Edit tour

Windows Analysis Report
https://download.anydesk.com/AnyDesk.exe

Overview

General Information

Sample URL:	https://download.anydesk.com/AnyDesk.exe
Analysis ID:	1351494
Infos:

Detection

Score:	68
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Detected unpacking (changes PE section rights)

Queries memory information (via WMI often done to detect virtual machines)

Queries sensitive physical memory information (via WMI, Win32_PhysicalMemory, often done to detect virtual machines)

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Hides that the sample has been downloaded from the Internet (zone.identifier)

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Tries to disable installed Antivirus / HIPS / PFW

Queries the volume information (name, serial number etc) of a device

May sleep (evasive loops) to hinder dynamic analysis

Found dropped PE file which has not been started or loaded

Contains long sleeps (>= 3 min)

Creates a DirectInput object (often for capturing keystrokes)

Drops files with a non-matching file extension (content does not match file extension)

PE file does not import any functions

Installs a raw input device (often for capturing keystrokes)

OS version to string mapping found (often used in BOTs)

PE file contains an invalid checksum

Drops PE files

Tries to load missing DLLs

Creates a window with clipboard capturing capabilities

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

PE file overlay found

Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)

Creates a process in suspended mode (likely to inject code)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Classification

Process Tree

System is w7x64

chrome.exe (PID: 424 cmdline: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank MD5: FFA2B8E17F645BCC20F0E0201FEF83ED)

chrome.exe (PID: 1436 cmdline: "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1428 --field-trial-handle=1232,i,645987832037181172,1117646879316641362,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: FFA2B8E17F645BCC20F0E0201FEF83ED)

chrome.exe (PID: 1544 cmdline: "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4348 --field-trial-handle=1232,i,645987832037181172,1117646879316641362,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: FFA2B8E17F645BCC20F0E0201FEF83ED)

chrome.exe (PID: 1784 cmdline: "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4416 --field-trial-handle=1232,i,645987832037181172,1117646879316641362,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: FFA2B8E17F645BCC20F0E0201FEF83ED)

chrome.exe (PID: 1160 cmdline: "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5452 --field-trial-handle=1232,i,645987832037181172,1117646879316641362,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: FFA2B8E17F645BCC20F0E0201FEF83ED)

chrome.exe (PID: 1788 cmdline: "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5468 --field-trial-handle=1232,i,645987832037181172,1117646879316641362,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: FFA2B8E17F645BCC20F0E0201FEF83ED)

chrome.exe (PID: 1788 cmdline: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" "https://download.anydesk.com/AnyDesk.exe MD5: FFA2B8E17F645BCC20F0E0201FEF83ED)

AnyDesk.exe (PID: 2816 cmdline: C:\Users\user\Downloads\AnyDesk.exe MD5: 75EECC3A8B215C465F541643E9C4F484)

AnyDesk.exe (PID: 908 cmdline: "C:\Users\user\Downloads\AnyDesk.exe" --local-service MD5: 75EECC3A8B215C465F541643E9C4F484)

AnyDesk.exe (PID: 2040 cmdline: "C:\Users\user\Downloads\AnyDesk.exe" --local-control MD5: 75EECC3A8B215C465F541643E9C4F484)

cleanup

HTTP traffic detected: POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1Host: accounts.google.comConnection: keep-aliveContent-Length: 1Origin: https://www.google.comContent-Type: application/x-www-form-urlencodedSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: CONSENT=PENDING+962; SOCS=CAESHAgCEhJnd3NfMjAyMzA4MDEtMF9SQzMaAmVuIAEaBgiAi8amBg; AEC=Ad49MVFCiIL4dH3NdVUPM9qw5tUX8unGaMgN_qTAwv0uoiOzKAI-JttOlg; __Secure-ENID=14.SE=LM-NkPAvbCtuNhK73uRS1U27fKMegq7R6_Ue_GnOGI1dekNKandC6Dto1fKS9ocnnyUmf2MAXGM269U9HhkgndYLxWy3FrZaGzh_yODdv1ouU12fBCNmRhMUwM3dzKbRlYRnbKhIQz9fV5WGdCRRjXQx5RGii6FbIw100Hc46oWQ6bysmy2hqA

Source: unknown

DNS traffic detected: queries for: clients2.google.com

Source: global traffic	HTTP traffic detected: GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=109.0.5414.120&lang=en-US&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1Host: clients2.google.comConnection: keep-aliveX-Goog-Update-Interactivity: fgX-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmiedaX-Goog-Update-Updater: chromecrx-109.0.5414.120Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /AnyDesk.exe HTTP/1.1Host: download.anydesk.comConnection: keep-alivesec-ch-ua: "Not_A Brand";v="99", "Google Chrome";v="109", "Chromium";v="109"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: unknown

HTTPS traffic detected: 185.209.179.55:443 -> 192.168.2.22:49176 version: TLS 1.2

Source: AnyDesk.exe, 0000000A.00000002.541131731.0000000000DF5000.00000002.00000001.01000000.00000003.sdmp

Binary or memory string: DirectDrawCreateEx

memstr_2854fdc4-2

Source: AnyDesk.exe, 0000000A.00000002.541131731.0000000000DF5000.00000002.00000001.01000000.00000003.sdmp

Binary or memory string: GetRawInputData

memstr_158e6912-a

Source: C:\Users\user\Downloads\AnyDesk.exe

Window created: window name: CLIPBRDWNDCLASS

Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\Google	Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\Google\GoogleUpdater	Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_BITS_424_1573113678	Jump to behavior

Source:	Binary string: C:\b\build\slave\win\build\src\out\Release\gcapi_dll.dll.pdbGCTL source: AnyDesk.exe, 0000000B.00000002.541822382.0000000006601000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.exe, 0000000B.00000002.541822382.00000000065E5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Buildbot\ad-windows-32\build\release\dwm_dda-32\privacy_feature\privacy_feature.pdb source: AnyDesk.exe, 0000000A.00000003.526458695.0000000002B30000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.exe, 0000000A.00000002.541228025.0000000001496000.00000004.00000001.01000000.00000003.sdmp, AnyDesk.exe, 0000000B.00000002.541231778.0000000001496000.00000004.00000001.01000000.00000003.sdmp
Source:	Binary string: C:\Buildbot\ad-windows-32\build\release\app-32\win_loader\AnyDesk.pdb source: AnyDesk.exe, 0000000A.00000002.541285392.0000000001640000.00000002.00000001.01000000.00000003.sdmp, AnyDesk.exe, 0000000B.00000000.527980854.0000000001640000.00000002.00000001.01000000.00000003.sdmp, AnyDesk.exe, 0000000C.00000002.541310729.0000000001640000.00000002.00000001.01000000.00000003.sdmp
Source:	Binary string: C:\Buildbot\ad-windows-32\build\release\dwm_dda-64\win_dwm\win_dwm.pdb source: AnyDesk.exe, 0000000A.00000003.526458695.0000000002B30000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.exe, 0000000A.00000002.541228025.0000000001496000.00000004.00000001.01000000.00000003.sdmp, AnyDesk.exe, 0000000B.00000002.541231778.0000000001496000.00000004.00000001.01000000.00000003.sdmp
Source:	Binary string: C:\Buildbot\ad-windows-32\build\release\dwm_dda-32\win_dwm\win_dwm.pdb source: AnyDesk.exe, 0000000A.00000002.541228025.000000000145A000.00000004.00000001.01000000.00000003.sdmp, AnyDesk.exe, 0000000A.00000003.526458695.0000000002B30000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.exe, 0000000B.00000002.541231778.000000000145A000.00000004.00000001.01000000.00000003.sdmp, AnyDesk.exe, 0000000C.00000002.541246062.000000000145A000.00000004.00000001.01000000.00000003.sdmp
Source:	Binary string: C:\Buildbot\ad-windows-32\build\release\dwm_dda-64\privacy_feature\privacy_feature.pdb source: AnyDesk.exe, 0000000A.00000002.541228025.0000000001534000.00000004.00000001.01000000.00000003.sdmp, AnyDesk.exe, 0000000A.00000003.526458695.0000000002B30000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.exe, 0000000B.00000002.541231778.0000000001534000.00000004.00000001.01000000.00000003.sdmp
Source:	Binary string: C:\Buildbot\ad-windows-32\build\release\app-32\win_app\win_app.pdb source: AnyDesk.exe, 0000000A.00000002.541131731.0000000000DF5000.00000002.00000001.01000000.00000003.sdmp, AnyDesk.exe, 0000000A.00000003.526458695.0000000002B30000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.exe, 0000000B.00000002.541128723.0000000000DF5000.00000002.00000001.01000000.00000003.sdmp
Source:	Binary string: C:\Buildbot\ad-windows-32\build\release\app-32\win_app\win_app.pdb` source: AnyDesk.exe, 0000000A.00000003.526458695.0000000002B30000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\b\build\slave\win\build\src\out\Release\gcapi_dll.dll.pdb source: AnyDesk.exe, 0000000B.00000002.541822382.0000000006601000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.exe, 0000000B.00000002.541822382.00000000065E5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: SAS.pdbR source: AnyDesk.exe, 0000000A.00000002.541228025.000000000145A000.00000004.00000001.01000000.00000003.sdmp, AnyDesk.exe, 0000000A.00000003.526458695.0000000002B30000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.exe, 0000000B.00000002.541231778.000000000145A000.00000004.00000001.01000000.00000003.sdmp, AnyDesk.exe, 0000000C.00000002.541246062.000000000145A000.00000004.00000001.01000000.00000003.sdmp
Source:	Binary string: SAS.pdb source: AnyDesk.exe, 0000000A.00000002.541228025.000000000145A000.00000004.00000001.01000000.00000003.sdmp, AnyDesk.exe, 0000000A.00000003.526458695.0000000002B30000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.exe, 0000000B.00000002.541231778.000000000145A000.00000004.00000001.01000000.00000003.sdmp, AnyDesk.exe, 0000000C.00000002.541246062.000000000145A000.00000004.00000001.01000000.00000003.sdmp

