97C43480D41695065AD55A97B382
SHA1:	D9C3D0895A5ED1A3951B8774B519B8217F0A54C5
SHA-256:	07A599FAB1E66BABC430E5FED3029F25FF3F4EA2DD0EC8968FFBA71EF1872F68
SHA-512:	22462763178409D60609761A2AF734F97B35B9A818EC1FD9046AFAB489AAD83CE34896EE8586EFE402EA7739ECF088BC2DB5C1C8E4FB39E6A0FC5B3ADC6B4A9B
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	.PNG........IHDR................1....sRGB.........gAMA......a.....pHYs..........o.d..5.IDATx^..[.,.]...../<.!.B(/y..).F\r...!(.H..a ..B.~..A..KXA.M...6..8...!1....l./.X.1....2.`.y"l..R...V.....{...}._gWW.Z.VUw.N...U..P@..... ..@.A...".$..E.I.........$..("H..PD..... ..p....U.}.{.....l..A.....A........s.......D.0...@....E..x........L. /.".A.....$...Y."...%.I..["../.&.I..[`.0..IA.........p4.I.........$..("H..PD..... ..@.A...".$..E.I.........$..("H..PD..... ..@.A...".$..E.>H...O.................?.~.......].7.....a?....(H....m.G..G..a.P..?yo......f?...o. .B.....mo{[....:9<].....7.....a.....S..Cd.5,.R....#....>......._g.....Wo\|.....z.g.........w.T...]x.>.....y(.........6....[..px...U....~.~hu...}H.......~.L... ....r...iY.$..Id..Ax"../....._..U....OTo\|.Mh.km..A.k..k....n.C`\|._\=...o...a.e.. ...&.A2..k.. ....X.+...C..P....y..>.{._..(H....8(.?...w.}M.........:s_!.m.........BY..T..z.5{.W.~..6.....F....bq....m.....?.......v....o..o...ki...iX.$......\]V...V...

Chrome Cache Entry: 102

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	4945
Entropy (8bit):	4.796097221456048
Encrypted:	false
SSDEEP:	96:A0AIvEQ+KfZcbhaW9dptAdSlkepQnymoLByzVqrpCvJ4QG62HxpJjJ+do88HxbqK:dgQ+KfZcbhaWjptAdSlkepQnNgByz8FB
MD5:	EF6E83E1C6E863A122281F71DD8020B4
SHA1:	CEA054B197D99548088012C2E011F3BA5DB8CE60
SHA-256:	B22DAC9B489D9184B1FFE6A4981CAE6C350557D2E7B3378FED8B2A20D41DEB70
SHA-512:	8C69422E55648BC875937D5A51B6D9E76A3019A8147E44D7BA29811772950A06A7A86EDB73319C91D27EB9E561565298977E295E5486770B76007DF108EE4D27
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	{"callToAction":{"primary":{"biName":"download-dotnet","href":"https://dotnet.microsoft.com/download","kind":"link","title":"Download .NET"}},"category":{"biName":"dotnet","href":"/dotnet/","kind":"link","title":".NET"},"items":[{"biName":"1-languages","items":[{"biName":"1-c-sharp","href":"/dotnet/csharp/","kind":"link","title":"C#"},{"biName":"2-f-sharp","href":"/dotnet/fsharp/","kind":"link","title":"F#"},{"biName":"3-visual-basic","href":"/dotnet/visual-basic/","kind":"link","title":"Visual Basic"}],"kind":"menu","title":"Languages"},{"biName":"2-features","items":[{"biName":"1-fundamental","href":"/dotnet/fundamentals/","kind":"link","title":"Fundamentals"},{"biName":"2-tools-and-diagnostics","href":"/dotnet/navigate/tools-diagnostics/","kind":"link","title":"Tools and diagnostics"},{"biName":"3-migrate-from-dotnet-framework","href":"/dotnet/navigate/migration-guide/","kind":"link","title":"Migrate from .NET Framework"},{"biName":"4-compatibility","href":"/dotnet/core/compatibilit

Chrome Cache Entry: 103

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 1300 x 300, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	81913
Entropy (8bit):	7.909044687847068
Encrypted:	false
SSDEEP:	1536:dKVqOVA4kDFNEgVzMoz1Olnr8AN5yl7UWBrZtLbqO0vPU9dADS/5een:au5DFj4ozot8AO9UWBDqOYPWB/5eq
MD5:	049412F03408193F0103637411B42627
SHA1:	540DA51436D5A9E305BB113FD522B91448348813
SHA-256:	BA778D4F93DBB62ED50333A967DBC34BB1FD5C9B45ED90B7366D72BD6A2955DB
SHA-512:	90F11094E997CBFA3593FE6A365B0D942EE03EAA9512AB73C0B6D7CAE409F7E0B2B15118944FB4DC113169F2BA900EBBCE9BEC8EE34C3832C5579F217B784AED
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR.......,......^......zTXtRaw profile type exif..x.mPA.. ...>...<..L.......;......n.T....5t..Qw.......c#X3;...=r....3..>..U...u..D$.2..<:...F.FLQ(i..[.L.....gh,.$:..._\|z...0....E.<..w..L.~.....#Ci...7..../.YMO.......iCCPICC profile..x.}.=H.@.._S."..v..:Y..q...Bi+..`r..4iHR\......U..g].\.A.....I.EJ._Rh...q?..{...f..f...j..N..\~U....B.@..L=.Y..s\|.......>...T.&.\|".....x.xf..9...YYR..... .#.e..8...xf.....b....feC%.&..F.B.e...g.Zg.{.....J..4#H`.I. BF..Ta!F.F..4..=.#.?E..\.0r,...........I7)..z_l.c......m...v...?.WZ._k....7:Z...m....M...w..']2$G....E....).....kno.}.>.Y.j..88..J.........=......r.......viTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?>.<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="XMP Core 4.4.0-Exiv2">. <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#">. <rdf:Description rdf:about="". xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/". xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/Resourc

Chrome Cache Entry: 104

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65409)
Category:	downloaded
Size (bytes):	185160
Entropy (8bit):	5.416088073921403
Encrypted:	false
SSDEEP:	3072:qr01mHNlmzFJALnfgl6KqMeuBDnQgUlzBTIxkLEq:S01ArI2IIMeuDnQzU+Yq
MD5:	B6C6F82EAC50F30FFCC090FA845F53F0
SHA1:	1B84A3B53A340BA59171800DF683D15418DD09D3
SHA-256:	7D960385011DDFE6CC859E56D4302DEDA71FDB2D90655E907C14E77D2DCBC8A5
SHA-512:	96CB5C8177D963CCCC0BD8E026B55BD990DD2784687B703DE61C663E16703892E33A0B84B714252F7361DFC8FA4D1D2CF0AA2F8A4F3EB27DB8BDBA4A52DFE4FB
Malicious:	false
URL:	https://js.monitor.azure.com/scripts/c/ms.jsll-3.min.js
Preview:	/!. 1DS JSLL SKU, 3.2.17. * Copyright (c) Microsoft and contributors. All rights reserved.. * (Microsoft Internal Only). */.!function(e,t){var n="undefined";if("object"==typeof exports&&typeof module!=n)t(exports);else if("function"==typeof define&&define.amd)define(["exports"],t);else{var r,n=typeof globalThis!=n?globalThis:e\|\|self,i={},e="__ms$mod__",a={},o=a.esm_ms_jsll_3_2_17={},s="3.2.17",c="oneDS3",u=(u=n)[c]=u[c]\|\|{},l=(l=n)[c="oneDS"]=l[c]\|\|{},n=u[e]=u[e]\|\|{},f=n.v=n.v\|\|[],c=l[e]=l[e]\|\|{},d=c.v=c.v\|\|[];for(r in(c.o=c.o\|\|[]).push(a),t(i),i)u[r]=i[r],f[r]=s,l[r]=i[r],d[r]=s,(o.n=o.n\|\|[]).push(r)}}(this,function(u){"use strict";!function(e,t,n){var r=Object.defineProperty;if(r)try{return r(e,t,n)}catch(i){}typeof n.value!==undefined&&(e[t]=n.value)}(u,"__esModule",{value:!0});var l="function",f="object",fe="undefined",j="prototype",d="hasOwnProperty",g=Object,m=g[j],y=g.assign,C=g.create,e=g.defineProperty,E=m[d],b=null;function K(e){e=!1===(e=void 0===e\|\|e)?null:b;return e\|\|((

Chrome Cache Entry: 105

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	2574
Entropy (8bit):	4.80598049257081
Encrypted:	false
SSDEEP:	48:YWuel64qAq3DJJWuO6Z3Db8VgK/ni47ttbFSlA37ERw7II77Aj5M1:PvqAWDzO5tRNEYIOEjc
MD5:	B446C5E0EE48273D54D308DDD35F954A
SHA1:	AF12E4273BE6F0A860589CE36E08920BD2C8CAC2
SHA-256:	7A0A2780A1A8977683EF113DEA438AB2ECA1B99DA9CF67854662D51E08E6BF15
SHA-512:	8C1CCEC779CA25B8678079CC7C88890C718330F64C55437C7AC1107EE5F81D1117763667B840C59AD6BE9F1ECB367AC3B1E4EEE775A2E43C88F6317EE6892FE7
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/breadcrumb/toc.json
Preview:	{"items":[{"children":[{"children":[{"homepage":"/dotnet/csharp/index","href":"/dotnet/csharp/","toc_title":"C#"},{"homepage":"/dotnet/azure/index","href":"/dotnet/azure/","toc_title":"Azure"},{"homepage":"/dotnet/aspire/index","href":"/dotnet/aspire/","toc_title":".NET Aspire (Preview)"},{"homepage":"/dotnet/orleans/index","href":"/dotnet/orleans/","toc_title":"Orleans"},{"children":[{"homepage":"/dotnet/architecture/modern-web-apps-azure/index","href":"/dotnet/architecture/modern-web-apps-azure/","toc_title":"Modern ASP.NET web applications e-book"},{"homepage":"/dotnet/architecture/microservices/index","href":"/dotnet/architecture/microservices/","toc_title":".NET microservices - Architecture e-book"},{"homepage":"/dotnet/architecture/cloud-native/index","href":"/dotnet/architecture/cloud-native/","toc_title":"Cloud native"},{"homepage":"/dotnet/architecture/blazor-for-web-forms-developers/index","href":"/dotnet/architecture/blazor-for-web-forms-developers/","toc_title":"Blazor for

Chrome Cache Entry: 106

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 533 x 478, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	18367
Entropy (8bit):	7.7772261735974215
Encrypted:	false
SSDEEP:	384:4qqZYz7CAda2Qmd6VWWNg9h8XvdkRbdi2nki:1qZYz7Cma2hYNMh8XvdObdi2nX
MD5:	240C4CC15D9FD65405BB642AB81BE615
SHA1:	5A66783FE5DD932082F40811AE0769526874BFD3
SHA-256:	030272CE6BA1BECA700EC83FDED9DBDC89296FBDE0633A7F5943EF5831876C07
SHA-512:	267FE31BC25944DD7B6071C2C2C271CCC188AE1F6A0D7E587DCF9198B81598DA6B058D1B413F228DF0CB37C8304329E808089388359651E81B5F3DEC566D0EE0
Malicious:	false
Preview:	.PNG........IHDR.............,#......sRGB.........gAMA......a.....pHYs..........o.d..GTIDATx^._.}.U.7..BkB.......!E......b.Ej.K...Z...iK.$..h..B`..T.?5.7.I..16$.E.......c...c...Q_V.k...k..g.y.9..G.g..g.9.Z{..Z{.nv....@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...<@v.].../.1R'm.....x..h.....]a1U7........s.......x.h.q.A! ....8IL\GP..............M...W.............D.....dJ<.+,.........W...pgAT...@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...@......P.;/..G....O~..O~...'?......h.....}.y..4/....S..........Y......?..?.g7...G...............x{..w..y.~.9.~.y....y.#.c....<.E.............^..7G.._.u.nv/..f........5.....5?.;...w.....i~.?\|..H+Dd.....Y%....r~.$Q...7.v..._hv..r.O_.4..7M.6....o..=..?....3....?.....xE...O..7....^......D.W....m...6........O..Ob.4.9J........6.;..>.,.....o.l..>%J.V......%k..0.bQqIA..O..y.{.....7.......4_..Za...4.o.....h..........k...M...i....G.4...h.L.#...&.'%...~j..W.*Kx......o.%s.m

Chrome Cache Entry: 69

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with CRLF line terminators
Category:	downloaded
Size (bytes):	1478
Entropy (8bit):	5.030941252322257
Encrypted:	false
SSDEEP:	24:TGAg3Efef6tfTf/fffCfxfdffW4N5f0f8fK8zyRWmmkYRWDKslbzP3LTPv4NUhqI:TK0W6bXnq512ysUbkfKCvUjeGxbu
MD5:	020629EBA820F2E09D8CDA1A753C032B
SHA1:	D91A65036E4C36B07AE3641E32F23F8DD616BD17
SHA-256:	F8AE8A1DC7CE7877B9FB9299183D2EBB3BEFAD0B6489AE785D99047EC2EB92D1
SHA-512:	EF5A5C7A301DE55D103B1BE375D988970D9C4ECD62CE464F730C49E622128F431761D641E1DFAA32CA03F8280B435AE909486806DF62A538B48337725EB63CE1
Malicious:	false
URL:	https://learn.microsoft.com/_themes/docs.theme/master/en-us/_themes/global/67a45209.deprecation.js
Preview:	// ES5 script for back compat with unsupported browsers...!(function () {...'use strict';...// Keep in sync with environment/browser.ts...var supportedBrowser =....typeof Blob === 'function' &&....typeof PerformanceObserver === 'function' &&....typeof Intl === 'object' &&....typeof MutationObserver === 'function' &&....typeof URLSearchParams === 'function' &&....typeof WebSocket === 'function' &&....typeof IntersectionObserver === 'function' &&....typeof queueMicrotask === 'function' &&....typeof TextEncoder === 'function' &&....typeof TextDecoder === 'function' &&....typeof customElements === 'object' &&....typeof HTMLDetailsElement === 'function' &&....typeof AbortController === 'function' &&....typeof AbortSignal === 'function' &&....'entries' in FormData.prototype &&....'toggleAttribute' in Element.prototype &&....'replaceChildren' in Element.prototype &&....// ES2019....'fromEntries' in Object &&....'flatMap' in Array.prototype &&....'trimEnd' in String.prototype &&....// ES2020..

Chrome Cache Entry: 70

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 533 x 478, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	13339
Entropy (8bit):	7.683569563478597
Encrypted:	false
SSDEEP:	192:zjSKAj04ndWb6OuzZjk6TsEaJS0/bJur2Gz4Imm3MhE4NfM:zutfW69XTspsG3G0TfhEQM
MD5:	512625CF8F40021445D74253DC7C28C0
SHA1:	F6B27CE0F7D4E48E34FDDCA8A96337F07CFFE730
SHA-256:	1D4DCEE8511D5371FEC911660D6049782E12901C662B409A5C675772E9B87369
SHA-512:	AE02319D03884D758A86C286B6F593BDFFD067885D56D82EEB8215FDCB41637C7BB9109039E7FBC93AD246D030C368FB285B3161976ED485ABC5A8DF6DF9A38C
Malicious:	false
Preview:	.PNG........IHDR.............,#......sRGB.........gAMA......a.....pHYs..........o.d..3.IDATx^..].5Y...C.$..tH .NF.I&A0..;.r.fF.#..!7...'..3.0.../..s....."!.y...~....4....om.g.3.BTP......j..g.zVU....u...a.Z..j..U....y......$.....I...pAR...\.T....$.....I...pAR...\.T..p....5O>.d...}Rg.$....@.4....fb1.o.I...7..<.P.....n0.D.P.....n..L.P.....n8.......P.~......n(+..'. ......J.vM,H......W...h.T....$.....I...pAR...\.T....$.....I...pAR...\.T....$.....I...pAR...\.T....$......'....w....g....\|../5_.......T...~.y.'.'.\|...W..[...C.)......\|.[.[WK...w...w..y.{..\|.#.n>...5....5...h>..O6O>.Xx....o.B........g?.........~....?o...w.......}..-_k^........l....\|.D.TH.....o..B'..(.W-%...?...W.......E?h..........~.......?...~,..}...o^...5ox..bI.mo{[s.}.5.<.L.......<......Y.W......K..Q._...Iu...2...e)d]4.}Y..............k.%k..s.'..L(..o4...g...z............N.X.....W.O.^.4.....7......i~._7..~,bI......3.0RRq..\|.Mk..?.{.K_...t.........SYG.W^#).N^..._W...(.8.7.....W....7...m

Chrome Cache Entry: 71

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 533 x 478, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	18367
Entropy (8bit):	7.7772261735974215
Encrypted:	false
SSDEEP:	384:4qqZYz7CAda2Qmd6VWWNg9h8XvdkRbdi2nki:1qZYz7Cma2hYNMh8XvdObdi2nX
MD5:	240C4CC15D9FD65405BB642AB81BE615
SHA1:	5A66783FE5DD932082F40811AE0769526874BFD3
SHA-256:	030272CE6BA1BECA700EC83FDED9DBDC89296FBDE0633A7F5943EF5831876C07
SHA-512:	267FE31BC25944DD7B6071C2C2C271CCC188AE1F6A0D7E587DCF9198B81598DA6B058D1B413F228DF0CB37C8304329E808089388359651E81B5F3DEC566D0EE0
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/install/media/application-not-started/repair-tool-no-resolution.png
Preview:	.PNG........IHDR.............,#......sRGB.........gAMA......a.....pHYs..........o.d..GTIDATx^._.}.U.7..BkB.......!E......b.Ej.K...Z...iK.$..h..B`..T.?5.7.I..16$.E.......c...c...Q_V.k...k..g.y.9..G.g..g.9.Z{..Z{.nv....@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...<@v.].../.1R'm.....x..h.....]a1U7........s.......x.h.q.A! ....8IL\GP..............M...W.............D.....dJ<.+,.........W...pgAT...@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...@......P.;/..G....O~..O~...'?......h.....}.y..4/....S..........Y......?..?.g7...G...............x{..w..y.~.9.~.y....y.#.c....<.E.............^..7G.._.u.nv/..f........5.....5?.;...w.....i~.?\|..H+Dd.....Y%....r~.$Q...7.v..._hv..r.O_.4..7M.6....o..=..?....3....?.....xE...O..7....^......D.W....m...6........O..Ob.4.9J........6.;..>.,.....o.l..>%J.V......%k..0.bQqIA..O..y.{.....7.......4_..Za...4.o.....h..........k...M...i....G.4...h.L.#...&.'%...~j..W.*Kx......o.%s.m

Chrome Cache Entry: 72

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	1154
Entropy (8bit):	4.59126408969148
Encrypted:	false
SSDEEP:	24:txFRuJpzYeGK+VS6ckNL2091JP/UcHc8oQJ1sUWMLc/jH6GbKqjHJIOHA:JsfcU6ckNL2091Z/U/YsUDM+GhS
MD5:	37258A983459AE1C2E4F1E551665F388
SHA1:	603A4E9115E613CC827206CF792C62AEB606C941
SHA-256:	8E34F3807B4BF495D8954E7229681DA8D0DD101DD6DDC2AD7F90CD2983802B44
SHA-512:	184CB63EF510143B0AF013F506411C917D68BB63F2CFA47EA2A42688FD4F55F3B820AF94F87083C24F48AACEE6A692199E185FC5C5CFBED5D70790454EED7F5C
Malicious:	false
Preview:	<svg width="456" height="456" viewBox="0 0 456 456" fill="none" xmlns="http://www.w3.org/2000/svg">..<rect width="456" height="456" fill="#512BD4"/>..<path d="M81.2738 291.333C78.0496 291.333 75.309 290.259 73.052 288.11C70.795 285.906 69.6665 283.289 69.6665 280.259C69.6665 277.173 70.795 274.529 73.052 272.325C75.309 270.121 78.0496 269.019 81.2738 269.019C84.5518 269.019 87.3193 270.121 89.5763 272.325C91.887 274.529 93.0424 277.173 93.0424 280.259C93.0424 283.289 91.887 285.906 89.5763 288.11C87.3193 290.259 84.5518 291.333 81.2738 291.333Z" fill="white"/>..<path d="M210.167 289.515H189.209L133.994 202.406C132.597 200.202 131.441 197.915 130.528 195.546H130.044C130.474 198.081 130.689 203.508 130.689 211.827V289.515H112.149V171H134.477L187.839 256.043C190.096 259.57 191.547 261.994 192.192 263.316H192.514C191.977 260.176 191.708 254.859 191.708 247.365V171H210.167V289.515Z" fill="white"/>..<path d="M300.449 289.515H235.561V171H297.87V187.695H254.746V221.249H294.485V237.861H254.746V

Chrome Cache Entry: 73

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2574
Entropy (8bit):	4.80598049257081
Encrypted:	false
SSDEEP:	48:YWuel64qAq3DJJWuO6Z3Db8VgK/ni47ttbFSlA37ERw7II77Aj5M1:PvqAWDzO5tRNEYIOEjc
MD5:	B446C5E0EE48273D54D308DDD35F954A
SHA1:	AF12E4273BE6F0A860589CE36E08920BD2C8CAC2
SHA-256:	7A0A2780A1A8977683EF113DEA438AB2ECA1B99DA9CF67854662D51E08E6BF15
SHA-512:	8C1CCEC779CA25B8678079CC7C88890C718330F64C55437C7AC1107EE5F81D1117763667B840C59AD6BE9F1ECB367AC3B1E4EEE775A2E43C88F6317EE6892FE7
Malicious:	false
Preview:	{"items":[{"children":[{"children":[{"homepage":"/dotnet/csharp/index","href":"/dotnet/csharp/","toc_title":"C#"},{"homepage":"/dotnet/azure/index","href":"/dotnet/azure/","toc_title":"Azure"},{"homepage":"/dotnet/aspire/index","href":"/dotnet/aspire/","toc_title":".NET Aspire (Preview)"},{"homepage":"/dotnet/orleans/index","href":"/dotnet/orleans/","toc_title":"Orleans"},{"children":[{"homepage":"/dotnet/architecture/modern-web-apps-azure/index","href":"/dotnet/architecture/modern-web-apps-azure/","toc_title":"Modern ASP.NET web applications e-book"},{"homepage":"/dotnet/architecture/microservices/index","href":"/dotnet/architecture/microservices/","toc_title":".NET microservices - Architecture e-book"},{"homepage":"/dotnet/architecture/cloud-native/index","href":"/dotnet/architecture/cloud-native/","toc_title":"Cloud native"},{"homepage":"/dotnet/architecture/blazor-for-web-forms-developers/index","href":"/dotnet/architecture/blazor-for-web-forms-developers/","toc_title":"Blazor for

Chrome Cache Entry: 74

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 533 x 478, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	15427
Entropy (8bit):	7.784472070227724
Encrypted:	false
SSDEEP:	384:CKKdvwj3SJMpKKKKKKKKikCyKwqHILyPGQV4ykihKKKKKKKCm:CKKdvMMgKKKKKKKKiqB3yPVXkihKKKKI
MD5:	3062488F9D119C0D79448BE06ED140D8
SHA1:	8A148951C894FC9E968D3E46589A2E978267650E
SHA-256:	C47A383DE6DD60149B37DD24825D42D83CB48BE0ED094E3FC3B228D0A7BB9332
SHA-512:	00BBA6BCBFBF44B977129594A47F732809DCE7D4E2D22D050338E4EEA91FCC02A9B333C45EEB4C9024DF076CBDA0B46B621BF48309C0D037D19BBEAE0367F5ED
Malicious:	false
Preview:	.PNG........IHDR.............,#......sRGB.........gAMA......a.....pHYs..........o.d..;.IDATx^..].u.Y..M....B.X...".......@.ZzSys..,H{.Rz!... .......WM.IN..9n..I....g...p<P.0-....\|...X..s...Z.Y{....w..5.._s..x...E.......... ..................... ..................{....2. ...`.$h.......)....,T-x.5......,.."..(.A.......>.. ...`......4..G.\|.....,T-..'. ...`....]........?~.....A...pAP...\.T..........A...pAP...\.T..........A...pAP...\.T..........A...pAP...\.}P../}....TJ...'.O...'?......XH...K..>.b..K/t...o.......T.._.E.....q.$.x..qJ......mo...ww.}.{....W..._...._.^z...........(^x..C..P.../.........U..]../u.....w..{.O.N..o.l........_.^...2.....*....<...iP.W...o......]..+.?}c...t!.....p.=..._x..._yo....?....~u.c?.c1'.....{.^.}.S...5.yMx./.>.lwqq.}.....g..g1wZ..%......h.i[..%ul.&..U.k..";7-.9.6...s..s..0.......}.s..?...c..X...\|..........>.x..o.?.?..{........n..o....]?....Ej..yuu5...A.}....5...^...f........s.qJ..SYF.V...'..q.......T..'..z.....

