Overview

overview

10

Static

static

1

39e246d194...81.exe

windows7-x64

1

39e246d194...81.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    160s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16/05/2024, 16:04 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    39e246d194e4a5ade27a08d4a925dbff009fa8b66963c05f18712c1472e24a81.exe

  • Size

    25.8MB

  • MD5

    9b28351713f6b95a04996fee315aa7fd

  • SHA1

    edac4aa27925404263fafdaad6dd375732861ad1

  • SHA256

    39e246d194e4a5ade27a08d4a925dbff009fa8b66963c05f18712c1472e24a81

  • SHA512

    7971eacbb3e56be9803abcd11f9fd3246ba763b16de5d3331e984b040c2c9730a9ba085ed1a7d0ae0d24bd28ed108938284111c8f65d011ee0e62c6c2c4fc624

  • SSDEEP

    393216:M+Jsv6tWKFdu9CRXu3AzmqTL6zemNMg56LLnToMjmmV5BBWCJP0/3uj7XlC4t6no:RfmqG3Q3TTyanWCJM/e9Ch6dv

Score
10/10
egregordiscoverypersistenceransomware

Malware Config

Signatures

  • Detected Egregor ransomware 1 IoCs
  • Egregor Ransomware

    Variant of the Sekhmet ransomware first seen in September 2020.

    ransomwareegregor
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 20 IoCs
  • Loads dropped DLL 64 IoCs
  • Registers COM server for autorun 1 TTPs 3 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks system information in the registry 2 TTPs 8 IoCs

    System information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory 49 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 5 IoCs
  • Launches sc.exe 1 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 42 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 12 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 2 IoCs
    evasion
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 5 IoCs
  • Modifies system certificate store 2 TTPs 3 IoCs
    evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 25 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\39e246d194e4a5ade27a08d4a925dbff009fa8b66963c05f18712c1472e24a81.exe
    "C:\Users\Admin\AppData\Local\Temp\39e246d194e4a5ade27a08d4a925dbff009fa8b66963c05f18712c1472e24a81.exe"
    1⤵
    • Drops file in Program Files directory
    • Suspicious use of WriteProcessMemory
    PID:4220
    • C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\GoToResolveUnattended.exe
      "C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\GoToResolveUnattended.exe" -regsvc
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Loads dropped DLL
      • Checks system information in the registry
      • Checks processor information in registry
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1504
      • C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\GoToResolveProcessChecker.exe
        "C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\GoToResolveProcessChecker.exe" -regsvc -expectadmin -starterpid 1504 -WorkFolder "C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572" -ApplicationType 4
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of AdjustPrivilegeToken
        PID:1488
    • C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\GoToResolveTools64.exe
      "C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\GoToResolveTools64.exe" -InstallVDD
      2⤵
      • Executes dropped EXE
      • Checks system information in the registry
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Checks SCSI registry key(s)
      • Checks processor information in registry
      PID:4932
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /S /C ""C:\Users\Admin\AppData\Local\Temp\39e246d194e4a5ade27a08d4a925dbff009fa8b66963c05f18712c1472e24a81.exe.cmd" "C:\Users\Admin\AppData\Local\Temp\39e246d194e4a5ade27a08d4a925dbff009fa8b66963c05f18712c1472e24a81.exe""
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2812
      • C:\Windows\SysWOW64\timeout.exe
        timeout /T 3
        3⤵
        • Delays execution with timeout.exe
        PID:2756
      • C:\Windows\SysWOW64\timeout.exe
        timeout /T 3
        3⤵
        • Delays execution with timeout.exe
        PID:4228
  • C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\GoToResolveProcessChecker.exe
    "C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\GoToResolveProcessChecker.exe" -Service -WorkFolder "C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572" -ApplicationType "4"
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3532
    • C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\GoToResolveUnattended.exe
      "C:/Program Files (x86)/GoTo Resolve Unattended/1937918270322737572/GoToResolveUnattended.exe" "-RegisteredProcess" "1" "-ParentProcessId" "3532" "-WtsStartingUsername" "-ServiceName" "GoToResolve_1937918270322737572" "-Service"
      2⤵
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Loads dropped DLL
      • Registers COM server for autorun
      • Checks system information in the registry
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Checks processor information in registry
      • Modifies data under HKEY_USERS
      • Modifies registry class
      • Modifies system certificate store
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4896
      • C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\GoToResolveLoggerProcess.exe
        GoToResolveLoggerProcess.exe -ParentProcessId 4896 -CompanyId 1937918270322737572 -InstallationId MMfJME8PUa -MonitoringUrl https://dumpster.console.gotoresolve.com -HostId 081ad3cce019e849dce362eb0b187071 -LogLevel 2 -MonitoringApiKey cnl6269ktie1dcpmz8y2ddxhjhhgi0nebxwpr4a3c71lbfwnubk2w7l7c6evabi3 -SessionType Unattended
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Modifies data under HKEY_USERS
        • Suspicious use of WriteProcessMemory
        PID:4600
        • C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\GoToResolveCrashHandler.exe
          "C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\GoToResolveCrashHandler.exe" "--attachment=attachment_GoToResolveLoggerProcess.log=C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\appdata\GoToResolveLoggerProcess.log" "--attachment=attachment_logger.json=C:/Program Files (x86)/GoTo Resolve Unattended/1937918270322737572\logger.json" "--database=C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\appdata\LoggerProcessCrashReportDB" "--metrics-dir=C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\appdata\LoggerProcessCrashReportDB" --url=https://dumpster.console.gotoresolve.com/api/dump --annotation=format=minidump --annotation=hostname=Objiyuie --annotation=installationid=MMfJME8PUa --annotation=version=1.15.2.3338 --initial-client-data=0x4d0,0x4d4,0x4d8,0x4a4,0x4dc,0x7502e09c,0x7502e0ac,0x7502e0bc
          4⤵
          • Executes dropped EXE
          PID:1584
      • C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\GoToResolveCrashHandler.exe
        "C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\GoToResolveCrashHandler.exe" "--attachment=attachment_GoToResolveUnattended.log=C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\appdata\GoToResolveUnattended.log" "--attachment=attachment_unattended.json=C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\unattended.json" "--database=C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\appdata\UnattendedCrashReportDB" "--metrics-dir=C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\appdata\UnattendedCrashReportDB" --url=https://dumpster.console.gotoresolve.com/api/dump --annotation=format=minidump --annotation=hostname=Objiyuie --annotation=installationid=MMfJME8PUa --annotation=version=1.15.2.3338 --initial-client-data=0x568,0x56c,0x570,0x544,0x574,0x7502e09c,0x7502e0ac,0x7502e0bc
        3⤵
        • Executes dropped EXE
        PID:1088
      • C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\GoToResolveFileManager.exe
        GoToResolveFileManager.exe -CompanyId 1937918270322737572 -InstallationId MMfJME8PUa -LogLevel 2 -MonitoringUrl https://dumpster.console.gotoresolve.com
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Program Files directory
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:396
        • C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\GoToResolveCrashHandler.exe
          "C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\GoToResolveCrashHandler.exe" "--database=C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\appdata\FileManagerCrashReportDB" "--metrics-dir=C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\appdata\FileManagerCrashReportDB" --url=https://dumpster.console.gotoresolve.com/api/dump --annotation=format=minidump --annotation=hostname=Objiyuie --annotation=installationid=MMfJME8PUa --annotation=version=1.15.2.3338 --initial-client-data=0x5f0,0x5f4,0x5f8,0x5c4,0x5fc,0x7502e09c,0x7502e0ac,0x7502e0bc
          4⤵
          • Executes dropped EXE
          PID:4964
      • C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\GoToResolveQuickView.exe
        GoToResolveQuickView.exe -InstallationId MMfJME8PUa -LogLevel 2
        3⤵
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Loads dropped DLL
        • Checks system information in the registry
        • Checks processor information in registry
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4892
      • C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\GoToResolveTerminal.exe
        GoToResolveTerminal.exe -CompanyId 1937918270322737572 -InstallationId MMfJME8PUa -LogLevel 2 -MonitoringUrl https://dumpster.console.gotoresolve.com
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Program Files directory
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4956
        • C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\GoToResolveCrashHandler.exe
          "C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\GoToResolveCrashHandler.exe" "--database=C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\appdata\TerminalCrashReportDB" "--metrics-dir=C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\appdata\TerminalCrashReportDB" --url=https://dumpster.console.gotoresolve.com/api/dump --annotation=format=minidump --annotation=hostname=Objiyuie --annotation=installationid=MMfJME8PUa --annotation=version=1.15.2.3338 --initial-client-data=0x5f0,0x5f4,0x5f8,0x5c4,0x5fc,0x7502e09c,0x7502e0ac,0x7502e0bc
          4⤵
          • Executes dropped EXE
          PID:3704
      • C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\externalmodules\DeviceDataModule\1.71.0\GoTo.Resolve.DeviceData.App.exe
        "C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\externalmodules\DeviceDataModule\1.71.0\GoTo.Resolve.DeviceData.App.exe" --Credentials:CompanyId 1937918270322737572 --Credentials:HostId syn-prd-ava-unattended-3e5ed0ea-763f-442b-b33d-60ffd6847cbd --Communication:IpcFolderPath "C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\externalmodules\DeviceDataModule\IPC" --Authentication:TokenFilePath "C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\externalmodules\token.txt" --ZeroTrust:ReferencePublicKeyHash 79297ed57ba94f2dde0d121e431d4ed4d8f143a35e3f89ed9b9c2fc1c3015ae8 --Native:Version 1.15.2.3338
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Modifies data under HKEY_USERS
        • Suspicious use of AdjustPrivilegeToken
        PID:2548
      • C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\externalmodules\AlertsModule\1.2024.0430.2\GoTo.Resolve.Alerts.Monitor.App.exe
        "C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\externalmodules\AlertsModule\1.2024.0430.2\GoTo.Resolve.Alerts.Monitor.App.exe" --Credentials:CompanyId 1937918270322737572 --Credentials:HostId syn-prd-ava-unattended-3e5ed0ea-763f-442b-b33d-60ffd6847cbd --Communication:IpcFolderPath "C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\externalmodules\AlertsModule\IPC" --Authentication:TokenFilePath "C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\externalmodules\token.txt" --ZeroTrust:ReferencePublicKeyHash 79297ed57ba94f2dde0d121e431d4ed4d8f143a35e3f89ed9b9c2fc1c3015ae8 --Native:Version 1.15.2.3338
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Suspicious use of AdjustPrivilegeToken
        PID:2828
      • C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\externalmodules\RemoteExecutionModule\1.2024.0506.1\RemoteExecution.Runner.exe
        "C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\externalmodules\RemoteExecutionModule\1.2024.0506.1\RemoteExecution.Runner.exe" --Credentials:CompanyId 1937918270322737572 --Credentials:HostId syn-prd-ava-unattended-3e5ed0ea-763f-442b-b33d-60ffd6847cbd --Communication:IpcFolderPath "C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\externalmodules\RemoteExecutionModule\IPC" --Authentication:TokenFilePath "C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\externalmodules\token.txt" --ZeroTrust:ReferencePublicKeyHash 79297ed57ba94f2dde0d121e431d4ed4d8f143a35e3f89ed9b9c2fc1c3015ae8 --Native:Version 1.15.2.3338
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in System32 directory
        • Suspicious use of AdjustPrivilegeToken
        PID:4312
      • C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\externalmodules\PatchManagementModule\1.2024.0507.5\GoTo.Resolve.PatchManagement.Client.exe
        "C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\externalmodules\PatchManagementModule\1.2024.0507.5\GoTo.Resolve.PatchManagement.Client.exe" --Credentials:CompanyId 1937918270322737572 --Credentials:HostId syn-prd-ava-unattended-3e5ed0ea-763f-442b-b33d-60ffd6847cbd --Communication:IpcFolderPath "C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\externalmodules\PatchManagementModule\IPC" --Authentication:TokenFilePath "C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\externalmodules\token.txt" --ZeroTrust:ReferencePublicKeyHash 79297ed57ba94f2dde0d121e431d4ed4d8f143a35e3f89ed9b9c2fc1c3015ae8 --Native:Version 1.15.2.3338
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Modifies data under HKEY_USERS
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:804
        • C:\Windows\SYSTEM32\where.exe
          "where" -r "C:\Program Files\WindowsApps" Winget.exe
          4⤵
            PID:3232
          • C:\Windows\SYSTEM32\where.exe
            "where" -r "C:\Program Files\WindowsApps" AppInstallerCLI.exe
            4⤵
              PID:1956
          • C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\externalmodules\AlertsModule\1.2024.0430.2\GoTo.Resolve.Alerts.Monitor.App.exe
            "C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\externalmodules\AlertsModule\1.2024.0430.2\GoTo.Resolve.Alerts.Monitor.App.exe" --Credentials:CompanyId 1937918270322737572 --Credentials:HostId syn-prd-ava-unattended-3e5ed0ea-763f-442b-b33d-60ffd6847cbd --Communication:IpcFolderPath "C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\externalmodules\AlertsModule\IPC" --Authentication:TokenFilePath "C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\externalmodules\token.txt" --ZeroTrust:ReferencePublicKeyHash 79297ed57ba94f2dde0d121e431d4ed4d8f143a35e3f89ed9b9c2fc1c3015ae8 --Native:Version 1.15.2.3338
            3⤵
            • Executes dropped EXE
            • Drops file in System32 directory
            • Suspicious use of AdjustPrivilegeToken
            PID:1756
          • C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\externalmodules\AntivirusModule\1.2024.0411.2\GoTo.Resolve.Antivirus.App.exe
            "C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\externalmodules\AntivirusModule\1.2024.0411.2\GoTo.Resolve.Antivirus.App.exe" --Credentials:CompanyId 1937918270322737572 --Credentials:HostId syn-prd-ava-unattended-3e5ed0ea-763f-442b-b33d-60ffd6847cbd --Communication:IpcFolderPath "C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\externalmodules\AntivirusModule\IPC" --Authentication:TokenFilePath "C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\externalmodules\token.txt" --ZeroTrust:ReferencePublicKeyHash 79297ed57ba94f2dde0d121e431d4ed4d8f143a35e3f89ed9b9c2fc1c3015ae8 --Native:Version 1.15.2.3338
            3⤵
            • Executes dropped EXE
            • Drops file in System32 directory
            • Suspicious use of AdjustPrivilegeToken
            PID:768
          • C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\externalmodules\AntivirusModule\1.2024.0411.2\GoTo.Resolve.Antivirus.App.exe
            "C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\externalmodules\AntivirusModule\1.2024.0411.2\GoTo.Resolve.Antivirus.App.exe" --Credentials:CompanyId 1937918270322737572 --Credentials:HostId syn-prd-ava-unattended-3e5ed0ea-763f-442b-b33d-60ffd6847cbd --Communication:IpcFolderPath "C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\externalmodules\AntivirusModule\IPC" --Authentication:TokenFilePath "C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\externalmodules\token.txt" --ZeroTrust:ReferencePublicKeyHash 79297ed57ba94f2dde0d121e431d4ed4d8f143a35e3f89ed9b9c2fc1c3015ae8 --Native:Version 1.15.2.3338
            3⤵
            • Executes dropped EXE
            • Drops file in System32 directory
            • Modifies data under HKEY_USERS
            • Suspicious use of AdjustPrivilegeToken
            PID:1664
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
        1⤵
        • Drops file in Windows directory
        • Checks SCSI registry key(s)
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4232
        • C:\Windows\system32\DrvInst.exe
          DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{bed90794-43cf-2c47-b32e-4003563ce77c}\g2rvdd.inf" "9" "415529917" "0000000000000148" "WinSta0\Default" "0000000000000158" "208" "C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\x64"
          2⤵
          • Drops file in System32 directory
          • Drops file in Windows directory
          • Checks SCSI registry key(s)
          • Modifies data under HKEY_USERS
          PID:1980
      • C:\Windows\system32\sc.exe
        C:\Windows\system32\sc.exe start GoToResolve_1937918270322737572
        1⤵
        • Launches sc.exe
        PID:4672