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49169
Source: unknown	Network traffic detected: HTTP traffic on port 49163 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49168
Source: unknown	Network traffic detected: HTTP traffic on port 49164 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49166
Source: unknown	Network traffic detected: HTTP traffic on port 49165 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49165
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49176
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49164
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49163
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49174
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49172
Source: unknown	Network traffic detected: HTTP traffic on port 49172 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49168 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49169 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49176 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49166 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49174 -> 443

Source: 21c5056f-a98c-4a81-9c27-b98d59e1480b.tmp.0.dr	Static PE information: No import functions for PE file found
Source: chromecache_78.1.dr	Static PE information: No import functions for PE file found
Source: Unconfirmed 683976.crdownload.0.dr	Static PE information: No import functions for PE file found

Source: C:\Users\user\Downloads\AnyDesk.exe	Memory allocated: 770B0000 page execute and read and write	Jump to behavior
Source: C:\Users\user\Downloads\AnyDesk.exe	Memory allocated: 771D0000 page execute and read and write	Jump to behavior
Source: C:\Users\user\Downloads\AnyDesk.exe	Memory allocated: 770B0000 page execute and read and write	Jump to behavior
Source: C:\Users\user\Downloads\AnyDesk.exe	Memory allocated: 771D0000 page execute and read and write	Jump to behavior
Source: C:\Users\user\Downloads\AnyDesk.exe	Memory allocated: 770B0000 page execute and read and write	Jump to behavior
Source: C:\Users\user\Downloads\AnyDesk.exe	Memory allocated: 771D0000 page execute and read and write	Jump to behavior

Source: unknown	Process created: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1428 --field-trial-handle=1232,i,645987832037181172,1117646879316641362,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" "https://download.anydesk.com/AnyDesk.exe
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4348 --field-trial-handle=1232,i,645987832037181172,1117646879316641362,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4416 --field-trial-handle=1232,i,645987832037181172,1117646879316641362,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5452 --field-trial-handle=1232,i,645987832037181172,1117646879316641362,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Users\user\Downloads\AnyDesk.exe C:\Users\user\Downloads\AnyDesk.exe
Source: C:\Users\user\Downloads\AnyDesk.exe	Process created: C:\Users\user\Downloads\AnyDesk.exe "C:\Users\user\Downloads\AnyDesk.exe" --local-service
Source: C:\Users\user\Downloads\AnyDesk.exe	Process created: C:\Users\user\Downloads\AnyDesk.exe "C:\Users\user\Downloads\AnyDesk.exe" --local-control
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1428 --field-trial-handle=1232,i,645987832037181172,1117646879316641362,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4348 --field-trial-handle=1232,i,645987832037181172,1117646879316641362,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4416 --field-trial-handle=1232,i,645987832037181172,1117646879316641362,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5452 --field-trial-handle=1232,i,645987832037181172,1117646879316641362,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" "https://download.anydesk.com/AnyDesk.exe	Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Downloads\AnyDesk.exe	Process created: C:\Users\user\Downloads\AnyDesk.exe "C:\Users\user\Downloads\AnyDesk.exe" --local-service	Jump to behavior
Source: C:\Users\user\Downloads\AnyDesk.exe	Process created: C:\Users\user\Downloads\AnyDesk.exe "C:\Users\user\Downloads\AnyDesk.exe" --local-control	Jump to behavior

Source: C:\Users\user\Downloads\AnyDesk.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\ad_qipcmtx_908_2584_4
Source: C:\Users\user\Downloads\AnyDesk.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\ad_qipcmtx_908_2584_5
Source: C:\Users\user\Downloads\AnyDesk.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\ad_qipcmtx_908_2584_6
Source: C:\Users\user\Downloads\AnyDesk.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\ad_qipcstobjmtx
Source: C:\Users\user\Downloads\AnyDesk.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\ad_qipcmtx_2040_2448_0
Source: C:\Users\user\Downloads\AnyDesk.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\ad_qipcmtx_908_2584_3
Source: C:\Users\user\Downloads\AnyDesk.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\ad_qipcmtx_908_2584_11
Source: C:\Users\user\Downloads\AnyDesk.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\ad_qipcmtx_908_2584_12
Source: C:\Users\user\Downloads\AnyDesk.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\ad_qipcmtx_908_2584_13
Source: C:\Users\user\Downloads\AnyDesk.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\ad_qipcmtx_908_2584_17
Source: C:\Users\user\Downloads\AnyDesk.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\ad_qipcmtx_2040_540_0
Source: C:\Users\user\Downloads\AnyDesk.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\ad_qipcmtx_908_2584_18

Source: C:\Users\user\Downloads\AnyDesk.exe	Unpacked PE file: 10.2.AnyDesk.exe.3b0000.0.unpack .text:ER;.itext:W;.rdata:R;.data:W;.rsrc:R;.reloc:R; vs .text:ER;.itext:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;
Source: C:\Users\user\Downloads\AnyDesk.exe	Unpacked PE file: 11.2.AnyDesk.exe.3b0000.0.unpack .text:ER;.itext:W;.rdata:R;.data:W;.rsrc:R;.reloc:R; vs .text:ER;.itext:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;
Source: C:\Users\user\Downloads\AnyDesk.exe	Unpacked PE file: 12.2.AnyDesk.exe.3b0000.0.unpack .text:ER;.itext:W;.rdata:R;.data:W;.rsrc:R;.reloc:R; vs .text:ER;.itext:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;

Source: 21c5056f-a98c-4a81-9c27-b98d59e1480b.tmp.0.dr	Static PE information: real checksum: 0x5479da should be: 0x15b2
Source: gcapi.dll.11.dr	Static PE information: real checksum: 0x0 should be: 0x6c9a9

Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\Downloads\21c5056f-a98c-4a81-9c27-b98d59e1480b.tmp	Jump to dropped file
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\Downloads\Unconfirmed 683976.crdownload	Jump to dropped file
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	File created: Chrome Cache Entry: 78	Jump to dropped file
Source: C:\Users\user\Downloads\AnyDesk.exe	File created: C:\Users\user\AppData\Local\Temp\gcapi.dll	Jump to dropped file
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	File created: (copy)	Jump to dropped file

Source: C:\Users\user\Downloads\AnyDesk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Downloads\AnyDesk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Downloads\AnyDesk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Downloads\AnyDesk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Downloads\AnyDesk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Downloads\AnyDesk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Downloads\AnyDesk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Downloads\AnyDesk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Downloads\AnyDesk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Downloads\AnyDesk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Downloads\AnyDesk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\Downloads\AnyDesk.exe TID: 1720	Thread sleep time: -5534023222112862s >= -30000s	Jump to behavior
Source: C:\Users\user\Downloads\AnyDesk.exe TID: 1548	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Users\user\Downloads\AnyDesk.exe TID: 1900	Thread sleep time: -180000s >= -30000s	Jump to behavior
Source: C:\Users\user\Downloads\AnyDesk.exe TID: 1384	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Downloads\AnyDesk.exe TID: 1720	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Downloads\AnyDesk.exe TID: 1712	Thread sleep time: -180000s >= -30000s	Jump to behavior
Source: C:\Users\user\Downloads\AnyDesk.exe TID: 2300	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Users\user\Downloads\AnyDesk.exe TID: 2440	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Downloads\AnyDesk.exe TID: 2300	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Downloads\AnyDesk.exe TID: 2336	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Users\user\Downloads\AnyDesk.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Downloads\AnyDesk.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Downloads\AnyDesk.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Downloads\AnyDesk.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Downloads\AnyDesk.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Downloads\AnyDesk.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Downloads\AnyDesk.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Downloads\AnyDesk.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Users\user\Downloads\AnyDesk.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Downloads\AnyDesk.exe	Queries volume information: C:\Users\user\Downloads\AnyDesk.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Downloads\AnyDesk.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: AnyDesk.exe, 0000000C.00000002.541310729.0000000001640000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: .itext.text.custom9292a41a800206f7d3a5e5d5722941e2release/win_8.0.xbe44929eaa9f4cd4625e8be543627ce9a1789671
Source: AnyDesk.exe, 0000000C.00000002.541310729.0000000001640000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: release/win_8.0.x
Source: AnyDesk.exe, 0000000C.00000002.541277037.0000000001561000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: be44929eaa9f4cd4625e8be543627ce9a1789671release/win_8.0.x9292a41a800206f7d3a5e5d5722941e2