Chrome Cache Entry: 75

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	16
Entropy (8bit):	3.875
Encrypted:	false
SSDEEP:	3:HMB:k
MD5:	0B04EA412F8FC88B51398B1CBF38110E
SHA1:	E073BCC5A03E7BBA2A16CF201A3CED1BE7533FBF
SHA-256:	7562254FF78FD854F0A8808E75A406F5C6058B57B71514481DAE490FC7B8F4C3
SHA-512:	6D516068C3F3CBFC1500032E600BFF5542EE30C0EAC11A929EE002C707810BBF614A5586C2673EE959AFDF19C08F6EAEFA18193AD6CEDC839BDF249CF95E8079
Malicious:	false
URL:	https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzISEAkEurwx6c-nJBIFDb_mJfI=?alt=proto
Preview:	CgkKBw2/5iXyGgA=

Chrome Cache Entry: 76

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	13100
Entropy (8bit):	5.176855971641256
Encrypted:	false
SSDEEP:	384:cF2jd3Y8nTnckYVYdOb/VdmFj/ZAA6SlB8qwV1sM5pNoEghVqQl3Tz5:62jJY8TcDiYb/VgFLyxOB8vV1sM7NoEe
MD5:	3B80CDF2C3556CFE9458577B5F2360B7
SHA1:	025EB63D8AB421A9E61F88D4924BEB11051B6411
SHA-256:	B72F34156103B51FD1F07E0ECB8958EAD34586C378FD383AE962EC927DB90F7D
SHA-512:	29A06D37422FD1D62ED3E557FDCF124BF421349F997AC812033F435BAB47ABEFDC3B1882066E152096A87AA46B6FCBCCA037209445F329CE92EA4A1D4CFC4E09
Malicious:	false
Preview:	{"banners":[{"content":{"text":"You may experience reduced functionality with empty pages and broken links. Development is in progress to improve your experience."},"dismissable":false,"location":"sectional","scope":{"accessLevels":["isolated"],"endDate":"2030-01-01T00:00:00-00:00","paths":["/samples/browse/","/lifecycle/products/","/dotnet/api/","/javascript/api/","/java/api/","/powershell/module/","/python/api/","/rest/api/","/assessments/"],"startDate":"2020-10-01T05:00:00-04:00"},"uid":"development-in-progress-isolated"},{"content":{"link":{"href":"https://aka.ms/DevBox/Customizations?wt.mc_id=mdbservice_resources_webpage_learnpromotion_cnl","title":"Learn more"},"text":"Now in preview \| Microsoft Dev Box customizations features."},"dismissable":true,"location":"sectional","scope":{"accessLevels":["online"],"endDate":"2024-03-31T04:00:00.000Z","paths":["/azure/dev-box/*"],"startDate":"2024-02-20T23:00:00.000Z"},"uid":"938234 live"},{"content":{"link":{"href":"https://aka.ms/MSLear

Chrome Cache Entry: 77

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (54649), with CRLF line terminators
Category:	downloaded
Size (bytes):	106026
Entropy (8bit):	5.171529071699513
Encrypted:	false
SSDEEP:	1536:JXQw7M1QH3FHimDA4A6b3UBm5AcTO5uIod:JXQ2tXUBmhLd
MD5:	A76A653DAAA136B17D3ABB880C159606
SHA1:	CEACBC85439BC26B17CB6B4422A8907CF446469C
SHA-256:	F50053CCD6D8CD18E2736166CE8376BBA8BC673C49AF7D96DFB8DFF7EC9BF715
SHA-512:	3FDAB4797F3CC73F2279887913970146894F441BE361512A2E5D14117B760AA193656B357CE8061E22967354544DC431599C1191860996EC3993FED5CA00B7E0
Malicious:	false
URL:	https://learn.microsoft.com/static/third-party/adobe-target/at-js/2.9.0/at.js
Preview:	// No custom JavaScript../*.. @license.. * at.js 2.9.0 \| (c) Adobe Systems Incorporated \| All rights reserved.. * zepto.js \| (c) 2010-2016 Thomas Fuchs \| zeptojs.com/license..*/..window.adobe=window.adobe\|\|{},window.adobe.target=function(){"use strict";var t=window,e=document,n=!e.documentMode\|\|e.documentMode>=11;var r,o,i,c=e.compatMode&&"CSS1Compat"===e.compatMode&&n&&(r=window.navigator.userAgent,o=r.indexOf("MSIE ")>0,i=r.indexOf("Trident/")>0,!(o\|\|i)),s=t.targetGlobalSettings;if(!c\|\|s&&!1===s.enabled)return t.adobe=t.adobe\|\|{},t.adobe.target={VERSION:"",event:{},getOffer:Ke,getOffers:yt,applyOffer:Ke,applyOffers:yt,sendNotifications:yt,trackEvent:Ke,triggerView:Ke,registerExtension:Ke,init:Ke},t.mboxCreate=Ke,t.mboxDefine=Ke,t.mboxUpdate=Ke,"console"in t&&"warn"in t.console&&(c\|\|t.console.warn("AT: Adobe Target content delivery is disabled. Update your DOCTYPE to support Standards mode."),t.console.warn("AT: Adobe Target content delivery is disabled in targetGlobalSettings.")),

Chrome Cache Entry: 78

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	13100
Entropy (8bit):	5.176855971641256
Encrypted:	false
SSDEEP:	384:cF2jd3Y8nTnckYVYdOb/VdmFj/ZAA6SlB8qwV1sM5pNoEghVqQl3Tz5:62jJY8TcDiYb/VgFLyxOB8vV1sM7NoEe
MD5:	3B80CDF2C3556CFE9458577B5F2360B7
SHA1:	025EB63D8AB421A9E61F88D4924BEB11051B6411
SHA-256:	B72F34156103B51FD1F07E0ECB8958EAD34586C378FD383AE962EC927DB90F7D
SHA-512:	29A06D37422FD1D62ED3E557FDCF124BF421349F997AC812033F435BAB47ABEFDC3B1882066E152096A87AA46B6FCBCCA037209445F329CE92EA4A1D4CFC4E09
Malicious:	false
URL:	https://learn.microsoft.com/en-us/banners/index.json
Preview:	{"banners":[{"content":{"text":"You may experience reduced functionality with empty pages and broken links. Development is in progress to improve your experience."},"dismissable":false,"location":"sectional","scope":{"accessLevels":["isolated"],"endDate":"2030-01-01T00:00:00-00:00","paths":["/samples/browse/","/lifecycle/products/","/dotnet/api/","/javascript/api/","/java/api/","/powershell/module/","/python/api/","/rest/api/","/assessments/"],"startDate":"2020-10-01T05:00:00-04:00"},"uid":"development-in-progress-isolated"},{"content":{"link":{"href":"https://aka.ms/DevBox/Customizations?wt.mc_id=mdbservice_resources_webpage_learnpromotion_cnl","title":"Learn more"},"text":"Now in preview \| Microsoft Dev Box customizations features."},"dismissable":true,"location":"sectional","scope":{"accessLevels":["online"],"endDate":"2024-03-31T04:00:00.000Z","paths":["/azure/dev-box/*"],"startDate":"2024-02-20T23:00:00.000Z"},"uid":"938234 live"},{"content":{"link":{"href":"https://aka.ms/MSLear

Chrome Cache Entry: 79

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 533 x 478, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	15427
Entropy (8bit):	7.784472070227724
Encrypted:	false
SSDEEP:	384:CKKdvwj3SJMpKKKKKKKKikCyKwqHILyPGQV4ykihKKKKKKKCm:CKKdvMMgKKKKKKKKiqB3yPVXkihKKKKI
MD5:	3062488F9D119C0D79448BE06ED140D8
SHA1:	8A148951C894FC9E968D3E46589A2E978267650E
SHA-256:	C47A383DE6DD60149B37DD24825D42D83CB48BE0ED094E3FC3B228D0A7BB9332
SHA-512:	00BBA6BCBFBF44B977129594A47F732809DCE7D4E2D22D050338E4EEA91FCC02A9B333C45EEB4C9024DF076CBDA0B46B621BF48309C0D037D19BBEAE0367F5ED
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/install/media/application-not-started/repair-tool-recommended-changes.png
Preview:	.PNG........IHDR.............,#......sRGB.........gAMA......a.....pHYs..........o.d..;.IDATx^..].u.Y..M....B.X...".......@.ZzSys..,H{.Rz!... .......WM.IN..9n..I....g...p<P.0-....\|...X..s...Z.Y{....w..5.._s..x...E.......... ..................... ..................{....2. ...`.$h.......)....,T-x.5......,.."..(.A.......>.. ...`......4..G.\|.....,T-..'. ...`....]........?~.....A...pAP...\.T..........A...pAP...\.T..........A...pAP...\.T..........A...pAP...\.}P../}....TJ...'.O...'?......XH...K..>.b..K/t...o.......T.._.E.....q.$.x..qJ......mo...ww.}.{....W..._...._.^z...........(^x..C..P.../.........U..]../u.....w..{.O.N..o.l........_.^...2.....*....<...iP.W...o......]..+.?}c...t!.....p.=..._x..._yo....?....~u.c?.c1'.....{.^.}.S...5.yMx./.>.lwqq.}.....g..g1wZ..%......h.i[..%ul.&..U.k..";7-.9.6...s..s..0.......}.s..?...c..X...\|..........>.x..o.?.?..{........n..o....]?....Ej..yuu5...A.}....5...^...f........s.qJ..SYF.V...'..q.......T..'..z.....

Chrome Cache Entry: 80

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (52717), with no line terminators
Category:	downloaded
Size (bytes):	52717
Entropy (8bit):	5.462668685745912
Encrypted:	false
SSDEEP:	1536:tjspYRrxlhd0fq3agV3IcgPPPI3r7DAQHCloIB3Tj7xHw:tjZLCtxQ
MD5:	413FCC759CC19821B61B6941808B29B5
SHA1:	1AD23B8A202043539C20681B1B3E9F3BC5D55133
SHA-256:	DAF7759FEDD9AF6C4D7E374B0D056547AE7CB245EC24A1C4ACF02932F30DC536
SHA-512:	E9BF8A74FEF494990AAFD15A0F21E0398DC28B4939C8F9F8AA1F3FFBD18056C8D1AB282B081F5C56F0928C48E30E768F7E347929304B55547F9CA8C1AABD80B8
Malicious:	false
URL:	https://wcpstatic.microsoft.com/mscc/lib/v2/wcp-consent.js
Preview:	var WcpConsent;!function(){var e={229:function(e){window,e.exports=function(e){var t={};function o(n){if(t[n])return t[n].exports;var r=t[n]={i:n,l:!1,exports:{}};return e[n].call(r.exports,r,r.exports,o),r.l=!0,r.exports}return o.m=e,o.c=t,o.d=function(e,t,n){o.o(e,t)\|\|Object.defineProperty(e,t,{enumerable:!0,get:n})},o.r=function(e){"undefined"!=typeof Symbol&&Symbol.toStringTag&&Object.defineProperty(e,Symbol.toStringTag,{value:"Module"}),Object.defineProperty(e,"__esModule",{value:!0})},o.t=function(e,t){if(1&t&&(e=o(e)),8&t)return e;if(4&t&&"object"==typeof e&&e&&e.__esModule)return e;var n=Object.create(null);if(o.r(n),Object.defineProperty(n,"default",{enumerable:!0,value:e}),2&t&&"string"!=typeof e)for(var r in e)o.d(n,r,function(t){return e[t]}.bind(null,r));return n},o.n=function(e){var t=e&&e.__esModule?function(){return e.default}:function(){return e};return o.d(t,"a",t),t},o.o=function(e,t){return Object.prototype.hasOwnProperty.call(e,t)},o.p="",o(o.s=3)}([function(e,t,o)

Chrome Cache Entry: 81

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	exported SGML document, ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	1173007
Entropy (8bit):	5.503893944397598
Encrypted:	false
SSDEEP:	24576:VMga+4IVzOjS1Jho1WXQFjTEr39/jHXzT:VMcVzOjS1Jho1WXQar39/bXzT
MD5:	2E00D51C98DBB338E81054F240E1DEB2
SHA1:	D33BAC6B041064AE4330DCC2D958EBE4C28EBE58
SHA-256:	300480069078B5892D2363A2B65E2DFBBF30FE5C80F83EDBFECF4610FD093862
SHA-512:	B6268D980CE9CB729C82DBA22F04FD592952B2A1AAB43079CA5330C68A86E72B0D232CE4070DB893A5054EE5C68325C92C9F1A33F868D61EBB35129E74FC7EF9
Malicious:	false
URL:	https://learn.microsoft.com/static/third-party/MathJax/3.2.2/tex-mml-chtml.js
Preview:	(function(){"use strict";var __webpack_modules__={351:function(t,e,r){var n,o=this&&this.__extends\|\|(n=function(t,e){return n=Object.setPrototypeOf\|\|{__proto__:[]}instanceof Array&&function(t,e){t.__proto__=e}\|\|function(t,e){for(var r in e)Object.prototype.hasOwnProperty.call(e,r)&&(t[r]=e[r])},n(t,e)},function(t,e){if("function"!=typeof e&&null!==e)throw new TypeError("Class extends value "+String(e)+" is not a constructor or null");function r(){this.constructor=t}n(t,e),t.prototype=null===e?Object.create(e):(r.prototype=e.prototype,new r)}),i=this&&this.__assign\|\|function(){return i=Object.assign\|\|function(t){for(var e,r=1,n=arguments.length;r<n;r++)for(var o in e=arguments[r])Object.prototype.hasOwnProperty.call(e,o)&&(t[o]=e[o]);return t},i.apply(this,arguments)},s=this&&this.__read\|\|function(t,e){var r="function"==typeof Symbol&&t[Symbol.iterator];if(!r)return t;var n,o,i=r.call(t),s=[];try{for(;(void 0===e\|\|e-- >0)&&!(n=i.next()).done;)s.push(n.value)}catch(t){o={error:t}}finally

Chrome Cache Entry: 82

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	4.241202481433726
Encrypted:	false
SSDEEP:	3:YozDD/RNgQJzRWWlKFiFD3e4xCzY:YovtNgmzR/wYFDxkY
MD5:	9E576E34B18E986347909C29AE6A82C6
SHA1:	532C767978DC2B55854B3CA2D2DF5B4DB221C934
SHA-256:	88BDF5AF090328963973990DE427779F9C4DF3B8E1F5BADC3D972BAC3087006D
SHA-512:	5EF6DCFFD93434D45760888BF4B95FF134D53F34DA9DC904AD3C5EBEDC58409073483F531FEA4233869ED3EC75F38B022A70B2E179A5D3A13BDB10AB5C46B124
Malicious:	false
Preview:	{"Message":"The requested resource does not support http method 'GET'."}

Chrome Cache Entry: 83

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 533 x 478, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	13339
Entropy (8bit):	7.683569563478597
Encrypted:	false
SSDEEP:	192:zjSKAj04ndWb6OuzZjk6TsEaJS0/bJur2Gz4Imm3MhE4NfM:zutfW69XTspsG3G0TfhEQM
MD5:	512625CF8F40021445D74253DC7C28C0
SHA1:	F6B27CE0F7D4E48E34FDDCA8A96337F07CFFE730
SHA-256:	1D4DCEE8511D5371FEC911660D6049782E12901C662B409A5C675772E9B87369
SHA-512:	AE02319D03884D758A86C286B6F593BDFFD067885D56D82EEB8215FDCB41637C7BB9109039E7FBC93AD246D030C368FB285B3161976ED485ABC5A8DF6DF9A38C
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/install/media/application-not-started/repair-tool-changes-complete.png
Preview:	.PNG........IHDR.............,#......sRGB.........gAMA......a.....pHYs..........o.d..3.IDATx^..].5Y...C.$..tH .NF.I&A0..;.r.fF.#..!7...'..3.0.../..s....."!.y...~....4....om.g.3.BTP......j..g.zVU....u...a.Z..j..U....y......$.....I...pAR...\.T....$.....I...pAR...\.T..p....5O>.d...}Rg.$....@.4....fb1.o.I...7..<.P.....n0.D.P.....n..L.P.....n8.......P.~......n(+..'. ......J.vM,H......W...h.T....$.....I...pAR...\.T....$.....I...pAR...\.T....$.....I...pAR...\.T....$......'....w....g....\|../5_.......T...~.y.'.'.\|...W..[...C.)......\|.[.[WK...w...w..y.{..\|.#.n>...5....5...h>..O6O>.Xx....o.B........g?.........~....?o...w.......}..-_k^........l....\|.D.TH.....o..B'..(.W-%...?...W.......E?h..........~.......?...~,..}...o^...5ox..bI.mo{[s.}.5.<.L.......<......Y.W......K..Q._...Iu...2...e)d]4.}Y..............k.%k..s.'..L(..o4...g...z............N.X.....W.O.^.4.....7......i~._7..~,bI......3.0RRq..\|.Mk..?.{.K_...t.........SYG.W^#).N^..._W...(.8.7.....W....7...m

Chrome Cache Entry: 84

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors
Category:	downloaded
Size (bytes):	17174
Entropy (8bit):	2.9129715116732746
Encrypted:	false
SSDEEP:	24:QSNTmTFxg4lyyyyyyyyyyyyyio7eeeeeeeeekzgsLsLsLsLsLsQZp:nfgyyyyyyyyyyyyynzQQQQQO
MD5:	12E3DAC858061D088023B2BD48E2FA96
SHA1:	E08CE1A144ECEAE0C3C2EA7A9D6FBC5658F24CE5
SHA-256:	90CDAF487716184E4034000935C605D1633926D348116D198F355A98B8C6CD21
SHA-512:	C5030C55A855E7A9E20E22F4C70BF1E0F3C558A9B7D501CFAB6992AC2656AE5E41B050CCAC541EFA55F9603E0D349B247EB4912EE169D44044271789C719CD01
Malicious:	false
URL:	https://learn.microsoft.com/favicon.ico
Preview:	..............h(..f...HH...........(..00......h....6.. ...........=...............@..........(....A..(....................(....................................."P.........................................."""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333""""""""""""""""""""""""""

Chrome Cache Entry: 85

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 1300 x 300, 8-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	81913
Entropy (8bit):	7.909044687847068
Encrypted:	false
SSDEEP:	1536:dKVqOVA4kDFNEgVzMoz1Olnr8AN5yl7UWBrZtLbqO0vPU9dADS/5een:au5DFj4ozot8AO9UWBDqOYPWB/5eq
MD5:	049412F03408193F0103637411B42627
SHA1:	540DA51436D5A9E305BB113FD522B91448348813
SHA-256:	BA778D4F93DBB62ED50333A967DBC34BB1FD5C9B45ED90B7366D72BD6A2955DB
SHA-512:	90F11094E997CBFA3593FE6A365B0D942EE03EAA9512AB73C0B6D7CAE409F7E0B2B15118944FB4DC113169F2BA900EBBCE9BEC8EE34C3832C5579F217B784AED
Malicious:	false
URL:	https://learn.microsoft.com/en-us/media/event-banners/banner-build-2024.png?branch=live
Preview:	.PNG........IHDR.......,......^......zTXtRaw profile type exif..x.mPA.. ...>...<..L.......;......n.T....5t..Qw.......c#X3;...=r....3..>..U...u..D$.2..<:...F.FLQ(i..[.L.....gh,.$:..._\|z...0....E.<..w..L.~.....#Ci...7..../.YMO.......iCCPICC profile..x.}.=H.@.._S."..v..:Y..q...Bi+..`r..4iHR\......U..g].\.A.....I.EJ._Rh...q?..{...f..f...j..N..\~U....B.@..L=.Y..s\|.......>...T.&.\|".....x.xf..9...YYR..... .#.e..8...xf.....b....feC%.&..F.B.e...g.Zg.{.....J..4#H`.I. BF..Ta!F.F..4..=.#.?E..\.0r,...........I7)..z_l.c......m...v...?.WZ._k....7:Z...m....M...w..']2$G....E....).....kno.}.>.Y.j..88..J.........=......r.......viTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?>.<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="XMP Core 4.4.0-Exiv2">. <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#">. <rdf:Description rdf:about="". xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/". xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/Resourc

Chrome Cache Entry: 86

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	5690
Entropy (8bit):	4.813031529066858
Encrypted:	false
SSDEEP:	96:ogtBAAQyXpcI3aDNjExAjfWQpL0dpwmWMv7BRevy8RJNjvZPyJ2tlh7RewZUZSex:ogt6cpcUaDNjESLWQN0dpwm99qllVR7W
MD5:	F42D394130C9AE372121C3758F7E266C
SHA1:	E36A7E780DF38D21BF955099234684147D88A857
SHA-256:	5D785C46FC1C27EB4A0862D554BD5CBCDA0847B9130E941FABD811F1BE3543CE
SHA-512:	9E310059A262BC2A3ED8CD8FC25AB4D16569A1C2AB38507D6CC66D9BB9FDB0258337699569058ECB0CAA6BE73F0AEA19B0F7F2E9636083AC78708029524CBDB7
Malicious:	false
Preview:	{"brandLink":{"biName":"learn","displayName":"Learn","href":"/"},"featuredContent":[{"biName":"1-featured-assessment","description":"Wherever you are in your AI journey, Microsoft Learn meets you where you are and helps you deepen your skills.","href":"/assessments/1c032171-8ca0-4032-8962-a38a5cc424a8/","supertitle":"Featured assessment","title":"It\u0027s your AI learning journey"}],"metadata":{"git_commit_id":"6e98cc35bf03910fbaf88c477e2d27b08d304968"},"navCategories":[{"biName":"1-discover","panel":{"panelContent":[{"biName":"1-documentation","componentType":"header-panel-card","description":"In-depth articles on Microsoft developer tools and technologies","href":"/docs/","title":"Documentation"},{"biName":"2-training","componentType":"header-panel-card","description":"Personalized learning paths and courses","href":"/training/","title":"Training"},{"biName":"3-credentials","componentType":"header-panel-card","description":"Globally recognized, industry-endorsed credentials","href":