      Network

      • flag-us
        DNS
        8.8.8.8.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        8.8.8.8.in-addr.arpa
        IN PTR
        Response
        8.8.8.8.in-addr.arpa
        IN PTR
        dnsgoogle
      • flag-us
        DNS
        232.168.11.51.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        232.168.11.51.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        91.90.14.23.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        91.90.14.23.in-addr.arpa
        IN PTR
        Response
        91.90.14.23.in-addr.arpa
        IN PTR
        a23-14-90-91deploystaticakamaitechnologiescom
      • flag-us
        DNS
        0.159.190.20.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        0.159.190.20.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        dumpster.console.gotoresolve.com
        GoToResolveUnattended.exe
        Remote address:
        8.8.8.8:53
        Request
        dumpster.console.gotoresolve.com
        IN A
        Response
        dumpster.console.gotoresolve.com
        IN A
        35.157.186.199
        dumpster.console.gotoresolve.com
        IN A
        18.194.5.184
      • flag-us
        DNS
        26.35.223.20.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        26.35.223.20.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        devices.console.gotoresolve.com
        GoToResolveUnattended.exe
        Remote address:
        8.8.8.8:53
        Request
        devices.console.gotoresolve.com
        IN A
        Response
        devices.console.gotoresolve.com
        IN A
        3.224.59.159
        devices.console.gotoresolve.com
        IN A
        52.5.186.44
        devices.console.gotoresolve.com
        IN A
        34.193.161.223
      • flag-us
        DNS
        ip.zscaler.com
        GoToResolveUnattended.exe
        Remote address:
        8.8.8.8:53
        Request
        ip.zscaler.com
        IN A
        Response
        ip.zscaler.com
        IN A
        165.225.4.122
        ip.zscaler.com
        IN A
        165.225.4.120
        ip.zscaler.com
        IN A
        165.225.244.120
      • flag-us
        DNS
        devices-iot.console.gotoresolve.com
        GoToResolveUnattended.exe
        Remote address:
        8.8.8.8:53
        Request
        devices-iot.console.gotoresolve.com
        IN A
        Response
        devices-iot.console.gotoresolve.com
        IN CNAME
        anofutxkwzrm2-ats.iot.us-east-1.amazonaws.com
        anofutxkwzrm2-ats.iot.us-east-1.amazonaws.com
        IN A
        54.243.5.228
        anofutxkwzrm2-ats.iot.us-east-1.amazonaws.com
        IN A
        52.6.195.5
        anofutxkwzrm2-ats.iot.us-east-1.amazonaws.com
        IN A
        54.172.5.229
        anofutxkwzrm2-ats.iot.us-east-1.amazonaws.com
        IN A
        52.54.139.17
        anofutxkwzrm2-ats.iot.us-east-1.amazonaws.com
        IN A
        54.152.76.135
        anofutxkwzrm2-ats.iot.us-east-1.amazonaws.com
        IN A
        54.160.24.106
        anofutxkwzrm2-ats.iot.us-east-1.amazonaws.com
        IN A
        54.173.243.251
        anofutxkwzrm2-ats.iot.us-east-1.amazonaws.com
        IN A
        52.87.34.145
      • flag-us
        DNS
        sessions.console.gotoresolve.com
        GoToResolveUnattended.exe
        Remote address:
        8.8.8.8:53
        Request
        sessions.console.gotoresolve.com
        IN A
        Response
        sessions.console.gotoresolve.com
        IN A
        3.67.114.44
        sessions.console.gotoresolve.com
        IN A
        52.57.212.200
      • flag-us
        DNS
        zerotrust.services.gotoresolve.com
        GoToResolveUnattended.exe
        Remote address:
        8.8.8.8:53
        Request
        zerotrust.services.gotoresolve.com
        IN A
        Response
        zerotrust.services.gotoresolve.com
        IN CNAME
        goto-resolve-zerotrust-prod.z01.azurefd.net
        goto-resolve-zerotrust-prod.z01.azurefd.net
        IN CNAME
        star-azurefd-prod.trafficmanager.net
        star-azurefd-prod.trafficmanager.net
        IN CNAME
        shed.dual-low.part-0036.t-0009.t-msedge.net
        shed.dual-low.part-0036.t-0009.t-msedge.net
        IN CNAME
        part-0036.t-0009.t-msedge.net
        part-0036.t-0009.t-msedge.net
        IN A
        13.107.246.64
        part-0036.t-0009.t-msedge.net
        IN A
        13.107.213.64
      • flag-us
        GET
        http://ip.zscaler.com/
        GoToResolveUnattended.exe
        Remote address:
        165.225.4.122:80
        Request
        GET / HTTP/1.1
        Host: ip.zscaler.com
        Content-Length: 0
        Connection: Keep-Alive
        Accept-Encoding: gzip, deflate
        Accept-Language: en-US,*
        User-Agent: Mozilla/5.0
        Response
        HTTP/1.1 502 Bad Gateway
        Server: nginx
        Date: Thu, 16 May 2024 16:04:56 GMT
        Content-Type: text/html
        Content-Length: 150
        Connection: keep-alive
        Strict-Transport-Security: max-age=63072000; includeSubDomains
        X-Frame-Options: SAMEORIGIN
      • flag-us
        DNS
        199.186.157.35.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        199.186.157.35.in-addr.arpa
        IN PTR
        Response
        199.186.157.35.in-addr.arpa
        IN PTR
        ec2-35-157-186-199 eu-central-1compute amazonawscom
      • flag-us
        DNS
        228.5.243.54.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        228.5.243.54.in-addr.arpa
        IN PTR
        Response
        228.5.243.54.in-addr.arpa
        IN PTR
        ec2-54-243-5-228 compute-1 amazonawscom
      • flag-us
        DNS
        64.246.107.13.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        64.246.107.13.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        44.114.67.3.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        44.114.67.3.in-addr.arpa
        IN PTR
        Response
        44.114.67.3.in-addr.arpa
        IN PTR
        ec2-3-67-114-44 eu-central-1compute amazonawscom
      • flag-us
        DNS
        159.59.224.3.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        159.59.224.3.in-addr.arpa
        IN PTR
        Response
        159.59.224.3.in-addr.arpa
        IN PTR
        ec2-3-224-59-159 compute-1 amazonawscom
      • flag-us
        DNS
        122.4.225.165.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        122.4.225.165.in-addr.arpa
        IN PTR
        Response
      • flag-nl
        GET
        https://www.bing.com/th?id=OADD2.10239359720591_10PHTLBML42K6TRZO&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=24&h=24&dynsize=1&qlt=90
        Remote address:
        23.62.61.144:443
        Request
        GET /th?id=OADD2.10239359720591_10PHTLBML42K6TRZO&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=24&h=24&dynsize=1&qlt=90 HTTP/2.0
        host: www.bing.com
        accept: */*
        accept-encoding: gzip, deflate, br
        user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
        Response
        HTTP/2.0 200
        cache-control: public, max-age=2592000
        content-type: image/png
        access-control-allow-origin: *
        access-control-allow-headers: *
        access-control-allow-methods: GET, POST, OPTIONS
        timing-allow-origin: *
        report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QWthbWFp"}]}
        nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
        content-length: 1107
        date: Thu, 16 May 2024 16:05:18 GMT
        alt-svc: h3=":443"; ma=93600
        x-cdn-traceid: 0.8c3d3e17.1715875518.1e91b830
      • flag-us
        DNS
        144.61.62.23.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        144.61.62.23.in-addr.arpa
        IN PTR
        Response
        144.61.62.23.in-addr.arpa
        IN PTR
        a23-62-61-144deploystaticakamaitechnologiescom
      • flag-us
        GET
        http://ip.zscaler.com/
        GoToResolveUnattended.exe
        Remote address:
        165.225.4.122:80
        Request
        GET / HTTP/1.1
        Host: ip.zscaler.com
        Content-Length: 0
        Connection: Keep-Alive
        Accept-Encoding: gzip, deflate
        Accept-Language: en-US,*
        User-Agent: Mozilla/5.0
      • flag-us
        DNS
        50.23.12.20.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        50.23.12.20.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        171.39.242.20.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        171.39.242.20.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        cdn.console.gotoresolve.com
        GoToResolveUnattended.exe
        Remote address:
        8.8.8.8:53
        Request
        cdn.console.gotoresolve.com
        IN A
        Response
        cdn.console.gotoresolve.com
        IN A
        18.245.162.101
        cdn.console.gotoresolve.com
        IN A
        18.245.162.119
        cdn.console.gotoresolve.com
        IN A
        18.245.162.112
        cdn.console.gotoresolve.com
        IN A
        18.245.162.117
      • flag-us
        DNS
        101.162.245.18.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        101.162.245.18.in-addr.arpa
        IN PTR
        Response
        101.162.245.18.in-addr.arpa
        IN PTR
        server-18-245-162-101lhr5r cloudfrontnet
      • flag-us
        DNS
        101.162.245.18.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        101.162.245.18.in-addr.arpa
        IN PTR
      • flag-us
        DNS
        104.219.191.52.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        104.219.191.52.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        139.53.16.96.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        139.53.16.96.in-addr.arpa
        IN PTR
        Response
        139.53.16.96.in-addr.arpa
        IN PTR
        a96-16-53-139deploystaticakamaitechnologiescom
      • flag-us
        DNS
        240.221.184.93.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        240.221.184.93.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        alerts-binaries.services.gotoresolve.com
        GoToResolveUnattended.exe
        Remote address:
        8.8.8.8:53
        Request
        alerts-binaries.services.gotoresolve.com
        IN A
        Response
        alerts-binaries.services.gotoresolve.com
        IN CNAME
        goto-resolve-alerts-monitor-prod.azureedge.net
        goto-resolve-alerts-monitor-prod.azureedge.net
        IN CNAME
        goto-resolve-alerts-monitor-prod.afd.azureedge.net
        goto-resolve-alerts-monitor-prod.afd.azureedge.net
        IN CNAME
        azureedge-t-prod.trafficmanager.net
        azureedge-t-prod.trafficmanager.net
        IN CNAME
        shed.dual-low.part-0036.t-0009.t-msedge.net
        shed.dual-low.part-0036.t-0009.t-msedge.net
        IN CNAME
        part-0036.t-0009.t-msedge.net
        part-0036.t-0009.t-msedge.net
        IN A
        13.107.246.64
        part-0036.t-0009.t-msedge.net
        IN A
        13.107.213.64
      • flag-us
        DNS
        patchmanagement-binaries.services.gotoresolve.com
        GoToResolveUnattended.exe
        Remote address:
        8.8.8.8:53
        Request
        patchmanagement-binaries.services.gotoresolve.com
        IN A
        Response
        patchmanagement-binaries.services.gotoresolve.com
        IN CNAME
        goto-resolve-patchmanagement-prod.azureedge.net
        goto-resolve-patchmanagement-prod.azureedge.net
        IN CNAME
        goto-resolve-patchmanagement-prod.afd.azureedge.net
        goto-resolve-patchmanagement-prod.afd.azureedge.net
        IN CNAME
        azureedge-t-prod.trafficmanager.net
        azureedge-t-prod.trafficmanager.net
        IN CNAME
        shed.dual-low.part-0036.t-0009.t-msedge.net
        shed.dual-low.part-0036.t-0009.t-msedge.net
        IN CNAME
        part-0036.t-0009.t-msedge.net
        part-0036.t-0009.t-msedge.net
        IN A
        13.107.246.64
        part-0036.t-0009.t-msedge.net
        IN A
        13.107.213.64
      • flag-us
        DNS
        antivirus-binaries.services.gotoresolve.com
        GoToResolveUnattended.exe
        Remote address:
        8.8.8.8:53
        Request
        antivirus-binaries.services.gotoresolve.com
        IN A
        Response
        antivirus-binaries.services.gotoresolve.com
        IN CNAME
        goto-resolve-antivirus-worker-prod.azureedge.net
        goto-resolve-antivirus-worker-prod.azureedge.net
        IN CNAME
        goto-resolve-antivirus-worker-prod.afd.azureedge.net
        goto-resolve-antivirus-worker-prod.afd.azureedge.net
        IN CNAME
        azureedge-t-prod.trafficmanager.net
        azureedge-t-prod.trafficmanager.net
        IN CNAME
        shed.dual-low.part-0036.t-0009.t-msedge.net
        shed.dual-low.part-0036.t-0009.t-msedge.net
        IN CNAME
        part-0036.t-0009.t-msedge.net
        part-0036.t-0009.t-msedge.net
        IN A
        13.107.246.64
        part-0036.t-0009.t-msedge.net
        IN A
        13.107.213.64
      • flag-us
        DNS
        remoteexecution-binaries.services.gotoresolve.com
        GoToResolveUnattended.exe
        Remote address:
        8.8.8.8:53
        Request
        remoteexecution-binaries.services.gotoresolve.com
        IN A
        Response
        remoteexecution-binaries.services.gotoresolve.com
        IN CNAME
        goto-remoteexecution-prod.azureedge.net
        goto-remoteexecution-prod.azureedge.net
        IN CNAME
        goto-remoteexecution-prod.afd.azureedge.net
        goto-remoteexecution-prod.afd.azureedge.net
        IN CNAME
        azureedge-t-prod.trafficmanager.net
        azureedge-t-prod.trafficmanager.net
        IN CNAME
        shed.dual-low.part-0036.t-0009.t-msedge.net
        shed.dual-low.part-0036.t-0009.t-msedge.net
        IN CNAME
        part-0036.t-0009.t-msedge.net
        part-0036.t-0009.t-msedge.net
        IN A
        13.107.246.64
        part-0036.t-0009.t-msedge.net
        IN A
        13.107.213.64
      • flag-us
        DNS
        goto-resolve-antivirus-worker-prod.azureedge.net
        GoToResolveUnattended.exe
        Remote address:
        8.8.8.8:53
        Request
        goto-resolve-antivirus-worker-prod.azureedge.net
        IN A
        Response
        goto-resolve-antivirus-worker-prod.azureedge.net
        IN CNAME
        goto-resolve-antivirus-worker-prod.afd.azureedge.net
        goto-resolve-antivirus-worker-prod.afd.azureedge.net
        IN CNAME
        azureedge-t-prod.trafficmanager.net
        azureedge-t-prod.trafficmanager.net
        IN CNAME
        shed.dual-low.part-0036.t-0009.t-msedge.net
        shed.dual-low.part-0036.t-0009.t-msedge.net
        IN CNAME
        part-0036.t-0009.t-msedge.net
        part-0036.t-0009.t-msedge.net
        IN A
        13.107.246.64
        part-0036.t-0009.t-msedge.net
        IN A
        13.107.213.64
      • flag-us
        DNS
        goto-resolve-alerts-monitor-prod.azureedge.net
        GoToResolveUnattended.exe
        Remote address:
        8.8.8.8:53
        Request
        goto-resolve-alerts-monitor-prod.azureedge.net
        IN A
        Response
        goto-resolve-alerts-monitor-prod.azureedge.net
        IN CNAME
        goto-resolve-alerts-monitor-prod.afd.azureedge.net
        goto-resolve-alerts-monitor-prod.afd.azureedge.net
        IN CNAME
        azureedge-t-prod.trafficmanager.net
        azureedge-t-prod.trafficmanager.net
        IN CNAME
        shed.dual-low.part-0036.t-0009.t-msedge.net
        shed.dual-low.part-0036.t-0009.t-msedge.net
        IN CNAME
        part-0036.t-0009.t-msedge.net
        part-0036.t-0009.t-msedge.net
        IN A
        13.107.246.64
        part-0036.t-0009.t-msedge.net
        IN A
        13.107.213.64
      • flag-us
        DNS
        dd-pipeline.console.gotoresolve.com
        GoTo.Resolve.DeviceData.App.exe
        Remote address:
        8.8.8.8:53
        Request
        dd-pipeline.console.gotoresolve.com
        IN A
        Response
        dd-pipeline.console.gotoresolve.com
        IN A
        44.196.136.97
        dd-pipeline.console.gotoresolve.com
        IN A
        52.206.250.163
        dd-pipeline.console.gotoresolve.com
        IN A
        54.92.170.80
      • flag-us
        DNS
        97.136.196.44.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        97.136.196.44.in-addr.arpa
        IN PTR
        Response
        97.136.196.44.in-addr.arpa
        IN PTR
        ec2-44-196-136-97 compute-1 amazonawscom
      • flag-us
        DNS
        westeurope.livediagnostics.monitor.azure.com
        GoTo.Resolve.Antivirus.App.exe
        Remote address:
        8.8.8.8:53
        Request
        westeurope.livediagnostics.monitor.azure.com
        IN A
        Response
        westeurope.livediagnostics.monitor.azure.com
        IN CNAME
        westeurope.livediagnostics.privatelink.monitor.azure.com
        westeurope.livediagnostics.privatelink.monitor.azure.com
        IN CNAME
        stamp1-westeurope.quickpulse.prod.applicationinsights.trafficmanager.net
        stamp1-westeurope.quickpulse.prod.applicationinsights.trafficmanager.net
        IN A
        40.113.178.33
      • flag-nl
        POST
        https://westeurope.livediagnostics.monitor.azure.com/QuickPulseService.svc/ping?ikey=19dca493-94b2-44d3-81d6-7b81beda4931
        GoTo.Resolve.Alerts.Monitor.App.exe
        Remote address:
        40.113.178.33:443
        Request
        POST /QuickPulseService.svc/ping?ikey=19dca493-94b2-44d3-81d6-7b81beda4931 HTTP/1.1
        Host: westeurope.livediagnostics.monitor.azure.com
        x-ms-qps-transmission-time: 638514723789241078
        x-ms-qps-configuration-etag:
        x-ms-qps-auth-api-key:
        x-ms-qps-auth-app-id:
        x-ms-qps-auth-status:
        x-ms-qps-auth-token-expiry:
        x-ms-qps-auth-token-signature:
        x-ms-qps-auth-token-signature-alg:
        x-ms-qps-instance-name: Objiyuie
        x-ms-qps-stream-id: 1ae0f53efd004792a62c9ca7427b941a
        x-ms-qps-machine-name: OBJIYUIE
        x-ms-qps-role-name:
        x-ms-qps-invariant-version: 5
        Content-Length: 322
        Response
        HTTP/1.1 200 OK
        Server: Microsoft-IIS/10.0
        x-ms-qps-subscribed: false
        Request-Context: appId=cid-v1:07ab024e-cb19-453f-9771-8b09429cc02d
        Access-Control-Expose-Headers: Request-Context
        X-Powered-By: ASP.NET
        Strict-Transport-Security: max-age=31536000; includeSubDomains
        X-Content-Type-Options: nosniff
        Date: Thu, 16 May 2024 16:06:23 GMT
        Content-Length: 0
      • flag-us
        DNS
        33.178.113.40.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        33.178.113.40.in-addr.arpa
        IN PTR
        Response
      • flag-nl
        POST
        https://westeurope.livediagnostics.monitor.azure.com/QuickPulseService.svc/ping?ikey=19dca493-94b2-44d3-81d6-7b81beda4931
        GoTo.Resolve.Alerts.Monitor.App.exe
        Remote address:
        40.113.178.33:443
        Request
        POST /QuickPulseService.svc/ping?ikey=19dca493-94b2-44d3-81d6-7b81beda4931 HTTP/1.1
        Host: westeurope.livediagnostics.monitor.azure.com
        x-ms-qps-transmission-time: 638514723810630609
        x-ms-qps-configuration-etag:
        x-ms-qps-auth-api-key:
        x-ms-qps-auth-app-id:
        x-ms-qps-auth-status:
        x-ms-qps-auth-token-expiry:
        x-ms-qps-auth-token-signature:
        x-ms-qps-auth-token-signature-alg:
        x-ms-qps-instance-name: Objiyuie
        x-ms-qps-stream-id: ca605e6e89d14b7b95aa52a2fa92aa01
        x-ms-qps-machine-name: OBJIYUIE
        x-ms-qps-role-name:
        x-ms-qps-invariant-version: 5
        Content-Length: 322
        Response
        HTTP/1.1 200 OK
        Server: Microsoft-IIS/10.0
        x-ms-qps-subscribed: false
        Request-Context: appId=cid-v1:07ab024e-cb19-453f-9771-8b09429cc02d
        Access-Control-Expose-Headers: Request-Context
        X-Powered-By: ASP.NET
        Strict-Transport-Security: max-age=31536000; includeSubDomains
        X-Content-Type-Options: nosniff
        Date: Thu, 16 May 2024 16:06:23 GMT
        Content-Length: 0
      • flag-nl
        POST
        https://westeurope.livediagnostics.monitor.azure.com/QuickPulseService.svc/ping?ikey=19dca493-94b2-44d3-81d6-7b81beda4931
        GoTo.Resolve.Alerts.Monitor.App.exe
        Remote address:
        40.113.178.33:443
        Request
        POST /QuickPulseService.svc/ping?ikey=19dca493-94b2-44d3-81d6-7b81beda4931 HTTP/1.1
        Host: westeurope.livediagnostics.monitor.azure.com
        x-ms-qps-transmission-time: 638514723819230281
        x-ms-qps-configuration-etag:
        x-ms-qps-auth-api-key:
        x-ms-qps-auth-app-id:
        x-ms-qps-auth-status:
        x-ms-qps-auth-token-expiry:
        x-ms-qps-auth-token-signature:
        x-ms-qps-auth-token-signature-alg:
        x-ms-qps-instance-name: Objiyuie
        x-ms-qps-stream-id: 8b3287bd57654c4893dd60beebf74fbc
        x-ms-qps-machine-name: OBJIYUIE
        x-ms-qps-role-name:
        x-ms-qps-invariant-version: 5
        Content-Length: 322
        Response
        HTTP/1.1 200 OK
        Server: Microsoft-IIS/10.0
        x-ms-qps-subscribed: false
        Request-Context: appId=cid-v1:07ab024e-cb19-453f-9771-8b09429cc02d
        Access-Control-Expose-Headers: Request-Context
        X-Powered-By: ASP.NET
        Strict-Transport-Security: max-age=31536000; includeSubDomains
        X-Content-Type-Options: nosniff
        Date: Thu, 16 May 2024 16:06:24 GMT
        Content-Length: 0
      • flag-us
        DNS
        30.243.111.52.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        30.243.111.52.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        30.243.111.52.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        30.243.111.52.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        rt.services.visualstudio.com
        RemoteExecution.Runner.exe
        Remote address:
        8.8.8.8:53
        Request
        rt.services.visualstudio.com
        IN A
        Response
        rt.services.visualstudio.com
        IN CNAME
        rt.applicationinsights.microsoft.com
        rt.applicationinsights.microsoft.com
        IN CNAME
        live.monitor.azure.com
        live.monitor.azure.com
        IN CNAME
        live.privatelink.monitor.azure.com
        live.privatelink.monitor.azure.com
        IN CNAME
        quickpulse.prod.applicationinsights.trafficmanager.net
        quickpulse.prod.applicationinsights.trafficmanager.net
        IN A
        40.117.80.207
      • flag-us
        POST
        https://rt.services.visualstudio.com/QuickPulseService.svc/ping?ikey=e2939d3e-7996-4b20-98ee-1662e7d61a10
        GoTo.Resolve.PatchManagement.Client.exe
        Remote address:
        40.117.80.207:443
        Request
        POST /QuickPulseService.svc/ping?ikey=e2939d3e-7996-4b20-98ee-1662e7d61a10 HTTP/1.1
        Host: rt.services.visualstudio.com
        x-ms-qps-transmission-time: 638514723827660402
        x-ms-qps-configuration-etag:
        x-ms-qps-auth-api-key:
        x-ms-qps-auth-app-id:
        x-ms-qps-auth-status:
        x-ms-qps-auth-token-expiry:
        x-ms-qps-auth-token-signature:
        x-ms-qps-auth-token-signature-alg:
        x-ms-qps-instance-name: Objiyuie
        x-ms-qps-stream-id: 91a815aea5954b5ea441f690753579ff
        x-ms-qps-machine-name: OBJIYUIE
        x-ms-qps-role-name:
        x-ms-qps-invariant-version: 5
        Content-Length: 322
        Response
        HTTP/1.1 200 OK
        Server: Microsoft-IIS/10.0
        x-ms-qps-subscribed: false
        x-ms-qps-service-endpoint-redirect: https://eastus.livediagnostics.monitor.azure.com/QuickPulseService.svc
        x-ms-qps-service-endpoint-redirect-v2: https://eastus.livediagnostics.monitor.azure.com/QuickPulseService.svc
        Request-Context: appId=cid-v1:07ab024e-cb19-453f-9771-8b09429cc02d
        Access-Control-Expose-Headers: Request-Context
        X-Powered-By: ASP.NET
        Strict-Transport-Security: max-age=31536000; includeSubDomains