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact	Resource Development	Reconnaissance
Valid Accounts	421 Windows Management Instrumentation	1 DLL Side-Loading	11 Process Injection	13 Masquerading	21 Input Capture	41 Security Software Discovery	Remote Services	21 Input Capture	Exfiltration Over Other Network Medium	1 Encrypted Channel	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Abuse Accessibility Features	Acquire Infrastructure	Gather Victim Identity Information
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	11 Disable or Modify Tools	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	1 Clipboard Data	Exfiltration Over Bluetooth	1 Ingress Tool Transfer	SIM Card Swap	Obtain Device Cloud Backups	Network Denial of Service	Domains	Credentials
Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	331 Virtualization/Sandbox Evasion	Security Account Manager	331 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	3 Non-Application Layer Protocol			Data Encrypted for Impact	DNS Server	Email Addresses
Local Accounts	Cron	Login Hook	Login Hook	11 Process Injection	NTDS	1 Remote System Discovery	Distributed Component Object Model	Input Capture	Traffic Duplication	4 Application Layer Protocol			Data Destruction	Virtual Private Server	Employee Names
Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Hidden Files and Directories	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Scheduled Transfer	Fallback Channels			Data Encrypted for Impact	Server	Gather Victim Network Information
Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	11 Software Packing	Cached Domain Credentials	123 System Information Discovery	VNC	GUI Input Capture	Data Transfer Size Limits	Multiband Communication			Service Stop	Botnet	Domain Properties
External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Exfiltration Over C2 Channel	Commonly Used Port			Inhibit System Recovery	Web Services	DNS

Source	Detection	Scanner
C:\Users\user\AppData\Local\Temp\gcapi.dll	0%	ReversingLabs
C:\Users\user\Downloads\Unconfirmed 683976.crdownload	0%	ReversingLabs
Chrome Cache Entry: 78	0%	ReversingLabs

Source	Detection	Scanner	Label
http://ns.useplus.org/ldf/xmp/1.0/	0%	URL Reputation	safe
http://iptc.org/std/Iptc4xmpExt/2008-02-29/	0%	Avira URL Cloud	safe
https://boot.net.anydesk.comabcdefABCDEFtruefalsetfInvalid	0%	Avira URL Cloud	safe
http://ns.adobe.c/s	0%	Avira URL Cloud	safe

Name	IP	Active	Malicious	Reputation
d1atxff5avezsq.cloudfront.net	13.33.82.26	true	false	high
boot.net.anydesk.com	57.128.101.74	true	false	high
relay-bb94445c.net.anydesk.com	185.209.179.55	true	false	high
accounts.google.com	142.250.96.84	true	false	high
sb-ssl.l.google.com	142.250.12.190	true	false	high
download.anydesk.com	188.40.104.135	true	false	high
www.google.com	142.250.96.103	true	false	high
clients.l.google.com	142.250.12.113	true	false	high
sb-ssl.google.com	unknown	unknown	false	high
api.playanext.com	unknown	unknown	false	unknown
clients2.google.com	unknown	unknown	false	high

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.96.84	accounts.google.com	United States	15169	GOOGLEUS	false
185.209.179.55	relay-bb94445c.net.anydesk.com	United States	396356	MAXIHOSTUS	false
142.250.96.103	www.google.com	United States	15169	GOOGLEUS	false
142.250.12.113	clients.l.google.com	United States	15169	GOOGLEUS	false
142.250.12.190	sb-ssl.l.google.com	United States	15169	GOOGLEUS	false
92.223.88.232	unknown	Austria	199524	GCOREAT	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
57.128.101.75	unknown	Belgium	2686	ATGS-MMD-ASUS	false
188.40.104.135	download.anydesk.com	Germany	24940	HETZNER-ASDE	false

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://download.anydesk.com/AnyDesk.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

Compliance

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

(copy)

C:\Users\user\AppData\Local\Temp\gcapi.dll

C:\Users\user\AppData\Roaming\AnyDesk\ad.trace

C:\Users\user\AppData\Roaming\AnyDesk\service.conf

C:\Users\user\AppData\Roaming\AnyDesk\system.conf

C:\Users\user\AppData\Roaming\AnyDesk\user.conf

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\G72G7TJ05TF6HZUM1VQL.temp

C:\Users\user\Downloads\21c5056f-a98c-4a81-9c27-b98d59e1480b.tmp

C:\Users\user\Downloads\Unconfirmed 683976.crdownload

Chrome Cache Entry: 78

Static File Info

File Icon

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

HTTP Packets

HTTPS Proxied Packets

Windows Analysis Report
https://download.anydesk.com/AnyDesk.exe

Joe Sandbox Version:	38.0.0 Ammolite
Analysis ID:	1351494
Start date and time:	2023-12-01 16:25:41 +01:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 5m 20s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	https://download.anydesk.com/AnyDesk.exe
Analysis system description:	Windows 7 x64 SP1 with Office 2010 SP1 (IE 11, FF52, Chrome 57, Adobe Reader DC 15, Flash 25.0.0.127, Java 8 Update 121, .NET 4.6.2)
Number of analysed new started processes analysed:	12
Number of new started drivers analysed:	2
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal68.evad.win@31/10@18/11
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0

Process:	C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3783
Entropy (8bit):	5.831832610151928
Encrypted:	false
SSDEEP:	48:qGzT31OfNik2sIXE9j4w+Pl8x6b1WllKeeZJ+a4IqJvlhLfX8zCk4nF2Ou2IYLH8:p5k2LXIj4w+d668rKeUqJNhIYs2Dy6I
MD5:	294CEA8AC0CC8B9214082C8CA865BB96
SHA1:	6FB2434EA324849C425D6955D09BAE8DE5F88367
SHA-256:	BBC0EE67BC768DA2DB0865A0C95928D46648424996A5D7DBC78B6A46DFC5FD7F
SHA-512:	5926A315BE9041AD9E5CB9F604944A2624E4DF7191FFC9B0A499EDCEA5BB6A5868D576BB5D48659ADAEBC77585AE6BDAC0957A0A1C767748652D14E93DFEABB8
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........h.}.;.}.;.}.;..";.}.;..#;.}.;...;.}.;...;.}.;Rich.}.;........................PE..L.....Le.........."..........S...(..........@....@...........................}......yT...@...........................................\|.PH............T.HF....\|.......)..............................................................................text...w(......................... ..`.itext....(..@...........................rdata........).....................@..@.data.....S...)...S..2..............@....rsrc...PH....\|..J....S.............@..@.reloc........\|.......T.............@..B................................................................................................................................................................................................................................................................................................................

Process:	C:\Users\user\Downloads\AnyDesk.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	394240
Entropy (8bit):	6.700175464943679
Encrypted:	false
SSDEEP:	6144:Tv/ioKdMF+LZD/ZRj1vwWrrUFMNoz4pFGxjEB1NYAOrabN2GZvFcD7:Td+LZrNwWrrwMNoz4vG1OYZabtK7
MD5:	1CE7D5A1566C8C449D0F6772A8C27900
SHA1:	60854185F6338E1BFC7497FD41AA44C5C00D8F85
SHA-256:	73170761D6776C0DEBACFBBC61B6988CB8270A20174BF5C049768A264BB8FFAF
SHA-512:	7E3411BE8614170AE91DB1626C452997DC6DB663D79130872A124AF982EE1D457CEFBA00ABD7F5269ADCE3052403BE31238AECC3934C7379D224CB792D519753
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...................................8...........!..L.!This program cannot be run in DOS mode....$........q.hB..;B..;B..;.I.:@..;...;W..;...;...;...;b..;.#;@..;!M.:U..;!M.:c..;!M.:u..;...;@..;,M.:...;...;Y..;B..;~..;,M.:e..;,M.:C..;,M.;C..;B.s;C..;,M.:C..;RichB..;........................PE..L......W.........."!................:.....................................................@.........................p................0.......................@..h2......8...........................p...@.......................@....................text...y........................... ..`.rdata...-..........................@..@.data...H5..........................@....gfids..(...........................@..@.tls......... ......................@....rsrc........0......................@..@.reloc..h2...@...4..................@..B................................................................................................................................................................