Chrome Cache Entry: 87

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors
Category:	dropped
Size (bytes):	17174
Entropy (8bit):	2.9129715116732746
Encrypted:	false
SSDEEP:	24:QSNTmTFxg4lyyyyyyyyyyyyyio7eeeeeeeeekzgsLsLsLsLsLsQZp:nfgyyyyyyyyyyyyynzQQQQQO
MD5:	12E3DAC858061D088023B2BD48E2FA96
SHA1:	E08CE1A144ECEAE0C3C2EA7A9D6FBC5658F24CE5
SHA-256:	90CDAF487716184E4034000935C605D1633926D348116D198F355A98B8C6CD21
SHA-512:	C5030C55A855E7A9E20E22F4C70BF1E0F3C558A9B7D501CFAB6992AC2656AE5E41B050CCAC541EFA55F9603E0D349B247EB4912EE169D44044271789C719CD01
Malicious:	false
Preview:	..............h(..f...HH...........(..00......h....6.. ...........=...............@..........(....A..(....................(....................................."P.........................................."""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333""""""""""""""""""""""""""

Chrome Cache Entry: 88

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 658 x 480, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	13842
Entropy (8bit):	7.802399161550213
Encrypted:	false
SSDEEP:	192:NLNf+jBQsDHg7av3EEondO8PuRu2mIYXEIiDm42NpsHFMHfgnJ4K2DVwv:NLt+1jDmY+ndXwjLUpiDwpzfwoDVk
MD5:	F6EC97C43480D41695065AD55A97B382
SHA1:	D9C3D0895A5ED1A3951B8774B519B8217F0A54C5
SHA-256:	07A599FAB1E66BABC430E5FED3029F25FF3F4EA2DD0EC8968FFBA71EF1872F68
SHA-512:	22462763178409D60609761A2AF734F97B35B9A818EC1FD9046AFAB489AAD83CE34896EE8586EFE402EA7739ECF088BC2DB5C1C8E4FB39E6A0FC5B3ADC6B4A9B
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/install/media/application-not-started/install-3-5.png
Preview:	.PNG........IHDR................1....sRGB.........gAMA......a.....pHYs..........o.d..5.IDATx^..[.,.]...../<.!.B(/y..).F\r...!(.H..a ..B.~..A..KXA.M...6..8...!1....l./.X.1....2.`.y"l..R...V.....{...}._gWW.Z.VUw.N...U..P@..... ..@.A...".$..E.I.........$..("H..PD..... ..p....U.}.{.....l..A.....A........s.......D.0...@....E..x........L. /.".A.....$...Y."...%.I..["../.&.I..[`.0..IA.........p4.I.........$..("H..PD..... ..@.A...".$..E.I.........$..("H..PD..... ..@.A...".$..E.>H...O.................?.~.......].7.....a?....(H....m.G..G..a.P..?yo......f?...o. .B.....mo{[....:9<].....7.....a.....S..Cd.5,.R....#....>......._g.....Wo\|.....z.g.........w.T...]x.>.....y(.........6....[..px...U....~.~hu...}H.......~.L... ....r...iY.$..Id..Ax"../....._..U....OTo\|.Mh.km..A.k..k....n.C`\|._\=...o...a.e.. ...&.A2..k.. ....X.+...C..P....y..>.{._..(H....8(.?...w.}M.........:s_!.m.........BY..T..z.5{.W.~..6.....F....bq....m.....?.......v....o..o...ki...iX.$......\]V...V...

Chrome Cache Entry: 89

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (31341), with no line terminators
Category:	dropped
Size (bytes):	31341
Entropy (8bit):	4.892781786468702
Encrypted:	false
SSDEEP:	384:FGvJOb4OLIch+KCnMet7NPXlJl+HjZjBTRdE0zIwHdDw:whOEO8chkMet7pCjBfFw
MD5:	40998D414F58B4779CB09C4FD275B92E
SHA1:	5D91AAF653083BD6A569852C0E62341F4F313655
SHA-256:	DD7F4EDCF142A2D2A22E386A7F3A7255B018B71300B53BEFA44C157164FFE5DC
SHA-512:	5BD7B3D4A3B141C315908E9BD7219927C4BD733A3835772BDA6DB3CD78B3D99CA268BC16DBD44EF4228FAC311FE02C429C6CFFC76F576F489A3486F1DEF9B0E7
Malicious:	false
Preview:	{"items":[{"href":"./","toc_title":".NET Framework documentation"},{"href":"get-started/overview","toc_title":"Overview of .NET Framework"},{"children":[{"href":"get-started/","toc_title":"Overview"},{"href":"get-started/the-net-framework-and-out-of-band-releases","toc_title":"Out-of-band releases"},{"href":"get-started/system-requirements","toc_title":"System requirements"}],"toc_title":"Get started"},{"children":[{"href":"install/","toc_title":"Overview"},{"href":"install/guide-for-developers","toc_title":"For developers"},{"children":[{"href":"install/on-windows-11","toc_title":"Windows 11"},{"href":"install/on-server-2022","toc_title":"Windows Server 2022"},{"href":"install/on-windows-10","toc_title":"Windows 10 and Windows Server 2016"},{"href":"install/on-windows-8-1","toc_title":"Windows 8.1 and Windows Server 2012 R2"},{"href":"install/on-windows-8","toc_title":"Windows 8 and Windows Server 2012"}],"toc_title":"By OS version"},{"href":"install/repair","toc_title":"Repair .NET f

Chrome Cache Entry: 90

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	5690
Entropy (8bit):	4.813031529066858
Encrypted:	false
SSDEEP:	96:ogtBAAQyXpcI3aDNjExAjfWQpL0dpwmWMv7BRevy8RJNjvZPyJ2tlh7RewZUZSex:ogt6cpcUaDNjESLWQN0dpwm99qllVR7W
MD5:	F42D394130C9AE372121C3758F7E266C
SHA1:	E36A7E780DF38D21BF955099234684147D88A857
SHA-256:	5D785C46FC1C27EB4A0862D554BD5CBCDA0847B9130E941FABD811F1BE3543CE
SHA-512:	9E310059A262BC2A3ED8CD8FC25AB4D16569A1C2AB38507D6CC66D9BB9FDB0258337699569058ECB0CAA6BE73F0AEA19B0F7F2E9636083AC78708029524CBDB7
Malicious:	false
URL:	https://learn.microsoft.com/en-us/content-nav/site-header/site-header.json?
Preview:	{"brandLink":{"biName":"learn","displayName":"Learn","href":"/"},"featuredContent":[{"biName":"1-featured-assessment","description":"Wherever you are in your AI journey, Microsoft Learn meets you where you are and helps you deepen your skills.","href":"/assessments/1c032171-8ca0-4032-8962-a38a5cc424a8/","supertitle":"Featured assessment","title":"It\u0027s your AI learning journey"}],"metadata":{"git_commit_id":"6e98cc35bf03910fbaf88c477e2d27b08d304968"},"navCategories":[{"biName":"1-discover","panel":{"panelContent":[{"biName":"1-documentation","componentType":"header-panel-card","description":"In-depth articles on Microsoft developer tools and technologies","href":"/docs/","title":"Documentation"},{"biName":"2-training","componentType":"header-panel-card","description":"Personalized learning paths and courses","href":"/training/","title":"Training"},{"biName":"3-credentials","componentType":"header-panel-card","description":"Globally recognized, industry-endorsed credentials","href":

Chrome Cache Entry: 91

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 475 x 212, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	35005
Entropy (8bit):	7.980061050467981
Encrypted:	false
SSDEEP:	768:aHBEr/QXnbCgWotMq4AZZivq2/Qu0cEv1FjHBep6U0Z/68R:ahWqbTWiM7ACvdIdldhep4rR
MD5:	522037F008E03C9448AE0AAAF09E93CB
SHA1:	8A32997EAB79246BEED5A37DB0C92FBFB006BEF2
SHA-256:	983C35607C4FB0B529CA732BE42115D3FCAAC947CEE9C9632F7CACDBDECAF5A7
SHA-512:	643EC613B2E7BDBB2F61E1799C189B0E3392EA5AE10845EB0B1F1542A03569E886F4B54D5B38AF10E78DB49C71357108C94589474B181F6A4573B86CF2D6F0D8
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/install/media/application-not-started/app-could-not-be-started.png
Preview:	.PNG........IHDR..............[.U....sRGB.........gAMA......a.....pHYs..........+.....RIDATx^..`........B hpwww(PJ....R.B.....K[j....@ H ..r:...].P._.`...K.ffg.v.ygf.TM.4.m...`.D".H$......"##..2e.X.t..Y".H$...d..PK.V".H$..uVm.,.H$.....b+.H$.I-#.V".H$.ZF..D".H$...[.D".Hj.)...D"..2Rl%..D".e..J$..DR.H..H$.....b+.H$..9..Neee.X,.B.\/.....o.b+.H$..9...q...EHU....p.....=z....b.7.q..........N.. ....cUAX.9...m'_...2.`.g{...4.H.9.p.4...K ^.....`.\|.n..]..m..`W..W.H.~..\|.^.a..K.6......_....K..w....9......^.....&...R....[...w..Ix=.:..^/..Epp0.5.....QRR...l....S.b.5.c.6...5..8.\....z...I......&.>....../.{.=...]'c......[.E`@Cg......Z.....c.f..,.y\|,.{.o@.j..2..:.&l4.{.]Ll.N.0..b:b...g.n.........I...Ewc....[..,i`v......F...il\|.c,{.-.....%BP.U........y.x....6..E2..n.W...J .*..`..r....F....#BCC......\|.L&........O...'........\.....;...q.n$...7...ga..x....)..A...0.{1..'1../...+yRC...W.-..b..c0dDG...U[po....2eG.G.../.@........h.:.k?.......Q...

Chrome Cache Entry: 92

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	439003
Entropy (8bit):	5.080184119276113
Encrypted:	false
SSDEEP:	6144:seRpljKCeWeLfn7AEYh6BFPDxZYX04GK7Mb:VKCeWkn7T
MD5:	28B3D9EF4FB3FE3AA48C704124C2BCD5
SHA1:	F1148DB35D3165F3D6C50545408E5C79EFFB56AE
SHA-256:	E84AB90255653A651CCCC086CDDB6307AF2655D86DA25575440EEF70987EEE17
SHA-512:	9B5468AA20E0863E0B9746B8DECF534F318F2C2A89884A838CF9580EF71C17F769CDB295AF08617ED48AC674D797D7D9F5BF597EDE2F55904A4CA0F48692D353
Malicious:	false
URL:	https://learn.microsoft.com/_themes/docs.theme/master/en-us/_themes/styles/281396a.site-ltr.css
Preview:	.CodeMirror{color:#000;direction:ltr;height:300px;font-family:monospace}.CodeMirror-lines{padding:4px 0}.CodeMirror pre.CodeMirror-line,.CodeMirror pre.CodeMirror-line-like{padding:0 4px}.CodeMirror-scrollbar-filler,.CodeMirror-gutter-filler{background-color:#fff}.CodeMirror-gutters{white-space:nowrap;background-color:#f7f7f7;border-right:1px solid #ddd}.CodeMirror-linenumber{text-align:right;color:#999;white-space:nowrap;min-width:20px;padding:0 3px 0 5px}.CodeMirror-guttermarker{color:#000}.CodeMirror-guttermarker-subtle{color:#999}.CodeMirror-cursor{border-left:1px solid #000;border-right:none;width:0}.CodeMirror div.CodeMirror-secondarycursor{border-left:1px solid silver}.cm-fat-cursor .CodeMirror-cursor{background:#7e7;width:auto;border:0!important}.cm-fat-cursor div.CodeMirror-cursors{z-index:1}.cm-fat-cursor .CodeMirror-line::selection{background:0 0}.cm-fat-cursor .CodeMirror-line>span::selection{background:0 0}.cm-fat-cursor .CodeMirror-line>span>span::selection{background:0 0

Chrome Cache Entry: 93

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (516), with CRLF, LF line terminators
Category:	downloaded
Size (bytes):	50915
Entropy (8bit):	5.037838727544772
Encrypted:	false
SSDEEP:	768:qYSzuF/zjif/8/60dCkNmPFw1Yn4/1VgMNF5F3/3eYxvlU/B:qpY/fif/U60dCksPFwO4/4yzRvhxNUJ
MD5:	57C4BF4CBA569B59AE4F8B2E2AFF92E6
SHA1:	44D04AEE0C53992C7856A17B374625C965E507CA
SHA-256:	1BF81EC2DD111875C29E560EF08830E5F3B0C3484930CBBDCA9A5E8643883294
SHA-512:	ABB085DBA753128E4AB47C88C15B9A39EC5F9B294549C740916D4FF0523103AB851290791A01B2EE7FE2643F120C98A278E5571C4EB8CB79BBE89C251CC25780
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=WAXD480.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Preview:	<!DOCTYPE html>................................................................................................................<html...class="hasSidebar hasPageActions hasBreadcrumb conceptual has-default-focus theme-light"...lang="en-us"...dir="ltr"...data-authenticated="false"...data-auth-status-determined="false"...data-target="docs"...x-ms-format-detection="none">....<head>...<meta charset="utf-8" />...<meta name="viewport" content="width=device-width, initial-scale=1.0" />...<meta property="og:title" content="Fix .NET Framework 'This application could not be started' - .NET Framework" />...<meta property="og:type" content="website" />...<meta property="og:url" content="https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started" />.....<meta property="og:description" content="Learn what to do if you see a 'This application could not be started' dialog box when running a .NET Framework application." />.....<meta property="og:image" content="https://learn.micr

Chrome Cache Entry: 94

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (46321), with CRLF line terminators
Category:	downloaded
Size (bytes):	1717140
Entropy (8bit):	5.521638736495704
Encrypted:	false
SSDEEP:	24576:ZhEEFQ8jRVpSB1DkCXW/ojYtP68bSpYddJkThNX:ZLFQ89VpSB1DkCXW/ojmP6EgYT0hNX
MD5:	FD94A091A5D455AC0D3BB4354D4A3BAC
SHA1:	77AC0A4BE61BBE4188592A9D1682F3F89D2D1B99
SHA-256:	81A560F924B0816E2C10E09BB2302E42E866E5B50F31DD6BFD7546D9348DF757
SHA-512:	0F589FBF9BCD1C7DF277ED64AD9DBF97503A61A6D723543A8BBB5A09F48181D10877BB7A941BCF24D10283CCCAF5304A7296E0B9022E12170B2E28BA7CA011B0
Malicious:	false
URL:	https://learn.microsoft.com/_themes/docs.theme/master/en-us/_themes/scripts/90b02f2b.index-docs.js
Preview:	"use strict";(()=>{var kpe=Object.create;var Yy=Object.defineProperty;var EF=Object.getOwnPropertyDescriptor;var Ape=Object.getOwnPropertyNames;var Ipe=Object.getPrototypeOf,Ppe=Object.prototype.hasOwnProperty;var Lpe=(t,e,o)=>e in t?Yy(t,e,{enumerable:!0,configurable:!0,writable:!0,value:o}):t[e]=o;var Ie=(t,e)=>()=>(e\|\|t((e={exports:{}}).exports,e),e.exports);var Rpe=(t,e,o,n)=>{if(e&&typeof e=="object"\|\|typeof e=="function")for(let r of Ape(e))!Ppe.call(t,r)&&r!==o&&Yy(t,r,{get:()=>e[r],enumerable:!(n=EF(e,r))\|\|n.enumerable});return t};var hd=(t,e,o)=>(o=t!=null?kpe(Ipe(t)):{},Rpe(e\|\|!t\|\|!t.__esModule?Yy(o,"default",{value:t,enumerable:!0}):o,t));var U=(t,e,o,n)=>{for(var r=n>1?void 0:n?EF(e,o):e,s=t.length-1,i;s>=0;s--)(i=t[s])&&(r=(n?i(e,o,r):i(r))\|\|r);return n&&r&&Yy(e,o,r),r};var Sl=(t,e,o)=>(Lpe(t,typeof e!="symbol"?e+"":e,o),o);var u$=Ie((l$,c$)=>{(function(t,e){typeof l$=="object"&&typeof c$<"u"?c$.exports=e():typeof define=="function"&&define.amd?define(e):t.Bottleneck=e()})

Chrome Cache Entry: 95

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	4945
Entropy (8bit):	4.796097221456048
Encrypted:	false
SSDEEP:	96:A0AIvEQ+KfZcbhaW9dptAdSlkepQnymoLByzVqrpCvJ4QG62HxpJjJ+do88HxbqK:dgQ+KfZcbhaWjptAdSlkepQnNgByz8FB
MD5:	EF6E83E1C6E863A122281F71DD8020B4
SHA1:	CEA054B197D99548088012C2E011F3BA5DB8CE60
SHA-256:	B22DAC9B489D9184B1FFE6A4981CAE6C350557D2E7B3378FED8B2A20D41DEB70
SHA-512:	8C69422E55648BC875937D5A51B6D9E76A3019A8147E44D7BA29811772950A06A7A86EDB73319C91D27EB9E561565298977E295E5486770B76007DF108EE4D27
Malicious:	false
URL:	https://learn.microsoft.com/en-us/content-nav/MSDocsHeader-DotNet.json?
Preview:	{"callToAction":{"primary":{"biName":"download-dotnet","href":"https://dotnet.microsoft.com/download","kind":"link","title":"Download .NET"}},"category":{"biName":"dotnet","href":"/dotnet/","kind":"link","title":".NET"},"items":[{"biName":"1-languages","items":[{"biName":"1-c-sharp","href":"/dotnet/csharp/","kind":"link","title":"C#"},{"biName":"2-f-sharp","href":"/dotnet/fsharp/","kind":"link","title":"F#"},{"biName":"3-visual-basic","href":"/dotnet/visual-basic/","kind":"link","title":"Visual Basic"}],"kind":"menu","title":"Languages"},{"biName":"2-features","items":[{"biName":"1-fundamental","href":"/dotnet/fundamentals/","kind":"link","title":"Fundamentals"},{"biName":"2-tools-and-diagnostics","href":"/dotnet/navigate/tools-diagnostics/","kind":"link","title":"Tools and diagnostics"},{"biName":"3-migrate-from-dotnet-framework","href":"/dotnet/navigate/migration-guide/","kind":"link","title":"Migrate from .NET Framework"},{"biName":"4-compatibility","href":"/dotnet/core/compatibilit

Chrome Cache Entry: 96

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	4.241202481433726
Encrypted:	false
SSDEEP:	3:YozDD/RNgQJzRWWlKFiFD3e4xCzY:YovtNgmzR/wYFDxkY
MD5:	9E576E34B18E986347909C29AE6A82C6
SHA1:	532C767978DC2B55854B3CA2D2DF5B4DB221C934
SHA-256:	88BDF5AF090328963973990DE427779F9C4DF3B8E1F5BADC3D972BAC3087006D
SHA-512:	5EF6DCFFD93434D45760888BF4B95FF134D53F34DA9DC904AD3C5EBEDC58409073483F531FEA4233869ED3EC75F38B022A70B2E179A5D3A13BDB10AB5C46B124
Malicious:	false
Preview:	{"Message":"The requested resource does not support http method 'GET'."}

Chrome Cache Entry: 97

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 18320, version 1.0
Category:	downloaded
Size (bytes):	18320
Entropy (8bit):	7.987743324424954
Encrypted:	false
SSDEEP:	384:M/4x9swMer+iBfrWC0iXUr4YESDWwoqh/bNirBh40LqGncCoLm6ECD:M/4x9aLiBjP0Mq4YESDWwo4q4nGncFiE
MD5:	9D54AEA8133FC8CC3DCAE9ECAFF9EF95
SHA1:	E9EB3E8F79B2AE8F096A2079F9FA5CDE72878B13
SHA-256:	43D0F83450A823F30B31DDAA4BF709EFBD6091AC7F0669ADA5533D989CB0CF01
SHA-512:	2166D2D341F2A7F9B9B47F9977B00B0CC7AE933140CFCAD11A081E5E67A469D81B0AE7FEB727E8D91A48B1631C5934EAEBDA9A8CAA0CFFD524DC9CC73824BA4A
Malicious:	false
URL:	https://learn.microsoft.com/_themes/docs.theme/master/en-us/_themes/styles/docons.c4a596dd.woff2
Preview:	wOF2......G...........G>.........................T.V..f...L..x.6.$..X..n.. ..y..?..wu...8.0_.(....rJX....$'c.0a.eY..EgKt.}.H.!..3q%.~...8..F.ib:D..D..)............J.....z..L}.`..)..l5x..t M.\KBf.....P...\|../.J.I...?....fN..6...1......(...w.?D.y...y ..0...v.....QQ.@@E.".q...............l.U.]N.gq..Z...3......Nd....:.@...zi.&......R......,...s..W....l...h....mAI.......4.....aa.yP.a(.f..r}..w`.S.V.y......U.D...0..3.u...2.F.f.n!..A8.....k.e.V.}....\|./@.P..J..........[..=}..*f..$...7._..g.r..N..V\|s.4..`x.....\|.......<.i...a.....y.A.....\|.@.........aCJ.V......\| h...Y...0..".......(.)...%...H..l......H.X?..5......f5...l...6e.c.S..j.+.....<...X-...tL4x.=...S/...w........v.!..".4.o...dN..v...)>P.A..\|..mI.h.(.......Vr...s...........@.......\|8d..s6...T!...7.K...&......~$S@....T3P...\.j.I.:..6....C_..$.....}.....@....&&..)I.b.....E\..Q..M..Fw.>..{N\|.}..^.......5/.^F..}EyU........10f\|.y3........{......wG....{.....O>.>.}....S..{.....7../././.I4.'.r!.L.o...&7MNB..r