        X-Content-Type-Options: nosniff
        Date: Thu, 16 May 2024 16:06:24 GMT
        Content-Length: 0
      • flag-us
        POST
        https://rt.services.visualstudio.com/QuickPulseService.svc/ping?ikey=05f32870-1d12-4fa1-bbf4-dc8789800299
        RemoteExecution.Runner.exe
        Remote address:
        40.117.80.207:443
        Request
        POST /QuickPulseService.svc/ping?ikey=05f32870-1d12-4fa1-bbf4-dc8789800299 HTTP/1.1
        Host: rt.services.visualstudio.com
        x-ms-qps-transmission-time: 638514723829098934
        x-ms-qps-configuration-etag:
        x-ms-qps-auth-api-key:
        x-ms-qps-auth-app-id:
        x-ms-qps-auth-status:
        x-ms-qps-auth-token-expiry:
        x-ms-qps-auth-token-signature:
        x-ms-qps-auth-token-signature-alg:
        x-ms-qps-instance-name: Objiyuie
        x-ms-qps-stream-id: c6b3b9e9f7304e5fbc2b78bf2496d4fd
        x-ms-qps-machine-name: OBJIYUIE
        x-ms-qps-role-name:
        x-ms-qps-invariant-version: 5
        Content-Length: 322
        Response
        HTTP/1.1 200 OK
        Server: Microsoft-IIS/10.0
        x-ms-qps-subscribed: false
        Request-Context: appId=cid-v1:07ab024e-cb19-453f-9771-8b09429cc02d
        Access-Control-Expose-Headers: Request-Context
        X-Powered-By: ASP.NET
        Strict-Transport-Security: max-age=31536000; includeSubDomains
        X-Content-Type-Options: nosniff
        Date: Thu, 16 May 2024 16:06:24 GMT
        Content-Length: 0
      • flag-us
        POST
        https://rt.services.visualstudio.com/QuickPulseService.svc/ping?ikey=05f32870-1d12-4fa1-bbf4-dc8789800299
        RemoteExecution.Runner.exe
        Remote address:
        40.117.80.207:443
        Request
        POST /QuickPulseService.svc/ping?ikey=05f32870-1d12-4fa1-bbf4-dc8789800299 HTTP/1.1
        Host: rt.services.visualstudio.com
        x-ms-qps-transmission-time: 638514723879126589
        x-ms-qps-configuration-etag:
        x-ms-qps-auth-api-key:
        x-ms-qps-auth-app-id:
        x-ms-qps-auth-status:
        x-ms-qps-auth-token-expiry:
        x-ms-qps-auth-token-signature:
        x-ms-qps-auth-token-signature-alg:
        x-ms-qps-instance-name: Objiyuie
        x-ms-qps-stream-id: c6b3b9e9f7304e5fbc2b78bf2496d4fd
        x-ms-qps-machine-name: OBJIYUIE
        x-ms-qps-role-name:
        x-ms-qps-invariant-version: 5
        Content-Length: 322
        Response
        HTTP/1.1 200 OK
        Server: Microsoft-IIS/10.0
        x-ms-qps-subscribed: false
        Request-Context: appId=cid-v1:07ab024e-cb19-453f-9771-8b09429cc02d
        Access-Control-Expose-Headers: Request-Context
        X-Powered-By: ASP.NET
        Strict-Transport-Security: max-age=31536000; includeSubDomains
        X-Content-Type-Options: nosniff
        Date: Thu, 16 May 2024 16:06:29 GMT
        Content-Length: 0
      • flag-us
        POST
        https://rt.services.visualstudio.com/QuickPulseService.svc/ping?ikey=05f32870-1d12-4fa1-bbf4-dc8789800299
        RemoteExecution.Runner.exe
        Remote address:
        40.117.80.207:443
        Request
        POST /QuickPulseService.svc/ping?ikey=05f32870-1d12-4fa1-bbf4-dc8789800299 HTTP/1.1
        Host: rt.services.visualstudio.com
        x-ms-qps-transmission-time: 638514723929120112
        x-ms-qps-configuration-etag:
        x-ms-qps-auth-api-key:
        x-ms-qps-auth-app-id:
        x-ms-qps-auth-status:
        x-ms-qps-auth-token-expiry:
        x-ms-qps-auth-token-signature:
        x-ms-qps-auth-token-signature-alg:
        x-ms-qps-instance-name: Objiyuie
        x-ms-qps-stream-id: c6b3b9e9f7304e5fbc2b78bf2496d4fd
        x-ms-qps-machine-name: OBJIYUIE
        x-ms-qps-role-name:
        x-ms-qps-invariant-version: 5
        Content-Length: 322
        Response
        HTTP/1.1 200 OK
        Server: Microsoft-IIS/10.0
        x-ms-qps-subscribed: false
        Request-Context: appId=cid-v1:07ab024e-cb19-453f-9771-8b09429cc02d
        Access-Control-Expose-Headers: Request-Context
        X-Powered-By: ASP.NET
        Strict-Transport-Security: max-age=31536000; includeSubDomains
        X-Content-Type-Options: nosniff
        Date: Thu, 16 May 2024 16:06:34 GMT
        Content-Length: 0
      • flag-us
        POST
        https://rt.services.visualstudio.com/QuickPulseService.svc/ping?ikey=05f32870-1d12-4fa1-bbf4-dc8789800299
        RemoteExecution.Runner.exe
        Remote address:
        40.117.80.207:443
        Request
        POST /QuickPulseService.svc/ping?ikey=05f32870-1d12-4fa1-bbf4-dc8789800299 HTTP/1.1
        Host: rt.services.visualstudio.com
        x-ms-qps-transmission-time: 638514723979116998
        x-ms-qps-configuration-etag:
        x-ms-qps-auth-api-key:
        x-ms-qps-auth-app-id:
        x-ms-qps-auth-status:
        x-ms-qps-auth-token-expiry:
        x-ms-qps-auth-token-signature:
        x-ms-qps-auth-token-signature-alg:
        x-ms-qps-instance-name: Objiyuie
        x-ms-qps-stream-id: c6b3b9e9f7304e5fbc2b78bf2496d4fd
        x-ms-qps-machine-name: OBJIYUIE
        x-ms-qps-role-name:
        x-ms-qps-invariant-version: 5
        Content-Length: 322
        Response
        HTTP/1.1 200 OK
        Server: Microsoft-IIS/10.0
        x-ms-qps-subscribed: false
        Request-Context: appId=cid-v1:07ab024e-cb19-453f-9771-8b09429cc02d
        Access-Control-Expose-Headers: Request-Context
        X-Powered-By: ASP.NET
        Strict-Transport-Security: max-age=31536000; includeSubDomains
        X-Content-Type-Options: nosniff
        Date: Thu, 16 May 2024 16:06:39 GMT
        Content-Length: 0
      • flag-us
        POST
        https://rt.services.visualstudio.com/QuickPulseService.svc/ping?ikey=05f32870-1d12-4fa1-bbf4-dc8789800299
        RemoteExecution.Runner.exe
        Remote address:
        40.117.80.207:443
        Request
        POST /QuickPulseService.svc/ping?ikey=05f32870-1d12-4fa1-bbf4-dc8789800299 HTTP/1.1
        Host: rt.services.visualstudio.com
        x-ms-qps-transmission-time: 638514724029118315
        x-ms-qps-configuration-etag:
        x-ms-qps-auth-api-key:
        x-ms-qps-auth-app-id:
        x-ms-qps-auth-status:
        x-ms-qps-auth-token-expiry:
        x-ms-qps-auth-token-signature:
        x-ms-qps-auth-token-signature-alg:
        x-ms-qps-instance-name: Objiyuie
        x-ms-qps-stream-id: c6b3b9e9f7304e5fbc2b78bf2496d4fd
        x-ms-qps-machine-name: OBJIYUIE
        x-ms-qps-role-name:
        x-ms-qps-invariant-version: 5
        Content-Length: 322
        Response
        HTTP/1.1 200 OK
        Server: Microsoft-IIS/10.0
        x-ms-qps-subscribed: false
        Request-Context: appId=cid-v1:07ab024e-cb19-453f-9771-8b09429cc02d
        Access-Control-Expose-Headers: Request-Context
        X-Powered-By: ASP.NET
        Strict-Transport-Security: max-age=31536000; includeSubDomains
        X-Content-Type-Options: nosniff
        Date: Thu, 16 May 2024 16:06:44 GMT
        Content-Length: 0
      • flag-us
        POST
        https://rt.services.visualstudio.com/QuickPulseService.svc/ping?ikey=05f32870-1d12-4fa1-bbf4-dc8789800299
        RemoteExecution.Runner.exe
        Remote address:
        40.117.80.207:443
        Request
        POST /QuickPulseService.svc/ping?ikey=05f32870-1d12-4fa1-bbf4-dc8789800299 HTTP/1.1
        Host: rt.services.visualstudio.com
        x-ms-qps-transmission-time: 638514724079120698
        x-ms-qps-configuration-etag:
        x-ms-qps-auth-api-key:
        x-ms-qps-auth-app-id:
        x-ms-qps-auth-status:
        x-ms-qps-auth-token-expiry:
        x-ms-qps-auth-token-signature:
        x-ms-qps-auth-token-signature-alg:
        x-ms-qps-instance-name: Objiyuie
        x-ms-qps-stream-id: c6b3b9e9f7304e5fbc2b78bf2496d4fd
        x-ms-qps-machine-name: OBJIYUIE
        x-ms-qps-role-name:
        x-ms-qps-invariant-version: 5
        Content-Length: 322
        Response
        HTTP/1.1 200 OK
        Server: Microsoft-IIS/10.0
        x-ms-qps-subscribed: false
        Request-Context: appId=cid-v1:07ab024e-cb19-453f-9771-8b09429cc02d
        Access-Control-Expose-Headers: Request-Context
        X-Powered-By: ASP.NET
        Strict-Transport-Security: max-age=31536000; includeSubDomains
        X-Content-Type-Options: nosniff
        Date: Thu, 16 May 2024 16:06:49 GMT
        Content-Length: 0
      • flag-us
        POST
        https://rt.services.visualstudio.com/QuickPulseService.svc/ping?ikey=05f32870-1d12-4fa1-bbf4-dc8789800299
        RemoteExecution.Runner.exe
        Remote address:
        40.117.80.207:443
        Request
        POST /QuickPulseService.svc/ping?ikey=05f32870-1d12-4fa1-bbf4-dc8789800299 HTTP/1.1
        Host: rt.services.visualstudio.com
        x-ms-qps-transmission-time: 638514724129121724
        x-ms-qps-configuration-etag:
        x-ms-qps-auth-api-key:
        x-ms-qps-auth-app-id:
        x-ms-qps-auth-status:
        x-ms-qps-auth-token-expiry:
        x-ms-qps-auth-token-signature:
        x-ms-qps-auth-token-signature-alg:
        x-ms-qps-instance-name: Objiyuie
        x-ms-qps-stream-id: c6b3b9e9f7304e5fbc2b78bf2496d4fd
        x-ms-qps-machine-name: OBJIYUIE
        x-ms-qps-role-name:
        x-ms-qps-invariant-version: 5
        Content-Length: 322
        Response
        HTTP/1.1 200 OK
        Server: Microsoft-IIS/10.0
        x-ms-qps-subscribed: false
        Request-Context: appId=cid-v1:07ab024e-cb19-453f-9771-8b09429cc02d
        Access-Control-Expose-Headers: Request-Context
        X-Powered-By: ASP.NET
        Strict-Transport-Security: max-age=31536000; includeSubDomains
        X-Content-Type-Options: nosniff
        Date: Thu, 16 May 2024 16:06:54 GMT
        Content-Length: 0
      • flag-us
        POST
        https://rt.services.visualstudio.com/QuickPulseService.svc/ping?ikey=05f32870-1d12-4fa1-bbf4-dc8789800299
        RemoteExecution.Runner.exe
        Remote address:
        40.117.80.207:443
        Request
        POST /QuickPulseService.svc/ping?ikey=05f32870-1d12-4fa1-bbf4-dc8789800299 HTTP/1.1
        Host: rt.services.visualstudio.com
        x-ms-qps-transmission-time: 638514724179122246
        x-ms-qps-configuration-etag:
        x-ms-qps-auth-api-key:
        x-ms-qps-auth-app-id:
        x-ms-qps-auth-status:
        x-ms-qps-auth-token-expiry:
        x-ms-qps-auth-token-signature:
        x-ms-qps-auth-token-signature-alg:
        x-ms-qps-instance-name: Objiyuie
        x-ms-qps-stream-id: c6b3b9e9f7304e5fbc2b78bf2496d4fd
        x-ms-qps-machine-name: OBJIYUIE
        x-ms-qps-role-name:
        x-ms-qps-invariant-version: 5
        Content-Length: 322
        Response
        HTTP/1.1 200 OK
        Server: Microsoft-IIS/10.0
        x-ms-qps-subscribed: false
        Request-Context: appId=cid-v1:07ab024e-cb19-453f-9771-8b09429cc02d
        Access-Control-Expose-Headers: Request-Context
        X-Powered-By: ASP.NET
        Strict-Transport-Security: max-age=31536000; includeSubDomains
        X-Content-Type-Options: nosniff
        Date: Thu, 16 May 2024 16:06:59 GMT
        Content-Length: 0
      • flag-us
        POST
        https://rt.services.visualstudio.com/QuickPulseService.svc/ping?ikey=05f32870-1d12-4fa1-bbf4-dc8789800299
        RemoteExecution.Runner.exe
        Remote address:
        40.117.80.207:443
        Request
        POST /QuickPulseService.svc/ping?ikey=05f32870-1d12-4fa1-bbf4-dc8789800299 HTTP/1.1
        Host: rt.services.visualstudio.com
        x-ms-qps-transmission-time: 638514724229207346
        x-ms-qps-configuration-etag:
        x-ms-qps-auth-api-key:
        x-ms-qps-auth-app-id:
        x-ms-qps-auth-status:
        x-ms-qps-auth-token-expiry:
        x-ms-qps-auth-token-signature:
        x-ms-qps-auth-token-signature-alg:
        x-ms-qps-instance-name: Objiyuie
        x-ms-qps-stream-id: c6b3b9e9f7304e5fbc2b78bf2496d4fd
        x-ms-qps-machine-name: OBJIYUIE
        x-ms-qps-role-name:
        x-ms-qps-invariant-version: 5
        Content-Length: 322
        Response
        HTTP/1.1 200 OK
        Server: Microsoft-IIS/10.0
        x-ms-qps-subscribed: false
        Request-Context: appId=cid-v1:07ab024e-cb19-453f-9771-8b09429cc02d
        Access-Control-Expose-Headers: Request-Context
        X-Powered-By: ASP.NET
        Strict-Transport-Security: max-age=31536000; includeSubDomains
        X-Content-Type-Options: nosniff
        Date: Thu, 16 May 2024 16:07:04 GMT
        Content-Length: 0
      • flag-us
        POST
        https://rt.services.visualstudio.com/QuickPulseService.svc/ping?ikey=05f32870-1d12-4fa1-bbf4-dc8789800299
        RemoteExecution.Runner.exe
        Remote address:
        40.117.80.207:443
        Request
        POST /QuickPulseService.svc/ping?ikey=05f32870-1d12-4fa1-bbf4-dc8789800299 HTTP/1.1
        Host: rt.services.visualstudio.com
        x-ms-qps-transmission-time: 638514724279206911
        x-ms-qps-configuration-etag:
        x-ms-qps-auth-api-key:
        x-ms-qps-auth-app-id:
        x-ms-qps-auth-status:
        x-ms-qps-auth-token-expiry:
        x-ms-qps-auth-token-signature:
        x-ms-qps-auth-token-signature-alg:
        x-ms-qps-instance-name: Objiyuie
        x-ms-qps-stream-id: c6b3b9e9f7304e5fbc2b78bf2496d4fd
        x-ms-qps-machine-name: OBJIYUIE
        x-ms-qps-role-name:
        x-ms-qps-invariant-version: 5
        Content-Length: 322
        Response
        HTTP/1.1 200 OK
        Server: Microsoft-IIS/10.0
        x-ms-qps-subscribed: false
        Request-Context: appId=cid-v1:07ab024e-cb19-453f-9771-8b09429cc02d
        Access-Control-Expose-Headers: Request-Context
        X-Powered-By: ASP.NET
        Strict-Transport-Security: max-age=31536000; includeSubDomains
        X-Content-Type-Options: nosniff
        Date: Thu, 16 May 2024 16:07:09 GMT
        Content-Length: 0
      • flag-us
        POST
        https://rt.services.visualstudio.com/QuickPulseService.svc/ping?ikey=05f32870-1d12-4fa1-bbf4-dc8789800299
        RemoteExecution.Runner.exe
        Remote address:
        40.117.80.207:443
        Request
        POST /QuickPulseService.svc/ping?ikey=05f32870-1d12-4fa1-bbf4-dc8789800299 HTTP/1.1
        Host: rt.services.visualstudio.com
        x-ms-qps-transmission-time: 638514724329205692
        x-ms-qps-configuration-etag:
        x-ms-qps-auth-api-key:
        x-ms-qps-auth-app-id:
        x-ms-qps-auth-status:
        x-ms-qps-auth-token-expiry:
        x-ms-qps-auth-token-signature:
        x-ms-qps-auth-token-signature-alg:
        x-ms-qps-instance-name: Objiyuie
        x-ms-qps-stream-id: c6b3b9e9f7304e5fbc2b78bf2496d4fd
        x-ms-qps-machine-name: OBJIYUIE
        x-ms-qps-role-name:
        x-ms-qps-invariant-version: 5
        Content-Length: 322
        Response
        HTTP/1.1 200 OK
        Server: Microsoft-IIS/10.0
        x-ms-qps-subscribed: false
        Request-Context: appId=cid-v1:07ab024e-cb19-453f-9771-8b09429cc02d
        Access-Control-Expose-Headers: Request-Context
        X-Powered-By: ASP.NET
        Strict-Transport-Security: max-age=31536000; includeSubDomains
        X-Content-Type-Options: nosniff
        Date: Thu, 16 May 2024 16:07:14 GMT
        Content-Length: 0
      • flag-us
        POST
        https://rt.services.visualstudio.com/QuickPulseService.svc/ping?ikey=05f32870-1d12-4fa1-bbf4-dc8789800299
        RemoteExecution.Runner.exe
        Remote address:
        40.117.80.207:443
        Request
        POST /QuickPulseService.svc/ping?ikey=05f32870-1d12-4fa1-bbf4-dc8789800299 HTTP/1.1
        Host: rt.services.visualstudio.com
        x-ms-qps-transmission-time: 638514724379205720
        x-ms-qps-configuration-etag:
        x-ms-qps-auth-api-key:
        x-ms-qps-auth-app-id:
        x-ms-qps-auth-status:
        x-ms-qps-auth-token-expiry:
        x-ms-qps-auth-token-signature:
        x-ms-qps-auth-token-signature-alg:
        x-ms-qps-instance-name: Objiyuie
        x-ms-qps-stream-id: c6b3b9e9f7304e5fbc2b78bf2496d4fd
        x-ms-qps-machine-name: OBJIYUIE
        x-ms-qps-role-name:
        x-ms-qps-invariant-version: 5
        Content-Length: 322
        Response
        HTTP/1.1 200 OK
        Server: Microsoft-IIS/10.0
        x-ms-qps-subscribed: false
        Request-Context: appId=cid-v1:07ab024e-cb19-453f-9771-8b09429cc02d
        Access-Control-Expose-Headers: Request-Context
        X-Powered-By: ASP.NET
        Strict-Transport-Security: max-age=31536000; includeSubDomains
        X-Content-Type-Options: nosniff
        Date: Thu, 16 May 2024 16:07:19 GMT
        Content-Length: 0
      • flag-nl
        POST
        https://westeurope.livediagnostics.monitor.azure.com/QuickPulseService.svc/ping?ikey=19dca493-94b2-44d3-81d6-7b81beda4931
        GoTo.Resolve.Alerts.Monitor.App.exe
        Remote address:
        40.113.178.33:443
        Request
        POST /QuickPulseService.svc/ping?ikey=19dca493-94b2-44d3-81d6-7b81beda4931 HTTP/1.1
        Host: westeurope.livediagnostics.monitor.azure.com
        x-ms-qps-transmission-time: 638514723834405397
        x-ms-qps-configuration-etag:
        x-ms-qps-auth-api-key:
        x-ms-qps-auth-app-id:
        x-ms-qps-auth-status:
        x-ms-qps-auth-token-expiry:
        x-ms-qps-auth-token-signature:
        x-ms-qps-auth-token-signature-alg:
        x-ms-qps-instance-name: Objiyuie
        x-ms-qps-stream-id: 0313a4e3efe3410e9683b39b54758825
        x-ms-qps-machine-name: OBJIYUIE
        x-ms-qps-role-name:
        x-ms-qps-invariant-version: 5
        Content-Length: 322
        Response
        HTTP/1.1 200 OK
        Server: Microsoft-IIS/10.0
        x-ms-qps-subscribed: false
        Request-Context: appId=cid-v1:07ab024e-cb19-453f-9771-8b09429cc02d
        Access-Control-Expose-Headers: Request-Context
        X-Powered-By: ASP.NET
        Strict-Transport-Security: max-age=31536000; includeSubDomains
        X-Content-Type-Options: nosniff
        Date: Thu, 16 May 2024 16:06:24 GMT
        Content-Length: 0
      • flag-nl
        POST
        https://westeurope.livediagnostics.monitor.azure.com/QuickPulseService.svc/ping?ikey=19dca493-94b2-44d3-81d6-7b81beda4931
        GoTo.Resolve.Alerts.Monitor.App.exe
        Remote address:
        40.113.178.33:443
        Request
        POST /QuickPulseService.svc/ping?ikey=19dca493-94b2-44d3-81d6-7b81beda4931 HTTP/1.1
        Host: westeurope.livediagnostics.monitor.azure.com
        x-ms-qps-transmission-time: 638514723836495906
        x-ms-qps-configuration-etag:
        x-ms-qps-auth-api-key:
        x-ms-qps-auth-app-id:
        x-ms-qps-auth-status:
        x-ms-qps-auth-token-expiry:
        x-ms-qps-auth-token-signature:
        x-ms-qps-auth-token-signature-alg:
        x-ms-qps-instance-name: Objiyuie
        x-ms-qps-stream-id: 80c50e1f42c9456aa8b0ad8bb68c4254
        x-ms-qps-machine-name: OBJIYUIE
        x-ms-qps-role-name:
        x-ms-qps-invariant-version: 5
        Content-Length: 322
        Response
        HTTP/1.1 200 OK
        Server: Microsoft-IIS/10.0
        x-ms-qps-subscribed: false
        Request-Context: appId=cid-v1:07ab024e-cb19-453f-9771-8b09429cc02d
        Access-Control-Expose-Headers: Request-Context
        X-Powered-By: ASP.NET
        Strict-Transport-Security: max-age=31536000; includeSubDomains
        X-Content-Type-Options: nosniff
        Date: Thu, 16 May 2024 16:06:25 GMT
        Content-Length: 0
      • flag-nl
        POST
        https://westeurope.livediagnostics.monitor.azure.com/QuickPulseService.svc/ping?ikey=19dca493-94b2-44d3-81d6-7b81beda4931
        GoTo.Resolve.Alerts.Monitor.App.exe
        Remote address:
        40.113.178.33:443
        Request
        POST /QuickPulseService.svc/ping?ikey=19dca493-94b2-44d3-81d6-7b81beda4931 HTTP/1.1
        Host: westeurope.livediagnostics.monitor.azure.com
        x-ms-qps-transmission-time: 638514723840373144
        x-ms-qps-configuration-etag:
        x-ms-qps-auth-api-key:
        x-ms-qps-auth-app-id:
        x-ms-qps-auth-status:
        x-ms-qps-auth-token-expiry:
        x-ms-qps-auth-token-signature:
        x-ms-qps-auth-token-signature-alg:
        x-ms-qps-instance-name: Objiyuie
        x-ms-qps-stream-id: 11dbf0fa253e4257a5db2b3a99bdd2a2
        x-ms-qps-machine-name: OBJIYUIE
        x-ms-qps-role-name:
        x-ms-qps-invariant-version: 5
        Content-Length: 322
        Response
        HTTP/1.1 200 OK
        Server: Microsoft-IIS/10.0
        x-ms-qps-subscribed: false
        Request-Context: appId=cid-v1:07ab024e-cb19-453f-9771-8b09429cc02d
        Access-Control-Expose-Headers: Request-Context
        X-Powered-By: ASP.NET
        Strict-Transport-Security: max-age=31536000; includeSubDomains
        X-Content-Type-Options: nosniff
        Date: Thu, 16 May 2024 16:06:25 GMT
        Content-Length: 0
      • flag-us
        DNS
        207.80.117.40.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        207.80.117.40.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        patchmanagement-client-api.services.gotoresolve.com
        GoTo.Resolve.PatchManagement.Client.exe
        Remote address:
        8.8.8.8:53
        Request
        patchmanagement-client-api.services.gotoresolve.com
        IN A
        Response
        patchmanagement-client-api.services.gotoresolve.com
        IN CNAME
        goto-resolve-patchmanagement-client-api-prod-ahhnfueqf8fyayaf.z01.azurefd.net
        goto-resolve-patchmanagement-client-api-prod-ahhnfueqf8fyayaf.z01.azurefd.net
        IN CNAME
        star-azurefd-prod.trafficmanager.net
        star-azurefd-prod.trafficmanager.net
        IN CNAME
        shed.dual-low.part-0036.t-0009.t-msedge.net
        shed.dual-low.part-0036.t-0009.t-msedge.net
        IN CNAME
        part-0036.t-0009.t-msedge.net
        part-0036.t-0009.t-msedge.net
        IN A
        13.107.246.64
        part-0036.t-0009.t-msedge.net
        IN A
        13.107.213.64
      • flag-us
        DNS
        patchmanagement-client-api.services.gotoresolve.com
        GoTo.Resolve.PatchManagement.Client.exe
        Remote address:
        8.8.8.8:53
        Request
        patchmanagement-client-api.services.gotoresolve.com
        IN A
        Response
        patchmanagement-client-api.services.gotoresolve.com
        IN CNAME
        goto-resolve-patchmanagement-client-api-prod-ahhnfueqf8fyayaf.z01.azurefd.net
        goto-resolve-patchmanagement-client-api-prod-ahhnfueqf8fyayaf.z01.azurefd.net
        IN CNAME
        star-azurefd-prod.trafficmanager.net
        star-azurefd-prod.trafficmanager.net
        IN CNAME
        shed.dual-low.part-0036.t-0009.t-msedge.net
        shed.dual-low.part-0036.t-0009.t-msedge.net
        IN CNAME
        part-0036.t-0009.t-msedge.net
        part-0036.t-0009.t-msedge.net
        IN A
        13.107.246.64
        part-0036.t-0009.t-msedge.net
        IN A
        13.107.213.64
      • flag-us
        DNS
        dc.services.visualstudio.com
        GoTo.Resolve.PatchManagement.Client.exe
        Remote address:
        8.8.8.8:53
        Request
        dc.services.visualstudio.com
        IN A
        Response
        dc.services.visualstudio.com
        IN CNAME
        dc.applicationinsights.microsoft.com
        dc.applicationinsights.microsoft.com
        IN CNAME
        dc.applicationinsights.azure.com
        dc.applicationinsights.azure.com
        IN CNAME
        global.in.ai.monitor.azure.com
        global.in.ai.monitor.azure.com
        IN CNAME
        global.in.ai.privatelink.monitor.azure.com
        global.in.ai.privatelink.monitor.azure.com
        IN CNAME
        dc.trafficmanager.net
        dc.trafficmanager.net
        IN CNAME
        westeurope-global.in.applicationinsights.azure.com
        westeurope-global.in.applicationinsights.azure.com
        IN CNAME
        gig-ai-prod-westeurope-global.trafficmanager.net
        gig-ai-prod-westeurope-global.trafficmanager.net
        IN CNAME
        gig-ai-g-prod-westeurope-7-app-v4-tag.westeurope.cloudapp.azure.com
        gig-ai-g-prod-westeurope-7-app-v4-tag.westeurope.cloudapp.azure.com
        IN A
        20.50.88.235
      • flag-us
        DNS
        dc.services.visualstudio.com
        GoTo.Resolve.PatchManagement.Client.exe
        Remote address:
        8.8.8.8:53
        Request