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 1, 2023 16:26:35.089730024 CET	53	54998	8.8.8.8	192.168.2.22
Dec 1, 2023 16:26:35.107718945 CET	52781	53	192.168.2.22	8.8.8.8
Dec 1, 2023 16:26:35.108804941 CET	63926	53	192.168.2.22	8.8.8.8
Dec 1, 2023 16:26:35.109137058 CET	65510	53	192.168.2.22	8.8.8.8
Dec 1, 2023 16:26:35.109414101 CET	62672	53	192.168.2.22	8.8.8.8
Dec 1, 2023 16:26:35.207588911 CET	53	65510	8.8.8.8	192.168.2.22
Dec 1, 2023 16:26:35.209386110 CET	53	63926	8.8.8.8	192.168.2.22
Dec 1, 2023 16:26:35.210323095 CET	53	62672	8.8.8.8	192.168.2.22
Dec 1, 2023 16:26:35.215874910 CET	53	52781	8.8.8.8	192.168.2.22
Dec 1, 2023 16:26:36.281321049 CET	53	54842	8.8.8.8	192.168.2.22
Dec 1, 2023 16:26:37.280970097 CET	57390	53	192.168.2.22	8.8.8.8
Dec 1, 2023 16:26:37.283451080 CET	58095	53	192.168.2.22	8.8.8.8
Dec 1, 2023 16:26:37.379645109 CET	53	57390	8.8.8.8	192.168.2.22
Dec 1, 2023 16:26:37.382049084 CET	53	58095	8.8.8.8	192.168.2.22
Dec 1, 2023 16:26:39.264522076 CET	50446	53	192.168.2.22	8.8.8.8
Dec 1, 2023 16:26:39.265393972 CET	55939	53	192.168.2.22	8.8.8.8
Dec 1, 2023 16:26:39.363003969 CET	53	50446	8.8.8.8	192.168.2.22
Dec 1, 2023 16:26:39.363557100 CET	53	55939	8.8.8.8	192.168.2.22
Dec 1, 2023 16:26:40.566777945 CET	61486	53	192.168.2.22	8.8.8.8
Dec 1, 2023 16:26:40.567210913 CET	62453	53	192.168.2.22	8.8.8.8
Dec 1, 2023 16:26:40.667395115 CET	53	61486	8.8.8.8	192.168.2.22
Dec 1, 2023 16:26:40.669903994 CET	53	62453	8.8.8.8	192.168.2.22
Dec 1, 2023 16:26:54.113976955 CET	53	59447	8.8.8.8	192.168.2.22
Dec 1, 2023 16:27:01.042020082 CET	53	54521	8.8.8.8	192.168.2.22
Dec 1, 2023 16:27:11.917344093 CET	53	51955	8.8.8.8	192.168.2.22
Dec 1, 2023 16:27:30.137322903 CET	53	60169	8.8.8.8	192.168.2.22
Dec 1, 2023 16:27:34.904691935 CET	53	58257	8.8.8.8	192.168.2.22
Dec 1, 2023 16:27:57.750170946 CET	61598	53	192.168.2.22	8.8.8.8
Dec 1, 2023 16:27:57.848436117 CET	53	61598	8.8.8.8	192.168.2.22
Dec 1, 2023 16:27:57.854165077 CET	61598	53	192.168.2.22	8.8.8.8
Dec 1, 2023 16:27:57.952426910 CET	53	61598	8.8.8.8	192.168.2.22
Dec 1, 2023 16:27:57.952691078 CET	61598	53	192.168.2.22	8.8.8.8
Dec 1, 2023 16:27:58.051970959 CET	53	61598	8.8.8.8	192.168.2.22
Dec 1, 2023 16:27:58.052211046 CET	61598	53	192.168.2.22	8.8.8.8
Dec 1, 2023 16:27:58.150295973 CET	53	61598	8.8.8.8	192.168.2.22
Dec 1, 2023 16:27:58.175230026 CET	58754	53	192.168.2.22	8.8.8.8
Dec 1, 2023 16:27:58.273646116 CET	53	58754	8.8.8.8	192.168.2.22
Dec 1, 2023 16:27:59.054596901 CET	49226	53	192.168.2.22	8.8.8.8
Dec 1, 2023 16:27:59.153774023 CET	53	49226	8.8.8.8	192.168.2.22
Dec 1, 2023 16:27:59.426781893 CET	54695	53	192.168.2.22	8.8.8.8
Dec 1, 2023 16:27:59.525382042 CET	53	54695	8.8.8.8	192.168.2.22
Dec 1, 2023 16:28:02.132694960 CET	61601	53	192.168.2.22	8.8.8.8
Dec 1, 2023 16:28:02.236634016 CET	53	61601	8.8.8.8	192.168.2.22

Timestamp	Bytes transferred	Direction	Data
Dec 1, 2023 16:27:58.464092016 CET	327	OUT	Data Raw: 16 03 01 01 0c 01 00 01 08 03 03 b0 ed 65 64 b8 c6 ca 60 8d f1 61 18 a3 f6 e1 9c d3 b3 b3 9e ab 6c e2 4a b3 3e 09 c3 4e 37 fe e7 00 00 6e c0 30 c0 2c c0 28 c0 24 c0 14 c0 0a 00 a5 00 a3 00 a1 00 9f 00 6b 00 6a 00 69 00 68 00 39 00 38 00 37 00 36 Data Ascii: ed`alJ>N7n0,($kjih98762.*&=5/+'#g@?>32101-)%</q#
Dec 1, 2023 16:27:58.648407936 CET	590	IN	Data Raw: 16 03 03 00 57 02 00 00 53 03 03 f2 fd d9 66 2a 65 40 94 98 2e 9f a1 44 db d1 e7 34 2e a2 2d 85 34 8a 71 44 4f 57 4e 47 52 44 01 20 a4 7c b8 97 02 d8 18 e9 cf 28 ed 04 31 90 38 e3 4e 78 a0 a1 d0 37 de 48 34 91 90 9e f5 0d 38 89 c0 2c 00 00 0b ff Data Ascii: WSfe@.D4.-4qDOWNGRD \|(18Nx7H48,C0?0'0vtS$0H0H10UAnyNet Root CA1 0Uphilandro Software GmbH10UDE0181118021423Z281115021
Dec 1, 2023 16:27:58.648448944 CET	590	IN	Data Raw: e6 e8 20 b9 4b 8b bb 63 de 6f 65 6a 9f 5d d7 c1 97 9b 2d 30 4e 9a 81 85 b4 1c 92 a6 ed d8 7a f9 df 9d 03 b3 90 9c 78 a9 c8 ba 0e 3c ac ec 14 db 7d 51 b3 97 06 b9 f6 77 60 ab fe 59 83 af 8e 97 56 29 c7 db 7e 71 79 d1 c7 f7 da b6 c8 f7 af 8f 24 e0 Data Ascii: Kcoej]-0Nzx<}Qw`YV)~qy$ZG\|'SO^jl$\|XM+")+{n\&9S\|4xLp\|aZ.qDL\vq$;OroCs4\|z\8[TRxU>R
Dec 1, 2023 16:27:58.648519993 CET	590	IN	Data Raw: 35 35 5a 17 0d 32 34 30 34 30 38 30 32 33 37 35 35 5a 30 48 31 17 30 15 06 03 55 04 03 0c 0e 41 6e 79 4e 65 74 20 52 6f 6f 74 20 43 41 31 20 30 1e 06 03 55 04 0a 0c 17 70 68 69 6c 61 6e 64 72 6f 20 53 6f 66 74 77 61 72 65 20 47 6d 62 48 31 0b 30 Data Ascii: 55Z240408023755Z0H10UAnyNet Root CA1 0Uphilandro Software GmbH10UDE0"0*H0AZ T7;h8m&i6p4p]\|Zx1\{ZQ/3'h;jlaV
Dec 1, 2023 16:27:58.648590088 CET	590	IN	Data Raw: 3c 1f 22 91 25 17 15 cc 42 82 da 3b a8 39 c7 2a 50 ca d9 4c a0 8c 95 33 75 03 70 b8 df a0 c9 b2 b2 8b 1b 38 83 79 32 c3 12 da 33 96 42 f4 91 11 aa c6 26 31 bc ea 43 8a 30 54 65 c5 43 9e 50 3b fa 91 93 0e 9d 3b 23 4a 3d 43 c1 c6 22 9b 68 af 2f fc Data Ascii: <"%B;9PL3up8y23B&1C0TeCP;;#J=C"h/R"j.P0N0UeyXW6\bG0U#0eyXW6\bG0U00HG`4%(^0VGv T=#
Dec 1, 2023 16:27:58.648627996 CET	527	IN	Data Raw: ca b6 9b 39 e6 cf 27 d0 2c 99 74 d4 ca de 47 88 ed df f7 9c 3b ac 8a 62 d2 75 90 d9 00 81 d3 f8 c2 47 8e 9a bd 87 6d ce e5 9a 7f 28 76 a4 77 c6 3f b9 bf 4d f1 cb df 0f 2c 73 fe b4 60 e3 26 5e 83 f2 ae 36 56 94 e9 a7 9d a1 3d ca 5d 6e 3d 5d a8 6f Data Ascii: 9',tG;buGm(vw?M,s`&^6V=]n=]oh'g4E4{%QT?*Qd9wsfI+\+Wfp;q.Lgr:>4m`=D^!`l.:s&jAkUHOc/x!dHDC&]
Dec 1, 2023 16:27:58.657362938 CET	1148	OUT	Data Raw: 16 03 03 02 b6 0b 00 02 b2 00 02 af 00 02 ac 30 82 02 a8 30 82 01 90 02 01 01 30 0d 06 09 2a 86 48 86 f7 0d 01 01 0b 05 00 30 19 31 17 30 15 06 03 55 04 03 0c 0e 41 6e 79 44 65 73 6b 20 43 6c 69 65 6e 74 30 20 17 0d 32 33 31 32 30 31 31 35 32 37 Data Ascii: 000H010UAnyDesk Client0 231201152756Z20731118152756Z010UAnyDesk Client0"0H0xpt13R)LkypM)t'.sZPp*J;R=Xr-a<y\3B?
Dec 1, 2023 16:27:58.840372086 CET	105	IN	Data Raw: 14 03 03 00 01 01 16 03 03 00 28 fc 4d 46 82 3e 3e a6 d6 38 b0 32 1c c1 08 1f fc 41 0d 3d 29 aa 6d cf 0c 2f af 52 f6 88 50 4f 5f 42 9f e5 5f 8c 0d c1 bf Data Ascii: (MF>>82A=)m/RPO_B_
Dec 1, 2023 16:27:58.840418100 CET	94	IN	Data Raw: 17 03 03 00 23 fc 4d 46 82 3e 3e a6 d7 72 e0 4d b9 5c c0 3e 1b 59 4a 5a 4a f3 32 7b c3 13 26 73 92 f4 24 0f c7 6a fa 53 Data Ascii: #MF>>rM\>YJZJ2{&s$jS
Dec 1, 2023 16:27:58.847659111 CET	141	OUT	Data Raw: 17 03 03 00 52 bd d1 65 9d 00 35 78 4b 6e 93 b5 a4 bf 2c 3b e2 2c a3 c2 01 f9 40 e0 0c f7 4e d3 f6 d0 0f c7 fa c4 dc 47 0c ea 4a 8b 27 a7 3c 7b 3d 42 3e ed 16 9a f0 6b d1 ec b4 ef dc 0d 67 08 1e 45 34 a9 a7 29 b5 0c 4f 42 1e f5 e4 3b bd de b6 e0 Data Ascii: Re5xKn,;,@NGJ'<{=B>kgE4)OB;e=