Chrome Cache Entry: 98

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1154
Entropy (8bit):	4.59126408969148
Encrypted:	false
SSDEEP:	24:txFRuJpzYeGK+VS6ckNL2091JP/UcHc8oQJ1sUWMLc/jH6GbKqjHJIOHA:JsfcU6ckNL2091Z/U/YsUDM+GhS
MD5:	37258A983459AE1C2E4F1E551665F388
SHA1:	603A4E9115E613CC827206CF792C62AEB606C941
SHA-256:	8E34F3807B4BF495D8954E7229681DA8D0DD101DD6DDC2AD7F90CD2983802B44
SHA-512:	184CB63EF510143B0AF013F506411C917D68BB63F2CFA47EA2A42688FD4F55F3B820AF94F87083C24F48AACEE6A692199E185FC5C5CFBED5D70790454EED7F5C
Malicious:	false
URL:	https://learn.microsoft.com/en-us/media/logos/logo_net.svg
Preview:	<svg width="456" height="456" viewBox="0 0 456 456" fill="none" xmlns="http://www.w3.org/2000/svg">..<rect width="456" height="456" fill="#512BD4"/>..<path d="M81.2738 291.333C78.0496 291.333 75.309 290.259 73.052 288.11C70.795 285.906 69.6665 283.289 69.6665 280.259C69.6665 277.173 70.795 274.529 73.052 272.325C75.309 270.121 78.0496 269.019 81.2738 269.019C84.5518 269.019 87.3193 270.121 89.5763 272.325C91.887 274.529 93.0424 277.173 93.0424 280.259C93.0424 283.289 91.887 285.906 89.5763 288.11C87.3193 290.259 84.5518 291.333 81.2738 291.333Z" fill="white"/>..<path d="M210.167 289.515H189.209L133.994 202.406C132.597 200.202 131.441 197.915 130.528 195.546H130.044C130.474 198.081 130.689 203.508 130.689 211.827V289.515H112.149V171H134.477L187.839 256.043C190.096 259.57 191.547 261.994 192.192 263.316H192.514C191.977 260.176 191.708 254.859 191.708 247.365V171H210.167V289.515Z" fill="white"/>..<path d="M300.449 289.515H235.561V171H297.87V187.695H254.746V221.249H294.485V237.861H254.746V

Chrome Cache Entry: 99

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (31341), with no line terminators
Category:	downloaded
Size (bytes):	31341
Entropy (8bit):	4.892781786468702
Encrypted:	false
SSDEEP:	384:FGvJOb4OLIch+KCnMet7NPXlJl+HjZjBTRdE0zIwHdDw:whOEO8chkMet7pCjBfFw
MD5:	40998D414F58B4779CB09C4FD275B92E
SHA1:	5D91AAF653083BD6A569852C0E62341F4F313655
SHA-256:	DD7F4EDCF142A2D2A22E386A7F3A7255B018B71300B53BEFA44C157164FFE5DC
SHA-512:	5BD7B3D4A3B141C315908E9BD7219927C4BD733A3835772BDA6DB3CD78B3D99CA268BC16DBD44EF4228FAC311FE02C429C6CFFC76F576F489A3486F1DEF9B0E7
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/toc.json
Preview:	{"items":[{"href":"./","toc_title":".NET Framework documentation"},{"href":"get-started/overview","toc_title":"Overview of .NET Framework"},{"children":[{"href":"get-started/","toc_title":"Overview"},{"href":"get-started/the-net-framework-and-out-of-band-releases","toc_title":"Out-of-band releases"},{"href":"get-started/system-requirements","toc_title":"System requirements"}],"toc_title":"Get started"},{"children":[{"href":"install/","toc_title":"Overview"},{"href":"install/guide-for-developers","toc_title":"For developers"},{"children":[{"href":"install/on-windows-11","toc_title":"Windows 11"},{"href":"install/on-server-2022","toc_title":"Windows Server 2022"},{"href":"install/on-windows-10","toc_title":"Windows 10 and Windows Server 2016"},{"href":"install/on-windows-8-1","toc_title":"Windows 8.1 and Windows Server 2012 R2"},{"href":"install/on-windows-8","toc_title":"Windows 8 and Windows Server 2012"}],"toc_title":"By OS version"},{"href":"install/repair","toc_title":"Repair .NET f

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	5.270991297712282
TrID:	Win32 Executable (generic) a (10002005/4) 99.94% Win16/32 Executable Delphi generic (2074/23) 0.02% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	WAXD480.exe
File size:	14'544'896 bytes
MD5:	7f1ffc9be9757477a8a39cb06d5032c8
SHA1:	31a174cb6a0d6b4f59529235d8efdb5bf5cca94a
SHA256:	f9a43eaa4e4ba619d3470762e5cd4226ad707f59bd89d892584df2771089ef3d
SHA512:	ba89acb7641f74328f51d6f64d70474b9949d16743f42528aa4e16cb0765c3d0a5ebdd409a4380c2ebf3275d06c9009626136e7c6e472f047e2e82a3a208f458
SSDEEP:	98304:MFo1GWb7bTtHxHV7G67rTPhFGIfxSj7SwMmRe1:MFS79Hpd7rTZFtfxSjIB
TLSH:	3CE63990BB10E522E19C97340CCBCFA96634F8951E43C62BB7F86B3F6D762943C62945
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....X}...............0..............;... ...@....@.. ....................................`................................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x403b9a
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0xFF7D5888 [Sat Oct 31 03:59:04 2105 UTC]
TLS Callbacks:
CLR (.Net) Version:	@
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:

Authenticode Signature

Signature Valid:
Signature Issuer:
Signature Validation Error:
Error Number:
Not Before, Not After
Subject Chain
Version:
Thumbprint MD5:
Thumbprint SHA-1:
Thumbprint SHA-256:
Serial:

Entrypoint Preview

Instruction
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x3b45	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x4000	0x69c	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x2800	0x25d0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x6000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x3a4c	0x54	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x1ba0	0x1c00	e5c55f0b8236d25407478e99de9111d6	False	0.06305803571428571	data	0.5448303170034065	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x4000	0x69c	0x800	e4d020c5a1901337fcc99c4758527ff4	False	0.12353515625	data	0.7882981859081486	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x6000	0xc	0x200	bf619eac0cdf3f68d496ea9344137e8b	False	0.02734375	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 24, 2024 09:04:26.090698004 CEST	49675	443	192.168.2.4	173.222.162.32
Apr 24, 2024 09:04:35.700129986 CEST	49675	443	192.168.2.4	173.222.162.32
Apr 24, 2024 09:04:41.771202087 CEST	49745	443	192.168.2.4	13.107.213.69
Apr 24, 2024 09:04:41.771301985 CEST	443	49745	13.107.213.69	192.168.2.4
Apr 24, 2024 09:04:41.771384954 CEST	49745	443	192.168.2.4	13.107.213.69
Apr 24, 2024 09:04:41.771668911 CEST	49746	443	192.168.2.4	13.107.213.69
Apr 24, 2024 09:04:41.771745920 CEST	443	49746	13.107.213.69	192.168.2.4
Apr 24, 2024 09:04:41.771815062 CEST	49746	443	192.168.2.4	13.107.213.69
Apr 24, 2024 09:04:41.771939039 CEST	49745	443	192.168.2.4	13.107.213.69
Apr 24, 2024 09:04:41.771961927 CEST	443	49745	13.107.213.69	192.168.2.4
Apr 24, 2024 09:04:41.772139072 CEST	49746	443	192.168.2.4	13.107.213.69
Apr 24, 2024 09:04:41.772166014 CEST	443	49746	13.107.213.69	192.168.2.4
Apr 24, 2024 09:04:42.265799046 CEST	443	49745	13.107.213.69	192.168.2.4
Apr 24, 2024 09:04:42.267734051 CEST	49745	443	192.168.2.4	13.107.213.69
Apr 24, 2024 09:04:42.267756939 CEST	443	49745	13.107.213.69	192.168.2.4
Apr 24, 2024 09:04:42.269412994 CEST	443	49745	13.107.213.69	192.168.2.4
Apr 24, 2024 09:04:42.269473076 CEST	49745	443	192.168.2.4	13.107.213.69
Apr 24, 2024 09:04:42.270767927 CEST	49745	443	192.168.2.4	13.107.213.69
Apr 24, 2024 09:04:42.270855904 CEST	443	49745	13.107.213.69	192.168.2.4
Apr 24, 2024 09:04:42.271006107 CEST	49745	443	192.168.2.4	13.107.213.69
Apr 24, 2024 09:04:42.271013021 CEST	443	49745	13.107.213.69	192.168.2.4
Apr 24, 2024 09:04:42.272770882 CEST	443	49746	13.107.213.69	192.168.2.4
Apr 24, 2024 09:04:42.273140907 CEST	49746	443	192.168.2.4	13.107.213.69
Apr 24, 2024 09:04:42.273186922 CEST	443	49746	13.107.213.69	192.168.2.4
Apr 24, 2024 09:04:42.274832964 CEST	443	49746	13.107.213.69	192.168.2.4
Apr 24, 2024 09:04:42.274915934 CEST	49746	443	192.168.2.4	13.107.213.69
Apr 24, 2024 09:04:42.275726080 CEST	49746	443	192.168.2.4	13.107.213.69
Apr 24, 2024 09:04:42.275818110 CEST	443	49746	13.107.213.69	192.168.2.4
Apr 24, 2024 09:04:42.275872946 CEST	49746	443	192.168.2.4	13.107.213.69
Apr 24, 2024 09:04:42.311079025 CEST	49745	443	192.168.2.4	13.107.213.69
Apr 24, 2024 09:04:42.320111990 CEST	443	49746	13.107.213.69	192.168.2.4
Apr 24, 2024 09:04:42.326159000 CEST	49746	443	192.168.2.4	13.107.213.69
Apr 24, 2024 09:04:42.326190948 CEST	443	49746	13.107.213.69	192.168.2.4
Apr 24, 2024 09:04:42.372776985 CEST	49746	443	192.168.2.4	13.107.213.69
Apr 24, 2024 09:04:42.747626066 CEST	443	49746	13.107.213.69	192.168.2.4
Apr 24, 2024 09:04:42.747693062 CEST	443	49746	13.107.213.69	192.168.2.4
Apr 24, 2024 09:04:42.747720957 CEST	443	49746	13.107.213.69	192.168.2.4
Apr 24, 2024 09:04:42.747745991 CEST	443	49746	13.107.213.69	192.168.2.4
Apr 24, 2024 09:04:42.747764111 CEST	49746	443	192.168.2.4	13.107.213.69
Apr 24, 2024 09:04:42.747766972 CEST	443	49746	13.107.213.69	192.168.2.4
Apr 24, 2024 09:04:42.747786045 CEST	443	49746	13.107.213.69	192.168.2.4
Apr 24, 2024 09:04:42.747792006 CEST	49746	443	192.168.2.4	13.107.213.69
Apr 24, 2024 09:04:42.747811079 CEST	49746	443	192.168.2.4	13.107.213.69
Apr 24, 2024 09:04:42.747816086 CEST	443	49746	13.107.213.69	192.168.2.4
Apr 24, 2024 09:04:42.747827053 CEST	49746	443	192.168.2.4	13.107.213.69
Apr 24, 2024 09:04:42.747886896 CEST	49746	443	192.168.2.4	13.107.213.69
Apr 24, 2024 09:04:42.748397112 CEST	443	49745	13.107.213.69	192.168.2.4
Apr 24, 2024 09:04:42.748445034 CEST	443	49745	13.107.213.69	192.168.2.4
Apr 24, 2024 09:04:42.748456001 CEST	443	49745	13.107.213.69	192.168.2.4
Apr 24, 2024 09:04:42.748486996 CEST	443	49745	13.107.213.69	192.168.2.4
Apr 24, 2024 09:04:42.748501062 CEST	49745	443	192.168.2.4	13.107.213.69
Apr 24, 2024 09:04:42.748521090 CEST	443	49745	13.107.213.69	192.168.2.4
Apr 24, 2024 09:04:42.748529911 CEST	49745	443	192.168.2.4	13.107.213.69
Apr 24, 2024 09:04:42.748547077 CEST	443	49745	13.107.213.69	192.168.2.4
Apr 24, 2024 09:04:42.748557091 CEST	49745	443	192.168.2.4	13.107.213.69
Apr 24, 2024 09:04:42.748583078 CEST	49745	443	192.168.2.4	13.107.213.69
Apr 24, 2024 09:04:42.748914003 CEST	443	49745	13.107.213.69	192.168.2.4
Apr 24, 2024 09:04:42.748949051 CEST	443	49745	13.107.213.69	192.168.2.4
Apr 24, 2024 09:04:42.748975992 CEST	49745	443	192.168.2.4	13.107.213.69
Apr 24, 2024 09:04:42.748985052 CEST	443	49745	13.107.213.69	192.168.2.4
Apr 24, 2024 09:04:42.749001026 CEST	49745	443	192.168.2.4	13.107.213.69
Apr 24, 2024 09:04:42.749022961 CEST	49745	443	192.168.2.4	13.107.213.69
Apr 24, 2024 09:04:42.749053955 CEST	443	49745	13.107.213.69	192.168.2.4
Apr 24, 2024 09:04:42.749293089 CEST	443	49746	13.107.213.69	192.168.2.4
Apr 24, 2024 09:04:42.749337912 CEST	443	49746	13.107.213.69	192.168.2.4
Apr 24, 2024 09:04:42.749375105 CEST	49746	443	192.168.2.4	13.107.213.69
Apr 24, 2024 09:04:42.749396086 CEST	443	49746	13.107.213.69	192.168.2.4
Apr 24, 2024 09:04:42.749432087 CEST	49746	443	192.168.2.4	13.107.213.69
Apr 24, 2024 09:04:42.749521971 CEST	49746	443	192.168.2.4	13.107.213.69
Apr 24, 2024 09:04:42.795392990 CEST	49745	443	192.168.2.4	13.107.213.69
Apr 24, 2024 09:04:42.908035040 CEST	443	49746	13.107.213.69	192.168.2.4
Apr 24, 2024 09:04:42.908090115 CEST	443	49746	13.107.213.69	192.168.2.4
Apr 24, 2024 09:04:42.908157110 CEST	49746	443	192.168.2.4	13.107.213.69
Apr 24, 2024 09:04:42.908183098 CEST	443	49746	13.107.213.69	192.168.2.4
Apr 24, 2024 09:04:42.908210039 CEST	49746	443	192.168.2.4	13.107.213.69
Apr 24, 2024 09:04:42.908229113 CEST	49746	443	192.168.2.4	13.107.213.69
Apr 24, 2024 09:04:42.909113884 CEST	443	49746	13.107.213.69	192.168.2.4
Apr 24, 2024 09:04:42.909157991 CEST	443	49746	13.107.213.69	192.168.2.4
Apr 24, 2024 09:04:42.909202099 CEST	49746	443	192.168.2.4	13.107.213.69
Apr 24, 2024 09:04:42.909215927 CEST	443	49746	13.107.213.69	192.168.2.4
Apr 24, 2024 09:04:42.909243107 CEST	49746	443	192.168.2.4	13.107.213.69
Apr 24, 2024 09:04:42.909303904 CEST	49746	443	192.168.2.4	13.107.213.69
Apr 24, 2024 09:04:42.910480022 CEST	443	49745	13.107.213.69	192.168.2.4
Apr 24, 2024 09:04:42.910497904 CEST	443	49745	13.107.213.69	192.168.2.4
Apr 24, 2024 09:04:42.910542965 CEST	49745	443	192.168.2.4	13.107.213.69
Apr 24, 2024 09:04:42.910559893 CEST	443	49745	13.107.213.69	192.168.2.4
Apr 24, 2024 09:04:42.910620928 CEST	49745	443	192.168.2.4	13.107.213.69
Apr 24, 2024 09:04:42.910686970 CEST	443	49745	13.107.213.69	192.168.2.4
Apr 24, 2024 09:04:42.910729885 CEST	49745	443	192.168.2.4	13.107.213.69
Apr 24, 2024 09:04:42.910734892 CEST	443	49745	13.107.213.69	192.168.2.4
Apr 24, 2024 09:04:42.910772085 CEST	49745	443	192.168.2.4	13.107.213.69
Apr 24, 2024 09:04:42.910916090 CEST	443	49745	13.107.213.69	192.168.2.4
Apr 24, 2024 09:04:42.910958052 CEST	49745	443	192.168.2.4	13.107.213.69
Apr 24, 2024 09:04:42.911046028 CEST	443	49746	13.107.213.69	192.168.2.4
Apr 24, 2024 09:04:42.911083937 CEST	443	49746	13.107.213.69	192.168.2.4
Apr 24, 2024 09:04:42.911111116 CEST	49746	443	192.168.2.4	13.107.213.69
Apr 24, 2024 09:04:42.911124945 CEST	443	49746	13.107.213.69	192.168.2.4
Apr 24, 2024 09:04:42.911151886 CEST	49746	443	192.168.2.4	13.107.213.69
Apr 24, 2024 09:04:42.911176920 CEST	49746	443	192.168.2.4	13.107.213.69
Apr 24, 2024 09:04:42.913985968 CEST	49745	443	192.168.2.4	13.107.213.69
Apr 24, 2024 09:04:42.914005041 CEST	443	49745	13.107.213.69	192.168.2.4
Apr 24, 2024 09:04:43.068847895 CEST	443	49746	13.107.213.69	192.168.2.4
Apr 24, 2024 09:04:43.068900108 CEST	443	49746	13.107.213.69	192.168.2.4
Apr 24, 2024 09:04:43.068923950 CEST	49746	443	192.168.2.4	13.107.213.69
Apr 24, 2024 09:04:43.068963051 CEST	443	49746	13.107.213.69	192.168.2.4
Apr 24, 2024 09:04:43.068990946 CEST	49746	443	192.168.2.4	13.107.213.69
Apr 24, 2024 09:04:43.069014072 CEST	49746	443	192.168.2.4	13.107.213.69
Apr 24, 2024 09:04:43.069320917 CEST	443	49746	13.107.213.69	192.168.2.4
Apr 24, 2024 09:04:43.069365025 CEST	443	49746	13.107.213.69	192.168.2.4
Apr 24, 2024 09:04:43.069397926 CEST	49746	443	192.168.2.4	13.107.213.69
Apr 24, 2024 09:04:43.069412947 CEST	443	49746	13.107.213.69	192.168.2.4
Apr 24, 2024 09:04:43.069439888 CEST	49746	443	192.168.2.4	13.107.213.69
Apr 24, 2024 09:04:43.069458961 CEST	49746	443	192.168.2.4	13.107.213.69
Apr 24, 2024 09:04:43.070152044 CEST	443	49746	13.107.213.69	192.168.2.4
Apr 24, 2024 09:04:43.070198059 CEST	443	49746	13.107.213.69	192.168.2.4
Apr 24, 2024 09:04:43.070223093 CEST	49746	443	192.168.2.4	13.107.213.69
Apr 24, 2024 09:04:43.070235014 CEST	443	49746	13.107.213.69	192.168.2.4
Apr 24, 2024 09:04:43.070265055 CEST	49746	443	192.168.2.4	13.107.213.69
Apr 24, 2024 09:04:43.070283890 CEST	49746	443	192.168.2.4	13.107.213.69
Apr 24, 2024 09:04:43.070858955 CEST	443	49746	13.107.213.69	192.168.2.4
Apr 24, 2024 09:04:43.070904016 CEST	443	49746	13.107.213.69	192.168.2.4
Apr 24, 2024 09:04:43.070925951 CEST	49746	443	192.168.2.4	13.107.213.69
Apr 24, 2024 09:04:43.070939064 CEST	443	49746	13.107.213.69	192.168.2.4
Apr 24, 2024 09:04:43.070976973 CEST	49746	443	192.168.2.4	13.107.213.69
Apr 24, 2024 09:04:43.070977926 CEST	49746	443	192.168.2.4	13.107.213.69
Apr 24, 2024 09:04:43.071779013 CEST	443	49746	13.107.213.69	192.168.2.4
Apr 24, 2024 09:04:43.071822882 CEST	443	49746	13.107.213.69	192.168.2.4
Apr 24, 2024 09:04:43.071862936 CEST	49746	443	192.168.2.4	13.107.213.69
Apr 24, 2024 09:04:43.071875095 CEST	443	49746	13.107.213.69	192.168.2.4
Apr 24, 2024 09:04:43.071901083 CEST	49746	443	192.168.2.4	13.107.213.69
Apr 24, 2024 09:04:43.071921110 CEST	49746	443	192.168.2.4	13.107.213.69
Apr 24, 2024 09:04:43.072467089 CEST	443	49746	13.107.213.69	192.168.2.4
Apr 24, 2024 09:04:43.072508097 CEST	443	49746	13.107.213.69	192.168.2.4
Apr 24, 2024 09:04:43.072531939 CEST	49746	443	192.168.2.4	13.107.213.69
Apr 24, 2024 09:04:43.072544098 CEST	443	49746	13.107.213.69	192.168.2.4
Apr 24, 2024 09:04:43.072590113 CEST	49746	443	192.168.2.4	13.107.213.69
Apr 24, 2024 09:04:43.072591066 CEST	49746	443	192.168.2.4	13.107.213.69
Apr 24, 2024 09:04:43.072643042 CEST	443	49746	13.107.213.69	192.168.2.4
Apr 24, 2024 09:04:43.072710991 CEST	49746	443	192.168.2.4	13.107.213.69
Apr 24, 2024 09:04:43.072724104 CEST	443	49746	13.107.213.69	192.168.2.4
Apr 24, 2024 09:04:43.072778940 CEST	49746	443	192.168.2.4	13.107.213.69
Apr 24, 2024 09:04:43.072832108 CEST	443	49746	13.107.213.69	192.168.2.4
Apr 24, 2024 09:04:43.072889090 CEST	49746	443	192.168.2.4	13.107.213.69
Apr 24, 2024 09:04:43.073035955 CEST	49746	443	192.168.2.4	13.107.213.69
Apr 24, 2024 09:04:43.073061943 CEST	443	49746	13.107.213.69	192.168.2.4
Apr 24, 2024 09:04:43.511037111 CEST	49751	443	192.168.2.4	142.250.101.104
Apr 24, 2024 09:04:43.511074066 CEST	443	49751	142.250.101.104	192.168.2.4
Apr 24, 2024 09:04:43.511132002 CEST	49751	443	192.168.2.4	142.250.101.104
Apr 24, 2024 09:04:43.511516094 CEST	49751	443	192.168.2.4	142.250.101.104
Apr 24, 2024 09:04:43.511532068 CEST	443	49751	142.250.101.104	192.168.2.4
Apr 24, 2024 09:04:43.864156008 CEST	49754	443	192.168.2.4	52.40.13.65
Apr 24, 2024 09:04:43.864224911 CEST	443	49754	52.40.13.65	192.168.2.4
Apr 24, 2024 09:04:43.864290953 CEST	49754	443	192.168.2.4	52.40.13.65
Apr 24, 2024 09:04:43.865446091 CEST	49754	443	192.168.2.4	52.40.13.65
Apr 24, 2024 09:04:43.865479946 CEST	443	49754	52.40.13.65	192.168.2.4
Apr 24, 2024 09:04:43.881369114 CEST	443	49751	142.250.101.104	192.168.2.4
Apr 24, 2024 09:04:43.881581068 CEST	49751	443	192.168.2.4	142.250.101.104
Apr 24, 2024 09:04:43.881608963 CEST	443	49751	142.250.101.104	192.168.2.4
Apr 24, 2024 09:04:43.883029938 CEST	443	49751	142.250.101.104	192.168.2.4
Apr 24, 2024 09:04:43.883091927 CEST	49751	443	192.168.2.4	142.250.101.104
Apr 24, 2024 09:04:43.887443066 CEST	49751	443	192.168.2.4	142.250.101.104
Apr 24, 2024 09:04:43.887697935 CEST	443	49751	142.250.101.104	192.168.2.4
Apr 24, 2024 09:04:43.927910089 CEST	49751	443	192.168.2.4	142.250.101.104
Apr 24, 2024 09:04:43.927920103 CEST	443	49751	142.250.101.104	192.168.2.4
Apr 24, 2024 09:04:43.969239950 CEST	49755	443	192.168.2.4	23.202.57.177
Apr 24, 2024 09:04:43.969278097 CEST	443	49755	23.202.57.177	192.168.2.4
Apr 24, 2024 09:04:43.969360113 CEST	49755	443	192.168.2.4	23.202.57.177
Apr 24, 2024 09:04:43.981189966 CEST	49755	443	192.168.2.4	23.202.57.177
Apr 24, 2024 09:04:43.981199980 CEST	443	49755	23.202.57.177	192.168.2.4
Apr 24, 2024 09:04:43.982642889 CEST	49751	443	192.168.2.4	142.250.101.104
Apr 24, 2024 09:04:44.260865927 CEST	443	49754	52.40.13.65	192.168.2.4
Apr 24, 2024 09:04:44.261087894 CEST	49754	443	192.168.2.4	52.40.13.65
Apr 24, 2024 09:04:44.261121035 CEST	443	49754	52.40.13.65	192.168.2.4
Apr 24, 2024 09:04:44.262765884 CEST	443	49754	52.40.13.65	192.168.2.4
Apr 24, 2024 09:04:44.262835026 CEST	49754	443	192.168.2.4	52.40.13.65
Apr 24, 2024 09:04:44.264240980 CEST	49754	443	192.168.2.4	52.40.13.65
Apr 24, 2024 09:04:44.264336109 CEST	443	49754	52.40.13.65	192.168.2.4
Apr 24, 2024 09:04:44.308619976 CEST	49754	443	192.168.2.4	52.40.13.65
Apr 24, 2024 09:04:44.308634043 CEST	443	49754	52.40.13.65	192.168.2.4
Apr 24, 2024 09:04:44.326910019 CEST	443	49755	23.202.57.177	192.168.2.4
Apr 24, 2024 09:04:44.327023983 CEST	49755	443	192.168.2.4	23.202.57.177
Apr 24, 2024 09:04:44.332159042 CEST	49755	443	192.168.2.4	23.202.57.177
Apr 24, 2024 09:04:44.332168102 CEST	443	49755	23.202.57.177	192.168.2.4
Apr 24, 2024 09:04:44.332418919 CEST	443	49755	23.202.57.177	192.168.2.4
Apr 24, 2024 09:04:44.356939077 CEST	49754	443	192.168.2.4	52.40.13.65
Apr 24, 2024 09:04:44.373018026 CEST	49755	443	192.168.2.4	23.202.57.177
Apr 24, 2024 09:04:44.379208088 CEST	49755	443	192.168.2.4	23.202.57.177
Apr 24, 2024 09:04:44.420144081 CEST	443	49755	23.202.57.177	192.168.2.4
Apr 24, 2024 09:04:44.656816006 CEST	443	49755	23.202.57.177	192.168.2.4
Apr 24, 2024 09:04:44.657011032 CEST	49755	443	192.168.2.4	23.202.57.177
Apr 24, 2024 09:04:44.657011032 CEST	49755	443	192.168.2.4	23.202.57.177
Apr 24, 2024 09:04:44.657030106 CEST	443	49755	23.202.57.177	192.168.2.4
Apr 24, 2024 09:04:44.657073021 CEST	443	49755	23.202.57.177	192.168.2.4
Apr 24, 2024 09:04:44.708498001 CEST	49760	443	192.168.2.4	23.202.57.177
Apr 24, 2024 09:04:44.708528042 CEST	443	49760	23.202.57.177	192.168.2.4
Apr 24, 2024 09:04:44.708669901 CEST	49760	443	192.168.2.4	23.202.57.177
Apr 24, 2024 09:04:44.708966017 CEST	49760	443	192.168.2.4	23.202.57.177
Apr 24, 2024 09:04:44.708983898 CEST	443	49760	23.202.57.177	192.168.2.4
Apr 24, 2024 09:04:45.057142019 CEST	443	49760	23.202.57.177	192.168.2.4
Apr 24, 2024 09:04:45.057226896 CEST	49760	443	192.168.2.4	23.202.57.177
Apr 24, 2024 09:04:45.059734106 CEST	49760	443	192.168.2.4	23.202.57.177
Apr 24, 2024 09:04:45.059746027 CEST	443	49760	23.202.57.177	192.168.2.4
Apr 24, 2024 09:04:45.060295105 CEST	443	49760	23.202.57.177	192.168.2.4
Apr 24, 2024 09:04:45.061383009 CEST	49760	443	192.168.2.4	23.202.57.177
Apr 24, 2024 09:04:45.104123116 CEST	443	49760	23.202.57.177	192.168.2.4
Apr 24, 2024 09:04:45.390634060 CEST	443	49760	23.202.57.177	192.168.2.4
Apr 24, 2024 09:04:45.390834093 CEST	443	49760	23.202.57.177	192.168.2.4
Apr 24, 2024 09:04:45.390892029 CEST	49760	443	192.168.2.4	23.202.57.177
Apr 24, 2024 09:04:45.391983986 CEST	49760	443	192.168.2.4	23.202.57.177
Apr 24, 2024 09:04:45.392000914 CEST	443	49760	23.202.57.177	192.168.2.4
Apr 24, 2024 09:04:45.392018080 CEST	49760	443	192.168.2.4	23.202.57.177
Apr 24, 2024 09:04:45.392024994 CEST	443	49760	23.202.57.177	192.168.2.4
Apr 24, 2024 09:04:48.078130960 CEST	49785	443	192.168.2.4	63.140.37.206
Apr 24, 2024 09:04:48.078197956 CEST	443	49785	63.140.37.206	192.168.2.4
Apr 24, 2024 09:04:48.078286886 CEST	49785	443	192.168.2.4	63.140.37.206
Apr 24, 2024 09:04:48.079320908 CEST	49785	443	192.168.2.4	63.140.37.206
Apr 24, 2024 09:04:48.079355001 CEST	443	49785	63.140.37.206	192.168.2.4
Apr 24, 2024 09:04:48.474364996 CEST	443	49785	63.140.37.206	192.168.2.4
Apr 24, 2024 09:04:48.525868893 CEST	49785	443	192.168.2.4	63.140.37.206
Apr 24, 2024 09:04:49.554522038 CEST	49785	443	192.168.2.4	63.140.37.206
Apr 24, 2024 09:04:49.554563046 CEST	443	49785	63.140.37.206	192.168.2.4
Apr 24, 2024 09:04:49.558490038 CEST	443	49785	63.140.37.206	192.168.2.4
Apr 24, 2024 09:04:49.558526993 CEST	443	49785	63.140.37.206	192.168.2.4
Apr 24, 2024 09:04:49.558557034 CEST	49785	443	192.168.2.4	63.140.37.206
Apr 24, 2024 09:04:49.561497927 CEST	49785	443	192.168.2.4	63.140.37.206
Apr 24, 2024 09:04:49.561686993 CEST	443	49785	63.140.37.206	192.168.2.4
Apr 24, 2024 09:04:49.561855078 CEST	49785	443	192.168.2.4	63.140.37.206
Apr 24, 2024 09:04:49.561865091 CEST	443	49785	63.140.37.206	192.168.2.4
Apr 24, 2024 09:04:49.561885118 CEST	49785	443	192.168.2.4	63.140.37.206
Apr 24, 2024 09:04:49.608117104 CEST	443	49785	63.140.37.206	192.168.2.4
Apr 24, 2024 09:04:49.610876083 CEST	49785	443	192.168.2.4	63.140.37.206
Apr 24, 2024 09:04:50.046526909 CEST	443	49785	63.140.37.206	192.168.2.4
Apr 24, 2024 09:04:50.046581030 CEST	443	49785	63.140.37.206	192.168.2.4
Apr 24, 2024 09:04:50.046641111 CEST	49785	443	192.168.2.4	63.140.37.206
Apr 24, 2024 09:04:50.046664000 CEST	443	49785	63.140.37.206	192.168.2.4
Apr 24, 2024 09:04:50.046829939 CEST	443	49785	63.140.37.206	192.168.2.4
Apr 24, 2024 09:04:50.046886921 CEST	49785	443	192.168.2.4	63.140.37.206
Apr 24, 2024 09:04:50.048239946 CEST	49785	443	192.168.2.4	63.140.37.206
Apr 24, 2024 09:04:50.048255920 CEST	443	49785	63.140.37.206	192.168.2.4
Apr 24, 2024 09:04:50.383212090 CEST	49791	443	192.168.2.4	63.140.36.51
Apr 24, 2024 09:04:50.383272886 CEST	443	49791	63.140.36.51	192.168.2.4
Apr 24, 2024 09:04:50.383333921 CEST	49791	443	192.168.2.4	63.140.36.51
Apr 24, 2024 09:04:50.383538008 CEST	49791	443	192.168.2.4	63.140.36.51
Apr 24, 2024 09:04:50.383550882 CEST	443	49791	63.140.36.51	192.168.2.4
Apr 24, 2024 09:04:50.386367083 CEST	49792	443	192.168.2.4	52.165.165.26
Apr 24, 2024 09:04:50.386390924 CEST	443	49792	52.165.165.26	192.168.2.4
Apr 24, 2024 09:04:50.386451960 CEST	49792	443	192.168.2.4	52.165.165.26
Apr 24, 2024 09:04:50.387835026 CEST	49792	443	192.168.2.4	52.165.165.26
Apr 24, 2024 09:04:50.387846947 CEST	443	49792	52.165.165.26	192.168.2.4
Apr 24, 2024 09:04:50.616507053 CEST	49672	443	192.168.2.4	173.222.162.32
Apr 24, 2024 09:04:50.616570950 CEST	443	49672	173.222.162.32	192.168.2.4
Apr 24, 2024 09:04:50.767847061 CEST	443	49791	63.140.36.51	192.168.2.4
Apr 24, 2024 09:04:50.808501005 CEST	49791	443	192.168.2.4	63.140.36.51
Apr 24, 2024 09:04:50.840842962 CEST	49791	443	192.168.2.4	63.140.36.51
Apr 24, 2024 09:04:50.840857983 CEST	443	49791	63.140.36.51	192.168.2.4
Apr 24, 2024 09:04:50.844639063 CEST	443	49791	63.140.36.51	192.168.2.4
Apr 24, 2024 09:04:50.844870090 CEST	49791	443	192.168.2.4	63.140.36.51
Apr 24, 2024 09:04:50.846947908 CEST	49791	443	192.168.2.4	63.140.36.51
Apr 24, 2024 09:04:50.847141027 CEST	443	49791	63.140.36.51	192.168.2.4
Apr 24, 2024 09:04:50.848083973 CEST	49791	443	192.168.2.4	63.140.36.51
Apr 24, 2024 09:04:50.848108053 CEST	443	49791	63.140.36.51	192.168.2.4
Apr 24, 2024 09:04:50.892234087 CEST	49791	443	192.168.2.4	63.140.36.51
Apr 24, 2024 09:04:51.004211903 CEST	443	49792	52.165.165.26	192.168.2.4
Apr 24, 2024 09:04:51.004470110 CEST	49792	443	192.168.2.4	52.165.165.26
Apr 24, 2024 09:04:51.009004116 CEST	49792	443	192.168.2.4	52.165.165.26
Apr 24, 2024 09:04:51.009010077 CEST	443	49792	52.165.165.26	192.168.2.4
Apr 24, 2024 09:04:51.009406090 CEST	443	49792	52.165.165.26	192.168.2.4
Apr 24, 2024 09:04:51.059786081 CEST	49792	443	192.168.2.4	52.165.165.26
Apr 24, 2024 09:04:51.189498901 CEST	443	49791	63.140.36.51	192.168.2.4
Apr 24, 2024 09:04:51.189604044 CEST	443	49791	63.140.36.51	192.168.2.4
Apr 24, 2024 09:04:51.189879894 CEST	49791	443	192.168.2.4	63.140.36.51
Apr 24, 2024 09:04:51.241605043 CEST	49791	443	192.168.2.4	63.140.36.51
Apr 24, 2024 09:04:51.241627932 CEST	443	49791	63.140.36.51	192.168.2.4
Apr 24, 2024 09:04:51.387177944 CEST	49799	443	192.168.2.4	63.140.37.206
Apr 24, 2024 09:04:51.387214899 CEST	443	49799	63.140.37.206	192.168.2.4
Apr 24, 2024 09:04:51.388202906 CEST	49799	443	192.168.2.4	63.140.37.206
Apr 24, 2024 09:04:51.391412020 CEST	49799	443	192.168.2.4	63.140.37.206
Apr 24, 2024 09:04:51.391429901 CEST	443	49799	63.140.37.206	192.168.2.4
Apr 24, 2024 09:04:51.775892973 CEST	443	49799	63.140.37.206	192.168.2.4
Apr 24, 2024 09:04:51.778724909 CEST	49799	443	192.168.2.4	63.140.37.206
Apr 24, 2024 09:04:51.778804064 CEST	443	49799	63.140.37.206	192.168.2.4
Apr 24, 2024 09:04:51.779870033 CEST	443	49799	63.140.37.206	192.168.2.4
Apr 24, 2024 09:04:51.780503988 CEST	49799	443	192.168.2.4	63.140.37.206
Apr 24, 2024 09:04:51.780503988 CEST	49799	443	192.168.2.4	63.140.37.206
Apr 24, 2024 09:04:51.780548096 CEST	443	49799	63.140.37.206	192.168.2.4
Apr 24, 2024 09:04:51.780689955 CEST	443	49799	63.140.37.206	192.168.2.4
Apr 24, 2024 09:04:51.780800104 CEST	49799	443	192.168.2.4	63.140.37.206
Apr 24, 2024 09:04:51.824129105 CEST	443	49799	63.140.37.206	192.168.2.4
Apr 24, 2024 09:04:51.891472101 CEST	49792	443	192.168.2.4	52.165.165.26
Apr 24, 2024 09:04:51.936116934 CEST	443	49792	52.165.165.26	192.168.2.4
Apr 24, 2024 09:04:52.170950890 CEST	443	49799	63.140.37.206	192.168.2.4
Apr 24, 2024 09:04:52.171080112 CEST	443	49799	63.140.37.206	192.168.2.4
Apr 24, 2024 09:04:52.171140909 CEST	49799	443	192.168.2.4	63.140.37.206
Apr 24, 2024 09:04:52.171175957 CEST	443	49799	63.140.37.206	192.168.2.4
Apr 24, 2024 09:04:52.171318054 CEST	443	49799	63.140.37.206	192.168.2.4
Apr 24, 2024 09:04:52.171365023 CEST	49799	443	192.168.2.4	63.140.37.206
Apr 24, 2024 09:04:52.171592951 CEST	49799	443	192.168.2.4	63.140.37.206
Apr 24, 2024 09:04:52.171611071 CEST	443	49799	63.140.37.206	192.168.2.4
Apr 24, 2024 09:04:52.177077055 CEST	49810	443	192.168.2.4	63.140.36.51
Apr 24, 2024 09:04:52.177107096 CEST	443	49810	63.140.36.51	192.168.2.4
Apr 24, 2024 09:04:52.177175999 CEST	49810	443	192.168.2.4	63.140.36.51
Apr 24, 2024 09:04:52.177510023 CEST	49810	443	192.168.2.4	63.140.36.51
Apr 24, 2024 09:04:52.177526951 CEST	443	49810	63.140.36.51	192.168.2.4
Apr 24, 2024 09:04:52.291857004 CEST	443	49792	52.165.165.26	192.168.2.4
Apr 24, 2024 09:04:52.291887999 CEST	443	49792	52.165.165.26	192.168.2.4
Apr 24, 2024 09:04:52.291898012 CEST	443	49792	52.165.165.26	192.168.2.4
Apr 24, 2024 09:04:52.291918993 CEST	443	49792	52.165.165.26	192.168.2.4
Apr 24, 2024 09:04:52.291970015 CEST	49792	443	192.168.2.4	52.165.165.26
Apr 24, 2024 09:04:52.291985989 CEST	443	49792	52.165.165.26	192.168.2.4
Apr 24, 2024 09:04:52.291996956 CEST	443	49792	52.165.165.26	192.168.2.4
Apr 24, 2024 09:04:52.292005062 CEST	49792	443	192.168.2.4	52.165.165.26
Apr 24, 2024 09:04:52.292026043 CEST	49792	443	192.168.2.4	52.165.165.26
Apr 24, 2024 09:04:52.292042971 CEST	49792	443	192.168.2.4	52.165.165.26
Apr 24, 2024 09:04:52.292181015 CEST	443	49792	52.165.165.26	192.168.2.4
Apr 24, 2024 09:04:52.292239904 CEST	49792	443	192.168.2.4	52.165.165.26
Apr 24, 2024 09:04:52.292244911 CEST	443	49792	52.165.165.26	192.168.2.4
Apr 24, 2024 09:04:52.292258978 CEST	443	49792	52.165.165.26	192.168.2.4
Apr 24, 2024 09:04:52.292320013 CEST	49792	443	192.168.2.4	52.165.165.26
Apr 24, 2024 09:04:52.305335045 CEST	49792	443	192.168.2.4	52.165.165.26
Apr 24, 2024 09:04:52.305342913 CEST	443	49792	52.165.165.26	192.168.2.4
Apr 24, 2024 09:04:52.403177023 CEST	49723	80	192.168.2.4	23.1.234.57
Apr 24, 2024 09:04:52.562153101 CEST	443	49810	63.140.36.51	192.168.2.4
Apr 24, 2024 09:04:52.562427044 CEST	49810	443	192.168.2.4	63.140.36.51
Apr 24, 2024 09:04:52.562469959 CEST	443	49810	63.140.36.51	192.168.2.4
Apr 24, 2024 09:04:52.562812090 CEST	80	49723	23.1.234.57	192.168.2.4
Apr 24, 2024 09:04:52.562930107 CEST	49723	80	192.168.2.4	23.1.234.57
Apr 24, 2024 09:04:52.563585997 CEST	443	49810	63.140.36.51	192.168.2.4
Apr 24, 2024 09:04:52.563937902 CEST	49810	443	192.168.2.4	63.140.36.51
Apr 24, 2024 09:04:52.564059973 CEST	49810	443	192.168.2.4	63.140.36.51
Apr 24, 2024 09:04:52.564073086 CEST	443	49810	63.140.36.51	192.168.2.4
Apr 24, 2024 09:04:52.564156055 CEST	443	49810	63.140.36.51	192.168.2.4
Apr 24, 2024 09:04:52.620650053 CEST	49810	443	192.168.2.4	63.140.36.51
Apr 24, 2024 09:04:52.981816053 CEST	443	49810	63.140.36.51	192.168.2.4
Apr 24, 2024 09:04:52.982290030 CEST	443	49810	63.140.36.51	192.168.2.4
Apr 24, 2024 09:04:52.982342958 CEST	49810	443	192.168.2.4	63.140.36.51
Apr 24, 2024 09:04:52.982501984 CEST	49810	443	192.168.2.4	63.140.36.51
Apr 24, 2024 09:04:52.982513905 CEST	443	49810	63.140.36.51	192.168.2.4
Apr 24, 2024 09:04:53.911569118 CEST	443	49751	142.250.101.104	192.168.2.4
Apr 24, 2024 09:04:53.911703110 CEST	443	49751	142.250.101.104	192.168.2.4
Apr 24, 2024 09:04:53.911796093 CEST	49751	443	192.168.2.4	142.250.101.104
Apr 24, 2024 09:04:54.023684025 CEST	49751	443	192.168.2.4	142.250.101.104
Apr 24, 2024 09:04:54.023710012 CEST	443	49751	142.250.101.104	192.168.2.4
Apr 24, 2024 09:05:28.753988981 CEST	49835	443	192.168.2.4	52.165.165.26
Apr 24, 2024 09:05:28.754014015 CEST	443	49835	52.165.165.26	192.168.2.4
Apr 24, 2024 09:05:28.754084110 CEST	49835	443	192.168.2.4	52.165.165.26
Apr 24, 2024 09:05:28.754421949 CEST	49835	443	192.168.2.4	52.165.165.26
Apr 24, 2024 09:05:28.754429102 CEST	443	49835	52.165.165.26	192.168.2.4
Apr 24, 2024 09:05:29.308624983 CEST	49754	443	192.168.2.4	52.40.13.65
Apr 24, 2024 09:05:29.308686018 CEST	443	49754	52.40.13.65	192.168.2.4
Apr 24, 2024 09:05:29.368612051 CEST	443	49835	52.165.165.26	192.168.2.4
Apr 24, 2024 09:05:29.368693113 CEST	49835	443	192.168.2.4	52.165.165.26
Apr 24, 2024 09:05:29.373519897 CEST	49835	443	192.168.2.4	52.165.165.26
Apr 24, 2024 09:05:29.373528957 CEST	443	49835	52.165.165.26	192.168.2.4
Apr 24, 2024 09:05:29.373807907 CEST	443	49835	52.165.165.26	192.168.2.4
Apr 24, 2024 09:05:29.383322001 CEST	49835	443	192.168.2.4	52.165.165.26
Apr 24, 2024 09:05:29.428112984 CEST	443	49835	52.165.165.26	192.168.2.4
Apr 24, 2024 09:05:29.964929104 CEST	443	49835	52.165.165.26	192.168.2.4
Apr 24, 2024 09:05:29.964955091 CEST	443	49835	52.165.165.26	192.168.2.4
Apr 24, 2024 09:05:29.964970112 CEST	443	49835	52.165.165.26	192.168.2.4
Apr 24, 2024 09:05:29.965008020 CEST	49835	443	192.168.2.4	52.165.165.26
Apr 24, 2024 09:05:29.965023994 CEST	443	49835	52.165.165.26	192.168.2.4
Apr 24, 2024 09:05:29.965034962 CEST	49835	443	192.168.2.4	52.165.165.26
Apr 24, 2024 09:05:29.965066910 CEST	49835	443	192.168.2.4	52.165.165.26
Apr 24, 2024 09:05:29.965260983 CEST	443	49835	52.165.165.26	192.168.2.4
Apr 24, 2024 09:05:29.965303898 CEST	443	49835	52.165.165.26	192.168.2.4
Apr 24, 2024 09:05:29.965320110 CEST	49835	443	192.168.2.4	52.165.165.26
Apr 24, 2024 09:05:29.965325117 CEST	443	49835	52.165.165.26	192.168.2.4
Apr 24, 2024 09:05:29.965353966 CEST	443	49835	52.165.165.26	192.168.2.4
Apr 24, 2024 09:05:29.965383053 CEST	49835	443	192.168.2.4	52.165.165.26
Apr 24, 2024 09:05:29.965393066 CEST	49835	443	192.168.2.4	52.165.165.26
Apr 24, 2024 09:05:29.984925032 CEST	49835	443	192.168.2.4	52.165.165.26
Apr 24, 2024 09:05:29.984970093 CEST	443	49835	52.165.165.26	192.168.2.4
Apr 24, 2024 09:05:29.984998941 CEST	49835	443	192.168.2.4	52.165.165.26
Apr 24, 2024 09:05:29.985014915 CEST	443	49835	52.165.165.26	192.168.2.4
Apr 24, 2024 09:05:41.715306997 CEST	49724	80	192.168.2.4	23.1.234.57
Apr 24, 2024 09:05:41.875263929 CEST	80	49724	23.1.234.57	192.168.2.4
Apr 24, 2024 09:05:41.875361919 CEST	49724	80	192.168.2.4	23.1.234.57
Apr 24, 2024 09:05:43.419708967 CEST	49837	443	192.168.2.4	142.250.101.104
Apr 24, 2024 09:05:43.419759989 CEST	443	49837	142.250.101.104	192.168.2.4
Apr 24, 2024 09:05:43.419822931 CEST	49837	443	192.168.2.4	142.250.101.104
Apr 24, 2024 09:05:43.420061111 CEST	49837	443	192.168.2.4	142.250.101.104
Apr 24, 2024 09:05:43.420073986 CEST	443	49837	142.250.101.104	192.168.2.4
Apr 24, 2024 09:05:43.778330088 CEST	443	49837	142.250.101.104	192.168.2.4
Apr 24, 2024 09:05:43.778642893 CEST	49837	443	192.168.2.4	142.250.101.104
Apr 24, 2024 09:05:43.778656960 CEST	443	49837	142.250.101.104	192.168.2.4
Apr 24, 2024 09:05:43.778989077 CEST	443	49837	142.250.101.104	192.168.2.4
Apr 24, 2024 09:05:43.779386997 CEST	49837	443	192.168.2.4	142.250.101.104
Apr 24, 2024 09:05:43.779433966 CEST	443	49837	142.250.101.104	192.168.2.4
Apr 24, 2024 09:05:43.823788881 CEST	49837	443	192.168.2.4	142.250.101.104
Apr 24, 2024 09:05:44.241413116 CEST	443	49754	52.40.13.65	192.168.2.4
Apr 24, 2024 09:05:44.241590023 CEST	443	49754	52.40.13.65	192.168.2.4
Apr 24, 2024 09:05:44.241791964 CEST	49754	443	192.168.2.4	52.40.13.65
Apr 24, 2024 09:05:45.451601028 CEST	49754	443	192.168.2.4	52.40.13.65
Apr 24, 2024 09:05:45.451673985 CEST	443	49754	52.40.13.65	192.168.2.4
Apr 24, 2024 09:05:53.774929047 CEST	443	49837	142.250.101.104	192.168.2.4
Apr 24, 2024 09:05:53.775116920 CEST	443	49837	142.250.101.104	192.168.2.4
Apr 24, 2024 09:05:53.775171041 CEST	49837	443	192.168.2.4	142.250.101.104
Apr 24, 2024 09:05:55.450926065 CEST	49837	443	192.168.2.4	142.250.101.104
Apr 24, 2024 09:05:55.450967073 CEST	443	49837	142.250.101.104	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 24, 2024 09:04:39.078391075 CEST	53	56338	1.1.1.1	192.168.2.4
Apr 24, 2024 09:04:39.165126085 CEST	53	59211	1.1.1.1	192.168.2.4
Apr 24, 2024 09:04:40.169493914 CEST	53	64583	1.1.1.1	192.168.2.4
Apr 24, 2024 09:04:41.617356062 CEST	65204	53	192.168.2.4	1.1.1.1
Apr 24, 2024 09:04:41.617542028 CEST	51835	53	192.168.2.4	1.1.1.1
Apr 24, 2024 09:04:43.356378078 CEST	50287	53	192.168.2.4	1.1.1.1
Apr 24, 2024 09:04:43.356700897 CEST	61582	53	192.168.2.4	1.1.1.1
Apr 24, 2024 09:04:43.510019064 CEST	53	50287	1.1.1.1	192.168.2.4
Apr 24, 2024 09:04:43.510114908 CEST	53	61582	1.1.1.1	192.168.2.4
Apr 24, 2024 09:04:43.649720907 CEST	64465	53	192.168.2.4	1.1.1.1
Apr 24, 2024 09:04:43.649868965 CEST	65454	53	192.168.2.4	1.1.1.1
Apr 24, 2024 09:04:43.650827885 CEST	52938	53	192.168.2.4	1.1.1.1
Apr 24, 2024 09:04:43.650965929 CEST	53549	53	192.168.2.4	1.1.1.1
Apr 24, 2024 09:04:43.826327085 CEST	53	64465	1.1.1.1	192.168.2.4
Apr 24, 2024 09:04:43.829787970 CEST	53	52938	1.1.1.1	192.168.2.4
Apr 24, 2024 09:04:43.843866110 CEST	53	53549	1.1.1.1	192.168.2.4
Apr 24, 2024 09:04:43.884671926 CEST	53	65454	1.1.1.1	192.168.2.4
Apr 24, 2024 09:04:46.408267975 CEST	58128	53	192.168.2.4	1.1.1.1
Apr 24, 2024 09:04:46.408480883 CEST	56596	53	192.168.2.4	1.1.1.1
Apr 24, 2024 09:04:49.957792044 CEST	53	58002	1.1.1.1	192.168.2.4
Apr 24, 2024 09:04:53.318397045 CEST	138	138	192.168.2.4	192.168.2.255
Apr 24, 2024 09:04:57.323059082 CEST	53	62439	1.1.1.1	192.168.2.4
Apr 24, 2024 09:05:16.275897980 CEST	53	60156	1.1.1.1	192.168.2.4
Apr 24, 2024 09:05:38.603982925 CEST	53	61859	1.1.1.1	192.168.2.4
Apr 24, 2024 09:05:38.964452028 CEST	53	55432	1.1.1.1	192.168.2.4
Apr 24, 2024 09:05:47.134768963 CEST	57101	53	192.168.2.4	1.1.1.1
Apr 24, 2024 09:05:47.134987116 CEST	54830	53	192.168.2.4	1.1.1.1
Apr 24, 2024 09:06:07.947531939 CEST	53	50680	1.1.1.1	192.168.2.4