        dc.services.visualstudio.com
        IN A
        Response
        dc.services.visualstudio.com
        IN CNAME
        dc.applicationinsights.microsoft.com
        dc.applicationinsights.microsoft.com
        IN CNAME
        dc.applicationinsights.azure.com
        dc.applicationinsights.azure.com
        IN CNAME
        global.in.ai.monitor.azure.com
        global.in.ai.monitor.azure.com
        IN CNAME
        global.in.ai.privatelink.monitor.azure.com
        global.in.ai.privatelink.monitor.azure.com
        IN CNAME
        dc.trafficmanager.net
        dc.trafficmanager.net
        IN CNAME
        westeurope-global.in.applicationinsights.azure.com
        westeurope-global.in.applicationinsights.azure.com
        IN CNAME
        gig-ai-prod-westeurope-global.trafficmanager.net
        gig-ai-prod-westeurope-global.trafficmanager.net
        IN CNAME
        gig-ai-g-prod-westeurope-4-app-v4-tag.westeurope.cloudapp.azure.com
        gig-ai-g-prod-westeurope-4-app-v4-tag.westeurope.cloudapp.azure.com
        IN A
        20.50.88.242
      • flag-nl
        GET
        https://dc.services.visualstudio.com/api/profiles/e2939d3e-7996-4b20-98ee-1662e7d61a10/appId
        GoTo.Resolve.PatchManagement.Client.exe
        Remote address:
        20.50.88.235:443
        Request
        GET /api/profiles/e2939d3e-7996-4b20-98ee-1662e7d61a10/appId HTTP/1.1
        Host: dc.services.visualstudio.com
        traceparent: 00-0e329565b73a80efd52d9d48ccff874a-0966bc47766435a5-00
        Response
        HTTP/1.1 200 OK
        Transfer-Encoding: chunked
        Content-Type: text/plain; charset=utf-8
        Server: Microsoft-HTTPAPI/2.0
        Strict-Transport-Security: max-age=31536000
        X-Content-Type-Options: nosniff
        Date: Thu, 16 May 2024 16:06:26 GMT
      • flag-us
        DNS
        fe2cr.update.microsoft.com
        Remote address:
        8.8.8.8:53
        Request
        fe2cr.update.microsoft.com
        IN A
        Response
        fe2cr.update.microsoft.com
        IN CNAME
        fe2cr.update.msft.com.trafficmanager.net
        fe2cr.update.msft.com.trafficmanager.net
        IN A
        40.83.50.89
        fe2cr.update.msft.com.trafficmanager.net
        IN A
        52.252.198.177
      • flag-us
        POST
        https://fe2cr.update.microsoft.com/v6/ClientWebService/client.asmx
        Remote address:
        40.83.50.89:443
        Request
        POST /v6/ClientWebService/client.asmx HTTP/2.0
        host: fe2cr.update.microsoft.com
        cache-control: no-cache
        pragma: no-cache
        content-type: text/xml; charset=utf-8
        accept-encoding: xpress
        user-agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.32
        soapaction: "http://www.microsoft.com/SoftwareDistribution/Server/ClientWebService/GetCookie"
        ms-cv: 1DyDkSOzt0+zySjf.1.0.0.2.1
        content-length: 864
        Response
        HTTP/2.0 200
        cache-control: private
        content-type: text/xml; charset=utf-8
        content-encoding: xpress
        vary: Accept-Encoding
        date: Thu, 16 May 2024 16:06:32 GMT
        content-length: 601
      • flag-us
        POST
        https://fe2cr.update.microsoft.com/v6/ClientWebService/client.asmx
        Remote address:
        40.83.50.89:443
        Request
        POST /v6/ClientWebService/client.asmx HTTP/2.0
        host: fe2cr.update.microsoft.com
        cache-control: no-cache
        pragma: no-cache
        content-type: text/xml; charset=utf-8
        accept-encoding: xpress
        user-agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.32
        soapaction: "http://www.microsoft.com/SoftwareDistribution/Server/ClientWebService/SyncUpdates"
        ms-cv: 1DyDkSOzt0+zySjf.1.0.0.2.2
        content-length: 16782
        Response
        HTTP/2.0 200
        cache-control: private
        content-type: text/xml; charset=utf-8
        content-encoding: xpress
        vary: Accept-Encoding
        date: Thu, 16 May 2024 16:06:33 GMT
        content-length: 11637
      • flag-us
        POST
        https://fe2cr.update.microsoft.com/v6/ClientWebService/client.asmx
        Remote address:
        40.83.50.89:443
        Request
        POST /v6/ClientWebService/client.asmx HTTP/2.0
        host: fe2cr.update.microsoft.com
        cache-control: no-cache
        pragma: no-cache
        content-type: text/xml; charset=utf-8
        accept-encoding: xpress
        user-agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.32
        soapaction: "http://www.microsoft.com/SoftwareDistribution/Server/ClientWebService/GetFileLocations"
        ms-cv: 1DyDkSOzt0+zySjf.1.0.0.2.3
        content-length: 642
        Response
        HTTP/2.0 200
        cache-control: private
        content-type: text/xml; charset=utf-8
        content-encoding: xpress
        vary: Accept-Encoding
        date: Thu, 16 May 2024 16:06:33 GMT
        content-length: 808
      • flag-us
        POST
        https://fe2cr.update.microsoft.com/v6/ClientWebService/client.asmx
        Remote address:
        40.83.50.89:443
        Request
        POST /v6/ClientWebService/client.asmx HTTP/2.0
        host: fe2cr.update.microsoft.com
        cache-control: no-cache
        pragma: no-cache
        content-type: text/xml; charset=utf-8
        accept-encoding: xpress
        user-agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.32
        soapaction: "http://www.microsoft.com/SoftwareDistribution/Server/ClientWebService/SyncUpdates"
        ms-cv: 1DyDkSOzt0+zySjf.1.0.0.2.4
        content-length: 16820
        Response
        HTTP/2.0 200
        cache-control: private
        content-type: text/xml; charset=utf-8
        content-encoding: xpress
        vary: Accept-Encoding
        date: Thu, 16 May 2024 16:06:33 GMT
        content-length: 2706
      • flag-us
        POST
        https://fe2cr.update.microsoft.com/v6/ClientWebService/client.asmx
        Remote address:
        40.83.50.89:443
        Request
        POST /v6/ClientWebService/client.asmx HTTP/2.0
        host: fe2cr.update.microsoft.com
        cache-control: no-cache
        pragma: no-cache
        content-type: text/xml; charset=utf-8
        accept-encoding: xpress
        user-agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.32
        soapaction: "http://www.microsoft.com/SoftwareDistribution/Server/ClientWebService/GetExtendedUpdateInfo"
        ms-cv: 1DyDkSOzt0+zySjf.1.0.0.2.5
        content-length: 1940
        Response
        HTTP/2.0 200
        cache-control: private
        content-type: text/xml; charset=utf-8
        content-encoding: xpress
        vary: Accept-Encoding
        date: Thu, 16 May 2024 16:06:36 GMT
      • flag-us
        POST
        https://fe2cr.update.microsoft.com/v6/ClientWebService/client.asmx
        Remote address:
        40.83.50.89:443
        Request
        POST /v6/ClientWebService/client.asmx HTTP/2.0
        host: fe2cr.update.microsoft.com
        cache-control: no-cache
        pragma: no-cache
        content-type: text/xml; charset=utf-8
        accept-encoding: xpress
        user-agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.32
        soapaction: "http://www.microsoft.com/SoftwareDistribution/Server/ClientWebService/GetExtendedUpdateInfo"
        ms-cv: 1DyDkSOzt0+zySjf.1.0.0.2.6
        content-length: 2013
        Response
        HTTP/2.0 200
        cache-control: private
        content-type: text/xml; charset=utf-8
        content-encoding: xpress
        vary: Accept-Encoding
        date: Thu, 16 May 2024 16:06:36 GMT
      • flag-us
        POST
        https://fe2cr.update.microsoft.com/v6/ClientWebService/client.asmx
        Remote address:
        40.83.50.89:443
        Request
        POST /v6/ClientWebService/client.asmx HTTP/2.0
        host: fe2cr.update.microsoft.com
        cache-control: no-cache
        pragma: no-cache
        content-type: text/xml; charset=utf-8
        accept-encoding: xpress
        user-agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.32
        soapaction: "http://www.microsoft.com/SoftwareDistribution/Server/ClientWebService/GetExtendedUpdateInfo"
        ms-cv: 1DyDkSOzt0+zySjf.1.0.0.2.7
        content-length: 1424
        Response
        HTTP/2.0 200
        cache-control: private
        content-type: text/xml; charset=utf-8
        content-encoding: xpress
        vary: Accept-Encoding
        date: Thu, 16 May 2024 16:06:37 GMT
      • flag-nl
        POST
        https://westeurope.livediagnostics.monitor.azure.com/QuickPulseService.svc/ping?ikey=d5c2d5c7-c95a-4316-9e4e-3f393c885a14
        GoTo.Resolve.Antivirus.App.exe
        Remote address:
        40.113.178.33:443
        Request
        POST /QuickPulseService.svc/ping?ikey=d5c2d5c7-c95a-4316-9e4e-3f393c885a14 HTTP/1.1
        Host: westeurope.livediagnostics.monitor.azure.com
        x-ms-qps-transmission-time: 638514723861034512
        x-ms-qps-configuration-etag:
        x-ms-qps-auth-api-key:
        x-ms-qps-auth-app-id:
        x-ms-qps-auth-status:
        x-ms-qps-auth-token-expiry:
        x-ms-qps-auth-token-signature:
        x-ms-qps-auth-token-signature-alg:
        x-ms-qps-instance-name: Objiyuie
        x-ms-qps-stream-id: 43030d1c3c064706b937f8dff77a4969
        x-ms-qps-machine-name: OBJIYUIE
        x-ms-qps-role-name:
        x-ms-qps-invariant-version: 5
        Content-Length: 322
        Response
        HTTP/1.1 400 Bad Request
        Content-Type: application/json; charset=utf-8
        Server: Microsoft-IIS/10.0
        Access-Control-Allow-Origin: *
        Request-Context: appId=cid-v1:07ab024e-cb19-453f-9771-8b09429cc02d
        Access-Control-Expose-Headers: Request-Context
        X-Powered-By: ASP.NET
        Strict-Transport-Security: max-age=31536000; includeSubDomains
        X-Content-Type-Options: nosniff
        Date: Thu, 16 May 2024 16:06:28 GMT
        Content-Length: 197
      • flag-us
        DNS
        235.88.50.20.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        235.88.50.20.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        235.88.50.20.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        235.88.50.20.in-addr.arpa
        IN PTR
      • flag-us
        DNS
        89.50.83.40.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        89.50.83.40.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        89.50.83.40.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        89.50.83.40.in-addr.arpa
        IN PTR
      • flag-us
        DNS
        eastus.livediagnostics.monitor.azure.com
        GoTo.Resolve.PatchManagement.Client.exe
        Remote address:
        8.8.8.8:53
        Request
        eastus.livediagnostics.monitor.azure.com
        IN A
        Response
        eastus.livediagnostics.monitor.azure.com
        IN CNAME
        eastus.livediagnostics.privatelink.monitor.azure.com
        eastus.livediagnostics.privatelink.monitor.azure.com
        IN CNAME
        stamp1-eastus.quickpulse.prod.applicationinsights.trafficmanager.net
        stamp1-eastus.quickpulse.prod.applicationinsights.trafficmanager.net
        IN A
        20.49.111.33
      • flag-us
        POST
        https://eastus.livediagnostics.monitor.azure.com/QuickPulseService.svc/ping?ikey=e2939d3e-7996-4b20-98ee-1662e7d61a10
        GoTo.Resolve.PatchManagement.Client.exe
        Remote address:
        20.49.111.33:443
        Request
        POST /QuickPulseService.svc/ping?ikey=e2939d3e-7996-4b20-98ee-1662e7d61a10 HTTP/1.1
        Host: eastus.livediagnostics.monitor.azure.com
        x-ms-qps-transmission-time: 638514723877561499
        x-ms-qps-configuration-etag:
        x-ms-qps-auth-api-key:
        x-ms-qps-auth-app-id:
        x-ms-qps-auth-status:
        x-ms-qps-auth-token-expiry:
        x-ms-qps-auth-token-signature:
        x-ms-qps-auth-token-signature-alg:
        x-ms-qps-instance-name: Objiyuie
        x-ms-qps-stream-id: 91a815aea5954b5ea441f690753579ff
        x-ms-qps-machine-name: OBJIYUIE
        x-ms-qps-role-name:
        x-ms-qps-invariant-version: 5
        Content-Length: 322
        Response
        HTTP/1.1 200 OK
        Server: Microsoft-IIS/10.0
        x-ms-qps-subscribed: false
        Request-Context: appId=cid-v1:07ab024e-cb19-453f-9771-8b09429cc02d
        Access-Control-Expose-Headers: Request-Context
        X-Powered-By: ASP.NET
        Strict-Transport-Security: max-age=31536000; includeSubDomains
        X-Content-Type-Options: nosniff
        Date: Thu, 16 May 2024 16:06:29 GMT
        Content-Length: 0
      • flag-us
        POST
        https://eastus.livediagnostics.monitor.azure.com/QuickPulseService.svc/ping?ikey=e2939d3e-7996-4b20-98ee-1662e7d61a10
        GoTo.Resolve.PatchManagement.Client.exe
        Remote address:
        20.49.111.33:443
        Request
        POST /QuickPulseService.svc/ping?ikey=e2939d3e-7996-4b20-98ee-1662e7d61a10 HTTP/1.1
        Host: eastus.livediagnostics.monitor.azure.com
        x-ms-qps-transmission-time: 638514723927596657
        x-ms-qps-configuration-etag:
        x-ms-qps-auth-api-key:
        x-ms-qps-auth-app-id:
        x-ms-qps-auth-status:
        x-ms-qps-auth-token-expiry:
        x-ms-qps-auth-token-signature:
        x-ms-qps-auth-token-signature-alg:
        x-ms-qps-instance-name: Objiyuie
        x-ms-qps-stream-id: 91a815aea5954b5ea441f690753579ff
        x-ms-qps-machine-name: OBJIYUIE
        x-ms-qps-role-name:
        x-ms-qps-invariant-version: 5
        Content-Length: 322
        Response
        HTTP/1.1 200 OK
        Server: Microsoft-IIS/10.0
        x-ms-qps-subscribed: false
        Request-Context: appId=cid-v1:07ab024e-cb19-453f-9771-8b09429cc02d
        Access-Control-Expose-Headers: Request-Context
        X-Powered-By: ASP.NET
        Strict-Transport-Security: max-age=31536000; includeSubDomains
        X-Content-Type-Options: nosniff
        Date: Thu, 16 May 2024 16:06:34 GMT
        Content-Length: 0
      • flag-us
        POST
        https://eastus.livediagnostics.monitor.azure.com/QuickPulseService.svc/ping?ikey=e2939d3e-7996-4b20-98ee-1662e7d61a10
        GoTo.Resolve.PatchManagement.Client.exe
        Remote address:
        20.49.111.33:443
        Request
        POST /QuickPulseService.svc/ping?ikey=e2939d3e-7996-4b20-98ee-1662e7d61a10 HTTP/1.1
        Host: eastus.livediagnostics.monitor.azure.com
        x-ms-qps-transmission-time: 638514723977555085
        x-ms-qps-configuration-etag:
        x-ms-qps-auth-api-key:
        x-ms-qps-auth-app-id:
        x-ms-qps-auth-status:
        x-ms-qps-auth-token-expiry:
        x-ms-qps-auth-token-signature:
        x-ms-qps-auth-token-signature-alg:
        x-ms-qps-instance-name: Objiyuie
        x-ms-qps-stream-id: 91a815aea5954b5ea441f690753579ff
        x-ms-qps-machine-name: OBJIYUIE
        x-ms-qps-role-name:
        x-ms-qps-invariant-version: 5
        Content-Length: 322
        Response
        HTTP/1.1 200 OK
        Server: Microsoft-IIS/10.0
        x-ms-qps-subscribed: false
        Request-Context: appId=cid-v1:07ab024e-cb19-453f-9771-8b09429cc02d
        Access-Control-Expose-Headers: Request-Context
        X-Powered-By: ASP.NET
        Strict-Transport-Security: max-age=31536000; includeSubDomains
        X-Content-Type-Options: nosniff
        Date: Thu, 16 May 2024 16:06:39 GMT
        Content-Length: 0
      • flag-us
        POST
        https://eastus.livediagnostics.monitor.azure.com/QuickPulseService.svc/ping?ikey=e2939d3e-7996-4b20-98ee-1662e7d61a10
        GoTo.Resolve.PatchManagement.Client.exe
        Remote address:
        20.49.111.33:443
        Request
        POST /QuickPulseService.svc/ping?ikey=e2939d3e-7996-4b20-98ee-1662e7d61a10 HTTP/1.1
        Host: eastus.livediagnostics.monitor.azure.com
        x-ms-qps-transmission-time: 638514724027553468
        x-ms-qps-configuration-etag:
        x-ms-qps-auth-api-key:
        x-ms-qps-auth-app-id:
        x-ms-qps-auth-status:
        x-ms-qps-auth-token-expiry:
        x-ms-qps-auth-token-signature:
        x-ms-qps-auth-token-signature-alg:
        x-ms-qps-instance-name: Objiyuie
        x-ms-qps-stream-id: 91a815aea5954b5ea441f690753579ff
        x-ms-qps-machine-name: OBJIYUIE
        x-ms-qps-role-name:
        x-ms-qps-invariant-version: 5
        Content-Length: 322
        Response
        HTTP/1.1 200 OK
        Server: Microsoft-IIS/10.0
        x-ms-qps-subscribed: false
        Request-Context: appId=cid-v1:07ab024e-cb19-453f-9771-8b09429cc02d
        Access-Control-Expose-Headers: Request-Context
        X-Powered-By: ASP.NET
        Strict-Transport-Security: max-age=31536000; includeSubDomains
        X-Content-Type-Options: nosniff
        Date: Thu, 16 May 2024 16:06:44 GMT
        Content-Length: 0
      • flag-us
        POST
        https://eastus.livediagnostics.monitor.azure.com/QuickPulseService.svc/ping?ikey=e2939d3e-7996-4b20-98ee-1662e7d61a10
        GoTo.Resolve.PatchManagement.Client.exe
        Remote address:
        20.49.111.33:443
        Request
        POST /QuickPulseService.svc/ping?ikey=e2939d3e-7996-4b20-98ee-1662e7d61a10 HTTP/1.1
        Host: eastus.livediagnostics.monitor.azure.com
        x-ms-qps-transmission-time: 638514724077559649
        x-ms-qps-configuration-etag:
        x-ms-qps-auth-api-key:
        x-ms-qps-auth-app-id:
        x-ms-qps-auth-status:
        x-ms-qps-auth-token-expiry:
        x-ms-qps-auth-token-signature:
        x-ms-qps-auth-token-signature-alg:
        x-ms-qps-instance-name: Objiyuie
        x-ms-qps-stream-id: 91a815aea5954b5ea441f690753579ff
        x-ms-qps-machine-name: OBJIYUIE
        x-ms-qps-role-name:
        x-ms-qps-invariant-version: 5
        Content-Length: 322
        Response
        HTTP/1.1 200 OK
        Server: Microsoft-IIS/10.0
        x-ms-qps-subscribed: false
        Request-Context: appId=cid-v1:07ab024e-cb19-453f-9771-8b09429cc02d
        Access-Control-Expose-Headers: Request-Context
        X-Powered-By: ASP.NET
        Strict-Transport-Security: max-age=31536000; includeSubDomains
        X-Content-Type-Options: nosniff
        Date: Thu, 16 May 2024 16:06:49 GMT
        Content-Length: 0
      • flag-us
        POST
        https://eastus.livediagnostics.monitor.azure.com/QuickPulseService.svc/ping?ikey=e2939d3e-7996-4b20-98ee-1662e7d61a10
        GoTo.Resolve.PatchManagement.Client.exe
        Remote address:
        20.49.111.33:443
        Request
        POST /QuickPulseService.svc/ping?ikey=e2939d3e-7996-4b20-98ee-1662e7d61a10 HTTP/1.1
        Host: eastus.livediagnostics.monitor.azure.com
        x-ms-qps-transmission-time: 638514724127583380
        x-ms-qps-configuration-etag:
        x-ms-qps-auth-api-key:
        x-ms-qps-auth-app-id:
        x-ms-qps-auth-status:
        x-ms-qps-auth-token-expiry:
        x-ms-qps-auth-token-signature:
        x-ms-qps-auth-token-signature-alg:
        x-ms-qps-instance-name: Objiyuie
        x-ms-qps-stream-id: 91a815aea5954b5ea441f690753579ff
        x-ms-qps-machine-name: OBJIYUIE
        x-ms-qps-role-name:
        x-ms-qps-invariant-version: 5
        Content-Length: 322
        Response
        HTTP/1.1 200 OK
        Server: Microsoft-IIS/10.0
        x-ms-qps-subscribed: false
        Request-Context: appId=cid-v1:07ab024e-cb19-453f-9771-8b09429cc02d
        Access-Control-Expose-Headers: Request-Context
        X-Powered-By: ASP.NET
        Strict-Transport-Security: max-age=31536000; includeSubDomains
        X-Content-Type-Options: nosniff
        Date: Thu, 16 May 2024 16:06:54 GMT
        Content-Length: 0
      • flag-us
        POST
        https://eastus.livediagnostics.monitor.azure.com/QuickPulseService.svc/ping?ikey=e2939d3e-7996-4b20-98ee-1662e7d61a10
        GoTo.Resolve.PatchManagement.Client.exe
        Remote address:
        20.49.111.33:443
        Request
        POST /QuickPulseService.svc/ping?ikey=e2939d3e-7996-4b20-98ee-1662e7d61a10 HTTP/1.1
        Host: eastus.livediagnostics.monitor.azure.com
        x-ms-qps-transmission-time: 638514724177559039
        x-ms-qps-configuration-etag:
        x-ms-qps-auth-api-key:
        x-ms-qps-auth-app-id:
        x-ms-qps-auth-status:
        x-ms-qps-auth-token-expiry:
        x-ms-qps-auth-token-signature:
        x-ms-qps-auth-token-signature-alg:
        x-ms-qps-instance-name: Objiyuie
        x-ms-qps-stream-id: 91a815aea5954b5ea441f690753579ff
        x-ms-qps-machine-name: OBJIYUIE
        x-ms-qps-role-name:
        x-ms-qps-invariant-version: 5
        Content-Length: 322
        Response
        HTTP/1.1 200 OK
        Server: Microsoft-IIS/10.0
        x-ms-qps-subscribed: false
        Request-Context: appId=cid-v1:07ab024e-cb19-453f-9771-8b09429cc02d
        Access-Control-Expose-Headers: Request-Context
        X-Powered-By: ASP.NET
        Strict-Transport-Security: max-age=31536000; includeSubDomains
        X-Content-Type-Options: nosniff
        Date: Thu, 16 May 2024 16:06:59 GMT
        Content-Length: 0
      • flag-us
        POST
        https://eastus.livediagnostics.monitor.azure.com/QuickPulseService.svc/ping?ikey=e2939d3e-7996-4b20-98ee-1662e7d61a10
        GoTo.Resolve.PatchManagement.Client.exe
        Remote address:
        20.49.111.33:443
        Request
        POST /QuickPulseService.svc/ping?ikey=e2939d3e-7996-4b20-98ee-1662e7d61a10 HTTP/1.1
        Host: eastus.livediagnostics.monitor.azure.com
        x-ms-qps-transmission-time: 638514724227642576
        x-ms-qps-configuration-etag:
        x-ms-qps-auth-api-key:
        x-ms-qps-auth-app-id:
        x-ms-qps-auth-status:
        x-ms-qps-auth-token-expiry:
        x-ms-qps-auth-token-signature:
        x-ms-qps-auth-token-signature-alg:
        x-ms-qps-instance-name: Objiyuie
        x-ms-qps-stream-id: 91a815aea5954b5ea441f690753579ff
        x-ms-qps-machine-name: OBJIYUIE
        x-ms-qps-role-name:
        x-ms-qps-invariant-version: 5
        Content-Length: 322
        Response
        HTTP/1.1 200 OK
        Server: Microsoft-IIS/10.0
        x-ms-qps-subscribed: false
        Request-Context: appId=cid-v1:07ab024e-cb19-453f-9771-8b09429cc02d
        Access-Control-Expose-Headers: Request-Context
        X-Powered-By: ASP.NET
        Strict-Transport-Security: max-age=31536000; includeSubDomains
        X-Content-Type-Options: nosniff
        Date: Thu, 16 May 2024 16:07:04 GMT
        Content-Length: 0
      • flag-us
        POST
        https://eastus.livediagnostics.monitor.azure.com/QuickPulseService.svc/ping?ikey=e2939d3e-7996-4b20-98ee-1662e7d61a10
        GoTo.Resolve.PatchManagement.Client.exe
        Remote address:
        20.49.111.33:443
        Request
        POST /QuickPulseService.svc/ping?ikey=e2939d3e-7996-4b20-98ee-1662e7d61a10 HTTP/1.1
        Host: eastus.livediagnostics.monitor.azure.com
        x-ms-qps-transmission-time: 638514724277642727
        x-ms-qps-configuration-etag:
        x-ms-qps-auth-api-key:
        x-ms-qps-auth-app-id:
        x-ms-qps-auth-status:
        x-ms-qps-auth-token-expiry:
        x-ms-qps-auth-token-signature:
        x-ms-qps-auth-token-signature-alg:
        x-ms-qps-instance-name: Objiyuie
        x-ms-qps-stream-id: 91a815aea5954b5ea441f690753579ff
        x-ms-qps-machine-name: OBJIYUIE
        x-ms-qps-role-name:
        x-ms-qps-invariant-version: 5
        Content-Length: 322
        Response
        HTTP/1.1 200 OK
        Server: Microsoft-IIS/10.0
        x-ms-qps-subscribed: false
        Request-Context: appId=cid-v1:07ab024e-cb19-453f-9771-8b09429cc02d
        Access-Control-Expose-Headers: Request-Context
        X-Powered-By: ASP.NET
        Strict-Transport-Security: max-age=31536000; includeSubDomains
        X-Content-Type-Options: nosniff
        Date: Thu, 16 May 2024 16:07:09 GMT
        Content-Length: 0
      • flag-us
        POST
        https://eastus.livediagnostics.monitor.azure.com/QuickPulseService.svc/ping?ikey=e2939d3e-7996-4b20-98ee-1662e7d61a10
        GoTo.Resolve.PatchManagement.Client.exe
        Remote address:
        20.49.111.33:443
        Request
        POST /QuickPulseService.svc/ping?ikey=e2939d3e-7996-4b20-98ee-1662e7d61a10 HTTP/1.1
        Host: eastus.livediagnostics.monitor.azure.com