Timestamp	Bytes transferred	Direction	Data
Dec 1, 2023 16:27:59.642168045 CET	327	OUT	Data Raw: 16 03 01 01 0c 01 00 01 08 03 03 9d 8d 2f 28 a1 f4 14 64 a7 65 cc 59 a9 71 ee fd f0 6b f0 83 0c df 84 88 b2 b8 c9 e7 28 e5 3b fa 00 00 6e c0 30 c0 2c c0 28 c0 24 c0 14 c0 0a 00 a5 00 a3 00 a1 00 9f 00 6b 00 6a 00 69 00 68 00 39 00 38 00 37 00 36 Data Ascii: /(deYqk(;n0,($kjih98762.*&=5/+'#g@?>32101-)%</q#
Dec 1, 2023 16:27:59.750664949 CET	1340	IN	Data Raw: 16 03 03 00 57 02 00 00 53 03 03 fd 36 d8 80 38 7f 23 7c 25 6e 16 ec 54 61 1d b1 cd be 84 6f fa 3a 25 52 44 4f 57 4e 47 52 44 01 20 a3 46 50 f0 02 9e 2c 60 85 13 d8 46 b1 f0 02 23 17 c6 44 7a aa 1f dc 35 b4 5e 32 4a 92 52 fb 05 c0 2c 00 00 0b ff Data Ascii: WS68#\|%nTao:%RDOWNGRD FP,`F#Dz5^2JR,C0?0'0vtS$0*H0H10UAnyNet Root CA1 0Uphilandro Software GmbH10UDE0181118021423Z281115021
Dec 1, 2023 16:27:59.750709057 CET	1340	IN	Data Raw: 5a eb 51 2f 97 bf f6 fb 33 27 90 b3 d8 e4 e0 cd 68 3b 6a 87 6c a6 0d e7 d8 bd 61 df 56 6b 2a e1 1c 2b f5 9f bf 85 dd 8c 5b 06 1e 71 7f ba 4a a6 40 b0 77 17 ea 2c 3f 5b 94 14 85 2e ad 11 61 ab 88 f6 01 bb b3 47 6b e2 81 18 f1 8e 39 e6 d8 7b 0c 63 Data Ascii: ZQ/3'h;jlaVk*+[qJ@w,?[.aGk9{cpu'-5={{Hy8-&~K2vf/bj@kXScuxI#ph3/L^}a}4AkP+g_R4gs@lo67Jv"rR}uMU#[~.K_e
Dec 1, 2023 16:27:59.750744104 CET	98	IN	Data Raw: 68 69 6c 61 6e 64 72 6f 20 53 6f 66 74 77 61 72 65 20 47 6d 62 48 31 0b 30 09 06 03 55 04 06 13 02 44 45 16 03 03 00 04 0e 00 00 00 Data Ascii: hilandro Software GmbH10UDE
Dec 1, 2023 16:27:59.765096903 CET	1148	OUT	Data Raw: 16 03 03 02 b6 0b 00 02 b2 00 02 af 00 02 ac 30 82 02 a8 30 82 01 90 02 01 01 30 0d 06 09 2a 86 48 86 f7 0d 01 01 0b 05 00 30 19 31 17 30 15 06 03 55 04 03 0c 0e 41 6e 79 44 65 73 6b 20 43 6c 69 65 6e 74 30 20 17 0d 32 33 31 32 30 31 31 35 32 37 Data Ascii: 000H010UAnyDesk Client0 231201152756Z20731118152756Z010UAnyDesk Client0"0H0xpt13R)LkypM)t'.sZPp*J;R=Xr-a<y\3B?
Dec 1, 2023 16:27:59.870883942 CET	105	IN	Data Raw: 14 03 03 00 01 01 16 03 03 00 28 77 94 ce fb 2e 92 02 ea 07 1b 75 a3 bf c3 25 21 5a 0b 3b 72 bd 73 ea e0 e4 26 19 ae 10 94 1d 0a 1f 4f 31 3b e5 e7 64 47 Data Ascii: (w.u%!Z;rs&O1;dG
Dec 1, 2023 16:27:59.870994091 CET	94	IN	Data Raw: 17 03 03 00 23 77 94 ce fb 2e 92 02 eb d6 43 e7 b6 7c b5 d6 a4 62 84 cb 9c 7e 0d 3d 2b e3 db 1a a5 d4 82 d2 d7 7a db 0a Data Ascii: #w.C\|b~=+z
Dec 1, 2023 16:27:59.878585100 CET	141	OUT	Data Raw: 17 03 03 00 52 ad fa ff 5c cc d3 c1 94 4f 17 2e 26 3c 7d 85 35 4b 1f b6 cb 8f d3 ab a4 c3 72 ee 1c bc af bc f4 aa 9d 04 ac 10 dc 6b 9a 80 e2 62 7f 44 83 bf 8f c8 61 d1 2b 6b 4e 35 02 95 58 31 c6 8a fc 41 44 e8 bb e6 d6 96 15 f8 ba 38 17 1d 47 05 Data Ascii: R\O.&<}5KrkbDa+kN5X1AD8GMk
Dec 1, 2023 16:28:00.129414082 CET	200	IN	Data Raw: 17 03 03 00 8d 77 94 ce fb 2e 92 02 ec d4 6d 24 70 17 5a 7c f5 4f b2 f2 9a 18 18 de 40 5a 66 a2 04 88 35 82 9d 9b 69 78 18 f8 c3 42 77 f1 a5 11 a8 e2 9c 8d 62 be d3 74 43 7e a2 bf 49 15 db 4d 10 b1 e5 c5 c6 1a 99 96 2d 11 96 9d 6d d9 28 c2 9c b9 Data Ascii: w.m$pZ\|O@Zf5ixBwbtC~IM-m(gk;Nm\|{IW7g*wJIAHQ\|{<>D
Dec 1, 2023 16:28:00.175654888 CET	510	OUT	Data Raw: 17 03 03 01 c3 ad fa ff 5c cc d3 c1 95 af 7b 66 ff f1 b8 72 4b fc 8c 64 a2 7f 7d 46 d6 24 48 30 f8 ae 32 d3 6d 6e df 56 e6 39 82 93 15 6c b9 75 fe 6c 75 c6 3d a0 6e ea 7d 9a 8e cd 1d 73 2a fa 76 30 6c 4c 56 5c 7e 98 4e ec 5d 0f 9e 99 f3 e8 3d b0 Data Ascii: \{frKd}F$H02mnV9lulu=n}sv0lLV\~N]=}9?GEHGMRaUUwQ_E'!E;dE^p0AQ5[EWA"Vs.\|rg6'\|Td"\T#I'o5)f