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Apr 24, 2024 09:04:43.884763956 CEST	192.168.2.4	1.1.1.1	c2a9	(Port unreachable)	Destination Unreachable

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Apr 24, 2024 09:04:41.617356062 CEST	192.168.2.4	1.1.1.1	0x1791	Standard query (0)	js.monitor.azure.com	A (IP address)	IN (0x0001)	false
Apr 24, 2024 09:04:41.617542028 CEST	192.168.2.4	1.1.1.1	0x8b	Standard query (0)	js.monitor.azure.com	65	IN (0x0001)	false
Apr 24, 2024 09:04:43.356378078 CEST	192.168.2.4	1.1.1.1	0x21fc	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Apr 24, 2024 09:04:43.356700897 CEST	192.168.2.4	1.1.1.1	0x374c	Standard query (0)	www.google.com	65	IN (0x0001)	false
Apr 24, 2024 09:04:43.649720907 CEST	192.168.2.4	1.1.1.1	0x588f	Standard query (0)	mscom.demdex.net	A (IP address)	IN (0x0001)	false
Apr 24, 2024 09:04:43.649868965 CEST	192.168.2.4	1.1.1.1	0x78aa	Standard query (0)	mscom.demdex.net	65	IN (0x0001)	false
Apr 24, 2024 09:04:43.650827885 CEST	192.168.2.4	1.1.1.1	0xeb78	Standard query (0)	microsoftmscompoc.tt.omtrdc.net	A (IP address)	IN (0x0001)	false
Apr 24, 2024 09:04:43.650965929 CEST	192.168.2.4	1.1.1.1	0x8c5	Standard query (0)	microsoftmscompoc.tt.omtrdc.net	65	IN (0x0001)	false
Apr 24, 2024 09:04:46.408267975 CEST	192.168.2.4	1.1.1.1	0xcd0b	Standard query (0)	mdec.nelreports.net	A (IP address)	IN (0x0001)	false
Apr 24, 2024 09:04:46.408480883 CEST	192.168.2.4	1.1.1.1	0xe538	Standard query (0)	mdec.nelreports.net	65	IN (0x0001)	false
Apr 24, 2024 09:05:47.134768963 CEST	192.168.2.4	1.1.1.1	0xeee5	Standard query (0)	mdec.nelreports.net	A (IP address)	IN (0x0001)	false
Apr 24, 2024 09:05:47.134987116 CEST	192.168.2.4	1.1.1.1	0x12dd	Standard query (0)	mdec.nelreports.net	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Apr 24, 2024 09:04:41.770220995 CEST	1.1.1.1	192.168.2.4	0xe854	No error (0)	consentdeliveryfd.azurefd.net	firstparty-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 24, 2024 09:04:41.770220995 CEST	1.1.1.1	192.168.2.4	0xe854	No error (0)	shed.dual-low.part-0041.t-0009.t-msedge.net	part-0041.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 24, 2024 09:04:41.770220995 CEST	1.1.1.1	192.168.2.4	0xe854	No error (0)	part-0041.t-0009.t-msedge.net		13.107.213.69	A (IP address)	IN (0x0001)	false
Apr 24, 2024 09:04:41.770220995 CEST	1.1.1.1	192.168.2.4	0xe854	No error (0)	part-0041.t-0009.t-msedge.net		13.107.246.69	A (IP address)	IN (0x0001)	false
Apr 24, 2024 09:04:41.770267010 CEST	1.1.1.1	192.168.2.4	0x29b6	No error (0)	consentdeliveryfd.azurefd.net	firstparty-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 24, 2024 09:04:41.770627975 CEST	1.1.1.1	192.168.2.4	0x8b	No error (0)	js.monitor.azure.com	aijscdn2.azureedge.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 24, 2024 09:04:41.770663977 CEST	1.1.1.1	192.168.2.4	0x1791	No error (0)	js.monitor.azure.com	aijscdn2.azureedge.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 24, 2024 09:04:41.770663977 CEST	1.1.1.1	192.168.2.4	0x1791	No error (0)	shed.dual-low.part-0041.t-0009.t-msedge.net	part-0041.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 24, 2024 09:04:41.770663977 CEST	1.1.1.1	192.168.2.4	0x1791	No error (0)	part-0041.t-0009.t-msedge.net		13.107.213.69	A (IP address)	IN (0x0001)	false
Apr 24, 2024 09:04:41.770663977 CEST	1.1.1.1	192.168.2.4	0x1791	No error (0)	part-0041.t-0009.t-msedge.net		13.107.246.69	A (IP address)	IN (0x0001)	false
Apr 24, 2024 09:04:43.510019064 CEST	1.1.1.1	192.168.2.4	0x21fc	No error (0)	www.google.com		142.250.101.104	A (IP address)	IN (0x0001)	false
Apr 24, 2024 09:04:43.510019064 CEST	1.1.1.1	192.168.2.4	0x21fc	No error (0)	www.google.com		142.250.101.106	A (IP address)	IN (0x0001)	false
Apr 24, 2024 09:04:43.510019064 CEST	1.1.1.1	192.168.2.4	0x21fc	No error (0)	www.google.com		142.250.101.103	A (IP address)	IN (0x0001)	false
Apr 24, 2024 09:04:43.510019064 CEST	1.1.1.1	192.168.2.4	0x21fc	No error (0)	www.google.com		142.250.101.147	A (IP address)	IN (0x0001)	false
Apr 24, 2024 09:04:43.510019064 CEST	1.1.1.1	192.168.2.4	0x21fc	No error (0)	www.google.com		142.250.101.99	A (IP address)	IN (0x0001)	false
Apr 24, 2024 09:04:43.510019064 CEST	1.1.1.1	192.168.2.4	0x21fc	No error (0)	www.google.com		142.250.101.105	A (IP address)	IN (0x0001)	false
Apr 24, 2024 09:04:43.510114908 CEST	1.1.1.1	192.168.2.4	0x374c	No error (0)	www.google.com			65	IN (0x0001)	false
Apr 24, 2024 09:04:43.826327085 CEST	1.1.1.1	192.168.2.4	0x588f	No error (0)	mscom.demdex.net	gslb-2.demdex.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 24, 2024 09:04:43.826327085 CEST	1.1.1.1	192.168.2.4	0x588f	No error (0)	gslb-2.demdex.net	edge-usw2.demdex.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 24, 2024 09:04:43.826327085 CEST	1.1.1.1	192.168.2.4	0x588f	No error (0)	edge-usw2.demdex.net	dcs-public-edge-usw2-219535174.us-west-2.elb.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 24, 2024 09:04:43.826327085 CEST	1.1.1.1	192.168.2.4	0x588f	No error (0)	dcs-public-edge-usw2-219535174.us-west-2.elb.amazonaws.com		52.40.13.65	A (IP address)	IN (0x0001)	false
Apr 24, 2024 09:04:43.826327085 CEST	1.1.1.1	192.168.2.4	0x588f	No error (0)	dcs-public-edge-usw2-219535174.us-west-2.elb.amazonaws.com		34.213.75.202	A (IP address)	IN (0x0001)	false
Apr 24, 2024 09:04:43.826327085 CEST	1.1.1.1	192.168.2.4	0x588f	No error (0)	dcs-public-edge-usw2-219535174.us-west-2.elb.amazonaws.com		52.89.237.227	A (IP address)	IN (0x0001)	false
Apr 24, 2024 09:04:43.826327085 CEST	1.1.1.1	192.168.2.4	0x588f	No error (0)	dcs-public-edge-usw2-219535174.us-west-2.elb.amazonaws.com		34.215.200.243	A (IP address)	IN (0x0001)	false
Apr 24, 2024 09:04:43.826327085 CEST	1.1.1.1	192.168.2.4	0x588f	No error (0)	dcs-public-edge-usw2-219535174.us-west-2.elb.amazonaws.com		34.215.74.30	A (IP address)	IN (0x0001)	false
Apr 24, 2024 09:04:43.826327085 CEST	1.1.1.1	192.168.2.4	0x588f	No error (0)	dcs-public-edge-usw2-219535174.us-west-2.elb.amazonaws.com		35.161.28.41	A (IP address)	IN (0x0001)	false
Apr 24, 2024 09:04:43.826327085 CEST	1.1.1.1	192.168.2.4	0x588f	No error (0)	dcs-public-edge-usw2-219535174.us-west-2.elb.amazonaws.com		100.21.16.173	A (IP address)	IN (0x0001)	false
Apr 24, 2024 09:04:43.826327085 CEST	1.1.1.1	192.168.2.4	0x588f	No error (0)	dcs-public-edge-usw2-219535174.us-west-2.elb.amazonaws.com		35.83.134.25	A (IP address)	IN (0x0001)	false
Apr 24, 2024 09:04:43.829787970 CEST	1.1.1.1	192.168.2.4	0xeb78	No error (0)	microsoftmscompoc.tt.omtrdc.net	adobetarget.data.adobedc.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 24, 2024 09:04:43.829787970 CEST	1.1.1.1	192.168.2.4	0xeb78	No error (0)	adobetarget.data.adobedc.net		63.140.36.145	A (IP address)	IN (0x0001)	false
Apr 24, 2024 09:04:43.829787970 CEST	1.1.1.1	192.168.2.4	0xeb78	No error (0)	adobetarget.data.adobedc.net		63.140.37.206	A (IP address)	IN (0x0001)	false
Apr 24, 2024 09:04:43.829787970 CEST	1.1.1.1	192.168.2.4	0xeb78	No error (0)	adobetarget.data.adobedc.net		63.140.37.126	A (IP address)	IN (0x0001)	false
Apr 24, 2024 09:04:43.829787970 CEST	1.1.1.1	192.168.2.4	0xeb78	No error (0)	adobetarget.data.adobedc.net		63.140.36.51	A (IP address)	IN (0x0001)	false
Apr 24, 2024 09:04:43.843866110 CEST	1.1.1.1	192.168.2.4	0x8c5	No error (0)	microsoftmscompoc.tt.omtrdc.net	adobetarget.data.adobedc.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 24, 2024 09:04:43.860871077 CEST	1.1.1.1	192.168.2.4	0x1bef	No error (0)	microsoftmscompoc.tt.omtrdc.net	adobetarget.data.adobedc.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 24, 2024 09:04:43.861840963 CEST	1.1.1.1	192.168.2.4	0xedc0	No error (0)	microsoftmscompoc.tt.omtrdc.net	adobetarget.data.adobedc.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 24, 2024 09:04:43.861840963 CEST	1.1.1.1	192.168.2.4	0xedc0	No error (0)	adobetarget.data.adobedc.net		63.140.37.206	A (IP address)	IN (0x0001)	false
Apr 24, 2024 09:04:43.861840963 CEST	1.1.1.1	192.168.2.4	0xedc0	No error (0)	adobetarget.data.adobedc.net		63.140.37.126	A (IP address)	IN (0x0001)	false
Apr 24, 2024 09:04:43.861840963 CEST	1.1.1.1	192.168.2.4	0xedc0	No error (0)	adobetarget.data.adobedc.net		63.140.36.51	A (IP address)	IN (0x0001)	false
Apr 24, 2024 09:04:43.861840963 CEST	1.1.1.1	192.168.2.4	0xedc0	No error (0)	adobetarget.data.adobedc.net		63.140.36.145	A (IP address)	IN (0x0001)	false
Apr 24, 2024 09:04:43.884671926 CEST	1.1.1.1	192.168.2.4	0x78aa	No error (0)	mscom.demdex.net	gslb-2.demdex.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 24, 2024 09:04:43.884671926 CEST	1.1.1.1	192.168.2.4	0x78aa	No error (0)	gslb-2.demdex.net	edge-usw2.demdex.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 24, 2024 09:04:43.884671926 CEST	1.1.1.1	192.168.2.4	0x78aa	No error (0)	edge-usw2.demdex.net	dcs-public-edge-usw2-219535174.us-west-2.elb.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 24, 2024 09:04:46.569220066 CEST	1.1.1.1	192.168.2.4	0xcd0b	No error (0)	mdec.nelreports.net	mdec.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 24, 2024 09:04:46.594676018 CEST	1.1.1.1	192.168.2.4	0xe538	No error (0)	mdec.nelreports.net	mdec.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 24, 2024 09:04:50.381925106 CEST	1.1.1.1	192.168.2.4	0xb3d5	No error (0)	microsoftmscompoc.tt.omtrdc.net	adobetarget.data.adobedc.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 24, 2024 09:04:50.381925106 CEST	1.1.1.1	192.168.2.4	0xb3d5	No error (0)	adobetarget.data.adobedc.net		63.140.36.51	A (IP address)	IN (0x0001)	false
Apr 24, 2024 09:04:50.381925106 CEST	1.1.1.1	192.168.2.4	0xb3d5	No error (0)	adobetarget.data.adobedc.net		63.140.37.126	A (IP address)	IN (0x0001)	false
Apr 24, 2024 09:04:50.381925106 CEST	1.1.1.1	192.168.2.4	0xb3d5	No error (0)	adobetarget.data.adobedc.net		63.140.36.145	A (IP address)	IN (0x0001)	false
Apr 24, 2024 09:04:50.381925106 CEST	1.1.1.1	192.168.2.4	0xb3d5	No error (0)	adobetarget.data.adobedc.net		63.140.37.206	A (IP address)	IN (0x0001)	false
Apr 24, 2024 09:04:50.382725000 CEST	1.1.1.1	192.168.2.4	0xbc37	No error (0)	microsoftmscompoc.tt.omtrdc.net	adobetarget.data.adobedc.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 24, 2024 09:04:50.796503067 CEST	1.1.1.1	192.168.2.4	0xf15a	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 24, 2024 09:04:50.812432051 CEST	1.1.1.1	192.168.2.4	0x8fa8	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 24, 2024 09:04:53.474956989 CEST	1.1.1.1	192.168.2.4	0x8cda	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 24, 2024 09:04:53.475295067 CEST	1.1.1.1	192.168.2.4	0x9cce	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 24, 2024 09:05:47.288938046 CEST	1.1.1.1	192.168.2.4	0x12dd	No error (0)	mdec.nelreports.net	mdec.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 24, 2024 09:05:47.296369076 CEST	1.1.1.1	192.168.2.4	0xeee5	No error (0)	mdec.nelreports.net	mdec.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

https:

wcpstatic.microsoft.com

js.monitor.azure.com

target.microsoft.com

fs.microsoft.com

slscr.update.microsoft.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49745	13.107.213.69	443	7576	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 07:04:42 UTC	682	OUT	GET /mscc/lib/v2/wcp-consent.js HTTP/1.1 Host: wcpstatic.microsoft.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://learn.microsoft.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: MC1=GUID=749eee6039c5489b9db3000c7ab3f399&HASH=749e&LV=202310&V=4&LU=1696413236917; MUID=375E6F2E0D8F6B9C2CEB7C8E098F6DFE
2024-04-24 07:04:42 UTC	713	IN	HTTP/1.1 200 OK Date: Wed, 24 Apr 2024 07:04:42 GMT Content-Type: application/javascript Content-Length: 52717 Connection: close Access-Control-Allow-Origin: * Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding Age: 26822 Cache-Control: max-age=43200 Content-MD5: QT/MdZzBmCG2G2lBgIsptQ== Etag: 0x8DA85F6F74C6D08 Last-Modified: Wed, 24 Aug 2022 17:34:58 GMT Vary: Accept-Encoding X-Cache: CONFIG_NOCACHE x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: 85ec1d2a-d01e-00ed-56d7-95f393000000 x-ms-version: 2009-09-19 x-azure-ref: 20240424T070442Z-168bb8d798b94t6v8q1baus7z800000000ag0000000090f8 Accept-Ranges: bytes
2024-04-24 07:04:42 UTC	15671	IN	Data Raw: 76 61 72 20 57 63 70 43 6f 6e 73 65 6e 74 3b 21 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 65 3d 7b 32 32 39 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 77 69 6e 64 6f 77 2c 65 2e 65 78 70 6f 72 74 73 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 7b 7d 3b 66 75 6e 63 74 69 6f 6e 20 6f 28 6e 29 7b 69 66 28 74 5b 6e 5d 29 72 65 74 75 72 6e 20 74 5b 6e 5d 2e 65 78 70 6f 72 74 73 3b 76 61 72 20 72 3d 74 5b 6e 5d 3d 7b 69 3a 6e 2c 6c 3a 21 31 2c 65 78 70 6f 72 74 73 3a 7b 7d 7d 3b 72 65 74 75 72 6e 20 65 5b 6e 5d 2e 63 61 6c 6c 28 72 2e 65 78 70 6f 72 74 73 2c 72 2c 72 2e 65 78 70 6f 72 74 73 2c 6f 29 2c 72 2e 6c 3d 21 30 2c 72 2e 65 78 70 6f 72 74 73 7d 72 65 74 75 72 6e 20 6f 2e 6d 3d 65 2c 6f 2e 63 3d 74 2c 6f 2e 64 3d 66 75 6e 63 74 69 6f 6e 28 65 Data Ascii: var WcpConsent;!function(){var e={229:function(e){window,e.exports=function(e){var t={};function o(n){if(t[n])return t[n].exports;var r=t[n]={i:n,l:!1,exports:{}};return e[n].call(r.exports,r,r.exports,o),r.l=!0,r.exports}return o.m=e,o.c=t,o.d=function(e
2024-04-24 07:04:42 UTC	16384	IN	Data Raw: 29 7b 72 65 74 75 72 6e 20 65 3f 65 2e 72 65 70 6c 61 63 65 28 2f 26 2f 67 2c 22 26 61 6d 70 3b 22 29 2e 72 65 70 6c 61 63 65 28 2f 3c 2f 67 2c 22 26 6c 74 3b 22 29 2e 72 65 70 6c 61 63 65 28 2f 3e 2f 67 2c 22 26 67 74 3b 22 29 2e 72 65 70 6c 61 63 65 28 2f 22 2f 67 2c 22 26 71 75 6f 74 3b 22 29 2e 72 65 70 6c 61 63 65 28 2f 27 2f 67 2c 22 26 23 30 33 39 3b 22 29 3a 22 22 7d 2c 65 7d 28 29 2c 61 3d 6e 2e 6c 6f 63 61 6c 73 2c 6c 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 65 28 65 2c 74 2c 6f 2c 6e 2c 72 2c 69 2c 61 29 7b 74 68 69 73 2e 64 69 72 65 63 74 69 6f 6e 3d 22 6c 74 72 22 2c 74 68 69 73 2e 70 72 65 76 69 6f 75 73 46 6f 63 75 73 45 6c 65 6d 65 6e 74 42 65 66 6f 72 65 50 6f 70 75 70 3d 6e 75 6c 6c 2c 74 68 69 73 2e 63 6f 6f 6b 69 Data Ascii: ){return e?e.replace(/&/g,"&").replace(/</g,"<").replace(/>/g,">").replace(/"/g,""").replace(/'/g,"'"):""},e}(),a=n.locals,l=function(){function e(e,t,o,n,r,i,a){this.direction="ltr",this.previousFocusElementBeforePopup=null,this.cooki
2024-04-24 07:04:42 UTC	713	IN	Data Raw: 6f 72 22 5d 2b 22 20 21 69 6d 70 6f 72 74 61 6e 74 3b 5c 6e 20 20 20 20 20 20 20 20 7d 22 2c 74 2b 3d 27 69 6e 70 75 74 5b 74 79 70 65 3d 22 72 61 64 69 6f 22 5d 2e 27 2b 63 2e 63 6f 6f 6b 69 65 49 74 65 6d 52 61 64 69 6f 42 74 6e 2b 22 20 2b 20 6c 61 62 65 6c 3a 68 6f 76 65 72 3a 3a 61 66 74 65 72 20 7b 5c 6e 20 20 20 20 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 22 2b 65 5b 22 72 61 64 69 6f 2d 62 75 74 74 6f 6e 2d 68 6f 76 65 72 2d 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 22 5d 2b 22 20 21 69 6d 70 6f 72 74 61 6e 74 3b 5c 6e 20 20 20 20 20 20 20 20 7d 22 2c 74 2b 3d 27 69 6e 70 75 74 5b 74 79 70 65 3d 22 72 61 64 69 6f 22 5d 2e 27 2b 63 2e 63 6f 6f 6b 69 65 49 74 65 6d 52 61 64 69 6f 42 74 6e 2b 22 20 2b 20 6c Data Ascii: or"]+" !important;\n }",t+='input[type="radio"].'+c.cookieItemRadioBtn+" + label:hover::after {\n background-color: "+e["radio-button-hover-background-color"]+" !important;\n }",t+='input[type="radio"].'+c.cookieItemRadioBtn+" + l
2024-04-24 07:04:42 UTC	16384	IN	Data Raw: 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 22 2b 65 5b 22 72 61 64 69 6f 2d 62 75 74 74 6f 6e 2d 64 69 73 61 62 6c 65 64 2d 63 6f 6c 6f 72 22 5d 2b 22 20 21 69 6d 70 6f 72 74 61 6e 74 3b 5c 6e 20 20 20 20 20 20 20 20 7d 22 7d 2c 65 7d 28 29 2c 64 3d 5b 22 61 72 22 2c 22 68 65 22 2c 22 70 73 22 2c 22 75 72 22 2c 22 66 61 22 2c 22 70 61 22 2c 22 73 64 22 2c 22 74 6b 22 2c 22 75 67 22 2c 22 79 69 22 2c 22 73 79 72 22 2c 22 6b 73 2d 61 72 61 62 22 5d 2c 75 3d 7b 22 63 6c 6f 73 65 2d 62 75 74 74 6f 6e 2d 63 6f 6c 6f 72 22 3a 22 23 36 36 36 36 36 36 22 2c 22 73 65 63 6f 6e 64 61 72 79 2d 62 75 74 74 6f 6e 2d 64 69 73 61 62 6c 65 64 2d 6f 70 61 63 69 74 79 22 3a 22 31 22 2c 22 73 65 63 6f 6e 64 61 72 79 2d 62 75 74 74 6f 6e 2d Data Ascii: background-color: "+e["radio-button-disabled-color"]+" !important;\n }"},e}(),d=["ar","he","ps","ur","fa","pa","sd","tk","ug","yi","syr","ks-arab"],u={"close-button-color":"#666666","secondary-button-disabled-opacity":"1","secondary-button-
2024-04-24 07:04:42 UTC	3565	IN	Data Raw: 2d 22 29 5b 30 5d 3b 6f 3d 65 2e 73 70 6c 69 74 28 22 2d 22 29 5b 30 5d 3d 3d 3d 6e 7d 72 65 74 75 72 6e 20 6f 7d 28 65 2c 63 29 7d 29 29 3b 73 26 26 30 3d 3d 3d 73 2e 6c 65 6e 67 74 68 26 26 28 65 3d 22 65 6e 2d 55 53 22 29 2c 6f 2e 70 6c 61 63 65 68 6f 6c 64 65 72 45 6c 65 6d 65 6e 74 3d 6c 2c 72 26 26 6f 2e 63 6f 6e 73 65 6e 74 43 68 61 6e 67 65 64 43 61 6c 6c 62 61 63 6b 73 2e 72 65 67 69 73 74 65 72 43 61 6c 6c 62 61 63 6b 28 72 29 2c 6f 2e 73 61 76 65 43 6f 6f 6b 69 65 28 29 2c 6f 2e 73 69 74 65 43 6f 6e 73 65 6e 74 3d 6e 65 77 20 66 28 21 31 29 2c 6e 75 6c 6c 3d 3d 6e 7c 7c 6e 28 76 6f 69 64 20 30 2c 6f 2e 73 69 74 65 43 6f 6e 73 65 6e 74 29 2c 6f 2e 69 73 49 6e 69 74 52 65 61 64 79 3d 21 30 2c 74 68 69 73 2e 63 6f 6e 73 65 6e 74 43 68 61 6e 67 65 Data Ascii: -")[0];o=e.split("-")[0]===n}return o}(e,c)}));s&&0===s.length&&(e="en-US"),o.placeholderElement=l,r&&o.consentChangedCallbacks.registerCallback(r),o.saveCookie(),o.siteConsent=new f(!1),null==n\|\|n(void 0,o.siteConsent),o.isInitReady=!0,this.consentChange

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49746	13.107.213.69	443	7576	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 07:04:42 UTC	549	OUT	GET /scripts/c/ms.jsll-3.min.js HTTP/1.1 Host: js.monitor.azure.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://learn.microsoft.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-24 07:04:42 UTC	960	IN	HTTP/1.1 200 OK Date: Wed, 24 Apr 2024 07:04:42 GMT Content-Type: text/javascript; charset=utf-8 Content-Length: 185160 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=1800, immutable, no-transform Last-Modified: Mon, 25 Mar 2024 17:36:27 GMT ETag: 0x8DC4CF219992427 x-ms-request-id: 801f4a01-801e-00c6-776c-91e6c3000000 x-ms-version: 2009-09-19 x-ms-meta-jssdkver: 3.2.17 x-ms-meta-jssdksrc: [cdn]/scripts/c/ms.jsll-3.2.17.min.js Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,x-ms-meta-jssdkver,x-ms-meta-jssdksrc,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240424T070442Z-168bb8d798b5v6l944pfnrufyw000000010g00000000puq2 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-04-24 07:04:42 UTC	15424	IN	Data Raw: 2f 2a 21 0a 20 2a 20 31 44 53 20 4a 53 4c 4c 20 53 4b 55 2c 20 33 2e 32 2e 31 37 0a 20 2a 20 43 6f 70 79 72 69 67 68 74 20 28 63 29 20 4d 69 63 72 6f 73 6f 66 74 20 61 6e 64 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 2e 20 41 6c 6c 20 72 69 67 68 74 73 20 72 65 73 65 72 76 65 64 2e 0a 20 2a 20 28 4d 69 63 72 6f 73 6f 66 74 20 49 6e 74 65 72 6e 61 6c 20 4f 6e 6c 79 29 0a 20 2a 2f 0a 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 76 61 72 20 6e 3d 22 75 6e 64 65 66 69 6e 65 64 22 3b 69 66 28 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 65 78 70 6f 72 74 73 26 26 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 21 3d 6e 29 74 28 65 78 70 6f 72 74 73 29 3b 65 6c 73 65 20 69 66 28 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 64 65 66 69 6e 65 26 26 64 65 66 Data Ascii: /! 1DS JSLL SKU, 3.2.17 * Copyright (c) Microsoft and contributors. All rights reserved. * (Microsoft Internal Only) */!function(e,t){var n="undefined";if("object"==typeof exports&&typeof module!=n)t(exports);else if("function"==typeof define&&def
2024-04-24 07:04:42 UTC	16384	IN	Data Raw: 39 36 37 32 39 35 7c 33 26 74 29 3e 3e 3e 30 2c 6e 3d 30 29 3b 72 65 74 75 72 6e 20 72 7d 76 61 72 20 57 72 3d 65 2c 47 72 3d 22 32 2e 38 2e 31 38 22 2c 58 72 3d 22 2e 22 2b 4b 72 28 36 29 2c 51 72 3d 30 3b 66 75 6e 63 74 69 6f 6e 20 4a 72 28 65 29 7b 72 65 74 75 72 6e 20 31 3d 3d 3d 65 5b 4d 5d 7c 7c 39 3d 3d 3d 65 5b 4d 5d 7c 7c 21 2b 65 5b 4d 5d 7d 66 75 6e 63 74 69 6f 6e 20 59 72 28 65 2c 74 29 7b 72 65 74 75 72 6e 20 4d 74 28 65 2b 51 72 2b 2b 2b 28 28 74 3d 76 6f 69 64 20 30 21 3d 3d 74 26 26 74 29 3f 22 2e 22 2b 47 72 3a 70 29 2b 58 72 29 7d 66 75 6e 63 74 69 6f 6e 20 24 72 28 65 29 7b 76 61 72 20 61 3d 7b 69 64 3a 59 72 28 22 5f 61 69 44 61 74 61 2d 22 2b 28 65 7c 7c 70 29 2b 22 2e 22 2b 47 72 29 2c 61 63 63 65 70 74 3a 4a 72 2c 67 65 74 3a 66 75 Data Ascii: 967295\|3&t)>>>0,n=0);return r}var Wr=e,Gr="2.8.18",Xr="."+Kr(6),Qr=0;function Jr(e){return 1===e[M]\|\|9===e[M]\|\|!+e[M]}function Yr(e,t){return Mt(e+Qr+++((t=void 0!==t&&t)?"."+Gr:p)+Xr)}function $r(e){var a={id:Yr("_aiData-"+(e\|\|p)+"."+Gr),accept:Jr,get:fu
2024-04-24 07:04:42 UTC	16384	IN	Data Raw: 2c 68 5b 51 5d 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 2c 72 29 7b 4e 26 26 74 6e 28 55 61 29 2c 68 5b 68 65 5d 28 29 26 26 74 6e 28 22 43 6f 72 65 20 73 68 6f 75 6c 64 20 6e 6f 74 20 62 65 20 69 6e 69 74 69 61 6c 69 7a 65 64 20 6d 6f 72 65 20 74 68 61 6e 20 6f 6e 63 65 22 29 2c 43 3d 65 7c 7c 7b 7d 2c 68 5b 76 65 5d 3d 43 2c 59 28 65 5b 6d 65 5d 29 26 26 74 6e 28 22 50 6c 65 61 73 65 20 70 72 6f 76 69 64 65 20 69 6e 73 74 72 75 6d 65 6e 74 61 74 69 6f 6e 20 6b 65 79 22 29 2c 69 3d 72 2c 68 5b 4c 61 5d 3d 72 3b 65 3d 5a 74 28 43 2e 64 69 73 61 62 6c 65 44 62 67 45 78 74 29 2c 21 30 3d 3d 3d 65 26 26 50 26 26 28 69 5b 49 65 5d 28 50 29 2c 50 3d 6e 75 6c 6c 29 2c 69 26 26 21 50 26 26 21 30 21 3d 3d 65 26 26 28 50 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b Data Ascii: ,h[Q]=function(e,t,n,r){N&&tn(Ua),h[he]()&&tn("Core should not be initialized more than once"),C=e\|\|{},h[ve]=C,Y(e[me])&&tn("Please provide instrumentation key"),i=r,h[La]=r;e=Zt(C.disableDbgExt),!0===e&&P&&(i[Ie](P),P=null),i&&!P&&!0!==e&&(P=function(e){
2024-04-24 07:04:42 UTC	16384	IN	Data Raw: 6f 6e 20 4b 73 28 65 29 7b 76 61 72 20 74 2c 6e 3d 6e 75 6c 6c 3b 69 66 28 65 29 74 72 79 7b 65 5b 4c 73 5d 3f 6e 3d 7a 73 28 65 5b 4c 73 5d 29 3a 65 5b 4d 73 5d 26 26 65 5b 4d 73 5d 5b 4c 73 5d 3f 6e 3d 7a 73 28 65 5b 4d 73 5d 5b 4c 73 5d 29 3a 65 2e 65 78 63 65 70 74 69 6f 6e 26 26 65 2e 65 78 63 65 70 74 69 6f 6e 5b 4c 73 5d 3f 6e 3d 7a 73 28 65 2e 65 78 63 65 70 74 69 6f 6e 5b 4c 73 5d 29 3a 6a 73 28 65 29 3f 6e 3d 65 3a 6a 73 28 65 5b 55 73 5d 29 3f 6e 3d 65 5b 55 73 5d 3a 77 69 6e 64 6f 77 26 26 77 69 6e 64 6f 77 2e 6f 70 65 72 61 26 26 65 5b 48 73 5d 3f 6e 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 66 6f 72 28 76 61 72 20 74 3d 5b 5d 2c 6e 3d 65 5b 77 6f 5d 28 22 5c 6e 22 29 2c 72 3d 30 3b 72 3c 6e 5b 68 5d 3b 72 2b 2b 29 7b 76 61 72 20 69 3d 6e 5b 72 Data Ascii: on Ks(e){var t,n=null;if(e)try{e[Ls]?n=zs(e[Ls]):e[Ms]&&e[Ms][Ls]?n=zs(e[Ms][Ls]):e.exception&&e.exception[Ls]?n=zs(e.exception[Ls]):js(e)?n=e:js(e[Us])?n=e[Us]:window&&window.opera&&e[Hs]?n=function(e){for(var t=[],n=e[wo]("\n"),r=0;r<n[h];r++){var i=n[r
2024-04-24 07:04:42 UTC	16384	IN	Data Raw: 6b 54 72 61 63 65 20 66 61 69 6c 65 64 2c 20 74 72 61 63 65 20 77 69 6c 6c 20 6e 6f 74 20 62 65 20 63 6f 6c 6c 65 63 74 65 64 3a 20 22 2b 76 28 72 29 2c 7b 65 78 63 65 70 74 69 6f 6e 3a 73 65 28 72 29 7d 29 7d 7d 2c 53 2e 74 72 61 63 6b 4d 65 74 72 69 63 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 74 72 79 7b 76 61 72 20 6e 3d 54 63 28 65 2c 74 63 5b 52 63 5d 2c 74 63 5b 4d 63 5d 2c 53 5b 4c 63 5d 28 29 2c 74 29 3b 53 5b 47 5d 5b 55 63 5d 28 6e 29 7d 63 61 74 63 68 28 72 29 7b 64 28 31 2c 33 36 2c 22 74 72 61 63 6b 4d 65 74 72 69 63 20 66 61 69 6c 65 64 2c 20 6d 65 74 72 69 63 20 77 69 6c 6c 20 6e 6f 74 20 62 65 20 63 6f 6c 6c 65 63 74 65 64 3a 20 22 2b 76 28 72 29 2c 7b 65 78 63 65 70 74 69 6f 6e 3a 73 65 28 72 29 7d 29 7d 7d 2c 53 5b 56 63 5d 3d 66 75 Data Ascii: kTrace failed, trace will not be collected: "+v(r),{exception:se(r)})}},S.trackMetric=function(e,t){try{var n=Tc(e,tc[Rc],tc[Mc],S[Lc](),t);S[G][Uc](n)}catch(r){d(1,36,"trackMetric failed, metric will not be collected: "+v(r),{exception:se(r)})}},S[Vc]=fu
2024-04-24 07:04:43 UTC	16384	IN	Data Raw: 7c 4c 74 28 72 2c 22 2f 22 29 29 26 26 28 61 2e 73 79 6e 63 3d 33 29 29 2c 65 26 26 28 61 2e 74 61 72 67 65 74 55 72 69 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 61 72 20 65 3d 22 22 3b 73 77 69 74 63 68 28 74 2e 74 61 67 4e 61 6d 65 29 7b 63 61 73 65 22 41 22 3a 63 61 73 65 22 41 52 45 41 22 3a 65 3d 74 2e 68 72 65 66 7c 7c 22 22 3b 62 72 65 61 6b 3b 63 61 73 65 22 49 4d 47 22 3a 65 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 74 29 7b 76 61 72 20 65 3d 4d 75 28 74 2c 4c 75 29 3b 69 66 28 65 26 26 31 3d 3d 3d 65 2e 6c 65 6e 67 74 68 29 7b 69 66 28 65 5b 30 5d 2e 68 72 65 66 29 72 65 74 75 72 6e 20 65 5b 30 5d 2e 68 72 65 66 3b 69 66 28 65 5b 30 5d 2e 73 72 63 29 72 65 74 75 72 6e 20 65 5b 30 5d 2e 73 72 63 7d 7d 72 65 74 75 72 6e 22 22 7d 28 29 3b 62 72 Data Ascii: \|Lt(r,"/"))&&(a.sync=3)),e&&(a.targetUri=function(t){var e="";switch(t.tagName){case"A":case"AREA":e=t.href\|\|"";break;case"IMG":e=function(){if(t){var e=Mu(t,Lu);if(e&&1===e.length){if(e[0].href)return e[0].href;if(e[0].src)return e[0].src}}return""}();br
2024-04-24 07:04:43 UTC	16384	IN	Data Raw: 72 79 28 65 2c 74 29 7d 2c 66 2e 74 72 61 63 6b 45 76 65 6e 74 3d 66 75 6e 63 74 69 6f 6e 28 6e 2c 65 29 7b 6e 2e 6c 61 74 65 6e 63 79 3d 6e 2e 6c 61 74 65 6e 63 79 7c 7c 31 2c 6e 2e 62 61 73 65 44 61 74 61 3d 6e 2e 62 61 73 65 44 61 74 61 7c 7c 7b 7d 2c 6e 2e 64 61 74 61 3d 6e 2e 64 61 74 61 7c 7c 7b 7d 2c 75 65 28 65 29 26 26 65 65 28 65 2c 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 6e 2e 64 61 74 61 5b 65 5d 3d 74 7d 29 2c 66 2e 63 6f 72 65 2e 74 72 61 63 6b 28 6e 29 7d 2c 66 2e 74 72 61 63 6b 50 61 67 65 56 69 65 77 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 49 2e 5f 72 65 63 6f 72 64 54 69 6d 65 53 70 61 6e 28 22 64 77 65 6c 6c 54 69 6d 65 22 2c 21 31 29 2c 54 2e 76 3d 30 2c 69 3d 21 31 2c 66 2e 69 64 2e 69 6e 69 74 69 61 6c 69 7a 65 49 64 73 28 29 Data Ascii: ry(e,t)},f.trackEvent=function(n,e){n.latency=n.latency\|\|1,n.baseData=n.baseData\|\|{},n.data=n.data\|\|{},ue(e)&&ee(e,function(e,t){n.data[e]=t}),f.core.track(n)},f.trackPageView=function(e,t){I._recordTimeSpan("dwellTime",!1),T.v=0,i=!1,f.id.initializeIds()
2024-04-24 07:04:43 UTC	16384	IN	Data Raw: 65 72 43 61 73 65 28 29 3d 3d 69 29 7b 6e 3d 21 30 3b 62 72 65 61 6b 7d 7d 7d 72 65 74 75 72 6e 20 6e 7d 66 75 6e 63 74 69 6f 6e 20 56 66 28 65 2c 74 2c 6e 2c 72 29 7b 74 26 26 6e 26 26 30 3c 6e 2e 6c 65 6e 67 74 68 26 26 28 72 26 26 4f 66 5b 74 5d 3f 28 65 2e 68 64 72 73 5b 4f 66 5b 74 5d 5d 3d 6e 2c 65 2e 75 73 65 48 64 72 73 3d 21 30 29 3a 65 2e 75 72 6c 2b 3d 22 26 22 2b 74 2b 22 3d 22 2b 6e 29 7d 66 75 6e 63 74 69 6f 6e 20 48 66 28 65 2c 74 29 7b 72 65 74 75 72 6e 20 74 26 26 28 48 74 28 74 29 3f 65 3d 5b 74 5d 2e 63 6f 6e 63 61 74 28 65 29 3a 46 28 74 29 26 26 28 65 3d 74 2e 63 6f 6e 63 61 74 28 65 29 29 29 2c 65 7d 4d 66 28 63 66 2c 63 66 2c 21 31 29 2c 4d 66 28 6e 66 2c 6e 66 29 2c 4d 66 28 72 66 2c 22 43 6c 69 65 6e 74 2d 49 64 22 29 2c 4d 66 28 Data Ascii: erCase()==i){n=!0;break}}}return n}function Vf(e,t,n,r){t&&n&&0<n.length&&(r&&Of[t]?(e.hdrs[Of[t]]=n,e.useHdrs=!0):e.url+="&"+t+"="+n)}function Hf(e,t){return t&&(Ht(t)?e=[t].concat(e):F(t)&&(e=t.concat(e))),e}Mf(cf,cf,!1),Mf(nf,nf),Mf(rf,"Client-Id"),Mf(
2024-04-24 07:04:43 UTC	16384	IN	Data Raw: 61 74 68 2e 63 65 69 6c 28 72 29 2a 74 5b 31 5d 29 2c 30 3c 3d 6e 26 26 30 3c 3d 74 5b 31 5d 26 26 6e 3e 74 5b 31 5d 26 26 28 6e 3d 74 5b 31 5d 29 2c 74 2e 70 75 73 68 28 6e 29 2c 42 5b 65 5d 3d 74 29 7d 29 7d 2c 6c 2e 66 6c 75 73 68 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 76 6f 69 64 20 30 3d 3d 3d 65 26 26 28 65 3d 21 30 29 2c 55 7c 7c 28 6e 3d 6e 7c 7c 31 2c 65 3f 6e 75 6c 6c 3d 3d 4c 3f 28 63 28 29 2c 6d 28 31 2c 30 2c 6e 29 2c 4c 3d 73 28 66 75 6e 63 74 69 6f 6e 28 29 7b 4c 3d 6e 75 6c 6c 2c 66 75 6e 63 74 69 6f 6e 20 72 28 65 2c 74 29 7b 61 28 31 2c 30 2c 74 29 2c 76 28 29 2c 66 75 6e 63 74 69 6f 6e 20 6e 28 65 29 7b 44 2e 69 73 43 6f 6d 70 6c 65 74 65 6c 79 49 64 6c 65 28 29 3f 65 28 29 3a 4c 3d 73 28 66 75 6e 63 74 69 6f 6e 28 29 7b 4c Data Ascii: ath.ceil(r)*t[1]),0<=n&&0<=t[1]&&n>t[1]&&(n=t[1]),t.push(n),B[e]=t)})},l.flush=function(e,t,n){void 0===e&&(e=!0),U\|\|(n=n\|\|1,e?null==L?(c(),m(1,0,n),L=s(function(){L=null,function r(e,t){a(1,0,t),v(),function n(e){D.isCompletelyIdle()?e():L=s(function(){L
2024-04-24 07:04:43 UTC	16384	IN	Data Raw: 28 29 7d 7d 29 2c 65 7d 74 28 73 70 2c 61 70 3d 43 74 29 2c 73 70 2e 5f 5f 69 65 44 79 6e 3d 31 3b 76 61 72 20 63 70 3d 73 70 3b 66 75 6e 63 74 69 6f 6e 20 75 70 28 74 29 7b 76 61 72 20 6e 3d 70 6f 28 29 2c 72 3d 74 61 28 29 3b 72 65 28 75 70 2c 74 68 69 73 2c 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 2e 67 65 74 54 72 61 63 65 49 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 74 26 26 74 2e 67 65 74 54 72 61 63 65 43 74 78 26 26 74 2e 67 65 74 54 72 61 63 65 43 74 78 28 29 2e 67 65 74 54 72 61 63 65 49 64 28 29 7c 7c 72 7d 2c 65 2e 67 65 74 4c 61 73 74 50 61 67 65 56 69 65 77 49 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 6e 7d 7d 29 7d 75 70 2e 5f 5f 69 65 44 79 6e 3d 31 3b 76 61 72 20 6c 70 3d 75 70 2c 66 70 3d 22 64 75 72 61 Data Ascii: ()}}),e}t(sp,ap=Ct),sp.__ieDyn=1;var cp=sp;function up(t){var n=po(),r=ta();re(up,this,function(e){e.getTraceId=function(){return t&&t.getTraceCtx&&t.getTraceCtx().getTraceId()\|\|r},e.getLastPageViewId=function(){return n}})}up.__ieDyn=1;var lp=up,fp="dura