        x-ms-qps-transmission-time: 638514724327642195
        x-ms-qps-configuration-etag:
        x-ms-qps-auth-api-key:
        x-ms-qps-auth-app-id:
        x-ms-qps-auth-status:
        x-ms-qps-auth-token-expiry:
        x-ms-qps-auth-token-signature:
        x-ms-qps-auth-token-signature-alg:
        x-ms-qps-instance-name: Objiyuie
        x-ms-qps-stream-id: 91a815aea5954b5ea441f690753579ff
        x-ms-qps-machine-name: OBJIYUIE
        x-ms-qps-role-name:
        x-ms-qps-invariant-version: 5
        Content-Length: 322
        Response
        HTTP/1.1 200 OK
        Server: Microsoft-IIS/10.0
        x-ms-qps-subscribed: false
        Request-Context: appId=cid-v1:07ab024e-cb19-453f-9771-8b09429cc02d
        Access-Control-Expose-Headers: Request-Context
        X-Powered-By: ASP.NET
        Strict-Transport-Security: max-age=31536000; includeSubDomains
        X-Content-Type-Options: nosniff
        Date: Thu, 16 May 2024 16:07:13 GMT
        Content-Length: 0
      • flag-us
        POST
        https://eastus.livediagnostics.monitor.azure.com/QuickPulseService.svc/ping?ikey=e2939d3e-7996-4b20-98ee-1662e7d61a10
        GoTo.Resolve.PatchManagement.Client.exe
        Remote address:
        20.49.111.33:443
        Request
        POST /QuickPulseService.svc/ping?ikey=e2939d3e-7996-4b20-98ee-1662e7d61a10 HTTP/1.1
        Host: eastus.livediagnostics.monitor.azure.com
        x-ms-qps-transmission-time: 638514724377642864
        x-ms-qps-configuration-etag:
        x-ms-qps-auth-api-key:
        x-ms-qps-auth-app-id:
        x-ms-qps-auth-status:
        x-ms-qps-auth-token-expiry:
        x-ms-qps-auth-token-signature:
        x-ms-qps-auth-token-signature-alg:
        x-ms-qps-instance-name: Objiyuie
        x-ms-qps-stream-id: 91a815aea5954b5ea441f690753579ff
        x-ms-qps-machine-name: OBJIYUIE
        x-ms-qps-role-name:
        x-ms-qps-invariant-version: 5
        Content-Length: 322
        Response
        HTTP/1.1 200 OK
        Server: Microsoft-IIS/10.0
        x-ms-qps-subscribed: false
        Request-Context: appId=cid-v1:07ab024e-cb19-453f-9771-8b09429cc02d
        Access-Control-Expose-Headers: Request-Context
        X-Powered-By: ASP.NET
        Strict-Transport-Security: max-age=31536000; includeSubDomains
        X-Content-Type-Options: nosniff
        Date: Thu, 16 May 2024 16:07:19 GMT
        Content-Length: 0
      • flag-us
        DNS
        33.111.49.20.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        33.111.49.20.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        33.111.49.20.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        33.111.49.20.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        westeurope.livediagnostics.monitor.azure.com
        GoTo.Resolve.Antivirus.App.exe
        Remote address:
        8.8.8.8:53
        Request
        westeurope.livediagnostics.monitor.azure.com
        IN A
        Response
        westeurope.livediagnostics.monitor.azure.com
        IN CNAME
        westeurope.livediagnostics.privatelink.monitor.azure.com
        westeurope.livediagnostics.privatelink.monitor.azure.com
        IN CNAME
        stamp1-westeurope.quickpulse.prod.applicationinsights.trafficmanager.net
        stamp1-westeurope.quickpulse.prod.applicationinsights.trafficmanager.net
        IN A
        40.113.178.33
      • flag-us
        DNS
        westeurope.livediagnostics.monitor.azure.com
        GoTo.Resolve.Antivirus.App.exe
        Remote address:
        8.8.8.8:53
        Request
        westeurope.livediagnostics.monitor.azure.com
        IN A
      • flag-nl
        POST
        https://westeurope.livediagnostics.monitor.azure.com/QuickPulseService.svc/ping?ikey=d5c2d5c7-c95a-4316-9e4e-3f393c885a14
        GoTo.Resolve.Antivirus.App.exe
        Remote address:
        40.113.178.33:443
        Request
        POST /QuickPulseService.svc/ping?ikey=d5c2d5c7-c95a-4316-9e4e-3f393c885a14 HTTP/1.1
        Host: westeurope.livediagnostics.monitor.azure.com
        x-ms-qps-transmission-time: 638514723899171174
        x-ms-qps-configuration-etag:
        x-ms-qps-auth-api-key:
        x-ms-qps-auth-app-id:
        x-ms-qps-auth-status:
        x-ms-qps-auth-token-expiry:
        x-ms-qps-auth-token-signature:
        x-ms-qps-auth-token-signature-alg:
        x-ms-qps-instance-name: Objiyuie
        x-ms-qps-stream-id: 739e4f16842749d9bbbd15d7f5c06774
        x-ms-qps-machine-name: OBJIYUIE
        x-ms-qps-role-name:
        x-ms-qps-invariant-version: 5
        Content-Length: 322
        Response
        HTTP/1.1 400 Bad Request
        Content-Type: application/json; charset=utf-8
        Server: Microsoft-IIS/10.0
        Access-Control-Allow-Origin: *
        Request-Context: appId=cid-v1:07ab024e-cb19-453f-9771-8b09429cc02d
        Access-Control-Expose-Headers: Request-Context
        X-Powered-By: ASP.NET
        Strict-Transport-Security: max-age=31536000; includeSubDomains
        X-Content-Type-Options: nosniff
        Date: Thu, 16 May 2024 16:06:31 GMT
        Content-Length: 197
      • flag-us
        DNS
        download.windowsupdate.com
        Remote address:
        8.8.8.8:53
        Request
        download.windowsupdate.com
        IN A
        Response
        download.windowsupdate.com
        IN CNAME
        download.windowsupdate.com.delivery.microsoft.com
        download.windowsupdate.com.delivery.microsoft.com
        IN CNAME
        wu-f-net.trafficmanager.net
        wu-f-net.trafficmanager.net
        IN CNAME
        fg.microsoft.map.fastly.net
        fg.microsoft.map.fastly.net
        IN A
        199.232.210.172
        fg.microsoft.map.fastly.net
        IN A
        199.232.214.172
      • flag-us
        DNS
        download.windowsupdate.com
        Remote address:
        8.8.8.8:53
        Request
        download.windowsupdate.com
        IN A
        Response
        download.windowsupdate.com
        IN CNAME
        download.windowsupdate.com.delivery.microsoft.com
        download.windowsupdate.com.delivery.microsoft.com
        IN CNAME
        wu-f-net.trafficmanager.net
        wu-f-net.trafficmanager.net
        IN CNAME
        fg.microsoft.map.fastly.net
        fg.microsoft.map.fastly.net
        IN A
        199.232.210.172
        fg.microsoft.map.fastly.net
        IN A
        199.232.214.172
      • flag-us
        GET
        http://download.windowsupdate.com/d/msdownload/update/others/2015/05/17930914_a3b333eff1f0428f5a2c87724c542504821cdbd8.cab
        Remote address:
        199.232.210.172:80
        Request
        GET /d/msdownload/update/others/2015/05/17930914_a3b333eff1f0428f5a2c87724c542504821cdbd8.cab HTTP/1.1
        Connection: Keep-Alive
        Accept: */*
        User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.32
        Host: download.windowsupdate.com
        Response
        HTTP/1.1 200 OK
        Connection: keep-alive
        Content-Length: 8047
        Cache-Control: public,max-age=172800
        Content-Type: application/vnd.ms-cab-compressed
        Last-Modified: Fri, 29 May 2015 16:16:45 GMT
        ETag: "80d429db2a9ad01:0"
        Accept-Ranges: bytes
        Date: Thu, 16 May 2024 16:06:33 GMT
        Via: 1.1 varnish
        Age: 126228
        X-Served-By: cache-lcy-eglc8600079-LCY
        X-Cache: HIT
        X-Cache-Hits: 1482
        X-Timer: S1715875594.648575,VS0,VE0
        X-CID: 3
        X-CCC: GB
      • flag-us
        DNS
        172.210.232.199.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        172.210.232.199.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        dc.services.visualstudio.com
        GoTo.Resolve.PatchManagement.Client.exe
        Remote address:
        8.8.8.8:53
        Request
        dc.services.visualstudio.com
        IN A
        Response
        dc.services.visualstudio.com
        IN CNAME
        dc.applicationinsights.microsoft.com
        dc.applicationinsights.microsoft.com
        IN CNAME
        dc.applicationinsights.azure.com
        dc.applicationinsights.azure.com
        IN CNAME
        global.in.ai.monitor.azure.com
        global.in.ai.monitor.azure.com
        IN CNAME
        global.in.ai.privatelink.monitor.azure.com
        global.in.ai.privatelink.monitor.azure.com
        IN CNAME
        dc.trafficmanager.net
        dc.trafficmanager.net
        IN CNAME
        westeurope-global.in.applicationinsights.azure.com
        westeurope-global.in.applicationinsights.azure.com
        IN CNAME
        gig-ai-prod-westeurope-global.trafficmanager.net
        gig-ai-prod-westeurope-global.trafficmanager.net
        IN CNAME
        gig-ai-g-prod-westeurope-1-app-v4-tag.westeurope.cloudapp.azure.com
        gig-ai-g-prod-westeurope-1-app-v4-tag.westeurope.cloudapp.azure.com
        IN A
        20.50.88.244
      • flag-us
        DNS
        dc.services.visualstudio.com
        GoTo.Resolve.PatchManagement.Client.exe
        Remote address:
        8.8.8.8:53
        Request
        dc.services.visualstudio.com
        IN A
        Response
        dc.services.visualstudio.com
        IN CNAME
        dc.applicationinsights.microsoft.com
        dc.applicationinsights.microsoft.com
        IN CNAME
        dc.applicationinsights.azure.com
        dc.applicationinsights.azure.com
        IN CNAME
        global.in.ai.monitor.azure.com
        global.in.ai.monitor.azure.com
        IN CNAME
        global.in.ai.privatelink.monitor.azure.com
        global.in.ai.privatelink.monitor.azure.com
        IN CNAME
        dc.trafficmanager.net
        dc.trafficmanager.net
        IN CNAME
        westeurope-global.in.applicationinsights.azure.com
        westeurope-global.in.applicationinsights.azure.com
        IN CNAME
        gig-ai-prod-westeurope-global.trafficmanager.net
        gig-ai-prod-westeurope-global.trafficmanager.net
        IN CNAME
        gig-ai-g-prod-westeurope-1-app-v4-tag.westeurope.cloudapp.azure.com
        gig-ai-g-prod-westeurope-1-app-v4-tag.westeurope.cloudapp.azure.com
        IN A
        20.50.88.244
      • flag-nl
        POST
        https://dc.services.visualstudio.com/v2/track
        RemoteExecution.Runner.exe
        Remote address:
        20.50.88.244:443
        Request
        POST /v2/track HTTP/1.1
        Host: dc.services.visualstudio.com
        Content-Type: application/x-json-stream
        Content-Encoding: gzip
        Content-Length: 913
        Response
        HTTP/1.1 200 OK
        Transfer-Encoding: chunked
        Content-Type: application/json; charset=utf-8
        Server: Microsoft-HTTPAPI/2.0
        Strict-Transport-Security: max-age=31536000
        X-Content-Type-Options: nosniff
        Date: Thu, 16 May 2024 16:06:54 GMT
      • flag-nl
        POST
        https://dc.services.visualstudio.com/v2/track
        GoTo.Resolve.PatchManagement.Client.exe
        Remote address:
        20.50.88.244:443
        Request
        POST /v2/track HTTP/1.1
        Host: dc.services.visualstudio.com
        traceparent: 00-0e329565b73a80efd52d9d48ccff874a-4b56fe77097132f6-00
        Content-Type: application/x-json-stream
        Content-Encoding: gzip
        Content-Length: 1266
        Response
        HTTP/1.1 206 Partial Content
        Transfer-Encoding: chunked
        Content-Type: application/json; charset=utf-8
        Server: Microsoft-HTTPAPI/2.0
        Strict-Transport-Security: max-age=31536000
        X-Content-Type-Options: nosniff
        Date: Thu, 16 May 2024 16:06:54 GMT
      • flag-us
        DNS
        244.88.50.20.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        244.88.50.20.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        244.88.50.20.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        244.88.50.20.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        905469987510.data-kinesis.us-east-1.amazonaws.com
        GoTo.Resolve.DeviceData.App.exe
        Remote address:
        8.8.8.8:53
        Request
        905469987510.data-kinesis.us-east-1.amazonaws.com
        IN A
        Response
        905469987510.data-kinesis.us-east-1.amazonaws.com
        IN CNAME
        kinesis.us-east-1.amazonaws.com
        kinesis.us-east-1.amazonaws.com
        IN A
        3.91.171.249
      • flag-us
        DNS
        43.39.156.108.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        43.39.156.108.in-addr.arpa
        IN PTR
        Response
        43.39.156.108.in-addr.arpa
        IN PTR
        server-108-156-39-43lhr50r cloudfrontnet
      • flag-us
        DNS
        249.171.91.3.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        249.171.91.3.in-addr.arpa
        IN PTR
        Response
        249.171.91.3.in-addr.arpa
        IN PTR
        ec2-3-91-171-249 compute-1 amazonawscom
      • flag-us
        DNS
        249.171.91.3.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        249.171.91.3.in-addr.arpa
        IN PTR
        Response
        249.171.91.3.in-addr.arpa
        IN PTR
        ec2-3-91-171-249 compute-1 amazonawscom
      • flag-us
        DNS
        fe2cr.update.microsoft.com
        Remote address:
        8.8.8.8:53
        Request
        fe2cr.update.microsoft.com
        IN A
        Response
        fe2cr.update.microsoft.com
        IN CNAME
        fe2cr.update.msft.com.trafficmanager.net
        fe2cr.update.msft.com.trafficmanager.net
        IN A
        20.163.45.183
        fe2cr.update.msft.com.trafficmanager.net
        IN A
        52.152.180.153
      • flag-us
        POST
        https://fe2cr.update.microsoft.com/v6/ClientWebService/client.asmx
        Remote address:
        20.163.45.183:443
        Request
        POST /v6/ClientWebService/client.asmx HTTP/2.0
        host: fe2cr.update.microsoft.com
        cache-control: no-cache
        pragma: no-cache
        content-type: text/xml; charset=utf-8
        accept-encoding: xpress
        user-agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.32
        soapaction: "http://www.microsoft.com/SoftwareDistribution/Server/ClientWebService/SyncUpdates"
        ms-cv: BQteXxq8TUeDTBx6.1.0.0.2.1
        content-length: 16858
        Response
        HTTP/2.0 200
        cache-control: private
        content-type: text/xml; charset=utf-8
        content-encoding: xpress
        vary: Accept-Encoding
        date: Thu, 16 May 2024 16:07:08 GMT
        content-length: 666
      • flag-us
        DNS
        183.45.163.20.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        183.45.163.20.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        tse1.mm.bing.net
        Remote address:
        8.8.8.8:53
        Request
        tse1.mm.bing.net
        IN A
        Response
        tse1.mm.bing.net
        IN CNAME
        mm-mm.bing.net.trafficmanager.net
        mm-mm.bing.net.trafficmanager.net
        IN CNAME
        dual-a-0001.a-msedge.net
        dual-a-0001.a-msedge.net
        IN A
        204.79.197.200
        dual-a-0001.a-msedge.net
        IN A
        13.107.21.200
      • flag-us
        GET
        https://tse1.mm.bing.net/th?id=OADD2.10239360931610_110BPTPDN41GIXK2B&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90
        Remote address:
        204.79.197.200:443
        Request
        GET /th?id=OADD2.10239360931610_110BPTPDN41GIXK2B&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/2.0
        host: tse1.mm.bing.net
        accept: */*
        accept-encoding: gzip, deflate, br
        user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
        Response
        HTTP/2.0 200
        cache-control: public, max-age=2592000
        content-length: 792794
        content-type: image/jpeg
        x-cache: TCP_HIT
        access-control-allow-origin: *
        access-control-allow-headers: *
        access-control-allow-methods: GET, POST, OPTIONS
        timing-allow-origin: *
        report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
        nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
        accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
        x-msedge-ref: Ref A: 1BD169F84C3845B9B984BCC2214B438D Ref B: LON04EDGE1212 Ref C: 2024-05-16T16:07:02Z
        date: Thu, 16 May 2024 16:07:02 GMT
      • flag-us
        GET
        https://tse1.mm.bing.net/th?id=OADD2.10239340783938_154JBSOQL12JS43YR&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90
        Remote address:
        204.79.197.200:443
        Request
        GET /th?id=OADD2.10239340783938_154JBSOQL12JS43YR&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/2.0
        host: tse1.mm.bing.net
        accept: */*
        accept-encoding: gzip, deflate, br
        user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
        Response
        HTTP/2.0 200
        cache-control: public, max-age=2592000
        content-length: 430689
        content-type: image/jpeg
        x-cache: TCP_HIT
        access-control-allow-origin: *
        access-control-allow-headers: *
        access-control-allow-methods: GET, POST, OPTIONS
        timing-allow-origin: *
        report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
        nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
        accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
        x-msedge-ref: Ref A: 57BF61E9B6204260ACE4749B34672344 Ref B: LON04EDGE1212 Ref C: 2024-05-16T16:07:02Z
        date: Thu, 16 May 2024 16:07:02 GMT
      • flag-us
        GET
        https://tse1.mm.bing.net/th?id=OADD2.10239340783939_14IT4JGOWRFC6CMW9&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90
        Remote address:
        204.79.197.200:443
        Request
        GET /th?id=OADD2.10239340783939_14IT4JGOWRFC6CMW9&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/2.0
        host: tse1.mm.bing.net
        accept: */*
        accept-encoding: gzip, deflate, br
        user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
        Response
        HTTP/2.0 200
        cache-control: public, max-age=2592000
        content-length: 627437
        content-type: image/jpeg
        x-cache: TCP_HIT
        access-control-allow-origin: *
        access-control-allow-headers: *
        access-control-allow-methods: GET, POST, OPTIONS
        timing-allow-origin: *
        report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
        nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
        accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
        x-msedge-ref: Ref A: C31CA89367584DE395B42E33CE68B7F3 Ref B: LON04EDGE1212 Ref C: 2024-05-16T16:07:02Z
        date: Thu, 16 May 2024 16:07:02 GMT
      • flag-us
        GET
        https://tse1.mm.bing.net/th?id=OADD2.10239360931609_1JAA48IJSET6WWQHH&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90
        Remote address:
        204.79.197.200:443
        Request
        GET /th?id=OADD2.10239360931609_1JAA48IJSET6WWQHH&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/2.0
        host: tse1.mm.bing.net
        accept: */*
        accept-encoding: gzip, deflate, br
        user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
        Response
        HTTP/2.0 200
        cache-control: public, max-age=2592000
        content-length: 415458
        content-type: image/jpeg
        x-cache: TCP_HIT
        access-control-allow-origin: *
        access-control-allow-headers: *
        access-control-allow-methods: GET, POST, OPTIONS
        timing-allow-origin: *
        report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
        nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
        accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
        x-msedge-ref: Ref A: 5D1F3225BEB24161ACD7C1C41D3C0E71 Ref B: LON04EDGE1212 Ref C: 2024-05-16T16:07:02Z
        date: Thu, 16 May 2024 16:07:02 GMT
      • flag-us
        POST
        https://fe2cr.update.microsoft.com/v6/ClientWebService/client.asmx
        Remote address:
        20.163.45.183:443
        Request
        POST /v6/ClientWebService/client.asmx HTTP/2.0
        host: fe2cr.update.microsoft.com
        cache-control: no-cache
        pragma: no-cache
        content-type: text/xml; charset=utf-8
        accept-encoding: xpress
        user-agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.32
        soapaction: "http://www.microsoft.com/SoftwareDistribution/Server/ClientWebService/SyncUpdates"
        ms-cv: A8OcaHb8hUas7K4L.1.0.0.2.1
        content-length: 16858
        Response
        HTTP/2.0 200
        cache-control: private
        content-type: text/xml; charset=utf-8
        content-encoding: xpress
        vary: Accept-Encoding
        date: Thu, 16 May 2024 16:07:11 GMT
        content-length: 671
      • flag-us
        POST
        https://fe2cr.update.microsoft.com/v6/ClientWebService/client.asmx
        Remote address:
        20.163.45.183:443
        Request
        POST /v6/ClientWebService/client.asmx HTTP/2.0
        host: fe2cr.update.microsoft.com
        cache-control: no-cache
        pragma: no-cache
        content-type: text/xml; charset=utf-8
        accept-encoding: xpress
        user-agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.32
        soapaction: "http://www.microsoft.com/SoftwareDistribution/Server/ClientWebService/SyncUpdates"
        ms-cv: yH/g127QP02iB/o3.1.0.0.2.1
        content-length: 16858
        Response
        HTTP/2.0 200
        cache-control: private
        content-type: text/xml; charset=utf-8
        content-encoding: xpress
        vary: Accept-Encoding
        date: Thu, 16 May 2024 16:07:14 GMT
        content-length: 669
      • flag-us
        DNS
        9.173.189.20.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        9.173.189.20.in-addr.arpa
        IN PTR
        Response
      • flag-us
        POST
        https://fe2cr.update.microsoft.com/v6/ClientWebService/client.asmx
        Remote address:
        20.163.45.183:443
        Request
        POST /v6/ClientWebService/client.asmx HTTP/2.0
        host: fe2cr.update.microsoft.com
        cache-control: no-cache
        pragma: no-cache
        content-type: text/xml; charset=utf-8
        accept-encoding: xpress
        user-agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.32
        soapaction: "http://www.microsoft.com/SoftwareDistribution/Server/ClientWebService/SyncUpdates"
        ms-cv: 77h7B6gPCUy2wFKD.1.0.0.2.1
        content-length: 16858
        Response
        HTTP/2.0 200
        cache-control: private
        content-type: text/xml; charset=utf-8
        content-encoding: xpress
        vary: Accept-Encoding
        date: Thu, 16 May 2024 16:07:18 GMT
        content-length: 661
      • 35.157.186.199:443
        dumpster.console.gotoresolve.com
        tls
        GoToResolveLoggerProcess.exe
        217.1kB
         21.1kB
         278
        169
      • 35.157.186.199:443
        dumpster.console.gotoresolve.com
        tls
        GoToResolveLoggerProcess.exe
        87.6kB
         11.9kB
         109
        72
      • 35.157.186.199:443
        dumpster.console.gotoresolve.com
        tls
        GoToResolveLoggerProcess.exe
        65.5kB
         10.4kB
         84
        56
      • 35.157.186.199:443
        dumpster.console.gotoresolve.com
        tls
        GoToResolveLoggerProcess.exe
        57.8kB
         10.3kB
         77
        54
      • 35.157.186.199:443
        dumpster.console.gotoresolve.com
        tls
        GoToResolveLoggerProcess.exe
        55.6kB
         10.1kB
         73
        51
      • 35.157.186.199:443
        dumpster.console.gotoresolve.com
        tls
        GoToResolveLoggerProcess.exe
        53.8kB
         9.6kB
         72
        50
      • 35.157.186.199:443
        dumpster.console.gotoresolve.com
        tls
        GoToResolveUnattended.exe
        1.6kB
         6.4kB
         12
        16
      • 54.243.5.228:443
        devices-iot.console.gotoresolve.com
        tls
        GoToResolveUnattended.exe
        1.2kB
         4.5kB
         10
        12
      • 165.225.4.122:80
        http://ip.zscaler.com/
        http
        GoToResolveUnattended.exe
        448 B
         1.0kB
         6
        6