Timestamp	Bytes transferred	Direction	Data
2023-12-01 15:26:35 UTC	849	OUT	POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1 Host: accounts.google.com Connection: keep-alive Content-Length: 1 Origin: https://www.google.com Content-Type: application/x-www-form-urlencoded Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: CONSENT=PENDING+962; SOCS=CAESHAgCEhJnd3NfMjAyMzA4MDEtMF9SQzMaAmVuIAEaBgiAi8amBg; AEC=Ad49MVFCiIL4dH3NdVUPM9qw5tUX8unGaMgN_qTAwv0uoiOzKAI-JttOlg; __Secure-ENID=14.SE=LM-NkPAvbCtuNhK73uRS1U27fKMegq7R6_Ue_GnOGI1dekNKandC6Dto1fKS9ocnnyUmf2MAXGM269U9HhkgndYLxWy3FrZaGzh_yODdv1ouU12fBCNmRhMUwM3dzKbRlYRnbKhIQz9fV5WGdCRRjXQx5RGii6FbIw100Hc46oWQ6bysmy2hqA
2023-12-01 15:26:35 UTC	1	OUT	Data Raw: 20 Data Ascii:
2023-12-01 15:26:36 UTC	1627	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6a 73 6f 6e 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 0d 0a 41 63 63 65 73 73 2d 43 6f 6e 74 72 6f 6c 2d 41 6c 6c 6f 77 2d 4f 72 69 67 69 6e 3a 20 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0d 0a 41 63 63 65 73 73 2d 43 6f 6e 74 72 6f 6c 2d 41 6c 6c 6f 77 2d 43 72 65 64 65 6e 74 69 61 6c 73 3a 20 74 72 75 65 0d 0a 58 2d 43 6f 6e 74 65 6e 74 2d 54 79 70 65 2d 4f 70 74 69 6f 6e 73 3a 20 6e 6f 73 6e 69 66 66 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f 6c 3a 20 6e 6f 2d 63 61 63 68 65 2c 20 6e 6f 2d 73 74 6f 72 65 2c 20 6d 61 78 2d 61 67 65 3d 30 2c 20 6d 75 73 74 2d 72 65 76 61 6c 69 64 61 74 65 0d 0a 50 72 Data Ascii: HTTP/1.1 200 OKContent-Type: application/json; charset=utf-8Access-Control-Allow-Origin: https://www.google.comAccess-Control-Allow-Credentials: trueX-Content-Type-Options: nosniffCache-Control: no-cache, no-store, max-age=0, must-revalidatePr
2023-12-01 15:26:36 UTC	23	IN	Data Raw: 31 31 0d 0a 5b 22 67 61 69 61 2e 6c 2e 61 2e 72 22 2c 5b 5d 5d 0d 0a Data Ascii: 11["gaia.l.a.r",[]]
2023-12-01 15:26:36 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2023-12-01 15:26:35 UTC	732	OUT	GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=109.0.5414.120&lang=en-US&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1 Host: clients2.google.com Connection: keep-alive X-Goog-Update-Interactivity: fg X-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmieda X-Goog-Update-Updater: chromecrx-109.0.5414.120 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-01 15:26:35 UTC	732	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 53 65 63 75 72 69 74 79 2d 50 6f 6c 69 63 79 3a 20 73 63 72 69 70 74 2d 73 72 63 20 27 72 65 70 6f 72 74 2d 73 61 6d 70 6c 65 27 20 27 6e 6f 6e 63 65 2d 6f 34 41 5f 4c 4a 77 64 30 44 42 62 34 75 72 4c 58 71 50 6c 34 67 27 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 20 27 73 74 72 69 63 74 2d 64 79 6e 61 6d 69 63 27 20 68 74 74 70 73 3a 20 68 74 74 70 3a 3b 6f 62 6a 65 63 74 2d 73 72 63 20 27 6e 6f 6e 65 27 3b 62 61 73 65 2d 75 72 69 20 27 73 65 6c 66 27 3b 72 65 70 6f 72 74 2d 75 72 69 20 68 74 74 70 73 3a 2f 2f 63 73 70 2e 77 69 74 68 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 63 73 70 2f 63 6c 69 65 6e 74 75 70 64 61 74 65 2d 61 75 73 2f 31 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f 6c Data Ascii: HTTP/1.1 200 OKContent-Security-Policy: script-src 'report-sample' 'nonce-o4A_LJwd0DBb4urLXqPl4g' 'unsafe-inline' 'strict-dynamic' https: http:;object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/clientupdate-aus/1Cache-Control
2023-12-01 15:26:35 UTC	520	IN	Data Raw: 32 63 39 0d 0a 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 67 75 70 64 61 74 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 75 70 64 61 74 65 32 2f 72 65 73 70 6f 6e 73 65 22 20 70 72 6f 74 6f 63 6f 6c 3d 22 32 2e 30 22 20 73 65 72 76 65 72 3d 22 70 72 6f 64 22 3e 3c 64 61 79 73 74 61 72 74 20 65 6c 61 70 73 65 64 5f 64 61 79 73 3d 22 36 31 37 38 22 20 65 6c 61 70 73 65 64 5f 73 65 63 6f 6e 64 73 3d 22 32 36 37 39 35 22 2f 3e 3c 61 70 70 20 61 70 70 69 64 3d 22 6e 6d 6d 68 6b 6b 65 67 63 63 61 67 64 6c 64 67 69 69 6d 65 64 70 69 63 63 6d 67 6d 69 65 64 61 22 20 63 6f 68 6f 72 74 3d 22 31 3a 3a 22 20 63 6f 68 6f 72 74 6e 61 6d 65 3d 22 22 Data Ascii: 2c9<?xml version="1.0" encoding="UTF-8"?><gupdate xmlns="http://www.google.com/update2/response" protocol="2.0" server="prod"><daystart elapsed_days="6178" elapsed_seconds="26795"/><app appid="nmmhkkegccagdldgiimedpiccmgmieda" cohort="1::" cohortname=""
2023-12-01 15:26:35 UTC	200	IN	Data Raw: 37 32 33 66 35 36 62 38 37 31 37 31 37 35 63 35 33 36 36 38 35 63 35 34 35 30 31 32 32 62 33 30 37 38 39 34 36 34 61 64 38 32 22 20 68 61 73 68 5f 73 68 61 32 35 36 3d 22 38 31 65 33 61 34 64 34 33 61 37 33 36 39 39 65 31 62 37 37 38 31 37 32 33 66 35 36 62 38 37 31 37 31 37 35 63 35 33 36 36 38 35 63 35 34 35 30 31 32 32 62 33 30 37 38 39 34 36 34 61 64 38 32 22 20 70 72 6f 74 65 63 74 65 64 3d 22 30 22 20 73 69 7a 65 3d 22 32 34 38 35 33 31 22 20 73 74 61 74 75 73 3d 22 6f 6b 22 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 2e 30 2e 36 22 2f 3e 3c 2f 61 70 70 3e 3c 2f 67 75 70 64 61 74 65 3e 0d 0a Data Ascii: 723f56b8717175c536685c5450122b30789464ad82" hash_sha256="81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82" protected="0" size="248531" status="ok" version="1.0.0.6"/></app></gupdate>
2023-12-01 15:26:35 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2023-12-01 15:26:37 UTC	675	OUT	GET /AnyDesk.exe HTTP/1.1 Host: download.anydesk.com Connection: keep-alive sec-ch-ua: "Not_A Brand";v="99", "Google Chrome";v="109", "Chromium";v="109" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-01 15:26:38 UTC	313	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 0d 0a 44 61 74 65 3a 20 46 72 69 2c 20 30 31 20 44 65 63 20 32 30 32 33 20 31 35 3a 32 36 3a 33 38 20 47 4d 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 35 35 32 35 35 37 36 0d 0a 4c 61 73 74 2d 4d 6f 64 69 66 69 65 64 3a 20 54 68 75 2c 20 30 39 20 4e 6f 76 20 32 30 32 33 20 30 38 3a 32 36 3a 32 32 20 47 4d 54 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 54 61 67 3a 20 22 36 35 34 63 39 37 61 65 2d 35 34 35 30 34 38 22 0d 0a 45 78 70 69 72 65 73 3a 20 46 72 69 2c 20 30 31 20 44 65 63 20 32 30 32 33 20 31 35 3a 32 36 Data Ascii: HTTP/1.1 200 OKServer: nginxDate: Fri, 01 Dec 2023 15:26:38 GMTContent-Type: application/octet-streamContent-Length: 5525576Last-Modified: Thu, 09 Nov 2023 08:26:22 GMTConnection: closeETag: "654c97ae-545048"Expires: Fri, 01 Dec 2023 15:26
2023-12-01 15:26:38 UTC	16071	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 e9 1c e7 68 ad 7d 89 3b ad 7d 89 3b ad 7d 89 3b c2 0b 22 3b a5 7d 89 3b c2 0b 23 3b ae 7d 89 3b b6 e0 13 3b ac 7d 89 3b c2 0b 14 3b ac 7d 89 3b 52 69 63 68 ad 7d 89 3b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 ba 8e 4c 65 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0a 00 00 2a 00 00 00 e0 53 00 00 b8 28 01 e5 1c 00 00 00 10 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$h};};};";};#;};;};;};Rich};PELLe"*S(