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49755	23.202.57.177	443

Timestamp	Bytes transferred	Direction	Data
2024-04-24 07:04:44 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-04-24 07:04:44 UTC	467	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (sac/2518) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-eus-z1 Cache-Control: public, max-age=259115 Date: Wed, 24 Apr 2024 07:04:44 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49760	23.202.57.177	443

Timestamp	Bytes transferred	Direction	Data
2024-04-24 07:04:45 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-04-24 07:04:45 UTC	521	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Last-Modified: Tue, 16 May 2017 22:58:00 GMT ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json X-MSEdge-Ref: Ref A: CC1186E36C704BA5AF8177F229D6CC87 Ref B: PAOEDGE0621 Ref C: 2023-04-04T13:32:33Z Cache-Control: public, max-age=259066 Date: Wed, 24 Apr 2024 07:04:45 GMT Content-Length: 55 Connection: close X-CID: 2
2024-04-24 07:04:45 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49785	63.140.37.206	443	7576	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 07:04:49 UTC	915	OUT	POST /rest/v1/delivery?client=microsoftmscompoc&sessionId=0791c829041c4c068b787022a66647a2&version=2.9.0 HTTP/1.1 Host: target.microsoft.com Connection: keep-alive Content-Length: 1111 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: text/plain Accept: / Origin: https://learn.microsoft.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://learn.microsoft.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: MC1=GUID=749eee6039c5489b9db3000c7ab3f399&HASH=749e&LV=202310&V=4&LU=1696413236917; MUID=375E6F2E0D8F6B9C2CEB7C8E098F6DFE; MSCC=NR; at_check=true; mbox=session#0791c829041c4c068b787022a66647a2#1713944147
2024-04-24 07:04:49 UTC	1111	OUT	Data Raw: 7b 22 72 65 71 75 65 73 74 49 64 22 3a 22 30 64 30 39 62 63 61 35 35 63 37 62 34 61 35 62 39 31 64 62 63 36 38 38 34 37 36 36 61 65 62 62 22 2c 22 63 6f 6e 74 65 78 74 22 3a 7b 22 75 73 65 72 41 67 65 6e 74 22 3a 22 4d 6f 7a 69 6c 6c 61 2f 35 2e 30 20 28 57 69 6e 64 6f 77 73 20 4e 54 20 31 30 2e 30 3b 20 57 69 6e 36 34 3b 20 78 36 34 29 20 41 70 70 6c 65 57 65 62 4b 69 74 2f 35 33 37 2e 33 36 20 28 4b 48 54 4d 4c 2c 20 6c 69 6b 65 20 47 65 63 6b 6f 29 20 43 68 72 6f 6d 65 2f 31 31 37 2e 30 2e 30 2e 30 20 53 61 66 61 72 69 2f 35 33 37 2e 33 36 22 2c 22 63 6c 69 65 6e 74 48 69 6e 74 73 22 3a 7b 22 6d 6f 62 69 6c 65 22 3a 66 61 6c 73 65 2c 22 70 6c 61 74 66 6f 72 6d 22 3a 22 57 69 6e 64 6f 77 73 22 2c 22 62 72 6f 77 73 65 72 55 41 57 69 74 68 4d 61 6a 6f 72 Data Ascii: {"requestId":"0d09bca55c7b4a5b91dbc6884766aebb","context":{"userAgent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36","clientHints":{"mobile":false,"platform":"Windows","browserUAWithMajor
2024-04-24 07:04:50 UTC	845	IN	HTTP/1.1 200 OK date: Wed, 24 Apr 2024 07:04:49 GMT content-type: application/json;charset=UTF-8 vary: origin,access-control-request-method,access-control-request-headers,accept-encoding access-control-allow-origin: https://learn.microsoft.com access-control-allow-credentials: true x-request-id: 5330aeb3-e89c-4a77-8b1c-05cd4f511aa6 timing-allow-origin: * accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List referrer-policy: strict-origin-when-cross-origin server: jag strict-transport-security: max-age=31536000; includeSubDomains cache-control: no-cache, no-store, max-age=0, no-transform, private x-xss-protection: 1; mode=block x-content-type-options: nosniff connection: close transfer-encoding: chunked
2024-04-24 07:04:50 UTC	1534	IN	Data Raw: 35 66 37 0d 0a 7b 22 73 74 61 74 75 73 22 3a 32 30 30 2c 22 72 65 71 75 65 73 74 49 64 22 3a 22 30 64 30 39 62 63 61 35 35 63 37 62 34 61 35 62 39 31 64 62 63 36 38 38 34 37 36 36 61 65 62 62 22 2c 22 63 6c 69 65 6e 74 22 3a 22 6d 69 63 72 6f 73 6f 66 74 6d 73 63 6f 6d 70 6f 63 22 2c 22 69 64 22 3a 7b 22 74 6e 74 49 64 22 3a 22 30 37 39 31 63 38 32 39 30 34 31 63 34 63 30 36 38 62 37 38 37 30 32 32 61 36 36 36 34 37 61 32 2e 33 35 5f 30 22 2c 22 74 68 69 72 64 50 61 72 74 79 49 64 22 3a 22 37 34 39 65 65 65 36 30 33 39 63 35 34 38 39 62 39 64 62 33 30 30 30 63 37 61 62 33 66 33 39 39 22 7d 2c 22 65 64 67 65 48 6f 73 74 22 3a 22 6d 62 6f 78 65 64 67 65 33 35 2e 74 74 2e 6f 6d 74 72 64 63 2e 6e 65 74 22 2c 22 70 72 65 66 65 74 63 68 22 3a 7b 7d 2c 22 74 65 Data Ascii: 5f7{"status":200,"requestId":"0d09bca55c7b4a5b91dbc6884766aebb","client":"microsoftmscompoc","id":{"tntId":"0791c829041c4c068b787022a66647a2.35_0","thirdPartyId":"749eee6039c5489b9db3000c7ab3f399"},"edgeHost":"mboxedge35.tt.omtrdc.net","prefetch":{},"te
2024-04-24 07:04:50 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49791	63.140.36.51	443	7576	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 07:04:50 UTC	707	OUT	GET /rest/v1/delivery?client=microsoftmscompoc&sessionId=0791c829041c4c068b787022a66647a2&version=2.9.0 HTTP/1.1 Host: target.microsoft.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: MC1=GUID=749eee6039c5489b9db3000c7ab3f399&HASH=749e&LV=202310&V=4&LU=1696413236917; MUID=375E6F2E0D8F6B9C2CEB7C8E098F6DFE; MSCC=NR; at_check=true; mbox=session#0791c829041c4c068b787022a66647a2#1713944149\|PC#0791c829041c4c068b787022a66647a2.35_0#1748122289
2024-04-24 07:04:51 UTC	450	IN	HTTP/1.1 405 Method Not Allowed date: Wed, 24 Apr 2024 07:04:51 GMT content-type: application/json;charset=UTF-8 vary: accept-encoding referrer-policy: strict-origin-when-cross-origin server: jag strict-transport-security: max-age=31536000; includeSubDomains cache-control: no-cache, no-store, max-age=0, no-transform, private x-xss-protection: 1; mode=block x-content-type-options: nosniff connection: close transfer-encoding: chunked
2024-04-24 07:04:51 UTC	67	IN	Data Raw: 33 64 0d 0a 7b 22 73 74 61 74 75 73 22 3a 34 30 35 2c 22 6d 65 73 73 61 67 65 22 3a 22 52 65 71 75 65 73 74 20 6d 65 74 68 6f 64 20 27 47 45 54 27 20 6e 6f 74 20 73 75 70 70 6f 72 74 65 64 22 7d 0d 0a Data Ascii: 3d{"status":405,"message":"Request method 'GET' not supported"}
2024-04-24 07:04:51 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49799	63.140.37.206	443	7576	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 07:04:51 UTC	967	OUT	POST /rest/v1/delivery?client=microsoftmscompoc&sessionId=0791c829041c4c068b787022a66647a2&version=2.9.0 HTTP/1.1 Host: target.microsoft.com Connection: keep-alive Content-Length: 1186 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: text/plain Accept: / Origin: https://learn.microsoft.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://learn.microsoft.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: MC1=GUID=749eee6039c5489b9db3000c7ab3f399&HASH=749e&LV=202310&V=4&LU=1696413236917; MUID=375E6F2E0D8F6B9C2CEB7C8E098F6DFE; MSCC=NR; at_check=true; mbox=session#0791c829041c4c068b787022a66647a2#1713944151\|PC#0791c829041c4c068b787022a66647a2.35_0#1748122289
2024-04-24 07:04:51 UTC	1186	OUT	Data Raw: 7b 22 72 65 71 75 65 73 74 49 64 22 3a 22 39 65 66 35 38 31 31 62 38 33 34 37 34 61 39 35 62 38 35 30 62 64 32 39 63 65 61 64 61 62 34 61 22 2c 22 63 6f 6e 74 65 78 74 22 3a 7b 22 75 73 65 72 41 67 65 6e 74 22 3a 22 4d 6f 7a 69 6c 6c 61 2f 35 2e 30 20 28 57 69 6e 64 6f 77 73 20 4e 54 20 31 30 2e 30 3b 20 57 69 6e 36 34 3b 20 78 36 34 29 20 41 70 70 6c 65 57 65 62 4b 69 74 2f 35 33 37 2e 33 36 20 28 4b 48 54 4d 4c 2c 20 6c 69 6b 65 20 47 65 63 6b 6f 29 20 43 68 72 6f 6d 65 2f 31 31 37 2e 30 2e 30 2e 30 20 53 61 66 61 72 69 2f 35 33 37 2e 33 36 22 2c 22 63 6c 69 65 6e 74 48 69 6e 74 73 22 3a 7b 22 6d 6f 62 69 6c 65 22 3a 66 61 6c 73 65 2c 22 70 6c 61 74 66 6f 72 6d 22 3a 22 57 69 6e 64 6f 77 73 22 2c 22 62 72 6f 77 73 65 72 55 41 57 69 74 68 4d 61 6a 6f 72 Data Ascii: {"requestId":"9ef5811b83474a95b850bd29ceadab4a","context":{"userAgent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36","clientHints":{"mobile":false,"platform":"Windows","browserUAWithMajor
2024-04-24 07:04:52 UTC	845	IN	HTTP/1.1 200 OK date: Wed, 24 Apr 2024 07:04:52 GMT content-type: application/json;charset=UTF-8 vary: origin,access-control-request-method,access-control-request-headers,accept-encoding access-control-allow-origin: https://learn.microsoft.com access-control-allow-credentials: true x-request-id: 62189efc-2d2b-4554-badf-f633325c5f85 timing-allow-origin: * accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List referrer-policy: strict-origin-when-cross-origin server: jag strict-transport-security: max-age=31536000; includeSubDomains cache-control: no-cache, no-store, max-age=0, no-transform, private x-xss-protection: 1; mode=block x-content-type-options: nosniff connection: close transfer-encoding: chunked
2024-04-24 07:04:52 UTC	1521	IN	Data Raw: 35 65 61 0d 0a 7b 22 73 74 61 74 75 73 22 3a 32 30 30 2c 22 72 65 71 75 65 73 74 49 64 22 3a 22 39 65 66 35 38 31 31 62 38 33 34 37 34 61 39 35 62 38 35 30 62 64 32 39 63 65 61 64 61 62 34 61 22 2c 22 63 6c 69 65 6e 74 22 3a 22 6d 69 63 72 6f 73 6f 66 74 6d 73 63 6f 6d 70 6f 63 22 2c 22 69 64 22 3a 7b 22 74 6e 74 49 64 22 3a 22 30 37 39 31 63 38 32 39 30 34 31 63 34 63 30 36 38 62 37 38 37 30 32 32 61 36 36 36 34 37 61 32 2e 33 35 5f 30 22 2c 22 74 68 69 72 64 50 61 72 74 79 49 64 22 3a 22 37 34 39 65 65 65 36 30 33 39 63 35 34 38 39 62 39 64 62 33 30 30 30 63 37 61 62 33 66 33 39 39 22 7d 2c 22 65 64 67 65 48 6f 73 74 22 3a 22 6d 62 6f 78 65 64 67 65 33 35 2e 74 74 2e 6f 6d 74 72 64 63 2e 6e 65 74 22 2c 22 70 72 65 66 65 74 63 68 22 3a 7b 7d 2c 22 74 65 Data Ascii: 5ea{"status":200,"requestId":"9ef5811b83474a95b850bd29ceadab4a","client":"microsoftmscompoc","id":{"tntId":"0791c829041c4c068b787022a66647a2.35_0","thirdPartyId":"749eee6039c5489b9db3000c7ab3f399"},"edgeHost":"mboxedge35.tt.omtrdc.net","prefetch":{},"te
2024-04-24 07:04:52 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49792	52.165.165.26	443

Timestamp	Bytes transferred	Direction	Data
2024-04-24 07:04:51 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=gztnYs+RTGfK+AB&MD=PdPVE7VN HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-04-24 07:04:52 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: 8c3cf2ba-8e0d-4706-868c-d54e1033e429 MS-RequestId: 552ca7f2-3e8f-4672-821e-ed0d4ea0f23e MS-CV: yljzP9IfqUCDFwMt.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Wed, 24 Apr 2024 07:04:51 GMT Connection: close Content-Length: 24490
2024-04-24 07:04:52 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-04-24 07:04:52 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49810	63.140.36.51	443	7576	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 07:04:52 UTC	745	OUT	GET /rest/v1/delivery?client=microsoftmscompoc&sessionId=0791c829041c4c068b787022a66647a2&version=2.9.0 HTTP/1.1 Host: target.microsoft.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: MC1=GUID=749eee6039c5489b9db3000c7ab3f399&HASH=749e&LV=202310&V=4&LU=1696413236917; MUID=375E6F2E0D8F6B9C2CEB7C8E098F6DFE; MSCC=NR; at_check=true; mbox=session#0791c829041c4c068b787022a66647a2#1713944151\|PC#0791c829041c4c068b787022a66647a2.35_0#1748122289; MS0=1e372c3aab014af7b628c367b32124df
2024-04-24 07:04:52 UTC	450	IN	HTTP/1.1 405 Method Not Allowed date: Wed, 24 Apr 2024 07:04:52 GMT content-type: application/json;charset=UTF-8 vary: accept-encoding referrer-policy: strict-origin-when-cross-origin server: jag strict-transport-security: max-age=31536000; includeSubDomains cache-control: no-cache, no-store, max-age=0, no-transform, private x-xss-protection: 1; mode=block x-content-type-options: nosniff connection: close transfer-encoding: chunked
2024-04-24 07:04:52 UTC	67	IN	Data Raw: 33 64 0d 0a 7b 22 73 74 61 74 75 73 22 3a 34 30 35 2c 22 6d 65 73 73 61 67 65 22 3a 22 52 65 71 75 65 73 74 20 6d 65 74 68 6f 64 20 27 47 45 54 27 20 6e 6f 74 20 73 75 70 70 6f 72 74 65 64 22 7d 0d 0a Data Ascii: 3d{"status":405,"message":"Request method 'GET' not supported"}
2024-04-24 07:04:52 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49835	52.165.165.26	443

Timestamp	Bytes transferred	Direction	Data
2024-04-24 07:05:29 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=gztnYs+RTGfK+AB&MD=PdPVE7VN HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-04-24 07:05:29 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "Mx1RoJH/qEwpWfKllx7sbsl28AuERz5IYdcsvtTJcgM=_2160" MS-CorrelationId: b5fe7fbc-da6d-4fd2-b35b-a97950e787c2 MS-RequestId: 43eab237-976f-4aa2-81ce-a165d8ef24bf MS-CV: iafOTrUTq0uJSOa6.0 X-Microsoft-SLSClientCache: 2160 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Wed, 24 Apr 2024 07:05:29 GMT Connection: close Content-Length: 25457
2024-04-24 07:05:29 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 51 22 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 db 8e 00 00 14 00 00 00 00 00 10 00 51 22 00 00 20 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 f3 43 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 0d 92 6f db e5 21 f3 43 43 4b ed 5a 09 38 55 5b df 3f 93 99 90 29 99 e7 29 ec 73 cc 4a 66 32 cf 84 32 64 c8 31 c7 11 52 38 87 90 42 66 09 99 87 32 0f 19 0a 09 51 a6 a8 08 29 53 86 4a 52 84 50 df 46 83 ba dd 7b df fb 7e ef 7d ee 7d bf ef 9e e7 d9 67 ef 35 ee b5 fe eb 3f ff b6 96 81 a2 0a 04 fc 31 40 21 5b 3f a5 ed 1b 04 0e 85 42 a0 10 04 64 12 6c a5 de aa a1 d8 ea f3 58 01 f2 f5 67 0b 5e 9b bd e8 a0 90 1d bf 40 88 9d eb 49 b4 87 9b ab 8b 9d 2b 46 c8 c7 c5 19 92 Data Ascii: MSCFQ"DQ" AdCenvironment.cabo!CCKZ8U[?))sJf22d1R8Bf2Q)SJRPF{~}}g5?1@![?BdlXg^@I+F
2024-04-24 07:05:29 UTC	9633	IN	Data Raw: 21 6f b3 eb a6 cc f5 31 be cf 05 e2 a9 fe fa 57 6d 19 30 b3 c2 c5 66 c9 6a df f5 e7 f0 78 bd c7 a8 9e 25 e3 f9 bc ed 6b 54 57 08 2b 51 82 44 12 fb b9 53 8c cc f4 60 12 8a 76 cc 40 40 41 9b dc 5c 17 ff 5c f9 5e 17 35 98 24 56 4b 74 ef 42 10 c8 af bf 7f c6 7f f2 37 7d 5a 3f 1c f2 99 79 4a 91 52 00 af 38 0f 17 f5 2f 79 81 65 d9 a9 b5 6b e4 c7 ce f6 ca 7a 00 6f 4b 30 44 24 22 3c cf ed 03 a5 96 8f 59 29 bc b6 fd 04 e1 70 9f 32 4a 27 fd 55 af 2f fe b6 e5 8e 33 bb 62 5f 9a db 57 40 e9 f1 ce 99 66 90 8c ff 6a 62 7f dd c5 4a 0b 91 26 e2 39 ec 19 4a 71 63 9d 7b 21 6d c3 9c a3 a2 3c fa 7f 7d 96 6a 90 78 a6 6d d2 e1 9c f9 1d fc 38 d8 94 f4 c6 a5 0a 96 86 a4 bd 9e 1a ae 04 42 83 b8 b5 80 9b 22 38 20 b5 25 e5 64 ec f7 f4 bf 7e 63 59 25 0f 7a 2e 39 57 76 a2 71 aa 06 8a Data Ascii: !o1Wm0fjx%kTW+QDS`v@@A\\^5$VKtB7}Z?yJR8/yekzoK0D$"<Y)p2J'U/3b_W@fjbJ&9Jqc{!m<}jxm8B"8 %d~cY%z.9Wvq

Target ID:	0
Start time:	09:04:31
Start date:	24/04/2024
Path:	C:\Users\user\Desktop\WAXD480.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\WAXD480.exe"
Imagebase:	0x400000
File size:	14'544'896 bytes
MD5 hash:	7F1FFC9BE9757477A8A39CB06D5032C8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	09:04:36
Start date:	24/04/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=WAXD480.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	09:04:37
Start date:	24/04/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1680 --field-trial-handle=2028,i,4872466835619599832,212431843967096772,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	4
Start time:	09:04:39
Start date:	24/04/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=WAXD480.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	09:04:40
Start date:	24/04/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2052 --field-trial-handle=1996,i,12553455973178745463,2557296557389022246,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report WAXD480.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

Phishing

Compliance

Networking

System Summary

Data Obfuscation

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Chrome Cache Entry: 100

Chrome Cache Entry: 101

Chrome Cache Entry: 102

Chrome Cache Entry: 103

Chrome Cache Entry: 104

Chrome Cache Entry: 105

Chrome Cache Entry: 106

Chrome Cache Entry: 69

Chrome Cache Entry: 70

Chrome Cache Entry: 71

Chrome Cache Entry: 72

Chrome Cache Entry: 73

Chrome Cache Entry: 74

Chrome Cache Entry: 75

Chrome Cache Entry: 76

Chrome Cache Entry: 77

Chrome Cache Entry: 78

Chrome Cache Entry: 79

Chrome Cache Entry: 80

Chrome Cache Entry: 81

Chrome Cache Entry: 82

Chrome Cache Entry: 83

Chrome Cache Entry: 84

Chrome Cache Entry: 85

Chrome Cache Entry: 86

Chrome Cache Entry: 87

Windows Analysis Report
WAXD480.exe