        HTTP Request

        GET http://ip.zscaler.com/

        HTTP Response

        502
      • 3.67.114.44:443
        sessions.console.gotoresolve.com
        tls
        GoToResolveUnattended.exe
        1.5kB
         5.5kB
         11
        13
      • 13.107.246.64:443
        zerotrust.services.gotoresolve.com
        tls
        GoToResolveUnattended.exe
        2.1kB
         7.4kB
         13
        17
      • 3.224.59.159:443
        devices.console.gotoresolve.com
        tls
        GoToResolveUnattended.exe
        1.5kB
         11.1kB
         12
        14
      • 54.243.5.228:443
        devices-iot.console.gotoresolve.com
        tls
        GoToResolveUnattended.exe
        4.1kB
         9.1kB
         22
        32
      • 23.62.61.144:443
        https://www.bing.com/th?id=OADD2.10239359720591_10PHTLBML42K6TRZO&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=24&h=24&dynsize=1&qlt=90
        tls, http2
        1.4kB
         6.3kB
         16
        11

        HTTP Request

        GET https://www.bing.com/th?id=OADD2.10239359720591_10PHTLBML42K6TRZO&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=24&h=24&dynsize=1&qlt=90

        HTTP Response

        200
      • 54.243.5.228:443
        devices-iot.console.gotoresolve.com
        tls
        GoToResolveUnattended.exe
        6.7kB
         11.6kB
         40
        45
      • 165.225.4.122:80
        http://ip.zscaler.com/
        http
        GoToResolveUnattended.exe
        396 B
         132 B
         5
        3

        HTTP Request

        GET http://ip.zscaler.com/
      • 54.243.5.228:443
        devices-iot.console.gotoresolve.com
        tls
        GoToResolveUnattended.exe
        1.3kB
         4.6kB
         11
        15
      • 18.245.162.101:443
        cdn.console.gotoresolve.com
        tls
        GoToResolveUnattended.exe
        6.2MB
         160.4MB
         95385
        114876
      • 13.107.246.64:443
        patchmanagement-binaries.services.gotoresolve.com
        tls
        GoToResolveUnattended.exe
        635.8kB
         36.2MB
         13568
        25978
      • 13.107.246.64:443
        alerts-binaries.services.gotoresolve.com
        tls
        GoToResolveUnattended.exe
        1.8kB
         6.1kB
         9
        11
      • 13.107.246.64:443
        antivirus-binaries.services.gotoresolve.com
        tls
        GoToResolveUnattended.exe
        1.8kB
         6.1kB
         9
        11
      • 13.107.246.64:443
        remoteexecution-binaries.services.gotoresolve.com
        tls
        GoToResolveUnattended.exe
        685.2kB
         39.3MB
         14665
        28138
      • 13.107.246.64:443
        goto-resolve-antivirus-worker-prod.azureedge.net
        tls
        GoToResolveUnattended.exe
        914.0kB
         53.2MB
         19631
        38054
      • 13.107.246.64:443
        goto-resolve-alerts-monitor-prod.azureedge.net
        tls
        GoToResolveUnattended.exe
        646.7kB
         37.0MB
         13852
        26471
      • 44.196.136.97:443
        dd-pipeline.console.gotoresolve.com
        tls
        GoTo.Resolve.DeviceData.App.exe
        1.5kB
         7.1kB
         14
        16
      • 40.113.178.33:443
        https://westeurope.livediagnostics.monitor.azure.com/QuickPulseService.svc/ping?ikey=19dca493-94b2-44d3-81d6-7b81beda4931
        tls, http
        GoTo.Resolve.Alerts.Monitor.App.exe
        1.7kB
         5.2kB
         10
        8

        HTTP Request

        POST https://westeurope.livediagnostics.monitor.azure.com/QuickPulseService.svc/ping?ikey=19dca493-94b2-44d3-81d6-7b81beda4931

        HTTP Response

        200
      • 40.113.178.33:443
        https://westeurope.livediagnostics.monitor.azure.com/QuickPulseService.svc/ping?ikey=19dca493-94b2-44d3-81d6-7b81beda4931
        tls, http
        GoTo.Resolve.Alerts.Monitor.App.exe
        1.7kB
         5.2kB
         9
        7

        HTTP Request

        POST https://westeurope.livediagnostics.monitor.azure.com/QuickPulseService.svc/ping?ikey=19dca493-94b2-44d3-81d6-7b81beda4931

        HTTP Response

        200
      • 40.113.178.33:443
        https://westeurope.livediagnostics.monitor.azure.com/QuickPulseService.svc/ping?ikey=19dca493-94b2-44d3-81d6-7b81beda4931
        tls, http
        GoTo.Resolve.Alerts.Monitor.App.exe
        1.7kB
         5.2kB
         9
        8

        HTTP Request

        POST https://westeurope.livediagnostics.monitor.azure.com/QuickPulseService.svc/ping?ikey=19dca493-94b2-44d3-81d6-7b81beda4931

        HTTP Response

        200
      • 40.117.80.207:443
        https://rt.services.visualstudio.com/QuickPulseService.svc/ping?ikey=e2939d3e-7996-4b20-98ee-1662e7d61a10
        tls, http
        GoTo.Resolve.PatchManagement.Client.exe
        1.6kB
         5.4kB
         8
        7

        HTTP Request

        POST https://rt.services.visualstudio.com/QuickPulseService.svc/ping?ikey=e2939d3e-7996-4b20-98ee-1662e7d61a10

        HTTP Response

        200
      • 40.117.80.207:443
        https://rt.services.visualstudio.com/QuickPulseService.svc/ping?ikey=05f32870-1d12-4fa1-bbf4-dc8789800299
        tls, http
        RemoteExecution.Runner.exe
        12.8kB
         10.4kB
         31
        19

        HTTP Request

        POST https://rt.services.visualstudio.com/QuickPulseService.svc/ping?ikey=05f32870-1d12-4fa1-bbf4-dc8789800299

        HTTP Response

        200

        HTTP Request

        POST https://rt.services.visualstudio.com/QuickPulseService.svc/ping?ikey=05f32870-1d12-4fa1-bbf4-dc8789800299

        HTTP Response

        200

        HTTP Request

        POST https://rt.services.visualstudio.com/QuickPulseService.svc/ping?ikey=05f32870-1d12-4fa1-bbf4-dc8789800299

        HTTP Response

        200

        HTTP Request

        POST https://rt.services.visualstudio.com/QuickPulseService.svc/ping?ikey=05f32870-1d12-4fa1-bbf4-dc8789800299

        HTTP Response

        200

        HTTP Request

        POST https://rt.services.visualstudio.com/QuickPulseService.svc/ping?ikey=05f32870-1d12-4fa1-bbf4-dc8789800299

        HTTP Response

        200

        HTTP Request

        POST https://rt.services.visualstudio.com/QuickPulseService.svc/ping?ikey=05f32870-1d12-4fa1-bbf4-dc8789800299

        HTTP Response

        200

        HTTP Request

        POST https://rt.services.visualstudio.com/QuickPulseService.svc/ping?ikey=05f32870-1d12-4fa1-bbf4-dc8789800299

        HTTP Response

        200

        HTTP Request

        POST https://rt.services.visualstudio.com/QuickPulseService.svc/ping?ikey=05f32870-1d12-4fa1-bbf4-dc8789800299

        HTTP Response

        200

        HTTP Request

        POST https://rt.services.visualstudio.com/QuickPulseService.svc/ping?ikey=05f32870-1d12-4fa1-bbf4-dc8789800299

        HTTP Response

        200

        HTTP Request

        POST https://rt.services.visualstudio.com/QuickPulseService.svc/ping?ikey=05f32870-1d12-4fa1-bbf4-dc8789800299

        HTTP Response

        200

        HTTP Request

        POST https://rt.services.visualstudio.com/QuickPulseService.svc/ping?ikey=05f32870-1d12-4fa1-bbf4-dc8789800299

        HTTP Response

        200

        HTTP Request

        POST https://rt.services.visualstudio.com/QuickPulseService.svc/ping?ikey=05f32870-1d12-4fa1-bbf4-dc8789800299

        HTTP Response

        200
      • 40.113.178.33:443
        https://westeurope.livediagnostics.monitor.azure.com/QuickPulseService.svc/ping?ikey=19dca493-94b2-44d3-81d6-7b81beda4931
        tls, http
        GoTo.Resolve.Alerts.Monitor.App.exe
        1.7kB
         5.2kB
         9
        7

        HTTP Request

        POST https://westeurope.livediagnostics.monitor.azure.com/QuickPulseService.svc/ping?ikey=19dca493-94b2-44d3-81d6-7b81beda4931

        HTTP Response

        200
      • 40.113.178.33:443
        https://westeurope.livediagnostics.monitor.azure.com/QuickPulseService.svc/ping?ikey=19dca493-94b2-44d3-81d6-7b81beda4931
        tls, http
        GoTo.Resolve.Alerts.Monitor.App.exe
        1.7kB
         5.2kB
         9
        7

        HTTP Request

        POST https://westeurope.livediagnostics.monitor.azure.com/QuickPulseService.svc/ping?ikey=19dca493-94b2-44d3-81d6-7b81beda4931

        HTTP Response

        200
      • 40.113.178.33:443
        https://westeurope.livediagnostics.monitor.azure.com/QuickPulseService.svc/ping?ikey=19dca493-94b2-44d3-81d6-7b81beda4931
        tls, http
        GoTo.Resolve.Alerts.Monitor.App.exe
        1.7kB
         5.2kB
         9
        8

        HTTP Request

        POST https://westeurope.livediagnostics.monitor.azure.com/QuickPulseService.svc/ping?ikey=19dca493-94b2-44d3-81d6-7b81beda4931

        HTTP Response

        200
      • 13.107.246.64:443
        patchmanagement-client-api.services.gotoresolve.com
        tls, https
        GoTo.Resolve.PatchManagement.Client.exe
        2.3kB
         6.9kB
         9
        12
      • 20.50.88.235:443
        https://dc.services.visualstudio.com/api/profiles/e2939d3e-7996-4b20-98ee-1662e7d61a10/appId
        tls, http
        GoTo.Resolve.PatchManagement.Client.exe
        912 B
         5.0kB
         8
        8

        HTTP Request

        GET https://dc.services.visualstudio.com/api/profiles/e2939d3e-7996-4b20-98ee-1662e7d61a10/appId