2023-12-01 15:26:38 UTC	16384	IN	Data Raw: 49 7b 5e 11 8e 3a b4 b9 e4 b1 62 34 25 63 1e 50 db 34 ea 10 14 bd 07 bc 99 51 a3 14 22 85 80 32 2e df 56 12 9f 0d 10 14 a0 f6 50 76 d1 6d d6 bc 1b 85 b5 2a 5c 46 e6 f4 f8 2a af 8e b7 c9 09 e4 2b fd ff de 47 f5 fb a9 a2 0e 11 ac bf 7e df ec c8 c3 f2 7c ea 9c 86 bd bd 9b 05 33 24 1a e5 e4 37 54 33 bc 3b bc 81 13 75 29 21 8f 01 c3 e9 da 68 02 d6 72 69 1f 69 c8 be 26 5b 9a a3 26 43 61 ba c3 5a 85 12 57 18 3e 80 7d 32 c1 04 f7 d0 89 7c 6a 1c a7 24 e1 47 20 55 05 4a 72 ba d4 76 24 39 1d 8a 7b 62 f2 5e fd 6e 10 0e 20 9c 36 b4 4e 68 d8 69 4d 1e 9a d7 2b 12 e5 12 ba 37 2b e9 c9 4b db 36 cf 29 78 13 46 46 bb 93 ce d6 19 74 df d0 ad 55 dc a8 a0 b3 58 28 3e db a8 cd 7b 7d 87 d6 0a cd 5b 7a 15 53 90 3d 49 70 2b 7b 42 ef 11 4d 9f 55 8f ff 14 a4 f7 ea 5c 9b e7 2f 7e 5b Data Ascii: I{^:b4%cP4Q"2.VPvm\F+G~\|3$7T3;u)!hrii&[&CaZW>}2\|j$G UJrv$9{b^n 6NhiM+7+K6)xFFtUX(>{}[zS=Ip+{BMU\/~[
2023-12-01 15:26:38 UTC	16384	IN	Data Raw: 51 20 31 54 67 0a df fc c1 29 e4 14 40 cc 39 76 0e 7b a4 ff ab a3 41 e2 6e c4 ce e1 d4 3e a0 8f 43 fb 9b fe e3 8f 85 f3 80 cd 8b 3a 69 45 63 a3 cd 4e 53 30 ac b7 7c 87 cf 15 a1 46 9e dd bb 51 05 a7 16 da 0d d1 32 50 b8 74 88 5b 65 72 c7 82 85 87 bd 46 c0 70 4d 88 37 93 fc fc e8 43 5b c1 fc b7 89 39 ce 89 69 23 25 a8 84 f2 f0 b1 0b 35 45 c6 d5 28 4f 56 e1 0a 09 68 a8 f1 e2 8f 20 84 36 34 3c e0 86 75 3b d2 dc 1d 0d dc 69 67 52 87 5e 9c 4b 97 32 8c 87 1a be a3 94 7f 5c 09 06 71 55 9e b6 10 d2 0b 25 dc c7 be b7 2d 5f 9b be 51 38 f6 83 fd d5 96 25 36 72 07 68 f7 4f e5 69 4d d0 60 69 4f a5 5d e6 d8 ec 9f 93 b9 69 c4 5d e2 b1 eb a7 3e d5 98 9e 8b 25 25 56 ed 5d 1e d5 0f 13 d9 e2 c8 0d d2 17 a9 34 f9 d3 70 d1 39 ff c2 8b 69 00 6f ca ac 7d f1 8e f2 08 d6 9f 88 22 Data Ascii: Q 1Tg)@9v{An>C:iEcNS0\|FQ2Pt[erFpM7C[9i#%5E(OVh 64<u;igR^K2\qU%-_Q8%6rhOiM`iO]i]>%%V]4p9io}"
2023-12-01 15:26:38 UTC	16384	IN	Data Raw: 78 36 a2 a9 aa 81 28 e5 6b 45 8f 30 c8 bf 92 11 41 25 11 b5 c5 4e ef bb 73 4d d5 c7 00 23 ca 8b fc 0e 0d 28 93 28 a1 88 99 d0 dd e8 7e 75 28 20 f4 75 db 80 18 29 ca 6d 75 0b 94 c1 8d b5 e0 30 2d 63 12 d5 c4 32 6a 96 e8 eb 20 44 e4 f9 63 56 9c cf a8 89 de 8f 4b f1 d9 60 0d fa e7 a7 99 e8 33 94 6c b7 f7 20 c8 43 a0 c3 b9 c1 37 59 2c b2 26 aa b2 80 33 54 4c 01 dc 47 2b f3 2d f3 83 c9 6d 5d 80 9d 46 97 a5 cf d1 97 97 bc ba 07 2d b1 69 c3 dc e7 9b 48 d8 88 63 c8 b7 76 1d d1 94 3f 0b 5c 10 78 b5 52 4c 68 1d 68 06 f3 5d 2c 3e 23 be 4a c6 f5 a5 ab f3 92 4b 7c 5c 6d d5 37 8e ca 43 f5 ec a6 2f 64 8c 34 b7 b3 c9 94 bd 79 a3 ac 17 2c 52 8e 8f 99 95 05 67 e2 61 02 d0 1d a5 35 18 f2 50 f0 7e 33 1b 5d 70 2e 7e 5d c0 0a 87 51 c7 b0 72 96 92 b7 4c 03 e0 d4 c3 80 c7 af e9 Data Ascii: x6(kE0A%NsM#((~u( u)mu0-c2j DcVK`3l C7Y,&3TLG+-m]F-iHcv?\xRLhh],>#JK\|\m7C/d4y,Rga5P~3]p.~]QrL
2023-12-01 15:26:38 UTC	16384	IN	Data Raw: 29 59 df 59 69 2b 10 36 97 74 0c f1 49 c3 65 89 48 82 91 a4 90 48 c6 8f 8a 4c 01 20 ae 3a f7 79 85 dc ce 6d 1b 28 c8 23 a4 0e 5f e9 41 ef 6a 5b 8d 55 e0 68 c0 29 78 78 84 e9 98 c5 e8 d1 4a 64 fd f4 b9 68 79 91 f6 03 b7 2c 0b 98 35 71 c7 e5 66 f3 8f 85 45 8c c0 0a 10 58 81 8d e3 b8 09 02 4b 97 2d 78 db f5 6d 71 0d 00 79 fd a5 34 cb ca c3 1c 1e d9 0d 68 a7 cf 25 7a 0a 4b 5c 8f d4 f4 bd d8 c5 1e 75 22 79 ce db 07 5b 96 54 3b 2f 9e 29 98 8f 01 a7 84 34 27 97 15 b2 eb 0d a4 57 fd ea 77 fe 1c e6 9b 20 a6 87 b7 9c f7 d1 a5 b8 27 5b ea c0 0f 1f 46 05 51 ba 2e 82 a0 51 cf 47 96 79 78 b1 8a 9b bf 63 67 d4 26 a9 90 29 64 36 fe 4e 61 ac 2d d6 de 81 4f e5 d5 99 e4 e9 5a 5d 90 fc c5 2d 5f f7 90 34 ce 15 75 b2 01 39 cf c0 10 8d 49 1d cd 39 37 2f 36 76 1b e4 66 aa 3a 67 Data Ascii: )YYi+6tIeHHL :ym(#_Aj[Uh)xxJdhy,5qfEXK-xmqy4h%zK\u"y[T;/)4'Ww '[FQ.QGyxcg&)d6Na-OZ]-_4u9I97/6vf:g
2023-12-01 15:26:38 UTC	16384	IN	Data Raw: 59 77 4e b1 cd cb 61 69 e5 3d fa a0 42 bc ce 11 2c 92 46 4f bd 61 f0 cd 94 21 6e c9 e7 4a 04 73 98 ef d5 f0 0d ed 41 84 9b 06 bb 81 05 59 2a 94 64 bc 32 03 84 ca 8e e4 17 9a 03 53 46 47 97 1a f2 fb b7 d1 44 5a 44 b1 f0 42 6b 6c c8 69 af e2 0d 53 96 4e 78 00 63 34 60 da 4f b3 cb da 64 95 16 20 3a 98 af f3 fa 5e fb d2 4c 0b 6a e6 4a db e0 d3 17 4b aa e6 7c 3b ff 29 08 86 0f d8 f9 9c a1 be f6 75 f0 b6 87 18 bc e0 ab 84 ad b3 02 a7 d9 98 8d 92 bf ea 92 b7 88 1e ca 69 96 58 cb a8 55 5d 9d 79 f9 61 1a 1a 15 24 35 ab 01 28 cc 9f a0 4b 2f b9 c7 93 66 cb 3b 7b 2e af b0 4b ea 37 cb 22 23 b1 3c 70 12 ba 47 9f d7 77 bd ee 69 f8 21 1d 07 e3 d8 bd db b4 f6 98 5d 23 1b 5b a7 17 17 97 90 9a 3d b6 5b 49 3b c1 be ce ef 46 26 fb 8b e2 a0 40 01 a5 79 20 18 ea 40 42 cb 9e 8c Data Ascii: YwNai=B,FOa!nJsAY*d2SFGDZDBkliSNxc4`Od :^LjJK\|;)uiXU]ya$5(K/f;{.K7"#<pGwi!]#[=[I;F&@y @B
2023-12-01 15:26:38 UTC	16384	IN	Data Raw: e9 da e2 e6 cd e2 3d 16 08 ab 87 f7 45 96 79 bb 9b 01 10 48 0c a7 10 1b 83 48 7a 6b c4 b6 ab eb c2 8e 96 db 81 0a 09 25 a0 3e 81 99 94 96 0d 24 c0 71 2c 21 4b 74 a4 3a 4b ad ee c0 ef af f0 55 01 9f 46 5e 6a 93 c0 20 8e 67 aa e6 17 a9 43 1e c3 88 f0 8b 00 17 58 44 15 1a 08 42 72 5b a2 f7 d3 dc e0 d6 3f b3 25 2f 12 5e 47 bf ff 5c c4 ec d8 11 f1 43 c5 29 f1 0f 9a f4 ad 96 01 3c 83 ec 58 e8 e7 91 69 a2 51 1c e3 f3 27 32 48 66 75 06 1a 63 1e eb 89 2a 89 c6 22 4e 24 12 dc 60 f1 fd 6a 73 31 de be 4b 15 de 20 33 68 f9 ab ed 67 fc 62 99 00 56 66 a0 68 c3 db dc 14 12 5b 37 05 51 71 20 6f ec 52 20 9b 7d 38 50 b9 d6 87 43 6c 51 70 b3 31 dc 73 c1 12 4b b1 e0 fa 4b 98 60 6c 96 d8 d5 38 f7 37 87 82 b3 c1 ca 2a 6c 0b ca 43 47 f3 fc ae 65 bd 7f 49 06 fa c7 0b a5 78 93 fc Data Ascii: =EyHHzk%>$q,!Kt:KUF^j gCXDBr[?%/^G\C)<XiQ'2Hfuc"N$`js1K 3hgbVfh[7Qq oR }8PClQp1sKK`l87lCGeIx
2023-12-01 15:26:38 UTC	16384	IN	Data Raw: 11 6e 7d 29 c8 9a 2b 66 e9 be fb af 00 39 dd a7 c5 02 b5 3b 3b 41 32 3a 1a 26 16 a8 3b c9 10 7d 31 d6 a8 58 d7 d1 af fb 4d db 29 d4 36 56 c5 1f d6 b3 95 12 90 73 64 56 d8 7d 71 af b1 9b 61 3b ec 5d 20 d9 c1 11 49 64 cc c2 65 38 1d b6 1b e4 22 28 ce 03 18 6b bd 57 a6 cf 46 ac 37 bf ce 29 c7 9f eb 34 c1 48 3b 8b 1b fe 0d a2 79 4d e8 7f 22 7b 83 b6 10 87 76 1a f3 de 60 a3 f6 f2 34 64 1d 1a a5 2e 12 01 80 98 2a cd 7c e5 5e 25 db 03 ed fe 08 bf c1 f6 0c 92 4e 77 3a 4b 09 62 e7 c7 50 e5 77 62 23 f3 f1 3b 5e 66 ff 0f c5 e7 85 b5 55 6e 7d e1 a6 5d 80 46 47 b9 e1 57 12 ae ba 5e 15 99 bb aa ad 0a ea 0c 7a 9d af d9 98 78 3b 60 6a aa d3 e5 25 2a 86 ac 2e a6 c1 aa 2a b9 d3 5d a9 c8 20 fc 3c ac fc f2 fe fa 78 a5 e3 43 f4 44 15 90 d4 33 14 71 be 32 d4 7e a2 91 44 21 14 Data Ascii: n})+f9;;A2:&;}1XM)6VsdV}qa;] Ide8"(kWF7)4H;yM"{v`4d.\|^%Nw:KbPwb#;^fUn}]FGW^zx;`j%.*] <xCD3q2~D!
2023-12-01 15:26:38 UTC	16384	IN	Data Raw: e7 82 8b 60 fb 2a cf d0 46 51 c0 f9 3e 8e b6 d4 28 8c de e8 7f f7 de 4e 01 12 ae e2 ad 99 93 eb a9 29 14 80 29 b4 b8 31 df 28 aa 43 26 28 96 d4 bc 3d 9f 27 5b 0f 86 d5 c1 b0 df bb 93 a5 ac 91 50 25 64 dc 44 ae b7 2b 10 0b ba df e5 2d 1d 8c cd cb c4 5c ec 81 81 07 c5 91 cf 9f 4a 6c 1c 33 56 9c ba bc 9a 72 36 da b8 9b 77 65 2d e5 bb 3e c4 7a 0b c5 84 54 37 ea 66 86 81 dd 91 1c aa 29 88 25 cd 10 00 3e 3b 68 47 71 6e 3a db a7 36 f5 2d d7 ae 08 36 c2 b2 6b c5 10 b7 c4 77 78 03 7f e4 5d c7 9b 31 c5 f6 f4 1b ce 69 d9 01 84 47 83 6c a7 67 58 3d cd f7 e0 ee 58 bd e4 ce c5 7d 5f b2 06 36 26 d9 9b 9c 11 0c ed e5 38 d7 92 2b 08 34 58 f1 35 c1 89 91 8f 0a c2 d2 2f 6c 59 31 45 64 4d fe 0f 24 eb b7 8c 88 5e cd 28 af 39 52 c3 43 b5 b6 cc ba 2e 37 f9 ab b7 46 45 1f f4 a4 Data Ascii: `*FQ>(N))1(C&(='[P%dD+-\Jl3Vr6we->zT7f)%>;hGqn:6-6kwx]1iGlgX=X}_6&8+4X5/lY1EdM$^(9RC.7FE

Timestamp	Bytes transferred	Direction	Data
2023-12-01 15:26:41 UTC	439	OUT	POST /safebrowsing/clientreport/download?key=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: sb-ssl.google.com Connection: keep-alive Content-Length: 7012 Content-Type: application/octet-stream Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br
2023-12-01 15:26:41 UTC	7012	OUT	Data Raw: 0a 28 68 74 74 70 73 3a 2f 2f 64 6f 77 6e 6c 6f 61 64 2e 61 6e 79 64 65 73 6b 2e 63 6f 6d 2f 41 6e 79 44 65 73 6b 2e 65 78 65 12 22 0a 20 ec 33 d8 ee 9c 38 81 b8 fc ea 18 f9 f8 62 d5 92 6d 99 45 53 ae c1 b6 50 81 d9 25 af d3 e8 b0 28 18 c8 a0 d1 02 22 3e 0a 28 68 74 74 70 73 3a 2f 2f 64 6f 77 6e 6c 6f 61 64 2e 61 6e 79 64 65 73 6b 2e 63 6f 6d 2f 41 6e 79 44 65 73 6b 2e 65 78 65 10 00 1a 0e 31 38 38 2e 34 30 2e 31 30 34 2e 31 33 35 22 00 22 2c 0a 28 68 74 74 70 73 3a 2f 2f 64 6f 77 6e 6c 6f 61 64 2e 61 6e 79 64 65 73 6b 2e 63 6f 6d 2f 41 6e 79 44 65 73 6b 2e 65 78 65 10 02 2a 9f 2e 0a 9a 2e 0a 85 0e 0a 82 0e 30 82 06 fe 30 82 04 e6 a0 03 02 01 02 02 10 0d bf 15 2d ea f0 b9 81 a8 a9 38 d5 3f 76 9d b8 30 0d 06 09 2a 86 48 86 f7 0d 01 01 0b 05 00 30 69 31 0b Data Ascii: (https://download.anydesk.com/AnyDesk.exe" 38bmESP%(">(https://download.anydesk.com/AnyDesk.exe188.40.104.135"",(https://download.anydesk.com/AnyDesk.exe..00-8?v0H0i1
2023-12-01 15:26:41 UTC	745	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 50 33 50 3a 20 43 50 3d 22 54 68 69 73 20 69 73 20 6e 6f 74 20 61 20 50 33 50 20 70 6f 6c 69 63 79 21 20 53 65 65 20 67 2e 63 6f 2f 70 33 70 68 65 6c 70 20 66 6f 72 20 6d 6f 72 65 20 69 6e 66 6f 2e 22 0d 0a 56 61 72 79 3a 20 4f 72 69 67 69 6e 0d 0a 56 61 72 79 3a 20 58 2d 4f 72 69 67 69 6e 0d 0a 56 61 72 79 3a 20 52 65 66 65 72 65 72 0d 0a 44 61 74 65 3a 20 46 72 69 2c 20 30 31 20 44 65 63 20 32 30 32 33 20 31 35 3a 32 36 3a 34 31 20 47 4d 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 0d 0a 53 65 72 76 65 72 3a 20 45 53 46 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 32 36 31 0d 0a 58 2d 58 53 53 2d 50 72 6f 74 65 63 74 69 6f 6e 3a 20 30 0d 0a 58 2d 46 72 61 6d 65 Data Ascii: HTTP/1.1 200 OKP3P: CP="This is not a P3P policy! See g.co/p3phelp for more info."Vary: OriginVary: X-OriginVary: RefererDate: Fri, 01 Dec 2023 15:26:41 GMTContent-Type: text/htmlServer: ESFContent-Length: 261X-XSS-Protection: 0X-Frame
2023-12-01 15:26:41 UTC	261	IN	Data Raw: 08 00 1a 80 02 30 62 35 37 65 64 31 35 34 36 33 61 38 66 65 61 31 32 63 34 65 38 39 36 31 31 63 32 62 61 62 32 65 36 32 32 30 30 31 32 34 30 35 31 62 31 61 64 33 31 39 64 64 39 38 62 39 66 63 38 61 62 31 63 61 32 63 33 65 61 36 33 33 62 64 30 66 31 61 38 38 62 32 34 33 34 32 31 65 31 66 35 31 38 31 35 32 62 64 37 36 33 37 35 62 61 30 65 37 36 61 36 37 39 36 63 34 64 34 34 34 62 62 30 38 35 33 34 62 61 66 38 37 63 65 64 30 30 62 37 35 35 36 32 39 31 37 65 63 30 31 64 39 37 66 35 62 63 32 63 31 31 38 64 62 39 61 39 33 39 39 31 38 38 38 39 63 34 38 37 65 32 64 62 37 31 30 31 66 61 63 36 39 38 61 33 35 31 64 62 33 66 66 65 64 34 37 62 39 39 30 38 37 62 64 33 30 34 63 33 31 38 64 32 62 66 36 39 38 37 66 62 63 35 38 65 32 33 37 36 61 66 33 32 31 37 65 31 36 30 Data Ascii: 0b57ed15463a8fea12c4e89611c2bab2e62200124051b1ad319dd98b9fc8ab1ca2c3ea633bd0f1a88b243421e1f518152bd76375ba0e76a6796c4d444bb08534baf87ced00b75562917ec01d97f5bc2c118db9a939918889c487e2db7101fac698a351db3ffed47b99087bd304c318d2bf6987fbc58e2376af3217e160