        HTTP Response

        200
      • 40.83.50.89:443
        https://fe2cr.update.microsoft.com/v6/ClientWebService/client.asmx
        tls, http2
        50.5kB
         355.9kB
         184
        277

        HTTP Request

        POST https://fe2cr.update.microsoft.com/v6/ClientWebService/client.asmx

        HTTP Response

        200

        HTTP Request

        POST https://fe2cr.update.microsoft.com/v6/ClientWebService/client.asmx

        HTTP Response

        200

        HTTP Request

        POST https://fe2cr.update.microsoft.com/v6/ClientWebService/client.asmx

        HTTP Response

        200

        HTTP Request

        POST https://fe2cr.update.microsoft.com/v6/ClientWebService/client.asmx

        HTTP Response

        200

        HTTP Request

        POST https://fe2cr.update.microsoft.com/v6/ClientWebService/client.asmx

        HTTP Response

        200

        HTTP Request

        POST https://fe2cr.update.microsoft.com/v6/ClientWebService/client.asmx

        HTTP Response

        200

        HTTP Request

        POST https://fe2cr.update.microsoft.com/v6/ClientWebService/client.asmx

        HTTP Response

        200
      • 40.113.178.33:443
        https://westeurope.livediagnostics.monitor.azure.com/QuickPulseService.svc/ping?ikey=d5c2d5c7-c95a-4316-9e4e-3f393c885a14
        tls, http
        GoTo.Resolve.Antivirus.App.exe
        1.8kB
         6.9kB
         10
        9

        HTTP Request

        POST https://westeurope.livediagnostics.monitor.azure.com/QuickPulseService.svc/ping?ikey=d5c2d5c7-c95a-4316-9e4e-3f393c885a14

        HTTP Response

        400
      • 20.49.111.33:443
        https://eastus.livediagnostics.monitor.azure.com/QuickPulseService.svc/ping?ikey=e2939d3e-7996-4b20-98ee-1662e7d61a10
        tls, http
        GoTo.Resolve.PatchManagement.Client.exe
        12.8kB
         9.6kB
         29
        19

        HTTP Request

        POST https://eastus.livediagnostics.monitor.azure.com/QuickPulseService.svc/ping?ikey=e2939d3e-7996-4b20-98ee-1662e7d61a10

        HTTP Response

        200

        HTTP Request

        POST https://eastus.livediagnostics.monitor.azure.com/QuickPulseService.svc/ping?ikey=e2939d3e-7996-4b20-98ee-1662e7d61a10

        HTTP Response

        200

        HTTP Request

        POST https://eastus.livediagnostics.monitor.azure.com/QuickPulseService.svc/ping?ikey=e2939d3e-7996-4b20-98ee-1662e7d61a10

        HTTP Response

        200

        HTTP Request

        POST https://eastus.livediagnostics.monitor.azure.com/QuickPulseService.svc/ping?ikey=e2939d3e-7996-4b20-98ee-1662e7d61a10

        HTTP Response

        200

        HTTP Request

        POST https://eastus.livediagnostics.monitor.azure.com/QuickPulseService.svc/ping?ikey=e2939d3e-7996-4b20-98ee-1662e7d61a10

        HTTP Response

        200

        HTTP Request

        POST https://eastus.livediagnostics.monitor.azure.com/QuickPulseService.svc/ping?ikey=e2939d3e-7996-4b20-98ee-1662e7d61a10

        HTTP Response

        200

        HTTP Request

        POST https://eastus.livediagnostics.monitor.azure.com/QuickPulseService.svc/ping?ikey=e2939d3e-7996-4b20-98ee-1662e7d61a10

        HTTP Response

        200

        HTTP Request

        POST https://eastus.livediagnostics.monitor.azure.com/QuickPulseService.svc/ping?ikey=e2939d3e-7996-4b20-98ee-1662e7d61a10

        HTTP Response

        200

        HTTP Request

        POST https://eastus.livediagnostics.monitor.azure.com/QuickPulseService.svc/ping?ikey=e2939d3e-7996-4b20-98ee-1662e7d61a10

        HTTP Response

        200

        HTTP Request

        POST https://eastus.livediagnostics.monitor.azure.com/QuickPulseService.svc/ping?ikey=e2939d3e-7996-4b20-98ee-1662e7d61a10

        HTTP Response

        200

        HTTP Request

        POST https://eastus.livediagnostics.monitor.azure.com/QuickPulseService.svc/ping?ikey=e2939d3e-7996-4b20-98ee-1662e7d61a10

        HTTP Response

        200
      • 40.113.178.33:443
        https://westeurope.livediagnostics.monitor.azure.com/QuickPulseService.svc/ping?ikey=d5c2d5c7-c95a-4316-9e4e-3f393c885a14
        tls, http
        GoTo.Resolve.Antivirus.App.exe
        1.7kB
         5.5kB
         9
        8

        HTTP Request

        POST https://westeurope.livediagnostics.monitor.azure.com/QuickPulseService.svc/ping?ikey=d5c2d5c7-c95a-4316-9e4e-3f393c885a14

        HTTP Response

        400
      • 199.232.210.172:80
        http://download.windowsupdate.com/d/msdownload/update/others/2015/05/17930914_a3b333eff1f0428f5a2c87724c542504821cdbd8.cab
        http
        663 B
         8.9kB
         9
        11

        HTTP Request

        GET http://download.windowsupdate.com/d/msdownload/update/others/2015/05/17930914_a3b333eff1f0428f5a2c87724c542504821cdbd8.cab

        HTTP Response

        200
      • 20.50.88.244:443
        https://dc.services.visualstudio.com/v2/track
        tls, http
        RemoteExecution.Runner.exe
        1.8kB
         5.1kB
         8
        9

        HTTP Request

        POST https://dc.services.visualstudio.com/v2/track

        HTTP Response

        200
      • 20.50.88.244:443
        https://dc.services.visualstudio.com/v2/track
        tls, http
        GoTo.Resolve.PatchManagement.Client.exe
        2.3kB
         5.5kB
         9
        9

        HTTP Request

        POST https://dc.services.visualstudio.com/v2/track

        HTTP Response

        206
      • 3.91.171.249:443
        905469987510.data-kinesis.us-east-1.amazonaws.com
        tls
        GoTo.Resolve.DeviceData.App.exe
        21.7kB
         7.8kB
         32
        30
      • 20.163.45.183:443
        https://fe2cr.update.microsoft.com/v6/ClientWebService/client.asmx
        tls, http2
        18.8kB
         3.8kB
         25
        12

        HTTP Request

        POST https://fe2cr.update.microsoft.com/v6/ClientWebService/client.asmx

        HTTP Response

        200
      • 204.79.197.200:443
        https://tse1.mm.bing.net/th?id=OADD2.10239360931609_1JAA48IJSET6WWQHH&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90
        tls, http2
        80.6kB
         2.4MB
         1712
        1706

        HTTP Request

        GET https://tse1.mm.bing.net/th?id=OADD2.10239360931610_110BPTPDN41GIXK2B&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90

        HTTP Request

        GET https://tse1.mm.bing.net/th?id=OADD2.10239340783938_154JBSOQL12JS43YR&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90

        HTTP Request

        GET https://tse1.mm.bing.net/th?id=OADD2.10239340783939_14IT4JGOWRFC6CMW9&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90

        HTTP Request

        GET https://tse1.mm.bing.net/th?id=OADD2.10239360931609_1JAA48IJSET6WWQHH&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90

        HTTP Response

        200

        HTTP Response

        200

        HTTP Response

        200

        HTTP Response

        200
      • 204.79.197.200:443
        tse1.mm.bing.net
        tls, http2
        1.2kB
         8.1kB
         16
        14
      • 204.79.197.200:443
        tse1.mm.bing.net
        tls, http2
        1.2kB
         8.1kB
         16
        14
      • 204.79.197.200:443
        tse1.mm.bing.net
        tls, http2
        1.2kB
         8.1kB
         16
        14
      • 20.163.45.183:443
        https://fe2cr.update.microsoft.com/v6/ClientWebService/client.asmx
        tls, http2
        18.8kB
         3.9kB
         25
        15

        HTTP Request

        POST https://fe2cr.update.microsoft.com/v6/ClientWebService/client.asmx

        HTTP Response

        200
      • 20.163.45.183:443
        https://fe2cr.update.microsoft.com/v6/ClientWebService/client.asmx
        tls, http2
        18.8kB
         3.8kB
         25
        12

        HTTP Request

        POST https://fe2cr.update.microsoft.com/v6/ClientWebService/client.asmx

        HTTP Response

        200
      • 20.163.45.183:443
        https://fe2cr.update.microsoft.com/v6/ClientWebService/client.asmx
        tls, http2
        18.8kB
         3.9kB
         25
        13

        HTTP Request

        POST https://fe2cr.update.microsoft.com/v6/ClientWebService/client.asmx

        HTTP Response

        200
      • 20.163.45.183:443
        fe2cr.update.microsoft.com
        tls
        349 B
         52 B
         3
        1
      • 8.8.8.8:53
        8.8.8.8.in-addr.arpa
        dns
        66 B
         90 B
         1
        1

        DNS Request

        8.8.8.8.in-addr.arpa

      • 8.8.8.8:53
        232.168.11.51.in-addr.arpa
        dns
        72 B
         158 B
         1
        1

        DNS Request

        232.168.11.51.in-addr.arpa

      • 8.8.8.8:53
        91.90.14.23.in-addr.arpa
        dns
        70 B
         133 B
         1
        1

        DNS Request

        91.90.14.23.in-addr.arpa

      • 8.8.8.8:53
        0.159.190.20.in-addr.arpa
        dns
        71 B
         157 B
         1
        1

        DNS Request

        0.159.190.20.in-addr.arpa

      • 8.8.8.8:53
        dumpster.console.gotoresolve.com
        dns
        GoToResolveUnattended.exe
        78 B
         110 B
         1
        1

        DNS Request

        dumpster.console.gotoresolve.com

        DNS Response

        35.157.186.199
        18.194.5.184

      • 8.8.8.8:53
        26.35.223.20.in-addr.arpa
        dns
        71 B
         157 B
         1
        1

        DNS Request

        26.35.223.20.in-addr.arpa

      • 8.8.8.8:53
        devices.console.gotoresolve.com
        dns
        GoToResolveUnattended.exe
        77 B
         125 B
         1
        1

        DNS Request

        devices.console.gotoresolve.com

        DNS Response

        3.224.59.159
        52.5.186.44
        34.193.161.223

      • 8.8.8.8:53
        ip.zscaler.com
        dns
        GoToResolveUnattended.exe
        60 B
         108 B
         1
        1

        DNS Request

        ip.zscaler.com

        DNS Response

        165.225.4.122
        165.225.4.120
        165.225.244.120

      • 8.8.8.8:53
        devices-iot.console.gotoresolve.com
        dns
        GoToResolveUnattended.exe
        81 B
         265 B
         1
        1

        DNS Request

        devices-iot.console.gotoresolve.com

        DNS Response

        54.243.5.228
        52.6.195.5
        54.172.5.229
        52.54.139.17
        54.152.76.135
        54.160.24.106
        54.173.243.251
        52.87.34.145

      • 8.8.8.8:53
        sessions.console.gotoresolve.com
        dns
        GoToResolveUnattended.exe
        78 B
         110 B
         1
        1

        DNS Request

        sessions.console.gotoresolve.com

        DNS Response

        3.67.114.44
        52.57.212.200

      • 8.8.8.8:53
        zerotrust.services.gotoresolve.com
        dns
        GoToResolveUnattended.exe
        80 B
         284 B
         1
        1

        DNS Request

        zerotrust.services.gotoresolve.com

        DNS Response

        13.107.246.64
        13.107.213.64

      • 8.8.8.8:53
        199.186.157.35.in-addr.arpa
        dns
        73 B
         140 B
         1
        1

        DNS Request

        199.186.157.35.in-addr.arpa

      • 8.8.8.8:53
        228.5.243.54.in-addr.arpa
        dns
        71 B
         125 B
         1
        1

        DNS Request

        228.5.243.54.in-addr.arpa

      • 8.8.8.8:53
        64.246.107.13.in-addr.arpa
        dns
        72 B
         158 B
         1
        1

        DNS Request

        64.246.107.13.in-addr.arpa

      • 8.8.8.8:53
        44.114.67.3.in-addr.arpa
        dns
        70 B
         134 B
         1
        1

        DNS Request

        44.114.67.3.in-addr.arpa

      • 8.8.8.8:53
        159.59.224.3.in-addr.arpa
        dns
        71 B
         125 B
         1
        1

        DNS Request

        159.59.224.3.in-addr.arpa

      • 8.8.8.8:53
        122.4.225.165.in-addr.arpa
        dns
        72 B
         132 B
         1
        1

        DNS Request

        122.4.225.165.in-addr.arpa

      • 8.8.8.8:53
        144.61.62.23.in-addr.arpa
        dns
        71 B
         135 B
         1
        1

        DNS Request

        144.61.62.23.in-addr.arpa

      • 8.8.8.8:53
        50.23.12.20.in-addr.arpa
        dns
        70 B
         156 B
         1
        1

        DNS Request

        50.23.12.20.in-addr.arpa

      • 8.8.8.8:53
        171.39.242.20.in-addr.arpa
        dns
        72 B
         158 B
         1
        1

        DNS Request

        171.39.242.20.in-addr.arpa

      • 8.8.8.8:53
        cdn.console.gotoresolve.com
        dns
        GoToResolveUnattended.exe
        73 B
         137 B
         1
        1

        DNS Request

        cdn.console.gotoresolve.com

        DNS Response

        18.245.162.101
        18.245.162.119
        18.245.162.112
        18.245.162.117

      • 8.8.8.8:53
        101.162.245.18.in-addr.arpa
        dns
        146 B
         130 B
         2
        1

        DNS Request

        101.162.245.18.in-addr.arpa

        DNS Request

        101.162.245.18.in-addr.arpa

      • 8.8.8.8:53
        104.219.191.52.in-addr.arpa
        dns
        73 B
         147 B
         1
        1

        DNS Request

        104.219.191.52.in-addr.arpa

      • 8.8.8.8:53
        139.53.16.96.in-addr.arpa
        dns
        71 B
         135 B
         1
        1

        DNS Request

        139.53.16.96.in-addr.arpa

      • 8.8.8.8:53
        240.221.184.93.in-addr.arpa
        dns
        73 B
         144 B
         1
        1

        DNS Request

        240.221.184.93.in-addr.arpa

      • 8.8.8.8:53
        alerts-binaries.services.gotoresolve.com
        dns
        GoToResolveUnattended.exe
        86 B
         343 B
         1
        1

        DNS Request

        alerts-binaries.services.gotoresolve.com

        DNS Response

        13.107.246.64
        13.107.213.64

      • 8.8.8.8:53
        patchmanagement-binaries.services.gotoresolve.com
        dns
        GoToResolveUnattended.exe
        95 B
         354 B
         1
        1

        DNS Request

        patchmanagement-binaries.services.gotoresolve.com

        DNS Response

        13.107.246.64
        13.107.213.64

      • 8.8.8.8:53
        antivirus-binaries.services.gotoresolve.com
        dns
        GoToResolveUnattended.exe
        89 B
         350 B
         1
        1

        DNS Request

        antivirus-binaries.services.gotoresolve.com

        DNS Response

        13.107.246.64
        13.107.213.64

      • 8.8.8.8:53
        remoteexecution-binaries.services.gotoresolve.com
        dns
        GoToResolveUnattended.exe
        95 B
         338 B
         1
        1

        DNS Request

        remoteexecution-binaries.services.gotoresolve.com

        DNS Response

        13.107.246.64
        13.107.213.64

      • 8.8.8.8:53
        goto-resolve-antivirus-worker-prod.azureedge.net
        dns
        GoToResolveUnattended.exe
        94 B
         293 B
         1
        1

        DNS Request

        goto-resolve-antivirus-worker-prod.azureedge.net

        DNS Response

        13.107.246.64
        13.107.213.64

      • 8.8.8.8:53
        goto-resolve-alerts-monitor-prod.azureedge.net
        dns
        GoToResolveUnattended.exe
        92 B
         289 B
         1
        1

        DNS Request

        goto-resolve-alerts-monitor-prod.azureedge.net

        DNS Response

        13.107.246.64
        13.107.213.64

      • 8.8.8.8:53
        dd-pipeline.console.gotoresolve.com
        dns
        GoTo.Resolve.DeviceData.App.exe
        81 B
         129 B
         1
        1

        DNS Request

        dd-pipeline.console.gotoresolve.com

        DNS Response

        44.196.136.97
        52.206.250.163
        54.92.170.80

      • 8.8.8.8:53
        97.136.196.44.in-addr.arpa
        dns
        72 B
         127 B
         1
        1

        DNS Request

        97.136.196.44.in-addr.arpa

      • 8.8.8.8:53
        westeurope.livediagnostics.monitor.azure.com
        dns
        GoTo.Resolve.Antivirus.App.exe
        90 B
         245 B
         1
        1

        DNS Request

        westeurope.livediagnostics.monitor.azure.com

        DNS Response

        40.113.178.33

      • 8.8.8.8:53
        33.178.113.40.in-addr.arpa
        dns
        72 B
         146 B
         1
        1

        DNS Request

        33.178.113.40.in-addr.arpa

      • 8.8.8.8:53
        30.243.111.52.in-addr.arpa
        dns
        144 B
         316 B
         2
        2

        DNS Request

        30.243.111.52.in-addr.arpa

        DNS Request

        30.243.111.52.in-addr.arpa

      • 8.8.8.8:53
        rt.services.visualstudio.com
        dns
        RemoteExecution.Runner.exe
        74 B
         269 B
         1
        1

        DNS Request

        rt.services.visualstudio.com

        DNS Response

        40.117.80.207

      • 8.8.8.8:53
        207.80.117.40.in-addr.arpa
        dns
        72 B
         146 B
         1
        1

        DNS Request

        207.80.117.40.in-addr.arpa

      • 8.8.8.8:53
        patchmanagement-client-api.services.gotoresolve.com
        dns
        GoTo.Resolve.PatchManagement.Client.exe
        194 B
         670 B
         2
        2

        DNS Request

        patchmanagement-client-api.services.gotoresolve.com

        DNS Request

        patchmanagement-client-api.services.gotoresolve.com

        DNS Response

        13.107.246.64
        13.107.213.64

        DNS Response

        13.107.246.64
        13.107.213.64

      • 8.8.8.8:53
        dc.services.visualstudio.com
        dns
        GoTo.Resolve.PatchManagement.Client.exe
        148 B
         880 B
         2
        2

        DNS Request

        dc.services.visualstudio.com

        DNS Request

        dc.services.visualstudio.com

        DNS Response

        20.50.88.235

        DNS Response

        20.50.88.242

      • 8.8.8.8:53
        fe2cr.update.microsoft.com
        dns
        72 B
         158 B
         1
        1

        DNS Request

        fe2cr.update.microsoft.com

        DNS Response

        40.83.50.89
        52.252.198.177

      • 8.8.8.8:53
        235.88.50.20.in-addr.arpa
        dns
        142 B
         157 B
         2
        1

        DNS Request

        235.88.50.20.in-addr.arpa

        DNS Request

        235.88.50.20.in-addr.arpa

      • 8.8.8.8:53
        89.50.83.40.in-addr.arpa
        dns
        140 B
         144 B
         2
        1

        DNS Request

        89.50.83.40.in-addr.arpa

        DNS Request

        89.50.83.40.in-addr.arpa

      • 8.8.8.8:53
        eastus.livediagnostics.monitor.azure.com
        dns
        GoTo.Resolve.PatchManagement.Client.exe
        86 B
         233 B
         1
        1

        DNS Request

        eastus.livediagnostics.monitor.azure.com

        DNS Response

        20.49.111.33

      • 8.8.8.8:53
        33.111.49.20.in-addr.arpa
        dns
        142 B
         314 B
         2
        2

        DNS Request

        33.111.49.20.in-addr.arpa

        DNS Request

        33.111.49.20.in-addr.arpa

      • 8.8.8.8:53
        westeurope.livediagnostics.monitor.azure.com
        dns
        GoTo.Resolve.Antivirus.App.exe
        180 B
         245 B
         2
        1

        DNS Request

        westeurope.livediagnostics.monitor.azure.com

        DNS Request

        westeurope.livediagnostics.monitor.azure.com

        DNS Response

        40.113.178.33

      • 8.8.8.8:53
        download.windowsupdate.com
        dns
        144 B
         486 B
         2
        2

        DNS Request

        download.windowsupdate.com

        DNS Request

        download.windowsupdate.com

        DNS Response

        199.232.210.172
        199.232.214.172

        DNS Response

        199.232.210.172
        199.232.214.172

      • 8.8.8.8:53
        172.210.232.199.in-addr.arpa
        dns
        74 B
         128 B
         1
        1

        DNS Request

        172.210.232.199.in-addr.arpa

      • 8.8.8.8:53
        dc.services.visualstudio.com
        dns
        GoTo.Resolve.PatchManagement.Client.exe
        148 B
         880 B
         2
        2

        DNS Request

        dc.services.visualstudio.com

        DNS Request

        dc.services.visualstudio.com

        DNS Response

        20.50.88.244

        DNS Response

        20.50.88.244

      • 8.8.8.8:53
        244.88.50.20.in-addr.arpa
        dns
        142 B
         314 B
         2
        2

        DNS Request

        244.88.50.20.in-addr.arpa

        DNS Request

        244.88.50.20.in-addr.arpa

      • 8.8.8.8:53
        905469987510.data-kinesis.us-east-1.amazonaws.com
        dns
        GoTo.Resolve.DeviceData.App.exe
        95 B
         133 B
         1
        1

        DNS Request

        905469987510.data-kinesis.us-east-1.amazonaws.com

        DNS Response

        3.91.171.249

      • 8.8.8.8:53
        43.39.156.108.in-addr.arpa
        dns
        72 B
         129 B
         1
        1

        DNS Request

        43.39.156.108.in-addr.arpa

      • 8.8.8.8:53
        249.171.91.3.in-addr.arpa
        dns
        142 B
         250 B
         2
        2

        DNS Request

        249.171.91.3.in-addr.arpa

        DNS Request

        249.171.91.3.in-addr.arpa

      • 8.8.8.8:53
        fe2cr.update.microsoft.com
        dns
        72 B
         158 B
         1
        1

        DNS Request

        fe2cr.update.microsoft.com

        DNS Response

        20.163.45.183
        52.152.180.153

      • 8.8.8.8:53
        183.45.163.20.in-addr.arpa
        dns
        72 B
         158 B
         1
        1

        DNS Request

        183.45.163.20.in-addr.arpa

      • 8.8.8.8:53
        tse1.mm.bing.net
        dns
        62 B
         173 B
         1
        1

        DNS Request

        tse1.mm.bing.net

        DNS Response

        204.79.197.200
        13.107.21.200

      • 8.8.8.8:53
        9.173.189.20.in-addr.arpa
        dns
        71 B
         157 B
         1
        1

        DNS Request

        9.173.189.20.in-addr.arpa

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\PROGRA~2\GOTORE~1\193791~1\x64\g2rvdd.dll
        Filesize

        141KB

        MD5

        e00f914a13981678cc130f7c65807f03

        SHA1

        0a00739f6f2b1c57946fc09f084deb5bd3d9e342

        SHA256

        484300ed3462124e23f42433678f8110aaebeec2da6b82e97fcd10ba2e60a0b8

        SHA512

        ec278c9d1dc3c066a2a1abd16a4d0f92142941916e0259d0787b7b3146979fba99e273bbbb2fc01fbab79f273d15892434e2685bc2badf4bbb48928d7e89f53c

        Download Submit

      • C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\FileManager.dll
        Filesize

        16.1MB

        MD5

        d3fa69a91fe17f9c4523d8fad2992f78

        SHA1

        d2a353b94ba3d718a489af7fe72cc858b74fe87e

        SHA256

        94df392a600acb29ff711f164073c1c80bbcf270dcc5a4cd8cba8e762b1ae40f

        SHA512

        cf2b0898bbf783e49112c61a7373c896856c5e5777d229b791804b29ab288f7613c5a67f4ebf38389d9b9c2100b88e93489a8d8aae68b090d9c7d6283d647e86

        Download Submit

      • C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\GoToResolveCrashHandler.exe
        Filesize

        1.1MB

        MD5

        c6e96dd2f500e4b3cedf7e627015e032

        SHA1

        35ea9753ca13c92971eff137c1cee613c0e93cab

        SHA256

        2b4556e9c709e1da52cab89aa754fab86c7bb5265e63850dc133dc4ca387fc70

        SHA512

        06e557d87fed5a1ff9d5d6a520429f6dc6d97e3f2952524ce30af5c25b017d39c15ce189092d0a9234c827510a07020cd31b9d172d60a8fdae6ad3f430b6339d

        Download Submit

      • C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\GoToResolveFileManager.exe
        Filesize

        109KB

        MD5

        62912afba6014da200e40c49f685f084

        SHA1

        38e4bd808305bf4b41c10da91daea49587743e32

        SHA256

        b2fc90c66d76aa33da449039e6ea5f66b43880b3ef86e7ae263e1e113f7c3296

        SHA512

        351938c08a92b663727ffb3b2f4a3377104013b3680f7ccd60394463c3b8992ea0e6115ebe847e0cfd9dba942c219af51de334204b2afdcc663a15901a81603f

        Download Submit

      • C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\GoToResolveLoggerProcess.exe
        Filesize

        109KB

        MD5

        d319e53da0d6ea80140611a19dd6c468

        SHA1

        e47768dbad5bc1bf81bd9f135c9d7a4f62de4573

        SHA256

        dc21f66e9dd2ca56504c3dcc02862117f2da94f212b289d3b09349bc59f57a25

        SHA512

        092617eb831cde6da475a759f9962c94ca70b78905f892a3a798a21cfe8d1e8e50d72dd0d2cdc89949a5f81e6a5d85b1597712112934a3ffab271b750089e32b

        Download Submit

      • C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\GoToResolveProcessChecker.exe
        Filesize

        107KB

        MD5

        5145ef194fdd47be876847e9b9534cdc

        SHA1

        34711371a01494b7432528821c75bd5fcfe851a4

        SHA256

        34e6f7d1fd0aa8b20cb8cac184b8ecd90c157ccc62e38568699efa10c411c7ea

        SHA512

        7e5fdaea1bb2501bc52801c11f36bbd6d165282eb920cddaba59a5c5999be57032a5e9f2b5196f54b300c51ae99381e7e1c831fa73422e0065174385a3ef6757

        Download Submit

      • C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\GoToResolveTools64.exe
        Filesize

        1.3MB

        MD5

        c3d3d6a881753584b29d60f4c5b6a965

        SHA1

        0952c70ea06b932a6c20cf8af10d3aa281880b7c

        SHA256

        f36b1c32a5fa8969422d99042287685634bb8d85c9643100032e9df5744dd39e

        SHA512

        5d1ebc3603690d1534d0624ffb73f947d1afe48f407540e07810df89ab737b47a1728a1829f9207be26bf03c2da3e7097ab8aedf31b212fc25ffe2ed632edcbf

        Download Submit

      • C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\GoToResolveUnattended.exe
        Filesize

        109KB

        MD5

        0e688254065af78d95a3fdf159ab8d86

        SHA1

        e1178f76ea31e1009f631ca0f0b948807392faa9

        SHA256

        1b6fc8321728fccd3a9a0f88f51ab115f0c6d227d644b948d9d0b58d1123c923

        SHA512

        71efb2e36026fd859522c593662ac7f607ad639027c0fa6cc2f4fc9e0c0bc9156ca4e90448f3e2795d693bad0d337b28147bea33747687524da70e598ddb430c

        Download Submit

      • C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\LibGoToResolve.dll
        Filesize

        19.7MB

        MD5

        c2b7eec9b082f83609d40a977c980c09

        SHA1

        e68345a8387c9644e1cc695ea1f8273e2911c63b

        SHA256

        1f13a2911d6cad19314f330bab9a57d81c8323575fdc7182e1c2eb6f844ba89b

        SHA512

        e0032b2acd49f20def25e799c39c7d9648e55250fb851c64b7a52b29aecfb5a3f8a83ded6963e221d16259b0e064504f92f1991a53c1e6a1a01044136e53de4e

        Download Submit

      • C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\MediaClientLib.dll
        Filesize

        13.9MB

        MD5

        12c3b59bbafa6ea8d0d3209e70ad39c2

        SHA1

        7f699dd519c20ecf8bf24947d03868c580913b39

        SHA256

        c132232018896ba3f84ff37a1ece4a7a58eef08afecf495fc31176b276b000bb

        SHA512

        55ebe552343ef28939d427f32e5ed98d11d734a65e050917e918efdf400806bbf809d8fc77beb48b6d2f4f5c7961f0c2c8a728691c4f217427578476bf64b10f

        Download Submit

      • C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\PasswordPrivacyDll.dll
        Filesize

        1.1MB

        MD5

        7a5ddf82d45f1060ac2386bf4ba89dd3

        SHA1

        ca26ead1e092c6612d7393873854ba0a257ae832

        SHA256

        95743c6c9d2f626fa66c3b95e2b3c003313089f653681c82c1e9c214ddd2778d

        SHA512

        5ad98d4985d36d6259027374c600913a5729635c71453c6191510ac1c4f3b9b732c6436eb49b9c0ddb2af753b08c699c1ca6c26c151cf52fce9cdb2b5a77bd5d

        Download Submit

      • C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\appdata\GoToResolveProcessChecker.log
        Filesize

        8KB

        MD5

        79456338a02f15328056b59bf6322111

        SHA1

        12666dcf5d3722d728aaa61ddb7fd2c7759b8c82

        SHA256

        c8b0b0cc6c2dfee2a4b89b8f2156c2fe12a7373e50f1160566656129a8cce691

        SHA512

        da9358cfa90f35ec645797e9e5888e4fa29ef69265e371f533fa0afd9e658295956ba0e831a15af3d52bb4203d99629b2d1432b30d6f25684f151bf7ace6ec30

        Download Submit

      • C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\appdata\GoToResolveUnattended.log
        Filesize

        29KB

        MD5

        909f9a7d06f5d785c90c6bc5266b3a01

        SHA1

        ac74e5a338e58c744310a3df0c2ad6942ba1f2e1

        SHA256

        663654993fcbb857ef4e9b02a29ef412d1f41463133052d21638fb5aa9495dac

        SHA512

        0840c00313bb95ca243111d95583eadf378fa8f8afb2dd88ff8aa9e09449dbadef87bf11a4dffdccbba7c88d0cb78777f85d64f72322465ca42d946284955774

        Download Submit

      • C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\externalmodules\AlertsModule\1.2024.0430.2\logs\2024-05-16.log
        Filesize

        4KB

        MD5

        0354cce08685b9e9fb9e4e66b70dc3a5

        SHA1

        00639ddb4c0c1fe68d0a115983298526b96aef87

        SHA256

        4d811296a07faab494bfbec17370e2e5cffef3830841e5cf440be90c22ba5788

        SHA512

        84ac938a3a1796e99e42a766131a71584f3cca4dcc43cd734d7814ad55a7553be407eed063f83dd692f1cd8fbce5d2428a2764bb9d3529f8ca28f01dd2370f87

        Download Submit

      • C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\externalmodules\AlertsModule\1.2024.0430.2\logs\2024-05-16.log
        Filesize

        1KB

        MD5

        30016934851d6c2070a7c697b5004bf5

        SHA1

        9d6bba656ccb22a5f44c3128673cfb6687977738

        SHA256

        f19d3f123ee77b34e9d4f84709e4105df45ea66eaa3445e085e95af953c778c8

        SHA512

        a26d7400e9f0f7f494968d673d8dba7d40d8c119a2cefe0d9e1c0d671dde096f6f1abf5362ef46286f07054575e50ff28100087a946553c96cb08b1885980f16

        Download Submit

      • C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\externalmodules\AntivirusModule\1.2024.0411.2\GoTo.Resolve.Antivirus.App.exe
        Filesize

        161KB

        MD5

        0ee709e29bad3bf3677eb380ae9fe100

        SHA1

        655d7ae9fbce8f5ec9fb1ebbf1edd34a7fcb0501

        SHA256

        7680070e0ba04e4219943cf513cdb004cd20aa5fcccf9644b8caa1cdf9a3f4fc

        SHA512

        5e0fabb74c25864f5fc6f2fd44aa0ed1337745c66246ae3e48d6ec0c1a1d18b718fc9e2d3d34cae974434a8f8625de9ff6615e6d4c8a55b0132ffbf6b0f469d7

        Download Submit

      • C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\externalmodules\DeviceDataModule\1.71.0\GoTo.Resolve.DeviceData.App.exe
        Filesize

        11.5MB

        MD5

        5c76b75ea22c81a9224456f77ab1175f

        SHA1

        b681216752e17148d341390d1c778e4c5ba33364

        SHA256

        0bc404e30bdad9be1d7ed633adc054800f2e7e757e6414795136c0a896b0bb87

        SHA512

        a18172f9ba6f6ee62c64cd4f506791c9592436a7cd9f06710794e86a26748bd6d51406420cfc89474fe0c1375e56f3ce1ccc834cd1799a5cc7decadcf63eef0a

        Download Submit

      • C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\externalmodules\RemoteExecutionModule\1.2024.0506.1\RemoteExecution.Runner.exe
        Filesize

        164KB

        MD5

        840ed278c7882f3b877df906937aa3c5

        SHA1

        0262be6cd5f1596e5b54ecc910efd6e277920c03

        SHA256

        8f70badc067ff6e828d6afccaead174a7623a8ef89c1c81a614f5fa8648f1019

        SHA512

        2e2ae3b5ba9b9394f386c2243da93ad3f7f35102f50be2206bf06cd48401bb8de5e1fb4ab18b29fa53ad8530474fdef3490df98aca7bc3ba2295485b911630c2

        Download Submit

      • C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\libcrypto-3.dll
        Filesize

        4.2MB

        MD5

        dc2bd7e6e6a3b528424410af077ba2a7

        SHA1

        aa891f61820e7c6d0ed35989a595af77f4b7203b

        SHA256

        e852018ec59efbe2dc2e32c064f35ee68171417d8c5bc5ba319609555dde2bc6

        SHA512

        a96f57f5d0272f8ba4ccb1b184289f0caeace54d001f641622fe38892fa9d0f6781808cf5a585d77fc75c356bb90c03a062b2fb17b09a29e20b0264b12c8358f

        Download Submit

      • C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\libssl-3.dll
        Filesize

        1.1MB

        MD5

        4f19c36b09b820d9371d8b6510497475

        SHA1

        03b8ee682eeac39e120aac474a54344c2b391150

        SHA256

        11598140036154dcd8ccd5619ac059aea4012cf9a4535ffa7c9b2f0ae405906d

        SHA512

        8ed2ee897c54abf13beae299902018861c4bc30a1ce5d14a64129af3856a3d2e5829eb060a99f7ea7bb894966e21a2d5eec473323883c865c0caed9de832d1b6

        Download Submit

      • C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\logger.json.tmp
        Filesize

        375B

        MD5

        60fe6c758548ab263951145da28e8434

        SHA1

        64402d6630d040a5da12184d62020a76c09c4308

        SHA256

        8c15b4cc110ebb9250d811bd21dc02be201c6e7e536b3ba546d81c82504edd76

        SHA512

        49b4a71ff8a3dbd7346f8fa35580f2259c868f56ec26a5ed00299b00f9b4fa8b8bb64f5dce4e59394ba9a5c518582a426a6004007765d5d39854c8b370426adc

        Download Submit

      • C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\mandatory.json
        Filesize

        74B

        MD5

        f50767df127a399996304f5a1259653a

        SHA1

        0a03f644be27865e0031b235ca6a21353e265ed7

        SHA256

        afc6a427fd31151d995e93e66edd9138df27dc88580b03b12d8a8012c481f3bd

        SHA512

        29898528d9047d2689de8be7938662c0e80c5161c20fcb9fa9135378b2c2193c6185cd560148f3fd7100824f7f43265434d9982c1b85933f3d00490804c7853e

        Download Submit

      • C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\mandatory.json.tmp
        Filesize

        1KB

        MD5

        91b5dc7a02fc3d30801d0b32074c5fe4

        SHA1

        c0c670e03a8cb77f34fff695503ef1f8caeb378c

        SHA256

        d626426cd816c31cec9fdc64cf2ef7d79a5bfa816f349b4666ba08f36a7f573b

        SHA512

        e8f137892ec0604a45e79d3b3c9b35e9850d8f36867166d8b38ce68e3eafa9bc47ac254bd23d28d0bcb5f2038c3aba03b1e9c9b26d6f8e76240973acd24c0617

        Download Submit

      • C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\unattended.json
        Filesize

        582B

        MD5

        c5b571903e37d2b955cd21f584471ed3

        SHA1

        267332217a876f04c16e8b92141fa8321dd6fc74

        SHA256

        f967768b99cebe2225ef1c41d9ee31c21f9014f87f29cf30c487b448aa074dfa

        SHA512

        e849d1bfceaa9450505c27119ec407d19b017a3748d907c73fcb915b46fbf7b1bb75c85be066d8898cdbda0d942389c965f2102522cd049211269f4ba4cdac3a

        Download Submit

      • C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\unattended.json.tmp
        Filesize

        703B

        MD5

        49271953cc7e7b5b920c292bd93026c1

        SHA1

        bddb772d4c859a56bea173c61023f973600d4bd8

        SHA256

        19eb67cc4ed0b294ba19f7ff2ab3c3f616cb05f27b9d6b87071fa52b9754b8ef

        SHA512

        d8e74aaf6eb247b64f2881711cd15d490a21373a197142aa9edb6593fed1d39b44e38c7783621b47b56b78861920dba720d311ad601150905f2365544acbf224

        Download Submit

      • C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\unattended.json.tmp
        Filesize

        1KB

        MD5

        a1f360682341d2b275f72960711eec2a

        SHA1

        260a695a9c81784a635b65c5c5a41a87272cf968

        SHA256

        5dc62a805c33a101370c6a12d927062e92752c32fc7a2f90ee15a4cb96b9617d

        SHA512

        9e9d1b53f0c3ad03c2e1f297b36d385671ccce01b71c866318c86d83e9969e05543717c92c47eef9b8058ed0998f50a6a03341b80f46976b7c81f02254af42fb

        Download Submit

      • C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\unattended.json.tmp
        Filesize

        1KB

        MD5

        f04525148fcd222fddfc876734dfb017

        SHA1

        fe2c657e820f2111a5e9feb51ba96a2128ffb3af

        SHA256

        3629ad46423b8150a6ec21c1412f958c8331f4e2bf01c49ec8f224a5df5cd1c3

        SHA512

        ea08b2f9f459e42c22970123a45d511fb38900d13b414e7013a24a14eaad26796ef9fe76836c9290a9898d4b553c07520e8acbcabe24cd0031f3796f778b61b1

        Download Submit

      • C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\unattended.json.tmp
        Filesize

        1KB

        MD5

        e6464a2670a2caef554ffbdb459dcee8

        SHA1

        6424382cbf3909b17fc3b298da9eaf9418b5c885

        SHA256

        be9cc4edc8727a0656d1ceeca29030255b34e25fb6607770af920b558b5b6436

        SHA512

        f09aee2d45774ccc6074878db0f96fab8840307b624e03fb46bcf8c8e23b7214490f474f158c4da03136168caf7ddd70d0df11d7dc005646bef899546307ab8b

        Download Submit

      • C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\unattended.json.tmp
        Filesize

        1KB

        MD5

        421d95aa876f95215ee8d000e88ff2c6

        SHA1

        d42911b7b360a172049242b8bbdd04ea9dfa00b3

        SHA256

        b9fe3ef599a8984d1e58ab10194d98c019115f82b80778c13edbebcd3a68c8fd

        SHA512

        7044a01940d6a76234618492945e93e178d6ede0088b340d3668e5c17c9d627cd4160b0eec334745be8b3755d5239f450e26417b207fd0ecab5b89a7e9b5a89d

        Download Submit

      • C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\unattended.json.tmp
        Filesize

        1KB

        MD5

        44333f285d83e68c68d1d212ae8529fa

        SHA1

        b4f94c23b88ab9a4783a8d3f4d1837225a89de52

        SHA256

        25ed0f06e7769799d7160f98a893af3671dcbf359cde8685536891a29f33d7b0

        SHA512

        4e310b596e006549edb3977c6b5f49b5eea61221e3aae843006351d429851cb7ebc7b6483846711afb0d093c2789d02a61e3a0cff2b41f22238172962aa796fa

        Download Submit

      • C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\x64\g2rvdd.inf
        Filesize

        3KB

        MD5

        79c299099a8f43e1a94047355ebdf1cc

        SHA1

        55ede099780c9e2dcc8cb3dd9006fbf098c8997b

        SHA256

        0a70026b5ac03d6c3c930c245fb992ad9c02192be607e62d27691909f331fe8d

        SHA512

        270c8600ed3c00aa6625bbd2c5777a19949773f8c58ddd560bf2d39fac2e9f5868ed633d60728e8d4a106d97a62d43056d818e1fea565198446c487a83342a7d

        Download Submit

      • C:\Users\Admin\AppData\Local\GoTo Resolve Installer\GoTo0001.tmp\UnattendedUpdater.csv
        Filesize

        3KB

        MD5

        d93e12207e578337fbe0c13683924007

        SHA1

        f422b2e7f441f5aa97d64e121494b139149fcf8e

        SHA256

        a36b3611d0880ec92afd1a77c5835ca708b21dbf216c0748c47f6a6cfefc9f30

        SHA512

        b48e15b1e794d64a75900ab645c570d4e6e082c6375c1bd41c5015e195255e6f1329796714df9e3632ab9520570f041e44bdd5bef1d5747a83c416df090a4d16

        Download Submit

      • C:\Windows\System32\DriverStore\Temp\{7df457cc-a637-f14a-8c8a-1ec7eeb0a973}\SET68DC.tmp
        Filesize

        10KB

        MD5

        8d2c58325f63af51d37693e7ffbdbc4d

        SHA1

        ea0507cdf4528faa174eb5883eb20b90363ed512

        SHA256

        6fe045e8a6ff18e27c6aceeeb7dbea3e5f3f25c3796d42f0d844b1b48f38c0be

        SHA512

        71ee9b93d70ace69344d9aeb582ab8110eeb5364cd0d593ecd95b2d57000114aac18f2496c160d2b761b0117c5e26d261d757b424fa6e57b91b98b75ac72dd62

        Download Submit

      • C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\ApplicationInsights\bf35fe7d15f2a58d930da8c8f390b78245b9136f9bb24b2713ab881c60fe52f1\hqb0dhos.4lq
        Filesize

        1B

        MD5

        93b885adfe0da089cdf634904fd59f71

        SHA1

        5ba93c9db0cff93f52b521d7420e43f6eda2784f

        SHA256

        6e340b9cffb37a989ca544e6bb780a2c78901d3fb33738768511a30617afa01d

        SHA512

        b8244d028981d693af7b456af8efa4cad63d282e19ff14942c246e50d9351d22704a802a71c3580b6370de4ceb293c324a8423342557d4e5c38438f0e36910ee

        Download Submit

      We care about your privacy.

      This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.